;; Railyard OS-level sandbox profile for Claude Code
;; Wraps the entire Claude Code process + all child processes
;; Usage: sandbox-exec -f this-file.sb -- claude
(version 1)
(deny default)

(allow process-exec)
(allow process-fork)
(allow signal)
(allow sysctl-read)

(allow mach-lookup)
(allow ipc-posix-shm-read-data)
(allow ipc-posix-shm-write-data)

;; Read-only system paths
(allow file-read* (subpath "/usr"))
(allow file-read* (subpath "/bin"))
(allow file-read* (subpath "/sbin"))
(allow file-read* (subpath "/opt/homebrew"))
(allow file-read* (subpath "/Library/Frameworks"))
(allow file-read* (subpath "/System"))
(allow file-read* (subpath "/private/var/db"))
(allow file-read* (subpath "/private/etc"))

(allow file-read* file-write* (subpath "/dev"))

(allow file-read* file-write* (subpath "/tmp"))
(allow file-read* file-write* (subpath "/private/tmp"))
(allow file-read* file-write* (subpath "/Users/arichoudhury/Library/Caches"))

;; Claude Code needs its own config and state
(allow file-read* file-write* (subpath "/Users/arichoudhury/.claude"))
(allow file-read* file-write* (subpath "/Users/arichoudhury/.config"))

;; Development toolchains
(allow file-read* (subpath "/Users/arichoudhury/.cargo"))
(allow file-read* (subpath "/Users/arichoudhury/.rustup"))
(allow file-read* (subpath "/Users/arichoudhury/.nvm"))
(allow file-read* (subpath "/Users/arichoudhury/.bun"))
(allow file-read* (subpath "/Users/arichoudhury/.deno"))
(allow file-read* (subpath "/Users/arichoudhury/.local"))
(allow file-read* file-write* (subpath "/Users/arichoudhury/.cargo/bin"))

;; Project directory (full access)
(allow file-read* file-write* (subpath "/Users/arichoudhury/Workspace/railyard"))

;; Denied paths (sensitive directories)
(deny file-read* file-write* (subpath "/Users/arichoudhury/.ssh"))
(deny file-read* file-write* (subpath "/Users/arichoudhury/.aws"))
(deny file-read* file-write* (subpath "/Users/arichoudhury/.gnupg"))
(deny file-read* file-write* (subpath "/Users/arichoudhury/.config/gcloud"))
(deny file-read* file-write* (subpath "/etc"))

;; Network: allow HTTPS for Anthropic API + package registries
(deny network*)
(allow network-outbound (remote tcp "*:443"))
(allow network-outbound (remote tcp "*:80"))
(allow network-outbound (remote tcp "localhost:*"))
(allow network-inbound (local tcp "localhost:*"))
(allow network-bind (local tcp "localhost:*"))
(allow network-outbound (remote udp "*:53"))
