@sleds/cli 0.1.68 → 0.1.69

package/dist/sleds.mjs

@@ -11563,7 +11563,20 @@ var mainCheckoutOf = (gitCommonDir, cwd) => {
   const main = dir.slice(0, -"/.git".length);
   return main && main !== cwd.replace(/\/+$/, "") ? main : null;
 };
-var claudeAddDirFlag = (mainCheckout) => mainCheckout ? ` --add-dir=${shq(mainCheckout)}` : "";
+var trimDir = (dir) => dir.replace(/\/+$/, "") || "/";
+var within = (path, dir) => {
+  const p = trimDir(path);
+  const d = trimDir(dir);
+  return p === d || p.startsWith(d === "/" ? "/" : `${d}/`);
+};
+var sessionReadDirs = (o) => {
+  const cwd = trimDir(o.cwd);
+  const dirs = [o.mainCheckout, ...o.worktrees ?? [], o.pnpmStore].filter((d) => !!d?.trim()).map(trimDir);
+  return [...new Set(dirs)].filter((d) => d !== cwd);
+};
+var readOnlyDirs = (readDirs, cwd, keep = []) => readDirs.filter((d) => ![cwd, ...keep].some((p) => within(p, d)));
+var readOnlyDenyRules = (dirs) => dirs.map((d) => `Edit(${absRule(d)})`);
+var claudeAddDirFlag = (dirs = []) => dirs.map((d) => ` --add-dir=${shq(d)}`).join("");
 var shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 
 // src/runners/exec.ts
@@ -11609,15 +11622,15 @@ var agentShellCommand = (o) => {
   const prompt = `"$(cat ${shq2(o.promptFile)})"`;
   const agent = o.agent?.trim();
   if (agent)
-    return `${sandboxedAgent(agent, o.sandbox, o.mainCheckout)} ${prompt}`;
+    return `${sandboxedAgent(agent, o.sandbox, o.readDirs)} ${prompt}`;
   const model = o.model ? ` --model ${shq2(o.model)}` : "";
   const effort = o.effort ? ` --effort ${shq2(o.effort)}` : "";
-  return `${sandboxedAgent("claude", o.sandbox, o.mainCheckout)}${hookSettingsFlag(o)}${mcpConfigFlag(o)} --permission-mode ${shq2(o.permissionMode)}${model}${effort} ${prompt}`;
+  return `${sandboxedAgent("claude", o.sandbox, o.readDirs)}${hookSettingsFlag(o)}${mcpConfigFlag(o)} --permission-mode ${shq2(o.permissionMode)}${model}${effort} ${prompt}`;
 };
 var execLine = (cmd) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(cmd) ? `exec env ${cmd}` : `exec ${cmd}`;
-var sandboxedAgent = (agent, sandbox, mainCheckout) => {
+var sandboxedAgent = (agent, sandbox, readDirs) => {
   const kind = sandboxAgentKind(agent);
-  const line = kind === "claude" ? `${agent}${claudeAddDirFlag(mainCheckout)}` : agent;
+  const line = kind === "claude" ? `${agent}${claudeAddDirFlag(readDirs)}` : agent;
   if (!sandbox)
     return line;
   if (kind === "claude")
@@ -12340,7 +12353,7 @@ function beatBody(state, flags, host = {}, cap = {}) {
     name: flags.name,
     os: host.os ?? process.platform,
     runner: flags.runner,
-    version: host.version ?? "0.1.68" ?? "dev",
+    version: host.version ?? "0.1.69" ?? "dev",
     running: live.length,
     items: live.slice(0, BEAT_ITEMS).map((r) => `${r.item}/${r.node}`),
     ...cap.atOnce !== undefined ? { atOnce: cap.atOnce } : {},
@@ -14955,21 +14968,29 @@ function fingerprint(text) {
 function wordsPrint(screen) {
   return fingerprint(stripTuiChrome(screen));
 }
-function sandboxFor(d, name, cwd, allow) {
+function sandboxFor(d, name, cwd, allow, readOnly) {
   if (!d.sandbox)
     return {};
   if (!d.writeSandboxSettings)
     throw new Error("sessions are sandboxed, but nothing writes their settings — not started");
-  return { sandbox: d.writeSandboxSettings(name, cwd, allow) };
+  return { sandbox: d.writeSandboxSettings(name, cwd, allow, readOnly) };
 }
