@rosthq/cli 0.7.113 → 0.7.115

package/dist/index.js

@@ -38708,6 +38708,14 @@ function accessLevelForScope(scopeTier) {
       return "admin";
   }
 }
+var RUNNER_WIRED_CONNECTOR_IDS = /* @__PURE__ */ new Set([
+  "gmail.read",
+  "gmail.draft",
+  "gmail.send",
+  "sheets.read",
+  "sheets.write",
+  "slack.post_message"
+]);
 function providerRequirementFor(entry) {
   if (!entry.credential_required) {
     return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
@@ -38730,6 +38738,12 @@ function trustedRequiredMetadataFor(entry) {
     "authorization_revoked_at"
   ];
 }
+function laneSupportFor(entry) {
+  if (providerRequirementFor(entry) === "connection" && !RUNNER_WIRED_CONNECTOR_IDS.has(entry.id)) {
+    return ["cloud"];
+  }
+  return ["cloud", "runner", "mcp"];
+}
 function enrichCatalogEntry(entry) {
   const accessLevels = [...new Set(entry.scope_tiers.map(accessLevelForScope))];
   return {
@@ -38738,7 +38752,7 @@ function enrichCatalogEntry(entry) {
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
     cost_class: entry.id === "script.run" || entry.id === "secret.broker" || entry.id === "baserow.read" || entry.id === "baserow.write" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
-    lane_support: ["cloud", "runner", "mcp"],
+    lane_support: laneSupportFor(entry),
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
 }
@@ -39856,6 +39870,8 @@ var tenantCapabilityGrantDtoSchema = external_exports.object({
   default_agent_access_level: capabilityGrantAccessLevelSchema,
   compile_status: capabilityGrantCompileStatusSchema
 }).strict();
+var capabilityGrantGrantSourceSchema = external_exports.enum(["charter", "template"]);
+var capabilityGrantCeilingSourceSchema = external_exports.enum(["tenant_policy", "unset"]);
 var agentEffectiveCapabilityGrantDtoSchema = external_exports.object({
   tool_grant_id: uuidSchema5,
   agent_tool_grant_id: uuidSchema5.nullable(),
@@ -39865,6 +39881,8 @@ var agentEffectiveCapabilityGrantDtoSchema = external_exports.object({
   availability: capabilityGrantAvailabilitySchema,
   source: capabilityGrantSourceSchema,
   selection_source: capabilityGrantSourceSchema.nullable(),
+  grant_source: capabilityGrantGrantSourceSchema.nullable(),
+  ceiling_source: capabilityGrantCeilingSourceSchema,
   max_access_level: capabilityGrantAccessLevelSchema,
   default_agent_access_level: capabilityGrantAccessLevelSchema,
   selected_access_level: capabilityGrantAccessLevelSchema,
@@ -48681,7 +48699,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-19.1",
+    version: "2026-07-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48737,6 +48755,10 @@ The native Gmail handlers run inside the same broker boundary as the REST and Sl
 
 Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose/send and Sheets, stores the returned credential in the vault, and records only account, scope, and capability-availability metadata in the integration row. Partial grants are accepted when at least one connector capability is usable; missing or revoked scopes reduce the affected capability instead of granting more authority. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail read/draft/send, bounded Sheets read, and approval-held Sheets write handlers run through the guarded broker when Google is connected; connecting Google still does not bypass the signed Charter manifest, tenant policy ceiling, credential vault, or tool-call audit. Sheet grants should use exact signed argument bindings for approved spreadsheet ids and ranges.
 
+## Connectors work the same on either lane
+
+A seat's governed connectors are available whether its agent runs on the cloud lane or the runner lane. {{brand}} projects each connector the seat's signed Charter grants onto the seat's own MCP surface and executes it server-side \u2014 so a runner-lane agent calls the same Gmail, Sheets, and Slack connectors a cloud-lane agent does, with identical governance: the same server guard, the same held-write approval for send/write tiers, and the same tool-call audit row. The OAuth or vaulted credential is resolved and bound only on the server inside the credential closure and never travels to the runner. Because this projection is derived from the Charter manifest and the connected integration, connecting a new integration makes its capabilities available to an already-live runner seat with no charter re-sign or code change. Connectors without a server-side handler yet stay cloud-only and are shown on the seat's Tools tab as not available on the runner lane until one ships.
+
 A connected Baserow REST integration (\`integration.connect_rest\`) derives a \`baserow.read\` tenant capability ceiling the same way: a live connection surfaces read, and a disconnected/revoked one collapses to off. The derivation is read-only by design \u2014 \`baserow.write\` is never inferred from the connection and is granted only through an explicit per-seat brokered secret grant, matching the conservative-by-default rule for every connection-backed ceiling.
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
@@ -48835,7 +48857,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-20.1",
+    version: "2026-07-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49575,7 +49597,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
 | \`rost_list_tenant_capability_grants\` | \`tool_grants.tenant.list\` | List tenant capability ceilings/defaults with connection, availability, source, and compile status. | Tenant | Call with \`{}\`; no secrets or vault refs. |
 | \`rost_update_tenant_capability_policy\` | \`tool_grants.tenant.update\` | Change tenant-wide capability ceilings/defaults with optimistic policy version or digest protection. | Tenant-admin | Human-gated; call with \`expected_policy_version\` or \`expected_policy_digest\`, \`mode\`, and grant ceiling changes. Returns changed grants, clamped defaults, and affected live agents. |
-| \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
+| \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants as a projection of the signed Charter manifest clamped by the tenant ceiling. Each grant carries provenance: \`grant_source\` (\`charter\` when the selected access comes from the signed manifest, else \`null\`) and \`ceiling_source\` (\`tenant_policy\`). This is the same computation the seat's Tools tab and the activation receipt project from, so the three agree \u2014 a charter-granted capability reads as granted, never a bare \`off\`. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_update_agent_capability_grants\` | \`tool_grants.agent.update\` | Compile a Charter supersession proposal for agent capability grant reductions or expansions. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","grants":[{"tool_grant_id":"<grant-id>","access_level":"read"}]}\`; active authority changes only after the signed Charter is superseded. |
 | \`rost_build_agent_activation_receipt\` | \`agent.activation_receipt\` | Build the current activation receipt for an agent: capabilities, connection metadata, digest, budget, and always-human boundary. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>"}\`; rebuild after Charter, connection, lane, schedule, or grant changes. |
 | \`rost_sign_agent_activation_receipt\` | \`agent.activation_sign\` | Human steward/admin sign-off for the exact activation receipt digest. | Tenant | Human-gated; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
@@ -56032,6 +56054,20 @@ function forgeBuildUnsupportedReason(platform2) {
   }
   return `Forge build execution is unsupported on this host: no macOS seatbelt (sandbox-exec) confinement is available on '${platform2}', so this runner cannot prove filesystem/egress isolation for an untrusted build turn. The server will not offer Forge-phase work to this runner \u2014 unless its tenant is on the narrow, operator-established trust allowlist (FORGE_SANDBOX_TRUSTED_TENANT_IDS) \u2014 until real Linux confinement (namespaces/Landlock, tracked as a DER-1343 follow-up) ships.`;
 }
+function sandboxRequiredTurnRefusal(input) {
+  if (input.spec.kind === "seatbelt") {
+    return null;
+  }
+  if (input.mode === "off") {
+    return null;
+  }
+  const postureLabel = input.mode === "strict" ? "strict" : "guard";
+  const override = "Set RUNNER_SANDBOX=off only on a trusted, founder-authorized host to override.";
+  if (input.platform !== "darwin") {
+    return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but macOS seatbelt confinement does not exist on this host ('${input.platform}') \u2014 seatbelt is macOS-only, and Linux confinement is a DER-1343 follow-up. The runner refuses rather than running an attacker-influenceable build turn unconfined. ${override}`;
+  }
+  return `Refusing to run this turn unconfined: sandbox mode is '${postureLabel}', but sandbox-exec is unavailable on this macOS host, so filesystem/egress confinement cannot be applied (${input.spec.reason}). The runner refuses rather than silently degrading to no sandbox. ${override}`;
+}
 function wrapCommandWithSandbox(spec, command, args, profilePath) {
   if (spec.kind === "none" || profilePath === null) {
     return { command, args, profilePath: null };
@@ -59005,6 +59041,17 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (execution?.profile === "forge_merge") {
     return runForgeMergeTurn(ctx, workOrder, execution, runtime);
   }
+  const requiresSandbox = Boolean(execution?.needs_repo) || execution?.local_tools === "workspace_write";
+  if (requiresSandbox) {
+    const refusal = sandboxRequiredTurnRefusal({
+      mode: ctx.config.sandboxMode,
+      platform: process.platform,
+      spec: ctx.config.sandbox
+    });
+    if (refusal) {
+      return { ok: false, summary: refusal };
+    }
+  }
   let forgePrep = null;
   if (execution?.needs_repo) {
     const prepared = await prepareForgeTurn(ctx, workOrder, execution);
@@ -59206,6 +59253,11 @@ async function resolveMergeConflictTurn(ctx, input) {
     ],
     allowNetwork: ctx.config.sandboxAllowNetwork
   });
+  const sandboxRefusal = sandboxRequiredTurnRefusal({ mode: ctx.config.sandboxMode, platform: process.platform, spec: sandbox });
+  if (sandboxRefusal) {
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: false, result: { ok: false, summary: sandboxRefusal.slice(0, MERGE_CONFLICT_SUMMARY_MAX) } };
+  }
   const modelResult = await spawnMergeConflictModel(ctx, {
     workOrder: input.workOrder,
     execution: input.execution,