mstro-app 0.4.17 → 0.4.21

package/server/services/websocket/terminal-handlers.ts

@@ -7,11 +7,11 @@ import { getPTYManager } from '../terminal/pty-manager.js';
 import type { HandlerContext } from './handler-context.js';
 import type { WebSocketMessage, WSContext } from './types.js';
 
-export function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string, permission?: 'control' | 'view'): void {
+export async function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
   const termId = msg.terminalId || tabId;
   switch (msg.type) {
     case 'terminalInit':
-      handleTerminalInit(ctx, ws, termId, workingDir, msg.data?.shell, msg.data?.cols, msg.data?.rows, permission);
+      await handleTerminalInit(ctx, ws, termId, workingDir, msg.data?.shell, msg.data?.cols, msg.data?.rows);
       break;
     case 'terminalReconnect':
       handleTerminalReconnect(ctx, ws, termId);
@@ -31,7 +31,7 @@ export function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: W
   }
 }
 
-function handleTerminalInit(
+async function handleTerminalInit(
   ctx: HandlerContext,
   ws: WSContext,
   terminalId: string,
@@ -39,8 +39,7 @@ function handleTerminalInit(
   requestedShell?: string,
   cols?: number,
   rows?: number,
-  permission?: 'control' | 'view'
-): void {
+): Promise<void> {
   const ptyManager = getPTYManager();
 
   if (!ptyManager.isPtyAvailable()) {
@@ -59,13 +58,12 @@ function handleTerminalInit(
   setupTerminalBroadcastListeners(ctx, terminalId);
 
   try {
-    const { shell, cwd, isReconnect, platform } = ptyManager.create(
+    const { shell, cwd, isReconnect, platform } = await ptyManager.create(
       terminalId,
       workingDir,
       cols || 80,
       rows || 24,
       requestedShell,
-      { sandboxed: permission === 'control' || permission === 'view' }
     );
 
     if (!isReconnect) {
@@ -96,23 +94,11 @@ function handleTerminalInit(
   } catch (error: unknown) {
     const errorMsg = error instanceof Error ? error.message : String(error);
     console.error(`[WebSocketImproviseHandler] Failed to create terminal:`, error);
-
-    if (errorMsg.startsWith('SANDBOX_UNAVAILABLE:')) {
-      ctx.send(ws, {
-        type: 'terminalError',
-        terminalId,
-        data: {
-          error: 'SANDBOX_UNAVAILABLE',
-          message: 'Terminal requires bubblewrap (bwrap) to be installed on the host machine for shared app sessions. Ask the app owner to install it.',
-        }
-      });
-    } else {
-      ctx.send(ws, {
-        type: 'terminalError',
-        terminalId,
-        data: { error: errorMsg || 'Failed to create terminal' }
-      });
-    }
+    ctx.send(ws, {
+      type: 'terminalError',
+      terminalId,
+      data: { error: errorMsg || 'Failed to create terminal' }
+    });
     removeTerminalSubscriber(ctx, terminalId, ws);
   }
 }

package/server/services/websocket/types.ts

@@ -158,8 +158,8 @@ export interface WebSocketMessage {
   terminalId?: string;
   // biome-ignore lint/suspicious/noExplicitAny: message envelope carries heterogeneous payloads
   data?: any;
-  /** Injected by server relay for sandboxed shared users (control + view) */
-  _permission?: 'control' | 'view';
+  /** Injected by server relay for view-only shared users */
+  _permission?: 'view';
 }
 
