@madarco/agentbox 0.11.3 → 0.13.0

package/runtime/relay/bin.cjs

@@ -18036,6 +18036,8 @@ var GH_PR_OPS = [
   "create",
   "view",
   "list",
+  "diff",
+  "checks",
   "comment",
   "review",
   "merge",
@@ -18046,7 +18048,84 @@ var GH_PR_OPS = [
 function isGhPrOp(value) {
   return GH_PR_OPS.includes(value);
 }
-var GH_PR_READ_ONLY_OPS = /* @__PURE__ */ new Set(["view", "list"]);
+var GH_PR_READ_ONLY_OPS = /* @__PURE__ */ new Set([
+  "view",
+  "list",
+  "diff",
+  "checks"
+]);
+var GH_RUN_OPS = ["list", "view", "rerun"];
+function isGhRunOp(value) {
+  return GH_RUN_OPS.includes(value);
+}
+var GH_RUN_READ_ONLY_OPS = /* @__PURE__ */ new Set(["list", "view"]);
+var PR_REVIEW_COMMENT = /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/comments(\?.*)?$/;
+var PR_REVIEW_COMMENT_REPLY = /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/comments\/\d+\/replies(\?.*)?$/;
+var GH_API_WRITE_ALLOWED_ENDPOINTS = [
+  PR_REVIEW_COMMENT,
+  PR_REVIEW_COMMENT_REPLY
+];
+var GH_API_ALLOWED_ENDPOINTS = [...GH_API_WRITE_ALLOWED_ENDPOINTS];
+function isAllowedGhApiEndpoint(endpoint) {
+  return GH_API_ALLOWED_ENDPOINTS.some((re) => re.test(normalizeGhApiEndpoint(endpoint)));
+}
+function isWriteAllowedGhApiEndpoint(endpoint) {
+  return GH_API_WRITE_ALLOWED_ENDPOINTS.some((re) => re.test(normalizeGhApiEndpoint(endpoint)));
+}
+function normalizeGhApiEndpoint(endpoint) {
+  return endpoint.replace(/^\/+/, "");
+}
+var GH_API_ENDPOINT_REFUSAL = {
+  exitCode: 65,
+  stdout: "",
+  stderr: "gh api: endpoint not allowlisted. Proxied: GET on repos/:owner/:repo/pulls/:number/comments (and /:id/replies); POST to those endpoints to add a review comment.\n"
+};
+function refuseGhApiCall(endpoint, args) {
+  const refuse = (reason) => ({
+    exitCode: 65,
+    stdout: "",
+    stderr: `gh api: ${reason}
+`
+  });
+  let explicitMethod = null;
+  let hasFieldFlag = false;
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2] ?? "";
+    if (arg === "-X" || arg === "--method") {
+      explicitMethod = args[i2 + 1] ?? "";
+      i2++;
+      continue;
+    }
+    if (arg.startsWith("--method=")) {
+      explicitMethod = arg.slice("--method=".length);
+      continue;
+    }
+    if (arg.startsWith("-X") && arg.length > 2) {
+      explicitMethod = arg.slice(2).replace(/^=/, "");
+      continue;
+    }
+    if (arg === "--input" || arg.startsWith("--input=")) {
+      return refuse("'--input' (stdin/file body) isn't supported through the relay; use -f/-F fields");
+    }
+    if (arg === "-f" || arg === "-F" || arg === "--field" || arg === "--raw-field") {
+      hasFieldFlag = true;
+      i2++;
+      continue;
+    }
+    if (arg.startsWith("-f") || arg.startsWith("-F") || arg.startsWith("--field=") || arg.startsWith("--raw-field=")) {
+      hasFieldFlag = true;
+    }
+  }
+  const method = (explicitMethod ?? (hasFieldFlag ? "POST" : "GET")).toUpperCase();
+  if (method === "GET") return null;
+  if (method === "POST") {
+    if (isWriteAllowedGhApiEndpoint(endpoint)) return null;
+    return refuse(
+      `POST is only proxied to PR review-comment endpoints (repos/:o/:r/pulls/:n/comments[/:id/replies]), not '${endpoint}'`
+    );
+  }
+  return refuse(`method '${method}' is not proxied \u2014 only GET, and POST to comment endpoints, are allowed`);
+}
 function injectPrCreateHead(op, branch, args) {
   if (op !== "create") return args;
   if (!branch || branch === "HEAD") return args;
@@ -18462,6 +18541,12 @@ async function executeCloudAction(action, deps) {
   if (action.method.startsWith("gh.pr.")) {
     return runGhPrRpc(action, deps);
   }
+  if (action.method.startsWith("gh.run.")) {
+    return runGhRunRpc(action, deps);
+  }
+  if (action.method === "gh.api") {
+    return runGhApiRpc(action, deps);
+  }
   if (action.method === "git.clone" || action.method === "gh.repo.clone") {
     return {
       exitCode: 64,
@@ -18570,6 +18655,66 @@ async function runGhPrRpc(action, deps) {
   if (prCreateNeedsHead(op, finalArgs)) return PR_CREATE_NO_HEAD_REFUSAL;
   return runHostGh(["pr", op, ...finalArgs], lookup.workspacePath);
 }
+async function cloudWriteConfirm(deps, command, cwd, args) {
+  if (!deps.prompts || !deps.subscribers) return null;
+  const ctx = {
+    kind: "confirm",
+    message: `Allow ${command} from cloud box ${deps.boxName ?? deps.boxId}?`,
+    detail: args.join(" ").slice(0, 200),
+    defaultAnswer: "n",
+    context: { command, cwd, argv: args }
+  };
+  const hasSubscriber = deps.subscribers.forBox(deps.boxId).length > 0;
+  if (!hasSubscriber && process.env["AGENTBOX_PROMPT"] !== "off") {
+    const noSubMode = (process.env["AGENTBOX_GH_NO_SUB"] ?? "deny").toLowerCase();
+    if (noSubMode === "deny") {
+      return {
+        exitCode: 10,
+        stdout: "",
+        stderr: "denied automatically \u2014 no attached wrapper to confirm. Attach `agentbox claude` (or similar) and retry, or set AGENTBOX_GH_NO_SUB=allow.\n"
+      };
+    }
+    if (noSubMode === "allow") {
+      deps.log?.(`${command} auto-approved (no subscribers, AGENTBOX_GH_NO_SUB=allow)`);
+      return null;
+    }
+    const verdict2 = await askPrompt(deps.prompts, deps.subscribers, deps.boxId, ctx, {
+      ttlMs: 5 * 60 * 1e3
+    });
+    return verdict2.answer === "y" ? null : { exitCode: 10, stdout: "", stderr: "denied by user\n" };
+  }
+  const verdict = await askPrompt(deps.prompts, deps.subscribers, deps.boxId, ctx);
+  return verdict.answer === "y" ? null : { exitCode: 10, stdout: "", stderr: "denied by user\n" };
+}
+async function runGhRunRpc(action, deps) {
+  const op = action.method.slice("gh.run.".length);
+  if (!isGhRunOp(op)) {
+    return { exitCode: 64, stdout: "", stderr: `unknown gh.run.* op: ${op}
+` };
+  }
+  const params = action.params ?? {};
+  const args = Array.isArray(params.args) ? params.args.filter((a2) => typeof a2 === "string") : [];
+  const ghReady = await assertGhReady();
+  if (ghReady) return ghReady;
+  const lookup = await lookupCloudBox(deps.boxId);
+  if (!GH_RUN_READ_ONLY_OPS.has(op)) {
+    const denied = await cloudWriteConfirm(deps, `gh run ${op}`, params.path, args);
+    if (denied) return denied;
+  }
+  return runHostGh(["run", op, ...args], lookup.workspacePath);
+}
+async function runGhApiRpc(action, deps) {
+  const params = action.params ?? {};
+  const endpoint = typeof params.endpoint === "string" ? params.endpoint : "";
+  if (!isAllowedGhApiEndpoint(endpoint)) return GH_API_ENDPOINT_REFUSAL;
+  const args = Array.isArray(params.args) ? params.args.filter((a2) => typeof a2 === "string") : [];
+  const callRefusal = refuseGhApiCall(endpoint, args);
+  if (callRefusal) return callRefusal;
+  const ghReady = await assertGhReady();
+  if (ghReady) return ghReady;
+  const lookup = await lookupCloudBox(deps.boxId);
+  return runHostGh(["api", endpoint, ...args], lookup.workspacePath);
+}
 async function runBrowserOpenMirror(action, deps) {
   const params = action.params ?? {};
   const url = typeof params.url === "string" ? params.url.trim() : "";
@@ -19506,6 +19651,29 @@ function createRelayServer(opts) {
         send(res, status, result);
         return;
       }
+      if (body.method.startsWith("gh.run.")) {
+        const op = body.method.slice("gh.run.".length);
+        if (!isGhRunOp(op)) {
+          send(res, 400, { error: `unknown gh.run.* op: ${op}` });
+          return;
+        }
+        const result = await handleGhRunRpc(
+          op,
+          reg,
+          body.params,
+          prompts,
+          subscribers
+        );
+        const status = result.exitCode === 0 ? 200 : 500;
+        send(res, status, result);
+        return;
+      }
+      if (body.method === "gh.api") {
+        const result = await handleGhApiRpc(reg, body.params);
+        const status = result.exitCode === 0 ? 200 : 500;
+        send(res, status, result);
+        return;
