glimmervoid 0.33.0 → 0.34.1

package/README.md

@@ -57,7 +57,7 @@ Update a clone with `git pull --ff-only && npm ci && npm run build`, then restar
 - **Claude Code CLI** on PATH, or another supported agent below.
 - **git** on PATH, for per-session worktrees.
 - **Linux only:** `build-essential` and `python3` for node-pty.
-- **Linux only:** `bubblewrap` (`bwrap`), `socat` and `ripgrep` (`rg`) for the sandbox that sandboxed sessions and factory checks run in (`sudo apt install bubblewrap socat ripgrep`). `glimmervoid doctor` reports all three.
+- **Linux only:** `bubblewrap` (`bwrap`), `socat` and `ripgrep` (`rg`) for the sandbox runtime behind session guardrails and factory checks (`sudo apt install bubblewrap socat ripgrep`). `glimmervoid doctor` reports all three.
 
 ## Supported agents
 

package/dist/bin/glimmervoid.js

@@ -6,7 +6,7 @@ import { t as AGENT_API_VERBS } from "../chunks/session-C7rstCmA.js";
 import { i as execSync } from "../chunks/child-process-safe-DDELk9XC.js";
 import { t as renderTable } from "../chunks/ascii-figure-core-pDAwtlKO.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "../chunks/config-path-core-DFt-TemS.js";
-import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-DuaNFq7n.js";
+import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-C63o3mZs.js";
 import { r as gitDoctorRows, t as probeGitVersion } from "../chunks/git-version-CrLW4a6r.js";
 import { i as pnpmGlobalBinDir, n as npmGlobalBinDir, r as onPath, t as formatPathNotice } from "../chunks/path-doctor-C23VAqeu.js";
 import fs from "node:fs";
@@ -135,7 +135,7 @@ var SUBCOMMAND_RUNNERS = new Map([
 		return 0;
 	}],
 	["pair", async (subcommandArgs) => {
-		const { runPairCli } = await import("../chunks/pair-cli-BuyzST-U.js");
+		const { runPairCli } = await import("../chunks/pair-cli-CI848omy.js");
 		return runPairCli(subcommandArgs);
 	}],
 	["agent", async (subcommandArgs) => {
@@ -143,7 +143,7 @@ var SUBCOMMAND_RUNNERS = new Map([
 		return runAgentSetupCli(subcommandArgs);
 	}],
 	["kg", async (subcommandArgs) => {
-		const { runKnowledgeGraphCommand } = await import("../chunks/knowledge-graph-cli-C7G-x5sY.js");
+		const { runKnowledgeGraphCommand } = await import("../chunks/knowledge-graph-cli-BBE3R9DJ.js");
 		return runKnowledgeGraphCommand(subcommandArgs);
 	}],
 	["visions", async (subcommandArgs) => {
@@ -209,7 +209,7 @@ async function readDeclaredCustomAgents() {
 		declared: [],
 		error: null
 	};
-	const { loadConfigFile } = await import("../chunks/config-store-DaRS2c2d.js");
+	const { loadConfigFile } = await import("../chunks/config-store-DwTxLe8Y.js");
 	try {
 		const loaded = loadConfigFile(decided.path, { exitOnError: false });
 		if (!loaded.config) return {
@@ -285,7 +285,7 @@ async function runDoctor() {
 	}
 	switchSection("Agents");
 	try {
-		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-C9gI2MHS.js");
+		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-CgbcceU3.js");
 		const declaredCustomAgents = await readDeclaredCustomAgents();
 		if (declaredCustomAgents.error) line("config", declaredCustomAgents.error);
 		setCustomAgents(declaredCustomAgents.declared);

package/dist/chunks/{adapters-C9gI2MHS.js → adapters-CgbcceU3.js}

@@ -1,2 +1,2 @@
-import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-CUBEhjOR.js";
+import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-D-cRFZ_Q.js";
 export { describeAgentResolvability, listAgentIds, setCustomAgents };

package/dist/chunks/{adapters-CUBEhjOR.js → adapters-D-cRFZ_Q.js}

@@ -5,7 +5,7 @@ import { n as resolveAgentCommand, t as buildAgentSpawnCommand } from "./spawn-c
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, t as grok } from "./grok-BYKnBgdr.js";
 import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
-import "./contracts-DWv6q8ir.js";
+import "./contracts-DZV9H8px.js";
 import { n as mergeCodexPreToolUse, t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import fs from "node:fs";
 //#region session/adapters/claude-code.ts

