@clipboard-health/groundcrew 4.48.0 → 4.48.2

package/dist/lib/launchCommand.js

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { BUILD_SECRET_NAMES, hasPreLaunchEnv, } from "./config.js";
@@ -38,51 +37,6 @@ export function resolveSafehouseClearancePath(baseUrl = import.meta.url) {
     return path.resolve(path.dirname(clearancePackageJson), "safehouse", "safehouse-clearance");
 }
 const SAFEHOUSE_CLEARANCE_WRAPPER_PATH = resolveSafehouseClearancePath();
-/**
- * Resolve the `srt` CLI shipped by `@anthropic-ai/sandbox-runtime` (a pinned
- * groundcrew dependency) via Node's module resolution, reading the package's
- * `bin` field so the path survives version bumps that move the entry point.
- * The resolved `dist/cli.js` carries a `#!/usr/bin/env node` shebang and npm
- * marks it executable, so it is exec'd directly like the safehouse wrapper.
- *
- * @param baseUrl - **Test-only seam.** Production callers must omit this so the
- *   helper resolves from this module's URL. Tests pass an invalid value to
- *   exercise the catch branch.
- */
-export function resolveSrtBinPath(baseUrl = import.meta.url) {
-    let packageJsonPath;
-    try {
-        packageJsonPath = createRequire(baseUrl).resolve("@anthropic-ai/sandbox-runtime/package.json");
-    }
-    catch (error) {
-        throw new Error("@anthropic-ai/sandbox-runtime is required by @clipboard-health/groundcrew for the srt runner but could not be resolved. " +
-            "Reinstall groundcrew's dependencies (`npm install`), or set local.runner to 'safehouse' or 'sdx'.", { cause: error });
-    }
-    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- reading our pinned dependency's well-known `bin` field
-    const manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-    return path.resolve(path.dirname(packageJsonPath), srtBinEntry(manifest));
-}
-/**
- * Extract the `srt` entry from a package manifest's `bin` field, which npm
- * allows as either a bare string (single-bin packages) or a name→path map.
- */
-export function srtBinEntry(manifest) {
-    const binEntry = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.["srt"];
-    if (binEntry === undefined) {
-        throw new Error("@anthropic-ai/sandbox-runtime package.json is missing the `srt` bin entry.");
-    }
-    return binEntry;
-}
-/**
- * Lazily resolved + memoized srt bin path. Unlike the safehouse wrapper (eager
- * at module load), this defers the `package.json` read until an srt launch is
- * actually built — srt is opt-in, so non-srt runs never pay for it.
- */
-let srtBinPathCache;
-function srtBinPath() {
-    srtBinPathCache ??= resolveSrtBinPath();
-    return srtBinPathCache;
-}
 function renderAgentCommand(arguments_) {
     return arguments_.agentCmd
         .replaceAll("{{worktree}}", shellSingleQuote(arguments_.worktreeDir))
@@ -137,20 +91,15 @@ function safehouseClearanceWrapperCommand() {
 function safehouseWrapperCommand(networkEgress) {
     return networkEgress === "allowlisted" ? safehouseClearanceWrapperCommand() : "safehouse";
 }
-function trapCleanupLine(promptDir) {
-    const cleanupCmd = `rm -rf ${shellSingleQuote(promptDir)}`;
+function trapCleanupLine({ promptDir, additionalCleanupCommands = [], }) {
+    const cleanupCmd = [`rm -rf ${shellSingleQuote(promptDir)}`, ...additionalCleanupCommands].join("; ");
     return `trap ${shellSingleQuote(cleanupCmd)} EXIT`;
 }
-/**
- * Shared head of every host-shell `&&` chain: arm the `EXIT` trap that wipes
- * `promptDir` (must come before any link that can fail, including the `cd`),
- * then `cd` into the working directory (the worktree root, or its `workdir`
- * subproject). Kept separate from secret sourcing so the safehouse path can
- * splice `preLaunch` between the `cd` and the secrets source — preLaunch must
- * never see build-time secrets in env.
- */
-function hostTrapAndCd(arguments_) {
-    return [trapCleanupLine(arguments_.promptDir), `cd ${shellSingleQuote(arguments_.workingDir)}`];
+function hostTrapAndCd({ workingDir, promptDir, additionalCleanupCommands = [], }) {
+    return [
+        trapCleanupLine({ promptDir, additionalCleanupCommands }),
+        `cd ${shellSingleQuote(workingDir)}`,
+    ];
 }
 /**
  * Optional source-of-secrets line. Returns `[]` when no `secretsFile` is
@@ -173,9 +122,9 @@ function preLaunchPromptAndExec(arguments_) {
     return lines;
 }
 /**
- * Shared by the safehouse, srt, and sdx builders: render the `exec <agent> "$@"`
+ * Shared by the safehouse and sdx builders: render the `exec <agent> "$@"`
  * inner command and the optional status-reported prepareWorktree hook. The
- * `{{sandbox}}` template is filled from `sandboxName` (empty for safehouse/srt).
+ * `{{sandbox}}` template is filled from `sandboxName` (empty for safehouse).
  */
 function renderPrepareAndAgentCommand(arguments_) {
     const agentCmd = renderAgentCommand({
@@ -193,7 +142,7 @@ function renderPrepareAndAgentCommand(arguments_) {
     };
 }
 /**
- * Shared host-shell prologue for the in-sandbox runners (safehouse, srt): when a
+ * Shared host-shell prologue for the safehouse runner: when a
  * `preLaunch` hook is present, scrub build-secret and `preLaunchEnv` names so it
  * cannot see them; then source build secrets, read the staged prompt into `$_p`,
  * and wipe the prompt dir. The caller arms the EXIT trap and `cd`s first.
@@ -254,7 +203,7 @@ export function isEnvironmentAssignment(token) {
 /**
  * Infer the agent's command basename from a agent `cmd` (skipping a leading
  * `env`/`KEY=val` prefix). Safehouse uses it to pick the matching `.sb`
- * profile; srt uses it to pick the agent's credential profile in `srtPolicy`.
+ * profile.
  */
 export function inferAgentCommandName(agentCmd) {
