glimmervoid 0.31.0 → 0.32.1

package/dist/client/index.html

@@ -7,8 +7,8 @@
   <link rel="icon" type="image/svg+xml" href="/assets/favicon-CKygeLwW.svg">
   <title>Glimmervoid</title>
   <style>html,body{background:var(--bg,#0a0810);height:100%;color:var(--text,#c8c0e0);font-family:var(--font-mono,"CommitMono", "Cascadia Code", "Fira Code", "Consolas", "Menlo", monospace);margin:0;padding:0}.app-shell{display:none}html:not([data-layout=phone]) .app-ready .app-shell{display:contents}.loading-screen{z-index:9999;background:#0a0810;flex-direction:column;justify-content:center;align-items:center;gap:20px;transition:opacity .3s;display:flex;position:fixed;inset:0}.loading-screen.fade-out{opacity:0;pointer-events:none}.loading-title{letter-spacing:.1em;color:#e8e0ff;text-transform:uppercase;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:20px;font-weight:700}.loading-title:before{content:"▸";color:#c084fc}.loading-status{color:#8276b0;letter-spacing:.04em;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:12px}.loading-spinner{border:2px solid #2a2440;border-top-color:#c084fc;border-radius:50%;width:28px;height:28px;animation:.8s linear infinite spin}@keyframes spin{to{transform:rotate(360deg)}}.shutdown-screen{z-index:9999;-webkit-backdrop-filter:blur();backdrop-filter:blur();pointer-events:none;opacity:0;background:#0a081000;flex-direction:column;justify-content:center;align-items:center;gap:20px;transition:background .4s,-webkit-backdrop-filter .4s,backdrop-filter .4s,opacity .3s;display:flex;position:fixed;inset:0}.shutdown-screen.active{-webkit-backdrop-filter:blur(8px);backdrop-filter:blur(8px);pointer-events:auto;opacity:1;background:#0a0810eb}.shutdown-status{color:#8276b0;letter-spacing:.04em;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:12px;transition:color .3s}.shutdown-screen.done .loading-spinner{opacity:.3;border-color:#2a2440;animation:none}.shutdown-screen.done .shutdown-status{color:#4a4268}</style>
-  <script type="module" crossorigin src="/assets/index-CThQEAEy.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-C6KD8lgZ.css">
+  <script type="module" crossorigin src="/assets/index-Co4S7tnh.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-BxU3Ww0L.css">
 </head>
 <body>
   <div class="loading-screen" id="loading-screen">

package/dist/scripts/postinstall-path-check.js

@@ -1,4 +1,4 @@
-import { a as sandboxInstallNotice, r as probeSandboxDependencies } from "../chunks/sandbox-deps-BPKE-ylr.js";
+import { a as sandboxInstallNotice, r as probeSandboxDependencies } from "../chunks/sandbox-deps-DuaNFq7n.js";
 import { n as npmGlobalBinDir, r as onPath, t as formatPathNotice } from "../chunks/path-doctor-C23VAqeu.js";
 import os from "node:os";
 //#region scripts/postinstall-path-check.ts

package/dist/server/index.js

@@ -87,6 +87,6 @@ if (!nodePty.ok) {
 	}));
 	process.exit(1);
 }
-await import("../chunks/main-DyTCWIu2.js");
+await import("../chunks/main-BG6iHwoY.js");
 //#endregion
 export {};

package/dist/session/hook-tool-relay.js

@@ -1,4 +1,4 @@
-import { o as spawn } from "../chunks/child-process-safe-Ch-Zgxqs.js";
+import { o as spawn } from "../chunks/child-process-safe-DDELk9XC.js";
 import { t as readStdin } from "../chunks/relay-stdin-CpHvLu6M.js";
 import { a as SANE_YOLO_PATH_ENV, n as RTK_PATH_ENV, r as normalizeRtkHookResponse } from "../chunks/rtk-hook-core-BmEz2aq9.js";
 //#region session/hook-tool-relay.ts

package/dist/session/sandbox-open-launcher.js

@@ -1,7 +1,30 @@
 import { r as errorMessage } from "../chunks/text-DoirglWV.js";
-import { o as spawn } from "../chunks/child-process-safe-Ch-Zgxqs.js";
+import { o as spawn } from "../chunks/child-process-safe-DDELk9XC.js";
 import fs from "node:fs";
+import path from "node:path";
+import tty from "node:tty";
 import { FilesystemConfigSchema, SandboxManager } from "@anthropic-ai/sandbox-runtime";
+//#region session/core/sandbox-terminal-core.ts
+var RUNTIME_TERMINAL_FILTER = "(regex #\"^/dev/ttys\")";
+var RUNTIME_TERMINAL_FILTER_COUNT = 2;
+var TERMINAL_PATH_SHAPE = /^\/dev\/ttys\d+$/;
+function confineToOwnTerminal(argv, ownTerminalPath) {
+	if (!TERMINAL_PATH_SHAPE.test(ownTerminalPath)) return {
+		ok: false,
+		reason: `${ownTerminalPath} is not a pseudo-terminal the sandbox can be confined to`
+	};
+	const filterCount = argv.reduce((count, word) => count + word.split(RUNTIME_TERMINAL_FILTER).length - 1, 0);
+	if (filterCount !== RUNTIME_TERMINAL_FILTER_COUNT) return {
+		ok: false,
+		reason: `the sandbox runtime emitted ${filterCount} terminal rules instead of ${RUNTIME_TERMINAL_FILTER_COUNT}, so they cannot be confined to one terminal`
+	};
+	const ownTerminalFilter = `(literal "${ownTerminalPath}")`;
+	return {
+		ok: true,
+		argv: argv.map((word) => word.replaceAll(RUNTIME_TERMINAL_FILTER, ownTerminalFilter))
+	};
+}
+//#endregion
 //#region session/sandbox-open-launcher.ts
 var FORWARDED_SIGNALS = [
 	"SIGINT",
@@ -9,6 +32,8 @@ var FORWARDED_SIGNALS = [
 	"SIGHUP"
 ];
 var OPEN_NETWORK = { allowAllUnixSockets: false };
+var DEVICE_FOLDER = "/dev";
+var PSEUDO_TERMINAL_PREFIX = "ttys";
 function fieldOf(record, field) {
 	if (typeof record !== "object" || record === null) return void 0;
 	return Reflect.get(record, field);
@@ -21,9 +46,23 @@ function readOpenPolicy(policyPath) {
 	if (fieldOf(fieldOf(policy, "network"), "allowedDomains") !== void 0) throw new Error("a policy with a domain list must run through the sandbox runtime CLI");
 	return {
 		network: OPEN_NETWORK,
-		filesystem: FilesystemConfigSchema.parse(fieldOf(policy, "filesystem"))
+		filesystem: FilesystemConfigSchema.parse(fieldOf(policy, "filesystem")),
+		allowPty: fieldOf(policy, "allowPty") === true
 	};
 }
+function ownTerminalPath() {
+	if (!tty.isatty(0)) throw new Error("a policy with terminal access needs the launcher to run in a terminal");
+	const ownDevice = fs.fstatSync(0).rdev;
+	const ownName = fs.readdirSync(DEVICE_FOLDER).filter((name) => name.startsWith(PSEUDO_TERMINAL_PREFIX)).find((name) => fs.statSync(path.join(DEVICE_FOLDER, name)).rdev === ownDevice);
+	if (ownName === void 0) throw new Error("the launcher terminal is not a pseudo-terminal under /dev");
+	return path.join(DEVICE_FOLDER, ownName);
+}
+function sandboxArgv(argv, policy) {
+	if (policy.allowPty !== true || process.platform !== "darwin") return argv;
+	const confinement = confineToOwnTerminal(argv, ownTerminalPath());
+	if (!confinement.ok) throw new Error(confinement.reason);
+	return confinement.argv;
+}
 function exitCodeFor(code, signal) {
 	if (signal === null) return code ?? 0;
 	return FORWARDED_SIGNALS.some((forwarded) => forwarded === signal) ? 0 : 1;
@@ -55,7 +94,7 @@ async function launchInOpenNetworkSandbox() {
 		exitWhenInterrupted();
 		throw wrapFailure;
 	});
-	const [shell, ...shellArgs] = wrapped.argv;
+	const [shell, ...shellArgs] = sandboxArgv(wrapped.argv, openPolicy);
 	if (!shell || shellArgs.at(-1) === commandLine) throw new Error("the sandbox runtime returned the command unwrapped");
 	exitWhenInterrupted();
 	child = spawn(shell, shellArgs, {

package/dist/session/statusline-relay.js

@@ -1,4 +1,4 @@
-import { o as spawn } from "../chunks/child-process-safe-Ch-Zgxqs.js";
+import { o as spawn } from "../chunks/child-process-safe-DDELk9XC.js";
 import { t as readStdin } from "../chunks/relay-stdin-CpHvLu6M.js";
 import { t as postPayload } from "../chunks/loopback-post-DepQfdcM.js";
 import { n as isRecord } from "../chunks/coerce-NSst8oRP.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glimmervoid",
-  "version": "0.31.0",
+  "version": "0.32.1",
   "description": "Mission control for coding agents: run and supervise Claude Code, Codex and Grok sessions in parallel git worktrees from one local browser dashboard",
   "main": "dist/server/index.js",
   "type": "module",