 export interface WebSocketResponse {

package/server/utils/port.ts

@@ -59,44 +59,3 @@ export async function findAvailablePort(startPort: number, maxTries: number = 20
   }
   throw new Error(`No available ports found between ${startPort} and ${startPort + maxTries}`)
 }
-
-/**
- * Find an available port pair for frontend and backend
- * Frontend = EVEN port (3000, 3002, 3004...)
- * Backend = ODD port (3001, 3003, 3005...)
- *
- * Checks all candidate ports in parallel for fast detection.
- */
-export async function findAvailablePortPair(startPort: number = 3000, maxPairs: number = 20): Promise<{ frontend: number; backend: number }> {
-  // Ensure startPort is even
-  const basePort = startPort % 2 === 0 ? startPort : startPort + 1
-
-  // Generate all candidate pairs
-  const pairs: { frontend: number; backend: number }[] = []
-  for (let i = 0; i < maxPairs; i++) {
-    pairs.push({
-      frontend: basePort + (i * 2),      // 3000, 3002, 3004...
-      backend: basePort + (i * 2) + 1    // 3001, 3003, 3005...
-    })
-  }
-
-  // Check all ports in parallel (both frontend and backend ports)
-  const allPorts = pairs.flatMap(p => [p.frontend, p.backend])
-  const results = await Promise.all(
-    allPorts.map(async (port) => ({ port, available: await isPortAvailable(port) }))
-  )
-
-  // Build a set of available ports for O(1) lookup
-  const availablePorts = new Set(
-    results.filter(r => r.available).map(r => r.port)
-  )
-
-  // Find first pair where both ports are available
-  for (const pair of pairs) {
-    if (availablePorts.has(pair.frontend) && availablePorts.has(pair.backend)) {
-      return pair
-    }
-  }
-
-  throw new Error(`No available port pairs found starting from ${startPort}`)
-}

package/dist/server/mcp/bouncer-sandbox.d.ts

@@ -1,60 +0,0 @@
-export interface SandboxExecResult {
-    /** The sandboxed command that was actually run */
-    wrappedCommand: string;
-    /** Whether sandbox-runtime is available on this platform */
-    sandboxAvailable: boolean;
-    /** Whether the sandbox contained the operation (no violations) */
-    contained: boolean;
-    /** List of violation descriptions if any escaped the sandbox */
-    violations: string[];
-}
-export interface CanaryCheckResult {
-    /** Whether the canary file still exists (should be true if sandbox contained the write) */
-    canaryIntact: boolean;
-    /** Whether a file was written outside the sandbox (should be false) */
-    escapeDetected: boolean;
-}
-/**
- * Test harness that wraps command execution in sandbox-runtime.
- * Provides canary files and violation tracking to verify containment.
- */
-export declare class BouncerSandboxHarness {
-    private sandboxManager;
-    private sandboxAvailable;
-    private tempDir;
-    private canaryDir;
-    constructor();
-    /**
-     * Initialize the sandbox. Falls back gracefully if bwrap/sandbox-exec not available.
-     */
-    initialize(): Promise<{
-        available: boolean;
-        reason?: string;
-    }>;
-    /**
-     * Execute a command inside the sandbox. Returns containment results.
-     * If sandbox is not available, validates the bouncer decision only (no actual execution).
-     */
-    executeInSandbox(command: string): Promise<SandboxExecResult>;
-    /**
-     * Place a canary file and return a checker to verify containment.
-     * If a sandboxed command can delete or modify the canary, containment failed.
-     */
-    placeCanary(name: string): {
-        path: string;
-        check: () => CanaryCheckResult;
-    };
-    /**
-     * Get the temp directory where sandboxed commands can write.
-     */
-    getSandboxWriteDir(): string;
-    /**
-     * Whether the sandbox is actually available and initialized.
-     */
-    isAvailable(): boolean;
-    /**
-     * Clean up temp dirs and reset sandbox state.
-     */
-    cleanup(): Promise<void>;
-}
-//# sourceMappingURL=bouncer-sandbox.d.ts.map

package/dist/server/mcp/bouncer-sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bouncer-sandbox.d.ts","sourceRoot":"","sources":["../../../server/mcp/bouncer-sandbox.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,YAAY,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,cAAc,CAA0F;IAChH,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;;IAQ1B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiDpE;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmDnE;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,iBAAiB,CAAA;KAAE;IAc3E;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAI5B;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAc/B"}