package/dist/chunks/{config-Cneb8Ujj.js → config-DTwMFUjx.js}

@@ -1448,12 +1448,16 @@ var AgentApiSettings = z.object(agentApiShape, { error: "agentApi must be an obj
 var AgentApiFileSettings = z.object(agentApiShape, { error: "agentApi must be an object" }).passthrough().optional();
 var optionalPathList = (field) => z.array(z.string({ error: `${field} must be an array of paths` }).trim().min(1, { error: `${field} must be an array of paths` }), { error: `${field} must be an array of paths` }).optional();
 var sandboxShape = {
-	unconfinedRepos: optionalPathList("sandbox.unconfinedRepos"),
-	writablePaths: optionalPathList("sandbox.writablePaths"),
-	unreadablePaths: optionalPathList("sandbox.unreadablePaths")
+	unguardedRepos: optionalPathList("guardrails.unguardedRepos"),
+	blockedPaths: optionalPathList("guardrails.blockedPaths"),
+	unreadablePaths: optionalPathList("guardrails.unreadablePaths")
 };
-var SandboxSettings = z.object(sandboxShape, { error: "sandbox must be an object" }).strict().optional();
-var SandboxFileSettings = z.object(sandboxShape, { error: "sandbox must be an object" }).passthrough().optional();
+var isHomeRelativePath = (entry) => entry === "~" || entry.startsWith("~/") || entry.startsWith("~\\");
+var createSandboxSettings = (isAbsolutePath) => z.object({
+	...sandboxShape,
+	blockedPaths: z.array(z.string({ error: "guardrails.blockedPaths must be an array of paths" }).trim().min(1, { error: "guardrails.blockedPaths must be an array of paths" }).refine((entry) => isHomeRelativePath(entry) || isAbsolutePath(entry), { message: "guardrails.blockedPaths entries must be absolute paths or start with ~/" }), { error: "guardrails.blockedPaths must be an array of paths" }).optional()
+}, { error: "guardrails must be an object" }).strict().optional();
+var SandboxFileSettings = z.object(sandboxShape, { error: "guardrails must be an object" }).passthrough().optional();
 var telemetryShape = { enabled: optionalBoolean("telemetry.enabled") };
 var TelemetrySettings = z.object(telemetryShape, { error: "telemetry must be an object" }).strict().optional();
 var TelemetryFileSettings = z.object(telemetryShape, { error: "telemetry must be an object" }).passthrough().optional();
@@ -1496,7 +1500,7 @@ var createBrowserConfigShape = (isAbsolutePath) => ({
 	telegram: TelegramSettings,
 	ingest: IngestSettings,
 	agentApi: AgentApiSettings,
-	sandbox: SandboxSettings,
+	guardrails: createSandboxSettings(isAbsolutePath),
 	telemetry: TelemetrySettings,
 	workflows: WorkflowsSettings.nullable().optional()
 });
@@ -1593,7 +1597,7 @@ var ProjectConfig = z.object({
 	agent: z.string({ error: "projects[].agent must be a string" }).regex(AGENT_ID_RE, { error: `projects[].agent must be ${AGENT_ID_SHAPE_MESSAGE}` }).optional(),
 	codexBypassHookTrust: z.boolean().optional(),
 	dangerouslySkipPermissions: z.boolean({ error: "projects[].dangerouslySkipPermissions must be a boolean" }).optional(),
-	unconfined: z.boolean({ error: "projects[].unconfined must be a boolean" }).optional()
+	unguarded: z.boolean({ error: "projects[].unguarded must be a boolean" }).optional()
 }).passthrough();
 var FILE_CONFIG_SHAPE = {
 	...BROWSER_CONFIG_SHAPE,
@@ -1612,7 +1616,7 @@ var FILE_CONFIG_SHAPE = {
 	ingest: optionalLooseObject("ingest"),
 	workflows: optionalLooseObject("workflows"),
 	agentApi: AgentApiFileSettings,
-	sandbox: SandboxFileSettings,
+	guardrails: SandboxFileSettings,
 	telemetry: TelemetryFileSettings,
 	trace: TraceSettings,
 	planReview: PlanReviewSettings,
@@ -1669,7 +1673,7 @@ var CONFIG_BLOCK_KEYS = Object.freeze([
 	"telegram",
 	"ingest",
 	"agentApi",
-	"sandbox",
+	"guardrails",
 	"telemetry",
 	"workflows",
 	"coder"

