@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/agents.js

@@ -6,6 +6,7 @@ import { join, dirname, isAbsolute } from "node:path";
 import { launcher, kiroDir } from "./install.js";
 import { agentSpawn, which } from "./which.js";
 import { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
+import { claudeRunSettings, NO_CLAUDE_FEATURES, runTmpDir, sandboxCacheEnv, versionAtLeast } from "./claude-confine.js";
 export function launchArgs(agent, prompt, name) {
     if (agent === "claude-code")
         return ["--name", name, prompt];
@@ -109,8 +110,9 @@ export function resolveBinary(backend) {
             }
             binaryCache.set(b, found);
         }
-        if (binaryCache.get(b))
-            return b;
+        const hit = binaryCache.get(b);
+        if (hit)
+            return hit;
     }
     return null;
 }
@@ -123,7 +125,16 @@ export const SIGN_IN_CHECK = {
 };
 export const NEEDS_SIGN_IN_BEFORE_SPAWN = new Set(["kiro"]);
 export const NOT_FOR_UNATTENDED_RUNS = new Set(["kiro"]);
-export const KIRO_UNATTENDED_REFUSAL = "Kiro cannot yet be fenced to its worktree for unattended runs; the worker uses another installed agent, or none";
+export const KIRO_UNATTENDED_REFUSAL = "Kiro answers in your live sessions; for runs while you are away the worker uses another installed agent (Claude Code, Codex, Cursor or Copilot)";
+export const SANDBOXED_FOR_UNATTENDED = new Set(["claude-code"]);
+export const unsandboxedRefusal = (label) => `${label} is set to leave teammates' requests for you on this machine, so this one waits for your next session. ` +
+    `To have ${label} answer them while you're away: pantheon policy grant unsandboxed-runs`;
+export function agentsNeedingUnsandboxed(available = detectAvailable()) {
+    if (available.some((a) => SANDBOXED_FOR_UNATTENDED.has(a.backend.id)))
+        return [];
+    return [...new Set(available.filter((a) => !NOT_FOR_UNATTENDED_RUNS.has(a.backend.id)).map((a) => a.backend.label))];
+}
+export const claudeSandboxable = (f, os = process.platform) => os !== "win32" && !!f.settings && versionAtLeast(f.version, "2.1.83");
 export function kiroSignedIn(binary, run = runStatus, env = process.env, home = homedir(), os = platform()) {
     if (env.KIRO_API_KEY)
         return { ok: true, detail: "signed in (KIRO_API_KEY in the environment)" };
@@ -219,6 +230,14 @@ export function chooseAgent(preferred, opts = {}) {
             skipped.push({ backend: c.backend, why: KIRO_UNATTENDED_REFUSAL });
     if (usable.length)
         order.splice(0, order.length, ...usable);
+    if (!opts.unsandboxedOk) {
+        const boxed = order.filter((c) => SANDBOXED_FOR_UNATTENDED.has(c.backend.id));
+        for (const c of order)
+            if (!SANDBOXED_FOR_UNATTENDED.has(c.backend.id) && boxed.length)
+                skipped.push({ backend: c.backend, why: unsandboxedRefusal(c.backend.label) });
+        if (boxed.length)
+            order.splice(0, order.length, ...boxed);
+    }
     for (const c of order) {
         const s = state(c.backend, c.binary);
         if (!s || s.ok || s.unknown)
@@ -228,9 +247,15 @@ export function chooseAgent(preferred, opts = {}) {
     const first = order.find((o) => !NEEDS_SIGN_IN_BEFORE_SPAWN.has(o.backend.id)) ?? order[0];
     return { backend: first.backend, binary: first.binary, signIn: state(first.backend, first.binary), because: `${first.because} (none signed in)`, skipped };
 }
-export function unattendedRefusal(c) {
+export function unattendedRefusal(c, o = {}) {
     if (NOT_FOR_UNATTENDED_RUNS.has(c.backend.id))
         return KIRO_UNATTENDED_REFUSAL;
+    if (!SANDBOXED_FOR_UNATTENDED.has(c.backend.id) && !o.unsandboxedOk) {
+        return c.because === "pinned"
+            ? `woken runs here are pinned to ${c.backend.label} (a persona's agent: line, or the worker's --agent), which is set to leave teammates' requests for you, so this one waits for your next session. ` +
+                `To have ${c.backend.label} answer them: pantheon policy grant unsandboxed-runs — or unpin it so Claude Code takes them`
+            : unsandboxedRefusal(c.backend.label);
+    }
     if (!NEEDS_SIGN_IN_BEFORE_SPAWN.has(c.backend.id) || c.signIn?.ok)
