@prismatic-io/lux 0.0.2-preview.3 → 0.0.2-preview.32

package/src/drivers/claude-code/isolation.ts

@@ -0,0 +1,228 @@
+import { mkdir, readdir, realpath, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve, sep } from "node:path";
+import type { StartContext } from "../../core/index.js";
+import type { ClaudeCodeDriverConfig } from "./index.js";
+
+const isWithin = (parent: string, child: string): boolean =>
+  child === parent || child.startsWith(`${parent}${sep}`);
+
+const permissionPath = (tool: "Edit" | "Read", path: string, directory: boolean): string => {
+  const absolute = resolve(path).replaceAll("\\", "/");
+  return `${tool}(//${absolute.replace(/^\/+/, "")}${directory ? "/**" : ""})`;
+};
+
+/**
+ * Permission rules have no "allow inside deny" override, so isolate a root by
+ * denying every sibling around explicitly allowed descendants.
+ */
+const carvedPermissionDenials = async (
+  tool: "Edit" | "Read",
+  root: string,
+  allowed: readonly string[],
+): Promise<string[]> => {
+  const normalizedRoot = resolve(root);
+  const inside = allowed
+    .map((path) => resolve(path))
+    .filter((path) => isWithin(normalizedRoot, path));
+  if (inside.some((path) => path === normalizedRoot)) return [];
+  if (inside.length === 0) {
+    const metadata = await stat(normalizedRoot);
+    return [permissionPath(tool, normalizedRoot, metadata.isDirectory())];
+  }
+
+  const out: string[] = [];
+  const walk = async (dir: string): Promise<void> => {
+    const entries = await readdir(dir, { withFileTypes: true });
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const path = join(dir, entry.name);
+      if (inside.some((allowedPath) => allowedPath === path)) continue;
+      if (entry.isDirectory() && inside.some((allowedPath) => isWithin(path, allowedPath))) {
+        await walk(path);
+      } else {
+        out.push(permissionPath(tool, path, entry.isDirectory()));
+      }
+    }
+  };
+  await walk(normalizedRoot);
+  return out;
+};
+
+export const carvedReadDenials = (root: string, allowed: readonly string[]): Promise<string[]> =>
+  carvedPermissionDenials("Read", root, allowed);
+
+const existingRealpaths = async (paths: readonly string[]): Promise<string[]> => {
+  const found = await Promise.all(
+    paths.map(async (path) => {
+      try {
+        return await realpath(resolve(path));
+      } catch {
+        return null;
+      }
+    }),
+  );
+  return [...new Set(found.filter((path): path is string => path !== null))];
+};
+
+const compactRoots = (paths: readonly string[]): string[] =>
+  [...new Set(paths)]
+    .sort((a, b) => a.length - b.length || a.localeCompare(b))
+    .filter((path, index, roots) => !roots.slice(0, index).some((root) => isWithin(root, path)));
+
+export const isolatedLaunch = async (
+  config: ClaudeCodeDriverConfig,
+  ctx: StartContext,
+  workspace: string,
+  controlDir: string,
+): Promise<{ env: Record<string, string>; settings: object }> => {
+  const homeRoots = await existingRealpaths([
+    homedir(),
+    ...(config.env?.HOME ? [config.env.HOME] : []),
+  ]);
+  const sensitiveHomePaths = homeRoots.flatMap((home) => [
+    join(home, ".aws"),
+    join(home, ".claude.json"),
+    join(home, ".claude", ".credentials.json"),
+    join(home, ".config", "gcloud"),
+    join(home, ".docker", "config.json"),
+    join(home, ".git-credentials"),
+    join(home, ".gnupg"),
+    join(home, ".kube"),
+    join(home, ".netrc"),
+    join(home, ".npmrc"),
+    join(home, ".ssh"),
+    ...[
+      ".bash_profile",
+      ".bash_login",
+      ".bashrc",
+      ".bash_aliases",
+      ".profile",
+      ".zshenv",
+      ".zprofile",
+      ".zshrc",
+      ".zlogin",
+    ].map((name) => join(home, name)),
+  ]);
+  const stateDir = join(workspace, ".lux-claude");
+  const configDir = join(controlDir, "config");
+  await mkdir(configDir, { recursive: true });
+  // An empty override preserves the CLI's default, unhashed Keychain service.
+  const authConfigOverride =
+    config.env?.CLAUDE_SECURESTORAGE_CONFIG_DIR ??
+    process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR ??
+    config.env?.CLAUDE_CONFIG_DIR ??
+    process.env.CLAUDE_CONFIG_DIR ??
+    "";
+  const authConfigDir = authConfigOverride || join(config.env?.HOME ?? homedir(), ".claude");
+  const cleanShell = process.platform === "win32" ? undefined : join(controlDir, "clean-bash");
+  if (cleanShell)
+    await writeFile(
+      cleanShell,
+      '#!/bin/sh\nunset BASH_ENV ENV\nexec /bin/bash --noprofile --norc "$@"\n',
+      { mode: 0o700 },
+    );
+  const protectedRoots = await existingRealpaths([
+    ...(config.interactionMode === "defer-resume" ? [configDir, authConfigDir] : []),
+    ctx.runDir,
+    ...(ctx.runsRoot ? [ctx.runsRoot] : []),
+    ...(process.env.CLAUDE_CONFIG_DIR ? [process.env.CLAUDE_CONFIG_DIR] : []),
+    ...(config.env?.CLAUDE_CONFIG_DIR ? [config.env.CLAUDE_CONFIG_DIR] : []),
+    ...(process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR
+      ? [process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR]
+      : []),
+    ...(config.env?.CLAUDE_SECURESTORAGE_CONFIG_DIR
+      ? [config.env.CLAUDE_SECURESTORAGE_CONFIG_DIR]
+      : []),
+    ...sensitiveHomePaths,
+    ...(config.isolation?.denyRead ?? []),
+    ...homeRoots.flatMap((home) => [
+      join(home, ".claude", "projects"),
+      join(home, ".claude", "memory"),
+    ]),
+  ]);
+  const denyRoots = compactRoots(protectedRoots);
+  const allowed = compactRoots(
+    await existingRealpaths([
+      ...(cleanShell ? [cleanShell] : []),
+      ...(config.pluginDirs ?? []),
+      ...(config.addDirs ?? []),
+      ...(config.isolation?.allowRead ?? []),
+    ]),
+  );
+  const overlapping = allowed.find(
+    (path) =>
+      (path !== workspace && isWithin(path, workspace)) ||
+      denyRoots.some((root) => isWithin(path, root)) ||
+      protectedRoots.some((root) => isWithin(root, path)),
+  );
+  if (overlapping) {
+    throw new Error(`isolation read carve-out overlaps a protected boundary: ${overlapping}`);
+  }
+  const readOnlyRoots = allowed.filter((path) => !isWithin(workspace, path));
+  const editDenyRoots = compactRoots([...denyRoots, ...readOnlyRoots, controlDir]);
+  const [readDenials, writeDenials] = await Promise.all([
+    Promise.all(denyRoots.map((root) => carvedPermissionDenials("Read", root, allowed))),
+    Promise.all(editDenyRoots.map((root) => carvedPermissionDenials("Edit", root, []))),
+  ]);
+  const denyRules = [...readDenials.flat(), ...writeDenials.flat()];
+  const sandboxSettings = {
+    disableAllHooks: true,
+    permissions: { deny: denyRules },
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      filesystem: {
+        denyRead: denyRoots,
+        denyWrite: [...denyRoots, controlDir],
+        allowRead: allowed,
+      },
+      // Filesystem isolation does not disable the live docs and package
+      // registry access that cases are intended to exercise.
+      network: { allowedDomains: ["*"] },
+    },
+  };
+  const tmpDir = join(stateDir, "tmp");
+  const cacheDir = join(stateDir, "cache");
+  const pluginCacheDir = join(stateDir, "plugins");
+  await Promise.all([
+    mkdir(tmpDir, { recursive: true }),
+    mkdir(cacheDir, { recursive: true }),
+    mkdir(pluginCacheDir, { recursive: true }),
+  ]);
+  return {
+    settings: sandboxSettings,
+    env: {
+      ...(config.env ?? {}),
+      ...(config.interactionMode === "defer-resume"
+        ? {
+            CLAUDE_CONFIG_DIR: configDir,
+            CLAUDE_SECURESTORAGE_CONFIG_DIR: authConfigOverride,
+          }
+        : {}),
+      ...(cleanShell ? { CLAUDE_CODE_SHELL: cleanShell } : {}),
+      // Hook shells launch outside the subject sandbox; clear their startup inputs too.
+      BASH_ENV: "",
+      ENV: "",
+      ZDOTDIR: controlDir,
+      CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1",
+      CLAUDE_CODE_DISABLE_CLAUDE_MDS: "1",
+      // The CLI checks presence, not boolean parsing: "0" still disables resume.
+      CLAUDE_CODE_SKIP_PROMPT_HISTORY: config.interactionMode === "defer-resume" ? "" : "1",
+      ...(config.interactionMode === "defer-resume"
+        ? { CLAUDE_CODE_FORCE_SESSION_PERSISTENCE: "1" }
+        : {}),
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1",
+      CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1",
+      CLAUDE_CODE_AUTO_CONNECT_IDE: "false",
+      CLAUDE_CODE_PLUGIN_CACHE_DIR: pluginCacheDir,
+      CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL: "1",
+      DISABLE_AUTOUPDATER: "1",
+      TMPDIR: tmpDir,
+      XDG_CACHE_HOME: cacheDir,
+      npm_config_cache: join(cacheDir, "npm"),
+      BUN_INSTALL_CACHE_DIR: join(cacheDir, "bun"),
+    },
+  };
+};

