@gethmy/harness 1.4.0 → 1.5.0

package/dist/cli.js

@@ -501,7 +501,6 @@ var init_stageHandoff = __esm(() => {
 
 // ../harmony-shared/dist/types.js
 var init_types = () => {};
-
 // ../harmony-shared/dist/index.js
 var init_dist = __esm(() => {
   init_agentStaleness();
@@ -611,6 +610,492 @@ var init_log = __esm(() => {
   };
 });
 
+// src/confine-to-repo.ts
+import { realpathSync } from "node:fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, parse, resolve as resolve2, sep as sep2 } from "node:path";
+function isGitMetadata(repoRoot, candidate) {
+  const rel = candidate.startsWith(repoRoot) ? candidate.slice(repoRoot.length) : candidate;
+  return rel.split(/[\\/]/).some((segment) => segment.toLowerCase() === ".git");
+}
+function patternEscapes(pattern) {
+  if (isAbsolute2(pattern))
+    return true;
+  if (/[{}[\]~()!+@]/.test(pattern))
+    return true;
+  return pattern.split(/[\\/]/).some((segment) => segment === "..");
+}
+function pathArgsFor(mode) {
+  return mode === "write" ? { ...READ_PATH_ARGS, ...WRITE_PATH_ARGS } : READ_PATH_ARGS;
+}
+function realPathOrNearest(p) {
+  const abs = isAbsolute2(p) ? p : resolve2(p);
+  const { root } = parse(abs);
+  let real = root;
+  for (const part of abs.slice(root.length).split(sep2)) {
+    if (part === "" || part === ".")
+      continue;
+    if (part === "..") {
+      real = dirname2(real);
+      continue;
+    }
+    const next = real.endsWith(sep2) ? real + part : real + sep2 + part;
+    try {
+      real = realpathSync(next);
+    } catch {
+      real = next;
+    }
+  }
+  return real;
+}
+function isInsideTree(root, target) {
+  const normalizedRoot = realPathOrNearest(root);
+  const normalizedTarget = realPathOrNearest(target);
+  if (normalizedTarget === normalizedRoot)
+    return true;
+  return normalizedTarget.startsWith(normalizedRoot + sep2);
+}
+function decideConfinedTool(repoRoot, toolName, input, mode = "read") {
+  const pathArgs = pathArgsFor(mode)[toolName];
+  if (!pathArgs) {
+    return {
+      behavior: "deny",
+      message: `${toolName} is not available to this run.`
+    };
+  }
+  const verb = toolName in WRITE_PATH_ARGS ? "write" : "read";
+  for (const key of PATTERN_ARG_BY_TOOL[toolName] ?? []) {
+    const value = input[key];
+    if (typeof value !== "string" || value.length === 0)
+      continue;
+    if (patternEscapes(value)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} patterns must stay inside the repository — no absolute path and no "..". Refused: ${value}`
+      };
+    }
+  }
+  for (const key of pathArgs) {
+    const value = input[key];
+    if (typeof value !== "string" || value.length === 0)
+      continue;
+    const candidate = isAbsolute2(value) ? value : `${repoRoot}${sep2}${value}`;
+    if (isGitMetadata(repoRoot, candidate)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} may not touch the repository's git metadata. Refused: ${value}`
+      };
+    }
+    if (!isInsideTree(repoRoot, candidate)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} may only ${verb} inside the repository. Refused: ${value}`
+      };
+    }
+  }
+  return { behavior: "allow" };
+}
+function confineToRepo(repoRoot, mode = "read") {
+  return async (toolName, input) => decideConfinedTool(repoRoot, toolName, input, mode);
+}
+var READ_PATH_ARGS, WRITE_PATH_ARGS, CONFINED_READ_TOOLS, CONFINED_WRITE_TOOLS, PATTERN_ARG_BY_TOOL;
+var init_confine_to_repo = __esm(() => {
+  READ_PATH_ARGS = {
+    Read: ["file_path", "path", "notebook_path"],
+    Grep: ["path"],
+    Glob: ["path"]
+  };
+  WRITE_PATH_ARGS = {
+    Write: ["file_path"],
+    Edit: ["file_path"],
