Update sandbox comments to match current hook flow

Author: lukelabonte

XcodeBuildTools/bin/swift

@@ -6,10 +6,10 @@
 # direct agent invocations and nested calls from build scripts
 # (Makefiles, fastlane, shell scripts, etc.) are sandboxed transparently.
 #
-# Reads $SANDBOX_PACKAGES (exported by the PreToolUse inject-session-id.py
-# hook into every Bash command) and passes it as --cache-path to
-# subcommands that accept SwiftPM flags (build, test, run). Other
-# subcommands pass through unmodified. If $SANDBOX_PACKAGES is unset
+# Reads $SANDBOX_PACKAGES (exported by hooks/write-env.sh through
+# $CLAUDE_ENV_FILE) and passes it as --cache-path to subcommands that
+# accept SwiftPM flags (build, test, run). Other subcommands pass through
+# unmodified. If $SANDBOX_PACKAGES is unset
 # (e.g. the wrapper was invoked from a shell outside a hosted Bash-tool
 # context), the wrapper falls through to an unsandboxed exec.
 #

XcodeBuildTools/bin/xcodebuild

@@ -6,10 +6,10 @@
 # both direct agent invocations and nested calls from build scripts
 # (Makefiles, fastlane, shell scripts, etc.) are sandboxed transparently.
 #
-# Reads $SANDBOX_DERIVED_DATA and $SANDBOX_PACKAGES (exported by the
-# PreToolUse inject-session-id.py hook into every Bash command) and
-# passes them to /usr/bin/xcodebuild as -derivedDataPath and
-# -clonedSourcePackagesDirPath. If neither env var is set (e.g. the
+# Reads $SANDBOX_DERIVED_DATA and $SANDBOX_PACKAGES (exported by
+# hooks/write-env.sh through $CLAUDE_ENV_FILE) and passes them to
+# /usr/bin/xcodebuild as -derivedDataPath and -clonedSourcePackagesDirPath.
+# If neither env var is set (e.g. the
 # wrapper was invoked from a shell outside a hosted Bash-tool context),
 # the wrapper falls through to an unsandboxed exec.
 #

XcodeBuildTools/hooks/setup-sandbox.sh

@@ -5,9 +5,9 @@
 # Creates per-session sandbox directories for DerivedData and SPM cache,
 # isolating CLI builds from Xcode's own storage. The wrapper scripts in
 # bin/ (xcodebuild, swift) read $SANDBOX_DERIVED_DATA and $SANDBOX_PACKAGES
-# at runtime and inject the appropriate isolation flags; those env vars
-# are set on every Bash tool command by hooks/inject-session-id.py from
-# the hook payload's session_id (stable across contexts unlike $PPID).
+# at runtime and inject the appropriate isolation flags. hooks/write-env.sh
+# writes those env vars to $CLAUDE_ENV_FILE during SessionStart so every
+# later Bash tool command inherits the same sandbox paths.
 #
 # Each agent session gets its own sandbox keyed by the session ID
 # from the SessionStart hook's stdin payload.

tests/test_repository_integrity.py

@@ -212,8 +212,17 @@ def test_agent_facing_docs_avoid_known_stale_terms(self):
             "iOSSimulator/skills/ios-simulator/SKILL.md": ["Read tool"],
             "iOSSimulator/skills/ios-simulator/references/script-details.md": ["Read tool"],
             "XcodeBuildTools/session-start.md": ["Claude session", "Claude sessions"],
-            "XcodeBuildTools/bin/xcodebuild": ["Claude invocations", "Claude Bash"],
-            "XcodeBuildTools/bin/swift": ["Claude invocations", "Claude Bash"],
+            "XcodeBuildTools/hooks/setup-sandbox.sh": ["inject-session-id.py"],
+            "XcodeBuildTools/bin/xcodebuild": [
+                "Claude invocations",
+                "Claude Bash",
+                "inject-session-id.py",
+            ],
+            "XcodeBuildTools/bin/swift": [
+                "Claude invocations",
+                "Claude Bash",
+                "inject-session-id.py",
+            ],
         }
 
         for relative_path, stale_terms in checks.items():