         return null;
     return `${c.backend.label} is not signed in (${c.signIn?.detail ?? "not checked"}), and signed out it opens a browser to log in, so it is not started while you are away — ${SIGN_IN_CHECK[c.backend.id].fix}`;
@@ -242,7 +267,8 @@ export function describeChoice(c) {
 export function skippedSummary(c) {
     if (!c.skipped.length)
         return "";
-    const why = [...new Set(c.skipped.map((s) => (s.why === KIRO_UNATTENDED_REFUSAL ? `${s.backend.label} cannot run unattended yet` : "not signed in")))];
+    const why = [...new Set(c.skipped.map((s) => (s.why === KIRO_UNATTENDED_REFUSAL ? `${s.backend.label} cannot run unattended yet`
+            : s.why === unsandboxedRefusal(s.backend.label) ? `${s.backend.label} has no sandbox` : "not signed in")))];
     return `${c.skipped.length} skipped (${why.join("; ")})`;
 }
 export function resolveAgent(preferred) {
@@ -250,25 +276,155 @@ export function resolveAgent(preferred) {
     return { backend: c.backend, binary: c.binary };
 }
 export { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
+export const COMMAND_ALLOWLIST = [
+    ...["status", "diff", "log", "show", "add", "rm", "mv", "commit", "push", "fetch", "checkout", "switch", "restore",
+        "branch", "rev-parse", "ls-files", "stash list", "stash show", "blame", "merge-base", "reset"].map((c) => `git ${c}`),
+    "npm test", "npm run", "npm ci", "pnpm test", "pnpm run", "yarn test", "yarn run", "bun test", "bun run",
+    "make", "cargo build", "cargo test", "cargo check", "go build", "go test", "go vet",
+    "pytest", "python -m pytest", "python3 -m pytest", "mvn", "gradle", "./gradlew", "dotnet build", "dotnet test",
+];
+export const COMMAND_EXACT = ["npm install", "pnpm install", "yarn install", "bun install"];
+export const claudeCommandRules = (extra = []) => [
+    ...COMMAND_ALLOWLIST.map((c) => `Bash(${c} *)`),
+    ...COMMAND_EXACT.map((c) => `Bash(${c})`),
+    ...extra.map((c) => `Bash(${c} *)`),
+];
+export const REPO_COMMANDS_FILE = ".pantheon/commands";
+const RUNS_ANYTHING = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "csh", "tcsh", "ash", "busybox", "pwsh", "powershell", "cmd",
+    "env", "eval", "exec", "sudo", "su", "doas", "pkexec", "runuser", "xargs", "nohup", "time", "command", "builtin", "source", ".", "nice", "timeout", "watch",
+    "setsid", "stdbuf", "ionice", "flock", "chroot", "unshare", "nsenter", "script", "unbuffer", "strace", "ltrace",
+    "ssh", "scp", "curl", "wget", "nc", "ncat", "socat", "osascript", "open", "launchctl", "systemctl", "crontab", "chmod", "chown", "rm",
+    "direnv", "devbox", "mise", "asdf", "nix", "nix-shell", "wsl", "start", "rundll32", "mshta", "wscript", "cscript",
+    "find", "awk", "gawk", "mawk", "nawk", "sed", "gsed", "parallel", "cross-env", "concurrently", "npm-run-all", "run-p", "run-s", "nodemon", "watchexec", "entr",
+    "hyperfine", "tmux", "screen", "gdb", "lldb", "expect", "nu", "xonsh", "mksh", "yash", "elvish", "rc", "oksh", "posh",
+    "winpty", "mintty", "wt", "conhost", "git-bash", "schtasks", "runas", "forfiles", "powershell_ise", "vim", "vi", "nvim", "emacs", "less", "more", "man"]);
+const VERSIONED_SHELL = /^(?:ba|z|k|c|tc|da|a|fi|mk)?sh[-.\d]*$|^fish[-.\d]+$|^pwsh[-.\d]+$/;
+const GIT_SAFE_SUB = new Set(["status", "diff", "log", "show", "add", "rm", "mv", "commit", "push", "fetch", "checkout", "switch", "restore", "branch",
+    "rev-parse", "ls-files", "blame", "merge-base", "reset", "describe", "shortlog", "cherry-pick", "merge", "pull", "clean", "rev-list", "ls-tree", "cat-file", "diff-tree", "name-rev", "check-ignore", "lfs", "worktree"]);
+const FETCH_AND_RUN = new Set(["npx", "pnpx", "bunx", "uvx", "pipx"]);
+const FETCH_AND_RUN_SUB = {
+    npm: /^(?:exec|x)$/, pnpm: /^(?:dlx|exec)$/, yarn: /^(?:dlx|exec)$/, bun: /^x$/, uv: /^tool$/, poetry: /^run$/, pipenv: /^run$/, pdm: /^run$/,
+};
+const MANY_VERBS = new Set(["npm", "pnpm", "yarn", "bun", "uv", "poetry", "pipenv", "pdm", "go", "cargo", "dotnet", "deno", "docker", "podman", "nerdctl", "kubectl", "gradle", "mvn", "make", "just", "task", "rake",
+    "pip", "pip3", "gem", "brew"]);
