release: v0.7.3 — fix macOS sandbox blocking every agent command

On macOS the sandbox-exec profile denied all writes outside the worktree, but
the agent's temp dir is /private/tmp/claude-<uid> and the resolved per-user
TMPDIR under /private/var/folders — neither was writable, so EVERY command
failed with "EPERM: operation not permitted, mkdir", the agent asked the user
to run commands, and the task stalled in implementation. Allow those temp
paths in the profile. (os.tmpdir() was already passed but didn't match due to
the /var -> /private/var symlink.) Linux/bubblewrap already binds /tmp writable.

Claude-Session: https://claude.ai/code/session_012GujqUM9Rzsu9dmhee8fQy

Author: shahinyanm

CHANGELOG.md

@@ -6,6 +6,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-06-26
+
+### Fixed
+
+- **Autopilot can run commands on macOS** — the OS sandbox (sandbox-exec) denied
+  all writes outside the worktree, but the agent's temp dir lives elsewhere
+  (`/private/tmp/claude-<uid>` and the resolved per-user `TMPDIR` under
+  `/private/var/folders`). So on a Mac EVERY command died with "EPERM: operation
+  not permitted, mkdir" — the agent couldn't run git/npm/tests, asked the user to
+  run them, and the task stalled in implementation. The sandbox profile now keeps
+  those temp paths writable (the passed `os.tmpdir()` didn't match because of the
+  `/var`→`/private/var` symlink). Linux (bubblewrap) was unaffected — it already
+  binds `/tmp` writable.
+
 ## [0.7.2] - 2026-06-26
 
 ### Fixed
@@ -154,7 +168,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Task-journal availability** — every session reaches task-journal, so
   reasoning-chain events are recorded; confirmed working end-to-end.
 
-[Unreleased]: https://github.com/Digital-Threads/loom/compare/v0.7.2...master
+[Unreleased]: https://github.com/Digital-Threads/loom/compare/v0.7.3...master
+[0.7.3]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.3
 [0.7.2]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.2
 [0.7.1]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.1
 [0.7.0]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digital-threads/loom",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "type": "module",
   "description": "Loom — local AI-dev orchestrator: give it a task and it runs the work through an analysis → spec → code → review → PR pipeline on a board, with cost, reasoning memory and multi-account support. Public beta.",
   "license": "MIT",

src/core/layers/security/os-sandbox.ts

@@ -78,6 +78,13 @@ export function wrapCommand(
       "(version 1)",
       "(allow default)",
       '(deny file-write* (subpath "/"))',
+      // The agent (and the claude CLI / its Bun runtime) needs a writable temp
+      // dir — e.g. /private/tmp/claude-<uid> and the per-user TMPDIR under
+      // /private/var/folders. Without it EVERY command fails with "EPERM:
+      // operation not permitted, mkdir" and the task stalls. Confinement is about
+      // the user's repo/home, not temp (loom-sbtmp).
+      '(allow file-write* (subpath "/private/tmp"))',
+      '(allow file-write* (subpath "/private/var/folders"))',
       ...writable.map((p) => `(allow file-write* (subpath ${JSON.stringify(p)}))`),
     ].join(" ");
     return { cli: "sandbox-exec", args: ["-p", profile, cli, ...args] };

test/core/layers/security/os-sandbox.test.ts

@@ -50,6 +50,10 @@ describe("os-sandbox (experimental, opt-in)", () => {
     expect(w.args[0]).toBe("-p");
     expect(w.args[1]).toContain('(deny file-write* (subpath "/"))');
     expect(w.args[1]).toContain("/wt");
+    // …but the agent's temp dir stays writable — without it every command fails
+    // with "EPERM: mkdir /private/tmp/claude-<uid>" and the task stalls (loom-sbtmp).
+    expect(w.args[1]).toContain('(allow file-write* (subpath "/private/tmp"))');
+    expect(w.args[1]).toContain('(subpath "/private/var/folders")');
     expect(w.args.slice(2)).toEqual(["claude", "-p"]);
   });