@sentropic/h2a-runtime 0.98.6 → 0.98.7-rc.10

package/dist/claude-code-cli-isolation.js

@@ -0,0 +1,277 @@
+/**
+ * Claude Code CLI isolation: private filesystem root, clean environment,
+ * and exclusive credential creation.
+ */
+import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, isAbsolute, join } from "node:path";
+import { readBootId, readPidNamespaceId, readProcessStartTime } from "./proc-identity.js";
+export const ALLOWED_ENV_VARS = [
+    "PATH",
+    "LANG",
+    "LC_ALL",
+    "HOME",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "CLAUDE_CONFIG_DIR",
+];
+/**
+ * Verify a private directory: never a symlink, always a directory owned by
+ * this user, always mode 0700. Pre-existing paths are tightened, never
+ * trusted as found. Throws a static error on any refusal.
+ */
+function ensurePrivateDir(dir) {
+    let current;
+    try {
+        current = lstatSync(dir);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw new Error("Claude private runtime root refused");
+        }
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        current = lstatSync(dir);
+    }
+    if (current.isSymbolicLink()) {
+        throw new Error("Claude private runtime root refused: symbolic link");
+    }
+    if (!current.isDirectory()) {
+        throw new Error("Claude private runtime root refused: not a directory");
+    }
+    const euid = process.geteuid?.();
+    if (typeof euid === "number" && current.uid !== euid) {
+        throw new Error("Claude private runtime root refused: foreign owner");
+    }
+    try {
+        chmodSync(dir, 0o700);
+    }
+    catch {
+        throw new Error("Claude private runtime root refused");
+    }
+    const verified = lstatSync(dir);
+    if (verified.isSymbolicLink() || !verified.isDirectory()) {
+        throw new Error("Claude private runtime root refused");
+    }
+    if ((verified.mode & 0o777) !== 0o700) {
+        throw new Error("Claude private runtime root refused: permissions");
+    }
+    if (typeof euid === "number" && verified.uid !== euid) {
+        throw new Error("Claude private runtime root refused: foreign owner");
+    }
+    return dir;
+}
+function verifyUserBaseDir(dir) {
+    let current;
+    try {
+        current = lstatSync(dir);
+    }
+    catch {
+        throw new Error("Claude private runtime root refused");
+    }
+    if (current.isSymbolicLink() || !current.isDirectory()) {
+        throw new Error("Claude private runtime root refused");
+    }
+    const euid = process.geteuid?.();
+    if (typeof euid === "number" && current.uid !== euid) {
+        throw new Error("Claude private runtime root refused: foreign owner");
+    }
+}
+/**
+ * Resolve the dedicated private runtime root outside workspaces and backups.
+ * Only per-user bases are candidates (XDG_RUNTIME_DIR, then /run/user/<euid>
+ * on Linux). Shared temporary roots (/dev/shm, tmpdir()) are never used;
+ * when no per-user base is available resolution fails closed.
+ */
+export function resolvePrivateRuntimeRoot(customRoot) {
+    if (customRoot) {
+        return ensurePrivateDir(customRoot);
+    }
+    const xdgBase = process.env.XDG_RUNTIME_DIR;
+    if (xdgBase) {
+        try {
+            verifyUserBaseDir(xdgBase);
+            return ensurePrivateDir(join(xdgBase, "h2a-claude-runtime"));
+        }
+        catch {
+            // Fall through to the next per-user candidate.
+        }
+    }
+    if (process.platform === "linux") {
+        const euid = process.geteuid?.();
+        if (typeof euid === "number") {
+            try {
+                const userBase = `/run/user/${euid}`;
+                verifyUserBaseDir(userBase);
+                return ensurePrivateDir(join(userBase, "h2a-claude-runtime"));
+            }
+            catch {
+                // Fall through to fail-closed.
+            }
+        }
+    }
+    throw new Error("Claude private runtime root unavailable: no per-user runtime directory");
+}
+/**
+ * Creates isolated 0700 run/config/home/cwd directories and an exclusive 0600 .credentials.json.
+ * Writes access token only; real provider expiry preserved; NO refresh token.
