@agentproto/driver-agent-cli 2.5.1 → 2.6.1

package/dist/{chunk-ES4VLTGZ.mjs → chunk-EZROBN7Q.mjs}

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { Writable, Readable } from 'stream';
 import { createAcpClient } from '@agentproto/acp/client';
 import { spawn, execFile } from 'child_process';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync, rmdirSync, mkdtempSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync, rmdirSync, realpathSync, mkdtempSync } from 'fs';
 import { createInterface } from 'readline';
-import { join, delimiter, dirname, basename } from 'path';
+import { join, resolve, delimiter, dirname, basename } from 'path';
 import { tmpdir, homedir } from 'os';
 import { loadAdapterSpawnSandboxConfig, resolveCommandSandbox } from '@agentproto/command-sandbox';
 import { randomUUID, createHash } from 'crypto';
@@ -701,18 +701,34 @@ function isAlive(pid) {
   }
 }
 function listProcesses() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     execFile("ps", ["-axo", "pid=,ppid="], { maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
-      if (err) return resolve([]);
+      if (err) return resolve2([]);
       const out = [];
       for (const line of stdout.split("\n")) {
         const m = line.match(/^\s*(\d+)\s+(\d+)\s*$/);
         if (m) out.push({ pid: Number(m[1]), ppid: Number(m[2]) });
       }
-      resolve(out);
+      resolve2(out);
     });
   });
 }
+function isWindowsBatchFile(exe, deps) {
+  if ((process.platform) !== "win32") return false;
+  return /\.(?:bat|cmd)$/i.test(exe);
+}
+function windowsBatchShellOption(exe, deps) {
+  if (isWindowsBatchFile(exe)) return { shell: true };
+  return {};
+}
+function resolveWindowsBatchSpawn(bin, args, deps) {
+  if ((process.platform) !== "win32") return void 0;
+  if (!isWindowsBatchFile(bin)) return void 0;
+  const stem = basename(bin).replace(/\.(?:bat|cmd)$/i, "");
+  if (stem !== "npx" && stem !== "npm") return void 0;
+  join(dirname(bin), "node_modules", "npm", "bin", `${stem}-cli.js`);
+  return void 0;
+}
 function defaultToolchainWritePaths() {
   const home = homedir();
   return [
@@ -743,8 +759,13 @@ function defaultToolchainReadPaths() {
 }
 async function wrapAgentCliSpawn(bin, args, opts) {
   const cfg = await loadAdapterSpawnSandboxConfig(opts.cwd);
-  const mode = opts.mode ?? cfg.mode;
+  const mode = opts.zones ? opts.mode ?? "workspace" : opts.mode ?? cfg.mode;
   if (mode === void 0) return [bin, args];
+  if (mode === "off" && opts.zones) {
+    throw new Error(
+      `agent-cli '${opts.label}': filesystem zones (an app boundary) cannot be combined with commandSandbox "off" \u2014 the zones are only enforceable through the OS sandbox. Refusing to spawn.`
+    );
+  }
   if (mode === "off") {
     console.error(
       `[agent-cli] \u26A0 spawning '${opts.label}' UNCONFINED \u2014 no OS-level sandbox is active (commandSandbox mode is "off").`
@@ -757,18 +778,20 @@ async function wrapAgentCliSpawn(bin, args, opts) {
       `agent-cli '${opts.label}': commandSandbox mode="${mode}" is configured but no sandbox backend is available on ${process.platform} (macOS needs sandbox-exec, Linux needs bwrap installed). Refusing to spawn unconfined \u2014 pass commandSandbox: "off" to explicitly accept unconfined execution, or install the missing backend.`
     );
   }
+  const fileCfg = opts.zones ? void 0 : cfg;
   const policy = {
     workspace: opts.cwd,
     extraReadPaths: [
       ...defaultToolchainReadPaths(),
-      ...cfg.extraReadPaths,
+      ...fileCfg?.extraReadPaths ?? [],
       ...opts.extraReadPaths ?? []
     ],
     extraWritePaths: [
       ...defaultToolchainWritePaths(),
-      ...cfg.extraWritePaths,
+      ...fileCfg?.extraWritePaths ?? [],
       ...opts.extraWritePaths ?? []
     ],
+    ...opts.zones ? { zones: opts.zones } : {},
     network: mode === "strict" || cfg.network === "deny" ? "deny" : "allow"
   };
   const wrapped = backend.wrap([bin, ...args], policy);
@@ -777,12 +800,12 @@ async function wrapAgentCliSpawn(bin, args, opts) {
 
