@join-pantheon/cli 0.29.1 → 0.30.0

package/dist/agents.js

@@ -6,6 +6,7 @@ import { join, dirname, isAbsolute } from "node:path";
 import { launcher, kiroDir } from "./install.js";
 import { agentSpawn, which } from "./which.js";
 import { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
+import { claudeRunSettings, NO_CLAUDE_FEATURES, runTmpDir, sandboxCacheEnv } from "./claude-confine.js";
 export function launchArgs(agent, prompt, name) {
     if (agent === "claude-code")
         return ["--name", name, prompt];
@@ -109,8 +110,9 @@ export function resolveBinary(backend) {
             }
             binaryCache.set(b, found);
         }
-        if (binaryCache.get(b))
-            return b;
+        const hit = binaryCache.get(b);
+        if (hit)
+            return hit;
     }
     return null;
 }
@@ -250,25 +252,159 @@ export function resolveAgent(preferred) {
     return { backend: c.backend, binary: c.binary };
 }
 export { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
+export const COMMAND_ALLOWLIST = [
+    ...["status", "diff", "log", "show", "add", "rm", "mv", "commit", "push", "fetch", "checkout", "switch", "restore",
+        "branch", "rev-parse", "ls-files", "stash list", "stash show", "blame", "merge-base", "reset"].map((c) => `git ${c}`),
+    "npm test", "npm run", "npm ci", "pnpm test", "pnpm run", "yarn test", "yarn run", "bun test", "bun run",
+    "make", "cargo build", "cargo test", "cargo check", "go build", "go test", "go vet",
+    "pytest", "python -m pytest", "python3 -m pytest", "mvn", "gradle", "./gradlew", "dotnet build", "dotnet test",
+];
+export const COMMAND_EXACT = ["npm install", "pnpm install", "yarn install", "bun install"];
+export const claudeCommandRules = (extra = []) => [
+    ...COMMAND_ALLOWLIST.map((c) => `Bash(${c} *)`),
+    ...COMMAND_EXACT.map((c) => `Bash(${c})`),
+    ...extra.map((c) => `Bash(${c} *)`),
+];
+export const REPO_COMMANDS_FILE = ".pantheon/commands";
+const RUNS_ANYTHING = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "csh", "tcsh", "ash", "busybox", "pwsh", "powershell", "cmd",
+    "env", "eval", "exec", "sudo", "su", "doas", "pkexec", "runuser", "xargs", "nohup", "time", "command", "builtin", "source", ".", "nice", "timeout", "watch",
+    "setsid", "stdbuf", "ionice", "flock", "chroot", "unshare", "nsenter", "script", "unbuffer", "strace", "ltrace",
+    "ssh", "scp", "curl", "wget", "nc", "ncat", "socat", "osascript", "open", "launchctl", "systemctl", "crontab", "chmod", "chown", "rm",
+    "direnv", "devbox", "mise", "asdf", "nix", "nix-shell", "wsl", "start", "rundll32", "mshta", "wscript", "cscript",
+    "find", "awk", "gawk", "mawk", "nawk", "sed", "gsed", "parallel", "cross-env", "concurrently", "npm-run-all", "run-p", "run-s", "nodemon", "watchexec", "entr",
+    "hyperfine", "tmux", "screen", "gdb", "lldb", "expect", "nu", "xonsh", "mksh", "yash", "elvish", "rc", "oksh", "posh",
+    "winpty", "mintty", "wt", "conhost", "git-bash", "schtasks", "runas", "forfiles", "powershell_ise", "vim", "vi", "nvim", "emacs", "less", "more", "man"]);
+const VERSIONED_SHELL = /^(?:ba|z|k|c|tc|da|a|fi|mk)?sh[-.\d]*$|^fish[-.\d]+$|^pwsh[-.\d]+$/;
+const GIT_SAFE_SUB = new Set(["status", "diff", "log", "show", "add", "rm", "mv", "commit", "push", "fetch", "checkout", "switch", "restore", "branch",
+    "rev-parse", "ls-files", "blame", "merge-base", "reset", "describe", "shortlog", "cherry-pick", "merge", "pull", "clean", "rev-list", "ls-tree", "cat-file", "diff-tree", "name-rev", "check-ignore", "lfs", "worktree"]);