+const RUNS_NEXT = /^(?:run|exec|x|dlx|tool|eval|start|create|compose|container|debug|attach|install|add|i)$/;
+const INTERPRETER = /^(?:node|nodejs|python[0-9.]*|pythonw|pypy[0-9.]*|perl[0-9.]*|ruby|php|deno|bun|lua[0-9.]*|luajit|rscript|tclsh|wish|java|kotlin|groovy|scala|elixir|erl|julia|swift|ts-node|tsx)$/;
+const SCRIPT_PATH = /^(?!\/|~|.*\.\.)(?:[\w@.+\-/]+\.(?:c?js|mjs|cts|mts|ts|tsx|jsx|py|rb|pl|php|lua|r|jar|kts?|groovy|exs?|jl|swift)$|[\w@.+\-]+\/[\w@.+\-/]+$)/i;
+export const programName = (word) => word.replace(/^.*[\\/]/, "").toLowerCase().replace(/\.(?:exe|cmd|bat|com|ps1)$/, "");
+export function checkRepoCommand(line) {
+    const t = line.trim();
+    if (!t)
+        return "empty";
+    if (/[;&|`$<>(){}\\*?!\n]/.test(t))
+        return "shell syntax (; & | ` $ < > ( ) { } * ? !) is not a command prefix";
+    const words = t.split(/\s+/);
+    const first = programName(words[0]);
+    if (RUNS_ANYTHING.has(first) || VERSIONED_SHELL.test(first))
+        return `${first} can run any command, so it would lift the whole list`;
+    if (/['"]/.test(t))
+        return "quotes are not allowed — write the command plainly";
+    if (FETCH_AND_RUN.has(first))
+        return `${first} fetches and runs packages, so it would run whatever it is given`;
+    const plain = words.slice(1).filter((w) => !w.startsWith("-"));
+    const sub = FETCH_AND_RUN_SUB[first];
+    if (sub && plain[0] && sub.test(plain[0].toLowerCase()))
+        return `${first} ${plain[0]} runs whatever it is given`;
+    if (MANY_VERBS.has(first) && !plain.length && !["make", "just", "task", "rake", "gradle", "mvn"].includes(first)) {
+        return `${first} alone would allow every ${first} subcommand, one that runs anything included — name it (${first} test, ${first} run lint)`;
+    }
+    const last = words[words.length - 1].toLowerCase();
+    const own = words.length === 2 || (words.length === 3 && /^(?:compose|container)$/i.test(words[1]));
+    if (MANY_VERBS.has(first) && own && RUNS_NEXT.test(last) && !(["poetry", "pdm", "pipenv"].includes(first) && last === "install")) {
+        return `it ends on "${last}", so the run would choose what that ${/^(?:install|add|i)$/.test(last) ? "installs" : "runs"} — name it (${words.join(" ")} <the program or target>)`;
+    }
+    if (first === "git" && (words.length < 2 || words[1].startsWith("-")))
+        return "git is allowed by subcommand only (git -c … can run anything)";
+    if (first === "git" && !GIT_SAFE_SUB.has(words[1].toLowerCase()))
+        return `git ${words[1]} is not one a woken run may be given (some git subcommands run programs: rebase --exec, submodule foreach, bisect run)`;
+    if (INTERPRETER.test(first)) {
+        const script = (first === "deno" || first === "bun") && words[1] === "run" ? words[2] : words[1];
+        if (!script || script.startsWith("-") || !SCRIPT_PATH.test(script)) {
+            return `${first} is allowed only with a script path after it (${first} scripts/test.${first.startsWith("py") ? "py" : "js"}) — alone it would allow inline code`;
+        }
+    }
+    if (words.some((w) => w === "-c" || w === "--eval" || w === "-e"))
+        return "an option that runs inline code";
+    return null;
+}
+export function parseRepoCommands(text) {
+    const ok = [];
+    const refused = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/\s+#.*$/, "").replace(/^#.*$/, "").trim();
+        if (!line)
+            continue;
+        const why = checkRepoCommand(line);
+        if (why)
+            refused.push({ line, why });
+        else if (!ok.includes(line))
+            ok.push(line);
+    }
+    return { ok: ok.slice(0, 100), refused };
+}
+export function repoCommands(worktree, rev) {
+    if (!rev || !/^[0-9a-f]{7,64}$/i.test(rev))
+        return { ok: [], refused: [] };
+    let bytes;
+    try {
+        bytes = execFileSync("git", ["-C", worktree, "show", `${rev}:${REPO_COMMANDS_FILE}`], { stdio: ["ignore", "pipe", "ignore"], timeout: 10_000, maxBuffer: 1 << 20 });
+    }
+    catch {
+        return { ok: [], refused: [] };
+    }
+    const text = decodeCommandsFile(bytes);
+    if (text === null)
+        return { ok: [], refused: [{ line: "(the whole file)", why: `it is not text — save ${REPO_COMMANDS_FILE} as UTF-8` }] };
