@agentproto/driver-agent-cli 2.5.1 → 2.6.0

package/dist/{chunk-ES4VLTGZ.mjs → chunk-SCR7UF3T.mjs}

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { Writable, Readable } from 'stream';
 import { createAcpClient } from '@agentproto/acp/client';
 import { spawn, execFile } from 'child_process';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync, rmdirSync, mkdtempSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync, rmdirSync, realpathSync, mkdtempSync } from 'fs';
 import { createInterface } from 'readline';
-import { join, delimiter, dirname, basename } from 'path';
+import { join, resolve, delimiter, dirname, basename } from 'path';
 import { tmpdir, homedir } from 'os';
 import { loadAdapterSpawnSandboxConfig, resolveCommandSandbox } from '@agentproto/command-sandbox';
 import { randomUUID, createHash } from 'crypto';
@@ -701,15 +701,15 @@ function isAlive(pid) {
   }
 }
 function listProcesses() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     execFile("ps", ["-axo", "pid=,ppid="], { maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
-      if (err) return resolve([]);
+      if (err) return resolve2([]);
       const out = [];
       for (const line of stdout.split("\n")) {
         const m = line.match(/^\s*(\d+)\s+(\d+)\s*$/);
         if (m) out.push({ pid: Number(m[1]), ppid: Number(m[2]) });
       }
-      resolve(out);
+      resolve2(out);
     });
   });
 }
@@ -743,8 +743,13 @@ function defaultToolchainReadPaths() {
 }
 async function wrapAgentCliSpawn(bin, args, opts) {
   const cfg = await loadAdapterSpawnSandboxConfig(opts.cwd);
-  const mode = opts.mode ?? cfg.mode;
+  const mode = opts.zones ? opts.mode ?? "workspace" : opts.mode ?? cfg.mode;
   if (mode === void 0) return [bin, args];
+  if (mode === "off" && opts.zones) {
+    throw new Error(
+      `agent-cli '${opts.label}': filesystem zones (an app boundary) cannot be combined with commandSandbox "off" \u2014 the zones are only enforceable through the OS sandbox. Refusing to spawn.`
+    );
+  }
   if (mode === "off") {
     console.error(
       `[agent-cli] \u26A0 spawning '${opts.label}' UNCONFINED \u2014 no OS-level sandbox is active (commandSandbox mode is "off").`
@@ -757,18 +762,20 @@ async function wrapAgentCliSpawn(bin, args, opts) {
       `agent-cli '${opts.label}': commandSandbox mode="${mode}" is configured but no sandbox backend is available on ${process.platform} (macOS needs sandbox-exec, Linux needs bwrap installed). Refusing to spawn unconfined \u2014 pass commandSandbox: "off" to explicitly accept unconfined execution, or install the missing backend.`
     );
   }
+  const fileCfg = opts.zones ? void 0 : cfg;
   const policy = {
     workspace: opts.cwd,
     extraReadPaths: [
       ...defaultToolchainReadPaths(),
-      ...cfg.extraReadPaths,
+      ...fileCfg?.extraReadPaths ?? [],
       ...opts.extraReadPaths ?? []
     ],
     extraWritePaths: [
       ...defaultToolchainWritePaths(),
-      ...cfg.extraWritePaths,
+      ...fileCfg?.extraWritePaths ?? [],
       ...opts.extraWritePaths ?? []
     ],
+    ...opts.zones ? { zones: opts.zones } : {},
     network: mode === "strict" || cfg.network === "deny" ? "deny" : "allow"
   };
   const wrapped = backend.wrap([bin, ...args], policy);
@@ -822,6 +829,7 @@ function createPrintSession(opts) {
         cwd: opts.cwd,
         ...opts.extraWritePaths ? { extraWritePaths: opts.extraWritePaths } : {},
         ...opts.extraReadPaths ? { extraReadPaths: opts.extraReadPaths } : {},
+        ...opts.fsZones ? { zones: opts.fsZones } : {},
         label: "print-arm"
       });
       const child = spawn(execBin, execArgs, {
@@ -831,11 +839,11 @@ function createPrintSession(opts) {
       });
       activeChild = child;
       let spawnFailure;
-      await new Promise((resolve) => {
-        child.once("spawn", () => resolve());
+      await new Promise((resolve2) => {
+        child.once("spawn", () => resolve2());
         child.once("error", (err) => {
           spawnFailure = err;
-          resolve();
+          resolve2();
         });
       });
       if (spawnFailure) {
@@ -1454,16 +1462,16 @@ var EventQueue = class {
         `print-arm: event backlog exceeded ${QUEUE_HIGH_WATER_MARK} buffered events \u2014 downstream consumer is not keeping up. The child's stdout is still being drained (no ENOBUFS), but memory will grow until the consumer catches up.`
       );
     }
-    const resolve = this.resolveNext;
+    const resolve2 = this.resolveNext;
     this.resolveNext = null;
-    resolve?.();
+    resolve2?.();
   }
   /** Signal that no further events will be pushed. */
   end() {
     this.ended = true;
-    const resolve = this.resolveNext;
+    const resolve2 = this.resolveNext;
     this.resolveNext = null;
-    resolve?.();
+    resolve2?.();
   }
   async *[Symbol.asyncIterator]() {
     for (; ; ) {
@@ -1473,8 +1481,8 @@ var EventQueue = class {
         continue;
       }
       if (this.ended) return;
-      await new Promise((resolve) => {
-        this.resolveNext = resolve;
+      await new Promise((resolve2) => {
+        this.resolveNext = resolve2;
       });
     }
   }
@@ -1493,9 +1501,9 @@ function mapMastraFinishReason(raw) {
   }
 }
 function waitForExit(child) {
-  return new Promise((resolve) => {
-    child.once("exit", (code) => resolve(code));
-    child.once("error", () => resolve(null));
+  return new Promise((resolve2) => {
+    child.once("exit", (code) => resolve2(code));
+    child.once("error", () => resolve2(null));
   });
 }
 