+const FETCH_AND_RUN = new Set(["npx", "pnpx", "bunx", "uvx", "pipx"]);
+const FETCH_AND_RUN_SUB = {
+    npm: /^(?:exec|x)$/, pnpm: /^(?:dlx|exec)$/, yarn: /^(?:dlx|exec)$/, bun: /^x$/, uv: /^tool$/, poetry: /^run$/, pipenv: /^run$/, pdm: /^run$/,
+};
+const MANY_VERBS = new Set(["npm", "pnpm", "yarn", "bun", "uv", "poetry", "pipenv", "pdm", "go", "cargo", "dotnet", "deno", "docker", "podman", "nerdctl", "kubectl", "gradle", "mvn", "make", "just", "task", "rake",
+    "pip", "pip3", "gem", "brew"]);
+const RUNS_NEXT = /^(?:run|exec|x|dlx|tool|eval|start|create|compose|container|debug|attach|install|add|i)$/;
+const INTERPRETER = /^(?:node|nodejs|python[0-9.]*|pythonw|pypy[0-9.]*|perl[0-9.]*|ruby|php|deno|bun|lua[0-9.]*|luajit|rscript|tclsh|wish|java|kotlin|groovy|scala|elixir|erl|julia|swift|ts-node|tsx)$/;
+const SCRIPT_PATH = /^(?!\/|~|.*\.\.)(?:[\w@.+\-/]+\.(?:c?js|mjs|cts|mts|ts|tsx|jsx|py|rb|pl|php|lua|r|jar|kts?|groovy|exs?|jl|swift)$|[\w@.+\-]+\/[\w@.+\-/]+$)/i;
+export const programName = (word) => word.replace(/^.*[\\/]/, "").toLowerCase().replace(/\.(?:exe|cmd|bat|com|ps1)$/, "");
+export function checkRepoCommand(line) {
+    const t = line.trim();
+    if (!t)
+        return "empty";
+    if (/[;&|`$<>(){}\\*?!\n]/.test(t))
+        return "shell syntax (; & | ` $ < > ( ) { } * ? !) is not a command prefix";
+    const words = t.split(/\s+/);
+    const first = programName(words[0]);
+    if (RUNS_ANYTHING.has(first) || VERSIONED_SHELL.test(first))
+        return `${first} can run any command, so it would lift the whole list`;
+    if (/['"]/.test(t))
+        return "quotes are not allowed — write the command plainly";
+    if (FETCH_AND_RUN.has(first))
+        return `${first} fetches and runs packages, so it would run whatever it is given`;
+    const plain = words.slice(1).filter((w) => !w.startsWith("-"));
+    const sub = FETCH_AND_RUN_SUB[first];
+    if (sub && plain[0] && sub.test(plain[0].toLowerCase()))
+        return `${first} ${plain[0]} runs whatever it is given`;
+    if (MANY_VERBS.has(first) && !plain.length && !["make", "just", "task", "rake", "gradle", "mvn"].includes(first)) {
+        return `${first} alone would allow every ${first} subcommand, one that runs anything included — name it (${first} test, ${first} run lint)`;
+    }
+    const last = words[words.length - 1].toLowerCase();
+    const own = words.length === 2 || (words.length === 3 && /^(?:compose|container)$/i.test(words[1]));
+    if (MANY_VERBS.has(first) && own && RUNS_NEXT.test(last) && !(["poetry", "pdm", "pipenv"].includes(first) && last === "install")) {
+        return `it ends on "${last}", so the run would choose what that ${/^(?:install|add|i)$/.test(last) ? "installs" : "runs"} — name it (${words.join(" ")} <the program or target>)`;
+    }
+    if (first === "git" && (words.length < 2 || words[1].startsWith("-")))
+        return "git is allowed by subcommand only (git -c … can run anything)";
+    if (first === "git" && !GIT_SAFE_SUB.has(words[1].toLowerCase()))
+        return `git ${words[1]} is not one a woken run may be given (some git subcommands run programs: rebase --exec, submodule foreach, bisect run)`;
+    if (INTERPRETER.test(first)) {
+        const script = (first === "deno" || first === "bun") && words[1] === "run" ? words[2] : words[1];
+        if (!script || script.startsWith("-") || !SCRIPT_PATH.test(script)) {
+            return `${first} is allowed only with a script path after it (${first} scripts/test.${first.startsWith("py") ? "py" : "js"}) — alone it would allow inline code`;