 // src/protocol/print-arm.ts
 function printModelMismatch(requested, reported) {
-  const basename2 = (id) => {
+  const basename3 = (id) => {
     const noSuffix = id.split("@")[0] ?? id;
     const segs = noSuffix.split("/");
     return (segs[segs.length - 1] ?? noSuffix).trim().toLowerCase();
   };
-  return basename2(requested) !== basename2(reported);
+  return basename3(requested) !== basename3(reported);
 }
 var DEFAULT_OUTPUT = ["--output-format", "stream-json"];
 var DEFAULT_PRE_PROMPT = ["--no-interactive"];
@@ -822,20 +845,26 @@ function createPrintSession(opts) {
         cwd: opts.cwd,
         ...opts.extraWritePaths ? { extraWritePaths: opts.extraWritePaths } : {},
         ...opts.extraReadPaths ? { extraReadPaths: opts.extraReadPaths } : {},
+        ...opts.fsZones ? { zones: opts.fsZones } : {},
         label: "print-arm"
       });
       const child = spawn(execBin, execArgs, {
         cwd: opts.cwd,
         env: opts.env,
-        stdio: ["ignore", "pipe", "pipe"]
+        stdio: ["ignore", "pipe", "pipe"],
+        // Win32: only reached for a `.cmd`/`.bat` bin that
+        // `resolveWindowsBatchSpawn` couldn't rewrite to its node entry
+        // (see `win32-spawn.ts` — Node refuses direct batch spawning,
+        // CVE-2024-27980, the recap-10 `spawn EINVAL`). POSIX: `{}`.
+        ...windowsBatchShellOption(execBin)
       });
       activeChild = child;
       let spawnFailure;
-      await new Promise((resolve) => {
-        child.once("spawn", () => resolve());
+      await new Promise((resolve2) => {
+        child.once("spawn", () => resolve2());
         child.once("error", (err) => {
           spawnFailure = err;
-          resolve();
+          resolve2();
         });
       });
       if (spawnFailure) {
@@ -1454,16 +1483,16 @@ var EventQueue = class {
         `print-arm: event backlog exceeded ${QUEUE_HIGH_WATER_MARK} buffered events \u2014 downstream consumer is not keeping up. The child's stdout is still being drained (no ENOBUFS), but memory will grow until the consumer catches up.`
       );
     }
-    const resolve = this.resolveNext;
+    const resolve2 = this.resolveNext;
     this.resolveNext = null;
-    resolve?.();
+    resolve2?.();
   }
   /** Signal that no further events will be pushed. */
   end() {
     this.ended = true;
-    const resolve = this.resolveNext;
+    const resolve2 = this.resolveNext;
     this.resolveNext = null;
-    resolve?.();
+    resolve2?.();
   }
   async *[Symbol.asyncIterator]() {
     for (; ; ) {
@@ -1473,8 +1502,8 @@ var EventQueue = class {
         continue;
       }
       if (this.ended) return;
-      await new Promise((resolve) => {
-        this.resolveNext = resolve;
+      await new Promise((resolve2) => {
+        this.resolveNext = resolve2;
       });
     }
   }
@@ -1493,9 +1522,9 @@ function mapMastraFinishReason(raw) {
   }
 }
 function waitForExit(child) {
-  return new Promise((resolve) => {
-    child.once("exit", (code) => resolve(code));
-    child.once("error", () => resolve(null));
+  return new Promise((resolve2) => {
+    child.once("exit", (code) => resolve2(code));
+    child.once("error", () => resolve2(null));
   });
 }
 
@@ -1744,6 +1773,42 @@ function interpolateEnv(env, value) {
   }
   return out;
 }
+function agentCliSupportsHostContextIsolation(adapterId) {
+  return adapterId === "claude-code";
+}
+function escapeGlob(p) {
+  return p.replace(/[\\*?[\]{}()!+@]/g, "\\$&");
+}
+function ancestors(dir) {
+  const out = [];
+  let cur = dirname(dir);
+  for (; ; ) {
+    out.push(cur);
+    const parent = dirname(cur);
+    if (parent === cur) return out;
+    cur = parent;
+  }
+}
+function hostContextExcludes(cwd) {
+  const abs = resolve(cwd);
+  let real = abs;
+  try {
+    real = realpathSync(abs);
+  } catch {
+  }
+  const dirs = /* @__PURE__ */ new Set([...ancestors(abs), ...ancestors(real)]);
+  const out = [];
+  for (const d of dirs) {
+    const base = d === "/" ? "" : escapeGlob(d);
+    out.push(
+      `${base}/CLAUDE.md`,
+      `${base}/CLAUDE.local.md`,
+      `${base}/.claude/CLAUDE.md`,
+      `${base}/.claude/rules/**`
+    );
+  }
+  return out;
+}
 function createArmSessionControls(arm, definition) {
   const modelApply = definition.models?.apply ?? "config";
   return {
@@ -1998,6 +2063,9 @@ function createAgentCliRuntime(definition) {
       }
       const spawnBin = npxFast?.bin ?? resolvedBin;
       const spawnArgs = npxFast?.args ?? composed.binArgs;
+      const batchRewrite = resolveWindowsBatchSpawn(spawnBin);
+      const finalBin = batchRewrite?.bin ?? spawnBin;
+      const finalArgs = batchRewrite?.args ?? spawnArgs;
       if (opts?.additionalReadPaths?.length) {
         env.AGENTPROTO_ADDITIONAL_READ_PATHS = JSON.stringify(opts.additionalReadPaths);
       }
@@ -2033,8 +2101,16 @@ function createAgentCliRuntime(definition) {
         const isolatedSettings = {
           attribution: { commit: "", pr: "", sessionUrl: false }
         };
-        if (permissionMode) {
-          isolatedSettings.permissions = { defaultMode: permissionMode };
+        const isolatedPermissions = {};
+        if (permissionMode) isolatedPermissions.defaultMode = permissionMode;
+        if (opts?.fsZones?.writable.length) {
+          isolatedPermissions.additionalDirectories = opts.fsZones.writable;
+        }
+        if (Object.keys(isolatedPermissions).length > 0) {
+          isolatedSettings.permissions = isolatedPermissions;
+        }
+        if (opts?.isolateHostContext) {
+          isolatedSettings.claudeMdExcludes = hostContextExcludes(cwd);
         }
         writeFileSync(
           join(claudeConfigDir, "settings.json"),
@@ -2045,14 +2121,15 @@ function createAgentCliRuntime(definition) {
       if (definition.protocol === "print") {
         const printModel = config?.options?.model;
         return createPrintSession({
-          bin: spawnBin,
-          baseArgs: spawnArgs,
+          bin: finalBin,
+          baseArgs: finalArgs,
           cwd,
           env,
           ...opts?.resumeSessionId ? { resumeSessionId: opts.resumeSessionId } : {},
           ...opts?.mcpServers ? { mcpServers: opts.mcpServers } : {},
           printConfig: definition.print,
           commandSandbox: opts?.commandSandbox,
+          ...opts?.fsZones ? { fsZones: opts.fsZones } : {},
           ...claudeConfigDir ? { extraWritePaths: [claudeConfigDir] } : {},
           // Exact-file read grant — see the ACP arm's wrapAgentCliSpawn call.
           ...opts?.additionalReadPaths?.length ? { extraReadPaths: opts.additionalReadPaths } : {},
@@ -2063,11 +2140,12 @@ function createAgentCliRuntime(definition) {
       const stderrBuf = [];
       if (definition.protocol !== "proprietary") {
         const [execBin, execArgs] = await wrapAgentCliSpawn(
-          spawnBin,
-          spawnArgs,
+          finalBin,
+          finalArgs,
           {
             mode: opts?.commandSandbox,
             cwd,
+            ...opts?.fsZones ? { zones: opts.fsZones } : {},
             ...claudeConfigDir ? { extraWritePaths: [claudeConfigDir] } : {},
             // Exact-file read grant (see additionalReadPaths above):
             // READ-only exceptions to the confinement boundary, never writes.
@@ -2079,15 +2157,20 @@ function createAgentCliRuntime(definition) {
           cwd,
           env,
           stdio: ["pipe", "pipe", "pipe"],
-          signal: opts?.signal
+          signal: opts?.signal,
+          // Win32: a `.cmd`/`.bat` bin that `resolveWindowsBatchSpawn`
+          // couldn't rewrite to its node entry needs the shell — Node
+          // refuses to spawn batch files directly (CVE-2024-27980, the
+          // recap-10 `spawn EINVAL`). POSIX: `{}` — unchanged.
+          ...windowsBatchShellOption(execBin)
         });
         child = spawned;
         let spawnFailure;
-        await new Promise((resolve) => {
-          spawned.once("spawn", () => resolve());
+        await new Promise((resolve2) => {
+          spawned.once("spawn", () => resolve2());
           spawned.once("error", (err) => {
             spawnFailure = err;
-            resolve();
+            resolve2();
           });
         });
         if (spawnFailure) {
@@ -2296,6 +2379,6 @@ function derivedModelRefusalError(definition, requested, reason) {
   );
 }
 
-export { LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
-//# sourceMappingURL=chunk-ES4VLTGZ.mjs.map
-//# sourceMappingURL=chunk-ES4VLTGZ.mjs.map
+export { LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, agentCliSupportsHostContextIsolation, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, hostContextExcludes, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
+//# sourceMappingURL=chunk-EZROBN7Q.mjs.map
+//# sourceMappingURL=chunk-EZROBN7Q.mjs.map