+      }
       if (body.method === "git.clone" || body.method === "gh.repo.clone") {
         send(res, 501, {
           exitCode: 64,
@@ -19983,6 +20151,53 @@ async function handleGhPrRpc(op, reg, params, prompts, subscribers, hostInitiate
   if (prCreateNeedsHead(op, finalArgs)) return PR_CREATE_NO_HEAD_REFUSAL;
   return runHostGh(["pr", op, ...finalArgs], worktree.hostMainRepo);
 }
+async function handleGhRunRpc(op, reg, params, prompts, subscribers) {
+  const containerPath = params?.path ?? "/workspace";
+  const worktree = resolveWorktree(reg, containerPath);
+  if (!worktree) {
+    return {
+      exitCode: 64,
+      stdout: "",
+      stderr: `no worktree registered for box ${reg.boxId} matching ${containerPath}`
+    };
+  }
+  const ghReady = await assertGhReady();
+  if (ghReady) return ghReady;
+  const args = Array.isArray(params?.args) ? params.args.filter((a2) => typeof a2 === "string") : [];
+  if (!GH_RUN_READ_ONLY_OPS.has(op)) {
+    const detail = args.join(" ").slice(0, 200);
+    const verdict = await askPrompt(prompts, subscribers, reg.boxId, {
+      kind: "confirm",
+      message: `Allow gh run ${op} from box ${reg.name}?`,
+      detail,
+      defaultAnswer: "n",
+      context: { command: `gh run ${op}`, cwd: containerPath, argv: args }
+    });
+    if (verdict.answer !== "y") {
+      return { exitCode: 10, stdout: "", stderr: "denied by user\n" };
+    }
+  }
+  return runHostGh(["run", op, ...args], worktree.hostMainRepo);
+}
+async function handleGhApiRpc(reg, params) {
+  const containerPath = params?.path ?? "/workspace";
+  const worktree = resolveWorktree(reg, containerPath);
+  if (!worktree) {
+    return {
+      exitCode: 64,
+      stdout: "",
+      stderr: `no worktree registered for box ${reg.boxId} matching ${containerPath}`
+    };
+  }
+  const endpoint = typeof params?.endpoint === "string" ? params.endpoint : "";
+  if (!isAllowedGhApiEndpoint(endpoint)) return GH_API_ENDPOINT_REFUSAL;
+  const args = Array.isArray(params?.args) ? params.args.filter((a2) => typeof a2 === "string") : [];
+  const callRefusal = refuseGhApiCall(endpoint, args);
+  if (callRefusal) return callRefusal;
+  const ghReady = await assertGhReady();
+  if (ghReady) return ghReady;
+  return runHostGh(["api", endpoint, ...args], worktree.hostMainRepo);
+}
 async function handleCpRpc(reg, method, params) {
   const entry = process.env.AGENTBOX_CLI_ENTRY;
   if (!entry) {
@@ -20110,13 +20325,23 @@ var BUILT_IN_DEFAULTS = {
     defaultCheckpointDaytona: "",
     defaultCheckpointHetzner: "",
     defaultCheckpointVercel: "",
+    size: "",
+    sizeDocker: "",
+    sizeDaytona: "",
+    sizeHetzner: "",
+    sizeVercel: "",
     withPlaywright: false,
     withEnv: false,
+    resyncOnStart: true,
     vnc: true,
     isolateClaudeConfig: false,
     isolateCodexConfig: false,
     isolateOpencodeConfig: false,
     image: "agentbox/box:dev",
+    imageDocker: "",
+    imageDaytona: "",
+    imageHetzner: "",
+    imageVercel: "",
     // Mirrors BOX_IMAGE_REGISTRY in @agentbox/sandbox-docker. Empty disables the
     // registry pull (always build the docker base image locally).
     imageRegistry: "ghcr.io/madarco/agentbox/box",
@@ -20145,7 +20370,8 @@ var BUILT_IN_DEFAULTS = {
     sessionName: "opencode"
   },
   attach: {
-    openIn: "split"
+    openIn: "split",
+    cmuxStatus: true
   },
   code: {
     ide: "auto",
@@ -20234,6 +20460,35 @@ var KEY_REGISTRY = [
     description: "Per-provider override of `box.defaultCheckpoint` for vercel. Wins over the global when set; set via `agentbox checkpoint set-default --provider vercel`.",
     advanced: true
   },
+  {
+    key: "box.size",
+    type: "string",
+    description: "Default VM size for cloud providers. Provider-interpreted: hetzner = server type (e.g. `cx33`); daytona = `cpu-memory-disk` GB (e.g. `4-8-20`). Used as fallback when no per-provider override is set. Docker/Vercel ignore it."