+        }
+    }
+    if (words.some((w) => w === "-c" || w === "--eval" || w === "-e"))
+        return "an option that runs inline code";
+    return null;
+}
+export function parseRepoCommands(text) {
+    const ok = [];
+    const refused = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/\s+#.*$/, "").replace(/^#.*$/, "").trim();
+        if (!line)
+            continue;
+        const why = checkRepoCommand(line);
+        if (why)
+            refused.push({ line, why });
+        else if (!ok.includes(line))
+            ok.push(line);
+    }
+    return { ok: ok.slice(0, 100), refused };
+}
+export function repoCommands(worktree, rev) {
+    if (!rev || !/^[0-9a-f]{7,64}$/i.test(rev))
+        return { ok: [], refused: [] };
+    let bytes;
+    try {
+        bytes = execFileSync("git", ["-C", worktree, "show", `${rev}:${REPO_COMMANDS_FILE}`], { stdio: ["ignore", "pipe", "ignore"], timeout: 10_000, maxBuffer: 1 << 20 });
+    }
+    catch {
+        return { ok: [], refused: [] };
+    }
+    const text = decodeCommandsFile(bytes);
+    if (text === null)
+        return { ok: [], refused: [{ line: "(the whole file)", why: `it is not text — save ${REPO_COMMANDS_FILE} as UTF-8` }] };
+    return parseRepoCommands(text);
+}
+export function decodeCommandsFile(b) {
+    const even = (x) => x.subarray(0, x.length - (x.length % 2));
+    if (b[0] === 0xff && b[1] === 0xfe)
+        return even(b.subarray(2)).toString("utf16le");
+    if (b[0] === 0xfe && b[1] === 0xff) {
+        const le = Buffer.from(even(b.subarray(2)));
+        le.swap16();
+        return le.toString("utf16le");
+    }
+    const text = b.toString("utf8").replace(/^\uFEFF/, "");
+    return text.includes("\0") ? null : text;
+}
+export const REPO_RULES_ARGV_MAX = 3_000;
+export const COMMAND_GRANT_SCOPE = "a granted run starts in its own worktree on a pantheon/* branch and runs commands as you, with your network access. " +
+    "The command list is not a boundary on its own: the run can edit the repo's scripts (package.json, a Makefile, a test file) and then run them " +
+    "through a listed command such as npm test, so whatever it can run, it can make run anything. " +
+    "Claude Code (macOS and Linux): the boundary is Claude Code's OS sandbox — every command, and everything it starts, may write only the run's worktree, " +
+    "its repo's shared git data (never the hooks or config) and the temp dirs, may not read ~/.ssh, ~/.aws, ~/.config/gh, ~/.gnupg, ~/.netrc, " +
+    "~/.docker/config.json, ~/.kube, ~/.git-credentials or ~/.pantheon, and may reach the network; if the sandbox cannot start the run does not start. " +
+    "It may run only git subcommands (status, diff, log, add, commit, push of its own branch, fetch, checkout …), the repo's scripts through npm/pnpm/yarn/bun, make, cargo, go, " +
+    "pytest, mvn/gradle and dotnet, plus what the committed .pantheon/commands on the base branch lists (a shell, a wrapper, a package runner or inline code is never accepted there). " +
+    "What it can still do: change anything in its worktree, push its branch, and read the rest of your files. " +
+    "On a Claude Code older than 2.1.83 (it cannot refuse to run unsandboxed), or on Windows, it has only the list — no boundary; if Pantheon cannot tell what the installed Claude Code supports, that run gets no commands. " +
+    "Codex: any command, inside Codex's own workspace-write sandbox, approved by Codex's auto-reviewer. " +
