@rosthq/cli 0.7.49 → 0.7.50

package/dist/index.js

@@ -52647,6 +52647,7 @@ function subpath(value) {
 function literal2(value) {
   return `(literal ${sbplString(value)})`;
 }
+var CLAUDE_TEMP_SBPL_REGEX = '(regex #"^/private/tmp/claude-[^/]+")';
 var STRICT_SYSTEM_READ_SUBPATHS = [
   "/usr",
   "/bin",
@@ -52693,7 +52694,7 @@ function buildSeatbeltProfile(input) {
   if (denyReadBaseSubpaths.length > 0) {
     lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
   }
-  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath)];
+  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath), CLAUDE_TEMP_SBPL_REGEX];
   lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
   lines.push("(deny file-write*)");
   const allowWrites = [
@@ -52702,6 +52703,8 @@ function buildSeatbeltProfile(input) {
     subpath(`${home}/.claude`),
     subpath(`${home}/.codex`),
     ...input.allowWritePaths.map(subpath),
+    CLAUDE_TEMP_SBPL_REGEX,
+    // DER-1398: Claude Code's per-session + per-command temp dirs.
     subpath("/dev/fd"),
     literal2("/dev/null"),
     literal2("/dev/stdout"),
@@ -52747,9 +52750,6 @@ function isSandboxExecAvailable() {
     return false;
   }
 }
-function claudeBashTempRoot(uid) {
-  return `/private/tmp/claude-${uid}`;
-}
 function resolveSandboxSpec(options) {
   if (options.mode === "off") {
     return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
@@ -52772,11 +52772,7 @@ function resolveSandboxSpec(options) {
   const denyWritePaths = (options.denyWritePaths ?? []).map(
     (p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
   );
-  const uid = typeof process.getuid === "function" ? process.getuid() : null;
-  const allowWritePaths = [
-    ...(options.allowWritePaths ?? []).map(canonical),
-    ...uid !== null ? [canonicalFile(claudeBashTempRoot(uid))] : []
-  ];
+  const allowWritePaths = (options.allowWritePaths ?? []).map(canonical);
   const profile = buildSeatbeltProfile({
     workspaceDir,
     tmpDir,