+    return parseRepoCommands(text);
+}
+export function decodeCommandsFile(b) {
+    const even = (x) => x.subarray(0, x.length - (x.length % 2));
+    if (b[0] === 0xff && b[1] === 0xfe)
+        return even(b.subarray(2)).toString("utf16le");
+    if (b[0] === 0xfe && b[1] === 0xff) {
+        const le = Buffer.from(even(b.subarray(2)));
+        le.swap16();
+        return le.toString("utf16le");
+    }
+    const text = b.toString("utf8").replace(/^\uFEFF/, "");
+    return text.includes("\0") ? null : text;
+}
+export const REPO_RULES_ARGV_MAX = 3_000;
+export const COMMAND_GRANT_SCOPE = "a run with commands works in its own worktree on a pantheon/* branch: it runs your tests and builds, commits, pushes its own branch for your review, and never merges. " +
+    "Claude Code (macOS and Linux) runs those commands inside its OS sandbox: they write only the run's worktree, its git data and the temp dirs, stay clear of your keys and credentials " +
+    "(~/.ssh, ~/.aws, ~/.config/gh, ~/.gnupg, ~/.netrc, ~/.docker/config.json, ~/.kube, ~/.git-credentials, ~/.pantheon), and use git, the repo's scripts through npm/pnpm/yarn/bun, " +
+    "make, cargo, go, pytest, mvn/gradle and dotnet, plus whatever the committed .pantheon/commands on the base branch lists. " +
+    "Codex runs them in its own workspace-write sandbox, approved by its auto-reviewer. " +
+    "Cursor and Copilot run any command without asking, as you and with no sandbox; Claude Code on Windows or before 2.1.83 runs its listed commands the same way, without its sandbox. " +
+    "After every run Pantheon checks its own settings and puts back any change a run made to them; " +
+    "pantheon setup --unsandboxed no leaves those requests for you instead. Kiro answers in your live sessions. " +
+    "Turn commands off any time: pantheon policy revoke run-commands.";
 export function headlessSpawn(opts) {
     const l = launcher();
-    const procEnv = {
+    const identity = {
         PANTHEON_RELAY: opts.cfg.relay,
         PANTHEON_SPACE: opts.cfg.space,
-        PANTHEON_TOKEN: opts.cfg.token,
         PANTHEON_MEMBER: opts.cfg.member,
         PANTHEON_PUBKEY: opts.cfg.publicKey,
-        PANTHEON_PRIVKEY: opts.cfg.privateKey,
+        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
+        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
+    };
+    const procEnv = {
+        ...identity,
+        PANTHEON_WOKEN_RUN: "1",
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
         ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
         ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
-        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
-        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
     const home = opts.runHome ?? process.env.PANTHEON_HOME;
     const fileEnv = {
+        ...identity,
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
@@ -278,19 +434,70 @@ export function headlessSpawn(opts) {
     };
     if (opts.backend.id === "claude-code") {
         const mcpCfg = join(opts.worktree, ".pantheon-mcp.json");
+        const writeFiles = [{
+                path: ".pantheon-mcp.json",
+                contents: JSON.stringify({ mcpServers: { pantheon: { command: l.command, args: l.args, env: fileEnv } } }, null, 2),
+            }];
+        const bashRules = opts.allowBash ? claudeCommandRules(repoCommands(opts.worktree, opts.commandsRev ?? opts.base).ok) : [];
+        const f = opts.claude?.features ?? NO_CLAUDE_FEATURES;
+        const notes = [];
+        const extra = [];
+        let env = procEnv;
+        let rulesOnArgv = bashRules;
+        if (opts.claude && opts.runHome) {
+            const runTmp = runTmpDir(opts.runHome);
+            const c = claudeRunSettings({
+                allowBash: opts.allowBash, worktree: opts.worktree, runHome: opts.runHome, pantheonHome: opts.claude.pantheonHome,
+                ...(opts.readOnlyDirs?.length ? { readOnlyDirs: opts.readOnlyDirs } : {}),
+                runTmp, bashRules, version: f.version, ...(opts.claude.home ? { home: opts.claude.home } : {}),
