@rosthq/cli 0.7.112 → 0.7.113

package/dist/forge-workspace.d.ts

@@ -1,6 +1,8 @@
 import { type StepLedger } from "./step-ledger.js";
 export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
-export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string): NodeJS.ProcessEnv;
+export declare function resolveSourceClaudeConfigDir(base: NodeJS.ProcessEnv): string;
+export declare function provisionIsolatedClaudeConfigDir(base: NodeJS.ProcessEnv, configDir: string): Promise<string>;
 export type ForgeCredential = {
     token: string;
     expiresAt: string;

package/dist/forge-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAAC,UAAU,CAiBnB;AAcD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAOD,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAejB;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/index.js

@@ -38746,6 +38746,7 @@ var catalogEntries = CATALOG_ENTRIES.map(enrichCatalogEntry);
 var catalogById = new Map(catalogEntries.map((entry) => [entry.id, entry]));
 
 // ../../packages/protocol/src/skills.ts
+var SKILL_DESCRIPTION_MAX_CHARS = 500;
 var skillVisibilitySchema = external_exports.enum(["private", "seat", "tenant"]);
 var skillStatusSchema = external_exports.enum(["draft", "pending_review", "published", "archived"]);
 var skillSourceTypeSchema = external_exports.enum([
@@ -38762,12 +38763,14 @@ var skillCatalogTierSchema = external_exports.enum(["free", "pro", "enterprise",
 var skillLocalClientSchema = external_exports.enum(["claude-code", "codex", "cursor"]);
 var skillSlugSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,80}$/);
 var skillNameSchema = external_exports.string().trim().min(1).max(120);
-var skillApplicationSchema = external_exports.object({
+var skillApplicationShape = {
   domain: external_exports.string().trim().min(1).max(80).optional(),
   summary: external_exports.string().trim().min(1).max(500),
   best_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([]),
   not_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([])
-}).strict();
+};
+var skillApplicationSchema = external_exports.object(skillApplicationShape).strict();
+var skillApplicationInputSchema = external_exports.object(skillApplicationShape);
 var skillToolDependencySchema = external_exports.object({
   tool: external_exports.string().trim().min(1).max(120),
   min_scope_tier: toolScopeTierSchema,
@@ -38787,7 +38790,7 @@ var skillValidationIssueSchema = external_exports.object({
 var normalizedSkillPackageSchema = external_exports.object({
   slug: skillSlugSchema,
   name: skillNameSchema,
-  description: external_exports.string().trim().min(1).max(300),
+  description: external_exports.string().trim().min(1).max(SKILL_DESCRIPTION_MAX_CHARS),
   visibility: skillVisibilitySchema,
   application: skillApplicationSchema,
   frontmatter: external_exports.record(external_exports.string(), external_exports.unknown()),
@@ -55804,7 +55807,8 @@ var RUNNER_ASKPASS_DIR = path4.join(tmpdir(), "rost-runner-askpass");
 var RUNNER_TEMP_PREFIXES = [
   "rost-runner-mcp-",
   "rost-runner-sandbox-",
-  "rost-runner-askpass-"
+  "rost-runner-askpass-",
+  "rost-runner-claude-config-"
 ];
 var RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS = 60 * 60 * 1e3;
 var RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS = 45 * 60 * 1e3;
@@ -56901,7 +56905,7 @@ function parseSemver2(value) {
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile6, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
 import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
 import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
@@ -56910,7 +56914,8 @@ import { promisify as promisify5 } from "node:util";
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, lstat, mkdir as mkdir4, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, lstat, mkdir as mkdir4, mkdtemp, readFile as readFile5, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import os2 from "node:os";
 import path6 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
@@ -56989,7 +56994,7 @@ var MODEL_SPAWN_ENV_ALLOWLIST = [
   "SHELL",
   "NODE_OPTIONS"
 ];
-function buildModelSpawnEnv(base) {
+function buildModelSpawnEnv(base, claudeConfigDir) {
   const out = {};
   for (const key of MODEL_SPAWN_ENV_ALLOWLIST) {
     const value = base[key];
@@ -56997,8 +57002,36 @@ function buildModelSpawnEnv(base) {
       out[key] = value;
     }
   }
+  if (typeof claudeConfigDir === "string" && claudeConfigDir.length > 0) {
+    out.CLAUDE_CONFIG_DIR = claudeConfigDir;
+  }
   return out;
 }
+var CLAUDE_CONFIG_AUTH_FILES = [".credentials.json", ".claude.json"];
+function resolveSourceClaudeConfigDir(base) {
+  const explicit = base.CLAUDE_CONFIG_DIR;
+  if (typeof explicit === "string" && explicit.length > 0) {
+    return explicit;
+  }
+  const home = base.HOME;
+  const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
+  return path6.join(homeDir, ".claude");
+}
+async function provisionIsolatedClaudeConfigDir(base, configDir) {