+    "Cursor, Copilot and Kiro: any command, as you, with no sandbox — they take no allowlist from Pantheon, so such a run can read and change anything you can, " +
+    "Pantheon's own files included (a changed policy or config file is put back after the run, and you are told).";
 export function headlessSpawn(opts) {
     const l = launcher();
-    const procEnv = {
+    const identity = {
         PANTHEON_RELAY: opts.cfg.relay,
         PANTHEON_SPACE: opts.cfg.space,
-        PANTHEON_TOKEN: opts.cfg.token,
         PANTHEON_MEMBER: opts.cfg.member,
         PANTHEON_PUBKEY: opts.cfg.publicKey,
-        PANTHEON_PRIVKEY: opts.cfg.privateKey,
+        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
+        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
+    };
+    const procEnv = {
+        ...identity,
+        PANTHEON_WOKEN_RUN: "1",
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
         ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
         ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
-        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
-        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
     const home = opts.runHome ?? process.env.PANTHEON_HOME;
     const fileEnv = {
+        ...identity,
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
@@ -278,19 +414,66 @@ export function headlessSpawn(opts) {
     };
     if (opts.backend.id === "claude-code") {
         const mcpCfg = join(opts.worktree, ".pantheon-mcp.json");
+        const writeFiles = [{
+                path: ".pantheon-mcp.json",
+                contents: JSON.stringify({ mcpServers: { pantheon: { command: l.command, args: l.args, env: fileEnv } } }, null, 2),
+            }];
+        const bashRules = opts.allowBash ? claudeCommandRules(repoCommands(opts.worktree, opts.commandsRev ?? opts.base).ok) : [];
+        const f = opts.claude?.features ?? NO_CLAUDE_FEATURES;
+        const notes = [];
+        const extra = [];
+        let env = procEnv;
+        let rulesOnArgv = bashRules;
+        if (opts.claude && opts.runHome) {
+            const runTmp = runTmpDir(opts.runHome);
+            const c = claudeRunSettings({
+                allowBash: opts.allowBash, worktree: opts.worktree, runHome: opts.runHome, pantheonHome: opts.claude.pantheonHome,
+                runTmp, bashRules, version: f.version, ...(opts.claude.home ? { home: opts.claude.home } : {}),
+                ...(opts.os ? { os: opts.os } : {}), ...(opts.claude.userSettings ? { userSettings: opts.claude.userSettings } : {}),
+            });
+            if (f.permissionPrompts)
+                extra.push("--permission-prompts", "none");
+            if (f.settingSources)
+                extra.push("--setting-sources", "user");
+            if (f.settings) {
+                const file = join(opts.runHome, "claude-settings.json");
+                writeFiles.push({ path: file, contents: JSON.stringify(c.settings, null, 2) });
+                extra.push("--settings", file);
+                rulesOnArgv = [];
+                notes.push(...c.notes);
+                if (c.sandboxed)
+                    env = { ...procEnv, ...sandboxCacheEnv(runTmp) };
+            }
+            else if (f.disallowedTools) {
+                const deny = c.settings.permissions.deny;
+                extra.push("--disallowedTools", ...deny);
+                notes.push("no --settings on this Claude Code: deny rules passed with --disallowedTools; no sandbox, so the command list is not a boundary");
+            }
+            else {
