From ba31936d70fe71ca6e2efe2e1a139399c0670807 Mon Sep 17 00:00:00 2001
From: kewton <newtons.boiled.clock@gmail.com>
Date: Tue, 13 Oct 2026 20:55:49 +0900
Subject: [PATCH 1/2] feat(tools): block --offline network in the OS sandbox
 and confine dependency setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Issue #658 (stage 3 of #502) adds the network layer and dependency-setup
confinement. New behavior lives in the os_sandbox leaf module; dependency_setup
and lib.rs carry only wiring.

- SandboxPolicy gains `offline` and `dev_server_ports`. The run installs it
  through os_sandbox::install_with, so config.offline reaches the model Bash,
  verifier, and dependency-setup launches; lib.rs passes config.offline and the
  leaf-derived dev-server ports. os_sandbox::install keeps the non-offline
  default for other callers.
- os_sandbox::dev_server_ports derives the allow list (the goal's requested port
  from planner::signals, else the profile default from planner::profile).
- macOS Seatbelt appends an --offline network profile (deny network*, re-allow
  loopback TCP in/out/bind and unix-socket connects); verified against
  sandbox-exec (external connect gives EPERM, loopback and unix sockets work).
- Linux Landlock handles AccessNet::ConnectTcp from ABI4 and re-allows the run's
  dev-server port with a NetPort rule; below ABI4 it records that the network is
  lexical-only in bash_sandbox_status while the write and read layers still
  apply. The network-rights/ABI handling is documented in the module and
  create_ruleset.
- The Python sh -c and npm install launches call os_sandbox::wrap_dependency_setup
  (the leaf seam); required-unavailable fails the setup with the sandbox reason,
  auto runs it outside and the run status records it as not applied.
- tests/issue502_os_sandbox_network.rs drives the network layer and the
  dependency-setup launch, gates ABI4 under CI (fail, not skip), and records the
  kernel/ABI to GITHUB_STEP_SUMMARY like the read test.
- SECURITY.md and both cli-reference pages split the --offline explanation into
  "OS-blocked when the sandbox is applied" and "lexical-only".

判断: the Linux dev-server allow list is derived at run start in the leaf module from the goal's requested port (else the profile default), matching preflight, so a sandboxed command can reach the run's dev server while every other connect is denied.
読み替え: the English --offline/--sandbox table rows stay pinned to the CLI help text by tests/doc_drift.rs, whose source is out of scope, so the rewrite lives in the section prose.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
---
 SECURITY.md                          |  81 ++--
 docs/guide/en/cli-reference.md       |  40 +-
 docs/guide/ja/cli-reference.md       |  13 +-
 src/lib.rs                           |  11 +-
 src/minimal_loop/dependency_setup.rs |  76 +++-
 src/tools/os_sandbox.rs              | 200 +++++++--
 src/tools/os_sandbox/landlock.rs     | 118 +++++-
 src/tools/os_sandbox/seatbelt.rs     |  65 ++-
 tests/issue502_os_sandbox_network.rs | 582 +++++++++++++++++++++++++++
 9 files changed, 1086 insertions(+), 100 deletions(-)
 create mode 100644 tests/issue502_os_sandbox_network.rs

diff --git a/SECURITY.md b/SECURITY.md
index 7a4123e20..4e301ac75 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -16,12 +16,14 @@ execute hostile projects or hostile instructions safely.
   newly created workspace symlinks may not target paths outside that root.
   Lexical inspection cannot prove every indirect effect of an arbitrary
   program, so when an OS sandbox is available it also confines the writes and
-  the home-credential reads performed inside a command or script (see
-  [OS Write and Read Sandbox](#os-write-and-read-sandbox)). Bash is not a
-  complete sandbox: shell commands and invoked programs still run as the current
-  OS user, network is not confined in this stage, read confinement covers the
-  home secret locations rather than every workspace credential on every
-  platform, and the sandbox is absent when the backend is unavailable.
+  the home-credential reads performed inside a command or script, and — only for
+  `--offline` — the network (see
+  [OS Write, Read, and Network Sandbox](#os-write-read-and-network-sandbox)).
+  Bash is not a complete sandbox: shell commands and invoked programs still run
+  as the current OS user, network is confined only for `--offline` and only when
+  the backend is applied, read confinement covers the home secret locations
+  rather than every workspace credential on every platform, and the sandbox is
+  absent when the backend is unavailable.
 
 ## `--allow` and `--yes`
 
@@ -46,18 +48,38 @@ changes. At exit it reports the final tracked/staged diff stat and untracked
 files. The report describes final workspace state and may include changes that
 predated the run.
 
-`--offline` blocks runtime dependency setup plus Bash command families named in
-`--help`. It does not block provider/API requests or arbitrary network-capable
-programs and therefore is not a network sandbox. Network isolation is a later
-stage of #502 and is independent of the write sandbox below.
-
-## OS Write and Read Sandbox
-
-`--sandbox auto|required|off` (default `auto`) adds an OS-level write sandbox and
-a home-credential read sandbox at the two `sh -c` launch points: the model Bash
-tool (the `bash:verify` interval reuses the same function) and the
-verification/acceptance commands. The sandbox is defense in depth; the lexical
-checks still run first and can refuse a command before the shell starts.
+`--offline` has two layers, and they are not the same guarantee.
+
+- OS-blocked, when `--sandbox` applies a backend: outbound network connections
+  are refused by the OS, so an arbitrary program the lexical guard cannot name
+  (`python -c "urllib..."`, `node -e "fetch(...)"`) still cannot leave the
+  machine. macOS (Seatbelt) denies every network operation except loopback TCP
+  and unix sockets. Linux (Landlock ABI4, kernel 6.7) denies every TCP connect
+  except the run's dev-server port(s): Landlock matches the port only, so the
+  same port on an external host still connects and UDP is not restricted, and
+  below ABI4 the network is not confined at all — the `bash_sandbox_status`
+  reason says so. The runtime dependency setup runs inside this same sandbox, so
+  a build backend (`setup.py`, an npm lifecycle script) cannot write outside the
+  workspace.
+- Lexical-only, always: `--offline` refuses runtime dependency setup and the
+  Bash command families named in `--help` (npm/pnpm/yarn/cargo install, curl,
+  wget). These checks do not change when a backend is applied; they still run
+  first. Provider/API requests are CommandAgent's own traffic, outside the
+  sandbox, and remain enabled.
+
+When `--sandbox` is `off` or its backend is unavailable, `--offline` is
+lexical-only: it blocks the named command families but not an arbitrary
+network-capable program.
+
+## OS Write, Read, and Network Sandbox
+
+`--sandbox auto|required|off` (default `auto`) adds an OS-level write sandbox, a
+home-credential read sandbox, and (for `--offline`) a network sandbox at the
+launch points the model can reach: the model Bash tool (the `bash:verify`
+interval reuses the same function), the verification/acceptance commands, and
+the runtime dependency setup (the Python `sh -c` and the `npm install`). The
+sandbox is defense in depth; the lexical checks still run first and can refuse a
+command before the shell starts.
 
 - What the OS closes (when the backend is available): a write performed inside a
   command or script that the lexical guard cannot see — `sh -c 'cp ...'`,
@@ -94,15 +116,20 @@ checks still run first and can refuse a command before the shell starts.
   read on that secret's subtree, so the read layer cannot deny it; the status
   then records that the read isolation is not effective instead of claiming it is
   applied. An empty `HOME` is reported the same way.
-- What remains lexical-only: network access, and every command run while the
-  backend is unavailable. `--allow bash:verify` and `--offline` are lexical
-  policies, so a command they admit can still start a script; only the sandbox
-  (when applied) constrains that script's writes and home-secret reads.
-  - Runtime dependency setup runs outside the sandbox: the setup steps that
-    execute `setup.py`, npm `postinstall`/`prepare` hooks, and similar
-    install-time scripts run before or outside the confined `sh -c` launch
-    points, so the sandbox does not constrain their writes. Confining dependency
-    setup is a later stage (#658).
+- What remains lexical-only: every command run while the backend is
+  unavailable. `--allow bash:verify` and `--offline` are lexical policies, so a
+  command they admit can still start a script; only the sandbox (when applied)
+  constrains that script's writes, home-secret reads, and, for `--offline`,
+  network. The network a non-`--offline` run makes is unchanged (the lexical
+  guard alone applies), and an `--offline` network layer is OS-enforced only
+  when the backend is applied (see the `--offline` section above).
+  - Runtime dependency setup now runs inside the sandbox (Issue #658): the
+    Python `sh -c` (venv and `pip install -e .`, including `setup.py`) and the
+    `npm install` are wrapped like the model Bash launches, so an install-time
+    script cannot write outside the workspace. With `auto` and an unavailable
+    backend the setup runs outside the sandbox as before and the
+    `bash_sandbox_status` record says it is not applied; with `required` it fails
+    honestly.
   - A hardlink that already exists in the workspace before the run and points at
     an inode outside the workspace can still be written through. Seatbelt decides
     by path, so it allows writing the workspace path even though the inode lives
diff --git a/docs/guide/en/cli-reference.md b/docs/guide/en/cli-reference.md
index a14298c11..435f3c1a1 100644
--- a/docs/guide/en/cli-reference.md
+++ b/docs/guide/en/cli-reference.md
@@ -78,8 +78,8 @@ internal integration surface and is intentionally not a public user flag.
 | `--profile` | `<PROFILE>` | inferred, then `generic` | Set a compiled profile or an external draft ID. An external ID requires the extension root that declares `profiles/<id>/manifest.toml`. | [Profile inference](slash-commands.md#profile-inference) |
 | `--style` | `<STYLE>` | `default` | Pass the plan presentation/generation style. | [Inline flags](slash-commands.md#inline-flags) |
 | `--resume` | `<RESUME>` | none | Load the named saved minimal-loop session for a direct `--prompt` run. | [Session options](#conflicts-and-combinations) |
-| `--offline` | none | off | Block runtime dependency setup and Bash commands containing npm/pnpm/yarn/cargo install, curl, or wget. Provider/API requests and other network-capable commands are unaffected. | [Providers](providers.md) |
-| `--sandbox` | `<auto\|required\|off>` | `auto` | Select the OS write sandbox for Bash and verifier commands. `auto` applies it when the backend is available and otherwise continues with lexical checks only; `required` fails those commands when the backend is unavailable; `off` keeps the previous behavior. | [OS write and read sandbox](#os-write-and-read-sandbox) |
+| `--offline` | none | off | Block runtime dependency setup and Bash commands containing npm/pnpm/yarn/cargo install, curl, or wget. Provider/API requests and other network-capable commands are unaffected. | [OS write, read, and network sandbox](#os-write-read-and-network-sandbox) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | Select the OS write sandbox for Bash and verifier commands. `auto` applies it when the backend is available and otherwise continues with lexical checks only; `required` fails those commands when the backend is unavailable; `off` keeps the previous behavior. | [OS write, read, and network sandbox](#os-write-read-and-network-sandbox) |
 | `--quiet` | none | off (`narration = "normal"`) | Suppress presentation narration. | [Top-level keys](configuration.md#top-level-keys) |
 | `--summary-json` | none | off | Append one machine-readable terminal run summary as the final stdout line. Omitting it preserves existing stdout bytes. | [Headless execution](../../user/headless.md) |
 | `--trace` | none | off | Opt in to scrubbed provider request and response traces under the active run directory. | [Troubleshooting](troubleshooting.md) |
@@ -98,16 +98,19 @@ internal integration surface and is intentionally not a public user flag.
 | `--footer` | `<on\|off>` | `on` | Control the fixed TUI footer; off keeps scrollback breadcrumbs. | [Footer problems](troubleshooting.md#footer-rendering-problems) |
 | `--no-footer` | none | off | Disable the fixed TUI footer. Equivalent in effect to `--footer off`. | [Footer problems](troubleshooting.md#footer-rendering-problems) |
 
-## OS write and read sandbox
+## OS write, read, and network sandbox
 
 The `--sandbox auto|required|off` flag (default `auto`) controls an OS-level
-write sandbox and a home-credential read sandbox for the model Bash tool and for
-verification/acceptance commands. The lexical checks still run first; the
-sandbox adds confinement for writes and reads the lexical guard cannot see.
+write sandbox, a home-credential read sandbox, and (for `--offline`) a network
+sandbox for the model Bash tool, verification/acceptance commands, and the
+runtime dependency setup (the Python `sh -c` and the `npm install`). The lexical
+checks still run first; the sandbox adds confinement for the writes, reads, and
+(with `--offline`) network the lexical guard cannot see.
 