+    MultiEdit: ["file_path"],
+    NotebookEdit: ["notebook_path"]
+  };
+  CONFINED_READ_TOOLS = Object.freeze(Object.keys(READ_PATH_ARGS));
+  CONFINED_WRITE_TOOLS = Object.freeze([
+    ...Object.keys(READ_PATH_ARGS),
+    ...Object.keys(WRITE_PATH_ARGS).filter((t) => t !== "MultiEdit")
+  ]);
+  PATTERN_ARG_BY_TOOL = {
+    Glob: ["pattern"],
+    Grep: ["glob"]
+  };
+});
+
+// src/runner.ts
+import { getConfigDir } from "@gethmy/mcp/src/config.js";
+function mayHoldCredentials(role) {
+  return role === "author" || role === "reviewer";
+}
+function credentialReadDeny() {
+  return `Read(/${getConfigDir()}/**)`;
+}
+function credentialAccessDeny() {
+  const dir = `/${getConfigDir()}/**`;
+  return [`Read(${dir})`, `Grep(${dir})`, `Glob(${dir})`];
+}
+function buildRoleLaunch(args) {
+  const role = normalizeStageRole(args.role);
+  const keep = mayHoldCredentials(role);
+  const env = {};
+  for (const [key, value] of Object.entries(args.parentEnv)) {
+    if (value === undefined)
+      continue;
+    if (!keep && HARMONY_CREDENTIAL_KEYS.includes(key))
+      continue;
+    env[key] = value;
+  }
+  return {
+    role,
+    prompt: args.prompt,
+    repoPath: args.repoPath,
+    env,
+    disallowedTools: keep ? [] : [credentialReadDeny()]
+  };
+}
+function envKeysDroppedByLaunch(parentEnv, launch) {
+  return Object.keys(parentEnv).filter((key) => parentEnv[key] !== undefined && !Object.hasOwn(launch.env, key));
+}
+var HARMONY_CREDENTIAL_KEYS;
+var init_runner = __esm(() => {
+  init_dist();
+  HARMONY_CREDENTIAL_KEYS = [
+    "HARMONY_API_KEY",
+    "HARMONY_API_URL",
+    "HARMONY_WORKSPACE_ID",
+    "SUPABASE_ANON_KEY",
+    "SUPABASE_SERVICE_ROLE_KEY",
+    "SUPABASE_URL"
+  ];
+});
+
+// src/run-containment.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { homedir, tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join2 } from "node:path";
+import { getConfigDir as getConfigDir2 } from "@gethmy/mcp/src/config.js";
+function credentialDirectories() {
+  const home = homedir();
+  return [
+    getConfigDir2(),
+    join2(home, ".claude"),
+    join2(home, ".claude.json"),
+    join2(home, ".ssh"),
+    join2(home, ".gnupg"),
+    join2(home, ".aws"),
+    join2(home, ".codex"),
+    join2(home, ".gemini"),
+    join2(home, ".config", "gh"),
+    join2(home, ".config", "gcloud"),
+    join2(home, ".config", "anthropic"),
+    join2(home, ".config", "op"),
+    join2(home, ".docker"),
+    join2(home, ".kube"),
+    join2(home, ".netrc"),
+    join2(home, ".npmrc"),
+    join2(home, ".git-credentials")
+  ];
+}
+function writeOnlyDenyPaths() {
+  const paths = [join2(homedir(), ".gitconfig")];
+  const xdg = process.env.XDG_CONFIG_HOME;
+  paths.push(xdg && isAbsolute3(xdg) ? join2(xdg, "git") : join2(homedir(), ".config", "git"));
+  return paths;
+}
+function credentialToolDeny() {
+  return credentialDirectories().flatMap((dir) => [
+    `Read(/${dir})`,
+    `Read(/${dir}/**)`
+  ]);
+}
+function toolchainCacheDirectories(worktree) {
+  const home = homedir();
+  const scratch = `harmony-run-${createHash2("sha256").update(worktree).digest("hex").slice(0, 16)}`;
+  const candidate = process.env.TMPDIR ?? tmpdir2();
+  const tmpRoot = isAbsolute3(candidate) ? candidate : "/tmp";
+  return [
+    join2(home, ".bun", "install", "cache"),
+    join2(home, ".npm", "_cacache"),
+    join2(tmpRoot, scratch)
+  ];
+}
+function secretEnvKeysToStrip(parentEnv = process.env) {
+  const stripped = new Set(HARMONY_CREDENTIAL_KEYS);
+  for (const key of Object.keys(parentEnv)) {
+    if (KEEP_ENV_KEYS.has(key))
+      continue;
+    if (SECRET_ENV_PATTERN.test(key))