+                notes.push("no --settings on this Claude Code: no deny rules and no sandbox — the command list is not a boundary");
+            }
+        }
+        if (rulesOnArgv.length) {
+            const fixed = claudeCommandRules().length;
+            let used = 0;
+            const kept = rulesOnArgv.filter((r, n) => n < fixed || (used += r.length + 3) <= REPO_RULES_ARGV_MAX);
+            if (kept.length < rulesOnArgv.length)
+                notes.push(`${rulesOnArgv.length - kept.length} of the repo's commands left off: they do not fit on this command line (${REPO_RULES_ARGV_MAX} characters for the repo's own)`);
+            rulesOnArgv = kept;
+        }
         return {
             command: opts.binary,
             args: [
                 "-p", opts.prompt,
                 "--mcp-config", mcpCfg, "--strict-mcp-config",
-                "--permission-mode", opts.allowBash ? "bypassPermissions" : "acceptEdits",
-                ...(opts.allowBash ? [] : ["--allowedTools", ...PANTHEON_TOOLS]),
+                "--permission-mode", "acceptEdits",
+                ...extra,
+                "--allowedTools", ...PANTHEON_TOOLS, ...rulesOnArgv,
             ],
-            env: procEnv,
-            writeFiles: [{
-                    path: ".pantheon-mcp.json",
-                    contents: JSON.stringify({ mcpServers: { pantheon: { command: l.command, args: l.args, env: fileEnv } } }, null, 2),
-                }],
+            env,
+            writeFiles,
+            ...(notes.length ? { notes } : {}),
+            ...(extra.includes("--setting-sources") ? { repoSettingsIgnored: true } : {}),
         };
     }
     if (opts.backend.id === "codex") {

package/dist/claude-confine.js

@@ -0,0 +1,283 @@
+import { execFileSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { lstatSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir, platform, tmpdir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { agentSpawn } from "./which.js";
+export const NO_CLAUDE_FEATURES = { version: null, permissionPrompts: false, settings: false, settingSources: false, disallowedTools: false };
+export function parseClaudeHelp(help, version = null) {
+    return {
+        version,
+        permissionPrompts: /(^|\s)--permission-prompts\b/m.test(help),
+        settings: /(^|\s)--settings\s/m.test(help),
+        settingSources: /(^|\s)--setting-sources\b/m.test(help),
+        disallowedTools: /(^|\s)--disallowed-?tools\b/im.test(help),
+    };
+}
+export function versionAtLeast(a, b) {
+    if (!a)
+        return false;
+    const pa = a.split(".").map((x) => parseInt(x, 10) || 0);
+    const pb = b.split(".").map((x) => parseInt(x, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) > (pb[i] ?? 0);
+    }
+    return true;
+}
+const runHelp = (binary, args) => {
+    try {
+        const sp = agentSpawn(binary, args);
+        return execFileSync(sp.command, sp.args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000, env: { ...process.env, NO_COLOR: "1" }, ...sp.options });
+    }
+    catch (e) {
+        const out = e.stdout;
+        return typeof out === "string" && out ? out : null;
+    }
+};
+const featureCache = new Map();
+export function detectClaudeFeatures(binary, run = runHelp) {
+    let stamp = "";
+    try {
+        if (isAbsolute(binary))
+            stamp = String(statSync(binary).mtimeMs);
+    }
+    catch { }
+    const key = `${binary}\0${stamp}`;
+    const hit = featureCache.get(key);
+    if (hit)
+        return hit;
+    const help = run(binary, ["--help"]);
+    const v = run(binary, ["--version"]);
