fix: apply the sandboxed and extraBinds settings a roj.config declares

[matej21]

RojConfig declares sandboxed and extraBinds, and no host used them. Both loaders read sandboxed into the returned config, and every entry point then reduced that config to its presets before handing it on. extraBinds was not even parsed. A user writing defineConfig({ sandboxed: true }) got no sandbox, no warning and no error.

The fold lives in bootstrap(), the one place every host already passes through, rather than in each entry point — that is what makes it hard to skip. Three entry points were dropping the config, including the platform-CLI bundle path, which reduced it to presets even though the other branch re-exported it whole. SessionDefaults (presets, sandboxed, extraBinds) is now a named slice that RojConfig and both server option types extend, so a server forwards { ...options, presets } instead of naming fields and a new field does not need every caller updated.

Precedence: preset.sandboxed ?? config.sandboxed ?? false. An explicit preset value wins in both directions, the file-level value fills the gap, the default stays false. extraBinds follow the same rule, and an empty list counts as a declaration at either level. A relative bind path resolves against the config directory, matching how local resources already behave; destPath names a location inside the sandbox, so it must be absolute.

Why wire these rather than drop them. A programmatic host sets both knobs on the preset and that path is unchanged. The top-level fields serve the other entry point — a file-based roj.config.ts where one switch for the whole config is the expected ergonomics — so the precedence lets a preset override a file-level default rather than replace it.

The knob now has teeth. Since the shell tool moved behind a host port, a command is refused when the session is sandboxed and the host shell declares confinement: 'none', rather than running unconfined. A config that declares sandboxed: true and reaches a host that cannot confine now fails loudly — the point of the change, but a visible difference for anyone setting the flag on such a host.

Not a default change. A config that declares nothing resolves exactly as before.

Tests pin the wiring, not just the resolver. An earlier revision covered only the shape of the resolved object: reverting the entry points entirely still passed the whole suite. A host is now started from a config and the resulting session's environment is read back, and the bundle entry module is held to what it generates. Each way of severing the chain — at an entry point, at the server, inside bootstrap, at the session, in the generated bundle — now fails a test.

Still open, in the same class and not addressed here: RojConfig.sessionsDir and snapshotter are also declared and read by nobody. snapshotter is parsed by both loaders and never consumed; the snapshotting plugin takes a Snapshotter instance through its own config.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CbVWntVv8xSdtn6DC6ZApM