     const tokens = tokenizeShellPrefix(agentCmd);
@@ -331,9 +280,6 @@ function promptPositional(omitPromptArgument) {
  * prompt in hand.
  */
 export function buildLaunchCommand(arguments_) {
-    if (arguments_.runner === "srt") {
-        return buildSrtLaunchCommand(arguments_);
-    }
     if (arguments_.runner === "sdx") {
         if (arguments_.definition.preLaunch !== undefined) {
             throw new Error("preLaunch is not yet supported for runner='sdx'. Set local.runner to 'safehouse' or 'none', or open an issue for sdx support.");
@@ -342,7 +288,7 @@ export function buildLaunchCommand(arguments_) {
             throw new Error("preLaunchEnv is not yet supported for runner='sdx'. Set local.runner to 'safehouse' or 'none', or open an issue for sdx support.");
         }
         if (arguments_.prepareWorktreeUnsandboxedCommand !== undefined) {
-            throw new Error("unsandboxedHooks.prepareWorktree is not supported for runner='sdx': the sdx container has no host to run it on. Remove unsandboxedHooks for this repo, or use runner 'safehouse', 'srt', or 'none'.");
+            throw new Error("unsandboxedHooks.prepareWorktree is not supported for runner='sdx': the sdx container has no host to run it on. Remove unsandboxedHooks for this repo, or use runner 'safehouse' or 'none'.");
         }
         return buildSdxLaunchCommand(arguments_);
     }
@@ -465,10 +411,11 @@ function buildSafehouseLaunchCommand(arguments_) {
     // separates it from the next argv token. See `resolveSafehouseAddDirs` for
     // which paths these are and why.
     const safehousePrepareAddDirs = arguments_.safehouseAddDirs ?? [];
-    const safehouseAgentAddDirs = uniqueStrings([
-        ...safehousePrepareAddDirs,
-        ...(arguments_.safehouseAgentAddDirs ?? []),
-    ]);
+    const safehouseAgentAddDirs = resolveSafehouseAgentAddDirs({
+        prepareAddDirs: safehousePrepareAddDirs,
+        agentAddDirs: arguments_.safehouseAgentAddDirs,
+        integrationAddDirs: safehouseAgentIntegration?.addDirs,
+    });
     const safehouseAddDirsFlag = safehousePathListFlag("--add-dirs", safehousePrepareAddDirs);
     const safehouseAgentAddDirsFlag = safehousePathListFlag("--add-dirs", safehouseAgentAddDirs);
     const safehouseAgentAddDirsReadOnlyFlag = safehousePathListFlag("--add-dirs-ro", uniqueStrings([
@@ -479,13 +426,26 @@ function buildSafehouseLaunchCommand(arguments_) {
     // profile only — the repo-controlled prepareWorktree hook never needs them.
     const safehouseEnableFlag = safehouseEnableFeaturesFlag(arguments_.safehouseEnableFeatures ?? []);
     const safehouseWrapper = safehouseWrapperCommand(arguments_.networkEgress);
+    // Extra paths an integration staged for the agent wrap (e.g. codex's
+    // relocated CODEX_HOME) and wants removed alongside the shim dir. Rendered
+    // once and reused by both the trap (failure path) and the explicit
+    // post-wrap cleanup (success path) below, so the two stay in lockstep.
+    const { teardownCleanupCmd, writeBackCmd } = safehouseIntegrationCleanupCommands(safehouseAgentIntegration);
     // Defensive shim+promptDir trap: by the time we arm it, `rm -rf <promptDir>`
     // has already run (line below) so the promptDir wipe is a no-op on the happy
     // path. Keeps the failure-window between shim creation and the explicit
     // post-wrap cleanup covered for both targets without an unarmed window.
-    const shimAndPromptCleanup = `rm -rf "$_safehouse_shim_dir"; rm -rf ${shellSingleQuote(promptDir)}`;
+    const shimAndPromptCleanup = safehouseShimAndPromptCleanup({
+        promptDir,
+        writeBackCmd,
+        teardownCleanupCmd,
+    });
     const shimAndPromptTrap = `trap ${shellSingleQuote(shimAndPromptCleanup)} EXIT`;
-    const lines = hostTrapAndCd({ workingDir: arguments_.workingDir, promptDir });
+    const lines = hostTrapAndCd({
+        workingDir: arguments_.workingDir,
+        promptDir,
+        additionalCleanupCommands: teardownCleanupCmd === "" ? [] : [teardownCleanupCmd],
+    });
     // Scrub inherited env before preLaunch (build secrets are copied out of
     // `process.env`, which the launch shell inherits), then source secrets and
     // read the staged prompt. See `hostPreLaunchSourceAndReadPrompt`.
@@ -510,130 +470,79 @@ function buildSafehouseLaunchCommand(arguments_) {
     // Running the real launch chain as `sh -c` would make it see `sh`, so use
     // an agent-named symlink to /bin/sh. This preserves per-agent profile
     // selection without enabling every agent profile.
-    `{ ${safehouseWrapper} ${safehouseAgentAddDirsFlag}${safehouseAgentAddDirsReadOnlyFlag}${safehouseEnableFlag}${agentEnvPassFlag}"$_safehouse_shim" -c ${shellSingleQuote(agentCommand)} sh${promptPositional(arguments_.omitPromptArgument)}; _safehouse_status=$?; rm -rf "$_safehouse_shim_dir"; trap - EXIT; exit "$_safehouse_status"; }`);
+    `{ ${safehouseWrapper} ${safehouseAgentAddDirsFlag}${safehouseAgentAddDirsReadOnlyFlag}${safehouseEnableFlag}${agentEnvPassFlag}"$_safehouse_shim" -c ${shellSingleQuote(agentCommand)} sh${promptPositional(arguments_.omitPromptArgument)}; _safehouse_status=$?; rm -rf "$_safehouse_shim_dir";${successPathCleanupSegment(writeBackCmd, teardownCleanupCmd)} trap - EXIT; exit "$_safehouse_status"; }`);
     return lines.join(" && ");
 }
-function safehousePathListFlag(flagName, paths) {
-    return paths.length === 0 ? "" : `${flagName}=${shellSingleQuote(paths.join(":"))} `;
+/**
+ * Extra paths an integration staged for the agent wrap (e.g. codex's
+ * relocated `CODEX_HOME`) rendered as a single `rm -rf` command, or `""` when
+ * the integration staged nothing (Claude) — the empty string keeps every
+ * caller's string interpolation a no-op rather than branching itself.
+ */
+function safehouseTeardownCleanupCommand(teardownPaths) {
+    return teardownPaths.length === 0
+        ? ""
+        : `rm -rf ${teardownPaths.map((teardownPath) => shellSingleQuote(teardownPath)).join(" ")}`;
 }
-function safehouseEnableFeaturesFlag(features) {
-    return features.length === 0 ? "" : `--enable=${shellSingleQuote(features.join(","))} `;
+function safehouseIntegrationCleanupCommands(integration) {
+    return {
+        teardownCleanupCmd: safehouseTeardownCleanupCommand(uniqueStrings(integration?.teardownPaths ?? [])),
+        writeBackCmd: safehouseWriteBackCommand(integration?.writeBackFiles ?? []),
+    };
 }
-function uniqueStrings(values) {
-    return [...new Set(values)];
+function safehouseWriteBackCommand(writeBackFiles) {
+    return writeBackFiles
+        .map(({ baselinePath, stagedPath, sourcePath }) => {
+        const temporaryTemplate = shellSingleQuote(`${sourcePath}.groundcrew.XXXXXX`);
+        return [
+            `_groundcrew_write_back_tmp=$(/usr/bin/mktemp ${temporaryTemplate})`,
+            `if [ -n "$_groundcrew_write_back_tmp" ]; then if [ ! -L ${shellSingleQuote(stagedPath)} ] && [ -f ${shellSingleQuote(stagedPath)} ] && /bin/cp -P ${shellSingleQuote(stagedPath)} "$_groundcrew_write_back_tmp" && [ ! -L "$_groundcrew_write_back_tmp" ] && [ -f "$_groundcrew_write_back_tmp" ] && /bin/chmod 600 "$_groundcrew_write_back_tmp"; then if /usr/bin/cmp -s "$_groundcrew_write_back_tmp" ${shellSingleQuote(baselinePath)}; then :; elif ! /usr/bin/cmp -s ${shellSingleQuote(sourcePath)} ${shellSingleQuote(baselinePath)}; then echo 'groundcrew: skipped staged agent config write-back because the source changed concurrently' >&2; elif ! /bin/mv -f "$_groundcrew_write_back_tmp" ${shellSingleQuote(sourcePath)}; then echo 'groundcrew: failed to persist staged agent config' >&2; fi; else echo 'groundcrew: refused unsafe staged agent config write-back' >&2; fi; /bin/rm -f "$_groundcrew_write_back_tmp"; else echo 'groundcrew: failed to create staged agent config write-back file' >&2; fi`,
+            "unset _groundcrew_write_back_tmp",
+        ].join("; ");
+    })
+        .join("; ");
 }
 /**
- * Benign baseline env the srt wraps run under (via `env -i`). This is an
- * allowlist on purpose: srt's CLI spawns its child with the *inherited* host
- * env, so — unlike safehouse (`--env=FILE` sanitized baseline) and sdx (clean
- * container env) — ambient secrets in the launch shell would otherwise reach
- * the agent and bypass the filesystem read mask. A denylist can't enumerate
- * every secret var, so we clear the env and re-add only these known-benign
- * names plus per-wrap forwarded vars (build secrets / `preLaunchEnv`). Values
- * are read from the host shell at runtime. Vars unset on the host become empty
- * (harmless for these). srt injects proxy + TMPDIR vars into the child itself.
+ * The EXIT-trap command that wipes the profile-shim dir, the prompt dir, and
+ * any integration teardown paths — the failure-path cleanup. Shared with the
+ * explicit success-path cleanup below it (`successPathTeardownSegment`) so
+ * both paths remove the same set of staged paths.
  */
-const SRT_ENV_BASELINE = [
-    "PATH",
-    "HOME",
-    "USER",
-    "LOGNAME",
-    "SHELL",
-    "TERM",
-    "COLORTERM",
-    "LANG",
-    "LC_ALL",
-    "LC_CTYPE",
-    "TZ",
-    "PWD",
-];
-/** Render `env -i` forwarded assignments: ` NAME="$NAME"` per name (value taken from the host shell at runtime). */
-function srtForwardedEnv(names) {
-    return names.map((name) => ` ${name}="$${name}"`).join("");
+function safehouseShimAndPromptCleanup(input) {
+    return [
+        `rm -rf "$_safehouse_shim_dir"`,
+        `rm -rf ${shellSingleQuote(input.promptDir)}`,
+        ...(input.writeBackCmd === "" ? [] : [input.writeBackCmd]),
+        ...(input.teardownCleanupCmd === "" ? [] : [input.teardownCleanupCmd]),
+    ].join("; ");
+}
+/** Success-path counterpart to the EXIT-trap integration cleanup. */
+function successPathCleanupSegment(writeBackCmd, teardownCleanupCmd) {
+    const commands = [writeBackCmd, teardownCleanupCmd].filter((command) => command !== "");
+    return commands.length === 0 ? "" : ` ${commands.join("; ")};`;
 }
 /**
- * srt launch. Two srt wraps mirror the safehouse two-wrap design, so the
- * dependency/build phase is sandboxed too — not just the agent:
- *
- *   1. **prepareWorktree wrap**: `env -i <baseline+secrets> srt --settings <file> sh -c '<hook>'`.
- *   2. **Agent wrap**: `env -i <baseline+preLaunchEnv> srt --settings <file> sh -c 'exec <agent> "$@"' sh "$_p"`.
- *
- * Unlike safehouse there is no profile-by-basename selection, so no symlink
- * shim is needed — srt takes the policy as an explicit `--settings` file. Each
- * srt invocation runs under `env -i` (see `SRT_ENV_BASELINE`) so the agent gets
- * a sanitized env instead of the inherited host env: the prepareWorktree wrap
- * additionally forwards build secrets (for `npm ci` auth) and the agent wrap
- * forwards the user's opt-in `preLaunchEnv` names — matching safehouse's
- * sanitized baseline plus explicit pass-list posture. `preLaunch` and secret
- * sourcing still run on the host shell (full env), exactly as under safehouse.
- *
- * The settings file lives in `srtSettingsDir` (a dedicated temp dir, never the
- * prompt dir, which is wiped before the agent execs). The EXIT trap covers both
- * the settings dir and the prompt dir for every failure window; the happy path
- * removes the prompt dir before the agent wrap and the settings dir after it.
+ * Writable `--add-dirs` for the agent wrap: the shared prepare grants plus the
+ * task-source write paths plus any integration-staged dirs (e.g. codex's
+ * relocated `CODEX_HOME`), deduped. Kept out of `buildSafehouseLaunchCommand`
+ * so its per-source nullish handling doesn't count against that function's
+ * complexity budget.
  */
-function buildSrtLaunchCommand(arguments_) {
-    if (arguments_.srtPrepareSettingsFile === undefined ||
-        arguments_.srtAgentSettingsFile === undefined ||
-        arguments_.srtSettingsDir === undefined) {
-        throw new Error("buildLaunchCommand: runner='srt' requires srtPrepareSettingsFile, srtAgentSettingsFile, and srtSettingsDir (generate them with buildSrtSettings + stageSrtSettings before calling).");
-    }
-    const promptDir = path.dirname(arguments_.promptFile);
-    const { agentCommand, prepareWorktreeCommand } = renderPrepareAndAgentCommand(arguments_);
-    const srtBin = shellSingleQuote(srtBinPath());
-    // Distinct policies per wrap: the prepareWorktree hook is repo-controlled, so
-    // it runs under the profile-neutral settings (no agent credential grants);
-    // only the agent wrap gets the full agent policy.
-    //
-    // The trailing `--` is load-bearing: srt's CLI (commander) has its own `-c`,
-    // `--settings`, `--debug`, and `--control-fd` options. Without `--`, srt would
-    // capture the child's `sh -c '<cmd>'` as its OWN `-c` (dropping the trailing
-    // prompt positionals entirely), and an option-looking prompt/hook value could
-    // mutate srt's options (e.g. redirect `--settings`). `--` ends srt option
-    // parsing so everything after is the child argv.
-    const prepareTarget = `${srtBin} --settings ${shellSingleQuote(arguments_.srtPrepareSettingsFile)} --`;
-    const agentTarget = `${srtBin} --settings ${shellSingleQuote(arguments_.srtAgentSettingsFile)} --`;
-    // `env -i <baseline>` drops the inherited host env; each wrap re-adds only the
-    // benign baseline plus its forwarded names (`VAR="$VAR"` — value from the host
-    // shell at runtime; the names are safe identifiers, validated for
-    // preLaunchEnv). env -i isolates the agent wrap from build secrets, so no
-    // `unset` dance between wraps is needed.
-    const baseline = SRT_ENV_BASELINE.map((name) => `${name}="$${name}"`).join(" ");
-    const prepareForward = arguments_.secretsFile === undefined ? "" : srtForwardedEnv(BUILD_SECRET_NAMES);
-    const prepareWrap = `env -i ${baseline}${prepareForward} ${prepareTarget}`;
-    // The relocated config-home env (e.g. CODEX_HOME) is an explicit value, not a
-    // `VAR="$VAR"` host passthrough — groundcrew computed the staged path, it is
-    // not in the launch shell's env. The name is a fixed identifier; the value is
-    // single-quoted. Only the agent wrap gets it.
-    const agentConfigDirAssignment = arguments_.srtAgentConfigDirEnv === undefined
-        ? ""
-        : ` ${arguments_.srtAgentConfigDirEnv.name}=${shellSingleQuote(arguments_.srtAgentConfigDirEnv.value)}`;
-    const agentWrap = `env -i ${baseline}${agentConfigDirAssignment}${srtForwardedEnv([
-        ...(arguments_.definition.preLaunchEnv ?? []),
-        ...workerEnvironmentNames(arguments_.workerEnvironment),
-    ])} ${agentTarget}`;
-    // One EXIT trap wipes both the settings dir and the prompt dir, covering
-    // every failure window between here and the post-wrap cleanup.
-    const cleanup = `rm -rf ${shellSingleQuote(arguments_.srtSettingsDir)}; rm -rf ${shellSingleQuote(promptDir)}`;
-    const lines = [
-        `trap ${shellSingleQuote(cleanup)} EXIT`,
-        `cd ${shellSingleQuote(arguments_.workingDir)}`,
-        ...hostPreLaunchSourceAndReadPrompt({
-            definition: arguments_.definition,
-            worktreeDir: arguments_.worktreeDir,
-            promptFile: arguments_.promptFile,
-            promptDir,
-            secretsFile: arguments_.secretsFile,
-        }),
-    ];
-    if (arguments_.prepareWorktreeUnsandboxedCommand !== undefined) {
-        lines.push(hostPrepareWorktreeLine(arguments_.prepareWorktreeUnsandboxedCommand, arguments_.definition.preLaunchEnv ?? []));
-    }
-    if (prepareWorktreeCommand !== undefined) {
-        lines.push(`${prepareWrap} sh -c ${shellSingleQuote(prepareWorktreeCommand)}`);
-    }
-    lines.push(...workerEnvironmentExports(arguments_.workerEnvironment), `{ ${agentWrap} sh -c ${shellSingleQuote(agentCommand)} sh${promptPositional(arguments_.omitPromptArgument)}; _srt_status=$?; rm -rf ${shellSingleQuote(arguments_.srtSettingsDir)}; trap - EXIT; exit "$_srt_status"; }`);
-    return lines.join(" && ");
+function resolveSafehouseAgentAddDirs(input) {
+    return uniqueStrings([
+        ...input.prepareAddDirs,
+        ...(input.agentAddDirs ?? []),
+        ...(input.integrationAddDirs ?? []),
+    ]);
+}
+function safehousePathListFlag(flagName, paths) {
+    return paths.length === 0 ? "" : `${flagName}=${shellSingleQuote(paths.join(":"))} `;
+}
+function safehouseEnableFeaturesFlag(features) {
+    return features.length === 0 ? "" : `--enable=${shellSingleQuote(features.join(","))} `;
+}
+function uniqueStrings(values) {
+    return [...new Set(values)];
 }
 function buildSdxLaunchCommand(arguments_) {
     /* v8 ignore next 5 @preserve -- setupWorkspace passes sandboxName + sandbox config when picking sdx; missing fields are programmer errors */
@@ -659,7 +568,7 @@ function buildSdxLaunchCommand(arguments_) {
     const sbxEnvironmentFlags = sbxEnvironmentNames.length === 0
         ? ""
         : `${sbxEnvironmentNames.map((name) => `-e ${name}`).join(" ")} `;
-    const lines = [trapCleanupLine(promptDir)];
+    const lines = [trapCleanupLine({ promptDir })];
     if (arguments_.secretsFile !== undefined) {
         lines.push(sourceSecretsLine(arguments_.secretsFile));
     }

package/dist/lib/localRunner.d.ts

@@ -3,11 +3,10 @@ import type { HostCapabilities } from "./host.ts";
 /**
  * Resolve `local.runner` from config + host capabilities into a concrete
  * backend. `auto` defaults to safehouse on macOS and sdx on Linux — both
- * are the deny-first paths for their platform. `srt`, `none`, and the
- * explicit names pass through unchanged so users always get exactly what
- * they asked for; `srt` is therefore opt-in only and never picked by
- * `auto` in this phase. Pure: takes everything it needs as arguments so
- * the dispatcher can test platform pivots without touching real hosts.
+ * are the deny-first paths for their platform. `none` and the explicit names
+ * pass through unchanged so users always get exactly what they asked for.
+ * Pure: takes everything it needs as arguments so the dispatcher can test
+ * platform pivots without touching real hosts.
  */
 export declare function resolveLocalRunner(setting: LocalRunnerSetting, host: HostCapabilities): LocalRunner;
 /**

package/dist/lib/localRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localRunner.d.ts","sourceRoot":"","sources":["../../src/lib/localRunner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,gBAAgB,GACrB,WAAW,CAQb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAqD/F"}
+{"version":3,"file":"localRunner.d.ts","sourceRoot":"","sources":["../../src/lib/localRunner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,gBAAgB,GACrB,WAAW,CAQb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CA+B/F"}