 - **What the OS closes (when the backend is available):** writes performed inside
   a command or script — `sh -c 'cp ...'`, `eval`, `xargs`, `find -exec`, an
-  interpreter's `open(..., 'w')`, `dd of=`, `sed -i` — and hardlinks to an inode
+  interpreter's `open(..., 'w')`, `dd of=`, `sed -i`, and an install-time script
+  such as `setup.py` or an npm lifecycle script — and hardlinks to an inode
   outside the workspace. Only the workspace, the run's temp directory, the known
   dependency caches, and device files such as `/dev/null` are writable.
 - **Read confinement:** reading the home secret locations (`.ssh`, `.aws`,
@@ -128,12 +131,23 @@ sandbox adds confinement for writes and reads the lexical guard cannot see.
   read layer cannot deny those secrets, and the status says the read isolation is
   not effective instead of claiming it is applied; an empty `HOME` is reported
   the same way.
-- **What stays lexical-only:** network access, and every command run when the
-  backend is unavailable. `--yes`, `--allow bash:verify`, and `--offline` do not
-  close an indirect write or a home-secret read by themselves; only the sandbox,
-  when applied, does. `--allow bash:verify` admits a command by its
-  classification only, so the contents of any script it invokes are limited by
-  the sandbox alone.
+- **Network (`--offline` only):** when the backend is applied, an `--offline`
+  run has its outbound connections refused by the OS, so an arbitrary program the
+  lexical guard cannot name (`python -c "urllib..."`, `node -e "fetch(...)"`)
+  cannot reach the network. macOS denies every network operation except loopback
+  TCP and unix sockets. Linux (Landlock ABI4, kernel 6.7) denies every TCP
+  connect except the run's dev-server port(s): Landlock matches the port only, so
+  the same port on an external host still connects and UDP is not restricted, and
+  below ABI4 the network is not confined — the `bash_sandbox_status` reason says
+  so. A run that is not `--offline` is unchanged.
+- **What stays lexical-only:** every command run when the backend is unavailable.
+  `--yes`, `--allow bash:verify`, and `--offline` do not close an indirect write
+  or a home-secret read by themselves; only the sandbox, when applied, does.
+  `--allow bash:verify` admits a command by its classification only, so the
+  contents of any script it invokes are limited by the sandbox alone. With `auto`
+  and an unavailable backend the dependency setup runs outside the sandbox as
+  before and the status records it as not applied; with `required` it fails
+  honestly.
 - **Modes:** `auto` uses the backend when available and otherwise warns once and
   records `bash_sandbox_status` with `applied=false` and a reason, continuing
   with lexical checks only; `required` fails Bash and verifier commands with
diff --git a/docs/guide/ja/cli-reference.md b/docs/guide/ja/cli-reference.md
index 9e3e440a7..151d0a7a1 100644
--- a/docs/guide/ja/cli-reference.md
+++ b/docs/guide/ja/cli-reference.md
@@ -77,8 +77,8 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 | `--profile` | `<PROFILE>` | 推論後に `generic` | 組み込み profile または外部 draft ID を明示します。外部 ID には `profiles/<id>/manifest.toml` を宣言する extension root が必要です。 | [プロファイル推論](slash-commands.md#プロファイル推論) |
 | `--style` | `<STYLE>` | `default` | plan の表示／生成スタイルを渡します。 | [インラインフラグ](slash-commands.md#インラインフラグ) |
 | `--resume` | `<RESUME>` | なし | 直接 `--prompt` 実行で、指定した保存済み minimal-loop セッションを読み込みます。 | [セッションオプション](#排他関係と組み合わせ) |
-| `--offline` | なし | オフ | runtime の依存関係セットアップと、npm/pnpm/yarn/cargo install、curl、wget を含む Bash コマンドを禁止します。provider/API 要求とその他のネットワーク可能なコマンドには影響しません。 | [プロバイダ](providers.md) |
-| `--sandbox` | `<auto\|required\|off>` | `auto` | モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを選びます。`auto` は backend が使えれば適用し、使えなければ字句検査だけで続けます。`required` は backend が使えないときに対象コマンドを失敗させます。`off` は今までの挙動を保ちます。 | [OS 書き込み・読み取りサンドボックス](#os-書き込み読み取りサンドボックス) |
+| `--offline` | なし | オフ | `--sandbox` が backend を適用するときは外向きの通信を OS で拒否し、常に runtime の依存関係セットアップと、npm/pnpm/yarn/cargo install、curl、wget を含む Bash コマンドを禁止します。provider/API 要求と `--offline` でない run には影響しません。 | [OS 書き込み・読み取り・ネットワークサンドボックス](#os-書き込み読み取りネットワークサンドボックス) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | モデルの Bash ツール・検証・受け入れコマンド・依存関係セットアップに対する OS レベルの書き込み・読み取り・（`--offline` のとき）ネットワークのサンドボックスを選びます。`auto` は backend が使えれば適用し、使えなければ字句検査だけで続けます。`required` は backend が使えないときに対象コマンドを失敗させます。`off` は今までの挙動を保ちます。 | [OS 書き込み・読み取り・ネットワークサンドボックス](#os-書き込み読み取りネットワークサンドボックス) |
 | `--quiet` | なし | オフ（`narration = "normal"`） | プレゼンテーションのナレーションを抑制します。 | [トップレベルキー](configuration.md#トップレベルキー) |
 | `--summary-json` | なし | オフ | stdout 最終行へ機械可読な終端runサマリを1件追加します。省略時は既存stdout bytesを維持します。 | [Headless execution](../../user/headless.md) |
 | `--trace` | なし | オフ | active run の `trace/` directory に scrub 済み provider exchange を opt-in 保存します。 | [トラブルシューティング](troubleshooting.md) |
@@ -97,13 +97,14 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 | `--footer` | `<on\|off>` | `on` | 固定 TUI フッターを制御します。off でもスクロールバックの breadcrumb は残ります。 | [フッターの問題](troubleshooting.md#フッター描画の問題) |
 | `--no-footer` | なし | オフ | 固定 TUI フッターを無効にします。効果は `--footer off` と同じです。 | [フッターの問題](troubleshooting.md#フッター描画の問題) |
 
-## OS 書き込み・読み取りサンドボックス
+## OS 書き込み・読み取り・ネットワークサンドボックス
 
-フラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスと、home の資格情報の読み取りサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込みと読み取りを閉じ込めます。
+フラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツール・検証・受け入れコマンド・依存関係セットアップ（Python の `sh -c` と `npm install`）に対する OS レベルの書き込みサンドボックスと、home の資格情報の読み取りサンドボックス、`--offline` のときのネットワークのサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込み・読み取り・（`--offline` のとき）ネットワークを閉じ込めます。
 
-- **OS が閉じるもの（backend が使えるとき）：** コマンドやスクリプトの中の書き込み — `sh -c 'cp ...'`、`eval`、`xargs`、`find -exec`、インタープリタの `open(..., 'w')`、`dd of=`、`sed -i` — と、workspace の外の inode への hardlink です。書き込めるのは、workspace・run の一時ディレクトリ・既知の依存キャッシュ・`/dev/null` などのデバイスだけです。
+- **OS が閉じるもの（backend が使えるとき）：** コマンドやスクリプトの中の書き込み — `sh -c 'cp ...'`、`eval`、`xargs`、`find -exec`、インタープリタの `open(..., 'w')`、`dd of=`、`sed -i`、`setup.py` や npm の lifecycle script のようなインストール時のスクリプト — と、workspace の外の inode への hardlink です。書き込めるのは、workspace・run の一時ディレクトリ・既知の依存キャッシュ・`/dev/null` などのデバイスだけです。
 - **読み取りの隔離：** home の秘密の場所（`.ssh`・`.aws`・`.gnupg`・`.netrc`・`.git-credentials`・`.npmrc`・`.pypirc`・`.docker/config.json`・`.kube`・`.config/gh`・`.config/gcloud`）の読み取りを拒否し、macOS では #501 の規則に当たる workspace の資格情報も拒否します。厳密な dotenv テンプレート（`.env.example`・`.env.sample`・`.env.template`）は読めます。これにより、秘密でない名前の symlink 経由、`BASH_ENV` のような環境変数で名指す形、インタープリタが実行時に組み立てた名前が拒否一覧の名前そのものを指す場合など、字句検査から見えない読み取りを閉じます。Linux では home の秘密の場所だけを拒否するため、秘密でない名前の symlink 経由の workspace の資格情報は読み取りの隔離では閉じません。home の npm の設定を拒否するため、private registry の `~/.npmrc` を読む `npm` は Bash の中で失敗します。Linux は拒否リストをコマンドの起動ごとに読み取り許可リストへ展開し直すため、起動の後にできた場所はそのコマンドの中では読めません（`ls /`・`ls $HOME`・`echo $HOME/*` は意図どおり失敗します）。書き込みの許可の場所（たとえば workspace）が home そのものか home の秘密の場所の祖先のときは、書き込みの許可がその秘密の場所の下位も読ませるため読み取りでは閉じられず、status は適用と偽らず「読み取りの隔離が効かない」と記録します。HOME が空のときも同じです。
-- **字句検査だけのもの：** ネットワーク、backend が使えないときの全コマンドです。`--yes`・`--allow bash:verify`・`--offline` は、それ自体では間接的な書き込みや home の秘密の読み取りを閉じません。適用されたサンドボックスだけが閉じます。`--allow bash:verify` はコマンドを分類で通すだけなので、そのコマンドが呼ぶスクリプトの中身を制限するのはサンドボックスだけです。
+- **ネットワーク（`--offline` のときだけ）：** backend が適用されているとき、`--offline` の run は外向きの接続を OS が拒否するため、字句検査が名指しできない任意のプログラム（`python -c "urllib..."`、`node -e "fetch(...)"`）はネットワークに出られません。macOS は loopback の TCP と unix socket 以外のネットワーク操作をすべて拒否します。Linux（Landlock ABI4、kernel 6.7）は run の dev server の port 以外の TCP の connect をすべて拒否します。Landlock は port しか区別しないため同じ port の外部ホストへは通り、UDP は制限できず、ABI4 未満ではネットワークを閉じ込めません（`bash_sandbox_status` の reason にそう書きます）。`--offline` でない run のネットワークは変わりません。
+- **字句検査だけのもの：** backend が使えないときの全コマンドです。`--yes`・`--allow bash:verify`・`--offline` は、それ自体では間接的な書き込みや home の秘密の読み取りを閉じません。適用されたサンドボックスだけが閉じます。`--allow bash:verify` はコマンドを分類で通すだけなので、そのコマンドが呼ぶスクリプトの中身を制限するのはサンドボックスだけです。`auto` で backend が使えないときは依存関係セットアップもこれまでどおり隔離の外で動き、status が未適用と記録します。`required` では正直に失敗します。
 - **モード：** `auto` は backend が使えれば適用し、使えなければ起動時に一度警告し、`applied=false` と理由つきの `bash_sandbox_status` を記録して字句検査だけで続けます。`required` は Bash と検証コマンドを `bash_sandbox_unavailable` で失敗させます。`off` は今までの挙動を保ちます。読み取りの隔離は同じイベントの `reason` で報告します（適用中は read isolation を名指し、完全に閉じている場合は空です）。macOS は Seatbelt で、入れ子の sandbox（`rc=71`）では未適用です。Linux は Landlock で、ABI1（kernel 5.13）未満・無効化・seccomp による拒否では未適用です。
 - 依存キャッシュ（cargo・npm・pip・Playwright のブラウザ）はビルドとテストのために書き込み可能なままにします。workspace の外の汚染経路として残ります。
 
diff --git a/src/lib.rs b/src/lib.rs
index ca1eb3fbc..10dbba077 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -137,7 +137,16 @@ pub fn run_with_provider_options(
     // its per-run temp directory; read-only actions must not create one. The
     // guard removes the run temp directory on every exit path.
     let _sandbox_cleanup = action_uses_write_sandbox(&config.action).then(|| {
-        tools::os_sandbox::install(sandbox_mode, &config.workspace_root, &config.state_dir);
+        tools::os_sandbox::install_with(
+            sandbox_mode,
+            &config.workspace_root,
+            &config.state_dir,
+            config.offline,
+            tools::os_sandbox::dev_server_ports(
+                &config.profile,
+                crate::config::action_goal(&config.action),
+            ),
+        );
         if let Some(warning) = tools::os_sandbox::startup_warning() {
             eprintln!("{warning}");
         }
diff --git a/src/minimal_loop/dependency_setup.rs b/src/minimal_loop/dependency_setup.rs
index eb2cf3557..171e6002b 100644
--- a/src/minimal_loop/dependency_setup.rs
+++ b/src/minimal_loop/dependency_setup.rs
@@ -661,7 +661,10 @@ pub fn run_node_dependency_setup(
     run_node_dependency_setup_with_program(root, requirement, Path::new("npm"))
 }
 