+    const version = v ? (/(\d+\.\d+\.\d+)/.exec(v)?.[1] ?? null) : null;
+    if (!help)
+        return { ...NO_CLAUDE_FEATURES, version, unknown: true };
+    const f = parseClaudeHelp(help, version);
+    featureCache.set(key, f);
+    return f;
+}
+export function describeFeatures(f) {
+    const say = (ok, flag) => `${flag} ${ok ? "yes" : "NO"}`;
+    const missing = [
+        !f.permissionPrompts && "a prompt is refused only by the permission mode",
+        !f.settings && (f.disallowedTools ? "no sandbox; deny rules go through --disallowedTools" : "no sandbox and no deny rules"),
+        !f.settingSources && "the repo's .claude settings are held out of the worktree instead",
+    ].filter(Boolean);
+    return `claude ${f.version ?? "(version unknown)"}: ${[
+        say(f.permissionPrompts, "--permission-prompts"), say(f.settings, "--settings"),
+        say(f.settingSources, "--setting-sources"), say(f.disallowedTools, "--disallowedTools"),
+    ].join(", ")}${missing.length ? ` — so: ${missing.join("; ")}` : ""}`;
+}
+export const SECRET_HOME_PATHS = [
+    { rel: ".pantheon", dir: true },
+    { rel: ".ssh", dir: true },
+    { rel: ".aws", dir: true },
+    { rel: ".config/gh", dir: true },
+    { rel: ".gnupg", dir: true },
+    { rel: ".netrc", dir: false },
+    { rel: ".docker/config.json", dir: false },
+    { rel: ".kube", dir: true },
+    { rel: ".git-credentials", dir: false },
+    { rel: ".claude/.credentials.json", dir: false },
+    { rel: "AppData/Roaming/GitHub CLI", dir: true },
+];
+export const GIT_DENY_RULES = [
+    "Bash(git -c *)", "Bash(git -C *)", "Bash(git --config-env*)", "Bash(git --exec-path*)", "Bash(git --git-dir*)", "Bash(git --work-tree*)",
+    "Bash(git * -c *)", "Bash(git * --config-env*)",
+    "Bash(git * --upload-pack*)", "Bash(git * --receive-pack*)", "Bash(git * --exec*)",
+    "Bash(git * -O*)", "Bash(git * --open-files-in-pager*)",
+    "Bash(git * --output*)", "Bash(git * --no-verify*)", "Bash(git commit -n*)", "Bash(git commit * -n*)",
+    ...["-d", "-D", "--delete", "-m", "-M", "--move", "-c", "-C", "--copy", "-f", "--force", "-u", "--set-upstream-to", "--unset-upstream", "--edit-description"]
+        .flatMap((o) => [`Bash(git branch ${o}*)`, `Bash(git branch * ${o}*)`]),
+    ...["-fD", "-Df", "-fd", "-df", "-fM", "-Mf", "-fm", "-mf", "-fC", "-Cf", "-fc", "-cf", "-qD", "-qd"].flatMap((o) => [`Bash(git branch ${o}*)`, `Bash(git branch * ${o}*)`]),
+    ...["-B", "-fB", "-qB", "-fqB", "-qfB"].flatMap((o) => [`Bash(git checkout ${o}*)`, `Bash(git checkout * ${o}*)`]),
+    ...["-C", "-fC", "-qC", "-fqC", "-qfC"].flatMap((o) => [`Bash(git switch ${o}*)`, `Bash(git switch * ${o}*)`]), "Bash(git switch * --force-create*)", "Bash(git switch --force-create*)",
+    "Bash(git fetch *+*)", "Bash(git fetch *:refs/heads/*)",
+    "Bash(git push --delete*)", "Bash(git push * --delete*)", "Bash(git push -d *)", "Bash(git push * -d *)",
+    "Bash(git push --mirror*)", "Bash(git push * --mirror*)", "Bash(git push --all*)", "Bash(git push * --all*)",
+];
+const inside = (child, parent) => {
+    const r = relative(parent, child);
+    return r === "" || (!!r && !r.startsWith("..") && !isAbsolute(r));
+};
+function ruleSpelling(abs, home, os) {
+    if (inside(abs, home) && abs !== home)
+        return `~/${relative(home, abs).split(sep).join("/")}`;
+    if (os === "win32") {
+        const m = /^([A-Za-z]):[\\/](.*)$/.exec(abs);
+        if (m)
+            return `//${m[1].toLowerCase()}/${m[2].split(/[\\/]+/).join("/")}`;
+    }
+    return `/${abs}`;
+}
