[FEATURE] Mods API: give Bash results the sandbox violations as a structured field

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Sandbox Tuner (github.com/dot-agi/sandbox-tuner) is a mod that offers Allow for a host or folder after the sandbox blocks a Bash command. It must know what the sandbox really blocked.

In Claude Code 2.1.296 on macOS, a failed call resolves to the error arm of ToolCallResult:

/** ...never the tool's typed record. */
result: unknown;
/** The error as the model reads it. */
text?: string;

The engine joins the <sandbox_violations> report into text with the command's own output. The Bash tool record has stdout and stderr and no violation field. The allowed_domains doc says "the <sandbox_violations> block names the host", so text is the only source.

A command can print its own <sandbox_violations> block. The mod cannot tell it from the real report, so a forged block can make Allow appear for a host or folder that an attacker chose.

Proposed Solution

1. Add an engine-owned field to the Bash tool record (success) and to the error arm of ToolCallResult, beside text:

sandboxViolations?: readonly SandboxViolation[];

type SandboxViolation = {
  kind: 'network' | 'file-read' | 'file-write' | 'other';
  target: string;      // host or absolute path
  port?: number;
  operation?: string;  // raw sandbox operation, e.g. mach-lookup
};

1. Fill it from the sandbox monitor only, never from command output.
2. Bind it to the call's tool_use_id.

Alternative Solutions

Parsing text, as Sandbox Tuner does today, is forgeable. Escaping the tag in output still gives mods no typed data.

Priority

Medium - Would be very helpful

Feature Category

Other (mods API)

Use Case Example

1. A Bash command fails because the sandbox blocks registry.example.com.
2. Sandbox Tuner reads sandboxViolations and offers Allow for that host only.
3. A printed fake block adds nothing to sandboxViolations, so no Allow appears.

This removes the Sandbox Tuner README limit "A failed command can forge a sandbox report".

Additional Context

Quotes are from the 2.1.296 mod API type files.