@bjoernrochel/sevro 0.1.0-rc.7 → 1.0.0

package/src/hosts/claude-refresh-lock.ts

@@ -0,0 +1,81 @@
+import { mkdir, rmdir, stat, utimes } from "node:fs/promises";
+import { join } from "node:path";
+
+/**
+ * Claude Code serializes OAuth refresh through this directory lock in the
+ * configuration directory. These values match its lockfile settings, observed
+ * in Claude Code 2.1.284 and 2.1.309: stale after 60s, refreshed every 5s.
+ */
+const LOCK_NAME = ".oauth_refresh.lock";
+const STALE_MS = 60_000;
+const UPDATE_MS = 5_000;
+const RETRY_MS = 250;
+const DEFAULT_WAIT_MS = 120_000;
+
+/** Run an action while holding the refresh lock Claude Code also honors. */
+export async function withClaudeRefreshLock<T>(
+  root: string,
+  action: () => Promise<T>,
+  { waitMs = DEFAULT_WAIT_MS, updateMs = UPDATE_MS } = {},
+): Promise<T> {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const lock = join(root, LOCK_NAME);
+  await acquireLock(lock, Date.now() + waitMs);
+  const heartbeat = setInterval(() => {
+    void touchLock(lock);
+  }, updateMs);
+  try {
+    return await action();
+  } finally {
+    clearInterval(heartbeat);
+    await releaseLock(lock);
+  }
+}
+
+async function acquireLock(lock: string, deadline: number): Promise<void> {
+  while (!(await createLock(lock))) {
+    if (Date.now() >= deadline)
+      throw new Error(
+        "Timed out waiting for another process to refresh the Claude login",
+      );
+    await Bun.sleep(RETRY_MS);
+  }
+}
+
+async function createLock(lock: string): Promise<boolean> {
+  try {
+    await mkdir(lock);
+    return true;
+  } catch (cause) {
+    if ((cause as NodeJS.ErrnoException).code !== "EEXIST")
+      throw new Error("Claude refresh lock is unavailable", { cause });
+  }
+  await removeStaleLock(lock);
+  return false;
+}
+
+/** An abandoned holder stops touching the lock; reclaim it as Claude does. */
+async function removeStaleLock(lock: string): Promise<void> {
+  try {
+    if (Date.now() - (await stat(lock)).mtimeMs > STALE_MS) await rmdir(lock);
+  } catch {
+    // Another contender released or reclaimed it first.
+  }
+}
+
+async function touchLock(lock: string): Promise<void> {
+  const now = new Date();
+  try {
+    await utimes(lock, now, now);
+  } catch {
+    // Release or reclamation races are resolved by the post-lock re-read.
+  }
+}
+
+async function releaseLock(lock: string): Promise<void> {
+  try {
+    await rmdir(lock);
+  } catch {
+    // Already removed; the heartbeat keeps a live holder from being reclaimed.
+  }
+}

package/src/hosts/claude-repository-invocation.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import type { HostAdapter } from "../engine";
 import { isRecord } from "../value-guards";
 import type { ClaudeToolCallsObservation } from "./claude-tool-calls";
+import { parseClaudeEvents, type ClaudeEvents } from "./claude-events";
 
 type Entry = Record<string, unknown>;
 export interface ClaudeRepositoryInvocation {
@@ -13,15 +14,12 @@ export interface ClaudeRepositoryInvocation {
   prompt: string;
 }
 
-function entries(text: string): Entry[] {
-  return text
-    .split(/\r?\n/)
-    .filter((line) => line.trim())
-    .map((line) => {
-      const value: unknown = JSON.parse(line);
-      if (!isRecord(value)) throw new Error("invalid Claude session entry");
-      return value;
-    });
+function entries(text: string | ClaudeEvents): Entry[] {
+  return parseClaudeEvents(text).lines.map((line) => {
+    if (!line.parsed) throw line.error;
+    if (!isRecord(line.value)) throw new Error("invalid Claude session entry");
+    return line.value;
+  });
 }
 