package/src/drivers/claude-code/parse-events.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import {
+  type AgentAttribution,
   type Interrupt,
   type ParsedDriverEvent,
   parseAgentUsage,
@@ -8,6 +9,39 @@ import {
   toolResultProgress,
 } from "../../core/index.js";
 
+const claudeAgent = (parentToolUseId?: string): AgentAttribution =>
+  parentToolUseId
+    ? {
+        id: `claude-code:${parentToolUseId}`,
+        role: "subagent",
+        parentId: "claude-code",
+        spawnToolUseId: parentToolUseId,
+      }
+    : { id: "claude-code", role: "main" };
+
+const isSubagentTool = (name: string): boolean => name === "Agent" || name === "Task";
+
+const spawnedClaudeAgent = (
+  toolUseId: string,
+  input: unknown,
+  parentToolUseId?: string,
+): AgentAttribution => {
+  const details =
+    typeof input === "object" && input !== null ? (input as Record<string, unknown>) : {};
+  const name = [details.name, details.subagent_type, details.agent, details.role].find(
+    (value): value is string => typeof value === "string" && value.length > 0,
+  );
+  const model = typeof details.model === "string" && details.model ? details.model : undefined;
+  return {
+    id: `claude-code:${toolUseId}`,
+    role: "subagent",
+    parentId: claudeAgent(parentToolUseId).id,
+    spawnToolUseId: toolUseId,
+    ...(name ? { name } : {}),
+    ...(model ? { model } : {}),
+  };
+};
+
 const ContentBlockSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal("text"), text: z.string() }),
   z.object({ type: z.literal("tool_use"), id: z.string(), name: z.string(), input: z.unknown() }),
@@ -88,6 +122,7 @@ type PendingTurn = {
   asked: boolean;
   thought: boolean;
   text?: string;
+  agent: AgentAttribution;
 };
 
 type AssistantContent = {
@@ -96,6 +131,7 @@ type AssistantContent = {
   asked: boolean;
   thought: boolean;
   firstText?: string;
+  agent: AgentAttribution;
 };
 
 const questionTextOf = (raw: unknown): string =>
@@ -225,6 +261,30 @@ class ClaudeEventParser {
       if (!block) continue;
       events.push(block);
       if (block.tag !== "progress") continue;
+      const resultPayload = block.progress.payload as {
+        name?: unknown;
+        toolUseId?: unknown;
+        isError?: unknown;
+      };
+      if (
+        typeof resultPayload.name === "string" &&
+        isSubagentTool(resultPayload.name) &&
+        typeof resultPayload.toolUseId === "string"
+      ) {
+        events.push({
+          tag: "progress",
+          progress: {
+            id: `agent-completed-${resultPayload.toolUseId}`,
+            kind: "agent-completed",
+            payload: {
+              agentId: `claude-code:${resultPayload.toolUseId}`,
+              status: resultPayload.isError === true ? "failed" : "completed",
+            },
+            agent: claudeAgent(),
+            ts: block.progress.ts,
+          },
+        });
+      }
       const text = (block.progress.payload as { text?: unknown }).text;
       const failure = typeof text === "string" ? toolInfrastructureFailure(text) : null;
       if (failure) {
@@ -244,20 +304,21 @@ class ClaudeEventParser {
 
     const toolUseId = block.tool_use_id;
     const content = block.content ?? [];
+    const progress = toolResultProgress(
+      this.eventSequence++,
+      {
+        name: this.toolNames.get(toolUseId) ?? "unknown",
+        toolUseId,
+        content,
+        isError: block.is_error === true,
+        text: toolResultText(content),
+        ...(parentToolUseId ? { parentToolUseId } : {}),
+      },
+      Date.now(),
+    );
     return {
       tag: "progress",
-      progress: toolResultProgress(
-        this.eventSequence++,
-        {
-          name: this.toolNames.get(toolUseId) ?? "unknown",
-          toolUseId,
-          content,
-          isError: block.is_error === true,
-          text: toolResultText(content),
-          ...(parentToolUseId ? { parentToolUseId } : {}),
-        },
-        Date.now(),
-      ),
+      progress: { ...progress, agent: claudeAgent(parentToolUseId) },
     };
   }
 