package/dist/chunks/agent-api-core-hVcT26JW.js

@@ -1,112 +0,0 @@
-import { a as AgentDispatchRequest, i as AgentAttentionRequest, o as AgentSpawnRequest, t as AGENT_API_VERBS } from "./session-fc4pFbon.js";
-import crypto from "node:crypto";
-var MAX_SPAWNS_IN_FLIGHT = 1;
-var SPAWNABLE_DEPTH = 0;
-var REFUSAL_REASON = "unknown session";
-var INVALID_BODY_STATUS = 400;
-function tokensMatch(presented, expected) {
-	if (presented.length !== expected.length) return false;
-	try {
-		return crypto.timingSafeEqual(Buffer.from(presented, "utf8"), Buffer.from(expected, "utf8"));
-	} catch {
-		return false;
-	}
-}
-function refused() {
-	return {
-		ok: false,
-		status: 404,
-		reason: REFUSAL_REASON
-	};
-}
-function decideAgentRequest({ sessionId, presentedToken, expectedToken, isLoopback, enabled }) {
-	if (!enabled) return refused();
-	if (!isLoopback) return refused();
-	if (!sessionId) return refused();
-	if (!expectedToken) return refused();
-	if (!presentedToken) return refused();
-	if (!tokensMatch(presentedToken, expectedToken)) return refused();
-	return { ok: true };
-}
-function decideSpawnAllowance({ liveChildren, lifetimeSpawns, inFlight, depth }) {
-	if (depth !== SPAWNABLE_DEPTH) return {
-		ok: false,
-		status: 403,
-		reason: "a spawned session may not spawn another"
-	};
-	if (inFlight >= MAX_SPAWNS_IN_FLIGHT) return {
-		ok: false,
-		status: 429,
-		reason: "a spawn is already in flight"
-	};
-	if (liveChildren >= 3) return {
-		ok: false,
-		status: 429,
-		reason: `at most 3 spawned sessions may be live at once`
-	};
-	if (lifetimeSpawns >= 10) return {
-		ok: false,
-		status: 429,
-		reason: `this session has used its 10 spawns`
-	};
-	return { ok: true };
-}
-function isAgentApiVerb(verb) {
-	return AGENT_API_VERBS.includes(verb);
-}
-function refuseInvalidBody(issues) {
-	return {
-		ok: false,
-		status: INVALID_BODY_STATUS,
-		error: issues[0]?.message || "invalid request"
-	};
-}
-function parseAgentVerb(verb, payload) {
-	if (!isAgentApiVerb(verb)) return {
-		ok: false,
-		status: 404,
-		error: REFUSAL_REASON
-	};
-	if (verb === "dispatch") {
-		const parsed = AgentDispatchRequest.safeParse(payload);
-		if (!parsed.success) return refuseInvalidBody(parsed.error.issues);
-		return {
-			ok: true,
-			verb,
-			request: parsed.data
-		};
-	}
-	if (verb === "board") return {
-		ok: true,
-		verb
-	};
-	if (verb === "attention") {
-		const parsed = AgentAttentionRequest.safeParse(payload);
-		if (!parsed.success) return refuseInvalidBody(parsed.error.issues);
-		return {
-			ok: true,
-			verb,
-			request: parsed.data
-		};
-	}
-	const parsed = AgentSpawnRequest.safeParse(payload);
-	if (!parsed.success) return refuseInvalidBody(parsed.error.issues);
-	return {
-		ok: true,
-		verb,
-		request: parsed.data
-	};
-}
-function deriveChildSessionName(parentName, existingNames) {
-	const base = `${String(parentName || "").trim() || "session"} agent`;
-	const taken = new Set(existingNames);
-	let candidate = base;
-	let suffix = 1;
-	while (taken.has(candidate)) {
-		suffix += 1;
-		candidate = `${base} ${suffix}`;
-	}
-	return candidate;
-}
-//#endregion
-export { isAgentApiVerb as a, deriveChildSessionName as i, decideAgentRequest as n, parseAgentVerb as o, decideSpawnAllowance as r, REFUSAL_REASON as t };

package/dist/chunks/child-process-safe-BKPZ-5qQ.js

@@ -1,2 +0,0 @@
-import { r as execFileSync } from "./child-process-safe-Ch-Zgxqs.js";
-export { execFileSync };

package/dist/chunks/config-store-DbBp7LJZ.js

@@ -1,2 +0,0 @@
-import { c as loadConfigFile } from "./config-store-BCy4FHNG.js";
-export { loadConfigFile };

package/dist/chunks/rtk-resolver-D4Nke1Fr.js

@@ -1,2 +0,0 @@
-import { t as getRtkPath } from "./rtk-resolver-BGDzw5XK.js";
-export { getRtkPath };