+  },
+  {
+    key: "box.sizeDocker",
+    type: "string",
+    description: "Per-provider override of `box.size` for docker. Reserved \u2014 docker sizing is controlled via `box.memory` / `box.cpus` / `box.disk`.",
+    advanced: true
+  },
+  {
+    key: "box.sizeDaytona",
+    type: "string",
+    description: "Per-provider override of `box.size` for daytona. `cpu-memory-disk` GB spec (e.g. `4-8-20`). Only honored on the image/Dockerfile create path; Daytona rejects custom resources on snapshot-resume.",
+    advanced: true
+  },
+  {
+    key: "box.sizeHetzner",
+    type: "string",
+    description: "Per-provider override of `box.size` for hetzner. Server type string (e.g. `cx23`, `cx33`, `cx43`).",
+    advanced: true
+  },
+  {
+    key: "box.sizeVercel",
+    type: "string",
+    description: "Per-provider override of `box.size` for vercel. Reserved \u2014 vercel sizing is controlled via `box.vercelVcpus`.",
+    advanced: true
+  },
   {
     key: "checkpoint.maxLayers",
     type: "int",
@@ -20250,6 +20505,11 @@ var KEY_REGISTRY = [
     type: "bool",
     description: "Copy host env/config files (.env*, secrets.toml, agentbox.yaml, ...) into /workspace at box create time (gitignore-bypassing)."
   },
+  {
+    key: "box.resyncOnStart",
+    type: "bool",
+    description: "Merge the host's current branch into the box and overlay the host's uncommitted/untracked changes when starting an agent session (keeps the box's version on conflict and warns the agent)."
+  },
   {
     key: "box.vnc",
     type: "bool",
@@ -20273,7 +20533,31 @@ var KEY_REGISTRY = [
   {
     key: "box.image",
     type: "string",
-    description: "Box image ref (advanced).",
+    description: "Generic box image ref (fallback). Used as fallback when no per-provider override is set; the default `agentbox/box:dev` is treated as a sentinel by cloud backends (boot from their prepared base snapshot instead).",
+    advanced: true
+  },
+  {
+    key: "box.imageDocker",
+    type: "string",
+    description: "Per-provider override of `box.image` for docker (local docker image ref, e.g. `agentbox/box:dev`). Wins over the generic when set.",
+    advanced: true
+  },
+  {
+    key: "box.imageDaytona",
+    type: "string",
+    description: "Per-provider override of `box.image` for daytona (named snapshot, e.g. `agentbox-base-<fingerprint>`). Written by `agentbox prepare --provider daytona`.",
+    advanced: true
+  },
+  {
+    key: "box.imageHetzner",
+    type: "string",
+    description: "Per-provider override of `box.image` for hetzner (image description, e.g. `agentbox-base-<fingerprint>`). Written by `agentbox prepare --provider hetzner`.",
+    advanced: true
+  },
+  {
+    key: "box.imageVercel",
+    type: "string",
+    description: "Per-provider override of `box.image` for vercel (snapshot id, e.g. `snap_\u2026`). Written by `agentbox prepare --provider vercel`.",
     advanced: true
   },
   {
@@ -20357,7 +20641,12 @@ var KEY_REGISTRY = [
     key: "attach.openIn",
     type: "enum",
     enumValues: ["split", "window", "tab", "same"],
-    description: "Where `agentbox claude|codex|opencode` opens the attached session when run from tmux or iTerm2: `split` (tmux split-window / iTerm2 vertical split, default), `window` (tmux new-window / new iTerm2 window), `tab` (tmux new-window / new iTerm2 tab), or `same` (attach inline in the current terminal). Outside tmux/iTerm2 every value behaves like `same`."
+    description: "Where `agentbox claude|codex|opencode` opens the attached session when run from tmux, cmux, or iTerm2: `split` (tmux split-window / cmux new-split / iTerm2 vertical split, default \u2014 same workspace), `window` (tmux new-window / cmux new-workspace / new iTerm2 window), `tab` (tmux new-window / cmux new-surface tab in the current pane, same workspace / new iTerm2 tab), or `same` (attach inline in the current terminal). Outside tmux/cmux/iTerm2 every value behaves like `same`."
+  },
+  {
+    key: "attach.cmuxStatus",
+    type: "bool",
+    description: "When attached inside cmux, reflect the box agent's live activity on its cmux workspace (colour + description: blue=working, amber=needs input, idle clears; restored on detach) and, when the agent needs input, flag the box's own tab via a cmux notification (tab badge + reorder + desktop notification) so it stands out among sibling tabs. cmux only; no-op in other terminals."
   },
   {
     key: "code.ide",