@ravefox/space 0.2.1 → 0.4.0

package/src/lib/windows-command.js

@@ -1,393 +0,0 @@
-// Launching an npm-installed CLI (claude, codex) on native Windows, without a
-// shell (#2141).
-//
-// Two things stand between `spawn('codex', args)` and a running Codex on
-// Windows. libuv's PATH search tries only the bare name plus `.com` and
-// `.exe`, so the `codex.cmd` npm writes is ENOENT. And Node >= 18.20.2 /
-// 20.12.2 refuses to spawn a `.cmd`/`.bat` without `shell: true` (EINVAL,
-// CVE-2024-27980). `shell: true` is not an option here: the prompt is pod
-// content, so it is untrusted, and it travels as an argv element. cmd.exe
-// would parse it (a command-injection path for anyone who can post in the
-// pod) and would cap the whole command line at 8191 characters.
-//
-// So the shim is read, never run. npm's cmd-shim writes one of a few fixed
-// shapes, each naming the real target relative to the shim's own folder
-// (`%dp0%` / `%~dp0`). A JS target runs as `node <script>`, an `.exe` target
-// runs as itself; anything else is refused with a reason, never handed to a
-// shell. On every other platform this module is a passthrough.
-
-import { spawnSync as realSpawnSync } from 'child_process';
-import { existsSync as realExistsSync, readFileSync as realReadFileSync } from 'fs';
-import { win32 } from 'path';
-
-const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
-const BINARY_EXTS = new Set(['.exe', '.com']);
-const SHIM_EXTS = new Set(['.cmd', '.bat']);
-const SCRIPT_EXTS = new Set(['.js', '.mjs', '.cjs']);
-
-// `%dp0%\…` (cmd-shim >= 4, where `dp0` is SET from `%~dp0` in a subroutine)
-// and `%~dp0\…` (cmd-shim <= 3). `%~dp0` already ends in a backslash, so the
-// separator after it is optional.
-const DP0_PREFIX = /^%(?:~dp0|dp0%)\\?/i;
-
-// A flag the shim passes before the script (from the script's shebang line,
-// e.g. `#!/usr/bin/env node --no-warnings`). Only plain tokens are accepted:
-// nothing a batch file would expand or redirect.
-const SAFE_SHIM_ARG = /^[A-Za-z0-9_.=:/+,-]+$/;
-
-const SEPARATORS = new Set(['&', '&&', '|', '||']);
-
-const extOf = (file) => win32.extname(file).toLowerCase();
-
-// Windows environment keys are case-insensitive, but a copied env object is
-// not: `{ ...process.env, PATH }` can carry both `Path` and `PATH`. Read
-// `Path` first (the casing Windows itself uses), then `PATH`, then any other
-// casing, and drop duplicates.
-// A relative entry (`.`, `bin`) names a folder relative to the working
-// directory the child is spawned in, as Windows reads it there. Given `cwd`,
-// it is resolved against that, never against this process's own directory.
-const pathEntries = (env = {}, cwd) => {
-  const keys = Object.keys(env).filter((key) => key.toLowerCase() === 'path');
-  const rank = (key) => (key === 'Path' ? 0 : key === 'PATH' ? 1 : 2);
-  keys.sort((a, b) => rank(a) - rank(b));
-  const seen = new Set();
-  const entries = [];
-  for (const key of keys) {
-    for (const raw of String(env[key] || '').split(';')) {
-      const entry = raw.trim().replace(/^"(.*)"$/, '$1');
-      const dir = entry && cwd && !win32.isAbsolute(entry) ? win32.resolve(cwd, entry) : entry;
-      if (!dir || seen.has(dir.toLowerCase())) continue;
-      seen.add(dir.toLowerCase());
-      entries.push(dir);
-    }
-  }
-  return entries;
-};
-
-const pathExtensions = (env = {}) => {
-  const key = Object.keys(env).find((k) => k.toLowerCase() === 'pathext');
-  const raw = (key && env[key]) || DEFAULT_PATHEXT;
-  return String(raw).split(';').map((ext) => ext.trim()).filter((ext) => ext.startsWith('.'));
-};
-
-// Split one batch line into tokens: a "quoted string" or a run of
-// non-space characters. Quotes are kept as a flag, not in the value.