 function content(entry: Entry): string {
@@ -250,7 +248,7 @@ function bodyCorrelated(
 /** Read only the completed bound native session; retain no arguments or body. */
 export async function claudeRepositoryInvocationObservation(input: {
   invocation: ClaudeRepositoryInvocation;
-  stream: string;
+  stream: string | ClaudeEvents;
   configRoot: string;
   workspace: string;
   tools: ClaudeToolCallsObservation;
@@ -264,14 +262,6 @@ export async function claudeRepositoryInvocationObservation(input: {
   } catch {
     /* Unavailable or malformed native evidence stays partial. */
   }
-  const observed = input.tools.data.calls
-    .filter((call) => call.name === "Skill")
-    .map((call) => call.skill);
-  const observedSkills = repositoryObservedSkills(
-    receipt,
-    input.invocation.skillName,
-    observed,
-  );
   return {
     id: "sevro.claude.repository-invocation" as const,
     completeness:
@@ -282,26 +272,11 @@ export async function claudeRepositoryInvocationObservation(input: {
       method: "native_repository_command",
       ...receipt,
       skill: input.invocation.skillName,
-      primarySkill: observedSkills[0] ?? null,
-      observedSkills,
     },
   };
 }
 
-function repositoryObservedSkills(
-  receipt: Receipt,
-  skillName: string,
-  observed: string[],
-): string[] {
-  return [
-    ...new Set([
-      ...(receipt.accepted === true ? [skillName] : []),
-      ...observed,
-    ]),
-  ];
-}
-
-function repositorySessionId(stream: string): string | null {
+function repositorySessionId(stream: string | ClaudeEvents): string | null {
   const sessions = [
     ...new Set(
       entries(stream)

package/src/hosts/claude-settings.ts

@@ -1,13 +1,18 @@
 import { isAbsolute } from "node:path";
 import { CLAUDE_AUTH_VARIABLES } from "./claude-credential";
-import type { RuntimePolicy } from "../runtime-config";
-import { runtimeHooksEnabled } from "../runtime-hooks";
-import { requireRuntimeReadRoots, isRuntimeHomeRoot } from "../runtime-paths";
+import type { RuntimePolicy } from "../runtime/config";
+import { runtimeHooksEnabled } from "../runtime/hooks";
+import { requireRuntimeReadRoots, isRuntimeHomeRoot } from "../runtime/paths";
 import { nativeStatePath } from "../native-transcript-state";
+import {
+  workspaceStatePath,
+  workspaceBoundaryException,
+} from "../fixtures/workspace-state";
 
 interface WritableRuntime {
   root: string;
   workspace: string;
+  cacheRoots?: string[];
 }
 