+ */
+export function createClaudeRunSandbox(options) {
+    const runId = options.runId ?? `run_${randomUUID().replace(/-/g, "")}`;
+    const root = resolvePrivateRuntimeRoot(options.rootDir);
+    const runDir = join(root, runId);
+    // 0700 private run directory
+    mkdirSync(runDir, { recursive: true, mode: 0o700 });
+    const homeDir = join(runDir, "home");
+    const configDir = join(runDir, "config");
+    const cwdDir = join(runDir, "cwd");
+    const tmpDir = join(runDir, "tmp");
+    mkdirSync(homeDir, { recursive: true, mode: 0o700 });
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+    mkdirSync(cwdDir, { recursive: true, mode: 0o700 });
+    mkdirSync(tmpDir, { recursive: true, mode: 0o700 });
+    // Identity-anchored run metadata for orphan sweeps: pid plus start-time
+    // and boot discriminants, so a later sweep can prove death instead of
+    // guessing from pid presence or directory age.
+    const runMeta = {
+        pid: process.pid,
+        startTime: readProcessStartTime(process.pid) ?? null,
+        bootId: readBootId() ?? null,
+        pidNamespace: readPidNamespaceId() ?? null,
+        createdAt: Date.now(),
+    };
+    writeFileSync(join(runDir, "run-meta.json"), JSON.stringify(runMeta), { mode: 0o600 });
+    const settingsPath = join(configDir, "settings.json");
+    const mcpConfigPath = join(configDir, "mcp-config.json");
+    writeFileSync(settingsPath, JSON.stringify({}), { mode: 0o600 });
+    writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers: {} }), { mode: 0o600 });
+    const credentialPath = join(configDir, ".credentials.json");
+    // Exclusive, no-follow creation (O_CREAT | O_EXCL | O_WRONLY | O_NOFOLLOW)
+    const openFlags = constants.O_CREAT |
+        constants.O_EXCL |
+        constants.O_WRONLY |
+        (constants.O_NOFOLLOW ?? 0);
+    const fd = openSync(credentialPath, openFlags, 0o600);
+    try {
+        const credentialPayload = JSON.stringify({
+            claudeAiOauth: {
+                accessToken: options.access.accessToken,
+                expiresAt: options.access.expiresAt,
+                scopes: [...options.access.scopes],
+            },
+        });
+        writeFileSync(fd, credentialPayload, { encoding: "utf8" });
+    }
+    finally {
+        closeSync(fd);
+    }
+    // Verify ownership and permissions: must not be a symlink
+    const lstat = lstatSync(credentialPath);
+    if (lstat.isSymbolicLink()) {
+        rmSync(runDir, { recursive: true, force: true });
+        throw new Error("Credential file must not be a symbolic link");
+    }
+    return {
+        runId,
+        runDir,
+        homeDir,
+        configDir,
+        cwdDir,
+        tmpDir,
+        credentialPath,
+        settingsPath,
+        mcpConfigPath,
+    };
+}
+/**
+ * Record child PID and start time in the run's run-meta.json so orphan sweeps
+ * can identify and reap detached child process trees.
+ */
+export function recordChildPidInSandbox(sandbox, childPid) {
+    const metaPath = join(sandbox.runDir, "run-meta.json");
+    try {
+        const existing = JSON.parse(readFileSync(metaPath, "utf8"));
+        const updated = {
+            ...existing,
+            childPid,
+            childStartTime: readProcessStartTime(childPid) ?? null,
+            childBootId: readBootId() ?? null,
+            childPidNamespace: readPidNamespaceId() ?? null,
+            childCwd: sandbox.cwdDir,
+            runId: sandbox.runId,
+        };
+        writeFileSync(metaPath, JSON.stringify(updated), { mode: 0o600 });
+    }
+    catch {
+        // Best effort
+    }
+}
+/**
+ * Construct an environment allowlist; strips all ambient auth, proxies, traces, and overrides.
+ * PATH is never inherited: a fixed minimal value (plus the binary directory
+ * when known) replaces whatever the parent carried.
