@rosthq/cli 0.7.46 → 0.7.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +9 -1
- package/dist/index.js.map +2 -2
- package/dist/runner-sandbox.d.ts +1 -0
- package/dist/runner-sandbox.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -52744,6 +52744,9 @@ function isSandboxExecAvailable() {
|
|
|
52744
52744
|
return false;
|
|
52745
52745
|
}
|
|
52746
52746
|
}
|
|
52747
|
+
function claudeBashTempRoot(uid) {
|
|
52748
|
+
return `/private/tmp/claude-${uid}`;
|
|
52749
|
+
}
|
|
52747
52750
|
function resolveSandboxSpec(options) {
|
|
52748
52751
|
if (options.mode === "off") {
|
|
52749
52752
|
return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
|
|
@@ -52766,12 +52769,17 @@ function resolveSandboxSpec(options) {
|
|
|
52766
52769
|
const denyWritePaths = (options.denyWritePaths ?? []).map(
|
|
52767
52770
|
(p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
|
|
52768
52771
|
);
|
|
52772
|
+
const uid = typeof process.getuid === "function" ? process.getuid() : null;
|
|
52773
|
+
const allowWritePaths = [
|
|
52774
|
+
...(options.allowWritePaths ?? []).map(canonical),
|
|
52775
|
+
...uid !== null ? [canonicalFile(claudeBashTempRoot(uid))] : []
|
|
52776
|
+
];
|
|
52769
52777
|
const profile = buildSeatbeltProfile({
|
|
52770
52778
|
workspaceDir,
|
|
52771
52779
|
tmpDir,
|
|
52772
52780
|
homeDir,
|
|
52773
52781
|
denyReadPaths,
|
|
52774
|
-
allowWritePaths
|
|
52782
|
+
allowWritePaths,
|
|
52775
52783
|
denyWritePaths,
|
|
52776
52784
|
allowNetwork,
|
|
52777
52785
|
strict: options.mode === "strict"
|