 function absoluteRule(root: string, tool: "Read" | "Edit"): string {
@@ -38,6 +43,7 @@ export function claudeHostSettings(
   runtimePolicy?: RuntimePolicy,
   transcriptReadRoots: string[] = [],
   runtime?: WritableRuntime,
+  workspace?: string,
 ): Record<string, unknown> {
   if (
     !validPrivatePaths(privateRoot, credentialFile, [
@@ -48,6 +54,10 @@ export function claudeHostSettings(
     throw new Error("Claude private state paths are invalid");
   const readRoots = runtimeReadRoots(runtimePolicy);
   requireRuntimeReadRoots(readRoots, [privateRoot, ...protectedRoots]);
+  requireRuntimeReadRoots(runtimeCacheRoots(runtime), [
+    privateRoot,
+    ...protectedRoots,
+  ]);
   return {
     disableAllHooks: !runtimeHooksEnabled(runtimePolicy),
     sandbox: {
@@ -61,6 +71,7 @@ export function claudeHostSettings(
         transcriptReadRoots,
         pluginRoots,
         runtime,
+        workspace,
       ),
       credentials: {
         files: [{ path: credentialFile, mode: "deny" }],
@@ -74,6 +85,7 @@ export function claudeHostSettings(
       runtimePolicy,
       transcriptReadRoots,
       runtime,
+      workspace,
     ),
   };
 }
@@ -85,21 +97,29 @@ function claudeFilesystemPolicy(
   transcriptReadRoots: string[],
   pluginRoots: string[],
   runtime: WritableRuntime | undefined,
+  workspace: string | undefined,
 ) {
   const runtimeWriteRoot = runtime?.root;
+  const writableRoots = runtimeWriteRoots(runtime);
   return {
     denyRead: [privateRoot, ...protectedRoots],
     allowRead: [
+      ...workspaceBoundaryException(workspaceStatePath(), workspace),
       ...readRoots,
       ...transcriptReadRoots,
       ...pluginRoots,
-      ...optionalRuntimeRoot(runtimeWriteRoot),
+      ...writableRoots,
     ],
-    ...(runtimeWriteRoot ? { allowWrite: [runtimeWriteRoot] } : {}),
+    ...(writableRoots.length ? { allowWrite: writableRoots } : {}),
     denyWrite: [
       privateRoot,
       ...pluginRoots,
-      ...writableProtectedRoots(protectedRoots, runtimeWriteRoot),
+      ...writableProtectedRoots(
+        protectedRoots,
+        runtimeWriteRoot,
+        workspace,
+        runtimeCacheRoots(runtime),
+      ),
       ...readRoots,
       ...transcriptReadRoots,
     ],
@@ -113,17 +133,27 @@ function claudePermissions(
   policy: RuntimePolicy | undefined,
   transcriptReadRoots: string[],
   runtime: WritableRuntime | undefined,
+  workspace: string | undefined,
 ) {
   const runtimeWriteRoot = runtime?.root;
-  const roots = [privateRoot, ...protectedRoots];
+  const roots = [
+    privateRoot,
+    ...protectedRoots.filter(
+      (root) => !workspaceBoundaryException(root, workspace).length,
+    ),
+  ];
+  const managedWorkspace = workspaceBoundaryException(
+    workspaceStatePath(),
+    workspace,
+  )[0];
   const readRoots = policy
     ? roots.filter((root) => !isRuntimeHomeRoot(root))
     : roots;
   const toolRoots = [...runtimeReadRoots(policy), ...transcriptReadRoots];
-  const writableRoots = optionalRuntimeRoot(runtimeWriteRoot);
+  const writableRoots = runtimeWriteRoots(runtime);
   return {
-    allow: claudeToolAllowRules(policy, runtime),
-    ...(policy
+    allow: claudeToolAllowRules(policy, runtime, managedWorkspace),
+    ...(policy || managedWorkspace
       ? {
           blockReadsOutsideWorkingDirectories: true,
           additionalDirectories: [
@@ -134,7 +164,12 @@ function claudePermissions(
         }
       : {}),
     deny: [
-      ...writableProtectedRoots(roots, runtimeWriteRoot).flatMap((root) =>
+      ...writableProtectedRoots(
+        roots,
+        runtimeWriteRoot,
+        workspace,
+        runtimeCacheRoots(runtime),
+      ).flatMap((root) =>
         protectedToolRules(
           root,
           readRoots.includes(root) &&
@@ -153,8 +188,16 @@ function claudePermissions(
 function claudeToolAllowRules(
   policy: RuntimePolicy | undefined,
   runtime: WritableRuntime | undefined,
+  workspace?: string,
 ): string[] {
-  if (!policy) return ["Bash", "Read", "Edit", "Skill", "Agent"];
+  if (!policy)
+    return [
+      "Bash",
+      "Read",
+      "Skill",
+      "Agent",
+      workspace ? absoluteRule(workspace, "Edit") : "Edit",
+    ];
   if (!runtime) return ["Bash", "Edit", "Skill", "Agent"];
   return [
     "Bash",
@@ -162,6 +205,7 @@ function claudeToolAllowRules(
     "Agent",
     absoluteRule(runtime.workspace, "Edit"),
     absoluteRule(runtime.root, "Edit"),
+    ...(runtime.cacheRoots ?? []).map((root) => absoluteRule(root, "Edit")),
   ];
 }
 
@@ -169,12 +213,45 @@ function claudeToolAllowRules(
 function writableProtectedRoots(
   roots: string[],
   runtimeWriteRoot: string | undefined,
+  workspace?: string,
+  cacheRoots: string[] = [],
 ): string[] {
-  if (!runtimeWriteRoot) return roots;
   const namespace = nativeStatePath();
   return roots.filter(
     (root) =>
-      root !== namespace || !runtimeWriteRoot.startsWith(`${namespace}/`),
+      !workspaceBoundaryException(root, workspace).length &&
+      !sharedHomeGrant(root, cacheRoots) &&
+      keepNativeWriteDeny(root, namespace, runtimeWriteRoot),
+  );
+}
+
+function sharedHomeGrant(root: string, cacheRoots: string[]): boolean {
+  return (
+    isRuntimeHomeRoot(root) &&
+    cacheRoots.some((cache) => cache.startsWith(`${root}/`))
+  );
+}
+
+function runtimeCacheRoots(runtime: WritableRuntime | undefined): string[] {
+  return runtime?.cacheRoots ?? [];
+}
+
+function runtimeWriteRoots(runtime: WritableRuntime | undefined): string[] {
+  return [
+    ...optionalRuntimeRoot(runtime?.root),
+    ...(runtime?.cacheRoots ?? []),
+  ];
+}
+
+function keepNativeWriteDeny(
+  root: string,
+  namespace: string,
+  runtimeWriteRoot?: string,
+): boolean {
+  return (
+    root !== namespace ||
+    runtimeWriteRoot === undefined ||
+    !runtimeWriteRoot.startsWith(`${namespace}/`)
   );
 }
 

package/src/hosts/claude-skill-activations.ts

@@ -0,0 +1,169 @@
+import { isRecord } from "../value-guards";
+import {
+  summarizeClaudeEvents,
+  parseClaudeEvents,
+  type ClaudeEvents,
+  type ClaudeEventLine,
+} from "./claude-events";
+
+const MAX_CALLS = 128;
+type Entry = Record<string, unknown>;
+interface SkillCall {
+  sessionId: string;
+  parentToolUseId: string | null;
+  toolUseId: string;
+  invocation: string;
+  status: "unknown" | "succeeded" | "failed";
+}
+interface State {
+  calls: Map<string, SkillCall>;
+  partial: boolean;
+  truncated: boolean;
+}
+
+function label(value: unknown): string | null {
+  return typeof value === "string" && /^[A-Za-z0-9_.:-]{1,256}$/.test(value)
+    ? value
+    : null;
+}
+
+function blocks(event: Entry): unknown[] {
+  const content: unknown = isRecord(event.message)
+    ? event.message.content
+    : null;
+  return Array.isArray(content) ? content : [];
+}
+
+function key(event: Entry, id: string): string {
+  return JSON.stringify([
+    event.session_id ?? event.sessionId,
+    event.parent_tool_use_id ?? null,
+    id,
+  ]);
+}
+
+function call(event: Entry, block: Entry, state: State) {
+  const id = label(block.id);
+  const sessionId = label(event.session_id ?? event.sessionId);
+  const invocation = skillInput(block.input);
+  if (!id || !sessionId || !invocation) {
+    state.partial = true;
+    return;
+  }
+  addCall(
+    key(event, id),
+    {
+      sessionId,
+      parentToolUseId: label(event.parent_tool_use_id),
+      toolUseId: id,
+      invocation,
+      status: "unknown",
+    },
+    state,
+  );
+}
+
+function skillInput(input: unknown): string | null {
+  return isRecord(input) ? label(input.skill) : null;
+}
+
+function addCall(id: string, value: SkillCall, state: State) {
+  const previous = state.calls.get(id);
+  if (previous) {
+    state.partial ||= previous.invocation !== value.invocation;
+    return;
+  }
+  if (state.calls.size >= MAX_CALLS) {
+    state.truncated = true;
+    return;
+  }
+  state.calls.set(id, value);
+}
+
+function result(event: Entry, block: Entry, state: State) {
+  const id = label(block.tool_use_id);
+  if (!id) return;
+  const pending = state.calls.get(key(event, id));
+  if (!pending) return;
+  const status = resultStatus(block.is_error);
+  if (!status) {
+    state.partial = true;
+    return;
+  }
+  state.partial ||= conflictingResult(pending.status, status);
+  pending.status = status;
+}
+
+function resultStatus(value: unknown): "failed" | "succeeded" | null {
+  if (value !== undefined && typeof value !== "boolean") return null;
+  return value === true ? "failed" : "succeeded";
+}
+
+function conflictingResult(
+  previous: SkillCall["status"],
+  next: SkillCall["status"],
+): boolean {
+  return previous !== "unknown" && previous !== next;
+}
+
+function visit(line: ClaudeEventLine, state: State) {
+  if (!line.parsed || !isRecord(line.value)) {
+    state.partial = true;
+    return;
+  }
+  for (const block of blocks(line.value)) visitBlock(line.value, block, state);
+}
+
+function visitBlock(event: Entry, block: unknown, state: State) {
+  if (!isRecord(block)) return;
+  switch (event.type) {
+    case "assistant":
+      if (isSkillCall(block)) call(event, block, state);
+      break;
+    case "user":
+      if (block.type === "tool_result") result(event, block, state);
+  }
+}
+
+function isSkillCall(block: Entry): boolean {
+  return block.type === "tool_use" && block.name === "Skill";
+}
+
+function completeCollection(completed: boolean, state: State): boolean {
+  return (
+    completed &&
+    !state.partial &&
+    !state.truncated &&
+    [...state.calls.values()].every((item) => item.status !== "unknown")
+  );
+}
+
+/** Observe the native Skill seam and distinguish successful results from attempts. */
+export function claudeSkillActivationsObservation(
+  stream: string | ClaudeEvents,
+  code: number,
+) {
+  const events = parseClaudeEvents(stream);
+  const summary = summarizeClaudeEvents(events, code);
+  const state: State = { calls: new Map(), partial: false, truncated: false };
+  for (const line of events.lines) visit(line, state);
+  const calls = [...state.calls.values()];
+  const complete = completeCollection(summary.complete, state);
+  return {
+    id: "sevro.host.skill-activations",
+    completeness: complete ? ("complete" as const) : ("partial" as const),
+    data: {
+      method: "skill_tool_result",
+      visibility: "skill_tool",
+      observedSkills: [
+        ...new Set(
+          calls
+            .filter((item) => item.status === "succeeded")
+            .map((item) => item.invocation),
+        ),
+      ],
+      calls,
+      truncated: state.truncated,
+    },
+  };
+}