+ */
+export function buildIsolatedEnvironment(sandbox, baseEnv = process.env, options = {}) {
+    const fixedPath = options.binaryPath && isAbsolute(options.binaryPath)
+        ? `${dirname(options.binaryPath)}:/usr/local/bin:/usr/bin:/bin`
+        : "/usr/local/bin:/usr/bin:/bin";
+    const safeEnv = {
+        PATH: fixedPath,
+        LANG: baseEnv.LANG ?? "C.UTF-8",
+        LC_ALL: baseEnv.LC_ALL ?? "C.UTF-8",
+        HOME: sandbox.homeDir,
+        TMPDIR: sandbox.tmpDir,
+        XDG_CONFIG_HOME: sandbox.configDir,
+        CLAUDE_CONFIG_DIR: sandbox.configDir,
+    };
+    return safeEnv;
+}
+/**
+ * Verify that the child process did not rewrite credentials, change auth, or write back a refresh token.
+ */
+export function verifyCredentialNotRewritten(sandbox, expectedAccess) {
+    if (!existsSync(sandbox.credentialPath)) {
+        return false;
+    }
+    const lstat = lstatSync(sandbox.credentialPath);
+    if (lstat.isSymbolicLink()) {
+        return false;
+    }
+    try {
+        const raw = readFileSync(sandbox.credentialPath, "utf8");
+        const parsed = JSON.parse(raw);
+        const oauth = parsed?.claudeAiOauth;
+        if (!oauth || typeof oauth !== "object")
+            return false;
+        // No refresh token allowed
+        if ("refreshToken" in oauth || "refresh_token" in oauth)
+            return false;
+        // Must match expected access material
+        if (oauth.accessToken !== expectedAccess.accessToken)
+            return false;
+        if (oauth.expiresAt !== expectedAccess.expiresAt)
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Content-blind cleanup of the dedicated sandbox directory without following symlinks.
+ * Throws a static error when the run directory persists: callers must block
+ * any success terminal on cleanup failure (no success without custody release).
+ */
+export function cleanClaudeRunSandbox(sandbox) {
+    try {
+        if (existsSync(sandbox.runDir)) {
+            rmSync(sandbox.runDir, { recursive: true, force: true });
+        }
+    }
+    catch {
+        throw new Error("Claude run sandbox cleanup failed");
+    }
+    if (existsSync(sandbox.runDir)) {
+        throw new Error("Claude run sandbox cleanup failed");
+    }
+}
+//# sourceMappingURL=claude-code-cli-isolation.js.map

package/dist/claude-code-cli-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-cli-isolation.js","sourceRoot":"","sources":["../src/claude-code-cli-isolation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAe1F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAEX;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAmB;IAC3D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAE,CAAC;gBACrC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5B,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEjC,6BAA6B;IAC7B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEnC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,wEAAwE;IACxE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI;QACpD,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI;QAC5B,YAAY,EAAE,kBAAkB,EAAE,IAAI,IAAI;QAC1C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzD,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAElF,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,MAAM,SAAS,GACb,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,MAAM;QAChB,SAAS,CAAC,QAAQ;QAClB,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IAE9B,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;YACvC,aAAa,EAAE;gBACb,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;gBACvC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;gBACnC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;aACnC;SACF,CAAC,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,0DAA0D;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,KAAK;QACL,MAAM;QACN,OAAO;QACP,SAAS;QACT,MAAM;QACN,MAAM;QACN,cAAc;QACd,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAyB,EAAE,QAAgB;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ;YACX,QAAQ;YACR,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,IAAI;YACtD,WAAW,EAAE,UAAU,EAAE,IAAI,IAAI;YACjC,iBAAiB,EAAE,kBAAkB,EAAE,IAAI,IAAI;YAC/C,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;QACF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAyB,EACzB,UAA6B,OAAO,CAAC,GAAG,EACxC,UAA4C,EAAE;IAE9C,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B;QAC/D,CAAC,CAAC,8BAA8B,CAAC;IACrC,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;QACnC,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,SAAS;QAClC,iBAAiB,EAAE,OAAO,CAAC,SAAS;KACrC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAyB,EACzB,cAA0C;IAE1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,2BAA2B;QAC3B,IAAI,cAAc,IAAI,KAAK,IAAI,eAAe,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAEtE,sCAAsC;QACtC,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAE/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAyB;IAC7D,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/claude-code-cli-lifecycle.d.ts

@@ -0,0 +1,80 @@
+export declare const DEFAULT_ORPHAN_STALE_AFTER_MS: number;
+export declare const DEFAULT_MIN_REMAINING_TTL_MS = 60000;
+export declare const DEFAULT_MAX_REMAINING_TTL_MS = 86400000;
+/**
+ * Account locking lives in the mesh account directory, like every other
+ * seat: h2a holds no per-account lease here. The holder record below only
+ * describes sweep/identity metadata (run-meta.json and the sweep lock),
+ * never a lock claim.
