glimmervoid 0.32.0 → 0.33.0

package/dist/client/index.html

@@ -7,8 +7,8 @@
   <link rel="icon" type="image/svg+xml" href="/assets/favicon-CKygeLwW.svg">
   <title>Glimmervoid</title>
   <style>html,body{background:var(--bg,#0a0810);height:100%;color:var(--text,#c8c0e0);font-family:var(--font-mono,"CommitMono", "Cascadia Code", "Fira Code", "Consolas", "Menlo", monospace);margin:0;padding:0}.app-shell{display:none}html:not([data-layout=phone]) .app-ready .app-shell{display:contents}.loading-screen{z-index:9999;background:#0a0810;flex-direction:column;justify-content:center;align-items:center;gap:20px;transition:opacity .3s;display:flex;position:fixed;inset:0}.loading-screen.fade-out{opacity:0;pointer-events:none}.loading-title{letter-spacing:.1em;color:#e8e0ff;text-transform:uppercase;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:20px;font-weight:700}.loading-title:before{content:"▸";color:#c084fc}.loading-status{color:#8276b0;letter-spacing:.04em;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:12px}.loading-spinner{border:2px solid #2a2440;border-top-color:#c084fc;border-radius:50%;width:28px;height:28px;animation:.8s linear infinite spin}@keyframes spin{to{transform:rotate(360deg)}}.shutdown-screen{z-index:9999;-webkit-backdrop-filter:blur();backdrop-filter:blur();pointer-events:none;opacity:0;background:#0a081000;flex-direction:column;justify-content:center;align-items:center;gap:20px;transition:background .4s,-webkit-backdrop-filter .4s,backdrop-filter .4s,opacity .3s;display:flex;position:fixed;inset:0}.shutdown-screen.active{-webkit-backdrop-filter:blur(8px);backdrop-filter:blur(8px);pointer-events:auto;opacity:1;background:#0a0810eb}.shutdown-status{color:#8276b0;letter-spacing:.04em;font-family:CommitMono,Cascadia Code,Fira Code,Consolas,Menlo,monospace;font-size:12px;transition:color .3s}.shutdown-screen.done .loading-spinner{opacity:.3;border-color:#2a2440;animation:none}.shutdown-screen.done .shutdown-status{color:#4a4268}</style>
-  <script type="module" crossorigin src="/assets/index-CoqWjYxP.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-C_XKsDFx.css">
+  <script type="module" crossorigin src="/assets/index-CoFsm_PF.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-BxU3Ww0L.css">
 </head>
 <body>
   <div class="loading-screen" id="loading-screen">

package/dist/server/index.js

@@ -87,6 +87,6 @@ if (!nodePty.ok) {
 	}));
 	process.exit(1);
 }
-await import("../chunks/main-DSbpYn2Y.js");
+await import("../chunks/main-J6y2RTri.js");
 //#endregion
 export {};

package/dist/session/sandbox-open-launcher.js

@@ -1,7 +1,30 @@
 import { r as errorMessage } from "../chunks/text-DoirglWV.js";
 import { o as spawn } from "../chunks/child-process-safe-DDELk9XC.js";
 import fs from "node:fs";
+import path from "node:path";
+import tty from "node:tty";
 import { FilesystemConfigSchema, SandboxManager } from "@anthropic-ai/sandbox-runtime";
+//#region session/core/sandbox-terminal-core.ts
+var RUNTIME_TERMINAL_FILTER = "(regex #\"^/dev/ttys\")";
+var RUNTIME_TERMINAL_FILTER_COUNT = 2;
+var TERMINAL_PATH_SHAPE = /^\/dev\/ttys\d+$/;
+function confineToOwnTerminal(argv, ownTerminalPath) {
+	if (!TERMINAL_PATH_SHAPE.test(ownTerminalPath)) return {
+		ok: false,
+		reason: `${ownTerminalPath} is not a pseudo-terminal the sandbox can be confined to`
+	};
+	const filterCount = argv.reduce((count, word) => count + word.split(RUNTIME_TERMINAL_FILTER).length - 1, 0);
+	if (filterCount !== RUNTIME_TERMINAL_FILTER_COUNT) return {
+		ok: false,
+		reason: `the sandbox runtime emitted ${filterCount} terminal rules instead of ${RUNTIME_TERMINAL_FILTER_COUNT}, so they cannot be confined to one terminal`
+	};
+	const ownTerminalFilter = `(literal "${ownTerminalPath}")`;
+	return {
+		ok: true,
+		argv: argv.map((word) => word.replaceAll(RUNTIME_TERMINAL_FILTER, ownTerminalFilter))
+	};
+}
+//#endregion
 //#region session/sandbox-open-launcher.ts
 var FORWARDED_SIGNALS = [
 	"SIGINT",
@@ -9,6 +32,8 @@ var FORWARDED_SIGNALS = [
 	"SIGHUP"
 ];
 var OPEN_NETWORK = { allowAllUnixSockets: false };
+var DEVICE_FOLDER = "/dev";
+var PSEUDO_TERMINAL_PREFIX = "ttys";
 function fieldOf(record, field) {
 	if (typeof record !== "object" || record === null) return void 0;
 	return Reflect.get(record, field);
@@ -21,9 +46,24 @@ function readOpenPolicy(policyPath) {
 	if (fieldOf(fieldOf(policy, "network"), "allowedDomains") !== void 0) throw new Error("a policy with a domain list must run through the sandbox runtime CLI");
 	return {
 		network: OPEN_NETWORK,
-		filesystem: FilesystemConfigSchema.parse(fieldOf(policy, "filesystem"))
+		filesystem: FilesystemConfigSchema.parse(fieldOf(policy, "filesystem")),
+		allowPty: fieldOf(policy, "allowPty") === true,
+		enableWeakerNetworkIsolation: true
 	};
 }
+function ownTerminalPath() {
+	if (!tty.isatty(0)) throw new Error("a policy with terminal access needs the launcher to run in a terminal");
+	const ownDevice = fs.fstatSync(0).rdev;
+	const ownName = fs.readdirSync(DEVICE_FOLDER).filter((name) => name.startsWith(PSEUDO_TERMINAL_PREFIX)).find((name) => fs.statSync(path.join(DEVICE_FOLDER, name)).rdev === ownDevice);
+	if (ownName === void 0) throw new Error("the launcher terminal is not a pseudo-terminal under /dev");
+	return path.join(DEVICE_FOLDER, ownName);
+}
+function sandboxArgv(argv, policy) {
+	if (policy.allowPty !== true || process.platform !== "darwin") return argv;
+	const confinement = confineToOwnTerminal(argv, ownTerminalPath());
+	if (!confinement.ok) throw new Error(confinement.reason);
+	return confinement.argv;
+}
 function exitCodeFor(code, signal) {
 	if (signal === null) return code ?? 0;
 	return FORWARDED_SIGNALS.some((forwarded) => forwarded === signal) ? 0 : 1;
@@ -55,7 +95,7 @@ async function launchInOpenNetworkSandbox() {
 		exitWhenInterrupted();
 		throw wrapFailure;
 	});
-	const [shell, ...shellArgs] = wrapped.argv;
+	const [shell, ...shellArgs] = sandboxArgv(wrapped.argv, openPolicy);
 	if (!shell || shellArgs.at(-1) === commandLine) throw new Error("the sandbox runtime returned the command unwrapped");
 	exitWhenInterrupted();
 	child = spawn(shell, shellArgs, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glimmervoid",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Mission control for coding agents: run and supervise Claude Code, Codex and Grok sessions in parallel git worktrees from one local browser dashboard",
   "main": "dist/server/index.js",
   "type": "module",

package/dist/chunks/config-store-Cp62jN1O.js

@@ -1,2 +0,0 @@
-import { c as loadConfigFile } from "./config-store-BVtdHkDK.js";
-export { loadConfigFile };