@brutalsystems/muster 0.11.1 → 1.0.1

package/dist/run.js

@@ -1,4 +1,4 @@
-import { stat, readFile, realpath, writeFile, mkdir, rm, } from "node:fs/promises";
+import { stat, readFile, writeFile, mkdir, rm, } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -10,10 +10,13 @@ import { LOCAL } from "./requester.js";
 import { assertEnforcementMeetsMinimum, assertLevelWithinCeiling, assertMayAct, resolveIdentityForRequest, resolveRequesterPolicy, RequesterPolicyRefusal, } from "./requester-policy.js";
 import { IdentityError, readIdentity, } from "./identity-store.js";
 import { resolveCredential } from "./identity-token.js";
-import { copyIdentity, identityEnv, setCodexWorkspaceTrust, setWorkspaceTrust, } from "./identity-copy.js";
+import { copyIdentity, identityEnv } from "./identity-copy.js";
 import { Registry } from "./registry.js";
 import { LaunchLog } from "./log.js";
 import { hosts, selectHost } from "./hosts/index.js";
+import { AGENTS } from "./agents.js";
+import { assertOptionsSupported, screenWorkspace } from "./options.js";
+import { workspaceTrustKey } from "./identity/workspace-key.js";
 import { processRef, isSame, stopTree, delay, descendants, ownedGroup, } from "./identity/processes.js";
 import { resolveCodex } from "./identity/codex.js";
 import { claudeConfigDir, claudeRegistryDiagnostic, claudeWorkspaceTrusted, resolveClaude, } from "./identity/claude.js";
@@ -58,12 +61,13 @@ function taskHandle(entry, pid) {
  * rather than a configuration path, so relocating its configuration moves
  * nothing Muster reads.
  */
+/**
+ * `undefined` rather than the table's `null`, because every caller treats this
+ * as "there is no such variable" via `?? entry.identityPath` and an absent
+ * value is what that idiom expects.
+ */
 function configHomeVar(runtime) {
-    if (runtime === "codex")
-        return "CODEX_HOME";
-    if (runtime === "claude")
-        return "CLAUDE_CONFIG_DIR";
-    return undefined;
+    return AGENTS[runtime].configHomeVar ?? undefined;
 }
 export class Muster {
     config;
@@ -147,7 +151,11 @@ export class Muster {
             // itself is not expressible remotely, and a remote launch gets the
             // receiver's configured `default_mcp` / `default_plugins`. Configuration
             // is the grant.
-            for (const key of ["mcp", "plugin"])
+            // `options` joins them for the same reason, and one of its own:
+            // auto-approve-path would have this machine trust a directory a remote
+            // caller named, and trust is what lets that directory configure the
+            // session. Configuration is the grant.
+            for (const key of ["mcp", "plugin", "options"])
                 if (raw[key] !== undefined)
                     throw new RequesterPolicyRefusal("not-expressible-remotely", `a remote request may not select ${key}; this receiver's configured defaults apply`);
         }
@@ -248,6 +256,9 @@ export class Muster {
         if (req.open &&
             (req.kind !== "session" || !["auto", "tmux"].includes(requestedHost)))
             throw new Error("--open requires a tmux session on macOS");
+        // Refused here, with the other checks that cost nothing to fail: an option
+        // the runtime cannot honour must not leave a registry entry behind.
+        assertOptionsSupported(req.runtime, req.options);
         const permissions = resolvePermissions(effective, this.config);
         const enforcement = enforcementGrade(req.runtime, permissions);
         assertEnforcementMeetsMinimum(req.runtime, enforcement, policy);
@@ -367,22 +378,13 @@ export class Muster {
         if (identityName && identityMeta) {
             // The launch id exists now, so the copy can be made and named after it.
             const copy = await copyIdentity(this.home, identityName, identityMeta, entry.launchId);
-            // Written into the copy, never the live ~/.claude.json: a running
-            // session rewrites that file continuously and Muster cannot coordinate.
-            if (identityMeta.agent === "claude")
-                // RESOLVED, not as written: Claude keys projects[] by what its own
-                // getcwd(2) returns, which has every symlink resolved. On macOS a
-                // launch into /tmp/... is really /private/tmp/..., so the un-resolved
-                // key is one Claude never looks up — the trust dialog appears, the
-                // session never registers, and the launch burns its whole deadline.
-                // `assertAllowedWorkspace` already realpaths for containment.