+      stripped.add(key);
+  }
+  return [...stripped];
+}
+function assertNoProjectSandboxOverride(worktree) {
+  for (const name of ["settings.json", "settings.local.json"]) {
+    const path = join2(worktree, ".claude", name);
+    let raw;
+    try {
+      raw = readFileSync2(path, "utf-8");
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (parsed === null || typeof parsed !== "object")
+      continue;
+    const offending = Object.keys(parsed).filter((key) => !INERT_PROJECT_SETTING_KEYS.has(key));
+    if (offending.length > 0) {
+      throw new ProjectSandboxOverrideError(path, offending);
+    }
+  }
+}
+function containedEnv(parentEnv = process.env) {
+  const strip = new Set(secretEnvKeysToStrip(parentEnv));
+  const out = {};
+  for (const [key, value] of Object.entries(parentEnv)) {
+    if (value === undefined || strip.has(key))
+      continue;
+    out[key] = value;
+  }
+  return out;
+}
+function gitMetadataDenyPaths(worktree) {
+  const paths = new Set;
+  const dotGit = join2(worktree, ".git");
+  const require2 = createRequire2(import.meta.url);
+  const { execFileSync } = require2("node:child_process");
+  const { statSync: statSync2 } = require2("node:fs");
+  const gitDirs = new Set;
+  try {
+    const out = execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "--git-dir", "--git-common-dir"], { cwd: worktree, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    for (const line of out.split(`
+`)) {
+      const trimmed = line.trim();
+      if (!trimmed)
+        continue;
+      gitDirs.add(isAbsolute3(trimmed) ? trimmed : join2(worktree, trimmed));
+    }
+  } catch {}
+  gitDirs.add(dotGit);
+  for (const dir of gitDirs) {
+    paths.add(join2(dir, "config"));
+    paths.add(join2(dir, "config.worktree"));
+    paths.add(join2(dir, "hooks"));
+  }
+  try {
+    if (statSync2(dotGit).isFile())
+      paths.add(dotGit);
+  } catch {}
+  return [...paths];
+}
+function hostPersistencePaths() {
+  const home = homedir();
+  return [
+    join2(home, ".zshenv"),
+    join2(home, ".zprofile"),
+    join2(home, ".zshrc"),
+    join2(home, ".zlogin"),
+    join2(home, ".bashrc"),
+    join2(home, ".bash_profile"),
+    join2(home, ".bash_login"),
+    join2(home, ".profile"),
+    join2(home, ".config", "fish", "config.fish"),
+    join2(home, ".config", "fish", "conf.d"),
+    join2(home, "Library", "LaunchAgents"),
+    join2(home, ".config", "systemd", "user"),
+    join2(home, ".config", "autostart")
+  ];
+}
+function credentialWriteToolDeny(worktree) {
+  return [
+    ...credentialDirectories(),
+    ...writeOnlyDenyPaths(),
+    ...hostPersistencePaths(),
+    ...gitMetadataDenyPaths(worktree)
+  ].flatMap((p) => [`Edit(/${p})`, `Edit(/${p}/**)`]);
+}
+function implementRunToolPolicy(args) {
+  const writable = [args.worktree, ...toolchainCacheDirectories(args.worktree)];
+  const gitMeta = gitMetadataDenyPaths(args.worktree);
+  const secrets = credentialDirectories();
+  return async (toolName, input) => {
+    const allow = { behavior: "allow", updatedInput: input };
+    const deny = (message) => ({ behavior: "deny", message });
+    if (toolName.startsWith("mcp__"))
+      return allow;
+    if (toolName === "Bash" || toolName === "BashOutput") {
+      return allow;
+    }
+    const writePaths = WRITE_TOOL_PATHS[toolName];
+    if (writePaths) {
+      if (args.readOnly === true) {
+        return deny(`${toolName} is not available to a review run.`);
+      }
+      for (const key of writePaths) {
+        const value = input[key];
+        if (typeof value !== "string" || value.length === 0)