@@ -284,6 +345,7 @@ class ClaudeEventParser {
       tools: [],
       asked: false,
       thought: false,
+      agent: claudeAgent(event.parent_tool_use_id),
     };
     for (const rawBlock of event.message.content) {
       const block = ContentBlockSchema.safeParse(rawBlock).data;
@@ -323,6 +385,7 @@ class ClaudeEventParser {
         kind: "agent-message",
         payload: { text, ...(parentToolUseId ? { parentToolUseId } : {}) },
         ts: Date.now(),
+        agent: claudeAgent(parentToolUseId),
       },
     });
   }
@@ -354,8 +417,29 @@ class ClaudeEventParser {
           ...(parentToolUseId ? { parentToolUseId } : {}),
         },
         ts: Date.now(),
+        agent: claudeAgent(parentToolUseId),
       },
     });
+    if (isSubagentTool(block.name)) {
+      const agent = spawnedClaudeAgent(block.id, block.input, parentToolUseId);
+      const details =
+        typeof block.input === "object" && block.input !== null
+          ? (block.input as Record<string, unknown>)
+          : {};
+      content.events.push({
+        tag: "progress",
+        progress: {
+          id: `agent-spawn-${block.id}`,
+          kind: "agent-spawn",
+          payload: {
+            agent,
+            ...(typeof details.prompt === "string" ? { prompt: details.prompt } : {}),
+          },
+          agent: claudeAgent(parentToolUseId),
+          ts: Date.now(),
+        },
+      });
+    }
   }
 
   private recordTurn(
@@ -376,6 +460,7 @@ class ClaudeEventParser {
       tools: [],
       asked: false,
       thought: false,
+      agent: content.agent,
     };
     this.pendingTurn.usage = usage;
     this.pendingTurn.asked ||= content.asked;
@@ -451,6 +536,7 @@ class ClaudeEventParser {
         kind: "usage",
         payload: { ...this.pendingTurn.usage, ...(label ? { label } : {}) },
         ts: Date.now(),
+        agent: this.pendingTurn.agent,
       },
     };
     this.pendingTurn = null;

package/src/drivers/codex/app-events.ts

@@ -1,5 +1,7 @@
 import {
+  type AgentAttribution,
   type ParsedDriverEvent,
+  type Progress,
   type TokenUsage,
   TURN_GLYPHS,
   toolResultProgress,
@@ -20,8 +22,108 @@ const resultText = (content: unknown): string => {
     .join("\n");
 };
 