-pub(crate) fn run_node_dependency_setup_with_program(
+/// Run the Node dependency setup with an explicit npm program. Public so an
+/// integration test can drive the launch with a fake npm and measure the OS
+/// sandbox of Issue #658 without a network install.
+pub fn run_node_dependency_setup_with_program(
     root: &Path,
     requirement: &NodeDependencySetupRequirement,
     npm_program: &Path,
@@ -750,9 +753,24 @@ fn run_node_dependency_setup_with_program_timeout_and_offline(
     command
         .args(["install", "--ignore-scripts"])
         .current_dir(root)
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
+        .stdin(Stdio::null());
+    // Issue #658: run the install inside the stage-1 OS sandbox, so a build
+    // backend or lifecycle script cannot write outside the workspace. Standard
+    // I/O is set after the wrap because the wrap does not transfer it.
+    let mut command = match crate::tools::os_sandbox::wrap_dependency_setup(command) {
+        Ok(command) => command,
+        Err(refusal) => {
+            return sandbox_refused_observation(
+                requirement,
+                "npm install --ignore-scripts".to_string(),
+                refusal.summary(),
+                started,
+                timeout,
+                Some(before_lock),
+            );
+        }
+    };
+    command.stdout(Stdio::piped()).stderr(Stdio::piped());
     let output = match bounded_process::run_with_timeout(&mut command, timeout) {
         Ok(output) => output,
         Err(err) => {
@@ -899,6 +917,36 @@ fn setup_dependency_label_ready(root: &Path, path: &str) -> bool {
     false
 }
 
+/// The honest failure for a `required` run whose OS backend is unavailable
+/// (Issue #658): the dependency setup is refused rather than run unconfined. The
+/// reason is the sandbox refusal summary, so the existing observation and its
+/// primary reason name the unavailability without a new status value or event.
+fn sandbox_refused_observation(
+    requirement: &NodeDependencySetupRequirement,
+    command: String,
+    reason: String,
+    started: Instant,
+    timeout: Duration,
+    lockfile_before: Option<bool>,
+) -> NodeDependencySetupObservation {
+    NodeDependencySetupObservation {
+        status: NodeDependencySetupStatus::Failed,
+        setup_kind: requirement.setup_kind,
+        package_manager: requirement.package_manager,
+        authority: requirement.setup_authority,
+        attempted: true,
+        command,
+        primary_reason: reason,
+        output_snippet: String::new(),
+        changed_paths: Vec::new(),
+        duration_ms: Some(started.elapsed().as_millis()),
+        timeout_ms: Some(timeout.as_millis()),
+        lockfile_present_before: lockfile_before,
+        lockfile_present_after: lockfile_before,
+        lockfile_created: lockfile_before.map(|_| false),
+    }
+}
+
 fn run_python_cli_dependency_setup(
     root: &Path,
     requirement: &NodeDependencySetupRequirement,
@@ -913,9 +961,23 @@ fn run_python_cli_dependency_setup(
         .arg("-c")
         .arg(&command_text)
         .current_dir(root)
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
+        .stdin(Stdio::null());
+    // Issue #658: the pip build backend is arbitrary code, so run the setup
+    // inside the stage-1 OS sandbox and keep its writes in the workspace.
+    let mut command = match crate::tools::os_sandbox::wrap_dependency_setup(command) {
+        Ok(command) => command,
+        Err(refusal) => {
+            return sandbox_refused_observation(
+                requirement,
+                command_text.clone(),
+                refusal.summary(),
+                started,
+                timeout,
+                None,
+            );
+        }
+    };
+    command.stdout(Stdio::piped()).stderr(Stdio::piped());
     let output = match bounded_process::run_with_timeout(&mut command, timeout) {
         Ok(output) => output,
         Err(err) => {
diff --git a/src/tools/os_sandbox.rs b/src/tools/os_sandbox.rs
index 705f226de..9bc7699a7 100644
--- a/src/tools/os_sandbox.rs
+++ b/src/tools/os_sandbox.rs
@@ -1,12 +1,14 @@
-//! OS write and read sandbox for model Bash and verifier commands (Issues #655
-//! and #657).
+//! OS write, read, and (for `--offline`) network sandbox for model Bash,
+//! verifier, and dependency-setup commands (Issues #655, #657, and #658).
 //!
 //! This is the common leaf module of the #502 confinement track. It wraps the
 //! `sh -c` launch point of the model Bash tool (including the `bash:verify`
-//! interval, which reuses the same function) and of verifier commands, so an
-//! indirect write the lexical guard cannot see still fails, and since #657 an
-//! indirect read of a home secret location (or, on macOS, a workspace
-//! credential) fails as well, when the OS backend is available.
+//! interval, which reuses the same function), of verifier commands, and of the
+//! dependency-setup launches, so an indirect write the lexical guard cannot see
+//! still fails, and since #657 an indirect read of a home secret location (or,
+//! on macOS, a workspace credential) fails as well, when the OS backend is
+//! available. Since #658 an `--offline` run also blocks outbound network, so an
+//! arbitrary program the lexical guard cannot name cannot reach the network.
 //!
 //! Design (issues #655 and #657, decisions from #502):
 //! - The backend writes a fixed profile; locations travel only through `-D`
@@ -97,8 +99,9 @@ pub enum SandboxAvailability {
     Unavailable(String),
 }
 
-/// The resolved write-allow list, the run temp directory, and the home whose
-/// secret locations are denied for reading (Issue #657).
+/// The resolved write-allow list, the run temp directory, the home whose secret
+/// locations are denied for reading (Issue #657), and the network layer of
+/// Issue #658.
 #[derive(Debug, Clone)]
 pub struct SandboxPolicy {
     pub workspace_root: PathBuf,
@@ -107,11 +110,22 @@ pub struct SandboxPolicy {
     /// The home whose secret locations the read backend denies. Resolved from
     /// `HOME`; tests pass an explicit tempdir so they never touch the real home.
     pub home: PathBuf,
+    /// Whether the run was started with `--offline` (Issue #658). When true the
+    /// backend also blocks outbound network — macOS confines it to loopback and
+    /// unix sockets, Linux (ABI4) to the dev-server ports — so an arbitrary
+    /// program the lexical guard cannot name still cannot reach the network.
+    /// When false the network is unchanged, exactly as before this stage.
+    pub offline: bool,
+    /// The TCP ports an `--offline` run still allows a `connect` to (Linux ABI4,
+    /// Issue #658), so a dev server started outside the sandbox stays reachable
+    /// while every other destination is refused. macOS allows all of loopback
+    /// and ignores this list. Empty by default; `install` does not populate it.
+    pub dev_server_ports: Vec<u16>,
 }
 
 impl SandboxPolicy {
     /// Build a policy whose cache locations and read-deny home are resolved from
-    /// `HOME`.
+    /// `HOME`. The network layer is off, so the network is unchanged.
     pub fn new(workspace_root: &Path, run_tmp_dir: &Path) -> Self {
         Self::with_home(workspace_root, run_tmp_dir, home_dir())
     }
@@ -124,8 +138,23 @@ impl SandboxPolicy {
             run_tmp_dir: run_tmp_dir.to_path_buf(),
             caches: resolve_cache_paths(&home),
             home,
+            offline: false,
+            dev_server_ports: Vec::new(),
         }
     }
+
+    /// Set whether the run is `--offline`, so the backend blocks outbound
+    /// network. Off by default.
+    pub fn with_offline(mut self, offline: bool) -> Self {
+        self.offline = offline;
+        self
+    }
+
+    /// Set the TCP ports an `--offline` run leaves connectable (Linux ABI4).
+    pub fn with_dev_server_ports(mut self, ports: impl IntoIterator<Item = u16>) -> Self {
+        self.dev_server_ports = ports.into_iter().collect();
+        self
+    }
 }
 
 /// The process home, or an empty path when `HOME` is unset. An empty home makes
@@ -288,21 +317,35 @@ fn read_isolation(_policy: Option<&SandboxPolicy>) -> ReadIsolation {
 }
 
 /// The note recorded in the `bash_sandbox_status` reason while the sandbox is
-/// applied. On Linux it names the write operations an older ABI cannot close and
-/// the read-isolation clause; a fully closed ABI with effective reads has no
-/// note (`None`), which the event reads as fully confined. On other platforms it
-/// names the read-isolation clause.
-fn backend_note(read: &ReadIsolation) -> Option<String> {
+/// applied. On Linux it names the write operations an older ABI cannot close,
+/// the network-isolation clause of Issue #658 when `--offline` cannot be
+/// enforced (no ABI4), and the read-isolation clause; a fully closed ABI with
+/// effective reads and an enforced network has no note (`None`), which the event
+/// reads as fully confined. On other platforms it names the read-isolation
+/// clause. macOS enforces the network layer inside Seatbelt, so it has no
+/// network clause.
+fn backend_note(read: &ReadIsolation, offline: bool) -> Option<String> {
     #[cfg(target_os = "linux")]
     {
-        match landlock::limitation_note() {
-            Some(note) => Some(format!("{note}; {}", read.clause)),
-            None if read.effective => None,
-            None => Some(read.clause.clone()),
+        let mut parts = Vec::new();
+        if let Some(note) = landlock::limitation_note() {
+            parts.push(note);
+        }
+        if let Some(note) = landlock::network_limitation_note(offline) {
+            parts.push(note);
+        }
+        if !read.effective {
+            parts.push(read.clause.clone());
+        }
+        if parts.is_empty() {
+            None
+        } else {
+            Some(parts.join("; "))
         }
     }
     #[cfg(not(target_os = "linux"))]
     {
+        let _ = offline;
         Some(read.clause.clone())
     }
 }
@@ -326,20 +369,38 @@ pub fn probe() -> SandboxAvailability {
 }
 