+                ...(opts.os ? { os: opts.os } : {}), ...(opts.claude.userSettings ? { userSettings: opts.claude.userSettings } : {}),
+            });
+            if (f.permissionPrompts)
+                extra.push("--permission-prompts", "none");
+            if (f.settingSources)
+                extra.push("--setting-sources", "user");
+            if (f.addDir && f.settings)
+                for (const d of c.readOnly)
+                    extra.push("--add-dir", d);
+            if (f.settings) {
+                const file = join(opts.runHome, "claude-settings.json");
+                writeFiles.push({ path: file, contents: JSON.stringify(c.settings, null, 2) });
+                extra.push("--settings", file);
+                rulesOnArgv = [];
+                notes.push(...c.notes);
+                if (c.sandboxed)
+                    env = { ...procEnv, ...sandboxCacheEnv(runTmp) };
+            }
+            else if (f.disallowedTools) {
+                const deny = c.settings.permissions.deny;
+                extra.push("--disallowedTools", ...deny);
+                notes.push("no --settings on this Claude Code: deny rules passed with --disallowedTools; no sandbox, so the command list is not a boundary");
+            }
+            else {
+                notes.push("no --settings on this Claude Code: no deny rules and no sandbox — the command list is not a boundary");
+            }
+        }
+        if (rulesOnArgv.length) {
+            const fixed = claudeCommandRules().length;
+            let used = 0;
+            const kept = rulesOnArgv.filter((r, n) => n < fixed || (used += r.length + 3) <= REPO_RULES_ARGV_MAX);
+            if (kept.length < rulesOnArgv.length)
+                notes.push(`${rulesOnArgv.length - kept.length} of the repo's commands left off: they do not fit on this command line (${REPO_RULES_ARGV_MAX} characters for the repo's own)`);
+            rulesOnArgv = kept;
+        }
         return {
             command: opts.binary,
             args: [
                 "-p", opts.prompt,
                 "--mcp-config", mcpCfg, "--strict-mcp-config",
-                "--permission-mode", opts.allowBash ? "bypassPermissions" : "acceptEdits",
-                ...(opts.allowBash ? [] : ["--allowedTools", ...PANTHEON_TOOLS]),
+                "--permission-mode", "acceptEdits",
+                ...extra,
+                "--allowedTools", ...PANTHEON_TOOLS, ...rulesOnArgv,
             ],
-            env: procEnv,
-            writeFiles: [{
-                    path: ".pantheon-mcp.json",
-                    contents: JSON.stringify({ mcpServers: { pantheon: { command: l.command, args: l.args, env: fileEnv } } }, null, 2),
-                }],
+            env,
+            writeFiles,
+            ...(notes.length ? { notes } : {}),
+            ...(extra.includes("--setting-sources") ? { repoSettingsIgnored: true } : {}),
         };
     }
     if (opts.backend.id === "codex") {

package/dist/claude-confine.js

@@ -0,0 +1,299 @@
+import { execFileSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { lstatSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir, platform, tmpdir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { agentSpawn } from "./which.js";
+export const NO_CLAUDE_FEATURES = { version: null, permissionPrompts: false, settings: false, settingSources: false, disallowedTools: false };
+export function parseClaudeHelp(help, version = null) {
+    return {
+        version,
+        permissionPrompts: /(^|\s)--permission-prompts\b/m.test(help),
+        settings: /(^|\s)--settings\s/m.test(help),
+        settingSources: /(^|\s)--setting-sources\b/m.test(help),
+        disallowedTools: /(^|\s)--disallowed-?tools\b/im.test(help),
+        addDir: /(^|\s)--add-dir\b/m.test(help),
+    };
+}
+export function versionAtLeast(a, b) {
+    if (!a)
+        return false;
+    const pa = a.split(".").map((x) => parseInt(x, 10) || 0);
+    const pb = b.split(".").map((x) => parseInt(x, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) > (pb[i] ?? 0);
+    }
+    return true;
+}
+const runHelp = (binary, args) => {
+    try {
+        const sp = agentSpawn(binary, args);
