mulmoclaude 0.5.2 → 0.5.3

package/Dockerfile.sandbox

@@ -0,0 +1,100 @@
+FROM node:22-slim
+
+# Sandbox tool set (see #162). Grouped into layers by purpose so the
+# rationale is obvious from the diff:
+#
+# 1. Core CLI — read local git history, fetch over HTTP, pipeline JSON,
+#    run Makefile-driven workspaces, handle archives, query SQLite.
+#    `ca-certificates` is needed because `node:22-slim` ships without
+#    a trust store. `ripgrep` backs Claude's grep tool.
+# 2. Data analysis + plotting — Python with pandas/numpy/matplotlib
+#    and `requests` for API fetches. Graphviz for structural diagrams.
+#    ImageMagick for raster ops. Covers the "investment / data / chart"
+#    and "visualize this workflow" use cases in the issue.
+# 3. Document + media conversion — pandoc bridges Markdown ↔ PDF/DOCX/
+#    HTML/EPUB for report output. ffmpeg covers audio/video transcode
+#    and probing. poppler-utils extracts text / images from PDFs.
+# 4. Small extras — `tree` for directory listing, `bc` for arbitrary-
+#    precision arithmetic, `less` for pagers.
+#
+# Deferred on purpose:
+#
+# - `@mermaid-js/mermaid-cli` — pulls in headless Chromium (~300MB).
+#   Revisit as a separate layer if diagram generation becomes common.
+# - `texlive-*` — ~150MB+ for marginal PDF quality gains over pandoc's
+#   default LaTeX-free path; add when a user actually needs math/
+#   journal-style typesetting.
+# - `gh` CLI — now installed (Layer 1b). Auth via SANDBOX_MOUNT_CONFIGS=gh
+#   which mounts ~/.config/gh:ro into the container (#259).
+#
+# Runtime `pip install` is intentionally NOT wired up. Everything the
+# agent might need for data work is preinstalled at build time so
+# supply-chain risk stays out of the sandbox.
+
+# Layer 1: core CLI + SSH client (needed for SSH agent forwarding #259)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git \
+      curl \
+      jq \
+      make \
+      ca-certificates \
+      openssh-client \
+      sqlite3 \
+      zip \
+      unzip \
+      ripgrep \
+    && rm -rf /var/lib/apt/lists/*
+
+# Layer 1b: GitHub CLI (#164). Installed from the official apt repo.
+# Auth is provided at runtime via SANDBOX_MOUNT_CONFIGS=gh which
+# bind-mounts ~/.config/gh:ro (#259). On macOS where the token lives
+# in the system keyring, the server falls back to GH_TOKEN env var.
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+      > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Layer 2: data analysis + plotting
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 \
+      python3-pip \
+      graphviz \
+      imagemagick \
+    && rm -rf /var/lib/apt/lists/* \
+ && pip3 install --no-cache-dir --break-system-packages \
+      pandas \
+      numpy \
+      matplotlib \
+      requests
+
+# Layer 3: document + media conversion
+# LibreOffice core + Impress + Writer enable server-side PPTX→PDF and
+# DOCX→PDF conversion for the attachment pipeline (#386). Only the
+# headless renderer is used (`--headless --convert-to pdf`).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      pandoc \
+      ffmpeg \
+      poppler-utils \
+      libreoffice-core \
+      libreoffice-impress \
+      libreoffice-writer \
+    && rm -rf /var/lib/apt/lists/*
+
+# Layer 4: small extras
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      tree \
+      bc \
+      less \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g @anthropic-ai/claude-code tsx
+
+COPY sandbox-entrypoint.sh /sandbox-entrypoint.sh
+RUN chmod +x /sandbox-entrypoint.sh
+
+# No `USER node` — the entrypoint starts as root to fix /etc/passwd
+# and socket permissions, then drops to HOST_UID:HOST_GID via setpriv.
+WORKDIR /home/node/mulmoclaude
+ENTRYPOINT ["/sandbox-entrypoint.sh"]

package/bin/mulmoclaude.js

@@ -104,7 +104,7 @@ Options:
 }
 
 if (args.includes("--version")) {
-  console.log("mulmoclaude 0.5.1");
+  console.log("mulmoclaude 0.5.3");
   process.exit(0);
 }
 

package/bin/prepare-dist.js

@@ -31,7 +31,7 @@
 // ── Publish ───────────────────────────────────────────────────
 //   cd packages/mulmoclaude && npm publish --access public
 