+ */
+export interface ClaudeSweepHolderRecord {
+    readonly pid?: unknown;
+    readonly startTime?: unknown;
+    readonly bootId?: unknown;
+    readonly pidNamespace?: unknown;
+    readonly machineId?: unknown;
+    readonly token?: unknown;
+}
+/**
+ * Positively prove that a live child process is the exact process spawned by this sandbox.
+ * Fails closed: never signals on PID presence alone, across reboot, across PID namespace
+ * boundary, across PID reuse, or when start-time was unrecorded or mismatched.
+ */
+export declare function isRecordedChildProvenTarget(childPid: number, rawMeta: {
+    readonly childStartTime?: unknown;
+    readonly childBootId?: unknown;
+    readonly childPidNamespace?: unknown;
+    readonly childCwd?: unknown;
+    readonly runId?: unknown;
+}, parentMeta: ClaudeSweepHolderRecord, runDir: string): {
+    proven: boolean;
+    reason?: string;
+};
+/**
+ * Account locking lives in the mesh account directory for every seat
+ * (owner decision 2026-10-13, realign on the common seat model): h2a holds
+ * no per-account lease. `acquireClaudeAccountLease` and
+ * `reclaimDeadAccountLock` were removed without replacement — the mesh route
+ * planner serializes acquisition and refresh. What follows is TTL admission,
+ * process reaping, and the orphan sweep (proven-dead sandboxes only).
+ */
+/**
+ * Validate token remaining TTL against admission boundaries.
+ * Preserves real provider expiry without rewriting or fabricating timestamps.
+ */
+export declare function checkTokenTtlAdmission(expiresAt: number, now?: number, minTtlMs?: number, maxTtlMs?: number): {
+    admitted: boolean;
+    reason?: string;
+};
+/**
+ * Supervise process tree and guarantee reaping of child and all descendants.
+ */
+export declare function reapProcessTree(pid: number, signal?: NodeJS.Signals, gracePeriodMs?: number): Promise<void>;
+export interface SweepResult {
+    readonly swept: number;
+    readonly retained: number;
+    readonly skippedAlive: number;
+    readonly skippedUnprovenChild?: number;
+}
+export interface SweepOrphanSandboxesOptions {
+    readonly maxAgeMs?: number;
+    readonly now?: () => number;
+    readonly reapProcessTreeFn?: (pid: number, signal?: NodeJS.Signals, gracePeriodMs?: number) => Promise<void>;
+    readonly onUnprovenChild?: (info: {
+        runDir: string;
+        childPid: number;
+        reason: string;
+    }) => void;
+}
+/** Sweep mutual-exclusion file inside the runtime root. */
+export declare const CLAUDE_SWEEP_LOCK_FILENAME = ".sweep.lock";
+/**
+ * Content-blind orphan sweep at host boot and runner start.
+ * A run is swept only when its run-meta.json carries a valid pid plus
+ * createdAt AND the holder is proven dead by pid/start-time/boot identity
+ * AND its age exceeds the stale threshold. Runs without valid metadata are
+ * always retained (never deleted blindly); live holders are skipped; a
+ * concurrent active sweeper makes this call a no-op.
+ */
+export declare function sweepOrphanSandboxes(rootDir?: string, options?: SweepOrphanSandboxesOptions): Promise<SweepResult>;
+//# sourceMappingURL=claude-code-cli-lifecycle.d.ts.map

package/dist/claude-code-cli-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-cli-lifecycle.d.ts","sourceRoot":"","sources":["../src/claude-code-cli-lifecycle.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,6BAA6B,QAAgB,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AACnD,eAAO,MAAM,4BAA4B,WAAa,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAyDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IACP,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,EACD,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAoFtC;AAED;;;;;;;GAOG;AAEH;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,GAAG,SAAa,EAChB,QAAQ,SAA+B,EACvC,QAAQ,SAA+B,GACtC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAYxC;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,aAAa,SAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7G,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjG;AAED,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,gBAAgB,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,WAAW,CAAC,CA2MtB"}