feat(sandbox): add DockerSandbox + pre-tool-use guardrail hooks (Phase 3)

Gives native-API-driven agents (currently just the Phase 2 Anthropic
adapter) real container isolation, decoupled from model invocation --
the model call happens in the Go process via provider.Provider, only tool
execution happens in the container, unlike the CLI-subprocess ContainerRunner
(left completely untouched) where the claude/gemini CLI runs inside the
container.

- internal/sandbox/dockersandbox.go: Sandbox via a long-lived
  `docker run -d ... sleep infinity` container (started once per execution,
  not per tool call), host-side git clone + bind-mount matching
  ContainerRunner's existing pattern, docker exec for read/write/bash/glob.
  Reuses images/agent-base (claudomator-agent:latest) rather than
  standing up a second image. WorkDir()/resume persists the host bind-mount
  directory (matching HostSandbox's contract); a resumed sandbox lazily
  starts a fresh container against that directory rather than trying to
  reattach to a possibly-gone one.
- internal/sandbox/guard.go, hooks.go: Hook interface (CheckBash/CheckWrite),
  Guarded wrapper, DenylistBashHook (rm -rf /, force-push, curl|sh, sudo,
  chmod 777, dd if=) and ProtectedPathHook (.git/**, .env*, credentials/,
  .github/workflows/**). A rejection returns *RejectionError, which
  agentloop/tools.go now recognizes and feeds back to the model as a normal
  (non-fatal) tool-error result instead of aborting the run.
- NativeRunner wraps whichever Sandbox it builds (Host or Docker) in
  Guarded{Hooks: DefaultHooks()} uniformly. The "anthropic" runner now uses
  DockerSandbox; "local" stays on HostSandbox by design (local models are
  the harness's more-trusted, lower-stakes-to-run tier).

Docker is not installed in this dev environment (no docker/podman/containerd
on PATH), so DockerSandbox's real container-lifecycle behavior is verified
via mocked-command unit tests only -- go test -race ./... passes throughout,
with the two real-daemon integration tests gated behind a dockerAvailable(t)
check and skipping here. Live verification against an actual Docker host is
a follow-up before relying on the "anthropic" agent type in production.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1moSNCJRcP6kykA4tyUSs

1 files changed, 10 insertions, 1 deletions

diff --git a/internal/cli/serve.go b/internal/cli/serve.go
index d9bf609..8b6cc6a 100644
--- a/internal/cli/serve.go
+++ b/internal/cli/serve.go
@@ -147,6 +147,10 @@ func serve(addr, basePath string) error {
 			LogDir:             cfg.LogDir,
 			DefaultTemperature: cfg.LocalModel.DefaultTemperature,
 			DefaultModel:       cfg.LocalModel.Model,
+			// SandboxKind left at its zero value ("host" / sandbox.HostSandbox).
+			// Local models are presumed more trusted/lower-stakes than paid
+			// cloud providers, so they stay on the weaker but zero-overhead
+			// host sandbox — see NativeRunner.SandboxKind doc comment.
 		}
 		logger.Info("local runner registered", "endpoint", cfg.LocalModel.Endpoint, "model", cfg.LocalModel.Model)
 	}
@@ -161,8 +165,13 @@ func serve(addr, basePath string) error {
 			Logger:       logger,
 			LogDir:       cfg.LogDir,
 			DefaultModel: pc.DefaultModel,
+			// Native cloud providers get real container isolation
+			// (sandbox.DockerSandbox) rather than HostSandbox's host-side
+			// path-prefix confinement.
+			SandboxKind:  "docker",
+			SandboxImage: cfg.SandboxImage,
 		}
-		logger.Info("anthropic runner registered", "default_model", pc.DefaultModel)
+		logger.Info("anthropic runner registered", "default_model", pc.DefaultModel, "sandbox", "docker")
 	}
 
 	pool := executor.NewPool(cfg.MaxConcurrent, runners, store, logger)