maf 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96b1964631e2a552046c0ddd8652294c79a4cce5c1c712770a2e6d2560f01fe6
-  data.tar.gz: 5931acc6d9569fedd3859f1ffe28a293c83f415e4cb228402867c7a4b7747171
+  metadata.gz: 0600cae448899ea324b41b1cc21c2fefc40f9f1b5b349bfd0d6ae6ea2fdd90dc
+  data.tar.gz: 32d55e40cfa8de776f1ba464a3316c8872737a1bfe4953bae45462678792046c
 SHA512:
-  metadata.gz: 44c6fa9c6804fc4f474630a56504197353d353452cc4bf0e34d90f646e9ef7320cd173cfe2cf33f7d4e60da2d47b410eb1432e797e772f20060e6c74ec1d6833
-  data.tar.gz: 36f145d2992490cebe573dc613dfaea00ec23b7159ec3c493176066e6d5930c2283ac183a813a80de27c706d143e2ee9821da119828a9304c2e48f067b6f399a
+  metadata.gz: 2efc01c78cd25e6a017361df5c735880c7ddad65d4b40e7e3b9c6b8659bb5b3fed7680009838ed9ff1e84cb0ec65c9f9261f70229800d50e35d71d860e4c0044
+  data.tar.gz: 752dd79b5d7ea15a8206a7aaf3b6097f21c5d8d51a7f45ef66d60822d46ea948272d0095b66a4959670f5d00495242c11774fcbd30784fd21e2ab65dd54bab0c

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-10-29
+
+- Changed: the dispatcher no longer escalates a crash or a LaunchServices denial of a macOS
+  service (a program in `/System/`, `MTLCompilerService`, `intelligencecontextd`). It writes a log
+  line only. Before, each one reached the project manager as an `ESCALATION` that needed no action.
+- Fixed: the macOS sandbox lets an agent connect to the PostgreSQL socket in `/tmp`
+  (`/tmp/.s.PGSQL.<port>`). Before, a Rails test that used the socket got `Operation not permitted`.
+- Fixed: when the pull request of a goal merges, coord keeps the goal branch while a task of the
+  goal is still open. Before, `coord gc` deleted it and the open task could not land.
+
 ## [0.7.0] - 2026-10-24
 
 - Changed: the project manager interviews the user until no decision stays silently assumed. It asks

data/assets/coord

@@ -1577,6 +1577,7 @@ end
     def goal_reason(name)
       goal = @tasks.find_short(name.delete_prefix("goal/"))
       return "goal is not done" unless goal["status"] == "completed"
+      return "goal has open tasks" if @tasks.for_goal(goal["uuid"]).any?
 
       Git.ancestor?(@root, name, ref) ? nil : "not merged into #{ref}"
     end

data/assets/dispatcher

@@ -758,6 +758,10 @@ module Dispatcher
              "apps outside the sandbox. An app with its own sandbox (Chrome) also needs it off (--no-sandbox), " \
              "because macOS cannot start a sandbox in a sandbox. Tell the user."
 
+    SYSTEM = %w[MTLCompilerService intelligencecontextd].freeze
+    IGNORED = "Dispatcher of %<worker>s: in the macOS sandbox, these macOS services crashed or were refused " \
+              "LaunchServices: %<apps>s. maf ignores them."
+
     @seen = []
 
     def self.guard(harness, config, env, &block)
@@ -774,9 +778,21 @@ module Dispatcher
     def self.report(config, env, crashes, denied)
       crashes = crashes.except(*@seen)
       denied -= @seen
+      @seen.concat(crashes.keys, denied)
+      ignore(config, crashes.keys + denied)
+      escalate(config, env, crashes.reject { |app, _| system?(app) }, denied.reject { |app| system?(app) })
+    end
+
+    def self.system?(app) = app.start_with?("/System/") || SYSTEM.include?(File.basename(app, ".*"))
+
+    def self.ignore(config, apps)
+      ignored = apps.select { |app| system?(app) }.uniq
+      Log.line(format(IGNORED, worker: config.worker, apps: ignored.join(", "))) if ignored.any?
+    end
+
+    def self.escalate(config, env, crashes, denied)
       return if crashes.empty? && denied.empty?
 
-      @seen.concat(crashes.keys, denied)
       text = format(NOTICE, worker: config.worker, found: found(crashes, denied))
       Log.line(text)
       CoordCall.run(env, "escalate", text)

data/lib/maf/shared/sandbox/seatbelt.rb

@@ -15,6 +15,7 @@ module Maf
         DEVICES = '(literal "/dev/null") (literal "/dev/zero") (literal "/dev/dtracehelper") ' \
                   '(regex #"^/dev/tty") (regex #"^/dev/fd/") (regex #"^/dev/ptmx")'
         DNS = '(path-literal "/private/var/run/mDNSResponder")'
+        POSTGRES = '(regex #"^/private/tmp/\\.s\\.PGSQL\\.[0-9]+$")'
         TMP_PREFIX = "maf-sandbox-"
         # The map database of LaunchServices only reads: it turns a type name into a type.
         # Without it, pbcopy writes the text with a type that no app reads.
@@ -98,7 +99,7 @@ module Maf
         end
 
         def self.sockets(dirs)
-          allowed = [DNS, *dirs.map { |dir| "(subpath #{quote(dir)})" }]
+          allowed = [DNS, POSTGRES, *dirs.map { |dir| "(subpath #{quote(dir)})" }]
           rules = allowed.map { |path| "(allow network-outbound (remote unix-socket #{path}))\n" }
           "(deny network-outbound (remote unix-socket))\n#{rules.join}"
         end

data/lib/maf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Maf
-  VERSION = "0.7.0"
+  VERSION = "0.7.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: maf
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Dominik Alberski