package/dist/chunks/{config-store-DYsZJDux.js → config-store-D0lRWsAM.js}

@@ -3,8 +3,8 @@ import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths
 import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
 import { a as positiveIntOr, c as textOr, n as isRecord } from "./coerce-NSst8oRP.js";
 import { d as writeJsonAtomicSync, f as writeTextAtomic, p as writeTextAtomicSync } from "./json-file-oEH9vt-0.js";
-import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-Cneb8Ujj.js";
-import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-DWv6q8ir.js";
+import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-DTwMFUjx.js";
+import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-DZV9H8px.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -1113,9 +1113,9 @@ var DEFAULT_CONFIG = {
 		mirrorHarnessRuns: false
 	},
 	agentApi: { enabled: false },
-	sandbox: {
-		unconfinedRepos: [],
-		writablePaths: ["~/.npm", "~/.cache"],
+	guardrails: {
+		unguardedRepos: [],
+		blockedPaths: [],
 		unreadablePaths: []
 	},
 	telemetry: { enabled: true },
@@ -1388,6 +1388,12 @@ function pickRedactedBlock(stored, allowedKeys, secretKeys) {
 	}
 	return redacted;
 }
+function retiredGuardrailKeysWarning(config) {
+	const projects = Array.isArray(config.projects) ? config.projects : [];
+	const retiredKeys = [...Object.hasOwn(config, "sandbox") ? ["sandbox (move it to guardrails, renaming unconfinedRepos to unguardedRepos)"] : [], ...projects.some((project) => isRecord(project) && Object.hasOwn(project, "unconfined")) ? ["projects[].unconfined (rename it to unguarded)"] : []];
+	if (retiredKeys.length === 0) return null;
+	return `[guardrails] config.json still has ${retiredKeys.join(" and ")}. These keys are ignored, so their unreadable paths and opt-outs do not apply until you move them.`;
+}
 function createConfigStore({ settingsDefaults } = {}) {
 	const configPath = resolveConfigPath();
 	const effectiveDefaults = {
@@ -1401,6 +1407,8 @@ function createConfigStore({ settingsDefaults } = {}) {
 	writeBackupContent(`${configPath}.boot.bak`, loadedConfig.loadedContent);
 	config.repoRoots = config.repoRoots || [];
 	config.branchGc = resolveBranchGcAndWarn(config.branchGc);
+	const retiredGuardrailKeys = retiredGuardrailKeysWarning(config);
+	if (retiredGuardrailKeys !== null) console.warn(retiredGuardrailKeys);
 	if (Array.isArray(config.projects) && ensureProjectIds(config.projects)) try {
 		writeJsonAtomicSync(configPath, withoutEnvSecrets(config, envSecrets), { mode: 384 });
 		console.log("[config] Auto-assigned IDs to projects missing them");
@@ -1520,9 +1528,9 @@ function createConfigStore({ settingsDefaults } = {}) {
 			recordSignals: config.recordSignals ?? effectiveDefaults.recordSignals,
 			trace: { enabled: config.trace?.enabled ?? DEFAULT_CONFIG.trace.enabled },
 			agentApi: { enabled: config.agentApi?.enabled ?? DEFAULT_CONFIG.agentApi.enabled },
-			sandbox: {
-				...DEFAULT_CONFIG.sandbox,
-				...config.sandbox
+			guardrails: {
+				...DEFAULT_CONFIG.guardrails,
+				...config.guardrails
 			},
 			telemetry: { enabled: config.telemetry?.enabled ?? DEFAULT_CONFIG.telemetry.enabled },
 			telemetryForcedOff: isTelemetryForcedOff(process.env),
@@ -1598,7 +1606,7 @@ function createConfigStore({ settingsDefaults } = {}) {
 		if (newConfig.telegram != null) config.telegram = newConfig.telegram;
 		if (newConfig.ingest != null) config.ingest = newConfig.ingest;
 		if (newConfig.agentApi != null) config.agentApi = newConfig.agentApi;
-		if (newConfig.sandbox != null) config.sandbox = newConfig.sandbox;
+		if (newConfig.guardrails != null) config.guardrails = newConfig.guardrails;
 		if (newConfig.telemetry != null) config.telemetry = newConfig.telemetry;
 		if (newConfig.workflows == null) delete config.workflows;
 		if (newConfig.workflows != null) config.workflows = newConfig.workflows;

package/dist/chunks/config-store-DwTxLe8Y.js

@@ -0,0 +1,2 @@
+import { c as loadConfigFile } from "./config-store-D0lRWsAM.js";
+export { loadConfigFile };

package/dist/chunks/{contracts-DWv6q8ir.js → contracts-DZV9H8px.js}

@@ -1,5 +1,5 @@
 import { T as TaskTitle, b as SessionSnapshot, d as PendingPromptDetail, g as SESSION_DOC_PATH_MAX_CHARS, p as PendingWakeup, x as SessionState, y as SessionDoc } from "./session-C7rstCmA.js";
-import { D as MyPrMergeWhenReadyRequest, Dt as CoherenceRisk, Et as CoherenceReadiness, F as CommitSha, O as MyPrMergeWhenReadyResult, P as MyPrsStatus, Q as TeamReviewActionResult, S as MyPrKeepMergeableResult, T as MyPrMergeResult, Tt as CoherenceOrient, Z as TeamReviewActionRequest, _t as ReviewsRefreshResult, gt as ReviewsRefreshRequest, jt as CoherenceWorkState, mt as REPO_SLUG_RE, n as BUILTIN_AGENT_IDS, nt as TeamReviewStatus, vt as reviewsPollingShape, w as MyPrMergeRequest, x as MyPrKeepMergeableRequest } from "./config-Cneb8Ujj.js";
+import { D as MyPrMergeWhenReadyRequest, Dt as CoherenceRisk, Et as CoherenceReadiness, F as CommitSha, O as MyPrMergeWhenReadyResult, P as MyPrsStatus, Q as TeamReviewActionResult, S as MyPrKeepMergeableResult, T as MyPrMergeResult, Tt as CoherenceOrient, Z as TeamReviewActionRequest, _t as ReviewsRefreshResult, gt as ReviewsRefreshRequest, jt as CoherenceWorkState, mt as REPO_SLUG_RE, n as BUILTIN_AGENT_IDS, nt as TeamReviewStatus, vt as reviewsPollingShape, w as MyPrMergeRequest, x as MyPrKeepMergeableRequest } from "./config-DTwMFUjx.js";
 import { z } from "zod";
 //#region shared/contracts/factory.ts
 var FactoryConsequences = z.looseObject({ records: z.array(z.looseObject({
@@ -1370,6 +1370,15 @@ var clientVariants = [
 		id: sessionId,
 		newName: z.string()
 	}),
+	loose("get-workspace-repos", {
+		id: sessionId,
+		requestId
+	}),
+	loose("set-workspace-repos", {
+		id: sessionId,
+		repos: z.array(z.string()),
+		requestId
+	}),
 	loose("set-session-title", {
 		id: sessionId,
 		title: TaskTitle
@@ -1511,6 +1520,8 @@ Object.freeze([
 	"hooks-report",
 	"save-hook-result",
 	"delete-hook-result",
+	"workspace-repos",
+	"set-workspace-repos-result",
 	"hooks-updated",
 	"state-change",
 	"session-added",
@@ -1635,6 +1646,19 @@ var serverVariants = [
 		error: optionalError,
 		id: z.string().optional()
 	}),
+	loose("workspace-repos", {
+		requestId,
+		id: sessionId,
+		ok: z.boolean(),
+		repos: z.array(z.string()),
+		error: optionalError
+	}),
+	loose("set-workspace-repos-result", {
+		requestId,
+		id: sessionId,
+		ok: z.boolean(),
+		error: optionalError
+	}),
 	loose("hooks-updated", { count: z.number().int().nonnegative() }),
 	loose("state-change", {
 		id: sessionId,

package/dist/chunks/{knowledge-graph-cli-C7G-x5sY.js → knowledge-graph-cli-BBE3R9DJ.js}

@@ -2,7 +2,7 @@ import { r as errorMessage } from "./text-DoirglWV.js";
 import { s as resolvePackageBin } from "./runtime-paths-BPoxENmK.js";
 import { r as execFileSync } from "./child-process-safe-DDELk9XC.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
-import { r as BrowserConfig } from "./config-Cneb8Ujj.js";
+import { r as BrowserConfig } from "./config-DTwMFUjx.js";
 import fs, { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path, { dirname, join, posix, resolve, win32 } from "node:path";
 import { parseArgs } from "node:util";