@divance/rrr 0.1.0 → 0.1.1

package/README.md

@@ -4,12 +4,19 @@ Runs AI agents, records each run and its handoff on an rrrrr server, and fires p
 
 ```bash
 npm i -g @divance/rrr
-rrr login                       # paste a runner token; the hosted server is the default
+rrr login                       # paste a runner token (minted with your pops' secrets); the hosted server is the default
 rrr agent list --config <config repo>
 rrr run <agent> --origin <ref>  # or --chain <ch_id> to continue a chain
 ```
 
 `RRR_SERVER` / `--server` point at another server, `RRR_TOKEN` overrides the saved token, `RRR_CONFIG` sets the config repo.
+In CI, pass the token only as `RRR_TOKEN` and don't `rrr login` (no credentials file). The agent runs in a temp
+dir with an env allowlist. Read and sandboxed Bash are denied `~/.config/rrr`, rrr's cwd and your shell
+startup files (`~/.bashrc`, `~/.bash_profile`, `~/.bash_login`, `~/.profile`, `~/.zshrc`, `~/.zshenv`, `~/.zprofile`,
+`~/.zlogin`), and `RRR_TOKEN` is unset in Bash. Other variables your shell rc exports still reach Bash. MCP servers in
+run.yaml run outside the sandbox with your file access (trusted config). Where Claude's sandbox can't start
+(e.g. no bubblewrap), Bash is not sandboxed and only the Read rules hold. The real boundary is a container
+([design](https://github.com/divanc/rrrrr/blob/main/docs/design.md#harness)).
 The CLI is one bundled file (`dist/rrr.js`); it needs Node 22+ and Claude Code on PATH.
 
 Design: https://github.com/divanc/rrrrr/blob/main/docs/design.md

package/dist/rrr.js

@@ -15623,8 +15623,8 @@ var program = new Command;
 
 // src/domain/run/index.ts
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync5, mkdtempSync, readFileSync as readFileSync4, writeFileSync } from "node:fs";
-import { hostname, tmpdir, userInfo } from "node:os";
+import { existsSync as existsSync5, mkdtempSync, readFileSync as readFileSync4, realpathSync, writeFileSync } from "node:fs";
+import { homedir, hostname, tmpdir, userInfo } from "node:os";
 import { join as join5 } from "node:path";
 // ../shared/src/ids.ts
 var ID_RE = /^(ch|rn|tk)_[0-9a-hjkmnp-tv-z]{10}$/;
@@ -15688,7 +15688,7 @@ function validateHandoff(handoff, agentSchema) {
 }
 // src/config.ts
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join, relative, sep } from "node:path";
 
 // ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -15764,10 +15764,17 @@ function envWithoutToken() {
   delete env.RRR_TOKEN;
   return env;
 }
+function isInside(dir, root) {
+  const path2 = relative(root, dir);
+  return path2 === "" || path2.split(sep)[0] !== ".." && !isAbsolute(path2);
+}
+function pickEnv(names) {
+  return Object.fromEntries(names.filter((name) => process.env[name] !== undefined).map((name) => [name, process.env[name]]));
+}
 
 // src/domain/agent/index.ts
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join2, relative } from "node:path";
+import { join as join2, relative as relative2 } from "node:path";
 var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 function list(configDir) {
   return names(configDir).map((name) => {
@@ -15785,7 +15792,7 @@ function names(configDir) {
   const found = [];
   for (const entry of readdirSync(root, { recursive: true, withFileTypes: true })) {
     if (entry.isFile() && entry.name === "run.yaml") {
-      found.push(relative(root, entry.parentPath));
+      found.push(relative2(root, entry.parentPath));
     }
   }
   return found.sort();
@@ -15816,6 +15823,10 @@ function load(configDir, agentName) {
     throw problem("mcp", "a list of server names");
   if (settings.tools !== undefined && !isStringList(settings.tools))
     throw problem("tools", "a list of tool names");
+  if (settings.env !== undefined && !isStringList(settings.env))
+    throw problem("env", "a list of env var names");
+  if (settings.env?.includes("RRR_TOKEN"))
+    throw problem("env", "without RRR_TOKEN (the agent never gets the runner token)");
   const promptFile = join2(dir, "prompt.md");
   if (!existsSync2(promptFile))
     throw new Error(`${name}: missing ${promptFile}`);
@@ -15833,6 +15844,7 @@ function load(configDir, agentName) {
     timeoutMs: parseDuration(settings.timeout),
     mcp,
     tools: settings.tools ?? [],
+    env: settings.env ?? [],
     promptFile,
     schema: schema2,
     mcpConfig: agentMcpConfig(configDir, name, mcp)
@@ -16165,7 +16177,11 @@ async function execute(deps, agentName, options) {
   const agent = load(options.configDir, agentName);
   if (options.pop)
     checkConfig(options.configDir);
-  const dir = mkdtempSync(join5(tmpdir(), "rrr-"));
+  const denyRead = deniedCwd();
+  if (denyRead.length > 0 && isInside(realpathSync(tmpdir()), denyRead[0])) {
+    throw new Error(`the temp dir ${tmpdir()} is inside the current directory, which the agent may not read: set TMPDIR outside it`);
+  }
+  const dir = realpathSync(mkdtempSync(join5(tmpdir(), "rrr-")));
   let mcpConfigFile;
   if (agent.mcpConfig) {
     mcpConfigFile = join5(dir, "mcp.json");
@@ -16186,6 +16202,7 @@ async function execute(deps, agentName, options) {
     agent,
     mode: options.interactive ? "interactive" : agent.mode,
     dir,
+    denyRead,
     handoffPath: join5(dir, "handoff.json"),
     mcpConfigFile,
     runId: start.run_id,
@@ -16213,8 +16230,9 @@ async function startAndStream(deps, run) {
     tools: agent.tools,
     mcp: agent.mcp,
     mcpConfigFile: run.mcpConfigFile,
-    handoffDir: run.dir,
-    env: { ...envWithoutToken(), RRR_HANDOFF: handoffPath, RRR_RUN_ID: run.runId, RRR_CHAIN_ID: run.chainId },
+    cwd: run.dir,
+    denyRead: run.denyRead,
+    env: { ...pickEnv(agent.env), RRR_HANDOFF: handoffPath, RRR_RUN_ID: run.runId, RRR_CHAIN_ID: run.chainId },
     timeoutMs: mode === "headless" ? agent.timeoutMs : undefined
   };
   const events = createUploader(deps.sdk, run.runId, deps.log);
@@ -16308,6 +16326,10 @@ async function ignoringSignals(fn, onSignal = () => {}) {
 function describe(handoff) {
   return handoff.status === "done" ? `done/${handoff.decision}` : "blocked";
 }
+function deniedCwd() {
+  const cwd = process.cwd();
+  return isInside(realpathSync(homedir()), cwd) ? [] : [cwd];
+}
 function gitSha(dir) {
   try {
     return execFileSync("git", ["-C", dir, "rev-parse", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -16328,12 +16350,12 @@ import { createInterface } from "node:readline";
 
