@snowyroad/braid 0.75.0 → 0.76.0

package/dist/{chunk-YKSY2S6J.js → chunk-IBUDDALN.js}

@@ -372,7 +372,7 @@ var InviteExpiredError = class extends Error {
   }
 };
 async function redeemInvite(relayHttpUrl, code) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-SP27G4XU.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-YQS643AJ.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/invites/redeem`, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -401,7 +401,7 @@ async function redeemInvite(relayHttpUrl, code) {
 
 // src/config.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { homedir as homedir4 } from "os";
 
 // src/keystore.ts
@@ -461,7 +461,7 @@ function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
   return { ok: true };
 }
 async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch, dpopProof) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-SP27G4XU.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-YQS643AJ.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
     method: "POST",
     headers: {
@@ -1295,8 +1295,322 @@ async function chooseFirstRunProvider(agentName, io = { input: process.stdin, ou
   return { provider: "claude-code", persist: false };
 }
 
+// src/scope/scopeConfig.ts
+import { realpathSync, readdirSync as readdirSync2, lstatSync } from "fs";
+import { execSync } from "child_process";
+import { join as join3 } from "path";
+function resolveIpcProfile(scope, flagValue) {
+  if (flagValue !== void 0) return flagValue;
+  if (scope?.ipcProfile !== void 0) return scope.ipcProfile;
+  return "compat";
+}
+var STRICT_IPC_ENV_STRIP = [
+  "SSH_AUTH_SOCK",
+  "DOCKER_HOST",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "DBUS_SYSTEM_BUS_ADDRESS",
+  "GPG_AGENT_INFO",
+  "DISPLAY",
+  "WAYLAND_DISPLAY"
+];
+function strictIpcDenyRead(env, lstatFn = lstatSync) {
+  const base = ["/run", "/var/run", "/tmp/.X11-unix"];
+  const xdg = env["XDG_RUNTIME_DIR"];
+  const candidates = xdg ? (() => {
+    const segments = xdg.split("/").filter((s) => s.length > 0);
+    if (!xdg.startsWith("/") || segments.length < 2) {
+      console.warn(
+        `[braid] warn: XDG_RUNTIME_DIR="${xdg}" failed the sanity gate (must be absolute, not "/", and have \u22652 path segments) \u2014 skipping from strict IPC denyRead shroud`
+      );
+      return base;
+    }
+    return [...base, xdg];
+  })() : base;
+  return candidates.filter((p) => {
+    try {
+      return !lstatFn(p).isSymbolicLink();
+    } catch {
+      return true;
+    }
+  });
+}
+var DEFAULT_ALLOWED_DOMAINS = [
+  // Anthropic / Claude
+  "api.anthropic.com",
+  "*.anthropic.com",
+  // OpenAI / Codex
+  "api.openai.com",
+  // Google / Gemini
+  "generativelanguage.googleapis.com",
+  "*.googleapis.com",
+  // xAI / Grok
+  "api.x.ai",
+  // Cursor
+  "api.cursor.sh",
+  // opencode (BL-169): its serve process fetches the models.dev registry AT BOOT;
+  // without it opencode dies inside the jail (`ServeError` / ACP connection closed
+  // on every connect). `models.dev` is repro-CONFIRMED (blocked → 403, allowed →
+  // 200 through the srt proxy). `opencode.ai` (opencode's own service) and the
+  // ChatGPT-sign-in OAuth hosts are opencode's documented auth/boot endpoints
+  // (from the 2026-07-02 dry-run that hard-failed opencode). claude-code was
+  // unaffected because all its hosts were already listed above.
