@rosthq/cli 0.7.112 → 0.7.114

package/dist/forge-workspace.d.ts

@@ -1,6 +1,8 @@
 import { type StepLedger } from "./step-ledger.js";
 export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
-export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string): NodeJS.ProcessEnv;
+export declare function resolveSourceClaudeConfigDir(base: NodeJS.ProcessEnv): string;
+export declare function provisionIsolatedClaudeConfigDir(base: NodeJS.ProcessEnv, configDir: string): Promise<string>;
 export type ForgeCredential = {
     token: string;
     expiresAt: string;

package/dist/forge-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAAC,UAAU,CAiBnB;AAcD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAOD,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAejB;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/index.js

@@ -38708,6 +38708,14 @@ function accessLevelForScope(scopeTier) {
       return "admin";
   }
 }
+var RUNNER_WIRED_CONNECTOR_IDS = /* @__PURE__ */ new Set([
+  "gmail.read",
+  "gmail.draft",
+  "gmail.send",
+  "sheets.read",
+  "sheets.write",
+  "slack.post_message"
+]);
 function providerRequirementFor(entry) {
   if (!entry.credential_required) {
     return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
@@ -38730,6 +38738,12 @@ function trustedRequiredMetadataFor(entry) {
     "authorization_revoked_at"
   ];
 }
+function laneSupportFor(entry) {
+  if (providerRequirementFor(entry) === "connection" && !RUNNER_WIRED_CONNECTOR_IDS.has(entry.id)) {
+    return ["cloud"];
+  }
+  return ["cloud", "runner", "mcp"];
+}
 function enrichCatalogEntry(entry) {
   const accessLevels = [...new Set(entry.scope_tiers.map(accessLevelForScope))];
   return {
@@ -38738,7 +38752,7 @@ function enrichCatalogEntry(entry) {
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
     cost_class: entry.id === "script.run" || entry.id === "secret.broker" || entry.id === "baserow.read" || entry.id === "baserow.write" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
-    lane_support: ["cloud", "runner", "mcp"],
+    lane_support: laneSupportFor(entry),
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
 }
@@ -38746,6 +38760,7 @@ var catalogEntries = CATALOG_ENTRIES.map(enrichCatalogEntry);
 var catalogById = new Map(catalogEntries.map((entry) => [entry.id, entry]));
 
 // ../../packages/protocol/src/skills.ts
+var SKILL_DESCRIPTION_MAX_CHARS = 500;
 var skillVisibilitySchema = external_exports.enum(["private", "seat", "tenant"]);
 var skillStatusSchema = external_exports.enum(["draft", "pending_review", "published", "archived"]);
 var skillSourceTypeSchema = external_exports.enum([
@@ -38762,12 +38777,14 @@ var skillCatalogTierSchema = external_exports.enum(["free", "pro", "enterprise",
 var skillLocalClientSchema = external_exports.enum(["claude-code", "codex", "cursor"]);
 var skillSlugSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,80}$/);
 var skillNameSchema = external_exports.string().trim().min(1).max(120);
-var skillApplicationSchema = external_exports.object({
+var skillApplicationShape = {
   domain: external_exports.string().trim().min(1).max(80).optional(),
   summary: external_exports.string().trim().min(1).max(500),
   best_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([]),
   not_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([])
-}).strict();
+};
+var skillApplicationSchema = external_exports.object(skillApplicationShape).strict();
+var skillApplicationInputSchema = external_exports.object(skillApplicationShape);
 var skillToolDependencySchema = external_exports.object({
   tool: external_exports.string().trim().min(1).max(120),
   min_scope_tier: toolScopeTierSchema,
@@ -38787,7 +38804,7 @@ var skillValidationIssueSchema = external_exports.object({
 var normalizedSkillPackageSchema = external_exports.object({
   slug: skillSlugSchema,
   name: skillNameSchema,
-  description: external_exports.string().trim().min(1).max(300),
+  description: external_exports.string().trim().min(1).max(SKILL_DESCRIPTION_MAX_CHARS),
   visibility: skillVisibilitySchema,
   application: skillApplicationSchema,
   frontmatter: external_exports.record(external_exports.string(), external_exports.unknown()),
@@ -48678,7 +48695,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-19.1",
+    version: "2026-07-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48734,6 +48751,10 @@ The native Gmail handlers run inside the same broker boundary as the REST and Sl
 
 Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose/send and Sheets, stores the returned credential in the vault, and records only account, scope, and capability-availability metadata in the integration row. Partial grants are accepted when at least one connector capability is usable; missing or revoked scopes reduce the affected capability instead of granting more authority. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail read/draft/send, bounded Sheets read, and approval-held Sheets write handlers run through the guarded broker when Google is connected; connecting Google still does not bypass the signed Charter manifest, tenant policy ceiling, credential vault, or tool-call audit. Sheet grants should use exact signed argument bindings for approved spreadsheet ids and ranges.
 
+## Connectors work the same on either lane
+
+A seat's governed connectors are available whether its agent runs on the cloud lane or the runner lane. {{brand}} projects each connector the seat's signed Charter grants onto the seat's own MCP surface and executes it server-side \u2014 so a runner-lane agent calls the same Gmail, Sheets, and Slack connectors a cloud-lane agent does, with identical governance: the same server guard, the same held-write approval for send/write tiers, and the same tool-call audit row. The OAuth or vaulted credential is resolved and bound only on the server inside the credential closure and never travels to the runner. Because this projection is derived from the Charter manifest and the connected integration, connecting a new integration makes its capabilities available to an already-live runner seat with no charter re-sign or code change. Connectors without a server-side handler yet stay cloud-only and are shown on the seat's Tools tab as not available on the runner lane until one ships.
+
 A connected Baserow REST integration (\`integration.connect_rest\`) derives a \`baserow.read\` tenant capability ceiling the same way: a live connection surfaces read, and a disconnected/revoked one collapses to off. The derivation is read-only by design \u2014 \`baserow.write\` is never inferred from the connection and is granted only through an explicit per-seat brokered secret grant, matching the conservative-by-default rule for every connection-backed ceiling.
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
@@ -55804,7 +55825,8 @@ var RUNNER_ASKPASS_DIR = path4.join(tmpdir(), "rost-runner-askpass");
 var RUNNER_TEMP_PREFIXES = [
   "rost-runner-mcp-",
   "rost-runner-sandbox-",
-  "rost-runner-askpass-"
+  "rost-runner-askpass-",
+  "rost-runner-claude-config-"
 ];
 var RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS = 60 * 60 * 1e3;
 var RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS = 45 * 60 * 1e3;
@@ -56028,6 +56050,20 @@ function forgeBuildUnsupportedReason(platform2) {
   }
   return `Forge build execution is unsupported on this host: no macOS seatbelt (sandbox-exec) confinement is available on '${platform2}', so this runner cannot prove filesystem/egress isolation for an untrusted build turn. The server will not offer Forge-phase work to this runner \u2014 unless its tenant is on the narrow, operator-established trust allowlist (FORGE_SANDBOX_TRUSTED_TENANT_IDS) \u2014 until real Linux confinement (namespaces/Landlock, tracked as a DER-1343 follow-up) ships.`;
 }
+function sandboxRequiredTurnRefusal(input) {
+  if (input.spec.kind === "seatbelt") {
+    return null;
+  }
+  if (input.mode === "off") {
+    return null;
+  }
+  const postureLabel = input.mode === "strict" ? "strict" : "guard";
+  const override = "Set RUNNER_SANDBOX=off only on a trusted, founder-authorized host to override.";
+  if (input.platform !== "darwin") {
+    return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but macOS seatbelt confinement does not exist on this host ('${input.platform}') \u2014 seatbelt is macOS-only, and Linux confinement is a DER-1343 follow-up. The runner refuses rather than running an attacker-influenceable build turn unconfined. ${override}`;
+  }