-function hooksFor(d, name, allow) {
+function hooksFor(d, name, allow, readOnly) {
   if (d.sandbox || !d.writeHookSettings)
     return {};
-  return { settingsFile: d.writeHookSettings(name, allow) };
+  return { settingsFile: d.writeHookSettings(name, allow, readOnly) };
 }
-function mainCheckoutFor(d, cwd) {
-  const main = d.mainCheckoutOf?.(cwd);
-  return main ? { mainCheckout: main } : {};
+function wallsFor(d, name, cwd, allow) {
+  let readDirs = [];
+  try {
+    readDirs = d.readDirsOf?.(cwd) ?? [];
+  } catch {}
+  const readOnly = readOnlyDirs(readDirs, cwd);
+  return {
+    ...sandboxFor(d, name, cwd, allow, readOnly),
+    ...hooksFor(d, name, allow, readOnly),
+    ...readDirs.length ? { readDirs } : {}
+  };
 }
 function engineMcpConfigFor(d, name, runToken, at, cwd) {
   if (d.source.name !== "sleds" || d.agent?.trim() || !d.writeMcpConfig)
@@ -15519,9 +15540,7 @@ async function tickOnce(d) {
         ...launch.effort && !launch.agent ? { effort: launch.effort } : {},
         ...launch.agent ? { agent: launch.agent } : {},
         ...mcpConfig ? { mcpConfig, ...d.strictMcp ? { strictMcp: true } : {} } : {},
-        ...sandboxFor(d, name, worktree, allow),
-        ...hooksFor(d, name, allow),
-        ...mainCheckoutFor(d, worktree),
+        ...wallsFor(d, name, worktree, allow),
         ...claim.group ? { group: claim.group } : {}
       };
     } catch (e) {
@@ -16398,9 +16417,7 @@ async function startAnswerer(d, answers, run) {
       permissionMode: d.permissionMode,
       ...launchOptions(launch),
       ...mcpConfig ? { mcpConfig, ...d.strictMcp ? { strictMcp: true } : {} } : {},
-      ...sandboxFor(d, name, run.handle.cwd),
-      ...hooksFor(d, name),
-      ...mainCheckoutFor(d, run.handle.cwd),
+      ...wallsFor(d, name, run.handle.cwd),
       ...run.group ? { group: run.group } : {}
     });
   } catch (e) {
@@ -16608,9 +16625,7 @@ async function startDraft(d, claim, why, state, started, finished) {
       permissionMode: d.permissionMode,
       ...launchOptions(launch),
       ...mcpConfig ? { mcpConfig, ...d.strictMcp ? { strictMcp: true } : {} } : {},
-      ...sandboxFor(d, name, worktree),
-      ...hooksFor(d, name),
-      ...mainCheckoutFor(d, worktree)
+      ...wallsFor(d, name, worktree)
     });
   } catch (e) {
     d.log(`${at}: could not start the drafter: ${message(e)}`);
@@ -16789,9 +16804,7 @@ async function startMock(d, claim, state, started, finished) {
       promptFile: d.writePrompt(name, prompt),
       permissionMode: d.permissionMode,
       ...launchOptions(launch),
-      ...sandboxFor(d, name, worktree, allow),
-      ...hooksFor(d, name, allow),
-      ...mainCheckoutFor(d, worktree)
+      ...wallsFor(d, name, worktree, allow)
     });
   } catch (e) {
     await fail(`the engine could not start the session: ${message(e)}`);
@@ -17678,9 +17691,7 @@ function restartInWorktree(d, run, name, prompt, base) {
       permissionMode: d.permissionMode,
       ...launchOptions(launch),
       ...run.mcpConfig ? { mcpConfig: run.mcpConfig, ...d.strictMcp ? { strictMcp: true } : {} } : {},
-      ...sandboxFor(d, name, run.handle.cwd),
-      ...hooksFor(d, name),
-      ...mainCheckoutFor(d, run.handle.cwd),
+      ...wallsFor(d, name, run.handle.cwd),
       ...run.group ? { group: run.group } : {}
     };
     run.handle = runner.makesWorktree ? runner.reopen(run.handle, o) : runner.start(o);
@@ -17814,9 +17825,7 @@ async function startEventAnswerer(d, answers, state, dec, decided) {
       permissionMode: d.permissionMode,
       ...launchOptions(launch),
       ...mcpConfig ? { mcpConfig, ...d.strictMcp ? { strictMcp: true } : {} } : {},
-      ...sandboxFor(d, name, worktree),
-      ...hooksFor(d, name),
-      ...mainCheckoutFor(d, worktree)
+      ...wallsFor(d, name, worktree)
     });
   } catch (e) {
     d.log(`${at}: could not start the ${KIND_SAYS[kind]} answerer — it goes to a person: ${message(e)}`);
@@ -18344,8 +18353,8 @@ ${renderTranscript(messages)}`;
 var headlessScript = (o, log) => {
   const prompt = `"$(cat ${shq2(o.promptFile)})"`;
   const agent = o.agent?.trim();
-  const cmd = agent ? `${sandboxedAgent(agent, o.sandbox, o.mainCheckout)} ${prompt}` : [
-    `${sandboxedAgent("claude", o.sandbox, o.mainCheckout)} -p`,
+  const cmd = agent ? `${sandboxedAgent(agent, o.sandbox, o.readDirs)} ${prompt}` : [
+    `${sandboxedAgent("claude", o.sandbox, o.readDirs)} -p`,
     prompt,
     ...o.mcpConfig ? [mcpConfigFlag(o).trim()] : [],
     "--output-format stream-json --verbose",
@@ -19224,7 +19233,7 @@ async function fetchVersion(o) {
   const platform = o.platform ?? process.platform;
   const arch = o.arch ?? process.arch;
   const publicKey = o.publicKey ?? RELEASE_PUBLIC_KEY;
-  const running = o.running ?? "0.1.68";
+  const running = o.running ?? "0.1.69";
   if (!publicKey)
     return { ok: false, why: "no release key yet" };
   if (!VERSION_RE2.test(o.version))
@@ -20450,7 +20459,7 @@ function engineUpdater(o) {
 
 // src/version.ts
 function cliVersion(env) {
-  return "0.1.68";
+  return "0.1.69";
 }
 
 // src/commands/update.ts
@@ -20836,7 +20845,7 @@ function engineClient(o, org, breaker) {
       ...src,
       ...breaker ? { fetchFn: breaker.fetch } : {},
       timeoutMs: ENGINE_TIMEOUT_MS,
-      version: "0.1.68"
+      version: "0.1.69"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -20912,6 +20921,7 @@ function engineDeps(o, flags, source, runner, stateName) {
   const reposDirs = splitReposDirs(flags.reposDir).map((d) => resolve9(cwd, d));
   const { branch, prTitle } = flags;
   const hooksDir = join25(stateDir, "hooks");
+  const pnpmStores = new Map;
   const permissionMark = (name) => join25(hooksDir, `${name}.permission.json`);
   const withHook = (name, settings) => applyPermissionHook(settings, [...o.sledsArgv ?? ["sleds"], "permission-event", "--mark", permissionMark(name)].map(shq2).join(" "));
   return {
@@ -20935,7 +20945,7 @@ function engineDeps(o, flags, source, runner, stateName) {
     ...flags.strictMcp ? { strictMcp: true } : {},
     ...flags.sandbox ? {
       sandbox: true,
-      writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow) => {
+      writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow, readOnly) => {
         const gitCommonDir = gitCommonDirOf(exec, cwd);
         const dir = join25(stateDir, "sandbox");
         mkdirSync18(dir, { recursive: true, mode: 448 });
@@ -20947,6 +20957,12 @@ function engineDeps(o, flags, source, runner, stateName) {
         walls.permissions.allow = [
           ...new Set([...walls.permissions.allow, ...allow ?? []])
         ];
+        walls.permissions.deny = [
+          ...new Set([
+            ...walls.permissions.deny,
+            ...readOnlyDenyRules(readOnlyDirs(readOnly ?? [], cwd, [gitCommonDir]))
+          ])