+        return execFileSync(sp.command, sp.args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000, env: { ...process.env, NO_COLOR: "1" }, ...sp.options });
+    }
+    catch (e) {
+        const out = e.stdout;
+        return typeof out === "string" && out ? out : null;
+    }
+};
+const featureCache = new Map();
+export function detectClaudeFeatures(binary, run = runHelp) {
+    let stamp = "";
+    try {
+        if (isAbsolute(binary))
+            stamp = String(statSync(binary).mtimeMs);
+    }
+    catch { }
+    const key = `${binary}\0${stamp}`;
+    const hit = featureCache.get(key);
+    if (hit)
+        return hit;
+    const help = run(binary, ["--help"]);
+    const v = run(binary, ["--version"]);
+    const version = v ? (/(\d+\.\d+\.\d+)/.exec(v)?.[1] ?? null) : null;
+    if (!help)
+        return { ...NO_CLAUDE_FEATURES, version, unknown: true };
+    const f = parseClaudeHelp(help, version);
+    featureCache.set(key, f);
+    return f;
+}
+export function describeFeatures(f) {
+    const say = (ok, flag) => `${flag} ${ok ? "yes" : "NO"}`;
+    const missing = [
+        !f.permissionPrompts && "a prompt is refused only by the permission mode",
+        !f.settings && (f.disallowedTools ? "no sandbox; deny rules go through --disallowedTools" : "no sandbox and no deny rules"),
+        !f.settingSources && "the repo's .claude settings are held out of the worktree instead",
+    ].filter(Boolean);
+    return `claude ${f.version ?? "(version unknown)"}: ${[
+        say(f.permissionPrompts, "--permission-prompts"), say(f.settings, "--settings"),
+        say(f.settingSources, "--setting-sources"), say(f.disallowedTools, "--disallowedTools"),
+    ].join(", ")}${missing.length ? ` — so: ${missing.join("; ")}` : ""}`;
+}
+export const SECRET_HOME_PATHS = [
+    { rel: ".pantheon", dir: true },
+    { rel: ".ssh", dir: true },
+    { rel: ".aws", dir: true },
+    { rel: ".config/gh", dir: true },
+    { rel: ".gnupg", dir: true },
+    { rel: ".netrc", dir: false },
+    { rel: ".docker/config.json", dir: false },
+    { rel: ".kube", dir: true },
+    { rel: ".git-credentials", dir: false },
+    { rel: ".claude/.credentials.json", dir: false },
+    { rel: "AppData/Roaming/GitHub CLI", dir: true },
+];
+export const GIT_DENY_RULES = [
+    "Bash(git -c *)", "Bash(git -C *)", "Bash(git --config-env*)", "Bash(git --exec-path*)", "Bash(git --git-dir*)", "Bash(git --work-tree*)",
+    "Bash(git * -c *)", "Bash(git * --config-env*)",
+    "Bash(git * --upload-pack*)", "Bash(git * --receive-pack*)", "Bash(git * --exec*)",
+    "Bash(git * -O*)", "Bash(git * --open-files-in-pager*)",
+    "Bash(git * --output*)", "Bash(git * --no-verify*)", "Bash(git commit -n*)", "Bash(git commit * -n*)",
+    ...["-d", "-D", "--delete", "-m", "-M", "--move", "-c", "-C", "--copy", "-f", "--force", "-u", "--set-upstream-to", "--unset-upstream", "--edit-description"]
+        .flatMap((o) => [`Bash(git branch ${o}*)`, `Bash(git branch * ${o}*)`]),
+    ...["-fD", "-Df", "-fd", "-df", "-fM", "-Mf", "-fm", "-mf", "-fC", "-Cf", "-fc", "-cf", "-qD", "-qd"].flatMap((o) => [`Bash(git branch ${o}*)`, `Bash(git branch * ${o}*)`]),
+    ...["-B", "-fB", "-qB", "-fqB", "-qfB"].flatMap((o) => [`Bash(git checkout ${o}*)`, `Bash(git checkout * ${o}*)`]),
+    ...["-C", "-fC", "-qC", "-fqC", "-qfC"].flatMap((o) => [`Bash(git switch ${o}*)`, `Bash(git switch * ${o}*)`]), "Bash(git switch * --force-create*)", "Bash(git switch --force-create*)",
+    "Bash(git fetch *+*)", "Bash(git fetch *:refs/heads/*)",
+    "Bash(git push --delete*)", "Bash(git push * --delete*)", "Bash(git push -d *)", "Bash(git push * -d *)",
+    "Bash(git push --mirror*)", "Bash(git push * --mirror*)", "Bash(git push --all*)", "Bash(git push * --all*)",
+];
+const inside = (child, parent) => {
+    const r = relative(parent, child);
+    return r === "" || (!!r && !r.startsWith("..") && !isAbsolute(r));
+};
+function ruleSpelling(abs, home, os) {
+    if (inside(abs, home) && abs !== home)
+        return `~/${relative(home, abs).split(sep).join("/")}`;
+    if (os === "win32") {
+        const m = /^([A-Za-z]):[\\/](.*)$/.exec(abs);
+        if (m)
+            return `//${m[1].toLowerCase()}/${m[2].split(/[\\/]+/).join("/")}`;