 // src/harness/transcript.ts
 import { existsSync as existsSync6, openSync, readSync, closeSync, readdirSync as readdirSync3, statSync } from "node:fs";
-import { homedir } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join as join6 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { setTimeout as sleep } from "node:timers/promises";
 function projectsDir() {
-  return join6(process.env.CLAUDE_CONFIG_DIR ?? join6(homedir(), ".claude"), "projects");
+  return join6(process.env.CLAUDE_CONFIG_DIR ?? join6(homedir2(), ".claude"), "projects");
 }
 function projectSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
@@ -16393,6 +16415,23 @@ async function* tailTranscript(cwd, sessionId, startOffset, isDone) {
 function claudeBin() {
   return process.env.RRR_CLAUDE_BIN ?? "claude";
 }
+var CLAUDE_ENV = [
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "TMPDIR",
+  "CLAUDE_CONFIG_DIR",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "CLAUDE_CODE_OAUTH_TOKEN"
+];
+function claudeEnv(options) {
+  return { ...pickEnv(CLAUDE_ENV), ...options.env };
+}
 function claudeArgs(options) {
   const tools = options.mcp.length > 0 && !options.tools.includes("ToolSearch") ? [...options.tools, "ToolSearch"] : options.tools;
   const args = ["--setting-sources", "", "--tools", tools.join(","), "--append-system-prompt-file", options.promptFile];
@@ -16407,9 +16446,27 @@ function claudeArgs(options) {
   const allowed = [...tools, ...options.mcp.map((name) => `mcp__${name}`)];
   if (allowed.length > 0)
     args.push("--allowedTools", allowed.join(","));
-  args.push("--add-dir", options.handoffDir);
+  args.push("--settings", claudeSettings(options));
   return args;
 }
+var SHELL_STARTUP_FILES = ["~/.bashrc", "~/.bash_profile", "~/.bash_login", "~/.profile", "~/.zshrc", "~/.zshenv", "~/.zprofile", "~/.zlogin"];
+function claudeSettings(options) {
+  const deny = [
+    "Read(~/.config/rrr/**)",
+    ...SHELL_STARTUP_FILES.map((file) => `Read(${file})`),
+    ...options.denyRead.map((dir) => `Read(/${dir.replace(/[\\*?[\]]/g, "\\$&")}/**)`)
+  ];
+  return JSON.stringify({
+    permissions: { deny },
+    sandbox: {
+      enabled: true,
+      allowUnsandboxedCommands: false,
+      filesystem: { denyRead: options.denyRead },
+      credentials: { envVars: [{ name: "RRR_TOKEN", mode: "deny" }] },
+      network: { allowedDomains: ["*"] }
+    }
+  });
+}
 function headlessArgs(options) {
   return ["-p", "--output-format", "stream-json", "--verbose", ...claudeArgs(options)];
 }
@@ -16425,7 +16482,7 @@ var claudeCode = {
   }
 };
 function startHeadless(options) {
-  const { child, exit, stop } = spawnGroup(claudeBin(), headlessArgs(options), { env: options.env, stdio: ["pipe", "pipe", "inherit"] }, options.timeoutMs);
+  const { child, exit, stop } = spawnGroup(claudeBin(), headlessArgs(options), { cwd: options.cwd, env: claudeEnv(options), stdio: ["pipe", "pipe", "inherit"] }, options.timeoutMs);
   child.stdin.on("error", () => {});
   child.stdin.end(options.message);
   const lines = createInterface({ input: child.stdout });
@@ -16436,8 +16493,8 @@ function startHeadless(options) {
   return { lines, exit: exited, stop };
 }
 function startInteractive(sessionId, args, options) {
-  const startOffset = fileSize(findTranscript(process.cwd(), sessionId));
-  const child = spawn2(claudeBin(), args, { env: options.env, stdio: "inherit" });
+  const startOffset = fileSize(findTranscript(options.cwd, sessionId));
+  const child = spawn2(claudeBin(), args, { cwd: options.cwd, env: claudeEnv(options), stdio: "inherit" });
   let exited = false;
   const exit = new Promise((resolve2) => {
     child.on("error", (error) => {
@@ -16449,7 +16506,7 @@ function startInteractive(sessionId, args, options) {
       resolve2({ code });
     });
   });
-  const lines = tailTranscript(process.cwd(), sessionId, startOffset, () => exited);
+  const lines = tailTranscript(options.cwd, sessionId, startOffset, () => exited);
   return { sessionId, lines, exit, stop: () => child.kill("SIGTERM") };
 }
 // ../sdk/src/index.ts
@@ -16497,11 +16554,11 @@ function createRunnerSdk(options) {
 
 // src/cli/credentials.ts
 import { chmodSync, existsSync as existsSync7, mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { dirname, join as join7 } from "node:path";
 var DEFAULT_SERVER = "https://rrrrr.me-4de.workers.dev";
 function credentialsFile() {
-  return join7(process.env.HOME || homedir2(), ".config", "rrr", "credentials.json");
+  return join7(process.env.HOME || homedir3(), ".config", "rrr", "credentials.json");
 }
 function loadCredentials() {
   const file = credentialsFile();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@divance/rrr",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "rrr: run AI agents, record their runs and handoffs, fire pops",
   "license": "UNLICENSED",
   "type": "module",