bostrat-node 1.16.5 → 1.16.7

package/node-entrypoint.sh

@@ -7,6 +7,45 @@ mkdir -p "$HOME/repos"
 # operator can overwrite it (it persists in $HOME/.gitconfig on the volume).
 git config --global user.name >/dev/null 2>&1 || git config --global user.name "bostrat node"
 git config --global user.email >/dev/null 2>&1 || git config --global user.email "node@bostrat.ai"
+# Box containment (BP-AU-I10, src/box-user.js) — only when the operator opted
+# in with BOSTRAT_BOX_USER. Boxes then run as that uid, not root: its home sits
+# on the volume (its CLI logins survive machine replacement), ~/.claude there is
+# root-owned + sticky (the hook settings the node writes stay read-only to the
+# box), root's own logins are closed to it, and the CLIs installed under /root
+# and $HOME/.local stay reachable. auditd is best-effort: a guest kernel
+# without audit support leaves doctor's "box containment" row saying so.
+if [ -n "${BOSTRAT_BOX_USER:-}" ] && id "$BOSTRAT_BOX_USER" >/dev/null 2>&1; then
+  BOX_HOME=$(getent passwd "$BOSTRAT_BOX_USER" | cut -d: -f6)
+  BOX_UID=$(id -u "$BOSTRAT_BOX_USER")
+  BOX_GID=$(id -g "$BOSTRAT_BOX_USER")
+  mkdir -p "$BOX_HOME/.claude"
+  chown "$BOX_UID:$BOX_GID" "$BOX_HOME" && chmod 750 "$BOX_HOME"
+  chown "0:$BOX_GID" "$BOX_HOME/.claude" && chmod 3775 "$BOX_HOME/.claude"
+  setfacl -d -m "u:$BOX_UID:rwX,g:$BOX_GID:rwX" "$BOX_HOME/.claude" || true
+  [ -e "$BOX_HOME/.claude/settings.json" ] && chown "0:$BOX_GID" "$BOX_HOME/.claude/settings.json" && chmod 644 "$BOX_HOME/.claude/settings.json"
+  for p in .claude .claude.json .codex .cursor .config/gh .ssh .gitconfig .bostrat/node.env .bostrat/api-token .bostrat/plane-link .bostrat/secure-inputs; do
+    [ -e "$HOME/$p" ] && chmod -R go-rwx "$HOME/$p" || true
+  done
+  setfacl -m "u:$BOX_UID:x" /root "$HOME" "$HOME/.bostrat" 2>/dev/null || true
+  for d in /root/.local /root/.local/share "$HOME/.local" "$HOME/.local/share"; do [ -d "$d" ] && setfacl -m "u:$BOX_UID:x" "$d" || true; done
+  for d in /root/.local/share/cursor-agent "$HOME/.local/bin" "$HOME/.local/share/claude" "$HOME/.bostrat/git-hooks"; do
+    [ -d "$d" ] && setfacl -R -m "u:$BOX_UID:rX" "$d" || true
+  done
+  [ -d "$HOME/.bostrat/deps" ] && setfacl -R -P -m "u:$BOX_UID:rX,d:u:$BOX_UID:rX" "$HOME/.bostrat/deps" || true
+  git config --global --get user.name >/dev/null 2>&1 && HOME="$BOX_HOME" git config --global user.name "$(git config --global user.name)" || true
+  git config --global --get user.email >/dev/null 2>&1 && HOME="$BOX_HOME" git config --global user.email "$(git config --global user.email)" || true
+  [ -e "$BOX_HOME/.gitconfig" ] && chown "$BOX_UID:$BOX_GID" "$BOX_HOME/.gitconfig" || true
+  mkdir -p /etc/audit/rules.d
+  printf -- '-a always,exit -F arch=b64 -S execve,execveat -F uid=%s -k bostrat-box\n' "$BOX_UID" > /etc/audit/rules.d/bostrat-box.rules
+  if command -v auditd >/dev/null 2>&1 && ! pgrep -x auditd >/dev/null 2>&1; then
+    if auditd && auditctl -R /etc/audit/rules.d/bostrat-box.rules >/dev/null 2>&1; then
+      echo "[entrypoint] box containment: auditd logging ${BOSTRAT_BOX_USER}'s execs"
+    else
+      echo "[entrypoint] box containment: auditd unavailable on this kernel — execs are not logged"
+    fi
+  fi
+  echo "[entrypoint] box containment: boxes run as $BOSTRAT_BOX_USER (uid $BOX_UID), home $BOX_HOME"
+fi
 # The agent drives boxes on a host tmux server (the Pi's globo-tmux.service
 # equivalent): keep one alive with a detached keeper session.
 SOCKET="${BOSTRAT_TMUX_SOCKET:-/tmp/tmux-0/default}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bostrat-node",
-  "version": "1.16.5",
+  "version": "1.16.7",
   "description": "Bostrat node — the box runtime that dials out to your Bostrat coordination plane. https://bostrat.ai",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",