harnery 0.40.0 → 0.42.0

package/dist/core/workflow/worker-access.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Decide, per launch, whether a workflow worker runs without its vendor sandbox
+ * (ADR 0192).
+ *
+ * A worker gets full access only when three independent things agree:
+ *
+ * 1. The host project enabled it. Harnery ships it off.
+ * 2. The session that launched the run can itself be shown to have full
+ *    access. A sandboxed parent never hands more access to a child than it
+ *    holds, and a parent whose access cannot be established counts as
+ *    sandboxed.
+ * 3. The worker's model and effort meet a floor the host configured for that
+ *    adapter.
+ *
+ * Every other case keeps the ordinary sandboxed projection, byte for byte. The
+ * decision is recorded on every launch, so a run states what each worker was
+ * allowed to do and why.
+ */
+import type { ParentAccessEvidence, SpawnFilesystemPolicy, WorkerAccessDecision } from "./types.js";
+/** One model an adapter's worker may run unsandboxed on. `minEffort` is on the
+ * adapter's declared effort scale; it is required for an adapter that has one
+ * and refused for an adapter that does not (whose effort lives in the model id). */
+export interface WorkerFullAccessFloor {
+    model: string;
+    minEffort?: string;
+}
+export interface WorkerFullAccessPolicy {
+    enabled: boolean;
+    floors: Readonly<Record<string, readonly WorkerFullAccessFloor[]>>;
+    /** Set when the configured value could not be validated. An invalid policy
+     * is disabled as a whole rather than partially honored. */
+    invalid?: string;
+}
+export declare const DISABLED_WORKER_FULL_ACCESS: WorkerFullAccessPolicy;
+/**
+ * Validate the raw `workflow.workerFullAccess` config value.
+ *
+ * Absent means disabled. Anything malformed disables the whole policy and says
+ * why, because honoring the valid half of a half-valid trust grant would hand
+ * out access the host never cleanly stated.
+ */
+export declare function parseWorkerFullAccessPolicy(raw: unknown): WorkerFullAccessPolicy;
+export interface WorkerAccessInput {
+    adapter: string;
+    model?: string;
+    effort?: string;
+    policy: WorkerFullAccessPolicy;
+    /** The run's filesystem policy, if the host requested one. */
+    filesystemPolicy?: SpawnFilesystemPolicy;
+    /** Called at most when every cheaper condition already allows full access. */
+    parent: () => ParentAccessEvidence;
+}
+/**
+ * The access decision for one launch. Conditions are checked from the host's
+ * own configuration outward, so the recorded reason names the first thing that
+ * kept the sandbox in place.
+ */
+export declare function decideWorkerAccess(input: WorkerAccessInput): WorkerAccessDecision;
+export interface ParentAccessDeps {
+    env: Readonly<Record<string, string | undefined>>;
+    platform: NodeJS.Platform;
+    homeDir: string;
+    /** Contents of /proc/self/status, or null when unreadable. */
+    procStatus: () => string | null;
+    /** Windows user profile roots visible from a WSL guest. */
+    windowsUserRoots: () => string[];
+}
+/**
+ * Establish whether the session that launched this process runs without a
+ * sandbox. Only positive evidence counts.
+ *
+ * Every adapter session marker in the environment has to prove full access on
+ * its own. A nested launch (one agent CLI inside another) inherits both
+ * markers, and the outer session's sandbox would still bind the inner one, so
+ * one sandboxed or unprovable marker is enough to keep workers sandboxed.
+ *
+ * - Process confinement is checked first. On Linux, the Codex and Claude Code
+ *   sandboxes both set `no_new_privs`, and Codex also exports
+ *   `CODEX_SANDBOX*` variables. Either one means this process is confined.
+ * - Codex: the thread's rollout file must show the latest turn ran under the
+ *   `danger-full-access` sandbox policy.
+ * - Claude Code: the session transcript's latest permission mode must be
+ *   `bypassPermissions`. Claude Code's Bash sandbox is covered by the Linux
+ *   confinement check; on other platforms it cannot be ruled out, so a Claude
+ *   Code parent there is unknown.
