Feature/seatbelt provider

[drscrewdriver]

--

PR 2: feature/seatbelt-provider

验证结果

验证项	结果
条件导入（Linux 不加载 Seatbelt）	PASS
_normalize_code_sandbox('seatbelt')	PASS
register_seatbelt_sandbox_action 方法存在	PASS
SBPL profile 生成（deny default / whitelist write / protected / deny-read）	PASS
网络开关	PASS
Provider name/kind 属性	PASS
create_handle 在 Linux 返回 unavailable	PASS
现有测试无新增失败	PASS

PR 说明（含待修复问题）

## feat: Seatbelt (macOS) ExecutionResourceProvider

### Summary

新增 macOS Seatbelt 沙箱后端，通过 `sandbox-exec` + SBPL (Seatbelt 
Profile Language) 提供内核级系统调用过滤，作为 Docker 隔离的轻量替代。
仅需 macOS，零外部依赖。

### Changes

| File | +/- | Description |
|------|-----|-------------|
| `SeatbeltExecutionResourceProvider.py` | +369 | 新文件：SeatbeltExecutionResource + SeatbeltExecutionResourceProvider |
| `ExecutionResourceProvider/__init__.py` | +6 | 条件导入（仅 Darwin 平台加载） |
| `ActionResourceRegistrar.py` | +75 / -4 | `_normalize_code_sandbox` 新增 `"seatbelt"`；新增 `register_seatbelt_sandbox_action` |


### SBPL Profile Design (inspired by OpenHanako)

- **Default deny all** → 最小权限原则
- **基础能力**：process-exec*, process-fork, signal, mach(*), ipc-posix*
- **文件读取**：全局允许（AI agent 需读系统库执行命令）
- **文件写入**：白名单模式（writable_paths + temp dirs）
- **受保护路径**：protected_paths 禁止写入（last-match-wins，覆盖 allow）
- **禁止读取**：deny_read_paths 同时禁止读写（保护 secrets）
- **设备文件**：/dev/null, /dev/ptmx, pseudo-tty
- **网络**：可选 outbound 开关
- **realpath** 防符号链接绕过

### Usage

```python
agent.register_seatbelt_sandbox_action(
    action_id="mac_sandbox",
    network=False,
    writable_paths=["/workspace"],
    protected_paths=["/workspace/.git"],
    deny_read_paths=["/home/user/.env"],
)

[Maplemx]

Status update

Agently 4.1.4.2 has been released, and the current package is 4.1.4.3. The 4.1.4.3 change is an unrelated Pydantic structured-output patch; the code-execution provider contract introduced on the 4.1.4.2 line is ready for this contribution.

Please rebase or retarget this PR onto the current dev branch and adapt Seatbelt as an independent code_execution provider:

• keep a stable provider id and perform a real macOS/sandbox-exec availability probe;
• report actual isolation axes and fail closed for unsupported required capabilities;
• consume the existing request and immutable execution bundle rather than adding a parallel sandbox facade;
• honor TaskWorkspace grants, bounded stdout/stderr, timeout/cancellation, declared-output readback, and provider release cleanup;
• keep platform-specific imports fail-open on non-macOS hosts and add focused provider/conformance tests.

Migration reference: Code Execution Provider Migration.

---

状态更新

Agently 4.1.4.2 已经发布，当前 package 是 4.1.4.3。4.1.4.3 只是无关的 Pydantic 结构化输出补丁；4.1.4.2 发布线提供的 code-execution provider 契约已经可以承接本 PR。

请把本 PR rebase 或 retarget 到当前 dev，并把 Seatbelt 适配为独立的 code_execution provider：

• 使用稳定 provider id，并真实探测 macOS / sandbox-exec 可用性；
• 上报真实 isolation axes，对无法满足的 required capabilities fail closed；
• 消费现有 request 与 immutable execution bundle，不再增加平行 sandbox facade；
• 遵守 TaskWorkspace grant、stdout/stderr 上限、timeout/cancellation、declared-output readback 和 provider release cleanup；
• 非 macOS 环境保持平台特定 import fail-open，并增加聚焦的 provider/conformance 测试。

迁移说明：Code Execution Provider Migration。

[Maplemx]

Superseded by the newer Seatbelt contribution #333 and the accepted maintainer integration #351.

#351 is now merged to dev with the contributor history from #333, real macOS Seatbelt evidence, grant-only write policy, bounded lifecycle handling, and consolidated documentation. This older parallel draft will not be expanded independently.