package/dist/server/mcp/bouncer-sandbox.js

@@ -1,182 +0,0 @@
-// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
-/**
- * Sandbox Harness for Bouncer Testing
- *
- * Wraps command execution in Anthropic's sandbox-runtime (bubblewrap on Linux,
- * sandbox-exec on macOS) to safely test what happens when the bouncer FAILS —
- * i.e., when a malicious tool call gets through.
- *
- * Usage in tests:
- *   const harness = new BouncerSandboxHarness();
- *   await harness.initialize();
- *   const result = await harness.executeInSandbox('rm -rf /tmp/test-canary');
- *   expect(result.violations).toContain(...)
- *   await harness.cleanup();
- */
-import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-/**
- * Test harness that wraps command execution in sandbox-runtime.
- * Provides canary files and violation tracking to verify containment.
- */
-export class BouncerSandboxHarness {
-    sandboxManager = null;
-    sandboxAvailable = false;
-    tempDir;
-    canaryDir;
-    constructor() {
-        this.tempDir = mkdtempSync(join(tmpdir(), 'bouncer-sandbox-'));
-        this.canaryDir = join(this.tempDir, 'canaries');
-        mkdirSync(this.canaryDir, { recursive: true });
-    }
-    /**
-     * Initialize the sandbox. Falls back gracefully if bwrap/sandbox-exec not available.
-     */
-    async initialize() {
-        try {
-            const { SandboxManager } = await import('@anthropic-ai/sandbox-runtime');
-            if (!SandboxManager.isSupportedPlatform()) {
-                return { available: false, reason: 'Platform not supported by sandbox-runtime' };
-            }
-            const deps = SandboxManager.checkDependencies();
-            if (deps.errors.length > 0) {
-                return {
-                    available: false,
-                    reason: `Missing dependencies: ${deps.errors.join(', ')}`,
-                };
-            }
-            await SandboxManager.initialize({
-                network: {
-                    allowedDomains: [], // Block ALL network access
-                    deniedDomains: ['*'],
-                },
-                filesystem: {
-                    denyRead: [
-                        '/home/*/.ssh',
-                        '/home/*/.aws',
-                        '/home/*/.gnupg',
-                        '/etc/shadow',
-                        '/etc/passwd',
-                    ],
-                    allowWrite: [this.tempDir], // Only allow writes to our temp dir
-                    denyWrite: [
-                        '/',
-                        '/home',
-                        '/etc',
-                        '/usr',
-                        '/var',
-                    ],
-                },
-            });
-            this.sandboxManager = SandboxManager;
-            this.sandboxAvailable = true;
-            return { available: true };
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            return { available: false, reason: `Failed to initialize sandbox: ${msg}` };
-        }
-    }
-    /**
-     * Execute a command inside the sandbox. Returns containment results.
-     * If sandbox is not available, validates the bouncer decision only (no actual execution).
-     */
-    async executeInSandbox(command) {
-        if (!this.sandboxAvailable || !this.sandboxManager) {
-            return {
-                wrappedCommand: command,
-                sandboxAvailable: false,
-                contained: true,
-                violations: ['Sandbox not available — decision-only testing mode'],
-            };
-        }
-        const violations = [];
-        try {
-            const wrappedCommand = await this.sandboxManager.wrapWithSandbox(command);
-            // Execute the wrapped command and capture violations
-            try {
-                execSync(wrappedCommand, {
-                    timeout: 5000,
-                    stdio: 'pipe',
-                    cwd: this.tempDir,
-                });
-            }
-            catch {
-                // Command failure inside sandbox is expected for malicious ops
-            }
-            // Check violation store
-            const stderr = this.sandboxManager.annotateStderrWithSandboxFailures(command, '');
-            if (stderr) {
-                violations.push(stderr);
-            }
-            this.sandboxManager.cleanupAfterCommand();
-            return {
-                wrappedCommand,
-                sandboxAvailable: true,
-                contained: violations.length === 0,
-                violations,
-            };
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            violations.push(`Sandbox execution error: ${msg}`);
-            return {
-                wrappedCommand: command,
-                sandboxAvailable: true,
-                contained: true, // Error means the command didn't execute
-                violations,
-            };
-        }
-    }
-    /**
-     * Place a canary file and return a checker to verify containment.
-     * If a sandboxed command can delete or modify the canary, containment failed.
-     */
-    placeCanary(name) {
-        const canaryPath = join(this.canaryDir, name);
-        const escapePath = join(this.canaryDir, `${name}.escaped`);
-        writeFileSync(canaryPath, `canary-${Date.now()}`, 'utf-8');
-        return {
-            path: canaryPath,
-            check: () => ({
-                canaryIntact: existsSync(canaryPath),
-                escapeDetected: existsSync(escapePath),
-            }),
-        };
-    }
-    /**
-     * Get the temp directory where sandboxed commands can write.
-     */
-    getSandboxWriteDir() {
-        return this.tempDir;
-    }
-    /**
-     * Whether the sandbox is actually available and initialized.
-     */
-    isAvailable() {
-        return this.sandboxAvailable;
-    }
-    /**
-     * Clean up temp dirs and reset sandbox state.
-     */
-    async cleanup() {
-        try {
-            if (this.sandboxManager) {
-                await this.sandboxManager.reset();
-            }
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-        try {
-            rmSync(this.tempDir, { recursive: true, force: true });
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-    }
-}
-//# sourceMappingURL=bouncer-sandbox.js.map

