@rosthq/cli 0.7.29 → 0.7.30

package/dist/runner-sandbox.d.ts

@@ -0,0 +1,94 @@
+export declare const SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+export declare const RUNNER_TEMP_PREFIXES: readonly ["rost-runner-mcp-", "rost-runner-sandbox-", "rost-runner-askpass-"];
+export type SandboxMode = "auto" | "off" | "strict";
+export declare function parseSandboxMode(value: string | undefined): SandboxMode;
+export declare function parseSandboxNetwork(value: string | undefined): {
+    allowNetwork: boolean;
+    unrecognized: string | null;
+};
+export type SandboxProfileInput = {
+    workspaceDir: string;
+    tmpDir: string;
+    homeDir: string;
+    denyReadPaths: string[];
+    allowWritePaths: string[];
+    allowNetwork: boolean;
+    strict: boolean;
+};
+/**
+ * Build a macOS seatbelt (SBPL) profile string. Pure — fully unit-testable without
+ * spawning anything.
+ *
+ * READS differ by mode: guard is allow-default with explicit credential/bearer denies;
+ * strict is deny-default with a system+workspace allowlist.
+ *
+ * WRITES are deny-default in BOTH modes — the security review (finding 1) showed an
+ * allow-default guard write posture is a token-capture path: a prompt-injected model
+ * writes `[credential] helper=<evil>` / `core.hooksPath` into ~/.gitconfig (or a
+ * ~/bin/git shim, or a shell-login file), and the very next HARNESS-executed git op —
+ * unsandboxed, same HOME — runs attacker code at operator uid and can capture the
+ * GitHub installation token. A hand-enumerated denylist can never be complete, so
+ * writes are confined to the workspace + tmp + the model runtimes' own dirs, mirroring
+ * strict. The explicit persistence-vector deny is kept as last-wins defense in depth.
+ *
+ * Rule ordering is the whole game: SBPL evaluates in order, LAST match wins, and it
+ * has no notion of "most specific path wins". So the layout is deliberate:
+ *
+ *   1. base-dir READ denies (the runner base — dirs the workspace may live UNDER) —
+ *      placed BEFORE the workspace re-allow, so a sibling workspace stays denied.
+ *   2. re-allow the model's OWN workspace — defeats (1) for its own checkout only.
+ *   3. credential-store + bearer-file READ denies — placed AFTER the workspace
+ *      re-allow so nothing re-opens them (the production read-only turn runs with
+ *      workspaceDir == tmpDir and the bearer state file lives in tmp: a broad "allow
+ *      read of the workspace(=tmp)" would otherwise re-expose the bearer). These paths
+ *      are never under the workspace, so denying them last is always safe.
+ */
+export declare function buildSeatbeltProfile(input: SandboxProfileInput): string;
+export type SandboxSpec = {
+    kind: "none";
+    reason: string;
+} | {
+    kind: "seatbelt";
+    reason: string;
+    profile: string;
+    allowNetwork: boolean;
+};
+export type ResolveSandboxOptions = {
+    mode: SandboxMode;
+    platform: NodeJS.Platform;
+    workspaceDir: string;
+    tmpDir: string;
+    homeDir: string;
+    stateFile: string;
+    runnerBaseDir?: string;
+    allowWritePaths?: string[];
+    allowNetwork?: boolean;
+    sandboxExecAvailable?: boolean;
+};
+export declare function isSandboxExecAvailable(): boolean;
+/**
+ * Decide whether and how to sandbox a model spawn. `off` disables confinement (the
+ * founder-authorized loosened fallback for trusted demo machines — logged loudly by
+ * the caller). `auto`/`strict` require macOS + `sandbox-exec`; on any other platform
+ * they degrade to `none` with a reason (Linux namespace/Landlock confinement is a
+ * hardening follow-up), so the runner never fails to start for lack of a sandbox.
+ */
+export declare function resolveSandboxSpec(options: ResolveSandboxOptions): SandboxSpec;
+export type WrappedCommand = {
+    command: string;
+    args: string[];
+    profilePath: string | null;
+};
+export declare function wrapCommandWithSandbox(spec: SandboxSpec, command: string, args: string[], profilePath: string | null): WrappedCommand;
+/**
+ * Remove stale runner temp artifacts (orphaned MCP config files carrying seat tokens,
+ * sandbox profiles, askpass helpers) from a directory. Best-effort and idempotent:
+ * per-file errors are swallowed so a locked/racing file never crashes startup.
+ * Returns the basenames actually removed. Only files older than `maxAgeMs` are
+ * touched, so a concurrently-running turn's live temp files are never yanked.
+ */
+export declare function sweepStaleRunnerTempFiles(dir: string, options?: {
+    maxAgeMs?: number;
+    now?: number;
+}): Promise<string[]>;
+//# sourceMappingURL=runner-sandbox.d.ts.map

package/dist/runner-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-sandbox.d.ts","sourceRoot":"","sources":["../src/runner-sandbox.ts"],"names":[],"mappings":"AA+BA,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAKzD,eAAO,MAAM,oBAAoB,+EAIvB,CAAC;AA0CX,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEpD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAQvE;AAMD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CASrH;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAGhB,aAAa,EAAE,MAAM,EAAE,CAAC;IAGxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,YAAY,EAAE,OAAO,CAAC;IAGtB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAgCF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAoGvE;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;IAGlB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAuBF,wBAAgB,sBAAsB,IAAI,OAAO,CAMhD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,CA4C9E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IAGf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAKF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,cAAc,CAShB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BnB"}

package/dist/runner-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-serve.d.ts","sourceRoot":"","sources":["../src/runner-serve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,KAAK,aAAa,GAAG;IACnB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AA8DF,wBAAsB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDjF;AAuID,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAW5F"}
+{"version":3,"file":"runner-serve.d.ts","sourceRoot":"","sources":["../src/runner-serve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD,KAAK,aAAa,GAAG;IACnB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AAqEF,wBAAsB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuEjF;AAmKD,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAW5F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rosthq/cli",
-  "version": "0.7.29",
+  "version": "0.7.30",
   "private": false,
   "type": "module",
   "description": "Command-line adapter for the server-side command surface.",