+    }
+    return `/${abs}`;
+}
+function sandboxSpelling(abs, home) {
+    return inside(abs, home) && abs !== home ? `~/${relative(home, abs).split(sep).join("/")}` : abs;
+}
+function userExcludedCommands(file) {
+    if (!file)
+        return [];
+    try {
+        const j = JSON.parse(readFileSync(file, "utf8"));
+        const xs = j.sandbox?.excludedCommands;
+        return Array.isArray(xs) ? xs.filter((x) => typeof x === "string" && !!x.trim()).slice(0, 50) : [];
+    }
+    catch {
+        return [];
+    }
+}
+const SECRET_FILE_GLOBS = [".env", ".env.*", "*.pem", "*.key", "*.p12", "*.pfx", "id_rsa*", "id_ed25519*", ".npmrc", ".netrc", "credentials*", "*.keystore", "service-account*.json"];
+const PANTHEON_HOME_ENTRIES = ["config.json", "config.json.bak", "config.json.lock", "worker-policy.json", "profile.json", "continued.json", "bin", "ops", "run-homes", "logs", "mcp", "data"];
+function aroundWorktree(top, keeps, named) {
+    const keep = (typeof keeps === "string" ? [keeps] : [...keeps]).map((k) => resolve(k));
+    const out = [];
+    const walk = (level, isTop) => {
+        if (keep.includes(resolve(level)))
+            return;
+        const nexts = new Set(keep.map((k) => relative(level, k).split(sep)[0]).filter((n) => !!n && n !== ".." && !isAbsolute(n)));
+        let names = [];
+        try {
+            names = readdirSync(level);
+        }
+        catch { }
+        const isDir = (n) => { try {
+            return statSync(join(level, n)).isDirectory();
+        }
+        catch {
+            return !n.includes(".");
+        } };
+        for (const n of new Set([...names, ...(isTop ? named : [])]))
+            if (!nexts.has(n))
+                out.push({ abs: join(level, n), dir: isDir(n) });
+        for (const n of nexts)
+            walk(join(level, n), false);
+    };
+    walk(top, true);
+    return out;
+}
+export function claudeRunSettings(i) {
+    const home = resolve(i.home ?? homedir());
+    const os = i.os ?? platform();
+    const worktree = resolve(i.worktree);
+    const notes = [];
+    const targets = [
+        ...SECRET_HOME_PATHS.map((p) => ({ abs: join(home, ...p.rel.split("/")), dir: p.dir })),
+        { abs: resolve(i.pantheonHome), dir: true },
+        { abs: resolve(i.runHome), dir: true },
+    ];
+    const seen = new Set();
+    const denied = [];
+    const secretTargets = targets.filter((t) => t.abs !== resolve(i.pantheonHome));
+    const readOnly = (i.readOnlyDirs ?? []).map((d) => resolve(d)).filter((d) => {
+        const bad = secretTargets.find((t) => inside(d, t.abs) || inside(t.abs, d));
+        if (bad)
+            notes.push(`${d} is not opened to the run: it holds or is inside ${bad.abs}`);
+        return !bad;
+    });
+    const keeps = [worktree, ...readOnly];
+    for (const t of targets) {
+        if (seen.has(t.abs))
+            continue;
+        seen.add(t.abs);
+        const kept = keeps.filter((k) => inside(k, t.abs));
+        if (kept.length) {
+            if (worktree === t.abs) {
+                notes.push(`${t.abs} is this run's worktree, so it is not denied to the run`);
+                continue;
+            }
+            for (const d of aroundWorktree(t.abs, kept, t.abs === resolve(i.pantheonHome) ? PANTHEON_HOME_ENTRIES : []))
+                if (!seen.has(d.abs)) {
+                    seen.add(d.abs);
+                    denied.push(d);
+                }
+            continue;
+        }
+        denied.push(t);
+    }
+    const fileRules = [
+        ...denied.flatMap((t) => {
+            const p = `${ruleSpelling(t.abs, home, os)}${t.dir ? "/**" : ""}`;
+            return [`Read(${p})`, `Edit(${p})`];
+        }),
+        ...readOnly.flatMap((d) => [`Edit(${ruleSpelling(d, home, os)}/**)`, ...SECRET_FILE_GLOBS.map((g) => `Read(${ruleSpelling(d, home, os)}/**/${g})`)]),
+    ];
+    if (!i.allowBash) {
+        const permissions = { deny: ["Bash", "PowerShell", ...fileRules] };
+        if (versionAtLeast(i.version, "2.1.257"))
+            permissions.blockReadsOutsideWorkingDirectories = true;
+        else