-import { cpSync, existsSync, rmSync } from "fs";
+import { copyFileSync, cpSync, existsSync, rmSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -42,11 +42,16 @@ const rootDir = join(pkgDir, "..", "..");
 // ── Clean ───────────────────────────────────────────────────
 
 // Include `dist` so leftovers from the older pre-built-JS layout are
-// wiped on re-run.
+// wiped on re-run. Stale sandbox files are removed too so a renamed
+// or deleted source file doesn't ride along into the tarball.
 for (const dir of ["dist", "client", "server", "src"]) {
   const target = join(pkgDir, dir);
   if (existsSync(target)) rmSync(target, { recursive: true });
 }
+for (const file of ["Dockerfile.sandbox", "sandbox-entrypoint.sh"]) {
+  const target = join(pkgDir, file);
+  if (existsSync(target)) rmSync(target);
+}
 
 // ── Client dist (Vite build output) ─────────────────────────
 // Copied to `client/` (not `dist/client/`) so the server's
@@ -89,5 +94,16 @@ cpSync(join(rootDir, "src"), join(pkgDir, "src"), {
 });
 console.log("✓ shared src/");
 
+// ── Sandbox build context ───────────────────────────────────
+// `server/system/docker.ts` builds the sandbox image via `docker build
+// -f Dockerfile.sandbox .` with cwd = pkgDir. The Dockerfile in turn
+// `COPY`s `sandbox-entrypoint.sh`, so both files must sit at pkgDir
+// or sandbox mode silently falls back to unrestricted execution.
+
+for (const file of ["Dockerfile.sandbox", "sandbox-entrypoint.sh"]) {
+  copyFileSync(join(rootDir, file), join(pkgDir, file));
+}
+console.log("✓ sandbox build context");
+
 console.log("\nReady to publish. Run:");
 console.log("  cd packages/mulmoclaude && npm publish --access public");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mulmoclaude",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "MulmoClaude — GUI-chat with Claude Code + long-term memory. One command to start.",
   "type": "module",
   "bin": {
@@ -15,7 +15,9 @@
     "bin/",
     "client/",
     "server/",
-    "src/"
+    "src/",
+    "Dockerfile.sandbox",
+    "sandbox-entrypoint.sh"
   ],
   "dependencies": {
     "@google/genai": "^1.50.1",