+  await mkdir4(configDir, { recursive: true, mode: 448 });
+  await chmod(configDir, 448);
+  const source = resolveSourceClaudeConfigDir(base);
+  for (const file2 of CLAUDE_CONFIG_AUTH_FILES) {
+    try {
+      const data = await readFile5(path6.join(source, file2));
+      const dest = path6.join(configDir, file2);
+      await writeFile4(dest, data, { mode: 384 });
+      await chmod(dest, 384);
+    } catch {
+    }
+  }
+  return configDir;
+}
 var GIT_HARDENING_ARGS = [
   "-c",
   "core.hooksPath=/dev/null",
@@ -58192,7 +58225,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 }
 async function loadState(filePath, expectedTenantId) {
   try {
-    const parsed = JSON.parse(await readFile5(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile6(filePath, "utf8"));
     if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
       if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
         return null;
@@ -58659,6 +58692,9 @@ function resolveTurnPlan(input) {
     return {
       profile: "read_status",
       claudeAllowedTools: [...input.kind === "turn_execution" ? RUNNER_AICOS_TURN_TOOLS : RUNNER_WORK_ORDER_TOOLS],
+      // DER-2104: the read stub is MCP-only — no local built-ins. `--tools ""` now enforces
+      // that (previously nothing did, so a stub turn silently inherited full local access).
+      localBuiltinTools: [],
       codexSandbox: "read-only",
       outputFormat: input.kind === "turn_execution" ? "json" : "text",
       repoDir: null,
@@ -58673,6 +58709,9 @@ function resolveTurnPlan(input) {
       ...execution.allowed_mcp_tools.map(claudeMcpToolName),
       ...claudeLocalToolsFor(execution.local_tools)
     ],
+    // DER-2104: the same built-in set, but as the `--tools` HARD whitelist (not the
+    // auto-approve list). `none` → `[]` → `--tools ""` → zero built-ins for a seat_work turn.
+    localBuiltinTools: claudeLocalToolsFor(execution.local_tools),
     codexSandbox: execution.local_tools === "workspace_write" ? "workspace-write" : "read-only",
     // Forge build/review turns emit a structured JSON envelope (reusing the AICOS
     // --output-format json pattern) so their summary is a real contract, not a stdout slice.
@@ -58722,8 +58761,19 @@ function buildTurnCommand(input) {
       "--mcp-config",
       configPath,
       "--strict-mcp-config",
+      // DER-2104: --tools is the HARD built-in whitelist. `--tools ""` (empty join for
+      // local_tools "none") removes Bash/Read/Write/Edit/… entirely, and the operator's
+      // settings.json cannot widen it — the real enforcement of `local_tools`. --allowedTools
+      // stays as the auto-approve list for the governed MCP + any declared local built-ins.
+      "--tools",
+      plan.localBuiltinTools.join(","),
       "--allowedTools",
       plan.claudeAllowedTools.join(","),
+      // DER-2104: unattended turns must never wait on a prompt — dontAsk auto-denies any tool
+      // call that would otherwise prompt. Governed MCP tools and the declared local built-ins
+      // are in --allowedTools (auto-approved, never prompt), so this only denies the unexpected.
+      "--permission-mode",
+      "dontAsk",
       "--output-format",
       plan.outputFormat,
       // DER-1397: turn off Claude Code's own nested Bash sandbox when the outer seatbelt confines
@@ -58975,6 +59025,10 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(ctx.state, workOrder) : void 0;
   const built = buildTurnCommand({
     runtime,
@@ -59003,7 +59057,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
     // A Forge turn's cwd is its worktree; every other turn stays in tmpdir.
     cwd: plan.repoDir ?? tmpdir2(),
     timeoutMs: plan.timeoutMs,
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope,
     resumeSessionId,
     // T1.6: only Forge turns carry a structured evidence contract worth parsing.
@@ -59032,6 +59086,9 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   if (forgePrep) {
     if (plan.profile === "forge_build" && result.ok && forgePrep.credential.canPush) {
@@ -59179,6 +59236,10 @@ async function spawnMergeConflictModel(ctx, input) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = input.runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const plan = resolveTurnPlan({ kind: "work_order", execution: input.execution, repoDir: input.workspace.worktreeDir });
   const prompt = [
     "You are resolving a merge conflict on a pull request branch so it can merge into the base branch.",
@@ -59208,7 +59269,7 @@ async function spawnMergeConflictModel(ctx, input) {
     cwd: input.workspace.worktreeDir,
     timeoutMs: plan.timeoutMs,
     // The model gets the EXPLICIT allowlist env — never the merge token, GIT_ASKPASS, or the bearer.
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope: false
   });
   const exitClass = classifyModelExit(result);
@@ -59224,6 +59285,9 @@ async function spawnMergeConflictModel(ctx, input) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   return result;
 }