@brutalsystems/muster 0.9.2 → 0.10.0

package/README.md

@@ -492,6 +492,30 @@ Every launch also records how strongly its containment was imposed:
 | `tool-policy` | OpenCode — rules the agent is asked to respect, with no kernel enforcement. |
 | `none`        | `full-access` — the sandbox is deliberately disabled.                       |
 
+#### What a sandboxed launch may write
+
+Muster names the write roots rather than leaving them to default. Under
+`workspace-write` a launched Claude session may write its cwd, `$TMPDIR`, and
+**its own configuration directory** — the `CLAUDE_CONFIG_DIR` the child will
+actually use, which an identity launch or a requester profile's `env_defaults`
+may relocate. That last root is granted because an agent's memory lives there:
+without it every Bash write to memory failed with `EPERM` while the in-process
+file tools succeeded, which reads from inside the session as a path bug rather
+than a boundary.
+
+Under `read` nothing is writable, including the config dir. Under `full-access`
+there is no sandbox to grant into.
+
+One path stays denied that muster cannot open: **`$CLAUDE_CONFIG_DIR/projects/`**
+(and `shell-snapshots/`). Claude Code refuses writes there in a sandboxed Bash
+regardless of what muster grants — naming those directories explicitly in
+`allowWrite` changes nothing, which is presumably deliberate, since a session's
+own transcripts live there. Project-scoped memory under
+`projects/<cwd-slug>/memory` is therefore reachable only through the file tools,
+which are in-process and not kernel-sandboxed. Note that `work` implies auto
+mode, which asks the model to prefer shell commands for file edits, so a session
+saving project-scoped memory has to be told to use `Write`/`Edit` instead.
+
 ### Requester profiles and enrolments
 
 A non-local caller — one reached through a transport such as Tin Can rather

package/dist/guard.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { realpath } from "node:fs/promises";
-import { isAbsolute, relative, resolve } from "node:path";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import { mcpName, claudeMcpConfig } from "./mcp.js";
 import { pluginName } from "./plugins.js";
 import { RequesterConfigError } from "./requester-policy.js";
@@ -316,7 +318,47 @@ export function runtimeArgs(req) {
     }
     return result;
 }
-export function launchArgs(req, config, mcp = [], bridgePath) {
+/**
+ * The config dir the launched agent will actually use. `launchEnv`'s blocklist
+ * is /^(CLAUDECODE|CLAUDE_CODE_|...)/, which does not match CLAUDE_CONFIG_DIR,
+ * so the child inherits whatever the caller set and this resolves to the same
+ * dir the child will open.
+ */
+export function claudeConfigDir(env) {
+    const configured = env.CLAUDE_CONFIG_DIR;
+    if (configured && configured.trim().length > 0)
+        return resolve(configured);
+    return join(env.HOME ?? homedir(), ".claude");
+}
+/**
+ * The keys of a profile's own settings.json that name its skill set rather than
+ * its policy. `--setting-sources ""` is what keeps `permissions`, `sandbox` and
+ * `hooks` muster's alone — forwarding those would let a settings file re-widen
+ * what `assertClaudePolicy` refuses to take on trust — so only these two are
+ * carried across, and muster's keys are spread after them and win regardless.
+ */
+const forwardedSettings = ["enabledPlugins", "extraKnownMarketplaces"];
+function profilePluginSettings(configDir) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(configDir, "settings.json"), "utf8"));
+    }
+    catch {
+        // No settings file, unreadable, or not JSON: a launch with built-in skills
+        // only is degraded but correct, and failing here would take the sandbox fix
+        // down with it.
+        return {};
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return {};
+    const source = parsed;
+    const out = {};
+    for (const key of forwardedSettings)
+        if (source[key] !== undefined)
+            out[key] = source[key];
+    return out;
+}
+export function launchArgs(req, config, mcp = [], bridgePath, env = process.env) {
     // Before `runtimeArgs`, so this function owns every model error on its own
     // rather than by its caller's discipline: `Muster.launch` happens to resolve
     // first, but `launchArgs` is exported and an input carrying both a model
@@ -357,7 +399,9 @@ export function launchArgs(req, config, mcp = [], bridgePath) {
         : policy.permissions === "bypass"
             ? "bypassPermissions"
             : "dontAsk";
+    const configDir = claudeConfigDir(env);
     const settings = {
+        ...profilePluginSettings(configDir),
         disableAllHooks: true,
         permissions: {
             defaultMode: mode,
@@ -374,7 +418,17 @@ export function launchArgs(req, config, mcp = [], bridgePath) {
             autoAllowBashIfSandboxed: true,
             allowUnsandboxedCommands: false,
             excludedCommands: [],
-            filesystem: { denyWrite: readonly ? ["/"] : [] },
+            filesystem: {
+                denyWrite: readonly ? ["/"] : [],
+                // The agent's own memory lives under the config dir, outside the cwd
+                // that Claude Code defaults the write root to, so Bash writes to it
+                // failed with EPERM while the in-process file tools succeeded (#80).
+                // Granted only under workspace-write: read-only must stay read-only,
+                // and full-access has no sandbox to grant into.
+                ...(policy.sandbox === "workspace-write"
+                    ? { allowWrite: [configDir] }
+                    : {}),
+            },
         },
     };
     return [

package/dist/run.js

@@ -240,7 +240,7 @@ export class Muster {
         if (req.runtime === "opencode")
             runtimeArgs(effective);
         else
-            argv = launchArgs(effective, this.config);
+            argv = launchArgs(effective, this.config, [], undefined, this.sourceEnv);
         const driver = req.kind === "session"
             ? await selectHost(req.open ? "tmux" : requestedHost, this.drivers)
             : undefined;
@@ -389,7 +389,10 @@ export class Muster {
                 await writeFile(bridgePath, JSON.stringify(Object.fromEntries(prepared.servers.map((s) => [s.name, s.config]))), { mode: 0o600 });
             }
             if (req.runtime !== "opencode")
-                argv = launchArgs(effective, this.config, prepared.servers, bridgePath);
+                // `runtimeEnv`, not the host's: an identity launch relocates
+                // CLAUDE_CONFIG_DIR to the per-launch copy, and the sandbox must grant
+                // the dir the child will actually open, not the one Muster runs under.
+                argv = launchArgs(effective, this.config, prepared.servers, bridgePath, runtimeEnv);
             if (req.runtime === "codex") {
                 codexPolicy = await codexPolicyArgs(runtimeEnv, req.cwd, deadline, prepared.servers, req.kind === "task");
                 argv.splice(1, 0, ...codexPolicy);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {