@clipboard-health/groundcrew 4.48.0 → 4.48.2

package/docs/spec/v2-design.md

@@ -23,7 +23,7 @@ Locked constraints, not to be re-litigated during implementation:
 
 - The locked decisions kill or fundamentally reshape most of v1 (~21K source lines, ~38K test lines): `config.ts` dies with the TS-config format, the reviewer PR-polling loop dies, clearance/safehouse/sbx die, several commands die, and the core nouns are redefined. Every external surface breaks: config, CLI, source contract, sandbox posture, completion model.
 - Evolve's safety-net premise was stale: the acceptance suite never runs against v1 (green-on-v1 dropped), so in-place evolution gets zero protection from it. "Evolve" would be the same rewrite executed as a thousand PRs fighting 38K test lines that assert dying behavior.
-- Roughly 15–25% of v1 survives recognizably (srtPolicy/srtLaunch, the cleaner, tmux/git plumbing, doctor pieces, usage, completions). Surviving code is **ported file-by-file with its unit tests**; `git mv` preserves history.
+- Roughly 15–25% of v1 survives recognizably (sandbox policy and launch composition, the cleaner, tmux/git plumbing, doctor pieces, usage, completions). Surviving code is **ported file-by-file with its unit tests**; `git mv` preserves history.
 
 **Repo strategy: same repo, isolated `v2/` workspace.** v2 grows on `main` under a top-level `v2/` with its own `package.json`, flat `src/<module>` layout, and its own `CLAUDE.md`/`AGENTS.md`/`CONTEXT.md` carrying the v2 ubiquitous language. v1 and v2 use the same nouns with contradictory meanings ("Workspace" means a terminal pane in v1 and a per-task directory of worktrees in v2), so sharing one `src/` was rejected — it would contaminate agent-driven work. dependency-cruiser forbids cross-tree imports in both directions. **Flip condition:** if v2-building agents keep tripping over v1 despite the boundary, escalate mid-build to a new repo initialized from a full clone, then rename old → `groundcrew-v1`, new → `groundcrew`.
 
@@ -96,14 +96,14 @@ Single-repo tasks stay dead simple as the degenerate case: one designated repo,
 **"Plugin" means exactly one thing in v2: a task source.** Everything else that looked pluggable is config or core:
 
 - **Agent harnesses are declarative config**, not plugins: `cmd`, resume args, sandbox preferences, plus first-class `model`/`effort` fields. `cmd`-points-at-your-script is the escape hatch for odd agents.
-- **Sandbox runners are core-only**, explicitly not pluggable — a pluggable sandbox is a contradiction under sandboxed-by-default. **v2 ships exactly one runner: srt** (`sandbox-exec` on macOS, bubblewrap on Linux). Safehouse, clearance, and sbx die, including the `crew-clearance-ensure` bin.
+- **Sandbox runners are core-only**, explicitly not pluggable — a pluggable sandbox is a contradiction under sandboxed-by-default. The implementation selects the supported platform runner and keeps its mechanics behind the core sandbox boundary.
 - **No in-process plugin class exists.** The internal `TaskSource` interface survives only as core's private representation of a discovered manifest.
 
 **Packaging:** a plugin is a **directory bundle** — `source.json` plus scripts — discovered under `~/.config/groundcrew/task-sources/<name>/` (user) or bundled in the package (first-party). The directory is the plugin: language-agnostic, no runtime loading. Distribution is deliberately not groundcrew's problem (git clone, `curl | tar`, npm postinstall). No registry or catalog in v2.0; provenance tiers collapse to `package | user`. Review isolation is met structurally: third-party code never enters the core repo and never runs in the core process.
 
 **Versioning:** `source.json` carries a required integer `protocolVersion: 1` naming the contract generation, bumped only on breaking change — capability-by-omission carries all additive change (no version sniffing: `update` absent means read-only). Parseable-but-unsupported version → explicit actionable error in discovery/doctor/status, never a silent skip; unparseable manifests keep skip-plus-warn. Core declares a supported set; v2.0 ships `{1}`. No v1 command aliases.
 
-**Sources are sandboxed by default**, under the same srt machinery as agents: deny-by-default; a source gets its install dir (read), declared secret files, declared env, stdout/stderr, and a per-source scratch dir. The manifest gains a **network egress allowlist** (e.g. `network: ["api.linear.app"]`) alongside `secrets`/`env`/`prerequisites`. Uniform across origins — bundled first-party sources run under the same policy. Per-source opt-out (`sandbox: false`) is loud in status/doctor.
+**Sources are sandboxed by default**, under the same core sandbox boundary as agents: deny-by-default; a source gets its install dir (read), declared secret files, declared env, stdout/stderr, and a per-source scratch dir. The manifest gains a **network egress allowlist** (e.g. `network: ["api.linear.app"]`) alongside `secrets`/`env`/`prerequisites`. Uniform across origins — bundled first-party sources run under the same policy. Per-source opt-out (`sandbox: false`) is loud in status/doctor.
 
 **Batteries included, kernel-pure code paths:** `linear`, `jira`, and `todo-txt` ship as manifest bundles crossing the same process boundary as third-party sources — first-party sources are the protocol's permanent conformance tests. The generic `shell` config-block adapter dies: bring-your-own-scripts is just a user-dir manifest.
 
@@ -190,7 +190,7 @@ Consequences: the session presenter presents sessions, not runs; `status` render
 | **Run**         | The run record: state machine, **reported layer** (`artifact add`/`done` intake), outcomes, writeback point                                                                                | the **Writeback port** (consumer-owned, defined in `src/run/`) |
 | **Workspace**   | Worktrees, branches, **observed layer** (credential-free git facts), `.groundcrew/task.json` and the task-identity resolver; typed errors that Shell maps to exit codes 2/3                | the workspace marker-file format                               |
 | **Session**     | Harness profiles (declarative), launch composition (presenter → sandbox → agent), pause/resume and session-id capture; cmux/tmux/zellij adapters in-core                                   | the **presenter contract seam**                                |
-| **Sandbox**     | Pure library: `wrap(command, policy) → command`; srt mechanics hidden; no lifecycle ownership                                                                                              | nothing pluggable — core-only by decision                      |
+| **Sandbox**     | Pure library: `wrap(command, policy) → command`; runner mechanics hidden; no lifecycle ownership                                                                                           | nothing pluggable — core-only by decision                      |
 | **Shell**       | commander wiring, routing (`repo add` → Workspace; `artifact add`/`done` → Run), rendering, error→exit-code mapping; `status` = read model joining Run (reported) and Workspace (observed) | —                                                              |
 
 The flow model's central invariant gets one owner per layer — **observed = Workspace, reported = Run** — so a lie or missing link is always attributable to exactly one module. Sandbox has two real callers (Session wraps agents, Acquisition wraps sources): a real seam, and the one place that keeps "sandbox runners are not pluggable" enforceable.
@@ -279,7 +279,7 @@ The file sink gets everything, always. Console: `info`+ by default, human-render
 
 ### 10.5 Reconcile and reaping
 
-**Active sweep yes, TTL no.** srt sandboxes are process-scoped — nothing standing to reap except a live agent process, and the interactive baseline forbids killing those on a timer.
+**Active sweep yes, TTL no.** Agent launches are process-scoped, and the interactive baseline forbids killing live agents on a timer. Persistent runner environments remain externally managed.
 
 - **Reconcile is an idempotent library routine with two callers**: startup (the crash-safety guarantee — on-disk git/tmux/sandbox state is the source of truth, compared against expected task state; `using`/signal handlers are the graceful path only) and the dispatcher tick (every Nth poll cycle).
 - Auto-GC only the provably dead: presenter surfaces whose process exited, stale run records, clean worktrees of source-terminal tasks (the cleaner, section 5).
@@ -326,7 +326,7 @@ If Effect is ever reconsidered: gate on v4-stable, follow the opencode pattern (
 1. **Build the acceptance suite red-first from the [E2E scenario catalog](./e2e-scenario-catalog.md)** — the `e2e/` package, fixture source, scripted agent, fake `gh`, harness self-tests. This is the entry point; no v2 code before it.
 2. Fix `main`'s release automation (path/scope filter) so v2 commits don't trigger 4.x publishes (section 2).
 3. Scaffold the `v2/` workspace: seven-module skeleton, dependency-cruiser rules (section 9.6) proven to bite, `CONTEXT.md` from the glossary seed, ADRs seeded from the wayfinder resolutions.
-4. Bring the suite green module by module, porting the surviving v1 code (srtPolicy/srtLaunch, cleaner, tmux/git plumbing, doctor pieces) file-by-file with its tests.
+4. Bring the suite green module by module, porting the surviving v1 code (sandbox policy and launch composition, cleaner, tmux/git plumbing, doctor pieces) file-by-file with its tests.
 5. Before publishing 5.0.0: resolve the `crew upgrade` ambush (section 11) and execute the cutover (section 2).
 
 Post-v2 handoff backlog (deferred by decision): migration easing detail (section 11); presenter bundles and their trust posture (section 8); `crew progress` (section 10.6); an optional repo allowlist (section 4).
@@ -343,7 +343,7 @@ Every map decision, in resolution order. Full rationale lives in the linked tick
 | [Multi-repo task model](https://linear.app/clipboardhealth/issue/DEVOP-5967)                 | One session per task over a workspace of worktrees                                                                     | 4       |
 | [Flow model](https://linear.app/clipboardhealth/issue/DEVOP-5968)                            | Sinks and flows dissolve; `list`/`get`/`update` source contract; run-state machine                                     | 3       |
 | [Effect vs plain TypeScript](https://linear.app/clipboardhealth/issue/DEVOP-5972)            | Plain TypeScript; exceptions inside, result-shaped protocol at the boundary; reconcile-on-startup                      | 12.1    |
-| [Plugin packaging and review isolation](https://linear.app/clipboardhealth/issue/DEVOP-5973) | Task sources are the only plugin kind; directory bundles; `protocolVersion`; sandboxed by default; srt only            | 6       |
+| [Plugin packaging and review isolation](https://linear.app/clipboardhealth/issue/DEVOP-5973) | Task sources are the only plugin kind; directory bundles; `protocolVersion`; sandboxed by default; core runners        | 6       |
 | [CLI surface](https://linear.app/clipboardhealth/issue/DEVOP-5975)                           | 14 commands; `crew.config.jsonc`; install.sh → `crew init`                                                             | 7       |
 | [E2E scenario catalog](https://linear.app/clipboardhealth/issue/DEVOP-5974)                  | v2-only red-first suite; harness self-tests; completion model codified (amends the destination)                        | 5       |
 | [Headless extension point](https://linear.app/clipboardhealth/issue/DEVOP-5976)              | Session-presenter seam; headless = future detached presenter (amends CLI config: `multiplexer` → `presenter`)          | 8       |

package/docs/task-sources.md

@@ -52,9 +52,9 @@ expected or explicitly allowed.
 Set `sandboxWritePaths` when the shell source owns local files the agent must
 read and update in place, such as a plan directory. Each path may be absolute,
 relative to the agent working directory, or `~`-prefixed. Under the `safehouse`
-and `srt` runners, groundcrew opens those directories for read and write only
-for tasks from that source; an unqualified task id grants every eligible
-source's declared paths. The `sdx` runner does not mount these host paths.
+runner, groundcrew opens those directories for read and write only for tasks
+from that source; an unqualified task id grants every eligible source's
+declared paths. The `sdx` runner does not mount these host paths.
 
 ```json
 [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clipboard-health/groundcrew",
-  "version": "4.48.0",
+  "version": "4.48.2",
   "description": "Linear-driven orchestrator that launches AI coding agents in git worktrees, with workspace lifecycle and usage tracking.",
   "keywords": [
     "agent",
@@ -63,14 +63,12 @@
     "markdown:lint": "markdownlint-cli2 --config config/markdownlint-cli2.jsonc",
     "prepack": "node --run build",
     "prepare": "husky",
-    "spell:check": "cspell --config config/cspell.json --no-summary --no-progress --no-must-find-files",
     "sync-ai-rules": "node ./node_modules/@clipboard-health/ai-rules/scripts/sync.js common",
     "syncpack:lint": "syncpack lint --config config/syncpack.config.ts",
     "test": "vitest run --coverage",
     "verify": "node scripts/verifyAll.mts"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "0.0.65",
     "@clipboard-health/clearance": "1.4.7",
     "@linear/sdk": "88.1.0",
     "agent-trust": "1.0.0",
@@ -79,7 +77,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@clipboard-health/ai-rules": "2.37.1",
+    "@clipboard-health/ai-rules": "2.43.4",
     "@clipboard-health/oxlint-config": "1.12.9",
     "@nx/js": "22.7.7",
     "@tsconfig/node24": "24.0.4",
@@ -87,7 +85,6 @@
     "@types/node": "25.9.5",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@vitest/coverage-v8": "4.1.10",
-    "cspell": "10.0.1",
     "dependency-cruiser": "18.1.0",
     "husky": "9.1.7",
     "jscpd": "5.0.12",

package/static/demo.tape

@@ -1,5 +1,3 @@
-# cspell:ignore noprofile norc ttyd
-
 Output static/demo.gif
 Require bash
 Require ffmpeg

package/static/render-demo.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-# cspell:ignore ttyd
 set -euo pipefail
 
 script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"

package/dist/lib/clearanceHosts.d.ts

@@ -1,31 +0,0 @@
-/**
- * Translate the existing clearance egress allowlist into srt
- * `network.allowedDomains`. groundcrew keeps one source of truth for which
- * hosts an agent may reach: the `CLEARANCE_ALLOW_HOSTS` env var and the
- * newline-delimited files named by `CLEARANCE_ALLOW_HOSTS_FILES` (the shipped
- * `clearance-allow-hosts` starter plus any personal files).
- *
- * clearance and srt share host-matching semantics — a bare `example.com` is an
- * exact match and `*.example.com` matches subdomains — so the translation is
- * almost an identity. The only real work is parsing (comments, blanks,
- * comma/whitespace/newline separators), de-duplication, and dropping entries
- * srt's domain schema would reject (`*.com`, `*`, leading/trailing dots, bare
- * tokens without a dot like `localhost`) so the generated settings file always
- * validates.
- */
-export interface CollectAllowedDomainsInput {
-    /** Raw `CLEARANCE_ALLOW_HOSTS` value (comma/whitespace separated). */
-    hosts?: string | undefined;
-    /**
-     * Raw `CLEARANCE_ALLOW_HOSTS_FILES` value: a list of file paths joined by
-     * the platform path delimiter (`:` on POSIX), each a newline-delimited host
-     * list. Missing or unreadable files are skipped with a debug line.
-     */
-    files?: string | undefined;
-}
-/**
- * Parse and validate clearance allow-host sources into a de-duplicated list of
- * srt domain patterns, preserving first-seen order.
- */
-export declare function collectAllowedDomains(input: CollectAllowedDomainsInput): string[];
-//# sourceMappingURL=clearanceHosts.d.ts.map

package/dist/lib/clearanceHosts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clearanceHosts.d.ts","sourceRoot":"","sources":["../../src/lib/clearanceHosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,EAAE,CA8BjF"}

package/dist/lib/clearanceHosts.js

@@ -1,96 +0,0 @@
-/**
- * Translate the existing clearance egress allowlist into srt
- * `network.allowedDomains`. groundcrew keeps one source of truth for which
- * hosts an agent may reach: the `CLEARANCE_ALLOW_HOSTS` env var and the
- * newline-delimited files named by `CLEARANCE_ALLOW_HOSTS_FILES` (the shipped
- * `clearance-allow-hosts` starter plus any personal files).
- *
- * clearance and srt share host-matching semantics — a bare `example.com` is an
- * exact match and `*.example.com` matches subdomains — so the translation is
- * almost an identity. The only real work is parsing (comments, blanks,
- * comma/whitespace/newline separators), de-duplication, and dropping entries
- * srt's domain schema would reject (`*.com`, `*`, leading/trailing dots, bare
- * tokens without a dot like `localhost`) so the generated settings file always
- * validates.
- */
-import { readFileSync } from "node:fs";
-import { splitPathList } from "./pathList.js";
-import { debug } from "./util.js";
-/**
- * Parse and validate clearance allow-host sources into a de-duplicated list of
- * srt domain patterns, preserving first-seen order.
- */
-export function collectAllowedDomains(input) {
-    const texts = [];
-    for (const file of splitPathList(input.files)) {
-        try {
-            texts.push(readFileSync(file, "utf8"));
-        }
-        catch (error) {
-            debug(`Skipping unreadable CLEARANCE_ALLOW_HOSTS_FILES entry ${file}: ${String(error)}`);
-        }
-    }
-    if (input.hosts !== undefined) {
-        texts.push(input.hosts);
-    }
-    const seen = new Set();
-    const domains = [];
-    for (const text of texts) {
-        for (const raw of tokenize(text)) {
-            const domain = normalizeDomain(raw);
-            if (domain === undefined) {
-                continue;
-            }
-            const key = domain.toLowerCase();
-            if (seen.has(key)) {
-                continue;
-            }
-            seen.add(key);
-            domains.push(domain);
-        }
-    }
-    return domains;
-}
-/**
- * Split a host source into candidate tokens. Handles env-style
- * comma/whitespace separators and file-style newline lists with `#` comments
- * (full-line or trailing — hostnames never contain `#`).
- */
-function tokenize(text) {
-    return text
-        .split(/\r?\n/)
-        .flatMap((line) => line.replace(/#.*$/, "").split(/[\s,]+/))
-        .map((token) => token.trim())
-        .filter((token) => token.length > 0);
-}
-/**
- * Normalize a raw host token into a valid srt domain pattern, or `undefined`
- * if srt would reject it. Mirrors srt's `DomainPatternSchema`: a wildcard must
- * be `*.<domain-with-a-dot>`; a bare host must contain a dot and no `*`. A
- * leading-dot suffix form (`.example.com`) is rewritten to `*.example.com`.
- */
-function normalizeDomain(token) {
-    const candidate = token.startsWith(".") ? `*${token}` : token;
-    if (candidate.startsWith("*.")) {
-        const base = candidate.slice(2);
-        return isPlainDomain(base) ? candidate : undefined;
-    }
-    return isPlainDomain(candidate) ? candidate : undefined;
-}
-function isPlainDomain(value) {
-    return (value.length > 0 &&
-        !value.includes("*") &&
-        // Mirror srt's DomainPatternSchema, which rejects scheme/path/port tokens.
-        // This matters for safety, not just correctness: a token srt rejects (e.g.
-        // `https://api.github.com`, `api.github.com:443`, `github.com/path`) fails
-        // the whole settings file's schema validation, and srt's `loadConfig` then
-        // returns null → the CLI silently falls back to a config with no read mask.
-        // Dropping such tokens here keeps the generated settings valid (fail closed
-        // for that host, never fail open for the launch).
-        !value.includes("://") &&
-        !value.includes("/") &&
-        !value.includes(":") &&
-        value.includes(".") &&
-        !value.startsWith(".") &&
-        !value.endsWith("."));
-}

package/dist/lib/srtLaunch.d.ts

@@ -1,61 +0,0 @@
-import type { AgentDefinition } from "./config.ts";
-export interface StagedSrtLaunch {
-    /** Dedicated temp dir holding the settings files (and any relocated config home). */
-    directory: string;
-    /** Profile-neutral policy for the prepareWorktree wrap (no agent credentials). */
-    prepareFile: string;
-    /** Full agent policy for the agent wrap. */
-    agentFile: string;
-    /**
-     * Env var pointing the agent at its relocated, writable config home (codex's
-     * `CODEX_HOME`). Threaded into the agent wrap by `buildLaunchCommand`.
-     * Undefined for read-only agents (claude), which run with a read-only home.
-     */
-    agentConfigDirEnv?: {
-        name: string;
-        value: string;
-    };
-}
-/**
- * Resolve the worktree's real git common dir — the shared `.git` the srt policy
- * fences off (read-grant + narrow write-allow + write-denies). Derived from the
- * worktree itself rather than assuming a `<projectDir>/<repo>/.git` clone, so
- * scripted/sparse-checkout worktrees — whose checkout is owned by an external
- * provisioner and whose `repo` is just an alias with no clone on disk — get the
- * correct dir instead of a phantom path that breaks git access and leaves the
- * real common dir unfenced. For native worktrees this returns the same
- * `<projectDir>/<repo>/.git` as before. `--path-format=absolute` keeps the path
- * absolute regardless of git version or cwd.
- */
-export declare function resolveGitCommonDir(worktreeDir: string): string;
-/**
- * Generate the srt policies for a launch and stage them, plus — for agents that
- * cannot run with a read-only config home (codex) — a relocated, writable
- * config dir seeded with the minimal files the agent needs to authenticate and
- * keep its config. Shared by `setupWorkspace` (fresh runs) and `resumeWorkspace`
- * (resumes) so both behave identically under the srt runner.
- *
- * Two policies, distinct surfaces:
- * - the `prepare` policy is profile-neutral (empty agent → no `~/.claude` /
- *   `~/.codex` grants, no relocated home) so the repo-controlled prepareWorktree
- *   hook can't touch the agent's credentials;
- * - the `agent` policy carries the agent's read-only config profile and, when
- *   the agent relocates, the writable relocated home.
- *
- * The relocated home lives **inside** the settings dir but is the only thing
- * under it granted to the sandbox — the settings JSON siblings are never
- * read-granted, so the agent can't read or rewrite its own policy. The launch
- * command tears the whole dir down after srt exits.
- */
-export declare function buildAndStageSrtLaunch(input: {
-    task: string;
-    worktreeDir: string;
-    definition: AgentDefinition;
-    /** Local task-source directories the agent needs for self-completion writeback. */
-    taskSourceWritePaths?: readonly string[] | undefined;
-    /** Absolute host dirs re-opened read-only (`config.local.readOnlyDirs`). */
-    readOnlyDirs?: readonly string[] | undefined;
-    /** Defaults to `os.homedir()`. Injected in tests to seed from a fixture home. */
-    homeDir?: string;
-}): StagedSrtLaunch;
-//# sourceMappingURL=srtLaunch.d.ts.map

package/dist/lib/srtLaunch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"srtLaunch.d.ts","sourceRoot":"","sources":["../../src/lib/srtLaunch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKnD,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,eAAe,CA+ClB"}

package/dist/lib/srtLaunch.js

@@ -1,107 +0,0 @@
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { clearanceAllowHostsFilesFromEnvironment } from "./clearanceAllowlist.js";
-import { collectAllowedDomains } from "./clearanceHosts.js";
-import { runCommand } from "./commandRunner.js";
-import { inferAgentCommandName } from "./launchCommand.js";
-import { agentConfigRelocation, buildSrtSettings } from "./srtPolicy.js";
-import { readEnvironmentVariable } from "./util.js";
-/**
- * Resolve the worktree's real git common dir — the shared `.git` the srt policy
- * fences off (read-grant + narrow write-allow + write-denies). Derived from the
- * worktree itself rather than assuming a `<projectDir>/<repo>/.git` clone, so
- * scripted/sparse-checkout worktrees — whose checkout is owned by an external
- * provisioner and whose `repo` is just an alias with no clone on disk — get the
- * correct dir instead of a phantom path that breaks git access and leaves the
- * real common dir unfenced. For native worktrees this returns the same
- * `<projectDir>/<repo>/.git` as before. `--path-format=absolute` keeps the path
- * absolute regardless of git version or cwd.
- */
-export function resolveGitCommonDir(worktreeDir) {
-    return runCommand("git", [
-        "-C",
-        worktreeDir,
-        "rev-parse",
-        "--path-format=absolute",
-        "--git-common-dir",
-    ]);
-}
-/**
- * Generate the srt policies for a launch and stage them, plus — for agents that
- * cannot run with a read-only config home (codex) — a relocated, writable
- * config dir seeded with the minimal files the agent needs to authenticate and
- * keep its config. Shared by `setupWorkspace` (fresh runs) and `resumeWorkspace`
- * (resumes) so both behave identically under the srt runner.
- *
- * Two policies, distinct surfaces:
- * - the `prepare` policy is profile-neutral (empty agent → no `~/.claude` /
- *   `~/.codex` grants, no relocated home) so the repo-controlled prepareWorktree
- *   hook can't touch the agent's credentials;
- * - the `agent` policy carries the agent's read-only config profile and, when
- *   the agent relocates, the writable relocated home.
- *
- * The relocated home lives **inside** the settings dir but is the only thing
- * under it granted to the sandbox — the settings JSON siblings are never
- * read-granted, so the agent can't read or rewrite its own policy. The launch
- * command tears the whole dir down after srt exits.
- */
-export function buildAndStageSrtLaunch(input) {
-    const agent = inferAgentCommandName(input.definition.cmd);
-    const homeDir = input.homeDir ?? os.homedir();
-    const base = {
-        worktreeDir: input.worktreeDir,
-        gitCommonDir: resolveGitCommonDir(input.worktreeDir),
-        allowedDomains: collectAllowedDomains({
-            hosts: readEnvironmentVariable("CLEARANCE_ALLOW_HOSTS"),
-            files: clearanceAllowHostsFilesFromEnvironment(),
-        }),
-        readOnlyDirs: input.readOnlyDirs ?? [],
-    };
-    const directory = mkdtempSync(path.join(os.tmpdir(), `groundcrew-srt-${input.task}-`));
-    const relocation = agentConfigRelocation(agent);
-    let relocatedConfigDir;
-    let agentConfigDirEnv;
-    if (relocation !== undefined) {
-        relocatedConfigDir = path.join(directory, `${agent}-home`);
-        mkdirSync(relocatedConfigDir, { recursive: true });
-        seedRelocatedConfigDir({
-            sourceDir: path.join(homeDir, relocation.sourceHomeRelativeDir),
-            seedFiles: relocation.seedFiles,
-            relocatedConfigDir,
-        });
-        agentConfigDirEnv = { name: relocation.configDirEnv, value: relocatedConfigDir };
-    }
-    const prepare = buildSrtSettings({ ...base, agent: "" });
-    const agentSettings = buildSrtSettings({
-        ...base,
-        agent,
-        taskSourceWritePaths: input.taskSourceWritePaths ?? [],
-        ...(relocatedConfigDir === undefined ? {} : { relocatedConfigDir }),
-    });
-    const prepareFile = path.join(directory, "prepare-settings.json");
-    const agentFile = path.join(directory, "agent-settings.json");
-    writeFileSync(prepareFile, `${JSON.stringify(prepare, undefined, 2)}\n`);
-    writeFileSync(agentFile, `${JSON.stringify(agentSettings, undefined, 2)}\n`);
-    return {
-        directory,
-        prepareFile,
-        agentFile,
-        ...(agentConfigDirEnv === undefined ? {} : { agentConfigDirEnv }),
-    };
-}
-/**
- * Copy the agent's minimal credential/config files into the relocated home.
- * Best-effort per file: a missing source (e.g. the user isn't logged into the
- * agent, or has no config) is skipped rather than aborting the launch — the
- * agent then reports its own "not logged in" state, which is the correct signal.
- */
-function seedRelocatedConfigDir(input) {
-    for (const file of input.seedFiles) {
-        const source = path.join(input.sourceDir, file);
-        if (!existsSync(source)) {
-            continue;
-        }
-        copyFileSync(source, path.join(input.relocatedConfigDir, file));
-    }
-}

package/dist/lib/srtPolicy.d.ts

@@ -1,118 +0,0 @@
-/**
- * Generate the srt (Anthropic sandbox-runtime) settings object for a single
- * agent launch. srt is only a sandbox engine — it has no groundcrew- or
- * agent-aware policy of its own — so this module owns the policy ergonomics
- * that safehouse previously supplied via its bundled `.sb` profiles.
- *
- * The shape, in one place:
- *
- * - **Reads** start broad and are clamped: `denyRead` masks the whole home
- *   region (`/Users` on macOS, `/home` + `/root` on Linux) so the agent cannot
- *   read `~/.ssh`, `~/.aws`, shell history, or unrelated repos; `allowRead`
- *   then re-opens exactly the worktree, the repo's git metadata, the language
- *   toolchains needed to *run* the agent, the agent's own config/credential
- *   dirs, and — on macOS, for keychain-authenticated agents (claude) — the user
- *   keychain dir (`~/Library/Keychains`) so the agent can authenticate under
- *   the home mask. srt skips non-existent allow/deny paths, so listing a path
- *   that isn't present (a Linux keychain dir, an uninstalled toolchain) is
- *   harmless.
- * - **Writes** are allow-only in srt. Two STAFF-1305 structural fixes shape it:
- *   1. **Agent state (work item 1).** The host-CLI persistence vector (planting
- *      hooks, `mcpServers`, commands, plugins, … that execute on the user's
- *      next host run) is closed per agent. **claude** runs with a writable
- *      `~/.claude` (its Bash tool creates `session-env`/scratch state there) but
- *      every fixed-path executable/instruction surface — including
- *      `~/.claude.json` (`mcpServers`) and the bundled `chrome` binary — is
- *      denied; claude tolerates those write denials. **codex** hard-fails with a
- *      read-only home, so it is pointed at a relocated, per-launch writable
- *      config dir (`CODEX_HOME`, see {@link agentConfigRelocation}) and its real
- *      `~/.codex` is never write-granted at all. **cursor-agent** keeps a
- *      writable `~/.cursor` (chats/projects/resume) but denies mcp.json,
- *      hooks, rules, skills, plugins, and commands — the host-RCE surfaces.
- *   2. **Git (work item 2).** The git common dir is granted write as a **narrow
- *      allowlist** of exactly the paths `status/diff/add/commit/push/gc` write —
- *      never wholesale — so the per-worktree gitdir redirection files, sibling
- *      worktree gitdirs, and the repo `config`/`hooks` stay unwritable.
- *   `denyWrite` is belt-and-suspenders over global toolchain bins and the agent
- *   homes; it uses **literal paths only** because bubblewrap silently ignores
- *   globs on Linux.
- * - **Network** is allow-only and sourced from the existing clearance
- *   allowlist (see {@link ./clearanceHosts.ts}); local binding and unix sockets
- *   stay off (the docker socket and the DNS-exfil vector in srt#88).
- *
- * `allowPty` is on because the agent runs interactively under tmux;
- * `allowGitConfig` stays off so the agent cannot rewrite `~/.gitconfig` or
- * `.git/config` (both readable, just not writable).
- */
-import { type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
-export interface BuildSrtSettingsInput {
-    /** Absolute worktree directory the agent runs in (read + write). */
-    worktreeDir: string;
-    /**
-     * Absolute path to the repo's git common dir (the parent clone's `.git`).
-     * Granted read wholesale, but write only as a narrow allowlist of the paths
-     * the git workflow actually touches (see `GIT_COMMON_WRITE_PATHS`).
-     */
-    gitCommonDir: string;
-    /** Agent identity (e.g. "claude", "codex") used to pick the credential profile. */
-    agent: string;
-    /** srt `network.allowedDomains`, already translated from the clearance allowlist. */
-    allowedDomains: readonly string[];
-    /**
-     * Absolute path to the agent's relocated, writable config/state home for this
-     * launch (codex's `CODEX_HOME`). When set it is granted read + write so the
-     * agent persists session state there instead of its real home, which stays
-     * read-only. claude does not relocate (its macOS keychain credential is bound
-     * to the default config dir), so this is omitted for it.
-     */
-    relocatedConfigDir?: string;
-    /**
-     * Local task-source directories the worker needs for self-completion
-     * writeback, such as a todo-txt file's parent directory and task prompt dir.
-     */
-    taskSourceWritePaths?: readonly string[];
-    /** Defaults to `process.platform`. Injected in tests to exercise both deny-read roots. */
-    platform?: NodeJS.Platform;
-    /** Defaults to `os.homedir()`. Injected in tests. */
-    homeDir?: string;
-    /** Defaults to `process.execPath`; used to locate the global node_modules to deny writes to. */
-    nodeExecPath?: string;
-    /**
-     * Absolute host dirs re-opened read-only from `config.local.readOnlyDirs`
-     * (toolchains the profile masks but doesn't re-open, e.g. tfenv). srt skips
-     * any that don't exist, so passing an absent path is harmless.
-     */
-    readOnlyDirs?: readonly string[];
-}
-/**
- * How an agent that cannot run with a read-only config home is pointed at a
- * relocated, per-launch writable home instead. The launch stages a temp dir,
- * seeds it with the minimal files the agent needs to authenticate + keep its
- * config, exports `configDirEnv` to that dir, and grants it write — so the real
- * home (which holds the persistence surfaces) is never written.
- *
- * Empirically (STAFF-1305 live validation, macOS): codex hard-fails to launch
- * with a read-only `~/.codex` ("failed to initialize in-process app-server
- * client") and authenticates from a file (`auth.json`), so relocating
- * `CODEX_HOME` + seeding `auth.json`/`config.toml` both unblocks it and closes
- * persistence. claude is deliberately absent: its macOS keychain credential is
- * bound to the default config dir, so relocating `CLAUDE_CONFIG_DIR` breaks
- * auth — claude instead runs with a writable home whose executable surfaces are
- * denied (see `AGENT_SRT_PROFILES`).
- */
-export interface AgentConfigRelocation {
-    /** Env var that points the agent at a relocated config home. */
-    configDirEnv: string;
-    /** Home-relative dir the seed files are copied from (the agent's real home). */
-    sourceHomeRelativeDir: string;
-    /** Files (relative to `sourceHomeRelativeDir`) seeded into the relocated home. */
-    seedFiles: readonly string[];
-}
-/**
- * Return the config-relocation spec for an agent, or `undefined` when the agent
- * runs with a writable real home + deny-list and does not relocate (claude,
- * unknown agents).
- */
-export declare function agentConfigRelocation(agent: string): AgentConfigRelocation | undefined;
-export declare function buildSrtSettings(input: BuildSrtSettingsInput): SandboxRuntimeConfig;
-//# sourceMappingURL=srtPolicy.d.ts.map

package/dist/lib/srtPolicy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"srtPolicy.d.ts","sourceRoot":"","sources":["../../src/lib/srtPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEtF;AAgOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CA0HnF"}