package/dist/lib/localRunner.js

@@ -2,11 +2,10 @@ import { log, styleWarning } from "./util.js";
 /**
  * Resolve `local.runner` from config + host capabilities into a concrete
  * backend. `auto` defaults to safehouse on macOS and sdx on Linux — both
- * are the deny-first paths for their platform. `srt`, `none`, and the
- * explicit names pass through unchanged so users always get exactly what
- * they asked for; `srt` is therefore opt-in only and never picked by
- * `auto` in this phase. Pure: takes everything it needs as arguments so
- * the dispatcher can test platform pivots without touching real hosts.
+ * are the deny-first paths for their platform. `none` and the explicit names
+ * pass through unchanged so users always get exactly what they asked for.
+ * Pure: takes everything it needs as arguments so the dispatcher can test
+ * platform pivots without touching real hosts.
  */
 export function resolveLocalRunner(setting, host) {
     if (setting !== "auto") {
@@ -38,24 +37,6 @@ export function assertLocalRunnerRequirements(host, runner) {
         }
         return;
     }
-    if (runner === "srt") {
-        if (!host.isSrtSupported) {
-            throw new Error("Local groundcrew runs with the srt runner require macOS or Linux/WSL. Set local.runner to 'auto' to pick the platform default.");
-        }
-        if (host.isLinux) {
-            const missing = [
-                host.hasBubblewrap ? undefined : "bubblewrap",
-                host.hasSocat ? undefined : "socat",
-                host.hasRipgrep ? undefined : "ripgrep (rg)",
-            ].filter((name) => name !== undefined);
-            if (missing.length > 0) {
-                throw new Error(`Local groundcrew runs with the srt runner on Linux require ${missing.join(", ")} on PATH. ` +
-                    "Install the missing dependencies (Debian/Ubuntu: `apt install bubblewrap socat ripgrep`). " +
-                    "On Ubuntu 24.04+ you may also need `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0` to allow unprivileged user namespaces.");
-            }
-        }
-        return;
-    }
     if (runner === "sdx") {
         if (!host.isSdxSupported) {
             throw new Error("Local groundcrew runs with the sdx runner require macOS or Linux.");

package/docs/configuration.md

@@ -314,7 +314,7 @@ and hook contract.
 | Key                                                   | Default              | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | ----------------------------------------------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `sources`                                             | `[]`                 | Additional pluggable task sources, dispatched alongside the built-in Linear adapter. Built-in kinds: `shell`, `linear`. Declare `{ kind: "linear", team: "ENG", statuses: { ... } }` to configure Linear task creation's default team and/or override Linear status names used for `in-progress` / `in-review` disambiguation. Disable the implicit Linear source with `{ kind: "linear", enabled: false }` (no API key required) — useful for shell-only setups.     |
-| `sources[].sandboxWritePaths`                         | optional             | Shell sources only. Local directories that the `safehouse` and `srt` sandbox runners open for read and write while an agent works a task from that source. Use this when a shell-backed task store lives outside the worktree, such as `~/plans`. Paths may be absolute, relative to the agent working directory, or `~`-prefixed. Not supported by the `sdx` runner.                                                                                                 |
+| `sources[].sandboxWritePaths`                         | optional             | Shell sources only. Local directories that the `safehouse` sandbox runner opens for read and write while an agent works a task from that source. Use this when a shell-backed task store lives outside the worktree, such as `~/plans`. Paths may be absolute, relative to the agent working directory, or `~`-prefixed. Not supported by the `sdx` runner.                                                                                                           |
 | `git.remote`                                          | `"origin"`           | Remote used for `fetch` and as the worktree base ref.                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `git.defaultBranch`                                   | `"main"`             | Branch fetched from `git.remote` and used as the worktree base.                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `git.branchPrefix`                                    | OS username          | Prefix groundcrew puts before the task id when naming a worktree branch (`<branchPrefix>-<task>`). Must be a slash-free slug of letters, digits, `.`, `_`, or `-`. Defaults to the OS account username. Changing it only affects newly created worktrees; existing local branches keep their original names until cleaned up. Prefer a per-user config for personal prefixes — a committed `git.branchPrefix` gives every contributor the same branch prefix.         |
@@ -340,6 +340,6 @@ and hook contract.
 | `prompts.promptFile`                                  | optional             | Path to a UTF-8 file whose contents become `prompts.initial`, read at load time. Resolved relative to the config file's directory; `~` is expanded and absolute paths are used as-is. The JSON-friendly alternative to inlining a large prompt or `readFileSync`. Mutually exclusive with `prompts.initial`.                                                                                                                                                          |
 | `workspaceKind`                                       | `"auto"`             | Terminal session manager. `"auto"` picks `cmux` when on PATH, else `tmux`. Set to `"cmux"`, `"tmux"`, or `"zellij"` to fail loudly when the chosen backend is missing.                                                                                                                                                                                                                                                                                                |
 | `local.runner`                                        | `"auto"`             | Local isolation backend. `"auto"` uses `safehouse` on macOS and `sdx` on Linux/WSL. Explicit: `"safehouse"`, `"sdx"`, `"none"`. `"none"` is never picked implicitly.                                                                                                                                                                                                                                                                                                  |
-| `local.networkEgress`                                 | `"allowlisted"`      | Network egress posture. With `local.runner: "safehouse"`, `"allowlisted"` wraps with Clearance and `"open"` keeps the Safehouse filesystem sandbox while opening network egress. Ignored by `srt`, `sdx`, and `none`; `srt` keeps enforcing its own allowlist.                                                                                                                                                                                                        |
-| `local.readOnlyDirs`                                  | `~/.config/tfenv`    | Host directories re-opened read-only inside the sandbox (`safehouse` + `srt`), for toolchains the sandbox profile masks but does not re-open. `~` is expanded. Defaults to tfenv's config root so `terraform`/`tfenv` work in the sandbox; set your own list to add or replace entries. Ignored by `sdx` and `none`.                                                                                                                                                  |
+| `local.networkEgress`                                 | `"allowlisted"`      | Network egress posture. With `local.runner: "safehouse"`, `"allowlisted"` wraps with Clearance and `"open"` keeps the Safehouse filesystem sandbox while opening network egress. Ignored by `sdx` and `none`.                                                                                                                                                                                                                                                         |
+| `local.readOnlyDirs`                                  | `~/.config/tfenv`    | Host directories re-opened read-only inside the Safehouse sandbox, for toolchains the profile masks but does not re-open. `~` is expanded. Defaults to tfenv's config root so `terraform`/`tfenv` work in the sandbox; set your own list to add or replace entries. Ignored by `sdx` and `none`.                                                                                                                                                                      |
 | `logging.file`                                        | XDG state path       | Append-mode log file. `log()` / `logEvent()` tee here in addition to stdout. Defaults to `${XDG_STATE_HOME:-$HOME/.local/state}/groundcrew/groundcrew.log`.                                                                                                                                                                                                                                                                                                           |