 /// Install the process-wide sandbox state for a run and create its temp
-/// directory. Returns the status recorded in `bash_sandbox_status`.
+/// directory, without the `--offline` network layer. Returns the status recorded
+/// in `bash_sandbox_status`.
 ///
 /// In a unit-test build this is a no-op: many lib tests run in one process and
 /// must not observe each other's process-wide state. Integration tests compile
 /// the library without `cfg(test)` and exercise the real install, and the
 /// `install_for_test` seam drives the explicit states.
 pub fn install(mode: SandboxMode, workspace_root: &Path, state_dir: &Path) -> SandboxStatus {
+    install_with(mode, workspace_root, state_dir, false, Vec::new())
+}
+
+/// [`install`] with the run's `--offline` network layer of Issue #658.
+///
+/// `offline` is the run's `--offline` flag, so the backend also blocks outbound
+/// network. `dev_server_ports` is the set of TCP ports an `--offline` run still
+/// allows a `connect` to (Linux ABI4), so the run's dev server stays reachable;
+/// macOS confines the network to loopback and ignores the list. Both defaults
+/// keep the network unchanged.
+pub fn install_with(
+    mode: SandboxMode,
+    workspace_root: &Path,
+    state_dir: &Path,
+    offline: bool,
+    dev_server_ports: Vec<u16>,
+) -> SandboxStatus {
     #[cfg(not(test))]
     {
-        install_impl(mode, workspace_root, state_dir)
+        install_impl(mode, workspace_root, state_dir, offline, dev_server_ports)
     }
     #[cfg(test)]
     {
-        let _ = (workspace_root, state_dir);
+        let _ = (workspace_root, state_dir, offline, dev_server_ports);
         SandboxStatus {
             mode,
             backend: backend_name(),
@@ -350,8 +411,33 @@ pub fn install(mode: SandboxMode, workspace_root: &Path, state_dir: &Path) -> Sa
     }
 }
 
+/// The TCP port(s) an `--offline` run leaves connectable (Issue #658).
+///
+/// Landlock (ABI4) is port-scoped and cannot tell addresses apart, so the run's
+/// dev-server port must be re-allowed for a sandboxed command to reach it. The
+/// port is derived the same way preflight derives it — the port named in the
+/// goal, otherwise the profile default — so the allow list matches the port the
+/// run actually uses. macOS confines the network to loopback and ignores the
+/// list; an empty list leaves the network fully denied.
+pub fn dev_server_ports(profile: &str, goal: Option<&str>) -> Vec<u16> {
+    let goal_port = goal.and_then(crate::planner::signals::requested_port_from_text);
+    let default_port =
+        crate::planner::profile::resolve_profile_runtime(profile).default_requested_port();
+    match (goal_port, default_port) {
+        (Some(port), _) => vec![port],
+        (None, Some(default)) => vec![default],
+        (None, None) => Vec::new(),
+    }
+}
+
 #[cfg(not(test))]
-fn install_impl(mode: SandboxMode, workspace_root: &Path, state_dir: &Path) -> SandboxStatus {
+fn install_impl(
+    mode: SandboxMode,
+    workspace_root: &Path,
+    state_dir: &Path,
+    offline: bool,
+    dev_server_ports: Vec<u16>,
+) -> SandboxStatus {
     let run_tmp_dir = state_dir
         .join("sandbox")
         .join(format!("run-{}", uuid::Uuid::now_v7()));
@@ -360,7 +446,9 @@ fn install_impl(mode: SandboxMode, workspace_root: &Path, state_dir: &Path) -> S
             SandboxAvailability::Unavailable(format!("run temp directory is unavailable: {err}"));
         return store(mode, None, availability);
     }
-    let policy = SandboxPolicy::new(workspace_root, &run_tmp_dir);
+    let policy = SandboxPolicy::new(workspace_root, &run_tmp_dir)
+        .with_offline(offline)
+        .with_dev_server_ports(dev_server_ports);
     let availability = if mode.uses_backend() {
         probe()
     } else {
@@ -428,11 +516,12 @@ fn reconcile_workspace_impl(workspace_root: &Path) -> Option<SandboxStatus> {
         )
     };
     let read = read_isolation(policy.as_ref());
+    let offline = policy.as_ref().is_some_and(|policy| policy.offline);
     if !mismatched || !mode.uses_backend() {
         return Some(SandboxStatus::from_parts(
             mode,
             &availability,
-            backend_note(&read),
+            backend_note(&read, offline),
             read.effective,
         ));
     }
@@ -442,7 +531,7 @@ fn reconcile_workspace_impl(workspace_root: &Path) -> Option<SandboxStatus> {
         return Some(SandboxStatus::from_parts(
             mode,
             &availability,
-            backend_note(&read),
+            backend_note(&read, offline),
             read.effective,
         ));
     }
@@ -462,8 +551,13 @@ fn store(
     availability: SandboxAvailability,
 ) -> SandboxStatus {
     let read = read_isolation(policy.as_ref());
-    let status =
-        SandboxStatus::from_parts(mode, &availability, backend_note(&read), read.effective);
+    let offline = policy.as_ref().is_some_and(|policy| policy.offline);
+    let status = SandboxStatus::from_parts(
+        mode,
+        &availability,
+        backend_note(&read, offline),
+        read.effective,
+    );
     let mut installed = INSTALLED.lock().expect("sandbox state");
     *installed = Some(Installed {
         policy,
@@ -539,10 +633,14 @@ pub fn status() -> Option<SandboxStatus> {
     let installed = INSTALLED.lock().expect("sandbox state");
     installed.as_ref().map(|installed| {
         let read = read_isolation(installed.policy.as_ref());
+        let offline = installed
+            .policy
+            .as_ref()
+            .is_some_and(|policy| policy.offline);
         SandboxStatus::from_parts(
             installed.mode,
             &installed.availability,
-            backend_note(&read),
+            backend_note(&read, offline),
             read.effective,
         )
     })
@@ -617,6 +715,30 @@ pub fn wrap_command(command: Command) -> Result<Command, SandboxRefusal> {
     }
 }
 
+/// Wrap a runtime dependency-setup launch in the OS sandbox (Issue #658).
+///
+/// The Python `sh -c` (venv and `pip install -e .`, including `setup.py`) and
+/// the `npm install` run through here, so an install-time script cannot write
+/// outside the workspace and an `--offline` run cannot reach the network. `Err`
+/// is the `required` refusal when the backend is unavailable; `auto` and `off`
+/// return the command unchanged (unwrapped when the backend is unavailable), so
+/// `auto` keeps running the setup outside the sandbox and the run status records
+/// it as not applied.
+///
+/// In a unit-test build this is a no-op: many lib tests run in one process and
+/// must not observe each other's process-wide sandbox state. Integration tests
+/// compile the library without `cfg(test)` and exercise the real wrap.
+pub fn wrap_dependency_setup(command: Command) -> Result<Command, SandboxRefusal> {
+    #[cfg(not(test))]
+    {
+        wrap_command(command)
+    }
+    #[cfg(test)]
+    {
+        Ok(command)
+    }
+}
+
 fn apply_backend(
     command: Command,
     policy: &SandboxPolicy,
@@ -684,12 +806,34 @@ mod tests {
     /// The installed state is process-wide, so these tests serialize.
     static SANDBOX_TEST_LOCK: Mutex<()> = Mutex::new(());
 
+    /// Issue #658: the `--offline` dev-server allow list is the port the run
+    /// will use — the goal's port, else the profile default — so a sandboxed
+    /// command can reach the dev server on Linux (ABI4) while every other
+    /// connect is denied. macOS ignores the list.
+    #[test]
+    fn dev_server_ports_follow_the_goal_then_the_profile_default() {
+        assert_eq!(
+            dev_server_ports("generic", Some("serve the app on port 4000")),
+            vec![4000]
+        );
+        assert_eq!(
+            dev_server_ports("generic", Some("serve the app")),
+            Vec::<u16>::new()
+        );
+        assert_eq!(
+            dev_server_ports("nextjs", Some("build a landing page")),
+            vec![crate::planner::profiles::nextjs::DEFAULT_REQUESTED_PORT]
+        );
+    }
+
     fn policy() -> SandboxPolicy {
         SandboxPolicy {
             workspace_root: PathBuf::from("/tmp/os-sandbox-test-work"),
             run_tmp_dir: PathBuf::from("/tmp/os-sandbox-test-tmp"),
             caches: CachePaths::default(),
             home: PathBuf::from("/tmp/os-sandbox-test-home"),
+            offline: false,
+            dev_server_ports: Vec::new(),
         }
     }
 
diff --git a/src/tools/os_sandbox/landlock.rs b/src/tools/os_sandbox/landlock.rs
index ecb04c486..9a39862ed 100644
--- a/src/tools/os_sandbox/landlock.rs
+++ b/src/tools/os_sandbox/landlock.rs
@@ -1,5 +1,5 @@
 //! Linux Landlock backend (Issue #656, stage 1b; read isolation in Issue #657,
-//! stage 2).
+//! stage 2; offline network confinement in Issue #658, stage 3).
 //!
 //! Confines the writes and, since #657, the reads of model Bash and verifier
 //! commands with Landlock. The ruleset and every allowed-location file
@@ -7,7 +7,7 @@
 //! `prctl(PR_SET_NO_NEW_PRIVS)` and `landlock_restrict_self`, so no work that
 //! could allocate, lock, or log happens between `fork` and `exec`.
 //!
-//! Design (issues #656 and #657, decisions from #502):
+//! Design (issues #656, #657, and #658, decisions from #502):
 //! - ABI1 (kernel 5.13) is required. ABI2 (`refer`, link/rename across
 //!   directories) and ABI3 (`truncate`) are used best-effort; when they are
 //!   missing the still-open operations are named in the `bash_sandbox_status`
@@ -26,7 +26,16 @@
 //!   ([`expand_read_allow`]): Landlock cannot deny part of an allowed tree, so
 //!   the home secret locations are expressed by allowing the siblings that do
 //!   not contain them.
-//! - Network is not handled, so it stays unchanged.
+//! - Network confinement of Issue #658 is only for an `--offline` run and only
+//!   from ABI4 (kernel 6.7): `AccessNet::ConnectTcp` is handled, which denies
+//!   every TCP connect, and a [`NetPort`] rule re-allows the dev-server ports.
+//!   Landlock cannot tell addresses apart and cannot restrict UDP, so an
+//!   `--offline` run can still reach the same port on an external host and any
+//!   UDP destination; both limitations are recorded in `bash_sandbox_status`.
+//!   Without ABI4 the network is left unchanged and the event names the gap
+//!   ([`network_limitation_note`]).
+//! - A non-`--offline` run handles no network access, so its network is exactly
+//!   as before this stage.
 //! - Availability is probed once at run start from the Landlock ABI query and a
 //!   child `restrict_self`, so a seccomp filter that denies either syscall is an
 //!   honest "unavailable" instead of a silent pass.
@@ -40,8 +49,8 @@ use std::sync::OnceLock;
 use std::time::Duration;
 
 use landlock::{
-    ABI, Access, AccessFs, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetCreatedAttr,
-    path_beneath_rules,
+    ABI, Access, AccessFs, AccessNet, CompatLevel, Compatible, NetPort, Ruleset, RulesetAttr,
+    RulesetCreated, RulesetCreatedAttr, path_beneath_rules,
 };
 
 use super::{SandboxAvailability, SandboxPolicy};
@@ -224,21 +233,38 @@ fn probe_command() -> Command {
 /// `handle_access` uses `from_all(abi)` so both the read layer and the write
 /// layer are enforced; `Execute | ReadFile | ReadDir` all exist from ABI1, so
 /// this adds no ABI requirement over the write layer.
+///
+/// For an `--offline` run with ABI4 (Issue #658), `AccessNet::ConnectTcp` is also
+/// handled, which denies every TCP connect, and each `dev_server_ports` entry is
+/// re-allowed with a [`NetPort`] rule. Before ABI4 Landlock cannot restrict the
+/// network, so nothing is handled and [`network_limitation_note`] records the
+/// gap instead of claiming confinement.
 fn create_ruleset(
     abi: u32,
     writable: impl IntoIterator<Item = PathBuf>,
     read_only: impl IntoIterator<Item = PathBuf>,
+    offline: bool,
+    dev_server_ports: &[u16],
 ) -> Result<OwnedFd, String> {
+    let abi_value = abi;
     let abi = ABI::from(abi as i32);
     let read_access = AccessFs::from_read(abi);
     let full_access = AccessFs::from_all(abi);
-    let created = Ruleset::default()
+    // Landlock gained the network access rights in ABI4 (kernel 6.7).
+    let restrict_network = offline && abi_value >= 4;
+    let mut ruleset = Ruleset::default()
         // ABI1 must be enforceable; otherwise the backend is unavailable.
         .set_compatibility(CompatLevel::HardRequirement)
         .handle_access(full_access)
-        .map_err(|err| format!("landlock ruleset setup failed: {err}"))?
-        // Rules are best-effort so a file location silently drops directory-only
-        // accesses instead of failing the whole ruleset.
+        .map_err(|err| format!("landlock ruleset setup failed: {err}"))?;
+    if restrict_network {
+        ruleset = ruleset
+            .handle_access(AccessNet::ConnectTcp)
+            .map_err(|err| format!("landlock network ruleset setup failed: {err}"))?;
+    }
+    // Rules are best-effort so a file location silently drops directory-only
+    // accesses instead of failing the whole ruleset.
+    let created = ruleset
         .set_compatibility(CompatLevel::BestEffort)
         .create()
         .map_err(|err| format!("landlock ruleset creation failed: {err}"))?;
@@ -248,10 +274,31 @@ fn create_ruleset(
     let created = created
         .add_rules(path_beneath_rules(read_only, read_access))
         .map_err(|err| format!("landlock read rule failed: {err}"))?;
+    let created = if restrict_network {
+        add_network_ports(created, dev_server_ports)?
+    } else {
+        created
+    };
     Option::<OwnedFd>::from(created)
         .ok_or_else(|| "landlock ruleset is not enforceable on this kernel".to_string())
 }
 
+/// Re-allow a TCP connect to each dev-server port on an `--offline` ruleset that
+/// otherwise handles (and so denies) every `ConnectTcp`. Landlock matches the
+/// port only, so a `NetPort` rule cannot distinguish the local dev server from
+/// an external host on the same port; that limitation is documented and recorded.
+fn add_network_ports(
+    mut created: RulesetCreated,
+    dev_server_ports: &[u16],
+) -> Result<RulesetCreated, String> {
+    for &port in dev_server_ports {
+        created = created
+            .add_rule(NetPort::new(port, AccessNet::ConnectTcp))
+            .map_err(|err| format!("landlock network rule failed: {err}"))?;
+    }
+    Ok(created)
+}
+
 /// Probe the backend once. Returns [`SandboxAvailability::Unavailable`] with an
 /// honest reason when Landlock is unsupported, disabled, or denied.
 pub fn probe() -> SandboxAvailability {
@@ -292,6 +339,42 @@ fn limitation_for(kernel: &str, abi: u32) -> Option<String> {
     }
 }
 
+/// The network-isolation clause recorded in `bash_sandbox_status` for an
+/// `--offline` run whose kernel cannot confine the network (Issue #658).
+///
+/// Landlock restricts TCP connect only from ABI4 (kernel 6.7). Before that the
+/// network is left unchanged, so the event must say so rather than claim
+/// confinement; `--offline` then relies on the lexical guard for the network.
+/// A non-`--offline` run is unchanged and has no clause, and an unavailable
+/// backend already records its own reason, so this returns `None` there.
+pub fn network_limitation_note(offline: bool) -> Option<String> {
+    let detected = match detect() {
+        Detected::Available { abi } => Some(*abi),
+        Detected::Unavailable(_) => None,
+    };
+    network_limitation_for(offline, detected, &kernel_release())
+}
+
+/// The pure network limitation: `None` unless an `--offline` run is on a kernel
+/// whose detected ABI is below 4. `None` for an unavailable backend, whose own
+/// reason already says the sandbox is not applied.
+fn network_limitation_for(
+    offline: bool,
+    detected_abi: Option<u32>,
+    kernel: &str,
+) -> Option<String> {
+    if !offline {
+        return None;
+    }
+    match detected_abi {
+        Some(abi) if abi >= 4 => None,
+        Some(abi) => Some(format!(
+            "network is not confined: landlock ABI {abi} (kernel {kernel}) cannot restrict TCP connect (ABI4, kernel 6.7, is required); --offline relies on lexical checks for the network"
+        )),
+        None => None,
+    }
+}
+
 /// The detected Landlock ABI, or 0 when the backend is unavailable. Test record.
 pub fn detected_abi() -> u32 {
     match detect() {
@@ -319,6 +402,8 @@ pub fn wrap(command: &mut Command, policy: &SandboxPolicy) -> Result<(), String>
         detected_abi(),
         allowed_paths(policy),
         read_allow_paths(policy),
+        policy.offline,
+        &policy.dev_server_ports,
     )?;
     // Point tools at the run temp directory, which the ruleset allows.
     command.env("TMPDIR", &policy.run_tmp_dir);
@@ -751,4 +836,19 @@ mod tests {
         assert!(limitation_for("6.1.0", 3).is_none());
         assert!(limitation_for("6.1.0", 9).is_none());
     }
+
+    /// Issue #658: the network limitation is named only for an `--offline` run
+    /// on a kernel below ABI4; ABI4 or later confines the network, a non-offline
+    /// run is unchanged, and an unavailable backend has its own reason.
+    #[test]
+    fn network_limitation_names_the_missing_abi4_only_when_offline() {
+        assert!(network_limitation_for(false, Some(1), "6.1.0").is_none());
+        assert!(network_limitation_for(true, Some(4), "6.7.0").is_none());
+        assert!(network_limitation_for(true, Some(9), "6.7.0").is_none());
+        assert!(network_limitation_for(true, None, "6.1.0").is_none());
+
+        let note = network_limitation_for(true, Some(3), "6.1.0")
+            .expect("ABI 3 cannot confine the network");
+        assert!(note.contains("ABI4") && note.contains("6.1.0"), "{note}");
+    }
 }
diff --git a/src/tools/os_sandbox/seatbelt.rs b/src/tools/os_sandbox/seatbelt.rs
index 23ad60f33..6977fc08f 100644
--- a/src/tools/os_sandbox/seatbelt.rs
+++ b/src/tools/os_sandbox/seatbelt.rs
@@ -1,5 +1,5 @@
 //! macOS Seatbelt backend (Issue #655, stage 1a; read isolation in Issue #657,
-//! stage 2).
+//! stage 2; offline network confinement in Issue #658, stage 3).
 //!
 //! Applies a write-confinement profile and, since #657, a read-confinement
 //! layer through `sandbox-exec`. The profile is assembled from a constant; every
@@ -10,7 +10,9 @@
 //! file-read*)` denies the home secret locations and the workspace credential
 //! names. Read isolation is a deny list (decision 4 of #502): everything that is
 //! not a credential stays readable, so a toolchain, git, and the system files
-//! keep working.
+//! keep working. For an `--offline` run (#658) the profile also denies every
+//! network operation except loopback TCP and unix sockets, so an arbitrary
+//! program the lexical guard cannot name cannot reach the network.
 
 use std::path::Path;
 use std::process::{Command, Stdio};
@@ -44,11 +46,28 @@ const WRITE_PROFILE: &str = r#"
 (allow file-write* (regex #"^/dev/"))
 "#;
 
-/// The profile for a run, with `deny_count` home secret locations and the
-/// workspace credential rules. Seatbelt applies the last matching rule, so the
-/// template re-allow comes after the workspace credential deny and keeps the
-/// three strict dotenv templates readable.
-fn profile(deny_count: usize) -> String {
+/// The `--offline` network rules (Issue #658). `(deny network*)` blocks every
+/// socket operation, then loopback TCP (in, out, and bind) and unix-socket
+/// connects are re-allowed so local tools keep working. The rules name no path
+/// and no address parameter — `localhost` is a Seatbelt keyword, not a `-D`
+/// value — so they are a constant. Every operation is named explicitly: a bare
+/// `(allow network* (local ip "localhost:*"))` would re-open all outbound
+/// traffic, so the outbound rule uses `network-outbound` with a remote filter.
+const NETWORK_PROFILE: &str = r#"
+(deny network*)
+(allow network-outbound (remote ip "localhost:*"))
+(allow network-outbound (remote unix-socket))
+(allow network-inbound (local ip "localhost:*"))
+(allow network-bind (local ip "localhost:*"))
+"#;
+
+/// The profile for a run, with `deny_count` home secret locations, the workspace
+/// credential rules, and (for an `--offline` run) the network rules. Seatbelt
+/// applies the last matching rule, so the template re-allow comes after the
+/// workspace credential deny and keeps the three strict dotenv templates
+/// readable. The network rules touch only `network*` operations, so their
+/// position relative to the file rules does not matter.
+fn profile(deny_count: usize, offline: bool) -> String {
     let mut profile = String::from(WRITE_PROFILE);
     for index in 0..deny_count {
         profile.push_str(&format!(
@@ -60,6 +79,9 @@ fn profile(deny_count: usize) -> String {
     // Re-deny a template below a secret-named directory, so the re-allow above
     // cannot open `.ssh/.env.example`.
     profile.push_str("(deny file-read* (regex (param \"RDENY_WS_TEMPLATE\")))\n");
+    if offline {
+        profile.push_str(NETWORK_PROFILE);
+    }
     profile
 }
 
@@ -112,7 +134,9 @@ fn classify_probe_exit(success: bool, status: Option<String>) -> SandboxAvailabi
 pub fn wrap(command: Command, policy: &SandboxPolicy) -> Command {
     let home_secrets = secret_locations::home_secret_locations(&policy.home);
     let mut wrapped = Command::new(SANDBOX_EXEC);
-    wrapped.arg("-p").arg(profile(home_secrets.len()));
+    wrapped
+        .arg("-p")
+        .arg(profile(home_secrets.len(), policy.offline));
     define(&mut wrapped, "WS", Some(&policy.workspace_root));
     define(&mut wrapped, "TMP", Some(&policy.run_tmp_dir));
     define(
@@ -204,7 +228,7 @@ mod tests {
 
     #[test]
     fn profile_denies_each_home_location_and_re_allows_templates_last() {
-        let built = profile(3);
+        let built = profile(3, false);
         assert!(built.contains("(deny file-write*)"), "{built}");
         for index in 0..3 {
             assert!(
@@ -230,6 +254,29 @@ mod tests {
         );
     }
 