+ * - Cursor and OpenCode record no readable access state, so they are unknown.
+ */
+export declare function detectParentAccess(deps?: ParentAccessDeps): ParentAccessEvidence;
+/** The last line of `path` containing `needle`, reading backwards so a large
+ * session log is not loaded whole. Null when absent or past `maxBytes`. */
+export declare function lastLineContaining(path: string, needle: string, maxBytes?: number): string | null;
+//# sourceMappingURL=worker-access.d.ts.map

package/dist/core/workflow/worker-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-access.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/worker-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEpG;;oFAEoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IACnE;+DAC2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,2BAA2B,EAAE,sBAGxC,CAAC;AAUH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CA6DhF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,oBAAoB,CAAC;CACpC;AAWD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CAqEjF;AAMD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,MAAM,EAAE,CAAC;CAClC;AA+BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAgC,GAAG,oBAAoB,CAiE/F;AAED;2EAC2E;AAC3E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,SAAoB,GAC3B,MAAM,GAAG,IAAI,CAgCf"}

package/dist/core/workflow/worker-access.js

@@ -0,0 +1,450 @@
+/**
+ * Decide, per launch, whether a workflow worker runs without its vendor sandbox
+ * (ADR 0192).
+ *
+ * A worker gets full access only when three independent things agree:
+ *
+ * 1. The host project enabled it. Harnery ships it off.
+ * 2. The session that launched the run can itself be shown to have full
+ *    access. A sandboxed parent never hands more access to a child than it
+ *    holds, and a parent whose access cannot be established counts as
+ *    sandboxed.
+ * 3. The worker's model and effort meet a floor the host configured for that
+ *    adapter.
+ *
+ * Every other case keeps the ordinary sandboxed projection, byte for byte. The
+ * decision is recorded on every launch, so a run states what each worker was
+ * allowed to do and why.
+ */
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { builtinAdapterProfile } from "../adapters/profiles.js";
+export const DISABLED_WORKER_FULL_ACCESS = Object.freeze({
+    enabled: false,
+    floors: Object.freeze({}),
+});
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalid(message) {
+    return { enabled: false, floors: {}, invalid: message };
+}
+/**
+ * Validate the raw `workflow.workerFullAccess` config value.
+ *
+ * Absent means disabled. Anything malformed disables the whole policy and says
+ * why, because honoring the valid half of a half-valid trust grant would hand
+ * out access the host never cleanly stated.
+ */
+export function parseWorkerFullAccessPolicy(raw) {
+    if (raw === undefined || raw === null)
+        return DISABLED_WORKER_FULL_ACCESS;
+    if (!isPlainObject(raw))
+        return invalid("workflow.workerFullAccess must be an object");
+    for (const key of Object.keys(raw)) {
+        if (key !== "enabled" && key !== "floors") {
+            return invalid(`workflow.workerFullAccess has unknown key ${JSON.stringify(key)}`);
+        }
+    }
+    if (raw.enabled !== undefined && typeof raw.enabled !== "boolean") {
+        return invalid("workflow.workerFullAccess.enabled must be a boolean");
+    }
+    const floorsRaw = raw.floors ?? {};
+    if (!isPlainObject(floorsRaw))
+        return invalid("workflow.workerFullAccess.floors must be an object");
+    const floors = {};
+    for (const [adapter, entries] of Object.entries(floorsRaw)) {
+        const profile = builtinAdapterProfile(adapter);
+        if (!profile) {
+            return invalid(`workflow.workerFullAccess.floors names unknown adapter ${JSON.stringify(adapter)}`);
+        }
+        if (!Array.isArray(entries)) {
+            return invalid(`workflow.workerFullAccess.floors.${adapter} must be an array`);
+        }
+        const parsed = [];
+        for (const entry of entries) {
+            if (!isPlainObject(entry)) {
+                return invalid(`workflow.workerFullAccess.floors.${adapter} entries must be objects`);
+            }
+            for (const key of Object.keys(entry)) {
+                if (key !== "model" && key !== "minEffort") {
+                    return invalid(`workflow.workerFullAccess.floors.${adapter} entry has unknown key ${JSON.stringify(key)}`);
+                }
+            }
+            const model = typeof entry.model === "string" ? entry.model.trim() : "";
+            if (!model) {
+                return invalid(`workflow.workerFullAccess.floors.${adapter} entry needs a model id`);
