@clipboard-health/clearance 1.9.4 → 1.9.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -0
- package/package.json +1 -1
- package/src/safehouseCmux.d.ts +7 -0
- package/src/safehouseCmux.js +1 -0
- package/src/safehouseCmux.js.map +1 -1
package/README.md
CHANGED
|
@@ -163,6 +163,14 @@ integration also grants cmux's existing Sentry cache write access so diagnostics
|
|
|
163
163
|
cannot corrupt hook JSON output. It points the shim at the real Claude binary so
|
|
164
164
|
the shim does not recurse through itself.
|
|
165
165
|
|
|
166
|
+
The integration does not grant connections to cmux's control socket:
|
|
167
|
+
`resolveSafehouseCmuxIntegration().socketProfile` is always `undefined`.
|
|
168
|
+
That socket can create terminals and run commands outside Safehouse, so granting
|
|
169
|
+
access for status hooks would also let sandboxed code bypass its restrictions.
|
|
170
|
+
Hooks that require the socket remain blocked. Restoring them requires a
|
|
171
|
+
host-side relay that accepts only the required hook operations for the assigned
|
|
172
|
+
workspace; consumers must not append a profile granting the control socket.
|
|
173
|
+
|
|
166
174
|
The cmux environment pass-through is an explicit reviewed allowlist. If a cmux
|
|
167
175
|
update adds new `CMUX_*` variables to its Claude wrapper contract,
|
|
168
176
|
`safehouse-claude-proxy` prints a warning naming the unreviewed variables
|
package/package.json
CHANGED
package/src/safehouseCmux.d.ts
CHANGED
|
@@ -11,6 +11,13 @@ export interface SafehouseCmuxIntegration {
|
|
|
11
11
|
claudeCommandPrelude: string;
|
|
12
12
|
envPass: readonly string[];
|
|
13
13
|
isActive: boolean;
|
|
14
|
+
/**
|
|
15
|
+
* Always undefined: cmux's control socket can launch commands outside the
|
|
16
|
+
* sandbox. Status hooks need a host-side relay restricted to hook operations
|
|
17
|
+
* and the assigned workspace before any socket access can be granted.
|
|
18
|
+
* Retained so consumers can omit their optional `--append-profile` flag.
|
|
19
|
+
*/
|
|
20
|
+
socketProfile: string | undefined;
|
|
14
21
|
unreviewedEnvNames: readonly string[];
|
|
15
22
|
}
|
|
16
23
|
export declare function resolveSafehouseCmuxIntegration(input?: ResolveSafehouseCmuxIntegrationInput): SafehouseCmuxIntegration;
|
package/src/safehouseCmux.js
CHANGED
|
@@ -63,6 +63,7 @@ export function resolveSafehouseCmuxIntegration(input = {}) {
|
|
|
63
63
|
claudeCommandPrelude: SAFEHOUSE_CMUX_CLAUDE_COMMAND_PRELUDE,
|
|
64
64
|
envPass: SAFEHOUSE_CMUX_ENV_PASS,
|
|
65
65
|
isActive: isSafehouseCmuxIntegrationActive({ env }),
|
|
66
|
+
socketProfile: undefined,
|
|
66
67
|
unreviewedEnvNames: resolveUnreviewedCmuxEnvNames({ env, readFile }),
|
|
67
68
|
};
|
|
68
69
|
}
|
package/src/safehouseCmux.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safehouseCmux.js","sourceRoot":"","sources":["../../../../packages/clearance/src/safehouseCmux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,uBAAuB;IACvB,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;IAC/B,yBAAyB;IACzB,eAAe;IACf,yCAAyC;IACzC,8CAA8C;IAC9C,kBAAkB;IAClB,sCAAsC;IACtC,iBAAiB;IACjB,aAAa;IACb,mBAAmB;CACX,CAAC;AAEX,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,4BAA4B;IAC5B,uBAAuB;IACvB,8BAA8B;IAC9B,wBAAwB;IACxB,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,2BAA2B;IAC3B,mEAAmE;IACnE,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,2BAA2B;IAC3B,iBAAiB;IACjB,6EAA6E;IAC7E,0EAA0E;IAC1E,6CAA6C;IAC7C,4BAA4B;IAC5B,kCAAkC;IAClC,oBAAoB;IACpB,sBAAsB;IACtB,4BAA4B;IAC5B,oCAAoC;IACpC,oBAAoB;IACpB,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,mIAAmI;IACnI,wBAAwB;IACxB,wCAAwC;IACxC,gYAAgY;IAChY,wQAAwQ;IACxQ,mHAAmH;IACnH,IAAI;CACL,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"safehouseCmux.js","sourceRoot":"","sources":["../../../../packages/clearance/src/safehouseCmux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,uBAAuB;IACvB,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;IAC/B,yBAAyB;IACzB,eAAe;IACf,yCAAyC;IACzC,8CAA8C;IAC9C,kBAAkB;IAClB,sCAAsC;IACtC,iBAAiB;IACjB,aAAa;IACb,mBAAmB;CACX,CAAC;AAEX,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,4BAA4B;IAC5B,uBAAuB;IACvB,8BAA8B;IAC9B,wBAAwB;IACxB,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,2BAA2B;IAC3B,mEAAmE;IACnE,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,2BAA2B;IAC3B,iBAAiB;IACjB,6EAA6E;IAC7E,0EAA0E;IAC1E,6CAA6C;IAC7C,4BAA4B;IAC5B,kCAAkC;IAClC,oBAAoB;IACpB,sBAAsB;IACtB,4BAA4B;IAC5B,oCAAoC;IACpC,oBAAoB;IACpB,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,mIAAmI;IACnI,wBAAwB;IACxB,wCAAwC;IACxC,gYAAgY;IAChY,wQAAwQ;IACxQ,mHAAmH;IACnH,IAAI;CACL,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAuBZ,MAAM,gCAAgC,GACpC,mEAAmE,CAAC;AACtE,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,MAAM,UAAU,+BAA+B,CAC7C,KAAK,GAAyC,EAAE;IAEhD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,eAAe,CAAC;IAEnD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC;QACzC,eAAe,EAAE,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC;QACjD,oBAAoB,EAAE,qCAAqC;QAC3D,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC;QACnD,aAAa,EAAE,SAAS;QACxB,kBAAkB,EAAE,6BAA6B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAiC;IAChE,MAAM,cAAc,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,OAAO,cAAc,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,GAAG,KAAK,CAAC,WAAW,kDAAkD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3G,GAAG,KAAK,CAAC,WAAW,kGAAkG;KACvH,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAiC;IACzE,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS;QAC1C,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,SAAS,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAiC;IAChE,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,QAAQ,GACZ,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAEnF,OAAO;QACL,GAAG,IAAI,GAAG,CAAC;YACT,wBAAwB;YACxB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;SAChE,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAiC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiC;IAC3D,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,YAAY,CAAC,KAAiC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoC;IACjE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,SAAS,6BAA6B,CAAC,KAGtC;IACC,MAAM,aAAa,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;QACpC,GAAG,uBAAuB;QAC1B,GAAG,sCAAsC;KAC1C,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,mCAAmC,CAAC,KAG5C;IACC,KAAK,MAAM,WAAW,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAiC;IAClE,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,GAAG,IAAI,GAAG,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;YAC/D,gCAAgC;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}
|