opencode-swarm 7.169.0 → 7.170.0

package/dist/sandbox/macos/sandbox-exec-executor.d.ts

@@ -23,12 +23,18 @@ declare function resolveProbeTargetBinary(): string;
  *
  * F6a item 2 (issue #2236): this deliberately shares the same primitives and
  * ordering as buildSandboxProfile's production profile — a blanket
- * `(deny file-write*)` followed by a scoped `(allow file-write* (subpath …))`,
- * plus a `(setenv …)`/`(unsetenv …)` pair (F6b) — so that probe success
- * implies the production profile's primitives actually parse under this
- * host's sandbox-exec. A trivial `(allow default)`-only probe would pass
- * even when the production profile is unparseable, which is the exact
- * probe-passes/production-fails failure mode this guards against.
+ * `(deny file-write*)` followed by a scoped `(allow file-write* (subpath …))` —
+ * so that probe success implies the production profile's primitives actually
+ * parse under this host's sandbox-exec. A trivial `(allow default)`-only probe
+ * would pass even when the production profile is unparseable, which is the
+ * exact probe-passes/production-fails failure mode this guards against.
+ *
+ * NEVER add env directives here or to buildSandboxProfile: `setenv`/`unsetenv`
+ * are not SBPL operations — the profile parser treats them as unbound
+ * variables and rejects the whole profile (exit 65), which silently disabled
+ * this executor on every macOS host (issue #2590). SBPL cannot mutate the
+ * sandboxed process's environment at all; env overrides are applied inside the
+ * wrapped command instead (see buildEnvOverridePrefix / wrapCommand).
  */
 declare function buildProbeProfile(tempDir: string): string;
 /**
@@ -61,15 +67,41 @@ export declare const _internals: {
     resetProbeMemo: typeof resetProbeMemo;
     buildSandboxProfile: typeof buildSandboxProfile;
     buildProbeProfile: typeof buildProbeProfile;
+    buildEnvOverridePrefix: typeof buildEnvOverridePrefix;
     resolveSandboxExecBinary: typeof resolveSandboxExecBinary;
     resolveProbeTargetBinary: typeof resolveProbeTargetBinary;
     exists: typeof existsSync;
     spawnSync: typeof spawnSync;
 };
 /**
- * Build a sandbox-exec profile string for the given scope paths, temp dir, and optional env overrides.
+ * Build the shell prefix that applies env overrides inside the wrapped
+ * command's `bash -c` payload (issue #2590).
+ *
+ * SBPL cannot mutate the sandboxed process's environment, so the hardening
+ * declared by getEnvOverrides() (DYLD_* unsets, PATH pin) and any per-call
+ * overrides are applied by the inner shell itself, before the user command:
+ * null-valued keys are unset via a single `unset` builtin, string-valued keys
+ * are exported with the value single-quote-escaped via shellEscape. Keys
+ * failing isValidEnvKey are silently dropped — the same contract the (broken)
+ * SBPL emitter applied, and required for shell safety too: an invalid key is
+ * neither a safe shell word nor a safe SBPL token.
+ *
+ * Returns '' when there is nothing to apply, so the no-override payload is
+ * byte-identical to the pre-#2590 wrapped command. The trailing '; ' lets the
+ * prefix compose with arbitrary user payloads.
+ */
+declare function buildEnvOverridePrefix(envOverrides?: Record<string, string | null>): string;
+/**
+ * Build a sandbox-exec profile string for the given scope paths and temp dir.
+ *
+ * NOTE: there are deliberately NO environment directives in the profile.
+ * `setenv`/`unsetenv` are not SBPL operations — sandbox-exec rejects them as
+ * unbound variables (exit 65), which silently disabled this executor on every
+ * macOS host (issue #2590). SBPL cannot mutate the sandboxed process's
+ * environment at all; env overrides are applied by the inner shell instead
+ * (see buildEnvOverridePrefix / wrapCommand).
  */
-declare function buildSandboxProfile(scopePaths: string[], tempDir: string, envOverrides?: Record<string, string | null>): string;
+declare function buildSandboxProfile(scopePaths: string[], tempDir: string): string;
 /**
  * macOS sandbox-exec sandbox executor.
  */
@@ -100,6 +132,8 @@ export declare class MacOSSandboxExecutor implements SandboxExecutor {
      * @param scopePaths - Additional scope paths to bind (merged with constructor scope)
      * @param tempDir   - Optional temp directory override
      * @param envOverrides - Optional per-call env overrides: string sets the var, null unsets it.
+     *                      Applied by the inner shell BEFORE the user command runs — SBPL
+     *                      cannot mutate the sandboxed process's environment (issue #2590).
      *                      When omitted, no per-call env override is applied.
      * @returns A sandbox-exec wrapped command string ready for shell execution,
      *          or the raw command string when the sandbox is unavailable (passthrough mode)
@@ -110,9 +144,12 @@ export declare class MacOSSandboxExecutor implements SandboxExecutor {
     /**
      * Return environment variable overrides required for the macOS sandbox.
      *
-     * DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH, DYLD_FRAMEWORK_PATH, and
-     * DYLD_ROOT_PATH can be used to bypass sandbox restrictions by injecting
-     * dynamic libraries. Unsetting them improves sandbox enforcement (defense in depth).
+     * DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH, DYLD_FRAMEWORK_PATH,
+     * DYLD_ROOT_PATH, and DYLD_FORCE_FLAT_NAMESPACE can be used to bypass
+     * sandbox restrictions by injecting or redirecting dynamic-library
+     * loading. Unsetting them improves sandbox enforcement (defense in
+     * depth); DYLD_FORCE_FLAT_NAMESPACE matches the Windows executors'
+     * scrub lists (review PRR-006, PR #2630).
      */
     getEnvOverrides(): Record<string, string | null>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.169.0",
+	"version": "7.170.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",