@rosthq/cli 0.7.113 → 0.7.114

package/dist/index.js

@@ -38708,6 +38708,14 @@ function accessLevelForScope(scopeTier) {
       return "admin";
   }
 }
+var RUNNER_WIRED_CONNECTOR_IDS = /* @__PURE__ */ new Set([
+  "gmail.read",
+  "gmail.draft",
+  "gmail.send",
+  "sheets.read",
+  "sheets.write",
+  "slack.post_message"
+]);
 function providerRequirementFor(entry) {
   if (!entry.credential_required) {
     return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
@@ -38730,6 +38738,12 @@ function trustedRequiredMetadataFor(entry) {
     "authorization_revoked_at"
   ];
 }
+function laneSupportFor(entry) {
+  if (providerRequirementFor(entry) === "connection" && !RUNNER_WIRED_CONNECTOR_IDS.has(entry.id)) {
+    return ["cloud"];
+  }
+  return ["cloud", "runner", "mcp"];
+}
 function enrichCatalogEntry(entry) {
   const accessLevels = [...new Set(entry.scope_tiers.map(accessLevelForScope))];
   return {
@@ -38738,7 +38752,7 @@ function enrichCatalogEntry(entry) {
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
     cost_class: entry.id === "script.run" || entry.id === "secret.broker" || entry.id === "baserow.read" || entry.id === "baserow.write" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
-    lane_support: ["cloud", "runner", "mcp"],
+    lane_support: laneSupportFor(entry),
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
 }
@@ -48681,7 +48695,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-19.1",
+    version: "2026-07-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48737,6 +48751,10 @@ The native Gmail handlers run inside the same broker boundary as the REST and Sl
 
 Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose/send and Sheets, stores the returned credential in the vault, and records only account, scope, and capability-availability metadata in the integration row. Partial grants are accepted when at least one connector capability is usable; missing or revoked scopes reduce the affected capability instead of granting more authority. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail read/draft/send, bounded Sheets read, and approval-held Sheets write handlers run through the guarded broker when Google is connected; connecting Google still does not bypass the signed Charter manifest, tenant policy ceiling, credential vault, or tool-call audit. Sheet grants should use exact signed argument bindings for approved spreadsheet ids and ranges.
 
+## Connectors work the same on either lane
+
+A seat's governed connectors are available whether its agent runs on the cloud lane or the runner lane. {{brand}} projects each connector the seat's signed Charter grants onto the seat's own MCP surface and executes it server-side \u2014 so a runner-lane agent calls the same Gmail, Sheets, and Slack connectors a cloud-lane agent does, with identical governance: the same server guard, the same held-write approval for send/write tiers, and the same tool-call audit row. The OAuth or vaulted credential is resolved and bound only on the server inside the credential closure and never travels to the runner. Because this projection is derived from the Charter manifest and the connected integration, connecting a new integration makes its capabilities available to an already-live runner seat with no charter re-sign or code change. Connectors without a server-side handler yet stay cloud-only and are shown on the seat's Tools tab as not available on the runner lane until one ships.
+
 A connected Baserow REST integration (\`integration.connect_rest\`) derives a \`baserow.read\` tenant capability ceiling the same way: a live connection surfaces read, and a disconnected/revoked one collapses to off. The derivation is read-only by design \u2014 \`baserow.write\` is never inferred from the connection and is granted only through an explicit per-seat brokered secret grant, matching the conservative-by-default rule for every connection-backed ceiling.
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
@@ -56032,6 +56050,20 @@ function forgeBuildUnsupportedReason(platform2) {
   }
   return `Forge build execution is unsupported on this host: no macOS seatbelt (sandbox-exec) confinement is available on '${platform2}', so this runner cannot prove filesystem/egress isolation for an untrusted build turn. The server will not offer Forge-phase work to this runner \u2014 unless its tenant is on the narrow, operator-established trust allowlist (FORGE_SANDBOX_TRUSTED_TENANT_IDS) \u2014 until real Linux confinement (namespaces/Landlock, tracked as a DER-1343 follow-up) ships.`;
 }
+function sandboxRequiredTurnRefusal(input) {
+  if (input.spec.kind === "seatbelt") {
+    return null;
+  }
+  if (input.mode === "off") {
+    return null;
+  }
+  const postureLabel = input.mode === "strict" ? "strict" : "guard";
+  const override = "Set RUNNER_SANDBOX=off only on a trusted, founder-authorized host to override.";
+  if (input.platform !== "darwin") {
+    return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but macOS seatbelt confinement does not exist on this host ('${input.platform}') \u2014 seatbelt is macOS-only, and Linux confinement is a DER-1343 follow-up. The runner refuses rather than running an attacker-influenceable build turn unconfined. ${override}`;
+  }
+  return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but sandbox-exec is unavailable on this macOS host, so filesystem/egress confinement cannot be applied (${input.spec.reason}). The runner refuses rather than silently degrading to no sandbox. ${override}`;
+}
 function wrapCommandWithSandbox(spec, command, args, profilePath) {
   if (spec.kind === "none" || profilePath === null) {
     return { command, args, profilePath: null };
@@ -59005,6 +59037,17 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (execution?.profile === "forge_merge") {
     return runForgeMergeTurn(ctx, workOrder, execution, runtime);
   }
+  const requiresSandbox = Boolean(execution?.needs_repo) || execution?.local_tools === "workspace_write";
+  if (requiresSandbox) {
+    const refusal = sandboxRequiredTurnRefusal({
+      mode: ctx.config.sandboxMode,
+      platform: process.platform,
+      spec: ctx.config.sandbox
+    });
+    if (refusal) {
+      return { ok: false, summary: refusal };
+    }
+  }
   let forgePrep = null;
   if (execution?.needs_repo) {
     const prepared = await prepareForgeTurn(ctx, workOrder, execution);
@@ -59206,6 +59249,11 @@ async function resolveMergeConflictTurn(ctx, input) {
     ],
     allowNetwork: ctx.config.sandboxAllowNetwork
   });
+  const sandboxRefusal = sandboxRequiredTurnRefusal({ mode: ctx.config.sandboxMode, platform: process.platform, spec: sandbox });
+  if (sandboxRefusal) {
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: false, result: { ok: false, summary: sandboxRefusal.slice(0, MERGE_CONFLICT_SUMMARY_MAX) } };
+  }
   const modelResult = await spawnMergeConflictModel(ctx, {
     workOrder: input.workOrder,
     execution: input.execution,