+const agentCompletionStatus = (status: unknown): "completed" | "failed" | "cancelled" | null => {
+  if (status === "completed") return "completed";
+  if (status === "errored") return "failed";
+  if (status === "shutdown" || status === "interrupted") return "cancelled";
+  return null;
+};
+
+export const appAgentLifecycleProgress = (
+  item: RpcRecord,
+  phase: "started" | "completed",
+  actor?: AgentAttribution,
+  ts = Date.now(),
+): Progress[] => {
+  if (item.type !== "collabAgentToolCall" || typeof item.id !== "string") return [];
+  const receiverThreadIds = Array.isArray(item.receiverThreadIds)
+    ? item.receiverThreadIds.filter((value): value is string => typeof value === "string")
+    : [];
+  if (phase !== "completed") return [];
+  const states = asRecord(item.agentsStates);
+  return receiverThreadIds.flatMap((receiverThreadId): Progress[] => {
+    const events: Progress[] = [];
+    if (item.tool === "spawnAgent" && item.status === "completed") {
+      events.push({
+        id: `agent-spawn-${item.id}-${receiverThreadId}`,
+        kind: "agent-spawn",
+        payload: {
+          agent: {
+            id: receiverThreadId,
+            role: "subagent",
+            parentId: actor?.id ?? "codex",
+            spawnToolUseId: item.id as string,
+            ...(typeof item.model === "string" ? { model: item.model } : {}),
+          },
+          ...(typeof item.prompt === "string" ? { prompt: item.prompt } : {}),
+        },
+        ...(actor ? { agent: actor } : {}),
+        ts,
+      });
+    }
+    const status = agentCompletionStatus(asRecord(states?.[receiverThreadId])?.status);
+    if (status) {
+      events.push({
+        id: `agent-completed-${item.id}-${receiverThreadId}`,
+        kind: "agent-completed",
+        payload: { agentId: receiverThreadId, status },
+        ...(actor ? { agent: actor } : {}),
+        ts,
+      });
+    }
+    return events;
+  });
+};
+
 export type RpcId = string | number;
 export type RpcRecord = Record<string, unknown>;
+
+export class CodexSubagentTracker {
+  private readonly spawnToolByThread = new Map<string, string>();
+  private readonly parentAgentByThread = new Map<string, string>();
+
+  record(
+    item: RpcRecord | null,
+    spawningThreadId: string | undefined,
+    mainThreadId: string | null,
+  ): void {
+    if (
+      item?.type !== "collabAgentToolCall" ||
+      item.tool !== "spawnAgent" ||
+      typeof item.id !== "string"
+    )
+      return;
+    const receiverThreadIds = Array.isArray(item.receiverThreadIds)
+      ? item.receiverThreadIds.filter((value): value is string => typeof value === "string")
+      : [];
+    for (const receiverThreadId of receiverThreadIds) {
+      this.spawnToolByThread.set(receiverThreadId, item.id);
+      if (spawningThreadId) {
+        this.parentAgentByThread.set(
+          receiverThreadId,
+          spawningThreadId === mainThreadId ? "codex" : spawningThreadId,
+        );
+      }
+    }
+  }
+
+  attribution(
+    threadId: string | undefined,
+    mainThreadId: string | null,
+  ): AgentAttribution | undefined {
+    if (!threadId) return undefined;
+    const spawnToolUseId = this.spawnToolByThread.get(threadId);
+    if (!spawnToolUseId) {
+      return { id: threadId === mainThreadId ? "codex" : threadId, role: "main" };
+    }
+    return {
+      id: threadId,
+      role: "subagent",
+      parentId: this.parentAgentByThread.get(threadId) ?? mainThreadId ?? "codex",
+      spawnToolUseId,
+    };
+  }
+}
 export type AppTurnFacets = {
   tools: string[];
   asked: boolean;
@@ -131,8 +233,10 @@ const appItemResultText = (item: RpcRecord, error: RpcRecord | null, content: un
 export const appItemProgress = (
   item: RpcRecord,
   phase: "started" | "completed",
-  parentToolUseId?: string,
+  attribution?: AgentAttribution | string,
 ): ParsedDriverEvent | null => {
+  const agent = typeof attribution === "string" ? undefined : attribution;
+  const parentToolUseId = typeof attribution === "string" ? attribution : agent?.spawnToolUseId;
   const id = typeof item.id === "string" ? item.id : `${String(item.type)}-${Date.now()}`;
   if (item.type === "agentMessage" && phase === "completed" && typeof item.text === "string") {
     return {
@@ -142,6 +246,7 @@ export const appItemProgress = (
         kind: "agent-message",
         payload: { text: item.text, ...(parentToolUseId ? { parentToolUseId } : {}) },
         ts: Date.now(),
+        ...(agent ? { agent } : {}),
       },
     };
   }
@@ -162,6 +267,7 @@ export const appItemProgress = (
           ...(parentToolUseId ? { parentToolUseId } : {}),
         },
         ts: Date.now(),
+        ...(agent ? { agent } : {}),
       },
     };
   }
@@ -184,6 +290,7 @@ export const appItemProgress = (
           ...(parentToolUseId ? { parentToolUseId } : {}),
         },
         ts: Date.now(),
+        ...(agent ? { agent } : {}),
       },
     };
   }
@@ -199,20 +306,23 @@ export const appItemProgress = (
     error !== null;
   return {
     tag: "progress",
-    progress: toolResultProgress(
-      0,
-      {
-        name: tool,
-        toolUseId: id,
-        content,
-        ...(asRecord(structuredContent)
-          ? { structuredContent: asRecord(structuredContent) ?? {} }
-          : {}),
-        isError,
-        text: appItemResultText(item, error, content),
-        ...(parentToolUseId ? { parentToolUseId } : {}),
-      },
-      Date.now(),
-    ),
+    progress: {
+      ...toolResultProgress(
+        0,
+        {
+          name: tool,
+          toolUseId: id,
+          content,
+          ...(asRecord(structuredContent)
+            ? { structuredContent: asRecord(structuredContent) ?? {} }
+            : {}),
+          isError,
+          text: appItemResultText(item, error, content),
+          ...(parentToolUseId ? { parentToolUseId } : {}),
+        },
+        Date.now(),
+      ),
+      ...(agent ? { agent } : {}),
+    },
   };
 };