agent-sandbox

Package claude builds and runs the sandboxed `claude` command: it parses the launcher's arguments, constructs the `nono wrap … claude …` invocation (including the hook settings injected in hook mode), and executes it.

Package policysnapshot persists the sandbox policy (a *config.Config) to a per-session JSON file so hook-mode `agent-sandbox exec` can route from a frozen copy the agent cannot edit, rather than re-reading the mutable agent-sandbox.toml on every command.

Package router routes a command to drop/host/container and executes it, independent of any transport (MCP, CLI).

Package safe holds shared helpers for the "safe" command wrappers.

Package dockercompose validates and runs docker compose invocations safely.

Package git implements the "safe git" wrapper: it parses a git argv and reports known-dangerous invocations so the command layer can refuse them.

Package sandboxhost is the single source of truth for host-access capabilities.

Package sandboxlifecycle decides whether the Docker sandbox needs starting and, when it does, brings it up — reporting whether the caller now owns it.

Package secret resolves and loads secrets referenced from config.

Package shellquote quotes strings as single shell tokens.