package/dist/server/mcp/bouncer-sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bouncer-sandbox.js","sourceRoot":"","sources":["../../../server/mcp/bouncer-sandbox.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoBjC;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACxB,cAAc,GAAqF,IAAI,CAAC;IACxG,gBAAgB,GAAG,KAAK,CAAC;IACzB,OAAO,CAAS;IAChB,SAAS,CAAS;IAE1B;QACE,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAEzE,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC1D,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,CAAC,UAAU,CAAC;gBAC9B,OAAO,EAAE;oBACP,cAAc,EAAE,EAAE,EAAE,2BAA2B;oBAC/C,aAAa,EAAE,CAAC,GAAG,CAAC;iBACrB;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,cAAc;wBACd,cAAc;wBACd,gBAAgB;wBAChB,aAAa;wBACb,aAAa;qBACd;oBACD,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,oCAAoC;oBAChE,SAAS,EAAE;wBACT,GAAG;wBACH,OAAO;wBACP,MAAM;wBACN,MAAM;wBACN,MAAM;qBACP;iBACF;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,GAAG,EAAE,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO;gBACL,cAAc,EAAE,OAAO;gBACvB,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,CAAC,oDAAoD,CAAC;aACnE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAE1E,qDAAqD;YACrD,IAAI,CAAC;gBACH,QAAQ,CAAC,cAAc,EAAE;oBACvB,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,MAAM;oBACb,GAAG,EAAE,IAAI,CAAC,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YAED,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC;YAE1C,OAAO;gBACL,cAAc;gBACd,gBAAgB,EAAE,IAAI;gBACtB,SAAS,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;gBAClC,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,cAAc,EAAE,OAAO;gBACvB,gBAAgB,EAAE,IAAI;gBACtB,SAAS,EAAE,IAAI,EAAE,yCAAyC;gBAC1D,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;QAC3D,aAAa,CAAC,UAAU,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAE3D,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACZ,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC;gBACpC,cAAc,EAAE,UAAU,CAAC,UAAU,CAAC;aACvC,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/server/services/credentials.d.ts

@@ -1,39 +0,0 @@
-export interface Credentials {
-    token: string;
-    userId: string;
-    email: string;
-    name?: string;
-    deviceId?: string;
-    clientId: string;
-    createdAt: string;
-    lastRefreshedAt?: string;
-}
-/**
- * Get stored credentials, or null if not logged in
- */
-export declare function getCredentials(): Credentials | null;
-/**
- * Save credentials after successful login
- */
-export declare function saveCredentials(credentials: Credentials): void;
-/**
- * Update the token (used during refresh)
- */
-export declare function updateToken(newToken: string): void;
-/**
- * Delete credentials (logout)
- */
-export declare function deleteCredentials(): boolean;
-/**
- * Check if user is logged in
- */
-export declare function isLoggedIn(): boolean;
-/**
- * Get the credentials file path (for display)
- */
-export declare function getCredentialsPath(): string;
-/**
- * Get the mstro directory path
- */
-export declare function getMstroDir(): string;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/server/services/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../server/services/credentials.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAWD;;GAEG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAoBnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAK9D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CASlD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAY3C;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/server/services/credentials.js

@@ -1,110 +0,0 @@
-// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
-/**
- * Credentials Service
- *
- * Manages persistent authentication credentials stored in ~/.mstro/credentials.json
- *
- * Structure:
- * {
- *   "token": "device-token-here",
- *   "userId": "user-uuid",
- *   "email": "user@example.com",
- *   "name": "User Name",
- *   "deviceId": "device-uuid",
- *   "clientId": "client-uuid",
- *   "createdAt": "2024-01-01T00:00:00.000Z",
- *   "lastRefreshedAt": "2024-01-01T00:00:00.000Z"
- * }
- */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-const MSTRO_DIR = join(homedir(), '.mstro');
-const CREDENTIALS_FILE = join(MSTRO_DIR, 'credentials.json');
-/**
- * Ensure the ~/.mstro directory exists
- */
-function ensureMstroDir() {
-    if (!existsSync(MSTRO_DIR)) {
-        mkdirSync(MSTRO_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Get stored credentials, or null if not logged in
- */
-export function getCredentials() {
-    if (!existsSync(CREDENTIALS_FILE)) {
-        return null;
-    }
-    try {
-        const content = readFileSync(CREDENTIALS_FILE, 'utf-8');
-        const credentials = JSON.parse(content);
-        // Validate required fields
-        if (!credentials.token || !credentials.userId || !credentials.email || !credentials.clientId) {
-            console.warn('Invalid credentials file, missing required fields');
-            return null;
-        }
-        return credentials;
-    }
-    catch (err) {
-        console.warn('Failed to read credentials file:', err);
-        return null;
-    }
-}
-/**
- * Save credentials after successful login
- */
-export function saveCredentials(credentials) {
-    ensureMstroDir();
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2), {
-        mode: 0o600 // Read/write for owner only
-    });
-}
-/**
- * Update the token (used during refresh)
- */
-export function updateToken(newToken) {
-    const credentials = getCredentials();
-    if (!credentials) {
-        throw new Error('No credentials to update');
-    }
-    credentials.token = newToken;
-    credentials.lastRefreshedAt = new Date().toISOString();
-    saveCredentials(credentials);
-}
-/**
- * Delete credentials (logout)
- */
-export function deleteCredentials() {
-    if (!existsSync(CREDENTIALS_FILE)) {
-        return false;
-    }
-    try {
-        unlinkSync(CREDENTIALS_FILE);
-        return true;
-    }
-    catch (err) {
-        console.error('Failed to delete credentials:', err);
-        return false;
-    }
-}
-/**
- * Check if user is logged in
- */
-export function isLoggedIn() {
-    return getCredentials() !== null;
-}
-/**
- * Get the credentials file path (for display)
- */
-export function getCredentialsPath() {
-    return CREDENTIALS_FILE;
-}
-/**
- * Get the mstro directory path
- */
-export function getMstroDir() {
-    return MSTRO_DIR;
-}
-//# sourceMappingURL=credentials.js.map

package/dist/server/services/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../server/services/credentials.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAa5D;;GAEG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAA;QAEtD,2BAA2B;QAC3B,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAA;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,cAAc,EAAE,CAAA;IAChB,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,KAAK,CAAC,4BAA4B;KACzC,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC;IAED,WAAW,CAAC,KAAK,GAAG,QAAQ,CAAA;IAC5B,WAAW,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtD,eAAe,CAAC,WAAW,CAAC,CAAA;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,UAAU,CAAC,gBAAgB,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,cAAc,EAAE,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/server/services/sandbox-utils.d.ts

@@ -1,8 +0,0 @@
-/**
- * Create a sanitized environment for sandboxed execution.
- * Strips sensitive env vars and sets HOME to the project directory.
- */
-export declare function sanitizeEnvForSandbox(env: NodeJS.ProcessEnv, workingDir: string, options?: {
-    overrideHome?: boolean;
-}): Record<string, string>;
-//# sourceMappingURL=sandbox-utils.d.ts.map

package/dist/server/services/sandbox-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-utils.d.ts","sourceRoot":"","sources":["../../../server/services/sandbox-utils.ts"],"names":[],"mappings":"AAsDA;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBxB"}

package/dist/server/services/sandbox-utils.js

@@ -1,75 +0,0 @@
-// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
-/**
- * Sandbox Utilities
- *
- * Environment sanitization for sandboxed shared sessions.
- * Used by both PTY manager (terminal) and Claude invoker (prompts)
- * to restrict shared users to the project directory.
- */
-/** Env var prefixes that may contain secrets or grant access outside the project */
-const BLOCKED_PREFIXES = [
-    'AWS_',
-    'GITHUB_',
-    'GH_',
-    'NPM_',
-    'DOCKER_',
-    'SSH_',
-    'GPG_',
-    'AZURE_',
-    'GCP_',
-    'GOOGLE_',
-    'OPENAI_',
-    'ANTHROPIC_',
-    'STRIPE_',
-    'TWILIO_',
-    'SENDGRID_',
-    'DATADOG_',
-    'SENTRY_',
-    'SLACK_',
-    'DISCORD_',
-];
-/** Specific env vars that may contain secrets or sensitive paths */
-const BLOCKED_KEYS = new Set([
-    'HISTFILE',
-    'LESSHISTFILE',
-    'MYSQL_PWD',
-    'PGPASSWORD',
-    'PGPASSFILE',
-    'REDIS_URL',
-    'DATABASE_URL',
-    'MONGO_URI',
-    'MONGODB_URI',
-    'SECRET_KEY',
-    'API_KEY',
-    'API_SECRET',
-    'ACCESS_TOKEN',
-    'REFRESH_TOKEN',
-    'PRIVATE_KEY',
-    'JWT_SECRET',
-]);
-/**
- * Create a sanitized environment for sandboxed execution.
- * Strips sensitive env vars and sets HOME to the project directory.
- */
-export function sanitizeEnvForSandbox(env, workingDir, options) {
-    const result = {};
-    for (const [key, value] of Object.entries(env)) {
-        if (!value)
-            continue;
-        if (BLOCKED_KEYS.has(key))
-            continue;
-        if (BLOCKED_PREFIXES.some(p => key.startsWith(p)))
-            continue;
-        result[key] = value;
-    }
-    // Override HOME to project directory so `cd ~` stays sandboxed (e.g. terminals).
-    // Claude Code processes opt out (overrideHome: false) to preserve OAuth auth lookup.
-    if (options?.overrideHome !== false) {
-        result.HOME = workingDir;
-    }
-    // Marker so scripts can detect sandboxed execution
-    result.MSTRO_SANDBOXED = '1';
-    return result;
-}
-//# sourceMappingURL=sandbox-utils.js.map

package/dist/server/services/sandbox-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-utils.js","sourceRoot":"","sources":["../../../server/services/sandbox-utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;GAMG;AAEH,oFAAoF;AACpF,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,SAAS;IACT,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,oEAAoE;AACpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU;IACV,cAAc;IACd,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,cAAc;IACd,WAAW;IACX,aAAa;IACb,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,cAAc;IACd,eAAe;IACf,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAsB,EACtB,UAAkB,EAClB,OAAoC;IAEpC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,iFAAiF;IACjF,qFAAqF;IACrF,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC;IAC3B,CAAC;IACD,mDAAmD;IACnD,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC;IAE7B,OAAO,MAAM,CAAC;AAChB,CAAC"}