+        ];
         const settings = withHook(name, { ...walls });
         writeFileSync16(p, `${JSON.stringify(settings, null, 2)}
 `, { mode: 384 });
@@ -20954,23 +20970,22 @@ function engineDeps(o, flags, source, runner, stateName) {
         return { settingsFile: p, gitCommonDir };
       })
     } : {},
-    writeHookSettings: (name, allow) => {
+    writeHookSettings: (name, allow, readOnly) => {
       mkdirSync18(hooksDir, { recursive: true, mode: 448 });
       const p = join25(hooksDir, `${name}.json`);
-      const base = allow?.length ? { permissions: { allow: [...allow] } } : {};
+      const deny = readOnlyDenyRules(readOnly ?? []);
+      const permissions = {
+        ...allow?.length ? { allow: [...allow] } : {},
+        ...deny.length ? { deny } : {}
+      };
+      const base = Object.keys(permissions).length ? { permissions } : {};
       writeFileSync16(p, `${JSON.stringify(withHook(name, base), null, 2)}
 `, { mode: 384 });
       chmodSync5(p, 384);
       return p;
     },
     permissionMark,
-    mainCheckoutOf: o.mainCheckoutOf ?? ((cwd) => {
-      try {
-        return mainCheckoutOf(gitCommonDirOf(exec, cwd), cwd);
-      } catch {
-        return null;
-      }
-    }),
+    readDirsOf: o.readDirsOf ?? ((dir) => engineReadDirs(exec, dir, exists, pnpmStores)),
     ...branch ? { branchOf: (claim) => branchFor(branch, claim) } : {},
     ...prTitle ? { prTitleOf: (claim) => prTitleFor(prTitle, claim) } : {},
     now: o.now ?? Date.now,
@@ -21072,6 +21087,52 @@ function gitCommonDirOf(exec, cwd) {
     throw new Error(`git has no common dir for ${cwd}, so the sandbox has nowhere to commit`);
   return resolve9(cwd, dir);
 }
+function worktreeListPaths(porcelain) {
+  return porcelain.split(/\n\s*\n/).map((block) => block.split(`
+`).map((l) => l.trim())).filter((lines) => !lines.some((l) => l === "bare" || l.startsWith("prunable"))).flatMap((lines) => {
+    const wt = lines.find((l) => l.startsWith("worktree "));
+    return wt ? [wt.slice("worktree ".length)] : [];
+  });
+}
+var PNPM_STORE_TIMEOUT_MS = 1e4;
+function engineReadDirs(exec, cwd, exists, stores) {
+  let common = null;
+  try {
+    common = gitCommonDirOf(exec, cwd);
+  } catch {}
+  const worktrees = (() => {
+    try {
+      const r = exec("git", ["-C", cwd, "worktree", "list", "--porcelain"]);
+      return r.status === 0 ? worktreeListPaths(r.stdout) : [];
+    } catch {
+      return [];
+    }
+  })();
+  const pnpmStore = (() => {
+    try {
+      if (!exists(join25(cwd, "pnpm-lock.yaml")))
+        return null;
+      const key = common ?? cwd;
+      const known = stores.get(key);
+      if (known)
+        return known;
+      const r = exec("pnpm", ["store", "path"], { cwd, timeoutMs: PNPM_STORE_TIMEOUT_MS });
+      const dir = r.status === 0 ? r.stdout.split(`
+`).map((l) => l.trim()).filter((l) => l.startsWith("/")).pop() : undefined;
+      if (dir)
+        stores.set(key, dir);
+      return dir ?? null;
+    } catch {
+      return null;
+    }
+  })();
+  return sessionReadDirs({
+    mainCheckout: common ? mainCheckoutOf(common, cwd) : null,
+    worktrees,
+    pnpmStore,
+    cwd
+  });
+}
 var LENT_NEEDS_SANDBOX = "a lent engine runs every session sandboxed (spec 48 rule 10) — add --sandbox to --lent-by";
 function lenderHome(accountHome, lentBy) {
   return isAbsolute3(lentBy) ? resolve9(lentBy) : join25(dirname16(accountHome), lentBy);