package/sandbox-entrypoint.sh

@@ -0,0 +1,106 @@
+#!/bin/sh
+# Docker sandbox entrypoint for MulmoClaude.
+#
+# Runs as root to perform setup steps that require elevated privileges,
+# then drops to the host user's UID:GID via setpriv (part of util-linux,
+# already in node:22-slim — no extra install).
+#
+# Why not just `--user ${UID}:${GID}`?
+#   That flag runs the ENTIRE container (including this entrypoint)
+#   as the non-root user, which prevents writing to /etc/passwd and
+#   fixing socket permissions. The entrypoint-then-drop pattern is
+#   the standard Docker solution for "I need root setup but non-root
+#   runtime". See #259 for the full motivation.
+
+set -e
+
+# When HOST_UID is unset, the container was started with `--user`
+# (non-SSH mode). Skip all root setup and exec directly — we're
+# already running as the target user with zero capabilities.
+if [ -z "${HOST_UID:-}" ]; then
+  exec "$@"
+fi
+
+TARGET_UID="$HOST_UID"
+TARGET_GID="${HOST_GID:-1000}"
+
+# 1. Add a /etc/passwd entry for the target UID if it doesn't exist.
+#    SSH refuses to operate when the running user has no passwd entry
+#    ("No user exists for uid NNN"). On macOS the host UID is
+#    typically 501, which isn't in the container's passwd (only root=0
+#    and node=1000 are).
+if ! getent passwd "$TARGET_UID" > /dev/null 2>&1; then
+  echo "sandbox:x:${TARGET_UID}:${TARGET_GID}::/home/node:/bin/sh" >> /etc/passwd
+fi
+
+# 1b. Ensure /home/node is writable by the target user.
+#     The base image (node:22-slim) creates this directory owned by
+#     node:node (1000:1000). When running as a different UID (e.g. 501
+#     on macOS), Claude CLI and git/ssh can't create config files
+#     there (.ssh/, .gitconfig, etc.) without this chown.
+chown -R "$TARGET_UID:$TARGET_GID" /home/node 2>/dev/null || true
+
+# 2. Make the SSH agent socket accessible to the target user.
+#    Docker Desktop for Mac's magic socket (/run/host-services/
+#    ssh-auth.sock) is created as root:root mode 660. The target UID
+#    (e.g. 501) has no group membership to read it. A broad chmod is
+#    acceptable here because we're inside an isolated container with
+#    --cap-drop ALL — there's no other user to protect against.
+if [ -S "${SSH_AUTH_SOCK:-}" ]; then
+  chmod 666 "$SSH_AUTH_SOCK" 2>/dev/null || true
+fi
+
+# 3. Restrict SSH agent usage to whitelisted hosts only.
+#    Without this, the container could use the forwarded agent to
+#    authenticate to ANY SSH server the host has access to (production
+#    servers, private infrastructure, etc.). The SSH config sets
+#    `IdentityAgent none` as the default and only enables the agent
+#    for explicitly allowed hosts.
+#
+#    SANDBOX_SSH_ALLOWED_HOSTS: comma-separated list of hostnames.
+#    Default: github.com (the most common use case for git+ssh).
+#    Example: github.com,gitlab.com,bitbucket.org
+if [ -S "${SSH_AUTH_SOCK:-}" ]; then
+  ALLOWED_HOSTS="${SANDBOX_SSH_ALLOWED_HOSTS:-github.com}"
+  SSH_DIR="/home/node/.ssh"
+  SSH_CONFIG="${SSH_DIR}/config"
+
+  mkdir -p "$SSH_DIR"
+  # SSH uses first-match-wins, so whitelisted hosts MUST come BEFORE
+  # the catch-all `Host *` block. Otherwise `IdentityAgent none`
+  # matches first and the per-host overrides are never reached.
+  cat > "$SSH_CONFIG" <<SSHEOF
+# Auto-generated by sandbox-entrypoint.sh — do not edit.
+# Restrict SSH agent forwarding to whitelisted hosts only.
+# Override via SANDBOX_SSH_ALLOWED_HOSTS env var.
+
+SSHEOF
+
+  # Per-host overrides FIRST (most-specific → least-specific)
+  echo "$ALLOWED_HOSTS" | tr ',' '\n' | while read -r host; do
+    host=$(echo "$host" | tr -d ' ')
+    if [ -n "$host" ]; then
+      printf "Host %s\n  IdentityAgent %s\n  StrictHostKeyChecking accept-new\n\n" "$host" "$SSH_AUTH_SOCK" >> "$SSH_CONFIG"
+    fi
+  done
+
+  # Catch-all LAST: block agent for everything else
+  cat >> "$SSH_CONFIG" <<SSHEOF
+Host *
+  IdentityAgent none
+  StrictHostKeyChecking accept-new
+SSHEOF
+
+  chmod 700 "$SSH_DIR"
+  chmod 600 "$SSH_CONFIG"
+  chown -R "${TARGET_UID}:${TARGET_GID}" "$SSH_DIR"
+fi
+
+# 4. Drop privileges and exec the actual command (typically `claude`).
+#    setpriv is part of util-linux, already present in node:22-slim.
+#    --init-groups initialises supplementary groups from /etc/group.
+#    --inh-caps=-all clears inheritable capabilities so the child
+#    process (claude) runs with zero capabilities even though the
+#    container was started with CHOWN/FOWNER/DAC_OVERRIDE/SETUID/SETGID
+#    for the entrypoint's setup steps.
+exec setpriv --reuid="$TARGET_UID" --regid="$TARGET_GID" --init-groups --inh-caps=-all -- "$@"