+            }
+            const minEffort = entry.minEffort;
+            if (profile.effortValues.length > 0) {
+                if (typeof minEffort !== "string" || !profile.effortValues.includes(minEffort)) {
+                    return invalid(`workflow.workerFullAccess.floors.${adapter} entry for ${model} needs minEffort, one of: ${profile.effortValues.join(", ")}`);
+                }
+                parsed.push({ model, minEffort });
+            }
+            else {
+                if (minEffort !== undefined) {
+                    return invalid(`workflow.workerFullAccess.floors.${adapter} has no effort scale; name the exact model id instead of minEffort`);
+                }
+                parsed.push({ model });
+            }
+        }
+        floors[adapter] = parsed;
+    }
+    return { enabled: raw.enabled === true, floors };
+}
+const sandboxed = (reason, detail) => ({
+    mode: "sandboxed",
+    reason,
+    detail,
+});
+/**
+ * The access decision for one launch. Conditions are checked from the host's
+ * own configuration outward, so the recorded reason names the first thing that
+ * kept the sandbox in place.
+ */
+export function decideWorkerAccess(input) {
+    const { adapter, policy } = input;
+    if (policy.invalid) {
+        return sandboxed("config_invalid", `worker full access is off: ${policy.invalid}`);
+    }
+    if (!policy.enabled) {
+        return sandboxed("disabled", "the host has not enabled worker full access");
+    }
+    if (!builtinAdapterProfile(adapter)?.fullAccess) {
+        return sandboxed("adapter_unrepresentable", `${adapter} declares no full-access mode`);
+    }
+    if (input.filesystemPolicy?.mode === "read-only") {
+        // A read-only policy is a deliberate constraint on this run's children, not
+        // a sandbox limitation to route around.
+        return sandboxed("policy_read_only", "the run requested a read-only filesystem policy");
+    }
+    const floors = policy.floors[adapter] ?? [];
+    if (floors.length === 0) {
+        return sandboxed("model_not_listed", `no full-access floor is configured for ${adapter}`);
+    }
+    if (!input.model) {
+        return sandboxed("model_unset", "the worker names no model, so the adapter default cannot be checked against a floor");
+    }
+    const matching = floors.filter((floor) => floor.model === input.model);
+    if (matching.length === 0) {
+        return sandboxed("model_not_listed", `${input.model} is not on the ${adapter} full-access list`);
+    }
+    const scale = builtinAdapterProfile(adapter)?.effortValues ?? [];
+    if (scale.length > 0) {
+        if (!input.effort) {
+            return sandboxed("effort_unset", `the worker names no effort, so ${input.model} cannot be checked against its floor`);
+        }
+        const rank = scale.indexOf(input.effort);
+        const floor = matching.find((entry) => entry.minEffort !== undefined && rank >= scale.indexOf(entry.minEffort));
+        if (rank < 0 || !floor) {
+            const needed = matching.map((entry) => entry.minEffort).join(" or ");
+            return sandboxed("effort_below_floor", `${input.model} at effort ${input.effort} is below the ${needed} floor`);
+        }
+    }
+    const parent = input.parent();
+    if (parent.state === "sandboxed") {
+        return sandboxed("parent_sandboxed", `the launching session is sandboxed: ${parent.detail}`);
+    }
+    if (parent.state !== "full-access") {
+        return sandboxed("parent_unknown", `the launching session's access could not be established: ${parent.detail}`);
+    }
+    const effortPart = input.effort ? ` at effort ${input.effort}` : "";
+    return {
+        mode: "full-access",
+        reason: "qualified",
+        detail: `${input.model}${effortPart} meets the ${adapter} floor and ${parent.detail}`,
+    };
+}
+function defaultDeps() {
+    return {
+        env: process.env,
+        platform: process.platform,
+        homeDir: homedir(),
+        procStatus: () => {
+            try {
+                return readFileSync("/proc/self/status", "utf8");
+            }
+            catch {
+                return null;
+            }
+        },
+        windowsUserRoots: () => {
+            try {
+                return readdirSync("/mnt/c/Users").map((name) => join("/mnt/c/Users", name));
+            }
+            catch {
+                return [];
+            }
+        },
+    };
+}
+const nonEmpty = (value) => {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+};
+/**
+ * Establish whether the session that launched this process runs without a
+ * sandbox. Only positive evidence counts.
+ *
+ * Every adapter session marker in the environment has to prove full access on
+ * its own. A nested launch (one agent CLI inside another) inherits both
+ * markers, and the outer session's sandbox would still bind the inner one, so
+ * one sandboxed or unprovable marker is enough to keep workers sandboxed.
+ *
+ * - Process confinement is checked first. On Linux, the Codex and Claude Code
+ *   sandboxes both set `no_new_privs`, and Codex also exports
+ *   `CODEX_SANDBOX*` variables. Either one means this process is confined.
+ * - Codex: the thread's rollout file must show the latest turn ran under the
+ *   `danger-full-access` sandbox policy.
+ * - Claude Code: the session transcript's latest permission mode must be
+ *   `bypassPermissions`. Claude Code's Bash sandbox is covered by the Linux
+ *   confinement check; on other platforms it cannot be ruled out, so a Claude
+ *   Code parent there is unknown.
+ * - Cursor and OpenCode record no readable access state, so they are unknown.
+ */
+export function detectParentAccess(deps = defaultDeps()) {
+    const env = deps.env;
+    const markers = [];
+    const claudeId = nonEmpty(env.CLAUDE_CODE_SESSION_ID);
+    if (claudeId)
+        markers.push({ adapter: "claude-code", id: claudeId });
+    const codexId = nonEmpty(env.CODEX_THREAD_ID);
+    if (codexId)
+        markers.push({ adapter: "codex", id: codexId });
+    const cursorId = nonEmpty(env.CURSOR_SESSION_ID) ?? nonEmpty(env.CURSOR_CONVERSATION_ID);
+    if (cursorId)
+        markers.push({ adapter: "cursor", id: cursorId });
+    const openCodeId = nonEmpty(env.OPENCODE_SESSION_ID);
+    if (openCodeId)
+        markers.push({ adapter: "opencode", id: openCodeId });
+    const adapters = markers.map((marker) => marker.adapter);
+    const result = (verdict) => ({ ...verdict, adapters });
+    if (markers.length === 0) {
+        return result({ state: "unknown", detail: "no adapter session marker is present" });
+    }
+    const sandboxVars = Object.keys(env).filter((key) => key.startsWith("CODEX_SANDBOX") && nonEmpty(env[key]));
+    if (sandboxVars.length > 0) {
+        return result({ state: "sandboxed", detail: `${sandboxVars.join(", ")} is set` });
+    }
+    let confinement;
+    if (deps.platform === "linux") {
+        const status = deps.procStatus();
+        const match = status?.match(/^NoNewPrivs:\s*(\d)/m);
+        if (!match) {
+            return result({ state: "unknown", detail: "process confinement could not be read" });
+        }
+        if (match[1] !== "0") {
+            return result({ state: "sandboxed", detail: "this process runs with no_new_privs set" });
+        }
+        confinement = { state: "full-access", detail: "no_new_privs is clear" };
+    }
+    else {
+        confinement = { state: "unknown", detail: `no confinement probe on ${deps.platform}` };
+    }
+    const verdicts = [];
+    for (const marker of markers) {
+        if (marker.adapter === "codex") {
+            verdicts.push(codexParentAccess(marker.id, deps));
+        }
+        else if (marker.adapter === "claude-code") {
+            if (confinement.state !== "full-access") {
+                verdicts.push({
+                    state: "unknown",
+                    detail: `Claude Code's Bash sandbox cannot be ruled out (${confinement.detail})`,