+function sandboxSpelling(abs, home) {
+    return inside(abs, home) && abs !== home ? `~/${relative(home, abs).split(sep).join("/")}` : abs;
+}
+function userExcludedCommands(file) {
+    if (!file)
+        return [];
+    try {
+        const j = JSON.parse(readFileSync(file, "utf8"));
+        const xs = j.sandbox?.excludedCommands;
+        return Array.isArray(xs) ? xs.filter((x) => typeof x === "string" && !!x.trim()).slice(0, 50) : [];
+    }
+    catch {
+        return [];
+    }
+}
+const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "bin", "ops", "run-homes", "logs", "mcp", "data"];
+function aroundWorktree(top, worktree, named) {
+    const out = [];
+    let level = top;
+    while (level !== worktree) {
+        const next = relative(level, worktree).split(sep)[0];
+        if (!next || next === "..")
+            break;
+        let names = [];
+        try {
+            names = readdirSync(level);
+        }
+        catch { }
+        const isDir = (n) => { try {
+            return statSync(join(level, n)).isDirectory();
+        }
+        catch {
+            return !n.includes(".");
+        } };
+        for (const n of new Set([...names, ...(level === top ? named : [])]))
+            if (n !== next)
+                out.push({ abs: join(level, n), dir: isDir(n) });
+        level = join(level, next);
+    }
+    return out;
+}
+export function claudeRunSettings(i) {
+    const home = resolve(i.home ?? homedir());
+    const os = i.os ?? platform();
+    const worktree = resolve(i.worktree);
+    const notes = [];
+    const targets = [
+        ...SECRET_HOME_PATHS.map((p) => ({ abs: join(home, ...p.rel.split("/")), dir: p.dir })),
+        { abs: resolve(i.pantheonHome), dir: true },
+        { abs: resolve(i.runHome), dir: true },
+    ];
+    const seen = new Set();
+    const denied = [];
+    for (const t of targets) {
+        if (seen.has(t.abs))
+            continue;
+        seen.add(t.abs);
+        if (inside(worktree, t.abs)) {
+            if (worktree === t.abs) {
+                notes.push(`${t.abs} is this run's worktree, so it is not denied to the run`);
+                continue;
+            }
+            for (const d of aroundWorktree(t.abs, worktree, t.abs === resolve(i.pantheonHome) ? PANTHEON_HOME_ENTRIES : []))
+                if (!seen.has(d.abs)) {
+                    seen.add(d.abs);
+                    denied.push(d);
+                }
+            continue;
+        }
+        denied.push(t);
+    }
+    const fileRules = denied.flatMap((t) => {
+        const p = `${ruleSpelling(t.abs, home, os)}${t.dir ? "/**" : ""}`;
+        return [`Read(${p})`, `Edit(${p})`];
+    });
+    if (!i.allowBash) {
+        const permissions = { deny: ["Bash", "PowerShell", ...fileRules] };
+        if (versionAtLeast(i.version, "2.1.257"))
+            permissions.blockReadsOutsideWorkingDirectories = true;
+        else
+            notes.push(`reads outside the worktree are not blocked wholesale (needs Claude Code 2.1.257+, this is ${i.version ?? "an unknown version"}) — only the secret paths are denied`);
+        notes.push("edits only: no shell, file tools held to the worktree, secrets and Pantheon's files denied");
+        return { settings: { permissions }, notes, sandboxed: false };
+    }
+    const excluded = userExcludedCommands(i.userSettings);
+    if (excluded.length)
+        notes.push(`your own sandbox exclusions are refused to the run: ${excluded.join(", ")}`);
+    const permissions = {
+        allow: [...i.bashRules, "WebFetch(domain:*)"],