package/src/hosts/claude-state.ts

@@ -1,4 +1,10 @@
-import { runtimeSeedSources } from "../runtime-config";
+import { runtimeSeedSources } from "../runtime/config";
+import { minimalRoots } from "../paths";
+import { shellQuote } from "../shell";
+import {
+  candidateArtifactEnvironment,
+  candidateArtifactReadRoots,
+} from "../candidate-artifacts";
 import {
   cp,
   mkdir,
@@ -10,16 +16,24 @@ import {
 import { delimiter, dirname, join } from "node:path";
 import type { HostAdapter } from "../engine";
 import { nativeStateParent } from "../native-transcript-state";
+import {
+  workspaceBoundaryException,
+  workspaceStatePath,
+} from "../fixtures/workspace-state";
 import {
   candidateTranscriptEnvironment,
   candidateTranscriptRoots,
 } from "../native-transcripts";
-import { prepareHookMounts, runtimeHooksEnabled } from "../runtime-hooks";
+import { prepareHookMounts, runtimeHooksEnabled } from "../runtime/hooks";
 import {
   insideRuntimeRoot as inside,
   runtimeExecutableProtection,
-} from "../runtime-paths";
-import { prepareRuntimeState } from "../runtime-state";
+} from "../runtime/paths";
+import { prepareRuntimeState } from "../runtime/state";
+import {
+  sharedCacheDenyRoots,
+  sharedCacheRoots,
+} from "../runtime/shared-cache";
 import { stageClaudeAuthentication } from "./claude-credential";
 import { claudeHostSettings } from "./claude-settings";
 import { evaluationProtectedRoots } from "./isolation-roots";
@@ -36,12 +50,7 @@ export interface ClaudeHostOptions {
   toolchainBinDir?: string;
   projectSettings?: boolean;
   timeoutMs?: number;
-}
-
-function minimalRoots(roots: string[]): string[] {
-  return roots.filter(
-    (root) => !roots.some((other) => other !== root && inside(other, root)),
-  );
+  retainHostDiagnostics?: boolean;
 }
 
 function claudeSeedSources(request: Request): string[] {
@@ -51,6 +60,7 @@ function claudeSeedSources(request: Request): string[] {
 async function createClaudePrivateState(
   stateRoot: string,
   options: ClaudeHostOptions,
+  loginLifetimeMs: number,
 ) {
   await mkdir(join(stateRoot, "private"), { mode: 0o700 });
   const privateRoot = await realpath(join(stateRoot, "private"));
@@ -60,6 +70,7 @@ async function createClaudePrivateState(
   const authentication = await stageClaudeAuthentication(
     join(privateRoot, "config"),
     options.credentialFile,
+    { binary: options.binary, lifetimeMs: loginLifetimeMs },
   );
   return {
     privateRoot,
@@ -181,14 +192,16 @@ function claudeRuntimeEnvironment(
     : {};
 }
 