-const tokenize = (line) => {
-  const tokens = [];
-  const re = /"([^"]*)"|([^\s"]+)/g;
-  let match;
-  while ((match = re.exec(line)) !== null) {
-    tokens.push(match[1] !== undefined
-      ? { value: match[1], quoted: true }
-      : { value: match[2], quoted: false });
-  }
-  return tokens;
-};
-
-const fromShimDir = (value, shimDir) => {
-  if (!DP0_PREFIX.test(value)) return null;
-  const rest = value.replace(DP0_PREFIX, '');
-  return win32.resolve(shimDir, rest);
-};
-
-const isNodeName = (value) => /^node(?:\.exe)?$/i.test(value);
-
-const isNodeBesideShim = (value, shimDir) => {
-  const abs = fromShimDir(value, shimDir);
-  return Boolean(abs) && win32.basename(abs).toLowerCase() === 'node.exe'
-    && win32.dirname(abs).toLowerCase() === win32.resolve(shimDir).toLowerCase();
-};
-
-// The program a JS shim runs must be node: bare `node`, `node.exe` beside
-// the shim, or the `%_prog%` variable the current cmd-shim SETs to one of
-// those two. A shim whose program is anything else (cmd-shim writes
-// `/bin/sh` for a shell-script bin) is refused.
-const programIsNode = (token, shimDir, text) => {
-  if (!token) return false;
-  if (!token.quoted && isNodeName(token.value)) return true;
-  if (token.quoted && isNodeBesideShim(token.value, shimDir)) return true;
-  if (token.quoted && token.value.toLowerCase() === '%_prog%') {
-    const values = [...text.matchAll(/SET\s+"_prog=([^"]*)"/gi)].map((m) => m[1]);
-    return values.length > 0
-      && values.every((value) => isNodeName(value) || isNodeBesideShim(value, shimDir));
-  }
-  return false;
-};
-
-// npm's own `npm.cmd` / `npx.cmd` (npm/bin/*.cmd, which the Node installer
-// copies next to node.exe) is hand-written, not a cmd-shim:
-//
-//   SET "NODE_EXE=%~dp0\node.exe"            (else `node`)
-//   SET "NPM_PREFIX_JS=%~dp0\node_modules\npm\bin\npm-prefix.js"
-//   SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
-//   FOR /F … ('CALL "%NODE_EXE%" "%NPM_PREFIX_JS%"') … SET "NPM_PREFIX_NPX_CLI_JS=%%F\node_modules\npm\bin\npx-cli.js"
-//   IF EXIST "%NPM_PREFIX_NPX_CLI_JS%" ( SET "NPX_CLI_JS=%NPM_PREFIX_NPX_CLI_JS%" )
-//   "%NODE_EXE%" "%NPX_CLI_JS%" %*
-//
-// The FOR line asks npm for its global prefix (older npm: `npm-cli.js prefix
-// -g`), so an npm the person upgraded with `npm i -g npm` wins over the
-// bundled one. That prefix is %APPDATA%\npm unless an npmrc or
-// `npm_config_prefix` says otherwise, and npm's config loader is the only
-// thing that knows which. So the same script is asked the same way, as
-// `node.exe <script>` with no shell, in the child's env, and in its folder
-// when the caller passes `cwd` (a project .npmrc counts there). An answer that names no npm, or no answer at all,
-// leaves the bundled npm, as npm.cmd does.
-const NPM_LAUNCH = /^"%NODE_EXE%"\s+"%(NP[MX]_CLI_JS)%"\s+%\*$/i;
-const NPM_PREFIX_FOR = /^FOR\s+\/F\s+"delims="\s+%%F\s+IN\s+\('CALL\s+"%NODE_EXE%"\s+"%([A-Z_]+)%"((?:\s+[A-Za-z0-9-]+)*)'\)\s+DO\s+\($/i;
-const PREFIX_TIMEOUT_MS = 10000;
-
-const declaredBesideShim = (lines, variable, shimDir) => {
-  const declared = lines
-    .map((line) => line.match(new RegExp(`^SET\\s+"${variable}=([^"]*)"$`, 'i')))
-    .find((match) => match && DP0_PREFIX.test(match[1]));
-  return declared ? fromShimDir(declared[1], shimDir) : null;
-};
-
-// The npm script npm.cmd would switch to after asking for the prefix, or
-// null to keep the bundled one.