package/docs/runners.md

@@ -2,14 +2,11 @@
 
 `local.runner` picks the local isolation backend. `auto` resolves per platform.
 
-| Runner      | Default on  | Backend                                                                                                                                                                      |
-| ----------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `safehouse` | macOS       | [Safehouse](https://agent-safehouse.dev/) — fastest local; cannot safely give the agent Docker.                                                                              |
-| `srt`       | — (opt-in)  | [Anthropic sandbox-runtime](https://github.com/anthropic-experimental/sandbox-runtime) — fast, non-Docker, on macOS **and** Linux/WSL. Built-in network + filesystem policy. |
-| `sdx`       | Linux / WSL | [Docker Sandboxes](https://docs.docker.com/sandboxes/) (`sbx`) — required when the agent needs `docker`.                                                                     |
-| `none`      | —           | Unsandboxed escape hatch. Never picked implicitly; doctor warns when configured.                                                                                             |
-
-`auto` never resolves to `srt` — opt in explicitly with `local.runner: "srt"`.
+| Runner      | Default on  | Backend                                                                                                  |
+| ----------- | ----------- | -------------------------------------------------------------------------------------------------------- |
+| `safehouse` | macOS       | [Safehouse](https://agent-safehouse.dev/) — fastest local; cannot safely give the agent Docker.          |
+| `sdx`       | Linux / WSL | [Docker Sandboxes](https://docs.docker.com/sandboxes/) (`sbx`) — required when the agent needs `docker`. |
+| `none`      | —           | Unsandboxed escape hatch. Never picked implicitly; doctor warns when configured.                         |
 
 ## Safehouse Clearance Allowlist
 
@@ -52,54 +49,14 @@ This is for the case where the allowlist is more friction than the egress restri
 Scope and limits:
 
 - **safehouse only.** It applies to both groundcrew-composed Safehouse wraps (the `prepareWorktree` wrap and the agent wrap).
-- **Ignored by `srt` / `sdx` / `none`.** The other runners ignore it, so you can leave `networkEgress` set while switching `local.runner`. Note that `srt` enforces its own network allowlist (`CLEARANCE_ALLOW_HOSTS` / `allowedDomains`) regardless: to actually open egress, use the `safehouse` runner.
+- **Ignored by `sdx` / `none`.** The other runners ignore it, so you can leave `networkEgress` set while switching `local.runner`.
 - **No additional effect when `cmd` already starts with `safehouse`:** that command owns its own wrap, so groundcrew injects nothing. Groundcrew-managed setup/resume launches still reject cmd-owned Safehouse wraps because worker self-completion env cannot be injected.
 
-## srt (Anthropic sandbox-runtime)
-
-`srt` is the fast, non-Docker option that works on **both macOS and Linux/WSL** — the gap `safehouse` (macOS-only) and `sdx` (Docker) leave. It replaces both Safehouse and Clearance in one tool: a sandbox engine (`sandbox-exec` on macOS, `bubblewrap` on Linux) plus a built-in proxy network allowlist. It is opt-in while it stabilizes:
-
-```bash
-crew run --watch  # with local.runner: "srt" in crew.config.ts
-```
-
-> **Beta.** `@anthropic-ai/sandbox-runtime` is an Anthropic research preview; its config format may evolve. groundcrew pins the version it ships with, so upgrades are deliberate.
-
-Groundcrew generates a per-launch policy itself (Safehouse's `.sb` profiles have no equivalent here):
-
-- **Reads**: the home region (`/Users` on macOS, `/home`+`/root`+`/mnt` on Linux — `/mnt` covers WSL's Windows drive mounts) is denied, then the worktree, the repo's git metadata, the language toolchains needed to run the agent, and the agent's own config dirs (`~/.claude`, `~/.codex`, …) are re-opened. On macOS the user keychain dir (`~/Library/Keychains`) is also re-opened read-only so keychain-authenticated agents (claude) can sign in under the home mask. The agent cannot read `~/.ssh`, `~/.aws`, shell history, or unrelated repos.
-- **Writes**: allow-only, and the host-CLI persistence vector (planting hooks, `mcpServers`, `commands/`, `plugins/`, … that run on the user's next host invocation) is closed per agent. **claude** keeps a writable `~/.claude` (its Bash tool needs scratch/session state there) but every fixed-path executable/instruction surface — `~/.claude.json` (`mcpServers`), `settings.json` and its hooks, `commands/`, `agents/`, `plugins/`, `skills/`, `statusline.sh`, `CLAUDE.md`, the bundled `chrome` binary, `.git/{hooks,config}` — is denied; claude tolerates those write denials. **codex** hard-fails with a read-only home, so it is pointed at a per-launch relocated config dir (`CODEX_HOME`) seeded with its credentials, leaving the real `~/.codex` entirely unwritten. The git common dir is granted as a **narrow allowlist** of only what `status/diff/add/commit/push/gc` write (`objects`, `refs`, `logs`, `packed-refs`, this worktree's gitdir, …) — never wholesale, so the repo `config`/`hooks`, the per-worktree gitdir redirection files, and **sibling worktree gitdirs** stay unwritable. Global toolchain bins (`~/.cargo/bin`, global `node_modules`, the npx cache, …) are never writable either.
-- **Environment**: each `srt` invocation runs under a sanitized env (`env -i` + a benign baseline). Unlike safehouse and sdx, the `srt` CLI inherits the host env, so without this an ambient `AWS_*`, `GITHUB_TOKEN`, etc. would reach the agent and bypass the read mask. Credentials the agent legitimately needs from the environment must be forwarded explicitly via the agent's `preLaunchEnv` (the same opt-in pass-list safehouse uses).
-- **Network**: allow-only, **reused from the same Clearance allowlist** (`CLEARANCE_ALLOW_HOSTS` / `CLEARANCE_ALLOW_HOSTS_FILES`, including the shipped `clearance-allow-hosts`) so there is one source of truth. Local binding and unix sockets stay off (never the Docker socket).
-- **Built-in credential profiles**: the per-agent read/write/deny profiles above ship for `claude`, `codex`, and `cursor-agent` (the `cursor` / `cursor-grok` presets). Unknown agents get no extra home access.
-
-### Linux / WSL prerequisites
-
-Install the srt runtime dependencies:
-
-```bash
-# Debian / Ubuntu
-sudo apt install bubblewrap socat ripgrep
-```
-
-On **Ubuntu 24.04+**, unprivileged user namespaces are restricted by AppArmor; enable them once:
-
-```bash
-sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-```
-
-`crew doctor` checks these and prints what is missing. macOS needs no extra dependencies — the `srt` CLI ships with groundcrew.
-
-### Debugging sandbox denials
-
-- **macOS**: `log stream --predicate 'process == "sandbox-exec"' --style syslog`
-- **Linux**: bubblewrap has no built-in violation log; trace the failing command with `strace -f -e trace=file <cmd>` to find the blocked path, then widen the policy.
-
 ## Docker Sandboxes Setup
 
 `sdx` does not support `unsandboxedHooks`. The sdx container has no
 host to run it on; configuring it for an `sdx`-runner repo is a launch-time
-config error. Use `safehouse`, `srt`, or `none` if you need host-side setup.
+config error. Use `safehouse` or `none` if you need host-side setup.
 
 Each agent that runs under `sdx` needs a `sandbox: { agent: "<sbx-agent>" }` block in `crew.config.ts`. Groundcrew addresses the sandbox as `groundcrew-<agent>` and reuses one existing sandbox per agent across repos and tasks.
 

package/docs/setup-hooks.md

@@ -127,7 +127,7 @@ Grant it only to repositories you trust to run arbitrary code on the host.
   (top-level or under `hooks`) is a hard config error.
 - **Per-repository only.** There is no `defaults.unsandboxedHooks`;
   host execution is never a fleet-wide default.
-- **Runner support.** Runs on the host for `safehouse`, `srt`, and `none`. The
+- **Runner support.** Runs on the host for `safehouse` and `none`. The
   `sdx` runner rejects it at launch — a container has no host to run it on.
 - **Credentials.** Build secrets are available so `npm`/`bundle` can
   authenticate; the agent's `preLaunchEnv` names are scrubbed so the command

package/docs/spec/e2e-scenario-catalog.md

@@ -58,7 +58,7 @@ With no working implementation to validate against (green-on-v1 dropped), the ha
 ### 1.6 Lanes
 
 - **Core lane**: hermetic, no sandbox runner, runs anywhere including CI.
-- **Sandbox lane**: real srt (macOS `sandbox-exec` / Linux bubblewrap), platform-gated; asserts denial behavior that can't be faked honestly. v2-only by definition — v1's posture keeps its existing unit-level coverage.
+- **Sandbox lane**: real platform runner, platform-gated; asserts denial behavior that can't be faked honestly. v2-only by definition — v1's posture keeps its existing unit-level coverage.
 
 ### 1.7 Suite packaging