@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/claude-settings.ts

@@ -1,5 +1,19 @@
 import { isAbsolute } from "node:path";
 import { CLAUDE_AUTH_VARIABLES } from "./claude-credential";
+import type { RuntimePolicy } from "../runtime/config";
+import { runtimeHooksEnabled } from "../runtime/hooks";
+import { requireRuntimeReadRoots, isRuntimeHomeRoot } from "../runtime/paths";
+import { nativeStatePath } from "../native-transcript-state";
+import {
+  workspaceStatePath,
+  workspaceBoundaryException,
+} from "../fixtures/workspace-state";
+
+interface WritableRuntime {
+  root: string;
+  workspace: string;
+  cacheRoots?: string[];
+}
 
 function absoluteRule(root: string, tool: "Read" | "Edit"): string {
   if (!isAbsolute(root) || /[\r\n()]/.test(root))
@@ -7,46 +21,251 @@ function absoluteRule(root: string, tool: "Read" | "Edit"): string {
   return `${tool}(/${root}/**)`;
 }
 
+function validPrivatePaths(
+  privateRoot: string,
+  credentialFile: string,
+  roots: string[],
+): boolean {
+  return !(
+    !isAbsolute(privateRoot) ||
+    !isAbsolute(credentialFile) ||
+    !credentialFile.startsWith(`${privateRoot}/`) ||
+    roots.some((root) => !isAbsolute(root) || /[\r\n()]/.test(root))
+  );
+}
+
 /** Keep agent tools away from the CLI's private state while core auth works. */
 export function claudeHostSettings(
   privateRoot: string,
   credentialFile: string,
   pluginRoots: string[] = [],
   protectedRoots: string[] = [],
+  runtimePolicy?: RuntimePolicy,
+  transcriptReadRoots: string[] = [],
+  runtime?: WritableRuntime,
+  workspace?: string,
 ): Record<string, unknown> {
   if (
-    !isAbsolute(privateRoot) ||
-    !isAbsolute(credentialFile) ||
-    !credentialFile.startsWith(`${privateRoot}/`) ||
-    [...pluginRoots, ...protectedRoots].some(
-      (root) => !isAbsolute(root) || /[\r\n()]/.test(root),
-    )
+    !validPrivatePaths(privateRoot, credentialFile, [
+      ...pluginRoots,
+      ...protectedRoots,
+    ])
   )
     throw new Error("Claude private state paths are invalid");
+  const readRoots = runtimeReadRoots(runtimePolicy);
+  requireRuntimeReadRoots(readRoots, [privateRoot, ...protectedRoots]);
+  requireRuntimeReadRoots(runtimeCacheRoots(runtime), [
+    privateRoot,
+    ...protectedRoots,
+  ]);
   return {
-    disableAllHooks: true,
+    disableAllHooks: !runtimeHooksEnabled(runtimePolicy),
     sandbox: {
       enabled: true,
       allowUnsandboxedCommands: false,
       failIfUnavailable: true,
-      filesystem: {
-        denyRead: [privateRoot, ...protectedRoots],
-        denyWrite: [privateRoot, ...pluginRoots, ...protectedRoots],
-      },
+      filesystem: claudeFilesystemPolicy(
+        privateRoot,
+        protectedRoots,
+        readRoots,
+        transcriptReadRoots,
+        pluginRoots,
+        runtime,
+        workspace,
+      ),
       credentials: {
         files: [{ path: credentialFile, mode: "deny" }],
         envVars: CLAUDE_AUTH_VARIABLES.map((name) => ({ name, mode: "deny" })),
       },
     },
-    permissions: {
-      allow: ["Bash", "Read", "Edit", "Skill", "Agent"],
-      deny: [
-        ...[privateRoot, ...protectedRoots].flatMap((root) => [
-          absoluteRule(root, "Read"),
-          absoluteRule(root, "Edit"),
-        ]),
-        ...pluginRoots.map((root) => absoluteRule(root, "Edit")),
-      ],
-    },
+    permissions: claudePermissions(
+      privateRoot,
+      protectedRoots,
+      pluginRoots,
+      runtimePolicy,
+      transcriptReadRoots,
+      runtime,
+      workspace,
+    ),
+  };
+}
+
+function claudeFilesystemPolicy(
+  privateRoot: string,
+  protectedRoots: string[],
+  readRoots: string[],
+  transcriptReadRoots: string[],
+  pluginRoots: string[],
+  runtime: WritableRuntime | undefined,
+  workspace: string | undefined,
+) {
+  const runtimeWriteRoot = runtime?.root;
+  const writableRoots = runtimeWriteRoots(runtime);
+  return {
+    denyRead: [privateRoot, ...protectedRoots],
+    allowRead: [
+      ...workspaceBoundaryException(workspaceStatePath(), workspace),
+      ...readRoots,
+      ...transcriptReadRoots,
+      ...pluginRoots,
+      ...writableRoots,
+    ],
+    ...(writableRoots.length ? { allowWrite: writableRoots } : {}),