-const npmFromPrefix = (lines, variable, shimDir, node, deps) => {
-  const forLine = lines.map((line) => line.match(NPM_PREFIX_FOR)).find(Boolean);
-  if (!forLine) return null;
-  const script = declaredBesideShim(lines, forLine[1], shimDir);
-  if (!script || !deps.existsSync(script)) return null;
-  const target = lines
-    .map((line) => line.match(new RegExp(`^SET\\s+"NPM_PREFIX_${variable}=%%F\\\\([^"%]+)"$`, 'i')))
-    .find(Boolean);
-  if (!target) return null;
-  let result;
-  try {
-    result = deps.spawnSync(node, [script, ...forLine[2].trim().split(/\s+/).filter(Boolean)], {
-      env: deps.env,
-      cwd: deps.cwd,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: PREFIX_TIMEOUT_MS,
-      windowsHide: true,
-    });
-  } catch {
-    return null;
-  }
-  if (!result || result.status !== 0) return null;
-  // FOR /F runs its body once per line, so the last line is the one that sticks.
-  const prefix = String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop();
-  if (!prefix || !win32.isAbsolute(prefix)) return null;
-  const upgraded = win32.join(prefix, target[1]);
-  return deps.existsSync(upgraded) ? upgraded : null;
-};
-
-const parseNpmLauncher = (lines, shimPath, deps) => {
-  const launch = lines.map((line) => line.match(NPM_LAUNCH)).find(Boolean);
-  if (!launch) return null;
-  const variable = launch[1];
-  const shimDir = win32.dirname(shimPath);
-  const bundled = declaredBesideShim(lines, variable, shimDir);
-  if (!bundled) return { command: null, reason: `${shimPath} does not name npm's script beside itself` };
-  const nodeBeside = win32.join(shimDir, 'node.exe');
-  const node = deps.existsSync(nodeBeside) ? nodeBeside : deps.execPath;
-  const script = npmFromPrefix(lines, variable, shimDir, node, deps) || bundled;
-  if (!deps.existsSync(script)) return { command: null, reason: `${shimPath} points at ${script}, which does not exist` };
-  return { command: node, args: [script] };
-};
-
-/**
- * Read an npm cmd-shim and return what it would run, as an argv prefix.
- * Shapes, from cmd-shim's generator (npm/cmd-shim lib/index.js, read at
- * v8.0.0 as bundled with npm, and its pre-4.0 output):
- *
- *   current JS:  endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%" [flags] "%dp0%\…\cli.js" %*
- *   current exe: "%dp0%\…\tool.exe"   %*
- *   npm's own:   "%NODE_EXE%" "%NPX_CLI_JS%" %*   (see parseNpmLauncher)
- *   legacy JS:   @IF EXIST "%~dp0\node.exe" ( "%~dp0\node.exe" "%~dp0\…\cli.js" %* ) ELSE ( … node "%~dp0\…\cli.js" %* )
- *
- * @returns {{ command: string, args: string[] } | { command: null, reason: string }}
- */
-export const parseCmdShim = (text, shimPath, {
-  existsSync = realExistsSync, execPath = process.execPath, env = {}, spawnSync = realSpawnSync, cwd,
-} = {}) => {
-  const shimDir = win32.dirname(shimPath);
-  const lines = String(text)
-    .split(/\r?\n/)
-    .map((line) => line.trim().replace(/^@/, ''))
-    .filter(Boolean);
-  const npmLauncher = parseNpmLauncher(lines, shimPath, { existsSync, execPath, env, spawnSync, cwd });
-  if (npmLauncher) return npmLauncher;
-  // The launch line is the one that forwards the caller's arguments. The
-  // legacy shape has two (node beside the shim, else node on PATH) that name
-  // the same script; the last one is the fallback branch.
-  const launches = lines
-    .map(tokenize)
-    .filter((tokens) => tokens.length > 0 && !tokens[tokens.length - 1].quoted
-      && tokens[tokens.length - 1].value === '%*');
-  if (launches.length === 0) {
-    return { command: null, reason: `${shimPath} is not an npm cmd-shim: no line forwards %*` };
-  }
-  let segment = launches[launches.length - 1];
-  // Drop everything up to the last command separator (the current shape
-  // prefixes `endLocal & goto … & ` to the launch).
-  for (let i = segment.length - 1; i >= 0; i -= 1) {
-    if (!segment[i].quoted && SEPARATORS.has(segment[i].value)) {
-      segment = segment.slice(i + 1);
-      break;
-    }
-  }
-  const legacyIfBranch = segment[0] && !segment[0].quoted && /^\($/.test(segment[0].value);
-  if (legacyIfBranch) segment = segment.slice(1);
-  const unsafe = segment.slice(0, -1).find((token) => !token.quoted && /[&|<>^()%]/.test(token.value));
-  if (unsafe) {
-    return { command: null, reason: `${shimPath} has a launch line this CLI will not interpret (${unsafe.value})` };
-  }
-
-  const targetToken = segment[segment.length - 2];
-  const target = targetToken?.quoted ? fromShimDir(targetToken.value, shimDir) : null;
-  if (!target) {
-    return { command: null, reason: `${shimPath} does not name a target beside itself` };
-  }
-  if (!existsSync(target)) {
-    return { command: null, reason: `${shimPath} points at ${target}, which does not exist` };
-  }
-  const ext = extOf(target);
-
-  if (BINARY_EXTS.has(ext)) {
-    if (segment.length !== 2) {
-      return { command: null, reason: `${shimPath} runs ${target} through another program` };
-    }
-    return { command: target, args: [] };
-  }
-
-  if (SCRIPT_EXTS.has(ext)) {
-    const program = segment[0];
-    const shimArgs = segment.slice(1, -2);
-    if (segment.length < 3 || !programIsNode(program, shimDir, String(text))) {
-      return { command: null, reason: `${shimPath} runs ${target} with a program other than node` };
-    }
-    const badArg = shimArgs.find((token) => token.quoted || !SAFE_SHIM_ARG.test(token.value));
-    if (badArg) {
-      return { command: null, reason: `${shimPath} passes an argument this CLI will not interpret (${badArg.value})` };
-    }
-    const nodeBeside = win32.join(shimDir, 'node.exe');
-    const node = existsSync(nodeBeside) ? nodeBeside : execPath;
-    return { command: node, args: [...shimArgs.map((token) => token.value), target] };
-  }
-
-  return { command: null, reason: `${shimPath} launches ${target}, which is neither a script nor an .exe` };
-};
-
-const classify = (file, deps) => {
-  const ext = extOf(file);
-  if (BINARY_EXTS.has(ext)) return { command: file, args: [], source: file };
-  if (SHIM_EXTS.has(ext)) {
-    let text;
-    try {
-      text = deps.readFileSync(file, 'utf8');
-    } catch (err) {
-      return { command: null, reason: `${file} could not be read: ${err.message}`, source: file };
-    }
-    return { ...parseCmdShim(text, file, deps), source: file };
-  }
-  return null;
-};
-
-/**
- * Resolve `name` to something spawnable without a shell, with the reason when
- * it cannot be. On anything but win32, `{ command: name, args: [] }`.
- * On win32, `source` is the file found on PATH (the shim, or the .exe).
- * `cwd` is the child's working directory; relative PATH entries are read
- * against it (unset: this process's, as before), and npm's own launcher asks
- * npm for its prefix there.
