mulmoterminal 0.6.2 → 0.7.0

package/Dockerfile.sandbox

@@ -0,0 +1,30 @@
+# MulmoTerminal sandbox image: runs the interactive `claude` CLI inside a container so
+# an untrusted workspace can't touch the host. Deliberately minimal — unlike MulmoClaude
+# this image needs NO in-container MCP broker, because MulmoTerminal's GUI MCP is served
+# over HTTP by the host and reached at host.docker.internal (see docs/spawn-architecture).
+#
+# What's inside: node (for the claude CLI), curl (the activity hooks POST to the host),
+# git + ripgrep + ca-certificates (claude's built-in tools). No secrets, no host FS.
+FROM node:22-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git \
+      curl \
+      ca-certificates \
+      ripgrep \
+    && rm -rf /var/lib/apt/lists/*
+
+# The interactive agent CLI. Pin nothing here — a rebuild picks up the latest, matching
+# how the host runs the newest `claude`.
+RUN npm install -g @anthropic-ai/claude-code
+
+# Run as the unprivileged `node` user (uid 1000). Phase 1 is macOS-only: Docker Desktop
+# maps bind-mount ownership transparently there. The server gates the sandbox off on Linux
+# (no `--user` yet → uid-1000 ownership mismatch) and Windows (host paths aren't valid
+# Linux container paths), falling back to the host spawn — see Phase 5 (#202).
+USER node
+ENV HOME=/home/node
+WORKDIR /home/node/workspace
+
+# The host passes `claude ...` (with a rewritten --mcp-config / --settings) as the
+# command, so no ENTRYPOINT/CMD baked in — the container IS one claude session.

package/README.md

@@ -136,6 +136,47 @@ survive (tmux itself is gone). Command-cell scripts are ephemeral and not persis
 
 ---
 
+## Docker sandbox (experimental, single view)
+
+Set **`MULMOTERMINAL_SANDBOX=1`** (and have Docker running) to run the **single-view**
+Claude session inside a container instead of on the host, while Claude still reaches the
+app's GUI MCP + activity hooks over `host.docker.internal`. The `mulmoterminal-sandbox`
+image is **built automatically** on first launch from the shipped `Dockerfile.sandbox`
+(~1 min, once; rebuilt only when that file changes). Override the name with
+`MULMOTERMINAL_SANDBOX_IMAGE`. If the image can't be built (e.g. Docker down), the session
+falls back to the host spawn — no cryptic failure.
+
+This **contains** Claude — it can't reach the host filesystem outside the mounts, host
+processes, or arbitrary host ports. It is **not full isolation**: the **workspace** and
+**`~/.claude`** are bind-mounted **read-write** by design (so Claude edits your project,
+and transcripts interoperate with host sessions), so those specific paths stay mutable
+from inside. The sandbox is **non-persistent** (the container is
+`--rm`, tied to the session), **opt-in and single-view only** — the grid keeps its host +
+tmux path, and with the flag unset (or Docker unavailable) everything runs on the host
+exactly as before. **macOS only** for now — on Linux (bind-mount uid ownership) and
+Windows (host paths aren't valid Linux container paths) it falls back to the host spawn;
+both are follow-ups. Adding arbitrary user MCP servers to the sandbox is in progress
+(see #202).
+
+**Authentication (macOS).** Claude's live login token lives in the macOS **Keychain**,
+which the container can't read (mounting `~/.claude` alone isn't enough — its
+`.credentials.json` is often absent or stale). On each sandbox spawn MulmoTerminal exports
+the current credential to a per-session `~/.mulmoterminal/sandbox/creds-<id>.json`
+(mode `0600`, removed when the session ends) and mounts it **read-only** over the
+container's `~/.claude/.credentials.json`; your host `~/.claude` is never modified. If
+you've never logged in on the host, run `claude` once first — otherwise the server logs a
+warning and the container shows "Not logged in".
+
+**Host credentials (opt-in).** By default the sandbox has no host credentials. To let the
+sandboxed Claude use `gh`/`git`, set **`SANDBOX_MOUNT_CONFIGS=gh,gitconfig`** — a **fixed
+allowlist** (you pick names, never arbitrary paths): `gh` mounts `~/.config/gh` read-only
+and passes a `GH_TOKEN` (from `gh auth token`, since macOS keeps it in the Keychain), and
+`gitconfig` mounts `~/.gitconfig` read-only. Set **`SANDBOX_SSH_AGENT_FORWARD=1`** to
+forward the SSH agent socket (the keys never enter the container). Both are read only when
+building the sandbox spawn, so they have no effect unless `MULMOTERMINAL_SANDBOX` is on.
+
+---
+
 ## Tech stack
 
 | Layer    | Technology |
@@ -179,6 +220,7 @@ The Settings modal (⚙) persists per-user UI choices to `~/.mulmoterminal/confi
 | `soundFile`  | Absolute path to a custom **attention sound** (played when a session needs attention). Empty/unset uses the built-in synthesized chime. |
 | `prRepos`    | `owner/repo` entries whose open PRs/issues the cross-repo **PRs & Issues** view aggregates (via your `gh` login). |
 | `launchers`  | `{ label, command }` entries offered in a grid cell's launcher besides Claude — a plain shell, `codex`, any interactive command. |
+| `userMcpServers` | `{ id, url }` HTTP MCP servers merged into the **single-view** Claude session's `--mcp-config` (a `localhost` URL is reached over `host.docker.internal` in the Docker sandbox). Takes effect on the next session. |
 
 **Attention sound.** The default chime is generated with the Web Audio API — **no
 audio file is bundled**, so the npm package stays light and has no media-licensing

package/dist/assets/{abnfDiagram-VRR7QNED-6nNByj6v-BR__eiyl.js → abnfDiagram-VRR7QNED-6nNByj6v-IGFnNkfa.js}

@@ -1 +1 @@
-import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-Brzfja-q-ch1VcTiG.js";import{_ as n,g as r}from"./mermaid-parser.core-DC7NPJ_M-ylD2dn6D.js";import"./chunk-WYO6CB5R-B83L_z6I-DmI80qCd.js";import"./chunk-VAUOI2AC-DrcykVNK-Bx9_R8iV.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-CqxshQHA-o-9QjKwX.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};
+import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-Brzfja-q-ch1VcTiG.js";import{_ as n,g as r}from"./mermaid-parser.core-DC7NPJ_M-DpdiJOd9.js";import"./chunk-WYO6CB5R-B83L_z6I-NmPlbhpt.js";import"./chunk-VAUOI2AC-DrcykVNK-Um-9nuwz.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-CqxshQHA-jUnAGLd5.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};

package/dist/assets/architecture-TIHT7OUA-CYMWc3UT-bWcDFBmU.js

@@ -0,0 +1 @@
+import{f as e}from"./mermaid-parser.core-DC7NPJ_M-DpdiJOd9.js";export{e as createArchitectureServices};