+                });
+            }
+            else {
+                verdicts.push(claudeParentAccess(marker.id, deps));
+            }
+        }
+        else {
+            verdicts.push({
+                state: "unknown",
+                detail: `${marker.adapter} records no readable access state`,
+            });
+        }
+    }
+    const sandboxedVerdict = verdicts.find((verdict) => verdict.state === "sandboxed");
+    if (sandboxedVerdict)
+        return result(sandboxedVerdict);
+    const unknownVerdict = verdicts.find((verdict) => verdict.state === "unknown");
+    if (unknownVerdict)
+        return result(unknownVerdict);
+    const details = verdicts.map((verdict) => verdict.detail);
+    if (confinement.state === "full-access")
+        details.push(confinement.detail);
+    return result({ state: "full-access", detail: details.join("; ") });
+}
+/** The last line of `path` containing `needle`, reading backwards so a large
+ * session log is not loaded whole. Null when absent or past `maxBytes`. */
+export function lastLineContaining(path, needle, maxBytes = 256 * 1024 * 1024) {
+    let fd;
+    try {
+        fd = openSync(path, "r");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const size = statSync(path).size;
+        const chunkSize = 1024 * 1024;
+        const needleBytes = Buffer.from(needle);
+        let position = size;
+        let tail = Buffer.alloc(0);
+        while (position > 0 && size - position < maxBytes) {
+            const length = Math.min(chunkSize, position);
+            position -= length;
+            const chunk = Buffer.alloc(length);
+            readSync(fd, chunk, 0, length, position);
+            tail = Buffer.concat([chunk, tail]);
+            const hit = tail.lastIndexOf(needleBytes);
+            if (hit < 0)
+                continue;
+            const start = tail.lastIndexOf(0x0a, hit);
+            if (start < 0 && position > 0)
+                continue; // the line starts in an unread chunk
+            const end = tail.indexOf(0x0a, hit);
+            return tail.subarray(start + 1, end < 0 ? tail.length : end).toString("utf8");
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Candidate UTC dates (YYYY/MM/DD) for a UUIDv7 thread id: its creation day
+ * and the days either side, since rollout folders use the creator's local date. */
+function rolloutDays(threadId) {
+    const hex = threadId.replace(/-/g, "");
+    if (!/^[0-9a-f]{32}$/i.test(hex) || hex[12] !== "7")
+        return null;
+    const ms = Number.parseInt(hex.slice(0, 12), 16);
+    const days = [];
+    for (const offset of [0, -1, 1]) {
+        const date = new Date(ms + offset * 86_400_000);
+        const y = date.getUTCFullYear();
+        const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+        const d = String(date.getUTCDate()).padStart(2, "0");
+        days.push(`${y}/${m}/${d}`);
+    }
+    return days;
+}
+function codexHomes(deps) {
+    const homes = [];
+    const explicit = nonEmpty(deps.env.CODEX_HOME);
+    if (explicit)
+        homes.push(explicit);
+    homes.push(join(deps.homeDir, ".codex"));
+    // A Windows Codex session driving a WSL checkout keeps its rollouts in the
+    // Windows profile, which the guest sees under /mnt/c/Users.