+    /// Issue #658: an offline profile denies every network operation and
+    /// re-allows only loopback TCP and unix sockets; a non-offline profile adds
+    /// no network rule, so the network is unchanged.
+    #[test]
+    fn profile_adds_network_confinement_only_when_offline() {
+        let online = profile(0, false);
+        assert!(!online.contains("network"), "{online}");
+
+        let offline = profile(0, true);
+        assert!(offline.contains("(deny network*)"), "{offline}");
+        assert!(
+            offline.contains("(allow network-outbound (remote ip \"localhost:*\"))"),
+            "{offline}"
+        );
+        assert!(
+            offline.contains("(allow network-outbound (remote unix-socket))"),
+            "{offline}"
+        );
+        // A bare `(allow network* (local ip …))` would re-open all outbound
+        // traffic; every network rule must name its operation.
+        assert!(!offline.contains("(allow network*"), "{offline}");
+    }
+
     #[test]
     fn probe_classifies_a_zero_exit_as_available() {
         assert_eq!(
diff --git a/tests/issue502_os_sandbox_network.rs b/tests/issue502_os_sandbox_network.rs
new file mode 100644
index 000000000..5e5bdd9e6
--- /dev/null
+++ b/tests/issue502_os_sandbox_network.rs
@@ -0,0 +1,582 @@
+#![cfg(unix)]
+
+//! Issue #658 (stage 3 of #502): the `--offline` network layer and the
+//! dependency-setup launch points.
+//!
+//! The lexical guard of `--offline` only refuses commands it can name (`npm
+//! install`, `curl`, `wget`, …). An arbitrary program (`python -c
+//! "urllib..."`, `node -e "fetch(...)"`) is invisible to it. This file drives
+//! the same `wrap_command` the launch points use with an `--offline` policy, so
+//! an outbound TCP connect is refused by the OS while a loopback dev server
+//! stays reachable. It also drives the dependency-setup launch with a fake npm,
+//! so a build script that tries to write outside the workspace fails and the
+//! outside fixture does not change.
+//!
+//! The macOS applied cases are `#[cfg(target_os = "macos")]` and no-op when the
+//! backend is unavailable (a nested sandbox reports rc=71). The Linux applied
+//! cases are `#[cfg(target_os = "linux")]` and fail under CI when Landlock (or
+//! its ABI4 network rights) is unavailable, so the runner cannot silently lose
+//! the network backend. The `off` and unavailable paths are shared. Every
+//! fixture lives inside one test tempdir and never touches the real home.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::sync::{Mutex, MutexGuard};
+use std::time::Duration;
+
+use commandagent::bounded_process::{self, BoundedProcessOutput};
+use commandagent::minimal_loop::dependency_setup::{
+    self, NodeDependencySetupAuthority, NodeDependencySetupStatus,
+};
+use commandagent::tools::os_sandbox::{self, SandboxAvailability, SandboxMode, SandboxPolicy};
+
+const TIMEOUT: Duration = Duration::from_secs(120);
+/// `192.0.2.0/24` is TEST-NET-1 (RFC 5737): a reserved address that is never
+/// routed, so a connect to it only fails when the OS refuses it.
+const RESERVED_HOST: &str = "192.0.2.1";
+const NESTED: &str = "sandbox-exec probe exited with exit status: 71";
+
+/// The sandbox state is process-wide, so the tests that install it serialize.
+static SANDBOX_LOCK: Mutex<()> = Mutex::new(());
+
+fn sandbox_lock() -> MutexGuard<'static, ()> {
+    SANDBOX_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+/// A workspace, its run temp directory, a fake home, and a sibling outside
+/// fixture, all inside one test tempdir.
+struct Fixture {
+    _dir: tempfile::TempDir,
+    root: PathBuf,
+    run_tmp: PathBuf,
+    home: PathBuf,
+    outside_secret: PathBuf,
+    connect_script: PathBuf,
+}
+
+/// A tiny TCP client: prints `CONNECT_OK` on success or `CONNECT_ERR <Kind>` on
+/// failure, so the test can tell an OS refusal (PermissionError) from a timeout.
+const CONNECT_PY: &str = r#"
+import socket, sys
+host, port = sys.argv[1], int(sys.argv[2])
+s = socket.socket()
+s.settimeout(3)
+try:
+    s.connect((host, port))
+    print("CONNECT_OK")
+except OSError as e:
+    print("CONNECT_ERR", type(e).__name__)
+"#;
+
+fn fixture() -> Fixture {
+    let dir = tempfile::tempdir().expect("create tempdir");
+    let root = dir.path().join("ws");
+    let run_tmp = dir.path().join("run-tmp");
+    let home = dir.path().join("home");
+    let outside = dir.path().join("outside");
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::create_dir_all(&run_tmp).unwrap();
+    std::fs::create_dir_all(&home).unwrap();
+    std::fs::create_dir_all(&outside).unwrap();
+    std::fs::write(outside.join("secret.txt"), "OUTSIDE_658\n").unwrap();
+    // A write through this symlink lands outside the workspace, which the
+    // sandbox must refuse.
+    std::os::unix::fs::symlink(&outside, root.join("escape")).unwrap();
+    let connect_script = root.join("connect.py");
+    std::fs::write(&connect_script, CONNECT_PY).unwrap();
+    Fixture {
+        _dir: dir,
+        root,
+        run_tmp,
+        home,
+        outside_secret: outside.join("secret.txt"),
+        connect_script,
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn backend_available() -> bool {
+    matches!(os_sandbox::probe(), SandboxAvailability::Available)
+}
+
+/// Ask the kernel for its Landlock ABI without going through the backend, so a
+/// mutated `landlock::detected_abi()` cannot make these tests agree with
+/// themselves.
+#[cfg(target_os = "linux")]
+fn kernel_landlock_abi() -> u32 {
+    const LANDLOCK_CREATE_RULESET_VERSION: libc::c_uint = 1;
+    let ret = unsafe {
+        libc::syscall(
+            libc::SYS_landlock_create_ruleset,
+            std::ptr::null::<libc::c_void>(),
+            0usize,
+            LANDLOCK_CREATE_RULESET_VERSION,
+        )
+    };
+    if ret < 0 { 0 } else { ret as u32 }
+}
+
+#[cfg(target_os = "linux")]
+fn landlock_kernel_release() -> String {
+    commandagent::tools::os_sandbox::landlock::kernel_release_label()
+}
+
+/// The ABI-gated outcome for the ABI4 network test.
+#[cfg(target_os = "linux")]
+#[derive(Debug, PartialEq, Eq)]
+enum AbiGate {
+    Continue,
+    Skip(String),
+    Fail(String),
+}
+
+/// The network layer needs ABI4, so the gate fails under CI when the kernel
+/// cannot confine TCP connect and skips on a local run; the reason names the
+/// kernel and the queried ABI.
+#[cfg(target_os = "linux")]
+fn abi_gate(ci: bool, abi: u32, required_abi: u32, kernel: &str) -> AbiGate {
+    if abi >= required_abi {
+        AbiGate::Continue
+    } else if ci {
+        AbiGate::Fail(format!(
+            "CI: Landlock ABI {abi} (kernel {kernel}) is below the required ABI{required_abi}"
+        ))
+    } else {
+        AbiGate::Skip(format!(
+            "SKIP: Landlock ABI {abi} (kernel {kernel}) < {required_abi}"
+        ))
+    }
+}
+
+#[cfg(target_os = "linux")]
+fn require_abi_or_ci_fail(abi: u32, required_abi: u32) -> bool {
+    match abi_gate(
+        std::env::var_os("CI").is_some(),
+        abi,
+        required_abi,
+        &landlock_kernel_release(),
+    ) {
+        AbiGate::Continue => true,
+        AbiGate::Skip(reason) => {
+            eprintln!("{reason}");
+            false
+        }
+        AbiGate::Fail(reason) => panic!("{reason}"),
+    }
+}
+
+/// Append the kernel release and Landlock ABI to `$GITHUB_STEP_SUMMARY` once per
+/// process, when that variable is set. Best effort.
+#[cfg(target_os = "linux")]
+fn record_kernel_and_abi_in_step_summary() {
+    use std::sync::Once;
+
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        let Some(path) = std::env::var_os("GITHUB_STEP_SUMMARY") else {
+            return;
+        };
+        let line = format!(
+            "issue502/658 landlock network: kernel={} abi={}\n",
+            landlock_kernel_release(),
+            kernel_landlock_abi()
+        );
+        let _ = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(path)
+            .and_then(|mut file| std::io::Write::write_all(&mut file, line.as_bytes()));
+    });
+}
+
+/// Print the kernel release and Landlock ABI, and refuse a silent skip under
+/// CI: a GitHub Actions Linux runner must have an applied backend. The network
+/// layer additionally needs ABI4, which the caller gates on separately.
+#[cfg(target_os = "linux")]
+fn require_landlock_backend() -> bool {
+    use commandagent::tools::os_sandbox::landlock;
+    record_kernel_and_abi_in_step_summary();
+    let abi = kernel_landlock_abi();
+    let kernel = landlock::kernel_release_label();
+    let available = matches!(os_sandbox::probe(), SandboxAvailability::Available);
+    let reported = landlock::detected_abi();
+    eprintln!("issue502/658 landlock network: kernel={kernel} abi={abi} detected_abi={reported}");
+    if available {
+        assert_eq!(
+            reported, abi,
+            "detected_abi() must equal the kernel ABI queried independently"
+        );
+    }
+    if std::env::var_os("CI").is_some() {
+        assert!(
+            available,
+            "CI: the Landlock backend must be available (kernel {kernel}, abi {abi})"
+        );
+    }
+    available
+}
+
+/// Install an available sandbox with the given offline policy.
+fn install_available(policy: SandboxPolicy) -> os_sandbox::SandboxStatus {
+    os_sandbox::install_for_test(SandboxMode::Auto, policy, SandboxAvailability::Available)
+}
+
+fn online_policy(fixture: &Fixture) -> SandboxPolicy {
+    SandboxPolicy::with_home(&fixture.root, &fixture.run_tmp, fixture.home.clone())
+}
+
+/// Build `sh -c <command>`, apply the installed sandbox directly (bypassing the
+/// lexical guard), and run it, so the OS network layer is measured on its own.
+fn run_wrapped(root: &Path, command: &str) -> BoundedProcessOutput {
+    let mut process = Command::new("sh");
+    process.arg("-c").arg(command).current_dir(root);
+    let mut process = os_sandbox::wrap_command(process).expect("available sandbox wraps");
+    process.stdout(Stdio::piped()).stderr(Stdio::piped());
+    bounded_process::run_with_timeout(&mut process, TIMEOUT).expect("spawn wrapped command")
+}
+
+fn connect_device(fixture: &Fixture, host: &str, port: u16) -> String {
+    let command = format!(
+        "python3 {script} {host} {port}",
+        script = fixture.connect_script.display(),
+    );
+    let output = run_wrapped(&fixture.root, &command);
+    String::from_utf8_lossy(&output.stdout).trim().to_string()
+}
+
+/// A loopback TCP listener the sandboxed client can reach, held for the test.
+fn dev_server() -> (std::net::TcpListener, u16) {
+    let listener = std::net::TcpListener::bind(("127.0.0.1", 0)).expect("bind dev server");
+    let port = listener.local_addr().unwrap().port();
+    (listener, port)
+}
+
+// ---------------------------------------------------------------------------
+// Shared: the sandbox-off and unavailable paths do not confine the network.