@@ -1744,6 +1752,42 @@ function interpolateEnv(env, value) {
   }
   return out;
 }
+function agentCliSupportsHostContextIsolation(adapterId) {
+  return adapterId === "claude-code";
+}
+function escapeGlob(p) {
+  return p.replace(/[\\*?[\]{}()!+@]/g, "\\$&");
+}
+function ancestors(dir) {
+  const out = [];
+  let cur = dirname(dir);
+  for (; ; ) {
+    out.push(cur);
+    const parent = dirname(cur);
+    if (parent === cur) return out;
+    cur = parent;
+  }
+}
+function hostContextExcludes(cwd) {
+  const abs = resolve(cwd);
+  let real = abs;
+  try {
+    real = realpathSync(abs);
+  } catch {
+  }
+  const dirs = /* @__PURE__ */ new Set([...ancestors(abs), ...ancestors(real)]);
+  const out = [];
+  for (const d of dirs) {
+    const base = d === "/" ? "" : escapeGlob(d);
+    out.push(
+      `${base}/CLAUDE.md`,
+      `${base}/CLAUDE.local.md`,
+      `${base}/.claude/CLAUDE.md`,
+      `${base}/.claude/rules/**`
+    );
+  }
+  return out;
+}
 function createArmSessionControls(arm, definition) {
   const modelApply = definition.models?.apply ?? "config";
   return {
@@ -2033,8 +2077,16 @@ function createAgentCliRuntime(definition) {
         const isolatedSettings = {
           attribution: { commit: "", pr: "", sessionUrl: false }
         };
-        if (permissionMode) {
-          isolatedSettings.permissions = { defaultMode: permissionMode };
+        const isolatedPermissions = {};
+        if (permissionMode) isolatedPermissions.defaultMode = permissionMode;
+        if (opts?.fsZones?.writable.length) {
+          isolatedPermissions.additionalDirectories = opts.fsZones.writable;
+        }
+        if (Object.keys(isolatedPermissions).length > 0) {
+          isolatedSettings.permissions = isolatedPermissions;
+        }
+        if (opts?.isolateHostContext) {
+          isolatedSettings.claudeMdExcludes = hostContextExcludes(cwd);
         }
         writeFileSync(
           join(claudeConfigDir, "settings.json"),
@@ -2053,6 +2105,7 @@ function createAgentCliRuntime(definition) {
           ...opts?.mcpServers ? { mcpServers: opts.mcpServers } : {},
           printConfig: definition.print,
           commandSandbox: opts?.commandSandbox,
+          ...opts?.fsZones ? { fsZones: opts.fsZones } : {},
           ...claudeConfigDir ? { extraWritePaths: [claudeConfigDir] } : {},
           // Exact-file read grant — see the ACP arm's wrapAgentCliSpawn call.
           ...opts?.additionalReadPaths?.length ? { extraReadPaths: opts.additionalReadPaths } : {},
@@ -2068,6 +2121,7 @@ function createAgentCliRuntime(definition) {
           {
             mode: opts?.commandSandbox,
             cwd,
+            ...opts?.fsZones ? { zones: opts.fsZones } : {},
             ...claudeConfigDir ? { extraWritePaths: [claudeConfigDir] } : {},
             // Exact-file read grant (see additionalReadPaths above):
             // READ-only exceptions to the confinement boundary, never writes.
@@ -2083,11 +2137,11 @@ function createAgentCliRuntime(definition) {
         });
         child = spawned;
         let spawnFailure;
-        await new Promise((resolve) => {
-          spawned.once("spawn", () => resolve());
+        await new Promise((resolve2) => {
+          spawned.once("spawn", () => resolve2());
           spawned.once("error", (err) => {
             spawnFailure = err;
-            resolve();
+            resolve2();
           });
         });
         if (spawnFailure) {
@@ -2296,6 +2350,6 @@ function derivedModelRefusalError(definition, requested, reason) {
   );
 }
 
-export { LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
-//# sourceMappingURL=chunk-ES4VLTGZ.mjs.map
-//# sourceMappingURL=chunk-ES4VLTGZ.mjs.map
+export { LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, agentCliSupportsHostContextIsolation, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, hostContextExcludes, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
+//# sourceMappingURL=chunk-SCR7UF3T.mjs.map
+//# sourceMappingURL=chunk-SCR7UF3T.mjs.map