@@ -21142,7 +21203,7 @@ async function driveEngine(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.68"
+    cliVersion: "0.1.69"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -23020,7 +23081,7 @@ function engineClient2(o, org, breaker) {
       ...src,
       ...breaker ? { fetchFn: breaker.fetch } : {},
       timeoutMs: ENGINE_TIMEOUT_MS2,
-      version: "0.1.68"
+      version: "0.1.69"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -23118,6 +23179,7 @@ function engineDeps2(o, flags, source, runner, stateName) {
   const reposDirs = splitReposDirs(flags.reposDir).map((d) => resolve11(cwd, d));
   const { branch, prTitle } = flags;
   const hooksDir = join28(stateDir, "hooks");
+  const pnpmStores = new Map;
   const permissionMark = (name) => join28(hooksDir, `${name}.permission.json`);
   const withHook = (name, settings) => applyPermissionHook(settings, [...o.sledsArgv ?? ["sleds"], "permission-event", "--mark", permissionMark(name)].map(shq2).join(" "));
   return {
@@ -23141,7 +23203,7 @@ function engineDeps2(o, flags, source, runner, stateName) {
     ...flags.strictMcp ? { strictMcp: true } : {},
     ...flags.sandbox ? {
       sandbox: true,
-      writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow) => {
+      writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow, readOnly) => {
         const gitCommonDir = gitCommonDirOf2(exec, cwd);
         const dir = join28(stateDir, "sandbox");
         mkdirSync21(dir, { recursive: true, mode: 448 });
@@ -23153,6 +23215,12 @@ function engineDeps2(o, flags, source, runner, stateName) {
         walls.permissions.allow = [
           ...new Set([...walls.permissions.allow, ...allow ?? []])
         ];
+        walls.permissions.deny = [
+          ...new Set([
+            ...walls.permissions.deny,
+            ...readOnlyDenyRules(readOnlyDirs(readOnly ?? [], cwd, [gitCommonDir]))
+          ])
+        ];
         const settings = withHook(name, { ...walls });
         writeFileSync20(p, `${JSON.stringify(settings, null, 2)}
 `, { mode: 384 });
@@ -23160,23 +23228,22 @@ function engineDeps2(o, flags, source, runner, stateName) {
         return { settingsFile: p, gitCommonDir };
       })
     } : {},
-    writeHookSettings: (name, allow) => {
+    writeHookSettings: (name, allow, readOnly) => {
       mkdirSync21(hooksDir, { recursive: true, mode: 448 });
       const p = join28(hooksDir, `${name}.json`);
-      const base = allow?.length ? { permissions: { allow: [...allow] } } : {};
+      const deny = readOnlyDenyRules(readOnly ?? []);
+      const permissions = {
+        ...allow?.length ? { allow: [...allow] } : {},
+        ...deny.length ? { deny } : {}
+      };
+      const base = Object.keys(permissions).length ? { permissions } : {};
       writeFileSync20(p, `${JSON.stringify(withHook(name, base), null, 2)}
 `, { mode: 384 });
       chmodSync6(p, 384);
       return p;
     },
     permissionMark,
-    mainCheckoutOf: o.mainCheckoutOf ?? ((cwd) => {
-      try {
-        return mainCheckoutOf(gitCommonDirOf2(exec, cwd), cwd);
-      } catch {
-        return null;
-      }
-    }),
+    readDirsOf: o.readDirsOf ?? ((dir) => engineReadDirs2(exec, dir, exists, pnpmStores)),
     ...branch ? { branchOf: (claim) => branchFor(branch, claim) } : {},
     ...prTitle ? { prTitleOf: (claim) => prTitleFor(prTitle, claim) } : {},
     now: o.now ?? Date.now,