+    if (deps.platform === "linux" && nonEmpty(deps.env.WSL_DISTRO_NAME)) {
+        for (const root of deps.windowsUserRoots())
+            homes.push(join(root, ".codex"));
+    }
+    return [...new Set(homes)];
+}
+function findCodexRollout(threadId, deps) {
+    const days = rolloutDays(threadId);
+    if (!days)
+        return null;
+    const suffix = `-${threadId}.jsonl`;
+    for (const home of codexHomes(deps)) {
+        for (const day of days) {
+            const dir = join(home, "sessions", day);
+            let names;
+            try {
+                names = readdirSync(dir);
+            }
+            catch {
+                continue;
+            }
+            const name = names.find((entry) => entry.startsWith("rollout-") && entry.endsWith(suffix));
+            if (name)
+                return join(dir, name);
+        }
+    }
+    return null;
+}
+function codexParentAccess(threadId, deps) {
+    const rollout = findCodexRollout(threadId, deps);
+    if (!rollout) {
+        return { state: "unknown", detail: `no Codex rollout was found for thread ${threadId}` };
+    }
+    const line = lastLineContaining(rollout, '"type":"turn_context"');
+    if (!line)
+        return { state: "unknown", detail: "the Codex rollout records no turn context" };
+    let policyType;
+    try {
+        const record = JSON.parse(line);
+        if (record.type !== "turn_context") {
+            return { state: "unknown", detail: "the Codex rollout's latest turn context is unreadable" };
+        }
+        policyType = record.payload?.sandbox_policy?.type;
+    }
+    catch {
+        return { state: "unknown", detail: "the Codex rollout's latest turn context is unreadable" };
+    }
+    if (typeof policyType !== "string") {
+        return { state: "unknown", detail: "the Codex turn context names no sandbox policy" };
+    }
+    if (policyType === "danger-full-access") {
+        return {
+            state: "full-access",
+            detail: "the Codex parent's latest turn ran danger-full-access",
+        };
+    }
+    return { state: "sandboxed", detail: `the Codex parent's latest turn ran ${policyType}` };
+}
+function findClaudeTranscript(sessionId, deps) {
+    if (!/^[A-Za-z0-9._-]+$/.test(sessionId))
+        return null;
+    const configDir = nonEmpty(deps.env.CLAUDE_CONFIG_DIR) ?? join(deps.homeDir, ".claude");
+    const projects = join(configDir, "projects");
+    let dirs;
+    try {
+        dirs = readdirSync(projects);
+    }
+    catch {
+        return null;
+    }
+    for (const dir of dirs) {
+        const candidate = join(projects, dir, `${sessionId}.jsonl`);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+function claudeParentAccess(sessionId, deps) {
+    const transcript = findClaudeTranscript(sessionId, deps);
+    if (!transcript) {
+        return {
+            state: "unknown",
+            detail: `no Claude Code transcript was found for session ${sessionId}`,
+        };
+    }
+    const line = lastLineContaining(transcript, '"permissionMode":"');
+    if (!line)
+        return { state: "unknown", detail: "the Claude Code transcript records no permission mode" };
+    let mode;
+    try {
+        mode = JSON.parse(line).permissionMode;
+    }
+    catch {
+        return {
+            state: "unknown",
+            detail: "the Claude Code transcript's latest permission mode is unreadable",
+        };
+    }
+    if (mode === "bypassPermissions") {
+        return { state: "full-access", detail: "the Claude Code parent runs bypassPermissions" };
+    }
+    return {
+        state: "sandboxed",
+        detail: `the Claude Code parent runs ${typeof mode === "string" ? mode : "an unrecognized"} permission mode`,
+    };
+}

package/dist/core/workflow/workspaces/leases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leases.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/leases.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;IACpC,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,OAAO,IAAI,IAAI,CAAC;CACjB;AAUD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,cAAc,CA+GvF"}
+{"version":3,"file":"leases.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/leases.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;IACpC,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,OAAO,IAAI,IAAI,CAAC;CACjB;AAUD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,cAAc,CA+GvF"}

package/dist/core/workflow/workspaces/leases.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
+import { stateDirMode, stateFileMode } from "../../storage/modes.js";
 const MAX_LEASE_BYTES = 8 * 1024;
 const MAX_CONTENTION_OBSERVATION_ATTEMPTS = 8;
 const SAFE_COMPONENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
@@ -128,11 +129,11 @@ function validateInput(input) {
     }
 }
 function ensureLeaseDirectory(leaseDir, onCreate) {
-    mkdirSync(dirname(leaseDir), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(leaseDir), { recursive: true, mode: stateDirMode() });
     let created = false;
     onCreate?.();
     try {
-        mkdirSync(leaseDir, { mode: 0o700 });
+        mkdirSync(leaseDir, { mode: stateDirMode() });
         created = true;
     }
     catch (error) {
@@ -148,7 +149,7 @@ function ensureLeaseDirectory(leaseDir, onCreate) {
 }
 function createRecoveryClaim(leaseDir, recoveryPath, claimant, observed) {
     const temporary = join(leaseDir, `recovery-claim-${claimant.owner_id}`);
-    mkdirSync(temporary, { mode: 0o700 });
+    mkdirSync(temporary, { mode: stateDirMode() });
     const claim = {
         schema_version: 1,
         claimant,
@@ -280,7 +281,7 @@ function leaseHandle(leaseDir, ownerPath, ownerBytes, owner) {
     };
 }
 function writeExclusive(path, bytes) {
-    const fd = openSync(path, "wx", 0o600);
+    const fd = openSync(path, "wx", stateFileMode());
     try {
         writeFileSync(fd, bytes, "utf8");
         fsyncSync(fd);

package/dist/core/workflow/workspaces/local-git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/local-git.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAgBV,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;CAC1C;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,iBAAiB,CAgBnB;AAED,wBAAsB,KAAK,CACzB,KAAK,EAAE,mBAAmB,EAC1B,wBAAwB,GAAE,MAAM,OAAwC,GACvE,OAAO,CAAC,oBAAoB,CAAC,CA4E/B"}
+{"version":3,"file":"local-git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/local-git.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAgBV,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;CAC1C;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,iBAAiB,CAgBnB;AAED,wBAAsB,KAAK,CACzB,KAAK,EAAE,mBAAmB,EAC1B,wBAAwB,GAAE,MAAM,OAAwC,GACvE,OAAO,CAAC,oBAAoB,CAAC,CA4E/B"}

package/dist/core/workflow/workspaces/local-git.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { stateDirMode, stateFileMode } from "../../storage/modes.js";
 import { WorkspaceAttestationError } from "./attestation-error.js";
 import { git, gitMaybe, gitMaybeWithDirectoryDescriptor, gitOperations, isAncestor, nulEntries, overwriteRiskPaths, parseWorktreeInventory, worktreeInventory, } from "./git.js";
 import { acquireNoClobberLease } from "./leases.js";
@@ -220,7 +221,7 @@ function hideWorkspaceParentFromGit(parent) {
     const ignoreFile = join(parent, ".gitignore");
     if (existsSync(ignoreFile))
         return;
-    writeFileSync(ignoreFile, "*\n", { mode: 0o600 });
+    writeFileSync(ignoreFile, "*\n", { mode: stateFileMode() });
 }
 function reconcileAllocation(coordRoot, claim, root) {
     const events = readWorkspaceEvents(coordRoot, PROVIDER_ID, claim.binding_id);
@@ -1491,7 +1492,7 @@ function capabilityDigestForClaim(claim) {
 }
 function acquireRepositoryLease(coordRoot, claim) {
     const leaseDir = join(resolve(coordRoot), ".harnery", "workspaces", PROVIDER_ID, ".leases");
-    mkdirSync(leaseDir, { recursive: true, mode: 0o700 });
+    mkdirSync(leaseDir, { recursive: true, mode: stateDirMode() });
     // Mutual exclusion keys on the Git common directory alone. `git worktree add`,
     // `prune`, and the shared-`config` migration all write to the common directory's
     // administrative area, and once worktrees and submodules are allowed, several

package/dist/core/workflow/workspaces/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/paths.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAUnE;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAIT;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWlE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAQxD;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAiB5E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAYR;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAOR;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,sBAAsB,CA2DxB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQ3F;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAON;AAwBD,wBAAgB,8BAA8B,IAAI,OAAO,CAOxD;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAKjD"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/paths.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAUnE;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAIT;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWlE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAQxD;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAiB5E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAYR;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAOR;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,sBAAsB,CA2DxB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQ3F;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAON;AAwBD,wBAAgB,8BAA8B,IAAI,OAAO,CAOxD;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAKjD"}

package/dist/core/workflow/workspaces/paths.js

@@ -1,5 +1,6 @@
 import { closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, realpathSync, statSync, } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { stateDirMode } from "../../storage/modes.js";
 const WINDOWS_AMBIGUOUS = /[<>:"|?*]|[ .]$/;
 export function filesystemIdentity(path) {
     const stat = statSync(path, { bigint: true });
@@ -105,7 +106,7 @@ export function openContainedDirectory(root, segments) {
                 }
             }
             else {
-                mkdirSync(candidate, { mode: 0o700 });
+                mkdirSync(candidate, { mode: stateDirMode() });
             }
             const childFd = openSync(candidate, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
             fds.push(childFd);