+          continue;
+        const target = isAbsolute3(value) ? value : join2(args.worktree, value);
+        if (gitMeta.some((p) => isInsideTree(p, target) || p === target)) {
+          return deny(`${toolName} may not touch git metadata. Refused: ${value}`);
+        }
+        if (!writable.some((root) => isInsideTree(root, target))) {
+          return deny(`${toolName} may only write inside this run's worktree. Refused: ${value}`);
+        }
+      }
+      return allow;
+    }
+    const readPaths = READ_TOOL_PATHS[toolName];
+    if (readPaths) {
+      for (const key of readPaths) {
+        const value = input[key];
+        if (typeof value !== "string" || value.length === 0)
+          continue;
+        const target = isAbsolute3(value) ? value : join2(args.worktree, value);
+        if (secrets.some((dir) => isInsideTree(dir, target))) {
+          return deny(`${toolName} may not read the credential directories. Refused: ${value}`);
+        }
+      }
+      return allow;
+    }
+    return allow;
+  };
+}
+function harmonyMcpServer() {
+  const require2 = createRequire2(import.meta.url);
+  const cli = join2(dirname3(require2.resolve("@gethmy/mcp")), "cli.js");
+  return {
+    harmony: {
+      type: "stdio",
+      command: process.execPath,
+      args: [cli, "serve"]
+    }
+  };
+}
+function implementRunContainment(args) {
+  assertNoProjectSandboxOverride(args.worktree);
+  return {
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      autoAllowBashIfSandboxed: args.readOnly !== true,
+      network: {
+        allowedDomains: [...IMPLEMENT_ALLOWED_DOMAINS],
+        allowLocalBinding: false
+      },
+      filesystem: {
+        allowWrite: [
+          args.worktree,
+          ...toolchainCacheDirectories(args.worktree)
+        ],
+        denyRead: credentialDirectories(),
+        denyWrite: [
+          ...credentialDirectories(),
+          ...writeOnlyDenyPaths(),
+          ...hostPersistencePaths(),
+          ...gitMetadataDenyPaths(args.worktree)
+        ]
+      }
+    },
+    canUseTool: implementRunToolPolicy(args),
+    gateEveryToolCall: true,
+    settingSources: args.readOnly === true ? [] : ["project"],
+    mcpServers: harmonyMcpServer(),
+    strictMcpConfig: true,
+    stripEnvKeys: secretEnvKeysToStrip(),
+    disallowedTools: [
+      ...args.extraDisallowedTools ?? [],
+      ...credentialToolDeny(),
+      ...credentialWriteToolDeny(args.worktree)
+    ]
+  };
+}
+function implementRunContainmentCliArgs(args) {
+  const containment = implementRunContainment(args);
+  return [
+    "--settings",
+    JSON.stringify({ sandbox: containment.sandbox }),
+    "--setting-sources",
+    containment.settingSources.join(","),
+    "--mcp-config",
+    JSON.stringify({ mcpServers: containment.mcpServers }),
+    "--strict-mcp-config",
+    "--disallowedTools",
+    containment.disallowedTools.join(",")
+  ];
+}
+var SECRET_ENV_PATTERN, KEEP_ENV_KEYS, ProjectSandboxOverrideError, INERT_PROJECT_SETTING_KEYS, WRITE_TOOL_PATHS, READ_TOOL_PATHS, GIT_NO_HOOKS, IMPLEMENT_ALLOWED_DOMAINS;
+var init_run_containment = __esm(() => {
+  init_confine_to_repo();
+  init_runner();
+  SECRET_ENV_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_?KEY|_PAT$|^PAT_|PRIVATE_KEY|ACCESS_KEY)/i;
+  KEEP_ENV_KEYS = new Set([
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "SSH_AUTH_SOCK",
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL",
+    "XAUTHORITY"
+  ]);
+  ProjectSandboxOverrideError = class ProjectSandboxOverrideError extends Error {
+    settingsPath;
+    offendingKeys;
+    constructor(settingsPath, offendingKeys) {