@@ -23278,6 +23345,52 @@ function gitCommonDirOf2(exec, cwd) {
     throw new Error(`git has no common dir for ${cwd}, so the sandbox has nowhere to commit`);
   return resolve11(cwd, dir);
 }
+function worktreeListPaths2(porcelain) {
+  return porcelain.split(/\n\s*\n/).map((block) => block.split(`
+`).map((l) => l.trim())).filter((lines) => !lines.some((l) => l === "bare" || l.startsWith("prunable"))).flatMap((lines) => {
+    const wt = lines.find((l) => l.startsWith("worktree "));
+    return wt ? [wt.slice("worktree ".length)] : [];
+  });
+}
+var PNPM_STORE_TIMEOUT_MS2 = 1e4;
+function engineReadDirs2(exec, cwd, exists, stores) {
+  let common = null;
+  try {
+    common = gitCommonDirOf2(exec, cwd);
+  } catch {}
+  const worktrees = (() => {
+    try {
+      const r = exec("git", ["-C", cwd, "worktree", "list", "--porcelain"]);
+      return r.status === 0 ? worktreeListPaths2(r.stdout) : [];
+    } catch {
+      return [];
+    }
+  })();
+  const pnpmStore = (() => {
+    try {
+      if (!exists(join28(cwd, "pnpm-lock.yaml")))
+        return null;
+      const key = common ?? cwd;
+      const known = stores.get(key);
+      if (known)
+        return known;
+      const r = exec("pnpm", ["store", "path"], { cwd, timeoutMs: PNPM_STORE_TIMEOUT_MS2 });
+      const dir = r.status === 0 ? r.stdout.split(`
+`).map((l) => l.trim()).filter((l) => l.startsWith("/")).pop() : undefined;
+      if (dir)
+        stores.set(key, dir);
+      return dir ?? null;
+    } catch {
+      return null;
+    }
+  })();
+  return sessionReadDirs({
+    mainCheckout: common ? mainCheckoutOf(common, cwd) : null,
+    worktrees,
+    pnpmStore,
+    cwd
+  });
+}
 function sandboxRefusal(flags) {
   if (flags.lentBy && !flags.sandbox)
     return LENT_NEEDS_SANDBOX2;
@@ -23361,7 +23474,7 @@ async function driveEngine2(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.68"
+    cliVersion: "0.1.69"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -25472,7 +25585,7 @@ function contextFor(deps) {
     ...src,
     fetchFn: deps.fetchFn,
     timeoutMs: deps.timeoutMs,
-    version: "0.1.68"
+    version: "0.1.69"
   }), deps.home, now) : null;
   return {
     channel: "code",
@@ -32040,7 +32153,7 @@ var realPidAlive4 = (pid) => {
 };
 function machineClient(home, env) {
   const src = meterSource(home, undefined, { env });
-  return src ? fetchClient({ ...src, version: "0.1.68" }) : null;
+  return src ? fetchClient({ ...src, version: "0.1.69" }) : null;
 }
 async function noteAnswer2(home, a, now) {
   try {
@@ -32991,7 +33104,7 @@ var main = async (argv) => {
     now: Date.now(),
     stderr: (line) => console.error(line),
     isTTY: !!process.stderr.isTTY,
-    version: "0.1.68"
+    version: "0.1.69"
   });
   switch (cmd) {
     case "update":
@@ -33255,7 +33368,7 @@ ${renderHelpText(argv[1])}`);
     case "version":
     case "--version":
     case "-v":
-      console.log("sleds 0.1.68");
+      console.log("sleds 0.1.69");
       return 0;
     default:
       console.error(`unknown command: ${cmd}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleds/cli",
-  "version": "0.1.68",
+  "version": "0.1.69",
   "description": "SLEDS CLI — the cost and limits of AI agent work, decided at the wall. Point Claude Code at a SLEDS proxy; estimate before you run; hold, switch model, or run overnight when you hit a limit.",
   "license": "UNLICENSED",
   "type": "module",