+  return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but sandbox-exec is unavailable on this macOS host, so filesystem/egress confinement cannot be applied (${input.spec.reason}). The runner refuses rather than silently degrading to no sandbox. ${override}`;
+}
 function wrapCommandWithSandbox(spec, command, args, profilePath) {
   if (spec.kind === "none" || profilePath === null) {
     return { command, args, profilePath: null };
@@ -56901,7 +56937,7 @@ function parseSemver2(value) {
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile6, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
 import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
 import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
@@ -56910,7 +56946,8 @@ import { promisify as promisify5 } from "node:util";
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, lstat, mkdir as mkdir4, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, lstat, mkdir as mkdir4, mkdtemp, readFile as readFile5, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import os2 from "node:os";
 import path6 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
@@ -56989,7 +57026,7 @@ var MODEL_SPAWN_ENV_ALLOWLIST = [
   "SHELL",
   "NODE_OPTIONS"
 ];
-function buildModelSpawnEnv(base) {
+function buildModelSpawnEnv(base, claudeConfigDir) {
   const out = {};
   for (const key of MODEL_SPAWN_ENV_ALLOWLIST) {
     const value = base[key];
@@ -56997,8 +57034,36 @@ function buildModelSpawnEnv(base) {
       out[key] = value;
     }
   }
+  if (typeof claudeConfigDir === "string" && claudeConfigDir.length > 0) {
+    out.CLAUDE_CONFIG_DIR = claudeConfigDir;
+  }
   return out;
 }
+var CLAUDE_CONFIG_AUTH_FILES = [".credentials.json", ".claude.json"];
+function resolveSourceClaudeConfigDir(base) {
+  const explicit = base.CLAUDE_CONFIG_DIR;
+  if (typeof explicit === "string" && explicit.length > 0) {
+    return explicit;
+  }
+  const home = base.HOME;
+  const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
+  return path6.join(homeDir, ".claude");
+}
+async function provisionIsolatedClaudeConfigDir(base, configDir) {
+  await mkdir4(configDir, { recursive: true, mode: 448 });
+  await chmod(configDir, 448);
+  const source = resolveSourceClaudeConfigDir(base);
+  for (const file2 of CLAUDE_CONFIG_AUTH_FILES) {
+    try {
+      const data = await readFile5(path6.join(source, file2));
+      const dest = path6.join(configDir, file2);
+      await writeFile4(dest, data, { mode: 384 });
+      await chmod(dest, 384);
+    } catch {
+    }
+  }
+  return configDir;
+}
 var GIT_HARDENING_ARGS = [
   "-c",
   "core.hooksPath=/dev/null",
@@ -58192,7 +58257,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 }
 async function loadState(filePath, expectedTenantId) {
   try {
-    const parsed = JSON.parse(await readFile5(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile6(filePath, "utf8"));
     if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
       if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
         return null;
@@ -58659,6 +58724,9 @@ function resolveTurnPlan(input) {
     return {
       profile: "read_status",
       claudeAllowedTools: [...input.kind === "turn_execution" ? RUNNER_AICOS_TURN_TOOLS : RUNNER_WORK_ORDER_TOOLS],
+      // DER-2104: the read stub is MCP-only — no local built-ins. `--tools ""` now enforces
+      // that (previously nothing did, so a stub turn silently inherited full local access).
+      localBuiltinTools: [],
       codexSandbox: "read-only",
       outputFormat: input.kind === "turn_execution" ? "json" : "text",
       repoDir: null,
@@ -58673,6 +58741,9 @@ function resolveTurnPlan(input) {
       ...execution.allowed_mcp_tools.map(claudeMcpToolName),
       ...claudeLocalToolsFor(execution.local_tools)
     ],
+    // DER-2104: the same built-in set, but as the `--tools` HARD whitelist (not the
+    // auto-approve list). `none` → `[]` → `--tools ""` → zero built-ins for a seat_work turn.
+    localBuiltinTools: claudeLocalToolsFor(execution.local_tools),
     codexSandbox: execution.local_tools === "workspace_write" ? "workspace-write" : "read-only",
     // Forge build/review turns emit a structured JSON envelope (reusing the AICOS
     // --output-format json pattern) so their summary is a real contract, not a stdout slice.
@@ -58722,8 +58793,19 @@ function buildTurnCommand(input) {
       "--mcp-config",
       configPath,
       "--strict-mcp-config",
+      // DER-2104: --tools is the HARD built-in whitelist. `--tools ""` (empty join for
+      // local_tools "none") removes Bash/Read/Write/Edit/… entirely, and the operator's
+      // settings.json cannot widen it — the real enforcement of `local_tools`. --allowedTools
+      // stays as the auto-approve list for the governed MCP + any declared local built-ins.
+      "--tools",
+      plan.localBuiltinTools.join(","),
       "--allowedTools",
       plan.claudeAllowedTools.join(","),
+      // DER-2104: unattended turns must never wait on a prompt — dontAsk auto-denies any tool
+      // call that would otherwise prompt. Governed MCP tools and the declared local built-ins
+      // are in --allowedTools (auto-approved, never prompt), so this only denies the unexpected.
+      "--permission-mode",
+      "dontAsk",
       "--output-format",
       plan.outputFormat,
       // DER-1397: turn off Claude Code's own nested Bash sandbox when the outer seatbelt confines
@@ -58955,6 +59037,17 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (execution?.profile === "forge_merge") {
     return runForgeMergeTurn(ctx, workOrder, execution, runtime);
   }
+  const requiresSandbox = Boolean(execution?.needs_repo) || execution?.local_tools === "workspace_write";
+  if (requiresSandbox) {
+    const refusal = sandboxRequiredTurnRefusal({
+      mode: ctx.config.sandboxMode,
+      platform: process.platform,
+      spec: ctx.config.sandbox
+    });
+    if (refusal) {
+      return { ok: false, summary: refusal };
+    }
+  }
   let forgePrep = null;
   if (execution?.needs_repo) {
     const prepared = await prepareForgeTurn(ctx, workOrder, execution);
@@ -58975,6 +59068,10 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(ctx.state, workOrder) : void 0;
   const built = buildTurnCommand({
     runtime,
@@ -59003,7 +59100,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
     // A Forge turn's cwd is its worktree; every other turn stays in tmpdir.
     cwd: plan.repoDir ?? tmpdir2(),
     timeoutMs: plan.timeoutMs,
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope,
     resumeSessionId,
     // T1.6: only Forge turns carry a structured evidence contract worth parsing.
@@ -59032,6 +59129,9 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   if (forgePrep) {
     if (plan.profile === "forge_build" && result.ok && forgePrep.credential.canPush) {
@@ -59149,6 +59249,11 @@ async function resolveMergeConflictTurn(ctx, input) {
     ],
     allowNetwork: ctx.config.sandboxAllowNetwork
   });
+  const sandboxRefusal = sandboxRequiredTurnRefusal({ mode: ctx.config.sandboxMode, platform: process.platform, spec: sandbox });
+  if (sandboxRefusal) {
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: false, result: { ok: false, summary: sandboxRefusal.slice(0, MERGE_CONFLICT_SUMMARY_MAX) } };
+  }
   const modelResult = await spawnMergeConflictModel(ctx, {
     workOrder: input.workOrder,
     execution: input.execution,
@@ -59179,6 +59284,10 @@ async function spawnMergeConflictModel(ctx, input) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = input.runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const plan = resolveTurnPlan({ kind: "work_order", execution: input.execution, repoDir: input.workspace.worktreeDir });
   const prompt = [
     "You are resolving a merge conflict on a pull request branch so it can merge into the base branch.",
@@ -59208,7 +59317,7 @@ async function spawnMergeConflictModel(ctx, input) {
     cwd: input.workspace.worktreeDir,
     timeoutMs: plan.timeoutMs,
     // The model gets the EXPLICIT allowlist env — never the merge token, GIT_ASKPASS, or the bearer.
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope: false
   });
   const exitClass = classifyModelExit(result);
@@ -59224,6 +59333,9 @@ async function spawnMergeConflictModel(ctx, input) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   return result;
 }