+      super(`Refusing to spawn: ${settingsPath} sets ${offendingKeys.map((k) => `"${k}"`).join(", ")}. ` + "Project settings are loaded so the run can read CLAUDE.md, and that same layer " + "can widen the sandbox (`sandbox.filesystem.allowWrite`) or execute commands " + "outside it (`hooks`, `env`). A run that can write this file could therefore " + "widen its own bounds, so only keys known not to affect execution are accepted. " + "Remove the key, or the run stays refused.");
+      this.settingsPath = settingsPath;
+      this.offendingKeys = offendingKeys;
+      this.name = "ProjectSandboxOverrideError";
+    }
+  };
+  INERT_PROJECT_SETTING_KEYS = new Set([
+    "$schema",
+    "cleanupPeriodDays",
+    "includeCoAuthoredBy",
+    "language",
+    "outputStyle",
+    "spinnerTipsEnabled",
+    "theme",
+    "verbose"
+  ]);
+  WRITE_TOOL_PATHS = {
+    Write: ["file_path"],
+    Edit: ["file_path"],
+    MultiEdit: ["file_path"],
+    NotebookEdit: ["notebook_path"]
+  };
+  READ_TOOL_PATHS = {
+    Read: ["file_path", "path", "notebook_path"],
+    Grep: ["path"],
+    Glob: ["path"]
+  };
+  GIT_NO_HOOKS = [
+    "-c",
+    "core.hooksPath=",
+    "-c",
+    "core.fsmonitor=",
+    "-c",
+    "core.pager=cat"
+  ];
+  IMPLEMENT_ALLOWED_DOMAINS = [
+    "api.anthropic.com",
+    "*.anthropic.com",
+    "registry.npmjs.org",
+    "*.npmjs.org",
+    "github.com",
+    "*.github.com",
+    "*.githubusercontent.com"
+  ];
+});
+
 // src/cli.ts
 init_dist();
 
@@ -896,6 +1381,7 @@ class SdkAgentRunner {
       ...this.cfg.settingSources ? { settingSources: this.cfg.settingSources } : {},
       ...this.cfg.mcpServers ? { mcpServers: this.cfg.mcpServers } : {},
       ...this.cfg.strictMcpConfig ? { strictMcpConfig: true } : {},
+      ...this.cfg.sandbox ? { sandbox: this.cfg.sandbox } : {},
       stderr: (data) => {
         this.capturedStderr += data;
       },
@@ -2035,6 +2521,7 @@ import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_proce
 
 // src/pm.ts
 init_log();
+init_run_containment();
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 var TAG6 = "pm";
@@ -2044,7 +2531,7 @@ function detectPackageManager() {
     return cached;
   let repoRoot;
   try {
-    repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+    repoRoot = execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"], {
       encoding: "utf-8"
     }).trim();
   } catch {
@@ -2087,7 +2574,7 @@ function spawnRunArgs(script, ...extra) {
 // src/project-type.ts
 init_log();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "node:fs";
 var TAG7 = "project-type";
 var _cache = new Map;
 function _resetCache() {
@@ -2190,7 +2677,7 @@ var NPM_PLACEHOLDER_TEST = /no test specified/i;
 function hasNodeTestScript(dir) {
   let script;
   try {
-    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync3(`${dir}/package.json`, "utf-8"));
     script = pkg.scripts?.test;
   } catch (err) {
     log.warn(TAG7, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
@@ -2207,7 +2694,7 @@ function hasNodeTestScript(dir) {
 function firstNodeScript(dir, candidates) {
   let scripts;
   try {
-    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync3(`${dir}/package.json`, "utf-8"));
     scripts = pkg.scripts ?? {};
   } catch (err) {
     log.warn(TAG7, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
@@ -2264,6 +2751,7 @@ function resolveXcodeScheme(pt) {
 
 // src/revert-guard.ts
 init_log();
+init_run_containment();
 import { execFileSync as execFileSync3 } from "node:child_process";
 var TAG8 = "revert-guard";
 var TEST_FILE = /(?:^|\/)__tests__\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