-                await setWorkspaceTrust(copy, await realpath(req.cwd));
-            // Codex gates the same way behind a different file and a different key,
-            // and a fresh copy trusts nothing — so every Codex identity launch sat
-            // on "Do you trust the contents of this directory?" until the deadline.
-            // Resolved for the same reason: Codex keys `projects` by its own cwd.
-            else if (identityMeta.agent === "codex")
-                await setCodexWorkspaceTrust(copy, await realpath(req.cwd));
+            // Keyed on the identity's agent, which `resolveIdentity` has already
+            // refused unless it equals req.runtime — so this is the same row either
+            // way, and reading it from the identity keeps the check and the use
+            // agreed. A fresh copy trusts nothing, so without this every identity
+            // launch sat on "Do you trust the contents of this directory?" until the
+            // deadline. `realpath` and the reason for it are documented on the slot.
+            await AGENTS[identityMeta.agent].trustWorkspace?.(copy, await workspaceTrustKey(req.cwd));
             runtimeEnv = {
                 ...runtimeEnv,
                 ...identityEnv(identityMeta, copy, this.sourceEnv, credential?.token),
@@ -403,6 +405,16 @@ export class Muster {
         // configuration home while resolution searched the host's — reserve, spawn,
         // dead at the deadline. The identity copy still wins where there is one,
         // because `identityEnv` is merged into `runtimeEnv` above.
+        // `--options auto-approve-path`: record the launch directory as trusted in
+        // the profile the agent will actually use, so the one-time dialog does not
+        // stop the launch. Screened first — a directory that ships hooks or MCP
+        // servers configures the session it is trusted by, and those run without
+        // asking, so it is named and refused rather than waved through.
+        if (req.options.includes("auto-approve-path")) {
+            const findings = await screenWorkspace(req.cwd);
+            if (findings.length)
+                throw new Error(`--options auto-approve-path refused: ${req.cwd} ships ${findings.join(" and ")}; trusting it would let that configure the session. Trust it yourself once, or launch without the option.`);
+        }
         const configVar = configHomeVar(req.runtime);
         const configHome = configVar
             ? (runtimeEnv[configVar] ?? entry.identityPath)
@@ -412,6 +424,11 @@ export class Muster {
         // before. `refreshed()` has only the entry in scope and must agree.
         if (configVar && configHome && configHome !== this.hostEnv[configVar])
             entry = await this.registry.update(entry.launchId, { configHome });
+        // Written before the agent starts and into the SAME dir the child will open.
+        // An identity launch has already had its copy trusted above, so this is a
+        // no-op there rather than a second write.
+        if (req.options.includes("auto-approve-path") && configHome)
+            await AGENTS[req.runtime].trustWorkspace?.(configHome, await workspaceTrustKey(req.cwd));
         const resolveEnv = this.resolutionEnv(req.runtime, configHome);
         let bridgePath;
         if (req.runtime === "claude" && prepared.servers.length) {
@@ -850,9 +867,6 @@ export class Muster {
                 .catch(() => { });
             throw e;
         }
-        finally {
-            await rpc?.close();
-        }
     }
     /**
      * The answer to a request we have already seen. Never a new launch: a repeat
@@ -934,17 +948,11 @@ export class Muster {
     }
     async stopEntry(entry) {
         try {
-            const openCodeSessionId = entry.peer?.session_id;
-            const abortDeadline = Date.now() + 1000;
-            if (entry.runtime === "opencode" &&
-                entry.root &&
-                entry.server_url &&
-                typeof openCodeSessionId === "string" &&
-                (await isSame(entry.root)) &&
-                (await openCodeEndpointOwnedBy(entry.root.pid, entry.server_url, abortDeadline)))
-                await new OpenCodeHttp(entry.server_url)
-                    .abort(openCodeSessionId, abortDeadline)
-                    .catch(() => { });
+            // One second, and best effort: the kill below is what guarantees the
+            // stop, so an agent that will not answer must not delay it. Which agents
+            // have anything to say, and every precondition on saying it, lives on
+            // the row rather than here.
+            await AGENTS[entry.runtime].beforeStop?.(entry, Date.now() + 1000);
             await this.stopEntryProcesses(entry);
         }
         finally {
@@ -1040,47 +1048,11 @@ export class Muster {
             !entry.peer)
             return entry;
         const deadline = Date.now() + 1500;
-        let rpc;
         try {
-            let metadata;
-            if (entry.runtime === "codex") {
-                // Derived from the entry for the same reason as the claude branch
-                // below: this reads the session's own thread, and a session launched
-                // under an identity recorded it inside the copy. On `hostEnv` a healthy
-                // codex identity session reads as `unreachable` in every listing.
