@rosthq/cli 0.7.48 → 0.7.50

package/dist/index.js

@@ -52647,6 +52647,7 @@ function subpath(value) {
 function literal2(value) {
   return `(literal ${sbplString(value)})`;
 }
+var CLAUDE_TEMP_SBPL_REGEX = '(regex #"^/private/tmp/claude-[^/]+")';
 var STRICT_SYSTEM_READ_SUBPATHS = [
   "/usr",
   "/bin",
@@ -52693,7 +52694,7 @@ function buildSeatbeltProfile(input) {
   if (denyReadBaseSubpaths.length > 0) {
     lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
   }
-  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath)];
+  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath), CLAUDE_TEMP_SBPL_REGEX];
   lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
   lines.push("(deny file-write*)");
   const allowWrites = [
@@ -52702,6 +52703,8 @@ function buildSeatbeltProfile(input) {
     subpath(`${home}/.claude`),
     subpath(`${home}/.codex`),
     ...input.allowWritePaths.map(subpath),
+    CLAUDE_TEMP_SBPL_REGEX,
+    // DER-1398: Claude Code's per-session + per-command temp dirs.
     subpath("/dev/fd"),
     literal2("/dev/null"),
     literal2("/dev/stdout"),
@@ -52747,9 +52750,6 @@ function isSandboxExecAvailable() {
     return false;
   }
 }
-function claudeBashTempRoot(uid) {
-  return `/private/tmp/claude-${uid}`;
-}
 function resolveSandboxSpec(options) {
   if (options.mode === "off") {
     return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
@@ -52772,11 +52772,7 @@ function resolveSandboxSpec(options) {
   const denyWritePaths = (options.denyWritePaths ?? []).map(
     (p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
   );
-  const uid = typeof process.getuid === "function" ? process.getuid() : null;
-  const allowWritePaths = [
-    ...(options.allowWritePaths ?? []).map(canonical),
-    ...uid !== null ? [canonicalFile(claudeBashTempRoot(uid))] : []
-  ];
+  const allowWritePaths = (options.allowWritePaths ?? []).map(canonical);
   const profile = buildSeatbeltProfile({
     workspaceDir,
     tmpDir,
@@ -53459,7 +53455,7 @@ function resolveTurnPlan(input) {
   };
 }
 function buildTurnCommand(input) {
-  const { runtime, prompt, configPath, plan, resumeSessionId } = input;
+  const { runtime, prompt, configPath, plan, resumeSessionId, disableClaudeBashSandbox } = input;
   if (runtime === "codex") {
     return {
       command: "codex",
@@ -53488,6 +53484,9 @@ function buildTurnCommand(input) {
       plan.claudeAllowedTools.join(","),
       "--output-format",
       plan.outputFormat,
+      // DER-1397: turn off Claude Code's own nested Bash sandbox when the outer seatbelt confines
+      // us — the JSON is passed inline (no secret; sandbox-exec reads its profile from a file).
+      ...disableClaudeBashSandbox ? ["--settings", '{"sandbox":{"enabled":false}}'] : [],
       ...plan.repoDir !== null ? ["--add-dir", plan.repoDir] : [],
       ...resumeSessionId ? ["--resume", resumeSessionId] : []
     ]
@@ -53728,7 +53727,15 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
 `, { mode: 384 });
   await chmod2(configPath, 384);
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(ctx.state, workOrder) : void 0;
-  const built = buildTurnCommand({ runtime, prompt, configPath, plan, resumeSessionId });
+  const built = buildTurnCommand({
+    runtime,
+    prompt,
+    configPath,
+    plan,
+    resumeSessionId,
+    // DER-1397: outer seatbelt active ⇒ disable claude's nested bash sandbox (bash runs in the repo cwd).
+    disableClaudeBashSandbox: sandbox.kind === "seatbelt"
+  });
   let sandboxProfilePath = null;
   if (sandbox.kind === "seatbelt") {
     sandboxProfilePath = path5.join(
@@ -53935,7 +53942,14 @@ async function spawnMergeConflictModel(ctx, input) {
     await writeFile3(sandboxProfilePath, input.sandbox.profile, { mode: 384 });
     await chmod2(sandboxProfilePath, 384);
   }
-  const built = buildTurnCommand({ runtime: input.runtime, prompt, configPath, plan });
+  const built = buildTurnCommand({
+    runtime: input.runtime,
+    prompt,
+    configPath,
+    plan,
+    // DER-1397: outer seatbelt active ⇒ disable claude's nested bash sandbox (bash runs in the repo cwd).
+    disableClaudeBashSandbox: input.sandbox.kind === "seatbelt"
+  });
   const { command, args } = wrapCommandWithSandbox(input.sandbox, built.command, built.args, sandboxProfilePath);
   const spawnStartedAt = (/* @__PURE__ */ new Date()).toISOString();
   const result = await runModelProcess({