- *
- * @returns {{ command: string, args: string[], source?: string }
- *   | { command: null, reason: string, source?: string }}
- */
-export const resolveWindowsCommandWithReason = (name, {
-  platform = process.platform,
-  env = process.env,
-  existsSync = realExistsSync,
-  readFileSync = realReadFileSync,
-  execPath = process.execPath,
-  spawnSync = realSpawnSync,
-  cwd,
-} = {}) => {
-  if (platform !== 'win32') return { command: name, args: [] };
-  const deps = { existsSync, readFileSync, execPath, env, spawnSync, cwd };
-  const exts = pathExtensions(env);
-  const hasKnownExt = [...BINARY_EXTS, ...SHIM_EXTS].includes(extOf(name));
-  // PATHEXT is upper case by convention and NTFS ignores case, so the
-  // extension is appended in lower case: the same file, a tidier path.
-  const candidatesFor = (base) => (hasKnownExt ? [base] : exts.map((ext) => base + ext.toLowerCase()));
-
-  // An explicit path is checked where it points, never searched for.
-  if (/[\\/]/.test(name) || win32.isAbsolute(name)) {
-    // A path that names an existing file is that file, whatever its extension.
-    for (const candidate of existsSync(name) ? [name] : candidatesFor(name)) {
-      if (!existsSync(candidate)) continue;
-      return classify(candidate, deps) || {
-        command: null,
-        reason: `${candidate} is a ${extOf(candidate)} file, which can only run through a shell`,
-        source: candidate,
-      };
-    }
-    return { command: null, reason: `${name} was not found` };
-  }
-
-  // Windows' own order: each PATH folder in turn, each PATHEXT extension
-  // within it. The first file that exists is what a shell would run, so it
-  // is decisive: when it is something this CLI cannot launch without a shell
-  // (a `.vbs`, a `.js`, a `.ps1` someone added to PATHEXT), the answer is a
-  // refusal, never a later match, which would be a different program from the
-  // one the person runs by typing the name.
-  for (const dir of pathEntries(env, cwd)) {
-    for (const candidate of candidatesFor(win32.join(dir, name))) {
-      if (!existsSync(candidate)) continue;
-      return classify(candidate, deps) || {
-        command: null,
-        reason: `${candidate} is first on PATH, and a ${extOf(candidate)} file can only run through a shell`,
-        source: candidate,
-      };
-    }
-  }
-  return { command: null, reason: `${name} was not found on PATH (searched ${exts.join(', ')})` };
-};
-
-/** `resolveWindowsCommandWithReason` without the reason: null when unresolvable. */
-export const resolveWindowsCommand = (name, deps) => {
-  const result = resolveWindowsCommandWithReason(name, deps);
-  return result.command ? { command: result.command, args: result.args } : null;
-};
-
-/**
- * The command and argv an adapter spawns: unchanged off Windows; on Windows,
- * the resolved target with its argv prefix ahead of the adapter's own args.
- * Throws (code ENOENT) with the reason when the name cannot be launched
- * without a shell.
- */
-export const resolveLaunch = (command, args, deps = {}) => {
-  const resolved = resolveWindowsCommandWithReason(command, deps);
-  if (!resolved.command) {
-    const err = new Error(`cannot launch ${command} on Windows without a shell: ${resolved.reason}`);
-    err.code = 'ENOENT';
-    throw err;
-  }
-  return { command: resolved.command, args: [...resolved.args, ...args], source: resolved.source };
-};
-
-/**
- * A stdio MCP server's argv as the runtime (Claude Code, Codex) should launch
- * it. Those runtimes spawn the server themselves, with no shell, so on Windows
- * the default `npx -y @commonlyai/mcp@latest` would hit the same `npx.cmd`
- * wall. On win32, `argv[0]` is resolved here and its prefix spliced in (an npm
- * shim becomes `node.exe …\npx-cli.js -y @commonlyai/mcp@latest`). When it
- * cannot be resolved the entry is left as declared and one line says why.
- * Off Windows the argv is returned as is (the same array).