+  "models.dev",
+  "opencode.ai",
+  "*.opencode.ai",
+  "auth.openai.com",
+  "chatgpt.com",
+  // npm
+  "registry.npmjs.org",
+  "*.npmjs.org",
+  // PyPI
+  "pypi.org",
+  "files.pythonhosted.org",
+  // Go modules
+  "proxy.golang.org",
+  // Crates.io
+  "crates.io",
+  "static.crates.io",
+  // Source hosts
+  "github.com",
+  "*.github.com",
+  "*.githubusercontent.com",
+  "gitlab.com",
+  "bitbucket.org"
+];
+var PROVIDER_PATHS = {
+  "claude-code": ["~/.claude", "~/.claude.json"],
+  codex: ["~/.codex"],
+  gemini: ["~/.gemini"],
+  grok: ["~/.grok"],
+  cursor: ["~/.cursor"],
+  opencode: ["~/.local/share/opencode", "~/.config/opencode"],
+  goose: ["~/.config/goose"],
+  cline: ["~/.cline"],
+  copilot: ["~/.copilot"],
+  qwen: ["~/.qwen"]
+};
+function expandHome(p, home) {
+  if (p.startsWith("~/")) return `${home}${p.slice(1)}`;
+  if (p === "~") return home;
+  return p;
+}
+function canonicalize(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function parseEnvList(val) {
+  if (!val) return [];
+  return val.split(/[,:]/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function dedup(arr) {
+  return [...new Set(arr)];
+}
+function darwinMdsCacheDir() {
+  try {
+    const cacheRoot = execSync("/usr/bin/getconf DARWIN_USER_CACHE_DIR", {
+      encoding: "utf8"
+    }).trim();
+    if (!cacheRoot) return [];
+    return [`${cacheRoot.replace(/\/+$/, "")}/mds`];
+  } catch {
+    return [];
+  }
+}
+function resolvePaths(paths, home) {
+  return dedup(paths.map((p) => canonicalize(expandHome(p, home))));
+}
+function foldCase(p, platform) {
+  return platform === "darwin" || platform === "win32" ? p.toLowerCase() : p;
+}
+function checkGrantsAgainstReservations(grants, reservations, platform) {
+  const sep2 = platform === "win32" ? "\\" : "/";
+  const out = [];
+  for (const g of grants) {
+    const gf = foldCase(g.path, platform);
+    for (const r of reservations) {
+      const rf = foldCase(r, platform);
+      if (gf === rf) {
+        out.push({ grant: g.path, source: g.source, reservation: r, relation: "equal" });
+      } else if (gf.startsWith(rf + sep2)) {
+        out.push({ grant: g.path, source: g.source, reservation: r, relation: "descendant" });
+      }
+    }
+  }
+  return out;
+}
+function resolveScope(cfg, provider, env, platform = process.platform) {
+  const scope = cfg.scope ?? {};
+  const home = env["HOME"] ?? "";
+  const cwd = env["PWD"] ?? process.cwd();
+  const tmpDir = env["TMPDIR"] ?? "/tmp";
+  const braidConfigDir = env["BRAID_CONFIG_DIR"]?.trim() || expandHome("~/.braid", home);
+  const legacyArpConfigDir = expandHome("~/.arp", home);
+  const protectedConfigDirs = braidConfigDir === legacyArpConfigDir ? [braidConfigDir] : [braidConfigDir, legacyArpConfigDir];
+  const flagOverride = cfg.scopeFlags?.scopeOverride;
+  const disabled = flagOverride !== void 0 ? flagOverride === "off" : scope.disabled === true || env["BRAID_SCOPE"] === "off";
+  const secretDirs = [
+    "~/.ssh",
+    "~/.aws",
+    "~/.gnupg",
+    "~/.kube/config"
+  ].map((p) => expandHome(p, home));
+  const protectedConfigDirEntries = protectedConfigDirs.flatMap((configDirPath) => {
+    if (platform !== "win32") return [configDirPath];
+    try {
+      const children = readdirSync2(configDirPath, { withFileTypes: true });
+      const denied = children.filter((entry) => entry.name !== "runtime").map((entry) => canonicalize(join3(configDirPath, entry.name)));
+      if (denied.length === 0) return [configDirPath];
+      return denied;
+    } catch {
+      return [configDirPath];
+    }
+  });
+  const providerPaths = PROVIDER_PATHS[provider].map((p) => expandHome(p, home));
+  const uid = process.getuid?.();
+  const claudeTmpRoot = provider === "claude-code" && uid !== void 0 ? [`${canonicalize("/tmp")}/claude-${uid}`, `${canonicalize("/tmp")}/claude-*-cwd`] : [];
+  const mdsCacheDir = platform === "darwin" ? darwinMdsCacheDir() : [];
+  const opAllowWrite = (scope.allowWrite ?? []).map((p) => expandHome(p, home));
+  const envAllowWrite = parseEnvList(env["BRAID_SCOPE_ALLOW_WRITE"]).map((p) => expandHome(p, home));
+  const flagAllowWrite = (cfg.scopeFlags?.allowWrite ?? []).map((p) => expandHome(p, home));
+  const rawAllowWrite = [
+    cwd,
+    ...providerPaths,
+    ...claudeTmpRoot,
+    ...mdsCacheDir,
+    expandHome("~/.npm", home),
+    tmpDir,
+    ...opAllowWrite,
+    ...envAllowWrite,
+    ...flagAllowWrite
+  ];
+  const allowWrite = resolvePaths(rawAllowWrite, home);
+  const rawDenyWrite = [
+    ...secretDirs,
+    ...protectedConfigDirEntries,
+    ...(scope.denyWrite ?? []).map((p) => expandHome(p, home)),
+    ...parseEnvList(env["BRAID_SCOPE_DENY_WRITE"]).map((p) => expandHome(p, home))
+  ];
+  const denyWrite = resolvePaths(rawDenyWrite, home);
+  const ipcProfile = resolveIpcProfile(scope, cfg.scopeFlags?.ipcProfile);
+  const rawDenyRead = [
+    ...secretDirs,
+    ...protectedConfigDirEntries,
+    ...(scope.denyRead ?? []).map((p) => expandHome(p, home)),
+    ...parseEnvList(env["BRAID_SCOPE_DENY_READ"]).map((p) => expandHome(p, home))
+  ];
+  const denyRead = dedup([
+    ...resolvePaths(rawDenyRead, home),
+    ...ipcProfile === "strict" && platform === "linux" ? strictIpcDenyRead(env) : []
+  ]);
+  const opAllowRead = (scope.allowRead ?? []).map((p) => expandHome(p, home));
+  const envAllowRead = parseEnvList(env["BRAID_SCOPE_ALLOW_READ"]).map((p) => expandHome(p, home));
+  const flagAllowRead = (cfg.scopeFlags?.allowRead ?? []).map((p) => expandHome(p, home));
+  const rawAllowRead = [
+    ...opAllowRead,
+    ...envAllowRead,
+    ...flagAllowRead
+  ];
+  const allowRead = resolvePaths(rawAllowRead, home);
+  if (!disabled) {
+    const reservations = resolvePaths([...secretDirs, ...protectedConfigDirs], home);
+    const labelled = (paths, source) => resolvePaths(paths, home).map((p) => ({ path: p, source }));
+    const grants = [
+      ...labelled([cwd], "launch directory (cwd)"),
+      ...labelled(providerPaths, "provider default paths"),
+      ...labelled(opAllowWrite, "scope.allowWrite"),
+      ...labelled(envAllowWrite, "BRAID_SCOPE_ALLOW_WRITE"),
+      ...labelled(flagAllowWrite, "--allow-write"),
+      ...labelled(opAllowRead, "scope.allowRead"),
+      ...labelled(envAllowRead, "BRAID_SCOPE_ALLOW_READ"),
+      ...labelled(flagAllowRead, "--allow-read")
+    ];
+    const conflicts = checkGrantsAgainstReservations(grants, reservations, platform);
+    if (conflicts.length > 0) {
+      const detail = conflicts.map((c) => `  - ${c.source}: "${c.grant}" is ${c.relation === "equal" ? "" : "inside "}the protected path "${c.reservation}"`).join("\n");
+      throw new Error(
+        `[braid] SCOPE ERROR: a grant covers a protected credential/secret path and was refused:
+${detail}
+Protected paths (never grantable): ${reservations.join(", ")}
+Narrow the grant to a path outside the protected set. (Ancestor grants like "~" are fine \u2014 the protected dirs are carved back out automatically.)`
+      );
+    }
+    const writableDefaults = resolvePaths(
+      [...providerPaths, expandHome("~/.npm", home), tmpDir],
+      home
+    );
+    const resolvedConfigDir = canonicalize(braidConfigDir);
+    const placement = checkGrantsAgainstReservations(
+      [{ path: resolvedConfigDir, source: "BRAID_CONFIG_DIR" }],
+      writableDefaults,
+      platform
+    );
+    if (placement.length > 0) {
+      const c = placement[0];
+      throw new Error(
+        `[braid] SCOPE ERROR: BRAID_CONFIG_DIR ("${c.grant}") is ${c.relation === "equal" ? "" : "inside "}a default provider-writable location ("${c.reservation}"). The bridge credential store must live outside provider/tmp/npm paths. Move it (default: ~/.braid) or unset BRAID_CONFIG_DIR.`
+      );
+    }
+  }
+  const allowedDomains = dedup([
+    ...DEFAULT_ALLOWED_DOMAINS,
+    ...scope.network?.allowedDomains ?? [],
+    ...cfg.derivedAllowedDomains ?? [],
+    ...parseEnvList(env["BRAID_SCOPE_ALLOW_DOMAINS"]),
+    ...cfg.scopeFlags?.allowDomains ?? []
+  ]);
+  const deniedDomains = dedup([
+    ...scope.network?.deniedDomains ?? [],
+    ...parseEnvList(env["BRAID_SCOPE_DENY_DOMAINS"])
+  ]);
+  function describe() {
+    const lines = [];
+    if (disabled) {
+      lines.push("[scope] SANDBOX DISABLED (BRAID_SCOPE=off or scope.disabled:true) \u2014 agent runs unconfined");
+      return lines;
+    }
+    lines.push("[scope] Agent sandbox is ACTIVE");
+    lines.push(
+      `[scope] protected (never readable/writable by the agent): ${resolvePaths([...secretDirs, ...protectedConfigDirs], home).join(", ")}`
+    );
+    lines.push(`[scope] cwd (writable): ${cwd}`);
+    if (providerPaths.length > 0) {
+      lines.push(`[scope] provider paths (writable): ${providerPaths.join(", ")}`);
+    }
+    lines.push(`[scope] allowed domains (${allowedDomains.length}): ${allowedDomains.slice(0, 5).join(", ")}${allowedDomains.length > 5 ? " ..." : ""}`);
+    if ((cfg.derivedAllowedDomains ?? []).length > 0) {
+      lines.push(`[scope] model endpoints (derived): ${(cfg.derivedAllowedDomains ?? []).join(", ")}`);
+    }
+    lines.push(`[scope] denied read: ${denyRead.join(", ")}`);
+    if (denyWrite.length > 0) {
+      lines.push(`[scope] denied write: ${denyWrite.join(", ")}`);
+    }
+    if (deniedDomains.length > 0) {
+      lines.push(`[scope] denied domains: ${deniedDomains.join(", ")}`);
+    }
+    if (ipcProfile === "compat") {
+      lines.push("[scope] ipc profile: compat \u2014 all unix sockets reachable inside the jail (Linux seccomp constraint)");
+    } else {
+      lines.push("[scope] ipc profile: strict \u2014 /run, /var/run, XDG_RUNTIME_DIR, /tmp/.X11-unix hidden; socket env vars stripped");
+    }
+    lines.push("[scope] To widen: add paths to scope.allowWrite/allowRead in agent config, or BRAID_SCOPE_ALLOW_WRITE/BRAID_SCOPE=off env.");
+    return lines;
+  }
+  return {
+    runtimeConfig: {
+      filesystem: { allowWrite, denyWrite, allowRead, denyRead },
+      network: { allowedDomains, deniedDomains }
+    },
+    disabled,
+    ipcProfile,
+    describe
+  };
+}
+
 // src/cardSigning.ts
-import canonicalize from "canonicalize";
+import canonicalize2 from "canonicalize";
 import {
   FlattenedSign,
   flattenedVerify,
@@ -1353,7 +1667,7 @@ function pruneForSigning(card) {
   return pruneNode(clone, REQUIRED_TOP);
 }
 function canonicalCardString(card) {
-  return canonicalize(pruneForSigning(card));
+  return canonicalize2(pruneForSigning(card));
 }
 function publicOkpJwk(jwk) {
   return { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
@@ -1825,10 +2139,10 @@ async function loadConfigFromInvite(code, env, flags) {
 }
 function buildJoinScopeBlock(flags, env) {
   const split = (v) => v ? v.split(/[,:]/).map((s) => s.trim()).filter((s) => s.length > 0) : [];
-  const dedup = (arr) => [...new Set(arr)];
-  const allowWrite = dedup([...split(env.BRAID_SCOPE_ALLOW_WRITE), ...flags?.allowWrite ?? []]);
-  const allowRead = dedup([...split(env.BRAID_SCOPE_ALLOW_READ), ...flags?.allowRead ?? []]);
-  const allowedDomains = dedup([...split(env.BRAID_SCOPE_ALLOW_DOMAINS), ...flags?.allowDomains ?? []]);
+  const dedup2 = (arr) => [...new Set(arr)];
+  const allowWrite = dedup2([...split(env.BRAID_SCOPE_ALLOW_WRITE), ...flags?.allowWrite ?? []]);
+  const allowRead = dedup2([...split(env.BRAID_SCOPE_ALLOW_READ), ...flags?.allowRead ?? []]);
+  const allowedDomains = dedup2([...split(env.BRAID_SCOPE_ALLOW_DOMAINS), ...flags?.allowDomains ?? []]);
   const disabled = flags?.scope === "off" || flags?.scope === void 0 && env.BRAID_SCOPE === "off";
   if (allowWrite.length === 0 && allowRead.length === 0 && allowedDomains.length === 0 && !disabled) {
     return void 0;
@@ -1901,7 +2215,7 @@ function parseClaudeConfigModel(jsonText) {
 function readClaudeConfigModel(agent) {
   if (agent !== "claude-code") return null;
   try {
-    const text = readFileSync2(join3(homedir4(), ".claude.json"), "utf8");
+    const text = readFileSync2(join4(homedir4(), ".claude.json"), "utf8");
     return parseClaudeConfigModel(text);
   } catch {
     return null;
@@ -1920,16 +2234,21 @@ function redactConfig(cfg) {
   return { ...cfg, token: "<redacted>", model };
 }
 function startingLines(cfg) {
-  const model = redactConfig(cfg).model;
+  const row = (label, value) => `${label.padEnd(8)} : ${value}`;
+  const anthropicCredential = cfg.agentMode !== "acp" || cfg.agent === "claude-code";
+  const catchUpHours = cfg.catchUpTtlMs % 36e5 === 0 ? `${cfg.catchUpTtlMs / 36e5}h` : `${Math.round(cfg.catchUpTtlMs / 6e4)}min`;
   return [
-    `agent    : ${sanitizeForTty(cfg.agentName)}`,
-    `relay    : ${sanitizeForTty(cfg.relayWsUrl)}`,
-    `provider : ${cfg.agentMode === "acp" ? cfg.agent : "bundled SDK (generic mode)"}`,
-    `model    : ${sanitizeForTty(model)}`,
-    `tools    : ${cfg.toolMode}`,
-    ...cfg.authMode ? [`auth     : ${cfg.authMode}`] : [],
-    ...cfg.fallbackModel ? [`fallback : ${sanitizeForTty(cfg.fallbackModel)}`] : [],
-    `sandbox  : ${cfg.scope?.disabled ? "OFF (unconfined)" : "on"}`
+    row("agent", sanitizeForTty(cfg.agentName)),
+    row("relay", sanitizeForTty(cfg.relayWsUrl)),
+    row("provider", cfg.agentMode === "acp" ? cfg.agent : "bundled SDK (generic mode)"),
+    row("model", sanitizeForTty(redactConfig(cfg).model)),
+    row("fallback", cfg.fallbackModel ? sanitizeForTty(cfg.fallbackModel) : "(none \u2014 a rate limit is surfaced, not switched)"),
+    row("tools", cfg.toolMode),
+    row("auth", anthropicCredential ? cfg.authMode ?? "auto" : `(managed by ${cfg.agent})`),
+    row("sandbox", cfg.scope?.disabled ? "OFF (unconfined)" : "on"),
+    row("ipc", resolveIpcProfile(cfg.scope, cfg.scopeFlags?.ipcProfile)),
+    row("catch-up", `${catchUpHours} window \xB7 up to ${cfg.catchUpMaxMentions} missed mentions`),
+    row("keystore", cfg.agentFile ? sanitizeForTty(cfg.agentFile) : "(env-provided credential \u2014 no saved file)")
   ];
 }
 
@@ -2162,6 +2481,9 @@ export {
   evaluateAcpPermission,
   evaluateSdkTool,
   pickRejectOptionId,
+  resolveIpcProfile,
+  STRICT_IPC_ENV_STRIP,
+  resolveScope,
   verifyCardSignature,
   cleanContent,
   resolveAgentSelection,