+// ---------------------------------------------------------------------------
+
+/// A run that is not `--offline` handles no network access, so its outbound
+/// behaviour is exactly as before this stage: no OS refusal (`PermissionError`).
+#[test]
+fn non_offline_run_leaves_outbound_unchanged() {
+    let _serial = sandbox_lock();
+    let fixture = fixture();
+    install_available(online_policy(&fixture));
+
+    let result = connect_device(&fixture, RESERVED_HOST, 9);
+    assert!(
+        !result.contains("PermissionError"),
+        "a non-offline run must not be refused by the OS: {result}"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// An unavailable backend records the reason and does not claim network
+/// confinement: `auto` continues, `required` refuses honestly.
+#[test]
+fn unavailable_backend_records_and_does_not_claim_confinement() {
+    let _serial = sandbox_lock();
+    let fixture = fixture();
+
+    os_sandbox::install_for_test(
+        SandboxMode::Auto,
+        online_policy(&fixture).with_offline(true),
+        SandboxAvailability::Unavailable(NESTED.to_string()),
+    );
+    let status = os_sandbox::status().unwrap();
+    assert!(!status.applied, "{status:?}");
+    assert_eq!(status.reason.as_deref(), Some(NESTED));
+    assert!(
+        os_sandbox::wrap_command(Command::new("sh")).is_ok(),
+        "auto continues"
+    );
+
+    os_sandbox::install_for_test(
+        SandboxMode::Required,
+        online_policy(&fixture).with_offline(true),
+        SandboxAvailability::Unavailable(NESTED.to_string()),
+    );
+    let error = os_sandbox::wrap_command(Command::new("sh")).expect_err("required must refuse");
+    assert!(
+        error.summary().starts_with(os_sandbox::UNAVAILABLE_KIND),
+        "{}",
+        error.summary()
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+// ---------------------------------------------------------------------------
+// Applied: an --offline run refuses outbound TCP but allows the dev server.
+// ---------------------------------------------------------------------------
+
+#[cfg(target_os = "macos")]
+#[test]
+fn macos_offline_refuses_outbound_and_allows_the_dev_server() {
+    let _serial = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: nested sandbox; macOS network cases no-op");
+        return;
+    }
+    let fixture = fixture();
+    install_available(online_policy(&fixture).with_offline(true));
+
+    let (_server, port) = dev_server();
+    let loopback = connect_device(&fixture, "127.0.0.1", port);
+    assert_eq!(loopback, "CONNECT_OK", "loopback must stay reachable");
+
+    let reserved = connect_device(&fixture, RESERVED_HOST, 9);
+    assert!(
+        reserved.contains("PermissionError"),
+        "an offline run must have its outbound connect refused by the OS: {reserved}"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_offline_refuses_outbound_and_allows_only_the_dev_server_port() {
+    let _serial = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    // The network layer needs ABI4 (kernel 6.7); under CI a kernel without it
+    // fails here instead of silently losing the network backend.
+    if !require_abi_or_ci_fail(kernel_landlock_abi(), 4) {
+        return;
+    }
+    let fixture = fixture();
+    let (_allowed_server, allowed_port) = dev_server();
+    let (_other_server, other_port) = dev_server();
+    install_available(
+        online_policy(&fixture)
+            .with_offline(true)
+            .with_dev_server_ports([allowed_port]),
+    );
+
+    let allowed = connect_device(&fixture, "127.0.0.1", allowed_port);
+    assert_eq!(
+        allowed, "CONNECT_OK",
+        "the dev-server port must stay reachable"
+    );
+
+    let other = connect_device(&fixture, "127.0.0.1", other_port);
+    assert!(
+        other.contains("PermissionError"),
+        "landlock is port-scoped, so another loopback port must be refused: {other}"
+    );
+
+    let reserved = connect_device(&fixture, RESERVED_HOST, other_port);
+    assert!(
+        reserved.contains("PermissionError"),
+        "an offline run must refuse an outbound connect: {reserved}"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// The ABI gate: the network layer needs ABI4, so an ABI below 4 fails under CI,
+/// skips on a local run, and ABI4 or later continues; the reason names the
+/// kernel and the queried ABI.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_abi_gate_requires_abi4_fails_under_ci_and_skips_otherwise() {
+    let kernel = "6.1.0-generic";
+    assert!(matches!(
+        abi_gate(true, 3, 4, kernel),
+        AbiGate::Fail(reason) if reason.contains(kernel) && reason.contains("ABI4")
+    ));
+    assert!(matches!(abi_gate(false, 3, 4, kernel), AbiGate::Skip(_)));
+    assert_eq!(abi_gate(false, 4, 4, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(true, 4, 4, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(false, 9, 4, kernel), AbiGate::Continue);
+}
+
+// ---------------------------------------------------------------------------
+// Dependency setup runs inside the sandbox and cannot write outside it.
+// ---------------------------------------------------------------------------
+
+/// Fake npm: create `node_modules` (so the setup is observed as passed) and try
+/// to write through the `escape` symlink. Under the sandbox that write is
+/// refused; without it the script would exit non-zero and change the outside
+/// fixture.
+const FAKE_NPM: &str = r#"#!/bin/sh
+mkdir -p node_modules
+if printf 'pwned' > escape/secret.txt 2>/dev/null; then
+  echo "outside write succeeded" >&2
+  exit 1
+fi
+exit 0
+"#;
+
+/// A fake npm that only creates `node_modules`, so an `auto` run outside the
+/// sandbox is observed as passed.
+const FAKE_NPM_CLEAN: &str = "#!/bin/sh\nmkdir -p node_modules\nexit 0\n";
+
+fn write_executable(root: &Path, name: &str, body: &str) -> PathBuf {
+    use std::os::unix::fs::PermissionsExt;
+    let path = root.join(name);
+    std::fs::write(&path, body).unwrap();
+    let mut permissions = std::fs::metadata(&path).unwrap().permissions();
+    permissions.set_mode(0o755);
+    std::fs::set_permissions(&path, permissions).unwrap();
+    path
+}
+
+fn write_fake_npm(fixture: &Fixture) -> PathBuf {
+    write_executable(&fixture.root, "fake-npm", FAKE_NPM)
+}
+
+#[test]
+fn dependency_setup_runs_inside_the_sandbox_and_cannot_write_outside() {
+    let _serial = sandbox_lock();
+    #[cfg(target_os = "macos")]
+    if !backend_available() {
+        eprintln!("SKIP: nested sandbox; dependency-setup confinement no-op");
+        return;
+    }
+    // The write confinement needs ABI1; a Linux CI runner without a working
+    // Landlock fails here instead of silently running the setup unconfined.
+    #[cfg(target_os = "linux")]
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    std::fs::write(
+        fixture.root.join("package.json"),
+        r#"{"dependencies":{"left-pad":"^1.3.0"}}"#,
+    )
+    .unwrap();
+    let fake_npm = write_fake_npm(&fixture);
+
+    install_available(online_policy(&fixture));
+
+    let requirement = dependency_setup::requirement_for_node_declared_dependencies(
+        &fixture.root,
+        Some("node"),
+        "network test",
+        NodeDependencySetupAuthority::PlanSetupStep,
+    );
+    assert!(requirement.allowed, "{requirement:?}");
+    let observation = dependency_setup::run_node_dependency_setup_with_program(
+        &fixture.root,
+        &requirement,
+        &fake_npm,
+    );
+
+    assert_eq!(
+        observation.status,
+        NodeDependencySetupStatus::Passed,
+        "the setup must succeed inside the sandbox: {observation:?}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(&fixture.outside_secret).unwrap(),
+        "OUTSIDE_658\n",
+        "the outside fixture must not change"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// `required` with an unavailable backend fails the dependency setup honestly
+/// (the sandbox reason in the existing observation) instead of running it
+/// unconfined.
+#[test]
+fn required_unavailable_sandbox_fails_the_dependency_setup_honestly() {
+    let _serial = sandbox_lock();
+    let fixture = fixture();
+    std::fs::write(
+        fixture.root.join("package.json"),
+        r#"{"dependencies":{"left-pad":"^1.3.0"}}"#,
+    )
+    .unwrap();
+    let fake_npm = write_fake_npm(&fixture);
+    os_sandbox::install_for_test(
+        SandboxMode::Required,
+        online_policy(&fixture),
+        SandboxAvailability::Unavailable(NESTED.to_string()),
+    );
+
+    let requirement = dependency_setup::requirement_for_node_declared_dependencies(
+        &fixture.root,
+        Some("node"),
+        "network test",
+        NodeDependencySetupAuthority::PlanSetupStep,
+    );
+    let observation = dependency_setup::run_node_dependency_setup_with_program(
+        &fixture.root,
+        &requirement,
+        &fake_npm,
+    );
+
+    assert_eq!(observation.status, NodeDependencySetupStatus::Failed);
+    assert!(
+        observation
+            .primary_reason
+            .contains(os_sandbox::UNAVAILABLE_KIND),
+        "the failure must name the sandbox: {}",
+        observation.primary_reason
+    );
+    assert!(
+        !fixture.root.join("node_modules").exists(),
+        "the setup must not run unconfined"
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+/// `auto` with an unavailable backend runs the dependency setup outside the
+/// sandbox and the run status records it as not applied.
+#[test]
+fn auto_unavailable_sandbox_runs_the_dependency_setup_outside() {
+    let _serial = sandbox_lock();
+    let fixture = fixture();
+    std::fs::write(
+        fixture.root.join("package.json"),
+        r#"{"dependencies":{"left-pad":"^1.3.0"}}"#,
+    )
+    .unwrap();
+    let fake_npm = write_executable(&fixture.root, "fake-npm", FAKE_NPM_CLEAN);
+    os_sandbox::install_for_test(
+        SandboxMode::Auto,
+        online_policy(&fixture),
+        SandboxAvailability::Unavailable(NESTED.to_string()),
+    );
+    let status = os_sandbox::status().unwrap();
+    assert!(
+        !status.applied,
+        "auto records the sandbox as not applied: {status:?}"
+    );
+    assert_eq!(status.reason.as_deref(), Some(NESTED));
+
+    let requirement = dependency_setup::requirement_for_node_declared_dependencies(
+        &fixture.root,
+        Some("node"),
+        "network test",
+        NodeDependencySetupAuthority::PlanSetupStep,
+    );
+    let observation = dependency_setup::run_node_dependency_setup_with_program(
+        &fixture.root,
+        &requirement,
+        &fake_npm,
+    );
+
+    assert_eq!(
+        observation.status,
+        NodeDependencySetupStatus::Passed,
+        "auto runs the setup outside the sandbox: {observation:?}"
+    );
+    assert!(fixture.root.join("node_modules").exists());
+
+    os_sandbox::reset_for_test();
+}