@@ -2275,7 +2763,7 @@ function filterTestFiles(paths) {
 }
 function refetchBase(worktreePath, baseBranch) {
   try {
-    execFileSync3("git", ["fetch", "origin", baseBranch], {
+    execFileSync3("git", [...GIT_NO_HOOKS, "fetch", "origin", baseBranch], {
       cwd: worktreePath,
       stdio: "pipe"
     });
@@ -2285,7 +2773,13 @@ function refetchBase(worktreePath, baseBranch) {
 }
 function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
   try {
-    const out = execFileSync3("git", ["diff", "--diff-filter=D", "--name-only", `origin/${baseBranch}...HEAD`], { cwd: worktreePath, encoding: "utf-8" });
+    const out = execFileSync3("git", [
+      ...GIT_NO_HOOKS,
+      "diff",
+      "--diff-filter=D",
+      "--name-only",
+      `origin/${baseBranch}...HEAD`
+    ], { cwd: worktreePath, encoding: "utf-8" });
     return out.split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0);
   } catch (err) {
@@ -2299,6 +2793,7 @@ function findDeletedTestFiles(worktreePath, baseBranch) {
 }
 
 // src/verification.ts
+init_run_containment();
 var TAG9 = "verification";
 var MAX_OUTPUT_BUFFER2 = 64 * 1024 * 1024;
 async function runVerification(worktreePath, config, workerId) {
@@ -2372,7 +2867,8 @@ function runBuild(worktreePath, timeout) {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER2,
+      env: containedEnv()
     });
     return [];
   } catch (err) {
@@ -2390,7 +2886,8 @@ function runTests(worktreePath, timeout) {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER2,
+      env: containedEnv()
     });
     return [];
   } catch (err) {
@@ -2409,7 +2906,8 @@ function runFormatFix(worktreePath, timeout, workerId) {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER2,
+      env: containedEnv()
     });
     log.info(TAG9, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
   } catch (err) {
@@ -2427,7 +2925,8 @@ function runLint(worktreePath, timeout) {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER2,
+      env: containedEnv()
     });
     return [];
   } catch (err) {
@@ -2445,7 +2944,8 @@ async function runDeepReview(worktreePath, config, workerId) {
     const [cmd, args] = spawnRunArgs("dev", "--port", String(port));
     devServer = spawn2(cmd, args, {
       cwd: worktreePath,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      env: containedEnv()
     });
     try {
       await waitForDevServer(devServer, 30000);
@@ -2456,7 +2956,7 @@ async function runDeepReview(worktreePath, config, workerId) {
     }
     let diff = "";
     try {
-      diff = execFileSync4("git", ["diff", `origin/${config.worktree.baseBranch}..HEAD`], {
+      diff = execFileSync4("git", [...GIT_NO_HOOKS, "diff", `origin/${config.worktree.baseBranch}..HEAD`], {
         cwd: worktreePath,
         encoding: "utf-8",
         timeout: 30000,
@@ -2477,14 +2977,16 @@ async function runDeepReview(worktreePath, config, workerId) {
       "```"
     ].join(`
 `);
-    const leanSources = config.claude.leanSettingSources;
     const output = execFileSync4("claude", [
       "--print",
       "--model",
       "sonnet",
       "--max-turns",
       "10",
-      ...leanSources ? ["--setting-sources", leanSources] : [],
+      ...implementRunContainmentCliArgs({
+        worktree: worktreePath,
+        readOnly: true
+      }),
       "--",
       reviewPrompt
     ], {
@@ -2492,7 +2994,8 @@ async function runDeepReview(worktreePath, config, workerId) {
       encoding: "utf-8",
       timeout: config.verification.timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER2,
+      env: containedEnv()
     });
     return parseReviewFindings(output);