+    denyWrite: [
+      privateRoot,
+      ...pluginRoots,
+      ...writableProtectedRoots(
+        protectedRoots,
+        runtimeWriteRoot,
+        workspace,
+        runtimeCacheRoots(runtime),
+      ),
+      ...readRoots,
+      ...transcriptReadRoots,
+    ],
+  };
+}
+
+function claudePermissions(
+  privateRoot: string,
+  protectedRoots: string[],
+  pluginRoots: string[],
+  policy: RuntimePolicy | undefined,
+  transcriptReadRoots: string[],
+  runtime: WritableRuntime | undefined,
+  workspace: string | undefined,
+) {
+  const runtimeWriteRoot = runtime?.root;
+  const roots = [
+    privateRoot,
+    ...protectedRoots.filter(
+      (root) => !workspaceBoundaryException(root, workspace).length,
+    ),
+  ];
+  const managedWorkspace = workspaceBoundaryException(
+    workspaceStatePath(),
+    workspace,
+  )[0];
+  const readRoots = policy
+    ? roots.filter((root) => !isRuntimeHomeRoot(root))
+    : roots;
+  const toolRoots = [...runtimeReadRoots(policy), ...transcriptReadRoots];
+  const writableRoots = runtimeWriteRoots(runtime);
+  return {
+    allow: claudeToolAllowRules(policy, runtime, managedWorkspace),
+    ...(policy || managedWorkspace
+      ? {
+          blockReadsOutsideWorkingDirectories: true,
+          additionalDirectories: [
+            ...pluginRoots,
+            ...toolRoots,
+            ...writableRoots,
+          ],
+        }
+      : {}),
+    deny: [
+      ...writableProtectedRoots(
+        roots,
+        runtimeWriteRoot,
+        workspace,
+        runtimeCacheRoots(runtime),
+      ).flatMap((root) =>
+        protectedToolRules(
+          root,
+          readRoots.includes(root) &&
+            ![...transcriptReadRoots, ...pluginRoots].some((path) =>
+              path.startsWith(`${root}/`),
+            ),
+        ),
+      ),
+      ...[...pluginRoots, ...toolRoots].map((root) =>
+        absoluteRule(root, "Edit"),
+      ),
+    ],
   };
 }
+
+function claudeToolAllowRules(
+  policy: RuntimePolicy | undefined,
+  runtime: WritableRuntime | undefined,
+  workspace?: string,
+): string[] {
+  if (!policy)
+    return [
+      "Bash",
+      "Read",
+      "Skill",
+      "Agent",
+      workspace ? absoluteRule(workspace, "Edit") : "Edit",
+    ];
+  if (!runtime) return ["Bash", "Edit", "Skill", "Agent"];
+  return [
+    "Bash",
+    "Skill",
+    "Agent",
+    absoluteRule(runtime.workspace, "Edit"),
+    absoluteRule(runtime.root, "Edit"),
+    ...(runtime.cacheRoots ?? []).map((root) => absoluteRule(root, "Edit")),
+  ];
+}
+
+/** Native write denies override grants; the namespace stays read-denied and has no write grant. */
+function writableProtectedRoots(
+  roots: string[],
+  runtimeWriteRoot: string | undefined,
+  workspace?: string,
+  cacheRoots: string[] = [],
+): string[] {
+  const namespace = nativeStatePath();
+  return roots.filter(
+    (root) =>
+      !workspaceBoundaryException(root, workspace).length &&
+      !sharedHomeGrant(root, cacheRoots) &&
+      keepNativeWriteDeny(root, namespace, runtimeWriteRoot),
+  );
+}
+
+function sharedHomeGrant(root: string, cacheRoots: string[]): boolean {
+  return (
+    isRuntimeHomeRoot(root) &&
+    cacheRoots.some((cache) => cache.startsWith(`${root}/`))
+  );
+}
+
+function runtimeCacheRoots(runtime: WritableRuntime | undefined): string[] {
+  return runtime?.cacheRoots ?? [];
+}
+
+function runtimeWriteRoots(runtime: WritableRuntime | undefined): string[] {
+  return [
+    ...optionalRuntimeRoot(runtime?.root),
+    ...(runtime?.cacheRoots ?? []),
+  ];
+}
+
+function keepNativeWriteDeny(
+  root: string,
+  namespace: string,
+  runtimeWriteRoot?: string,
+): boolean {
+  return (
+    root !== namespace ||
+    runtimeWriteRoot === undefined ||
+    !runtimeWriteRoot.startsWith(`${namespace}/`)
+  );
+}
+
+function optionalRuntimeRoot(root: string | undefined): string[] {
+  return root ? [root] : [];
+}
+
+function protectedToolRules(root: string, denyRead: boolean): string[] {
+  return [
+    ...(denyRead ? [absoluteRule(root, "Read")] : []),
+    absoluteRule(root, "Edit"),
+  ];
+}
+
+function runtimeReadRoots(policy: RuntimePolicy | undefined): string[] {
+  return policy?.readOnlyRoots ?? [];
+}

package/src/hosts/claude-skill-activations.ts

@@ -0,0 +1,166 @@
+import { isRecord } from "../value-guards";
+import { summarizeClaudeEvents } from "./claude-events";
+
+const MAX_CALLS = 128;
+type Entry = Record<string, unknown>;
+interface SkillCall {
+  sessionId: string;
+  parentToolUseId: string | null;
+  toolUseId: string;
+  invocation: string;
+  status: "unknown" | "succeeded" | "failed";
+}
+interface State {
+  calls: Map<string, SkillCall>;
+  partial: boolean;
+  truncated: boolean;
+}
+
+function label(value: unknown): string | null {
+  return typeof value === "string" && /^[A-Za-z0-9_.:-]{1,256}$/.test(value)
+    ? value
+    : null;
+}
+
+function blocks(event: Entry): unknown[] {
+  const content: unknown = isRecord(event.message)
+    ? event.message.content
+    : null;
+  return Array.isArray(content) ? content : [];
+}
+
+function key(event: Entry, id: string): string {
+  return JSON.stringify([
+    event.session_id ?? event.sessionId,
+    event.parent_tool_use_id ?? null,
+    id,
+  ]);
+}
+
+function call(event: Entry, block: Entry, state: State) {
+  const id = label(block.id);
+  const sessionId = label(event.session_id ?? event.sessionId);
+  const invocation = skillInput(block.input);
+  if (!id || !sessionId || !invocation) {
+    state.partial = true;
+    return;
+  }
+  addCall(
+    key(event, id),
+    {
+      sessionId,
+      parentToolUseId: label(event.parent_tool_use_id),
+      toolUseId: id,
+      invocation,
+      status: "unknown",
+    },
+    state,
+  );
+}
+
+function skillInput(input: unknown): string | null {
+  return isRecord(input) ? label(input.skill) : null;
+}
+
+function addCall(id: string, value: SkillCall, state: State) {
+  const previous = state.calls.get(id);
+  if (previous) {
+    state.partial ||= previous.invocation !== value.invocation;
+    return;
+  }
+  if (state.calls.size >= MAX_CALLS) {
+    state.truncated = true;
+    return;
+  }
+  state.calls.set(id, value);
+}
+
+function result(event: Entry, block: Entry, state: State) {
+  const id = label(block.tool_use_id);
+  if (!id) return;
+  const pending = state.calls.get(key(event, id));
+  if (!pending) return;
+  const status = resultStatus(block.is_error);
+  if (!status) {
+    state.partial = true;
+    return;
+  }
+  state.partial ||= conflictingResult(pending.status, status);
+  pending.status = status;
+}
+
+function resultStatus(value: unknown): "failed" | "succeeded" | null {
+  if (value !== undefined && typeof value !== "boolean") return null;
+  return value === true ? "failed" : "succeeded";
+}
+
+function conflictingResult(
+  previous: SkillCall["status"],
+  next: SkillCall["status"],
+): boolean {
+  return previous !== "unknown" && previous !== next;
+}
+
+function visit(line: string, state: State) {
+  try {
+    const event: unknown = JSON.parse(line);
+    if (!isRecord(event)) throw new Error("invalid Claude event");
+    for (const block of blocks(event)) visitBlock(event, block, state);
+  } catch {
+    state.partial = true;
+  }
+}
+
+function visitBlock(event: Entry, block: unknown, state: State) {
+  if (!isRecord(block)) return;
+  switch (event.type) {
+    case "assistant":
+      if (isSkillCall(block)) call(event, block, state);
+      break;
+    case "user":
+      if (block.type === "tool_result") result(event, block, state);
+  }
+}
+
+function isSkillCall(block: Entry): boolean {
+  return block.type === "tool_use" && block.name === "Skill";
+}
+
+function completeCollection(completed: boolean, state: State): boolean {
+  return (
+    completed &&
+    !state.partial &&
+    !state.truncated &&
+    [...state.calls.values()].every((item) => item.status !== "unknown")
+  );
+}
+
+/** Observe the native Skill seam and distinguish successful results from attempts. */
+export function claudeSkillActivationsObservation(
+  stream: string,
+  code: number,
+) {
+  const summary = summarizeClaudeEvents(stream, code);
+  const state: State = { calls: new Map(), partial: false, truncated: false };
+  for (const line of stream.split("\n").filter((line) => line.trim()))
+    visit(line, state);
+  const calls = [...state.calls.values()];
+  const complete = completeCollection(summary.complete, state);
+  return {
+    id: "sevro.host.skill-activations",
+    completeness: complete ? ("complete" as const) : ("partial" as const),
+    data: {
+      method: "skill_tool_result",
+      visibility: "skill_tool",
+      observedSkills: [
+        ...new Set(
+          calls
+            .filter((item) => item.status === "succeeded")
+            .map((item) => item.invocation),
+        ),
+      ],
+      calls,
+      truncated: state.truncated,
+    },
+  };
+}