- */
-export const resolveMcpCommand = (argv, deps = {}, { label = 'mcp', name = '', warn } = {}) => {
-  if ((deps.platform || process.platform) !== 'win32') return argv;
-  if (!Array.isArray(argv) || argv.length === 0 || typeof argv[0] !== 'string') return argv;
-  const resolved = resolveWindowsCommandWithReason(argv[0], deps);
-  if (!resolved.command) {
-    const line = `[${label}] MCP server ${name || argv[0]}: left as declared, ${resolved.reason}`;
-    // eslint-disable-next-line no-console
-    (warn || console.warn)(line);
-    return argv;
-  }
-  return [resolved.command, ...resolved.args, ...argv.slice(1)];
-};

package/src/lib/workspace-git.js

@@ -1,87 +0,0 @@
-/**
- * The read-only `workspace_git` MCP server (git-readonly-server.js), as an
- * adapter attaches it to a sandboxed seat. Shared by the claude adapter (for a
- * workspace-trust seat) and the codex adapter (for a public seat), so both
- * give the model the same one git tool, run against the same real binary.
- */
-import { spawnSync } from 'child_process';
-import { realpathSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-import { wrapArgvWithSeatbelt } from './sandbox/seatbelt.js';
-
-// The name git-readonly-server.js serves under. Kept here, not imported: the
-// server module pulls in git-readonly.js and its execFile, which an adapter has
-// no use for (git-readonly-server.test.mjs checks the two names agree).
-export const WORKSPACE_GIT_SERVER_NAME = 'workspace_git';
-
-// The tool is opt-in: an adapter attaches it only when the environment the
-// daemon itself runs in sets COMMONLY_WORKSPACE_GIT=1. Read from the daemon's
-// own environment, never from a seat's record, so a seat cannot turn it on.
-export const WORKSPACE_GIT_ENV = 'COMMONLY_WORKSPACE_GIT';
-export const workspaceGitEnabled = (env = process.env) => env?.[WORKSPACE_GIT_ENV] === '1';
-
-// The server runs inside the sandbox, so the sandbox must admit its code
-// (cli/src/lib, plus package.json for the module type) and the git binary it runs.
-export const WORKSPACE_GIT_SERVER = fileURLToPath(new URL('./git-readonly-server.js', import.meta.url));
-export const WORKSPACE_GIT_PACKAGE_JSON = fileURLToPath(new URL('../../package.json', import.meta.url));
-
-// macOS's /usr/bin/git is an xcrun shim, and it fails inside a sandbox ("No
-// developer tools were found"). So the sandbox gets the binary git itself runs:
-// `git --exec-path`, resolved here on the host, holds a `git` that links to it.
-export const resolveRealGit = ({ run = spawnSync } = {}) => {
-  const result = run('git', ['--exec-path'], { encoding: 'utf8', timeout: 5000 });
-  const execDir = result?.status === 0 ? String(result.stdout || '').trim() : '';
-  if (!execDir) return null;
-  try {
-    return realpathSync(join(execDir, 'git'));
-  } catch {
-    return null;
-  }
-};
-
-// The MCP server entry and the paths the sandbox has to let it read, for a
-// seat whose workspace is `root`. Null when this machine has no git.
-export const workspaceGitAttachment = (root, { git = resolveRealGit() } = {}) => {
-  if (!root || !git) return null;
-  return {
-    server: {
-      name: WORKSPACE_GIT_SERVER_NAME,
-      transport: 'stdio',
-      command: [process.execPath, WORKSPACE_GIT_SERVER, '--root', root, '--git', git],
-    },
-    executable: git,
-    readDirectories: [dirname(WORKSPACE_GIT_SERVER)],
-    readPaths: [WORKSPACE_GIT_PACKAGE_JSON],
-  };
-};
-
-// For a public Codex seat. Codex starts its MCP servers outside the seat's
-// permission profile, so a bare server would run git as the operator, with the
-// network on and every file the profile denies in reach. This one runs under a
-// Seatbelt of its own: the workspace read-only with its .env, .npmrc and
-// .yarnrc* files unreadable, as the profile has them, no network, its code and
-// git readable, and nothing writable but `stateDir`, an empty folder of its own (not
-// the folder that holds the seat's credential). macOS only: elsewhere there is
-// no wrapper here yet, so the seat gets no tool rather than an unconfined one.