   } catch (err) {
@@ -2522,7 +3025,6 @@ function attemptAutoFix(worktreePath, config, errors) {
     "```"
   ].join(`
 `);
-  const leanSources = config.claude.leanSettingSources;
   const args = [
     "--print",
     "--model",
@@ -2531,7 +3033,7 @@ function attemptAutoFix(worktreePath, config, errors) {
     "50",
     "--allowedTools",
     "Bash,Read,Write,Edit,Glob,Grep",
-    ...leanSources ? ["--setting-sources", leanSources] : [],
+    ...implementRunContainmentCliArgs({ worktree: worktreePath }),
     "--",
     fixPrompt
   ];
@@ -2540,7 +3042,8 @@ function attemptAutoFix(worktreePath, config, errors) {
     cwd: worktreePath,
     timeout: config.verification.timeout,
     stdio: "pipe",
-    maxBuffer: MAX_OUTPUT_BUFFER2
+    maxBuffer: MAX_OUTPUT_BUFFER2,
+    env: containedEnv()
   });
 }
 async function reportFindings(client, cardId, result, recovery) {
@@ -2641,7 +3144,7 @@ class DevServerReadinessError extends Error {
   }
 }
 function waitForDevServer(proc, timeout) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const cleanup = () => {
       proc.stdout?.off("data", onData);
@@ -2655,7 +3158,7 @@ function waitForDevServer(proc, timeout) {
         return;
       settled = true;
       cleanup();
-      resolve2();
+      resolve3();
     };
     const settleReject = (err) => {
       if (settled)
@@ -3009,52 +3512,7 @@ function relayAgentEvent(draft) {
 
 // src/stage-cli.ts
 init_dist();
-
-// src/runner.ts
-init_dist();
-import { getConfigDir } from "@gethmy/mcp/src/config.js";
-var HARMONY_CREDENTIAL_KEYS = [
-  "HARMONY_API_KEY",
-  "HARMONY_API_URL",
-  "HARMONY_WORKSPACE_ID",
-  "SUPABASE_ANON_KEY",
-  "SUPABASE_SERVICE_ROLE_KEY",
-  "SUPABASE_URL"
-];
-function mayHoldCredentials(role) {
-  return role === "author" || role === "reviewer";
-}
-function credentialReadDeny() {
-  return `Read(/${getConfigDir()}/**)`;
-}
-function credentialAccessDeny() {
-  const dir = `/${getConfigDir()}/**`;
-  return [`Read(${dir})`, `Grep(${dir})`, `Glob(${dir})`];
-}
-function buildRoleLaunch(args) {
-  const role = normalizeStageRole(args.role);
-  const keep = mayHoldCredentials(role);
-  const env = {};
-  for (const [key, value] of Object.entries(args.parentEnv)) {
-    if (value === undefined)
-      continue;
-    if (!keep && HARMONY_CREDENTIAL_KEYS.includes(key))
-      continue;
-    env[key] = value;
-  }
-  return {
-    role,
-    prompt: args.prompt,
-    repoPath: args.repoPath,
-    env,
-    disallowedTools: keep ? [] : [credentialReadDeny()]
-  };
-}
-function envKeysDroppedByLaunch(parentEnv, launch) {
-  return Object.keys(parentEnv).filter((key) => parentEnv[key] !== undefined && !Object.hasOwn(launch.env, key));
-}
-
-// src/stage-cli.ts
+init_runner();
 var STAGE_RUN_USAGE = "usage: harmony-harness stage run --card <id> --stage <id> --workspace <id> --repo <path> --session <id> [--metrics <json-path>]";
 function readFlag(argv, name) {
   const index = argv.indexOf(`--${name}`);
@@ -3340,8 +3798,8 @@ ${STAGE_RUN_USAGE}
   const { cardId, stageId, workspaceId, repoPath, sessionId, metricsPath } = parsed.args;
   let driverMetrics = {};
   if (metricsPath !== null) {
-    const { readFileSync: readFileSync3 } = await import("node:fs");
-    driverMetrics = parseMetricsAllowlist(readFileSync3(metricsPath, "utf8"), metricsPath);
+    const { readFileSync: readFileSync4 } = await import("node:fs");
+    driverMetrics = parseMetricsAllowlist(readFileSync4(metricsPath, "utf8"), metricsPath);
   }
   const client = new HarmonyClient(readClientConfig(process.env));
   const card = await client.fetchStageCard(cardId);