+            notes.push(`reads outside the worktree are not blocked wholesale (needs Claude Code 2.1.257+, this is ${i.version ?? "an unknown version"}) — only the secret paths are denied`);
+        notes.push("edits only: no shell, file tools held to the worktree, secrets and Pantheon's files denied");
+        return { settings: { permissions }, notes, sandboxed: false, readOnly };
+    }
+    const excluded = userExcludedCommands(i.userSettings);
+    if (excluded.length)
+        notes.push(`your own sandbox exclusions are refused to the run: ${excluded.join(", ")}`);
+    const permissions = {
+        allow: [...i.bashRules, "WebFetch(domain:*)"],
+        deny: ["PowerShell", ...fileRules, ...GIT_DENY_RULES, ...excluded.map((c) => `Bash(${c})`)],
+    };
+    if (os === "win32") {
+        notes.push("no OS sandbox on Windows (Claude Code has none there): the command list is the only line, and it is not a boundary; commands run through Git Bash only (the PowerShell tool is denied), so without Git Bash this run has no shell");
+        return { settings: { permissions }, notes, sandboxed: false, readOnly };
+    }
+    const failsClosed = versionAtLeast(i.version, "2.1.83");
+    const hooks = join(resolve(i.runHome), "git-hooks");
+    const sandbox = {
+        enabled: true,
+        failIfUnavailable: true,
+        autoAllowBashIfSandboxed: false,
+        allowUnsandboxedCommands: false,
+        filesystem: {
+            allowWrite: [...new Set([resolve(i.runTmp), resolve(tmpdir())])],
+            denyWrite: readOnly.map((d) => sandboxSpelling(d, home)),
+            denyRead: denied.map((t) => sandboxSpelling(t.abs, home)),
+            allowRead: [hooks],
+        },
+        network: { allowLocalBinding: true },
+    };
+    if (!failsClosed) {
+        notes.push(`this Claude Code (${i.version ?? "version unknown"}) cannot refuse to run a command when its sandbox does not start — update it to 2.1.83 or later; until then the command list is the only line, and it is not a boundary`);
+        return { settings: { permissions, sandbox }, notes, sandboxed: false, readOnly };
+    }
+    notes.push(`sandboxed: commands write only the worktree, its repo's git data and the temp dirs; the secret paths and Pantheon's files are unreadable; network allowed`);
+    return { settings: { permissions, sandbox }, notes, sandboxed: true, readOnly };
+}
+export function runTmpDir(runHome) {
+    const saltFile = join(runHome, ".tmp-salt");
+    let salt = "";
+    try {
+        salt = readFileSync(saltFile, "utf8").trim();
+    }
+    catch { }
+    if (!/^[0-9a-f]{32}$/.test(salt)) {
+        salt = randomBytes(16).toString("hex");
+        try {
+            mkdirSync(runHome, { recursive: true, mode: 0o700 });
+            writeFileSync(saltFile, salt, { mode: 0o600 });
+        }
+        catch { }
+    }
+    return join(tmpdir(), `pantheon-run-${createHash("sha256").update(`${resolve(runHome)}\0${salt}`).digest("hex").slice(0, 16)}`);
+}
+export function ensureRunTmp(dir) {
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const st = lstatSync(dir);
+        if (!st.isDirectory() || st.isSymbolicLink())
+            return false;
+        if (process.platform === "win32")
+            return true;
+        return (typeof process.getuid !== "function" || st.uid === process.getuid()) && (st.mode & 0o077) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function sandboxCacheEnv(runTmp) {
+    return {
+        TMPDIR: runTmp,
+        npm_config_cache: join(runTmp, "npm-cache"),
+        YARN_CACHE_FOLDER: join(runTmp, "yarn-cache"),
+        PIP_CACHE_DIR: join(runTmp, "pip-cache"),
+        GOCACHE: join(runTmp, "go-build"),
+        XDG_CACHE_HOME: join(runTmp, "cache"),
+    };
+}
+export function bashRuleMatches(rule, command) {
+    const m = /^Bash\((.*)\)$/s.exec(rule);
+    if (!m)
+        return false;
+    const pat = m[1];
+    const cmd = command.trim();
+    const stars = (pat.match(/\*/g) ?? []).length;
+    if (stars === 1 && pat.endsWith(" *") && cmd === pat.slice(0, -2))
+        return true;
+    const re = new RegExp(`^${pat.split("*").map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\s\\S]*")}$`);
+    return re.test(cmd);
+}
+//# sourceMappingURL=claude-confine.js.map