-export const confinedWorkspaceGitServer = (root, {
-  stateDir,
-  platform = process.platform,
-  git = platform === 'darwin' ? resolveRealGit() : null,
-  wrap = wrapArgvWithSeatbelt,
-} = {}) => {
-  if (platform !== 'darwin' || !root || !stateDir || !git) return null;
-  const attachment = workspaceGitAttachment(root, { git });
-  const command = wrap(attachment.server.command, {
-    workspacePath: root,
-    workspaceAccess: 'read',
-    executablePath: git,
-    statePath: stateDir,
-    readOnlyDirectories: attachment.readDirectories,
-    readOnlyPaths: attachment.readPaths,
-    network: 'loopback',
-    processInfo: 'self',
-    denyRegistryConfig: true,
-  });
-  return { ...attachment.server, command };
-};

package/src/lib/workspace-trust.js

@@ -1,162 +0,0 @@
-/**
- * The two facts a `workspace`-trust seat depends on (TASK-294), as pure
- * predicates so the attach path, the first-run bootstrap and the per-spawn
- * check all read them the same way.
- *
- * 1. Every pod the seat answers in is CONFIRMED private: not publicly
- *    readable, not listed, and invite-only. Visibility alone is not enough,
- *    because any agent can add itself to an open pod an agent created, listed
- *    or not. A pod whose fields the server did not report counts as public:
- *    the workspace tier lets the room read the start directory, so an unknown
- *    room fails closed.
- * 2. The start directory is a directory worth exposing to that room, and not
- *    one that contains the operator's whole account: `/`, `$HOME`, an ancestor
- *    of `$HOME`, or a directory inside one of the credential stores the public
- *    policy denies by name.
- */
-import { realpathSync } from 'fs';
-import { homedir } from 'os';
-import {
-  isAbsolute, join, relative, resolve, sep,
-} from 'path';
-
-/** A pod is private only when the server says so in all three fields. */
-export const podIsConfirmedPrivate = (pod) => (
-  typeof pod?.publicRead === 'boolean'
-  && typeof pod?.communityListed === 'boolean'
-  && !pod.publicRead
-  && !pod.communityListed
-  && pod.joinPolicy === 'invite-only'
-);
-
-/** True only for a non-empty list in which every pod is confirmed private. */
-export const allPodsConfirmedPrivate = (pods) => (
-  Array.isArray(pods) && pods.length > 0 && pods.every(podIsConfirmedPrivate)
-);
-
-// The stores claude.js denies by absolute path for a public seat. A start
-// directory inside one of them would put the seat's own credentials in reach.
-const CREDENTIAL_DIRS = ['.commonly', '.claude', '.codex', '.ssh', '.aws', '.config'];
-
-const realOrResolved = (p) => {
-  try {
-    return realpathSync(p);
-  } catch {
-    return resolve(p);
-  }
-};
-
-const isInsideOrEqual = (child, parent) => {
-  const rel = relative(parent, child);
-  return rel === '' || (rel.split(sep)[0] !== '..' && !isAbsolute(rel));
-};
-
-/**
- * Why `dir` cannot be a workspace seat's start directory, or `null` when it can.
- * Symlinks are resolved first, so a link to `$HOME` is refused as `$HOME`.
- */
-export const workspaceStartDirRefusal = (dir, { home = homedir() } = {}) => {
-  if (typeof dir !== 'string' || !isAbsolute(dir)) {
-    return 'the start directory is not an absolute path';
-  }
-  const real = realOrResolved(dir);
-  const realHome = realOrResolved(home);
-  if (real === '/') return 'the start directory is /';
-  if (isInsideOrEqual(realHome, real)) {
-    return real === realHome
-      ? 'the start directory is your home directory'
-      : 'the start directory contains your home directory';
-  }
-  const store = CREDENTIAL_DIRS.find((name) => isInsideOrEqual(real, join(realHome, name)));
-  if (store) return `the start directory is inside ~/${store}`;
-  return null;
-};
-
-const PUBLIC_POD_REASON = 'a pod it answers in is publicly readable or open to join, or did not report whether it is';
-// claude.js runs a workspace seat under Seatbelt on macOS and under bwrap on
-// Linux (#2784). Native Windows has no sandbox for it, so there the default
-// would be a seat that fails every turn rather than one that reads a project.