+        deny: ["PowerShell", ...fileRules, ...GIT_DENY_RULES, ...excluded.map((c) => `Bash(${c})`)],
+    };
+    if (os === "win32") {
+        notes.push("no OS sandbox on Windows (Claude Code has none there): the command list is the only line, and it is not a boundary; commands run through Git Bash only (the PowerShell tool is denied), so without Git Bash this run has no shell");
+        return { settings: { permissions }, notes, sandboxed: false };
+    }
+    const failsClosed = versionAtLeast(i.version, "2.1.83");
+    const hooks = join(resolve(i.runHome), "git-hooks");
+    const sandbox = {
+        enabled: true,
+        failIfUnavailable: true,
+        autoAllowBashIfSandboxed: false,
+        allowUnsandboxedCommands: false,
+        filesystem: {
+            allowWrite: [...new Set([resolve(i.runTmp), resolve(tmpdir())])],
+            denyWrite: [],
+            denyRead: denied.map((t) => sandboxSpelling(t.abs, home)),
+            allowRead: [hooks],
+        },
+        network: { allowLocalBinding: true },
+    };
+    if (!failsClosed) {
+        notes.push(`this Claude Code (${i.version ?? "version unknown"}) cannot refuse to run a command when its sandbox does not start — update it to 2.1.83 or later; until then the command list is the only line, and it is not a boundary`);
+        return { settings: { permissions, sandbox }, notes, sandboxed: false };
+    }
+    notes.push(`sandboxed: commands write only the worktree, its repo's git data and the temp dirs; the secret paths and Pantheon's files are unreadable; network allowed`);
+    return { settings: { permissions, sandbox }, notes, sandboxed: true };
+}
+export function runTmpDir(runHome) {
+    const saltFile = join(runHome, ".tmp-salt");
+    let salt = "";
+    try {
+        salt = readFileSync(saltFile, "utf8").trim();
+    }
+    catch { }
+    if (!/^[0-9a-f]{32}$/.test(salt)) {
+        salt = randomBytes(16).toString("hex");
+        try {
+            mkdirSync(runHome, { recursive: true, mode: 0o700 });
+            writeFileSync(saltFile, salt, { mode: 0o600 });
+        }
+        catch { }
+    }
+    return join(tmpdir(), `pantheon-run-${createHash("sha256").update(`${resolve(runHome)}\0${salt}`).digest("hex").slice(0, 16)}`);
+}
+export function ensureRunTmp(dir) {
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const st = lstatSync(dir);
+        if (!st.isDirectory() || st.isSymbolicLink())
+            return false;
+        if (process.platform === "win32")
+            return true;
+        return (typeof process.getuid !== "function" || st.uid === process.getuid()) && (st.mode & 0o077) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function sandboxCacheEnv(runTmp) {
+    return {
+        TMPDIR: runTmp,
+        npm_config_cache: join(runTmp, "npm-cache"),
+        YARN_CACHE_FOLDER: join(runTmp, "yarn-cache"),
+        PIP_CACHE_DIR: join(runTmp, "pip-cache"),
+        GOCACHE: join(runTmp, "go-build"),
+        XDG_CACHE_HOME: join(runTmp, "cache"),
+    };
+}
+export function bashRuleMatches(rule, command) {
+    const m = /^Bash\((.*)\)$/s.exec(rule);
+    if (!m)
+        return false;
+    const pat = m[1];
+    const cmd = command.trim();
+    const stars = (pat.match(/\*/g) ?? []).length;
+    if (stars === 1 && pat.endsWith(" *") && cmd === pat.slice(0, -2))
+        return true;
+    const re = new RegExp(`^${pat.split("*").map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\s\\S]*")}$`);
+    return re.test(cmd);
+}
+//# sourceMappingURL=claude-confine.js.map