From c938a227391d6ef4ff81025d5cb06ee5c68f3319 Mon Sep 17 00:00:00 2001
From: kewton <newtons.boiled.clock@gmail.com>
Date: Tue, 13 Oct 2026 23:14:44 +0900
Subject: [PATCH 2/2] fix(tools): keep dependency-setup stdin null and allow
 unix socket bind offline

Four review fixes for #658:

- Set the dependency-setup child's stdin after the sandbox wrap, so on macOS
  (where seatbelt::wrap rebuilds the command) it stays null instead of inheriting
  the parent's stdin. A macOS applied test runs the check in a child process with
  a piped stdin, so an inherited stdin is visible.
- Allow `network-bind (local unix-socket)` in the macOS --offline profile, so a
  unix socket can be created inside the isolation (the design allows unix
  sockets); outbound TCP/UDP stay denied. A macOS applied test binds and listens
  on a socket inside the tempdir and still checks the 192.0.2.1 connect is
  refused.
- Correct the landlock module comment: the ABI4 port-scope and UDP limits are
  documented, not recorded in bash_sandbox_status; only a kernel below ABI4 is
  recorded there.
- SECURITY.md: note the Linux fail-closed case -- when no dev-server port can be
  derived, every TCP connect is denied, localhost included.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
---
 SECURITY.md                          |  14 +--
 src/minimal_loop/dependency_setup.rs |  27 +++--
 src/tools/os_sandbox/landlock.rs     |   7 +-
 src/tools/os_sandbox/seatbelt.rs     |  18 ++--
 tests/issue502_os_sandbox_network.rs | 152 +++++++++++++++++++++++++++
 5 files changed, 192 insertions(+), 26 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 4e301ac75..710e6960c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -55,12 +55,14 @@ predated the run.
   (`python -c "urllib..."`, `node -e "fetch(...)"`) still cannot leave the
   machine. macOS (Seatbelt) denies every network operation except loopback TCP
   and unix sockets. Linux (Landlock ABI4, kernel 6.7) denies every TCP connect
-  except the run's dev-server port(s): Landlock matches the port only, so the
-  same port on an external host still connects and UDP is not restricted, and
-  below ABI4 the network is not confined at all — the `bash_sandbox_status`
-  reason says so. The runtime dependency setup runs inside this same sandbox, so
-  a build backend (`setup.py`, an npm lifecycle script) cannot write outside the
-  workspace.
+  except the run's dev-server port(s). Landlock matches the port only, so the
+  same port on an external host still connects and UDP is not restricted. When
+  the run's dev-server port cannot be derived — it is neither named in the goal
+  nor a profile default — the allow list is empty and every TCP connect is
+  denied, localhost included. Below ABI4 the network is not confined at all — the
+  `bash_sandbox_status` reason says so. The runtime dependency setup runs inside
+  this same sandbox, so a build backend (`setup.py`, an npm lifecycle script)
+  cannot write outside the workspace.
 - Lexical-only, always: `--offline` refuses runtime dependency setup and the
   Bash command families named in `--help` (npm/pnpm/yarn/cargo install, curl,
   wget). These checks do not change when a backend is applied; they still run
diff --git a/src/minimal_loop/dependency_setup.rs b/src/minimal_loop/dependency_setup.rs
index 171e6002b..32845d9fa 100644
--- a/src/minimal_loop/dependency_setup.rs
+++ b/src/minimal_loop/dependency_setup.rs
@@ -752,11 +752,12 @@ fn run_node_dependency_setup_with_program_timeout_and_offline(
     let mut command = verifier_env::normalized_command_at_root(npm_program, root);
     command
         .args(["install", "--ignore-scripts"])
-        .current_dir(root)
-        .stdin(Stdio::null());
+        .current_dir(root);
     // Issue #658: run the install inside the stage-1 OS sandbox, so a build
     // backend or lifecycle script cannot write outside the workspace. Standard
-    // I/O is set after the wrap because the wrap does not transfer it.
+    // I/O is set after the wrap: macOS `seatbelt::wrap` rebuilds the command and
+    // does not transfer stdio, so a pre-wrap `.stdin(Stdio::null())` would be
+    // lost and the child would inherit the parent's stdin.
     let mut command = match crate::tools::os_sandbox::wrap_dependency_setup(command) {
         Ok(command) => command,
         Err(refusal) => {
@@ -770,7 +771,10 @@ fn run_node_dependency_setup_with_program_timeout_and_offline(
             );
         }
     };
-    command.stdout(Stdio::piped()).stderr(Stdio::piped());
+    command
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
     let output = match bounded_process::run_with_timeout(&mut command, timeout) {
         Ok(output) => output,
         Err(err) => {
@@ -957,13 +961,11 @@ fn run_python_cli_dependency_setup(
     let mut changed_paths = Vec::new();
     let command_text = "python -m venv .venv && .venv/bin/python -m pip install -e .".to_string();
     let mut command = verifier_env::normalized_command_at_root("sh", root);
-    command
-        .arg("-c")
-        .arg(&command_text)
-        .current_dir(root)
-        .stdin(Stdio::null());
+    command.arg("-c").arg(&command_text).current_dir(root);
     // Issue #658: the pip build backend is arbitrary code, so run the setup
-    // inside the stage-1 OS sandbox and keep its writes in the workspace.
+    // inside the stage-1 OS sandbox and keep its writes in the workspace. Standard
+    // I/O is set after the wrap: macOS `seatbelt::wrap` rebuilds the command and
+    // does not transfer stdio.
     let mut command = match crate::tools::os_sandbox::wrap_dependency_setup(command) {
         Ok(command) => command,
         Err(refusal) => {
@@ -977,7 +979,10 @@ fn run_python_cli_dependency_setup(
             );
         }
     };
-    command.stdout(Stdio::piped()).stderr(Stdio::piped());
+    command
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
     let output = match bounded_process::run_with_timeout(&mut command, timeout) {
         Ok(output) => output,
         Err(err) => {
diff --git a/src/tools/os_sandbox/landlock.rs b/src/tools/os_sandbox/landlock.rs
index 9a39862ed..f6ce2df4b 100644
--- a/src/tools/os_sandbox/landlock.rs
+++ b/src/tools/os_sandbox/landlock.rs
@@ -31,9 +31,10 @@
 //!   every TCP connect, and a [`NetPort`] rule re-allows the dev-server ports.
 //!   Landlock cannot tell addresses apart and cannot restrict UDP, so an
 //!   `--offline` run can still reach the same port on an external host and any
-//!   UDP destination; both limitations are recorded in `bash_sandbox_status`.
-//!   Without ABI4 the network is left unchanged and the event names the gap
-//!   ([`network_limitation_note`]).
+//!   UDP destination; those limits are documented (SECURITY.md and the
+//!   cli-reference) rather than recorded in `bash_sandbox_status`. Only a kernel
+//!   below ABI4 is recorded there, because then the network is left unchanged and
+//!   the event says so ([`network_limitation_note`]).
 //! - A non-`--offline` run handles no network access, so its network is exactly
 //!   as before this stage.
 //! - Availability is probed once at run start from the Landlock ABI query and a
diff --git a/src/tools/os_sandbox/seatbelt.rs b/src/tools/os_sandbox/seatbelt.rs
index 6977fc08f..ab35704dd 100644
--- a/src/tools/os_sandbox/seatbelt.rs
+++ b/src/tools/os_sandbox/seatbelt.rs
@@ -47,18 +47,20 @@ const WRITE_PROFILE: &str = r#"
 "#;
 
 /// The `--offline` network rules (Issue #658). `(deny network*)` blocks every
-/// socket operation, then loopback TCP (in, out, and bind) and unix-socket
-/// connects are re-allowed so local tools keep working. The rules name no path
-/// and no address parameter — `localhost` is a Seatbelt keyword, not a `-D`
-/// value — so they are a constant. Every operation is named explicitly: a bare
-/// `(allow network* (local ip "localhost:*"))` would re-open all outbound
-/// traffic, so the outbound rule uses `network-outbound` with a remote filter.
+/// socket operation, then loopback TCP (in, out, and bind) and unix sockets
+/// (outbound connect and bind) are re-allowed so local tools keep working. The
+/// rules name no path and no address parameter — `localhost` is a Seatbelt
+/// keyword, not a `-D` value — so they are a constant. Every operation is named
+/// explicitly: a bare `(allow network* (local ip "localhost:*"))` would re-open
+/// all outbound traffic, so the outbound rule uses `network-outbound` with a
+/// remote filter.
 const NETWORK_PROFILE: &str = r#"
 (deny network*)
 (allow network-outbound (remote ip "localhost:*"))
 (allow network-outbound (remote unix-socket))
 (allow network-inbound (local ip "localhost:*"))
 (allow network-bind (local ip "localhost:*"))
+(allow network-bind (local unix-socket))
 "#;
 
 /// The profile for a run, with `deny_count` home secret locations, the workspace
@@ -272,6 +274,10 @@ mod tests {
             offline.contains("(allow network-outbound (remote unix-socket))"),
             "{offline}"
         );
+        assert!(
+            offline.contains("(allow network-bind (local unix-socket))"),
+            "a unix socket must be bindable inside the isolation: {offline}"
+        );
         // A bare `(allow network* (local ip …))` would re-open all outbound
         // traffic; every network rule must name its operation.
         assert!(!offline.contains("(allow network*"), "{offline}");
diff --git a/tests/issue502_os_sandbox_network.rs b/tests/issue502_os_sandbox_network.rs
index 5e5bdd9e6..aa9bfa19f 100644
--- a/tests/issue502_os_sandbox_network.rs
+++ b/tests/issue502_os_sandbox_network.rs
@@ -339,6 +339,158 @@ fn macos_offline_refuses_outbound_and_allows_the_dev_server() {
     os_sandbox::reset_for_test();
 }
 
+/// macOS Seatbelt: an `--offline` run lets a unix socket be created (bind and
+/// listen) inside the isolation, while the reserved-address connect is still
+/// refused. The socket path is inside the fixture tempdir.
+#[cfg(target_os = "macos")]
+#[test]
+fn macos_offline_allows_unix_socket_bind_and_still_refuses_outbound() {
+    const UNPROBE_PY: &str = r#"
+import os, socket, sys
+path = os.path.join(sys.argv[1], "probe.sock")
+s = socket.socket(socket.AF_UNIX)
+try:
+    s.bind(path)
+    s.listen(1)
+    print("BIND_OK")
+except OSError as e:
+    print("BIND_ERR", type(e).__name__)
+c = socket.socket()
+c.settimeout(3)
+try:
+    c.connect(("192.0.2.1", 9))
+    print("EXT_OK")
+except OSError as e:
+    print("EXT_ERR", type(e).__name__)
+"#;
+    let _serial = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: nested sandbox; macOS network cases no-op");
+        return;
+    }
+    let fixture = fixture();
+    install_available(online_policy(&fixture).with_offline(true));
+
+    let script = fixture.root.join("unixbind.py");
+    std::fs::write(&script, UNPROBE_PY).unwrap();
+    let command = format!(
+        "python3 {script} {dir}",
+        script = script.display(),
+        dir = fixture.root.display(),
+    );
+    let output = run_wrapped(&fixture.root, &command);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(
+        stdout.contains("BIND_OK"),
+        "a unix socket must be bindable inside the isolation: {stdout}"
+    );
+    assert!(
+        stdout.contains("EXT_ERR") && !stdout.contains("EXT_OK"),
+        "outbound must stay refused: {stdout}"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// macOS Seatbelt: the dependency-setup child's stdin is null, not inherited.
+/// `seatbelt::wrap` rebuilds the command, so the launch must set `stdin` after
+/// the wrap. The check runs in a child process whose stdin is an open pipe with
+/// data, so an inherited stdin is visible (a null stdin is not).
+#[cfg(target_os = "macos")]
+#[test]
+fn macos_dependency_setup_child_stdin_is_null() {
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+
+    if !backend_available() {
+        eprintln!("SKIP: nested sandbox; dependency-setup stdin no-op");
+        return;
+    }
+    let mut child = Command::new(std::env::current_exe().unwrap())
+        .args([
+            "--ignored",
+            "--exact",
+            "macos_dependency_setup_child_stdin_is_null_child",
+            "--nocapture",
+        ])
+        .stdin(Stdio::piped())
+        .spawn()
+        .expect("spawn stdin child");
+    // Keep the pipe open with data while the child runs; a null stdin would not
+    // see this.
+    let mut stdin = child.stdin.take().expect("child stdin");
+    let _ = stdin.write_all(b"x");
+    let _ = stdin.flush();
+    let status = child.wait().expect("wait stdin child");
+    drop(stdin);
+    assert!(status.success(), "the child check must pass: {status}");
+}
+
+/// The child check of [`macos_dependency_setup_child_stdin_is_null`]. It runs in
+/// its own process so its stdin can be a pipe; the fake npm records whether fd 0
+/// is a terminal, a pipe, and at EOF.
+#[cfg(target_os = "macos")]
+#[test]
+#[ignore]
+fn macos_dependency_setup_child_stdin_is_null_child() {
+    // The child process spawned by the parent has its own sandbox state, but
+    // --include-ignored also runs this test in the main process, so it must
+    // serialize with the tests that install the process-wide sandbox.
+    let _serial = sandbox_lock();
+    const FAKE_NPM_STDIN: &str = r#"#!/usr/bin/env python3
+import os, select, stat
+fd = os.fstat(0)
+ready, _, _ = select.select([0], [], [], 0.5)
+eof = bool(ready) and os.read(0, 1) == b""
+with open("stdin.txt", "w") as fh:
+    fh.write(f"tty={os.isatty(0)} fifo={stat.S_ISFIFO(fd.st_mode)} eof={eof}\n")
+os.makedirs("node_modules", exist_ok=True)
+"#;
+    let fixture = fixture();
+    std::fs::write(
+        fixture.root.join("package.json"),
+        r#"{"dependencies":{"left-pad":"^1.3.0"}}"#,
+    )
+    .unwrap();
+    let fake_npm = write_executable(&fixture.root, "fake-npm", FAKE_NPM_STDIN);
+    install_available(online_policy(&fixture));
+
+    let requirement = dependency_setup::requirement_for_node_declared_dependencies(
+        &fixture.root,
+        Some("node"),
+        "network test",
+        NodeDependencySetupAuthority::PlanSetupStep,
+    );
+    let observation = dependency_setup::run_node_dependency_setup_with_program(
+        &fixture.root,
+        &requirement,
+        &fake_npm,
+    );
+    assert_eq!(
+        observation.status,
+        NodeDependencySetupStatus::Passed,
+        "{observation:?}"
+    );
+
+    let recorded = std::fs::read_to_string(fixture.root.join("stdin.txt")).unwrap();
+    assert!(
+        recorded.contains("tty=False"),
+        "stdin must not be a terminal: {recorded}"
+    );
+    assert!(
+        recorded.contains("fifo=False"),
+        "stdin must not be a pipe: {recorded}"
+    );
+    assert!(
+        recorded.contains("eof=True"),
+        "stdin must be at EOF: {recorded}"
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
 #[cfg(target_os = "linux")]
 #[test]
 fn linux_offline_refuses_outbound_and_allows_only_the_dev_server_port() {