-const UNSUPPORTED_OS_REASON = 'an agent works in its folder only on macOS and Linux for now';
-
-/**
- * Where a first-run claude seat may read (TASK-294), from three facts the
- * bootstrap already holds: the adapter it detected, the rooms its token
- * answers in, and the directory the person ran it from. It returns the start
- * directory only when all three allow it, and otherwise the reason the seat
- * keeps the `public` default it had before, plus a `fix` when the person can
- * change the outcome by starting somewhere else. Any other adapter gets `null`:
- * `workspace` is claude-only for now, so there is nothing to decide.
- */
-export const firstRunWorkspace = ({
-  adapterName, installations, startDir, home, platform = process.platform,
-} = {}) => {
-  if (adapterName !== 'claude') return null;
-  if (platform !== 'darwin' && platform !== 'linux') {
-    return { workspacePath: null, reason: UNSUPPORTED_OS_REASON };
-  }
-  if (!allPodsConfirmedPrivate(installations)) {
-    return { workspacePath: null, reason: PUBLIC_POD_REASON };
-  }
-  const refusal = workspaceStartDirRefusal(startDir, home === undefined ? {} : { home });
-  if (refusal) {
-    return {
-      workspacePath: null,
-      reason: refusal,
-      fix: 'To let it read a project, run this command from that project\'s folder.',
-    };
-  }
-  return { workspacePath: realOrResolved(startDir), reason: null };
-};
-
-/**
- * Where one turn of a seat runs, and under which trust. A pod can turn public
- * after attach, so a `workspace` seat's rooms are re-read before every turn
- * (`installations` is that read, or `null` when it failed). A turn that cannot
- * confirm them all private runs as a `public` seat in its scratch folder: the
- * confinement it would have had without the workspace. Any other trust runs
- * where and as it was started.
- */
-export const workspaceTurnPlacement = ({
-  environment, workspacePath, installations, scratchDir,
-} = {}) => {
-  const cwd = workspacePath || scratchDir;
-  if (environment?.sandbox?.trust !== 'workspace' || allPodsConfirmedPrivate(installations)) {
-    return { environment, cwd, reason: null };
-  }
-  // Its write/web grants widen the workspace tier only, so the public turn
-  // drops them rather than carry them into a room strangers can read.
-  const { allow: _grants, ...sandbox } = environment.sandbox;
-  return {
-    environment: { ...environment, sandbox: { ...sandbox, trust: 'public' } },
-    cwd: scratchDir,
-    reason: installations === null ? 'its pods could not be read' : PUBLIC_POD_REASON,
-  };
-};
-
-/**
- * Where one turn of a Codex seat runs when the person opted in to running it
- * unsandboxed (windows-unsandboxed.js; native Windows, or Linux since F387). A
- * pod can turn public after the run starts, so its rooms are re-read before
- * every turn, as for a `workspace` seat. With every pod confirmed private, the
- * turn has no sandbox block and Codex runs unconfined. Anything else, a failed
- * read included, is placed `public`, and the run loop refuses that turn on
- * every platform, so strangers can never reach an unconfined shell.
- */
-export const unconfinedTurnPlacement = ({ environment, installations, cwd } = {}) => {
-  const { sandbox: _sandbox, ...unsandboxed } = environment || {};
-  if (allPodsConfirmedPrivate(installations)) return { environment: unsandboxed, cwd, reason: null };
-  return {
-    environment: { ...unsandboxed, sandbox: { trust: 'public' } },
-    cwd,
-    reason: installations === null ? 'its pods could not be read' : PUBLIC_POD_REASON,
-  };
-};
-
-export default {
-  podIsConfirmedPrivate,
-  allPodsConfirmedPrivate,
-  workspaceStartDirRefusal,
-  firstRunWorkspace,
-  workspaceTurnPlacement,
-  unconfinedTurnPlacement,
-};