+/** `lifetimeMs` is the access-token lifetime the complete execution needs. */
 export async function prepareClaudeState(
   stateRoot: string,
   options: ClaudeHostOptions,
   request: Request,
   pluginDirs: string[],
+  lifetimeMs: number,
 ) {
   await requireClaudeRuntimeNamespace(request, stateRoot);
-  const state = await createClaudePrivateState(stateRoot, options);
+  const state = await createClaudePrivateState(stateRoot, options, lifetimeMs);
   const transcripts = await claudeTranscriptAccess(
     stateRoot,
     state.credential,
@@ -213,6 +226,11 @@ export async function prepareClaudeState(
     runtime,
     stateRoot,
   );
+  const cacheRoots = await sharedCacheRoots(
+    request.runtimePolicy,
+    request.runtimeRole,
+    roots,
+  );
   await writeFile(
     settingsPath,
     JSON.stringify(
@@ -220,15 +238,20 @@ export async function prepareClaudeState(
         state.privateRoot,
         state.credential,
         [...pluginDirs, ...effectivePlugins],
-        roots,
+        [
+          ...roots,
+          ...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole),
+        ],
         transcripts.policy,
         [
           ...transcripts.readRoots,
           ...candidateTranscriptRoots(request.candidateTranscriptRoot),
+          ...candidateArtifactReadRoots(request.candidateArtifactRoots),
         ],
         runtimeWriteRoot
-          ? { root: runtimeWriteRoot, workspace: request.workspace }
+          ? { root: runtimeWriteRoot, workspace: request.workspace, cacheRoots }
           : undefined,
+        request.workspace,
       ),
     ),
     { flag: "wx", mode: 0o600 },
@@ -237,6 +260,7 @@ export async function prepareClaudeState(
   Object.assign(
     env,
     candidateTranscriptEnvironment(request.candidateTranscriptRoot),
+    candidateArtifactEnvironment(request.candidateArtifactRoots),
   );
   if (runtime) await mkdir(join(runtime, "host-home"), { mode: 0o700 });
   return {
@@ -253,7 +277,11 @@ async function requireClaudeRuntimeNamespace(
   request: Request,
   stateRoot: string,
 ) {
-  if (!request.runtimePolicy) return;
+  if (
+    !request.runtimePolicy &&
+    !workspaceBoundaryException(workspaceStatePath(), request.workspace).length
+  )
+    return;
   const implicitRoots = await Promise.all(
     ["/tmp/claude", "/private/tmp/claude"].map(implicitClaudeWritePaths),
   );
@@ -293,7 +321,7 @@ async function claudeTranscriptAccess(
   await mkdir(projects, { recursive: true, mode: 0o700 });
   await symlink(projects, join(dirname(credential), "projects"));
   const startup = join(view, "shell-env");
-  const script = `export CLAUDE_CONFIG_DIR='${view.replaceAll("'", `'"'"'`)}'\n`;
+  const script = `export CLAUDE_CONFIG_DIR=${shellQuote(view)}\n`;
   await writeFile(startup, script, { flag: "wx", mode: 0o600 });
   await writeFile(join(view, ".zshenv"), script, { flag: "wx", mode: 0o600 });
   return {
@@ -350,7 +378,9 @@ async function applyClaudeRuntimeEnvironment(
 }
 
 function claudeRuntimeDirectory(request: Request, stateRoot: string) {
-  return request.runtimePolicy ? join(stateRoot, "runtime") : undefined;
+  return request.runtimePolicy
+    ? (request.candidateRuntimeRoot ?? join(stateRoot, "runtime"))
+    : undefined;
 }
 
 function applyLegacyClaudeCommandEnvironment(