-                rpc = new CodexRpc(this.resolutionEnv("codex", entry.configHome ?? entry.identityPath), entry.cwd);
-                metadata = await codexReachable(rpc, entry.id, deadline);
-            }
-            else if (entry.runtime === "opencode") {
-                if (!entry.server_url)
-                    throw new Error("session endpoint missing");
-                if (!(await isSame(entry.root)) ||
-                    !(await openCodeEndpointOwnedBy(entry.root.pid, entry.server_url, deadline)))
-                    throw new Error("session endpoint is not owned by the launch");
-                metadata = await openCodeReachable(new OpenCodeHttp(entry.server_url), {
-                    id: entry.id,
-                    pid: entry.root.pid,
-                    rawName: null,
-                    cwd: entry.cwd,
-                    serverUrl: entry.server_url,
-                }, deadline);
-                if (!(await isSame(entry.root)) ||
-                    !(await openCodeEndpointOwnedBy(entry.root.pid, entry.server_url, deadline)))
-                    throw new Error("session endpoint ownership changed during refresh");
-            }
-            else {
-                // Derived from the entry, not from a launch-time value: this runs long
-                // after the launch returned and has only the recorded entry in scope. A
-                // running session launched under an identity recorded itself inside the
-                // copy, so re-resolution must look there or `list` reports every such
-                // session as unreachable.
-                const identity = await resolveClaude(entry.root.pid, this.resolutionEnv(entry.runtime, entry.configHome ?? entry.identityPath), deadline);
-                if (!identity ||
-                    identity.id !== entry.id ||
-                    !(await claudeReachable(identity.socketPath, deadline)))
-                    throw new Error("session unreachable");
-                metadata = identity;
-            }
+            // The agent's own configuration home, which an identity launch relocates
+            // to a per-launch copy — composed here because only Muster knows where
+            // that copy went, and handed to the row that knows what to do with it.
+            const metadata = await AGENTS[entry.runtime].refreshMetadata(entry, this.resolutionEnv(entry.runtime, entry.configHome ?? entry.identityPath), deadline);
             const named = assignNames([
                 {
                     runtime: runtimeName(entry.runtime),
@@ -1101,13 +1073,13 @@ export class Muster {
             });
         }
         catch {
+            // Any failure is "unreachable", including a connection this refresh never
+            // managed to open. Each implementation owns whatever it opened, so there
+            // is nothing left for this to close.
             return await this.registry.update(entry.launchId, {
                 peer: { ...entry.peer, state: "unreachable" },
             });
         }
-        finally {
-            await rpc?.close();
-        }
     }
     /**
      * Unscoped by requester, unlike stop and output. Filtering the listing is a

package/dist/stop/opencode.js

@@ -0,0 +1,32 @@
+import { OpenCodeHttp } from "../opencode-http.js";
+import { openCodeEndpointOwnedBy } from "../identity/opencode.js";
+import { isSame } from "../identity/processes.js";
+/**
+ * Ask an OpenCode session to abort before anything is signalled.
+ *
+ * OpenCode is a server with work possibly in flight, so it gets told to stop
+ * rather than only being killed — Claude and Codex have nothing equivalent to
+ * say. Best effort by design: a failure here is not a reason to leave processes
+ * running, and the kill that follows is what actually guarantees the stop.
+ *
+ * Every precondition is a reason not to shout at a stranger. The endpoint must
+ * still be owned by the process Muster started, because a loopback port is a
+ * shared resource and a pid can be reused — without that check an abort could
+ * be sent to whatever now happens to be listening on that port.
+ *
+ * Lives outside `opencode-policy.ts` deliberately: that module imports
+ * `guard.ts`, which imports the agent table, so referencing it from a row would
+ * close a cycle and leave the slot undefined depending on evaluation order.
+ */
+export async function abortOpenCodeSession(entry, deadline) {
+    const sessionId = entry.peer?.session_id;
+    if (!entry.root ||
+        !entry.server_url ||
+        typeof sessionId !== "string" ||
+        !(await isSame(entry.root)) ||
+        !(await openCodeEndpointOwnedBy(entry.root.pid, entry.server_url, deadline)))
+        return;
+    await new OpenCodeHttp(entry.server_url)
+        .abort(sessionId, deadline)
+        .catch(() => { });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.11.1",
+  "version": "1.0.1",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {