shennian 0.3.72 → 0.3.74

package/dist/publish-build-manifest.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "jsMinified": true,
   "minifier": "esbuild",
-  "fileCount": 131,
+  "fileCount": 144,
   "files": [
     {
       "file": "bin/shennian.js",
@@ -11,18 +11,33 @@
     },
     {
       "file": "src/agent-env.js",
-      "beforeBytes": 4611,
-      "afterBytes": 2531
+      "beforeBytes": 9273,
+      "afterBytes": 4197
     },
     {
       "file": "src/agents/adapter.js",
       "beforeBytes": 552,
       "afterBytes": 322
     },
+    {
+      "file": "src/agents/claude-managed-permissions.js",
+      "beforeBytes": 10147,
+      "afterBytes": 4390
+    },
     {
       "file": "src/agents/claude.js",
-      "beforeBytes": 12169,
-      "afterBytes": 6313
+      "beforeBytes": 15474,
+      "afterBytes": 8088
+    },
+    {
+      "file": "src/agents/codex-managed-permissions.js",
+      "beforeBytes": 12579,
+      "afterBytes": 4943
+    },
+    {
+      "file": "src/agents/codex-managed-room-tools.js",
+      "beforeBytes": 8618,
+      "afterBytes": 4667
     },
     {
       "file": "src/agents/codex-utils.js",
@@ -31,33 +46,43 @@
     },
     {
       "file": "src/agents/codex.js",
-      "beforeBytes": 46603,
-      "afterBytes": 23409
+      "beforeBytes": 55539,
+      "afterBytes": 29007
     },
     {
       "file": "src/agents/command-spec.js",
-      "beforeBytes": 16528,
-      "afterBytes": 7521
+      "beforeBytes": 17437,
+      "afterBytes": 7807
     },
     {
       "file": "src/agents/config-status.js",
       "beforeBytes": 7583,
       "afterBytes": 3900
     },
+    {
+      "file": "src/agents/cursor-managed-permissions.js",
+      "beforeBytes": 12138,
+      "afterBytes": 5991
+    },
     {
       "file": "src/agents/cursor.js",
-      "beforeBytes": 9236,
-      "afterBytes": 4191
+      "beforeBytes": 12051,
+      "afterBytes": 5791
+    },
+    {
+      "file": "src/agents/custom-managed-runtime.js",
+      "beforeBytes": 9992,
+      "afterBytes": 5280
     },
     {
       "file": "src/agents/custom.js",
-      "beforeBytes": 10938,
-      "afterBytes": 5449
+      "beforeBytes": 16524,
+      "afterBytes": 8695
     },
     {
       "file": "src/agents/detect.js",
-      "beforeBytes": 1506,
-      "afterBytes": 701
+      "beforeBytes": 2358,
+      "afterBytes": 1204
     },
     {
       "file": "src/agents/external-channel-instructions.js",
@@ -96,8 +121,8 @@
     },
     {
       "file": "src/agents/model-registry/service.js",
-      "beforeBytes": 3262,
-      "afterBytes": 1409
+      "beforeBytes": 4344,
+      "afterBytes": 1743
     },
     {
       "file": "src/agents/model-registry/types.js",
@@ -119,10 +144,15 @@
       "beforeBytes": 11104,
       "afterBytes": 4973
     },
+    {
+      "file": "src/agents/opencode-managed-permissions.js",
+      "beforeBytes": 7040,
+      "afterBytes": 3492
+    },
     {
       "file": "src/agents/opencode.js",
-      "beforeBytes": 8314,
-      "afterBytes": 4377
+      "beforeBytes": 11310,
+      "afterBytes": 6249
     },
     {
       "file": "src/agents/platform-instructions.js",
@@ -134,10 +164,15 @@
       "beforeBytes": 1705,
       "afterBytes": 810
     },
+    {
+      "file": "src/agents/workbuddy-managed-permissions.js",
+      "beforeBytes": 13486,
+      "afterBytes": 6431
+    },
     {
       "file": "src/agents/workbuddy.js",
-      "beforeBytes": 14475,
-      "afterBytes": 7299
+      "beforeBytes": 18087,
+      "afterBytes": 9384
     },
     {
       "file": "src/commands/daemon-process.js",
@@ -156,8 +191,8 @@
     },
     {
       "file": "src/commands/daemon.js",
-      "beforeBytes": 39845,
-      "afterBytes": 19471
+      "beforeBytes": 43216,
+      "afterBytes": 20705
     },
     {
       "file": "src/commands/integration.js",
@@ -191,13 +226,13 @@
     },
     {
       "file": "src/commands/room.js",
-      "beforeBytes": 16423,
-      "afterBytes": 9464
+      "beforeBytes": 17175,
+      "afterBytes": 9722
     },
     {
       "file": "src/commands/runtime.js",
-      "beforeBytes": 4986,
-      "afterBytes": 2765
+      "beforeBytes": 5624,
+      "afterBytes": 3146
     },
     {
       "file": "src/commands/tools.js",
@@ -226,8 +261,8 @@
     },
     {
       "file": "src/daemon-ipc/paths.js",
-      "beforeBytes": 1010,
-      "afterBytes": 558
+      "beforeBytes": 1827,
+      "afterBytes": 914
     },
     {
       "file": "src/daemon-ipc/protocol.js",
@@ -276,8 +311,13 @@
     },
     {
       "file": "src/index.js",
-      "beforeBytes": 24056,
-      "afterBytes": 12460
+      "beforeBytes": 25818,
+      "afterBytes": 13311
+    },
+    {
+      "file": "src/log-redaction.js",
+      "beforeBytes": 5228,
+      "afterBytes": 2828
     },
     {
       "file": "src/log-reporter.js",
@@ -406,8 +446,8 @@
     },
     {
       "file": "src/relay/client.js",
-      "beforeBytes": 14515,
-      "afterBytes": 7173
+      "beforeBytes": 15036,
+      "afterBytes": 7402
     },
     {
       "file": "src/room/activation-audit.js",
@@ -421,18 +461,18 @@
     },
     {
       "file": "src/room/activation-service.js",
-      "beforeBytes": 15508,
-      "afterBytes": 7310
+      "beforeBytes": 20861,
+      "afterBytes": 10189
     },
     {
       "file": "src/room/attachment-cache.js",
-      "beforeBytes": 12558,
-      "afterBytes": 6015
+      "beforeBytes": 13659,
+      "afterBytes": 6480
     },
     {
       "file": "src/room/attachment-upload.js",
-      "beforeBytes": 4871,
-      "afterBytes": 2617
+      "beforeBytes": 6996,
+      "afterBytes": 3546
     },
     {
       "file": "src/room/device-authorization-client.js",
@@ -456,23 +496,23 @@
     },
     {
       "file": "src/room/managed-context.js",
-      "beforeBytes": 4442,
-      "afterBytes": 2478
+      "beforeBytes": 4512,
+      "afterBytes": 2530
     },
     {
       "file": "src/room/managed-prompt-composer.js",
-      "beforeBytes": 4610,
-      "afterBytes": 4552
+      "beforeBytes": 8405,
+      "afterBytes": 7995
     },
     {
       "file": "src/room/managed-room-binding.js",
-      "beforeBytes": 6014,
-      "afterBytes": 3277
+      "beforeBytes": 6604,
+      "afterBytes": 3782
     },
     {
       "file": "src/room/managed-room-ipc.js",
-      "beforeBytes": 7797,
-      "afterBytes": 3832
+      "beforeBytes": 11388,
+      "afterBytes": 5518
     },
     {
       "file": "src/room/mirror-sync-service.js",
@@ -491,8 +531,8 @@
     },
     {
       "file": "src/room/room-action-client.js",
-      "beforeBytes": 23728,
-      "afterBytes": 11957
+      "beforeBytes": 27147,
+      "afterBytes": 13584
     },
     {
       "file": "src/room/room-binding-client.js",
@@ -501,8 +541,28 @@
     },
     {
       "file": "src/room/session-registry.js",
-      "beforeBytes": 27201,
-      "afterBytes": 15360
+      "beforeBytes": 27871,
+      "afterBytes": 15713
+    },
+    {
+      "file": "src/security/managed-agent-credential-paths.js",
+      "beforeBytes": 1853,
+      "afterBytes": 748
+    },
+    {
+      "file": "src/security/managed-agent-executable.js",
+      "beforeBytes": 3298,
+      "afterBytes": 1589
+    },
+    {
+      "file": "src/security/managed-agent-policy.js",
+      "beforeBytes": 7298,
+      "afterBytes": 3524
+    },
+    {
+      "file": "src/security/managed-agent-runtime.js",
+      "beforeBytes": 6814,
+      "afterBytes": 3251
     },
     {
       "file": "src/session/archive-zip.js",
@@ -546,8 +606,8 @@
     },
     {
       "file": "src/session/handlers/chat.js",
-      "beforeBytes": 35022,
-      "afterBytes": 14909
+      "beforeBytes": 41468,
+      "afterBytes": 17513
     },
     {
       "file": "src/session/handlers/control.js",
@@ -564,10 +624,15 @@
       "beforeBytes": 676,
       "afterBytes": 392
     },
+    {
+      "file": "src/session/handlers/remote-access.js",
+      "beforeBytes": 1644,
+      "afterBytes": 821
+    },
     {
       "file": "src/session/handlers/room-managed.js",
-      "beforeBytes": 3724,
-      "afterBytes": 2153
+      "beforeBytes": 4009,
+      "afterBytes": 2276
     },
     {
       "file": "src/session/handlers/session-refresh.js",
@@ -591,8 +656,8 @@
     },
     {
       "file": "src/session/history-subscriptions.js",
-      "beforeBytes": 13799,
-      "afterBytes": 6616
+      "beforeBytes": 21124,
+      "afterBytes": 10285
     },
     {
       "file": "src/session/index-publisher.js",
@@ -601,8 +666,8 @@
     },
     {
       "file": "src/session/manager.js",
-      "beforeBytes": 28952,
-      "afterBytes": 14787
+      "beforeBytes": 30450,
+      "afterBytes": 15750
     },
     {
       "file": "src/session/native-cleanup-outbox.js",
@@ -621,8 +686,8 @@
     },
     {
       "file": "src/session/queue.js",
-      "beforeBytes": 19312,
-      "afterBytes": 8831
+      "beforeBytes": 25631,
+      "afterBytes": 11668
     },
     {
       "file": "src/session/store.js",

package/dist/src/agent-env.d.ts

@@ -1,3 +1,24 @@
+import type { AgentType } from '@shennian/wire';
+/**
+ * Session-scoped Shennian capabilities that are intentionally available to a
+ * managed Agent. Any new entry is a security boundary change and must have a
+ * matching authorization test before being added here.
+ */
+export declare const MANAGED_AGENT_SESSION_ENV_KEYS: readonly ["SHENNIAN_MANAGED_ROOM_CONTEXT", "SHENNIAN_MANAGED_ROOM_IPC_ROOT"];
+export declare function getManagedAgentProviderEnvKeys(agentType: AgentType): readonly string[];
+export declare function getManagedAgentBaseEnvKeys(platform?: NodeJS.Platform): readonly string[];
+export type ManagedAgentProcessEnvInput = {
+    agentType: AgentType;
+    /** The daemon snapshot is read only for explicitly allowlisted OS values. */
+    daemonEnv?: NodeJS.ProcessEnv;
+    /** Provider credentials already selected by Shennian's provider config. */
+    providerEnv?: NodeJS.ProcessEnv;
+    /** Short-lived Room or Manager capabilities issued for this exact session. */
+    sessionEnv?: NodeJS.ProcessEnv;
+    /** Harmless process behavior flags such as NO_COLOR. */
+    runtimeEnv?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+};
 export declare function readLatestUserEnv(): NodeJS.ProcessEnv;
 export declare function mergeAgentProcessEnv(input: {
     daemonEnv: NodeJS.ProcessEnv;
@@ -5,3 +26,12 @@ export declare function mergeAgentProcessEnv(input: {
     extra?: NodeJS.ProcessEnv;
 }): NodeJS.ProcessEnv;
 export declare function buildAgentProcessEnv(extra?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Builds the environment for an automatically activated managed Agent.
+ *
+ * Unlike buildAgentProcessEnv(), this function never starts a login shell and
+ * never merges the daemon environment wholesale. Provider and Shennian
+ * capability values must be supplied in their dedicated buckets; unexpected
+ * keys are dropped instead of silently broadening the child's authority.
+ */
+export declare function buildManagedAgentProcessEnv(input: ManagedAgentProcessEnvInput): NodeJS.ProcessEnv;

package/dist/src/agent-env.js

@@ -1,8 +1,8 @@
-import E from"node:os";import u from"node:path";import{spawnSync as d}from"node:child_process";import{buildAugmentedPath as h}from"./env-path.js";import{buildWindowsSystemEnv as m,resolveWindowsPowerShellPath as _}from"./windows-shell.js";const a="__SHENNIAN_AGENT_ENV_START__",p="__SHENNIAN_AGENT_ENV_END__";function l(e){return`'${e.replace(/'/g,"'\\''")}'`}function v(e){const n=e.indexOf(a),i=e.indexOf(p,n+a.length);if(n===-1||i===-1)return null;const r=e.slice(n+a.length,i);try{const t=JSON.parse(r),c={};for(const[s,o]of Object.entries(t))typeof o=="string"&&(c[s]=o);return c}catch{return null}}function g(){const e=process.env.SHELL?.trim()||"/bin/sh",n=[`printf ${l(a)}`,`${l(process.execPath)} -e ${l("process.stdout.write(JSON.stringify(process.env))")}`,`printf ${l(p)}`].join("; ");for(const i of[["-ilc",n],["-lc",n]]){const r=d(e,i,{env:process.env,encoding:"utf-8",stdio:["ignore","pipe","ignore"],timeout:1500,windowsHide:!0}),t=typeof r.stdout=="string"?v(r.stdout):null;if(t)return t}return null}function w(){const e=`
+import S from"node:os";import a from"node:path";import{spawnSync as _}from"node:child_process";import{buildAugmentedPath as g}from"./env-path.js";import{buildWindowsSystemEnv as u,resolveWindowsPowerShellPath as h}from"./windows-shell.js";const l="__SHENNIAN_AGENT_ENV_START__",A="__SHENNIAN_AGENT_ENV_END__",m=["HOME","USER","LOGNAME","LANG","LANGUAGE","LC_ALL","LC_CTYPE","TMPDIR","TMP","TEMP","TZ"],N=["SystemRoot","WINDIR","ComSpec","PATHEXT","USERPROFILE","APPDATA","LOCALAPPDATA","ProgramData","ProgramFiles","ProgramFiles(x86)","TEMP","TMP","TZ"],P=["NO_COLOR"],O=["SHENNIAN_MANAGED_ROOM_CONTEXT","SHENNIAN_MANAGED_ROOM_IPC_ROOT"],T={codex:["OPENAI_BASE_URL","OPENAI_API_KEY"],claude:["ANTHROPIC_BASE_URL","ANTHROPIC_API_KEY"],pi:["DASHSCOPE_BASE_URL","DASHSCOPE_API_KEY"]};function w(e){return T[e]??[]}function V(e=process.platform){return["PATH",...e==="win32"?N:m,...P]}function p(e){return`'${e.replace(/'/g,"'\\''")}'`}function v(e){const n=e.indexOf(l),r=e.indexOf(A,n+l.length);if(n===-1||r===-1)return null;const t=e.slice(n+l.length,r);try{const o=JSON.parse(t),i={};for(const[c,s]of Object.entries(o))typeof s=="string"&&(i[c]=s);return i}catch{return null}}function R(){const e=process.env.SHELL?.trim()||"/bin/sh",n=[`printf ${p(l)}`,`${p(process.execPath)} -e ${p("process.stdout.write(JSON.stringify(process.env))")}`,`printf ${p(A)}`].join("; ");for(const r of[["-ilc",n],["-lc",n]]){const t=_(e,r,{env:process.env,encoding:"utf-8",stdio:["ignore","pipe","ignore"],timeout:1500,windowsHide:!0}),o=typeof t.stdout=="string"?v(t.stdout):null;if(o)return o}return null}function y(){const e=`
 $envs = @{}
 [Environment]::GetEnvironmentVariables('Machine').GetEnumerator() | ForEach-Object { $envs[$_.Key] = [string]$_.Value }
 [Environment]::GetEnvironmentVariables('User').GetEnumerator() | ForEach-Object { $envs[$_.Key] = [string]$_.Value }
-Write-Output '${a}'
+Write-Output '${l}'
 $envs | ConvertTo-Json -Compress
-Write-Output '${p}'
-`,n=d(_(),["-NoProfile","-Command",e],{env:{...process.env,...m(process.env)},encoding:"utf-8",stdio:["ignore","pipe","ignore"],timeout:1500,windowsHide:!0});return typeof n.stdout=="string"?v(n.stdout):null}function N(){return(E.platform()==="win32"?w():g())??{}}function S(e){const n={...e.daemonEnv,...e.userEnv,...e.extra};return process.platform==="win32"&&Object.assign(n,m(n)),n.PATH=P(e.daemonEnv,e.userEnv,e.extra,n),delete n.Path,delete n.path,n}function j(e={}){return S({daemonEnv:process.env,userEnv:N(),extra:e})}function f(e){return e?.PATH??e?.Path??e?.path}function P(e,n,i,r){const t=[];for(const s of[f(e),f(n),f(i)])for(const o of(s??"").split(u.delimiter))o&&!t.includes(o)&&t.push(o);if(process.platform==="win32"){const s=r.SystemRoot||r.WINDIR||process.env.SystemRoot||process.env.WINDIR||"C:\\Windows";for(const o of[u.win32.join(s,"System32"),u.win32.join(s,"System32","WindowsPowerShell","v1.0"),u.win32.join(s)])o&&!t.includes(o)&&t.push(o)}const c=u.dirname(process.execPath);return c&&!t.includes(c)&&t.unshift(c),h({pathValue:t.join(u.delimiter),env:r})}export{j as buildAgentProcessEnv,S as mergeAgentProcessEnv,N as readLatestUserEnv};
+Write-Output '${A}'
+`,n=_(h(),["-NoProfile","-Command",e],{env:{...process.env,...u(process.env)},encoding:"utf-8",stdio:["ignore","pipe","ignore"],timeout:1500,windowsHide:!0});return typeof n.stdout=="string"?v(n.stdout):null}function I(){return(S.platform()==="win32"?y():R())??{}}function G(e){const n={...e.daemonEnv,...e.userEnv,...e.extra};return process.platform==="win32"&&Object.assign(n,u(n)),n.PATH=M(e.daemonEnv,e.userEnv,e.extra,n),delete n.Path,delete n.path,n}function j(e={}){return G({daemonEnv:process.env,userEnv:I(),extra:e})}function W(e){const n=e.daemonEnv??process.env,r=e.platform??process.platform,t={};return f(t,n,r==="win32"?N:m,r),f(t,e.providerEnv,w(e.agentType),r),f(t,e.sessionEnv,O,r),f(t,e.runtimeEnv,P,r),r==="win32"&&Object.assign(t,u({...n,...t})),t.PATH=D(n,t,r),delete t.Path,delete t.path,t}function f(e,n,r,t){if(!n)return;const o=Object.entries(n);for(const i of r){const s=(t==="win32"?o.find(([E])=>E.toUpperCase()===i.toUpperCase()):o.find(([E])=>E===i))?.[1];typeof s=="string"&&s.length>0&&(e[i]=s)}}function D(e,n,r){const t=r==="win32"?a.win32.delimiter:a.posix.delimiter,o=[],i=(c,s=!1)=>{if(c)for(const E of c.split(t))!E||o.includes(E)||(s?o.unshift(E):o.push(E))};if(i(d(e)),i(a.dirname(process.execPath),!0),r==="win32"){const c=u({...e,...n}),s=c.SystemRoot??c.WINDIR??"C:\\Windows";i(a.win32.join(s,"System32")),i(a.win32.join(s,"System32","WindowsPowerShell","v1.0")),i(s)}else i("/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin");return o.join(t)}function d(e){return e?.PATH??e?.Path??e?.path}function M(e,n,r,t){const o=[];for(const c of[d(e),d(n),d(r)])for(const s of(c??"").split(a.delimiter))s&&!o.includes(s)&&o.push(s);if(process.platform==="win32"){const c=t.SystemRoot||t.WINDIR||process.env.SystemRoot||process.env.WINDIR||"C:\\Windows";for(const s of[a.win32.join(c,"System32"),a.win32.join(c,"System32","WindowsPowerShell","v1.0"),a.win32.join(c)])s&&!o.includes(s)&&o.push(s)}const i=a.dirname(process.execPath);return i&&!o.includes(i)&&o.unshift(i),g({pathValue:o.join(a.delimiter),env:t})}export{O as MANAGED_AGENT_SESSION_ENV_KEYS,j as buildAgentProcessEnv,W as buildManagedAgentProcessEnv,V as getManagedAgentBaseEnvKeys,w as getManagedAgentProviderEnvKeys,G as mergeAgentProcessEnv,I as readLatestUserEnv};

package/dist/src/agents/adapter.d.ts

@@ -1,5 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { AgentType, ChatAttachmentMeta, ExternalChannelSessionStatus, SessionRunPhase } from '@shennian/wire';
+import type { CompiledManagedAgentPolicy } from '../security/managed-agent-policy.js';
+import type { ManagedRoomExecutor } from '../room/managed-room-ipc.js';
 export type AgentEvent = {
     state: string;
     runId: string;
@@ -47,6 +49,9 @@ export declare abstract class AgentAdapter extends EventEmitter<AgentAdapterEven
         sessionId?: string;
         externalChannel?: ExternalChannelSessionStatus | null;
         env?: NodeJS.ProcessEnv;
+        managedAgentPolicy?: CompiledManagedAgentPolicy | null;
+        managedRoomContextToken?: string | null;
+        managedRoomExecutor?: ManagedRoomExecutor | null;
     }): void;
     getStatus?(): Promise<{
         active: boolean;

package/dist/src/agents/claude-managed-permissions.d.ts

@@ -0,0 +1,33 @@
+import type { ManagedAgentEnforcement } from '@shennian/wire';
+import type { ManagedAgentRuntimeSecurityDeclaration } from '../security/managed-agent-runtime.js';
+type JsonObject = Record<string, unknown>;
+export type ClaudeManagedPermissionOptions = {
+    /** Exact runtime files required by Shennian's managed Room transport. */
+    internalReadPaths?: readonly string[];
+    /** Exact local sockets required by Shennian's managed Room transport. */
+    internalUnixSockets?: readonly string[];
+    shellSubprocessPolicy?: {
+        inherit: 'none';
+        allowedEnvKeys: readonly string[];
+        deniedEnvKeys: readonly string[];
+    };
+};
+export type ClaudeManagedPermissionConfig = {
+    /** One-invocation-only settings passed inline through --settings. */
+    settings: JsonObject;
+    args: string[];
+};
+/**
+ * v2.1.260 is the first evidence baseline used by Shennian: it includes
+ * restricted mode, source isolation, fail-closed sandbox startup, credential
+ * scrubbing, outside-workspace read blocking, and the macOS fix for that read
+ * boundary. Unknown and older builds therefore resolve as unverified.
+ */
+export declare const CLAUDE_MANAGED_RUNTIME_SECURITY: ManagedAgentRuntimeSecurityDeclaration;
+/**
+ * Converts the daemon-verified effective policy into Claude Code's native,
+ * invocation-scoped permission and sandbox configuration. It never writes to
+ * ~/.claude or the project's .claude directory.
+ */
+export declare function compileClaudeManagedPermissions(enforcement: ManagedAgentEnforcement, resolvedWorkDir: string, options?: ClaudeManagedPermissionOptions): ClaudeManagedPermissionConfig;
+export {};

package/dist/src/agents/claude-managed-permissions.js

@@ -0,0 +1 @@
+import g from"node:fs";import n from"node:path";import{resolveProtectedShennianDirectories as N}from"../security/managed-agent-credential-paths.js";const m={commandNetwork:{allow:!0,deny:!0},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},M={minimumRuntimeVersion:"2.1.260",maximumRuntimeVersionExclusive:"2.2.0",platforms:{darwin:{level:"hard",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m},linux:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},wsl:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},win32:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:{commandNetwork:{allow:!0,deny:!1},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},knownGaps:["sandbox.nativeWindowsUnavailable"]}}},P=["//**/.env","//**/.env.*","//**/*.key","//**/*.pem","~/.ssh/**","~/.aws/**","~/.azure/**","~/.config/gcloud/**","~/.netrc","~/.npmrc","~/.shennian/**"],f=["/**/.env","/**/.env.*","/**/*.key","/**/*.pem","~/.ssh","~/.aws","~/.azure","~/.config/gcloud","~/.netrc","~/.npmrc"],x="~/.shennian",W=["Read","Glob","Grep","LSP"],z=["Edit","Write","NotebookEdit"];function G(a,e,l={}){const b=D(e),t=a.effectivePolicy,s=a.platform!=="win32",_=A(l.internalReadPaths),h=A(l.internalUnixSockets),S=d(n.parse(b).root),u=d(b),i=t.fileAccess==="host-full",c=t.fileAccess==="workspace-write",p=N(),o=[];c&&o.push("Edit(/**)"),i&&o.push("Read","Edit"),t.externalCapabilities.webSearch&&o.push("WebSearch","WebFetch"),t.externalCapabilities.mcp&&o.push("mcp__*"),s||o.push("Bash","PowerShell");const E=[...P.flatMap(r=>[`Read(${r})`,`Edit(${r})`]),...p.flatMap(r=>[`Read(${y(r)}/**)`,`Edit(${y(r)}/**)`]),...t.externalCapabilities.webSearch?[]:["WebSearch","WebFetch"],...t.externalCapabilities.mcp?[]:["mcp__*"]],C=s?{disabled:!1,allowRead:[...new Set([u,..._])],allowWrite:i?[S]:c?[u]:[],denyRead:[...f,x,...p],denyWrite:[...f,x,...p,...!i&&!c?[u]:[]]}:void 0,v=s?{allowedDomains:t.externalCapabilities.commandNetwork?["*"]:[],deniedDomains:t.externalCapabilities.commandNetwork?[]:["*"],strictAllowlist:!0,allowLocalBinding:t.externalCapabilities.commandNetwork,allowUnixSockets:a.platform==="darwin"?h:[],allowAllUnixSockets:(a.platform==="linux"||a.platform==="wsl")&&h.length>0}:void 0,k={permissions:{defaultMode:"dontAsk",disableBypassPermissionsMode:"disable",disableAutoMode:"disable",blockReadsOutsideWorkingDirectories:!i,allow:[...new Set(o)].sort(),deny:[...new Set(E)].sort()},disableArtifact:!0,disableRemoteControl:!0,disableWorkflows:!0,disableClaudeAiConnectors:!t.externalCapabilities.mcp,...s?{sandbox:{enabled:!0,failIfUnavailable:!0,autoAllowBashIfSandboxed:!0,allowUnsandboxedCommands:!1,excludedCommands:[],allowAppleEvents:!1,filesystem:C,network:v,credentials:{files:f.map(r=>({path:r,mode:"deny"})),envVars:I(l.shellSubprocessPolicy?.deniedEnvKeys).map(r=>({name:r,mode:"deny"}))}}}:{}},R=["Bash",...W,...c||i?z:[],...t.externalCapabilities.webSearch?["WebSearch","WebFetch"]:[]],w=["--restricted","--setting-sources","","--settings",JSON.stringify(k),"--permission-mode","dontAsk","--tools",[...new Set(R)].join(","),t.externalCapabilities.browser?"--chrome":"--no-chrome"];return i&&w.push("--add-dir",S),t.externalCapabilities.mcp||w.push("--strict-mcp-config","--mcp-config",JSON.stringify({mcpServers:{}})),{settings:k,args:w}}function D(a){const e=n.normalize(a.trim());if(!e||!n.isAbsolute(e))throw new Error("claude_managed_workdir_invalid");let l;try{l=g.realpathSync(e)}catch{throw new Error("claude_managed_workdir_unavailable")}if(n.normalize(l)!==e)throw new Error("claude_managed_workdir_not_realpath");return e}function A(a){return[...new Set(a??[])].map(e=>n.normalize(e.trim())).filter(e=>e&&n.isAbsolute(e)).map(d).sort()}function d(a){return a.replaceAll("\\","/")}function y(a){const e=d(a);return e.startsWith("/")?`/${e}`:`//${e}`}function I(a){return[...new Set(a??[])].filter(e=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)).sort()}export{M as CLAUDE_MANAGED_RUNTIME_SECURITY,G as compileClaudeManagedPermissions};

package/dist/src/agents/claude.d.ts

@@ -1,5 +1,6 @@
-import { AgentAdapter, type AgentStartOptions } from './adapter.js';
+import { AgentAdapter, type AgentSendContext, type AgentStartOptions } from './adapter.js';
 import type { ChatAttachmentMeta, ExternalChannelSessionStatus } from '@shennian/wire';
+import { type CompiledManagedAgentPolicy } from '../security/managed-agent-policy.js';
 export declare function normalizeClaudeModelId(modelId?: string | null): string;
 export declare function normalizeClaudeReasoningEffort(reasoningEffort?: string | null): string | undefined;
 export declare function resetClaudeCapabilityCacheForTests(): void;
@@ -17,6 +18,7 @@ export declare class ClaudeAdapter extends AgentAdapter {
     private hasEmittedText;
     private terminalState;
     private persistNativeSession;
+    private managedAgentPolicy;
     constructor(options?: {
         systemPrompt?: string;
         hidden?: boolean;
@@ -28,12 +30,15 @@ export declare class ClaudeAdapter extends AgentAdapter {
         sessionId?: string;
         externalChannel?: ExternalChannelSessionStatus | null;
         env?: NodeJS.ProcessEnv;
+        managedAgentPolicy?: CompiledManagedAgentPolicy | null;
     }): void;
     start(sessionId: string, workDir: string, agentSessionId?: string | null, options?: AgentStartOptions): Promise<void>;
-    send(text: string, modelId?: string, reasoningEffort?: string, _attachments?: ChatAttachmentMeta[], agentSystemPrompt?: string | null): Promise<void>;
+    send(text: string, modelId?: string, reasoningEffort?: string, _attachments?: ChatAttachmentMeta[], agentSystemPrompt?: string | null, context?: AgentSendContext): Promise<void>;
     resume(agentSessionId: string): Promise<void>;
     stop(): Promise<void>;
     private spawnAndParse;
+    private buildManagedPermissionConfig;
+    private buildProcessEnv;
     private handleStreamEvent;
     private handleProcessClose;
     private emitFinalIfOpen;
@@ -42,3 +47,7 @@ export declare class ClaudeAdapter extends AgentAdapter {
     private emitEvent;
     private killProcess;
 }
+export declare function resolveClaudeManagedInternalAccess(): {
+    readPaths: string[];
+    unixSockets: string[];
+};

package/dist/src/agents/claude.js

@@ -1,8 +1,8 @@
-import{createInterface as f}from"node:readline";import{randomUUID as d}from"node:crypto";import{AgentAdapter as g,registerAgent as S}from"./adapter.js";import{resolveBuiltinCommand as p,spawnAgentCommand as I,spawnResolvedCommandSync as E}from"./command-spec.js";import{buildAgentProcessEnv as m}from"../agent-env.js";import{buildPlatformInstructions as c}from"./platform-instructions.js";function x(i){return i?.trim()||"default"}const y=new Set(["low","medium","high","xhigh","max"]),o=new Map;function v(i){const e=i?.trim();if(e){if(y.has(e))return e;throw new Error(`Unsupported Claude reasoning effort "${e}". Supported values: low, medium, high, xhigh, max.`)}}function R(){o.clear()}function w(i){const e=i.trim();return e?!e.includes("claude.ai connectors are disabled because"):!1}function C(){const i=p("claude");if(!i)return!1;const e=`${i.kind}:${i.path}:${i.command}:${i.args.join("\0")}`;if(o.has(e))return o.get(e)??!1;try{const t=E(i,["--help"],{encoding:"utf-8",stdio:["ignore","pipe","pipe"],timeout:3e3,env:m()}),s=`${t.stdout??""}
-${t.stderr??""}`,a=/(?:^|\s)--effort(?:\s|,|<)/.test(s);return o.set(e,a),a}catch{return o.set(e,!1),!1}}class k extends g{options;type="claude";process=null;agentSessionId=null;sessionId=null;workDir=null;seq=0;runId="";hasEmittedText=!1;terminalState="open";persistNativeSession=!0;constructor(e={}){super(),this.options=e}externalChannel=null;shennianSessionId=null;extraEnv={};configure(e){this.shennianSessionId=e.sessionId??null,this.externalChannel=e.externalChannel??null,this.extraEnv=e.env??{}}async start(e,t,s,a){this.sessionId=e,this.workDir=t,this.seq=0,this.persistNativeSession=a?.persistNativeSession!==!1,s&&(this.agentSessionId=s)}async send(e,t,s,a,u){await this.killProcess(),this.runId=d(),this.resetRunState();const n=["-p",e,"--output-format","stream-json","--verbose"];this.persistNativeSession||n.push("--no-session-persistence");const r=this.options.systemPrompt??c(this.workDir??process.cwd(),this.externalChannel,this.shennianSessionId??void 0,u);r&&n.push("--append-system-prompt",r),this.options.hidden&&n.push("--name","Shennian Manager Substrate"),process.getuid?.()!==0&&n.push("--dangerously-skip-permissions"),n.push("--model",x(t));const l=v(s);l&&C()&&n.push("--effort",l),this.agentSessionId&&n.push("--resume",this.agentSessionId),this.spawnAndParse(n)}async resume(e){await this.killProcess(),this.agentSessionId=e,this.runId=d(),this.resetRunState();const t=["--resume",e,"--output-format","stream-json","--verbose"],s=this.options.systemPrompt??c(this.workDir??process.cwd(),this.externalChannel,this.shennianSessionId??void 0);s&&t.push("--append-system-prompt",s),this.options.hidden&&t.push("--name","Shennian Manager Substrate"),process.getuid?.()!==0&&t.push("--dangerously-skip-permissions"),this.spawnAndParse(t)}async stop(){await this.killProcess()}spawnAndParse(e){const t=p("claude");if(!t){this.emit("error",new Error('Command "claude" not found. Is Claude Code CLI installed?'));return}const s=I(t,e,{cwd:this.workDir??void 0,stdio:["ignore","pipe","pipe"],env:m(this.extraEnv)});this.process=s,f({input:s.stdout}).on("line",n=>{if(n.trim())try{const r=JSON.parse(n);this.handleStreamEvent(r)}catch{}});let u="";s.stderr?.on("data",n=>{const r=n.toString();if(u+=r,this.terminalState==="open")for(const l of r.split(`
-`)){const h=l.trim();w(h)&&this.emitEvent({state:"delta",text:h+`
-`})}}),s.on("close",n=>{this.process===s&&(this.process=null,this.handleProcessClose(n,u))}),s.on("error",n=>{this.process===s&&(this.process=null,n.code==="ENOENT"?this.emit("error",new Error('Command "claude" not found. Is Claude Code CLI installed?')):this.emit("error",n))})}handleStreamEvent(e){if(e.type==="system"&&e.subtype==="init"&&e.session_id){this.agentSessionId=e.session_id,this.emitEvent({state:"start",agentSessionId:this.agentSessionId});return}if(e.type==="system"&&e.subtype==="api_retry"&&e.error==="authentication_failed"){this.emitErrorIfOpen({state:"error",message:'Claude authentication failed. Run "claude auth login" and retry.'});return}if(e.type==="assistant"){if(e.message?.content){for(const t of e.message.content)if(t.type==="text"&&t.text){const s=this.hasEmittedText?`
+import g from"node:fs";import h from"node:path";import{createInterface as y}from"node:readline";import{randomUUID as c}from"node:crypto";import{AgentAdapter as S,registerAgent as E}from"./adapter.js";import{resolveBuiltinCommand as m,spawnAgentCommand as x,spawnResolvedCommandSync as I}from"./command-spec.js";import{buildAgentProcessEnv as p,buildManagedAgentProcessEnv as v}from"../agent-env.js";import{buildPlatformInstructions as f}from"./platform-instructions.js";import{resolveManagedAgentAdapterEnforcement as P}from"../security/managed-agent-policy.js";import{registerManagedAgentRuntimeSecurity as k}from"../security/managed-agent-runtime.js";import{resolveManagedRoomIpcPaths as w}from"../daemon-ipc/paths.js";import{CLAUDE_MANAGED_RUNTIME_SECURITY as C,compileClaudeManagedPermissions as A}from"./claude-managed-permissions.js";k("claude",C);function _(n){return n?.trim()||"default"}const M=new Set(["low","medium","high","xhigh","max"]),l=new Map;function R(n){const e=n?.trim();if(e){if(M.has(e))return e;throw new Error(`Unsupported Claude reasoning effort "${e}". Supported values: low, medium, high, xhigh, max.`)}}function Q(){l.clear()}function T(n){const e=n.trim();return e?!e.includes("claude.ai connectors are disabled because"):!1}function O(){const n=m("claude");if(!n)return!1;const e=`${n.kind}:${n.path}:${n.command}:${n.args.join("\0")}`;if(l.has(e))return l.get(e)??!1;try{const t=I(n,["--help"],{encoding:"utf-8",stdio:["ignore","pipe","pipe"],timeout:3e3,env:p()}),s=`${t.stdout??""}
+${t.stderr??""}`,a=/(?:^|\s)--effort(?:\s|,|<)/.test(s);return l.set(e,a),a}catch{return l.set(e,!1),!1}}class D extends S{options;type="claude";process=null;agentSessionId=null;sessionId=null;workDir=null;seq=0;runId="";hasEmittedText=!1;terminalState="open";persistNativeSession=!0;managedAgentPolicy=null;constructor(e={}){super(),this.options=e}externalChannel=null;shennianSessionId=null;extraEnv={};configure(e){this.shennianSessionId=e.sessionId??null,this.externalChannel=e.externalChannel??null,this.extraEnv=e.env??{},"managedAgentPolicy"in e&&(this.managedAgentPolicy=e.managedAgentPolicy??null),this.managedAgentPolicy&&(this.workDir=this.managedAgentPolicy.adapterPolicy.workDir)}async start(e,t,s,a){this.sessionId=e,this.workDir=this.managedAgentPolicy?.adapterPolicy.workDir??t,this.seq=0,this.persistNativeSession=a?.persistNativeSession!==!1,s&&(this.agentSessionId=s)}async send(e,t,s,a,u,r){if(r?.source==="room_activation"&&!this.managedAgentPolicy)throw new Error("managed_agent_policy_missing");await this.killProcess(),this.runId=c(),this.resetRunState();const i=["-p",e,"--output-format","stream-json","--verbose",...this.buildManagedPermissionConfig()?.args??[]];this.persistNativeSession||i.push("--no-session-persistence");const d=this.options.systemPrompt??f(this.workDir??process.cwd(),this.externalChannel,this.shennianSessionId??void 0,u);d&&i.push("--append-system-prompt",d),this.options.hidden&&i.push("--name","Shennian Manager Substrate"),!this.managedAgentPolicy&&process.getuid?.()!==0&&i.push("--dangerously-skip-permissions"),i.push("--model",_(t));const o=R(s);o&&O()&&i.push("--effort",o),this.agentSessionId&&i.push("--resume",this.agentSessionId),this.spawnAndParse(i)}async resume(e){await this.killProcess(),this.agentSessionId=e,this.runId=c(),this.resetRunState();const t=["--resume",e,"--output-format","stream-json","--verbose",...this.buildManagedPermissionConfig()?.args??[]],s=this.options.systemPrompt??f(this.workDir??process.cwd(),this.externalChannel,this.shennianSessionId??void 0);s&&t.push("--append-system-prompt",s),this.options.hidden&&t.push("--name","Shennian Manager Substrate"),!this.managedAgentPolicy&&process.getuid?.()!==0&&t.push("--dangerously-skip-permissions"),this.spawnAndParse(t)}async stop(){await this.killProcess()}spawnAndParse(e){const t=m("claude");if(!t){this.emit("error",new Error('Command "claude" not found. Is Claude Code CLI installed?'));return}const s=x(t,e,{cwd:this.workDir??void 0,stdio:["ignore","pipe","pipe"],env:this.buildProcessEnv()});this.process=s,y({input:s.stdout}).on("line",r=>{if(r.trim())try{const i=JSON.parse(r);this.handleStreamEvent(i)}catch{}});let u="";s.stderr?.on("data",r=>{const i=r.toString();if(u+=i,this.terminalState==="open")for(const d of i.split(`
+`)){const o=d.trim();T(o)&&this.emitEvent({state:"delta",text:o+`
+`})}}),s.on("close",r=>{this.process===s&&(this.process=null,this.handleProcessClose(r,u))}),s.on("error",r=>{this.process===s&&(this.process=null,r.code==="ENOENT"?this.emit("error",new Error('Command "claude" not found. Is Claude Code CLI installed?')):this.emit("error",r))})}buildManagedPermissionConfig(){const e=this.managedAgentPolicy;if(!e)return null;const t=N();return A(P(e),e.adapterPolicy.workDir,{internalReadPaths:t.readPaths,internalUnixSockets:t.unixSockets,shellSubprocessPolicy:e.environmentPolicy.shellSubprocess})}buildProcessEnv(){return this.managedAgentPolicy?v({agentType:"claude",providerEnv:this.extraEnv,sessionEnv:this.extraEnv,runtimeEnv:{NO_COLOR:"1"}}):p(this.extraEnv)}handleStreamEvent(e){if(e.type==="system"&&e.subtype==="init"&&e.session_id){this.agentSessionId=e.session_id,this.emitEvent({state:"start",agentSessionId:this.agentSessionId});return}if(e.type==="system"&&e.subtype==="api_retry"&&e.error==="authentication_failed"){this.emitErrorIfOpen({state:"error",message:'Claude authentication failed. Run "claude auth login" and retry.'});return}if(e.type==="assistant"){if(e.message?.content){for(const t of e.message.content)if(t.type==="text"&&t.text){const s=this.hasEmittedText?`
 
 `:"";this.emitEvent({state:"delta",text:s+t.text}),this.hasEmittedText=!0}else t.type==="thinking"&&t.thinking?this.emitEvent({state:"delta",text:t.thinking,thinking:!0}):t.type==="tool_use"&&this.emitEvent({state:"tool-call",name:t.name,args:t.input});return}if(e.subtype==="text"&&e.text){const t=this.hasEmittedText?`
 
-`:"";this.emitEvent({state:"delta",text:t+e.text}),this.hasEmittedText=!0}else e.subtype==="thinking"&&e.thinking?this.emitEvent({state:"delta",text:e.thinking,thinking:!0}):e.subtype==="tool_use"&&this.emitEvent({state:"tool-call",name:e.name,args:e.input});return}if(e.type==="result")if(e.subtype==="tool_result"){const t=typeof e.content=="string"?e.content:JSON.stringify(e.content);this.emitEvent({state:"tool-result",name:e.name,result:t})}else if(e.subtype==="success"){e.session_id&&(this.agentSessionId=e.session_id);const t=e.usage??e.message?.usage;this.emitFinalIfOpen({state:"final",agentSessionId:this.agentSessionId??void 0,usage:t?{inputTokens:t.input_tokens,outputTokens:t.output_tokens}:void 0})}else e.subtype==="error"&&this.emitErrorIfOpen({state:"error",message:e.error??e.result??"unknown error"})}handleProcessClose(e,t){if(e!==0&&e!==null){const s=t.trim()||`claude exited with code ${e}`;this.emitErrorIfOpen({state:"error",message:s});return}this.emitFinalIfOpen({state:"final",agentSessionId:this.agentSessionId??void 0})}emitFinalIfOpen(e){this.terminalState==="open"&&(this.terminalState="final",this.emitEvent(e))}emitErrorIfOpen(e){this.terminalState==="open"&&(this.terminalState="error",this.emitEvent(e))}resetRunState(){this.seq=0,this.hasEmittedText=!1,this.terminalState="open"}emitEvent(e){const t={...e,runId:this.runId,seq:this.seq++};this.emit("agentEvent",t)}async killProcess(){const e=this.process;e&&(this.process=null,e.kill("SIGTERM"),await new Promise(t=>{e.on("close",t),setTimeout(()=>{e.kill("SIGKILL"),t()},3e3)}))}}S("claude",()=>new k);export{k as ClaudeAdapter,x as normalizeClaudeModelId,v as normalizeClaudeReasoningEffort,R as resetClaudeCapabilityCacheForTests,w as shouldForwardClaudeStderrLine,C as supportsClaudeReasoningEffort};
+`:"";this.emitEvent({state:"delta",text:t+e.text}),this.hasEmittedText=!0}else e.subtype==="thinking"&&e.thinking?this.emitEvent({state:"delta",text:e.thinking,thinking:!0}):e.subtype==="tool_use"&&this.emitEvent({state:"tool-call",name:e.name,args:e.input});return}if(e.type==="result")if(e.subtype==="tool_result"){const t=typeof e.content=="string"?e.content:JSON.stringify(e.content);this.emitEvent({state:"tool-result",name:e.name,result:t})}else if(e.subtype==="success"){e.session_id&&(this.agentSessionId=e.session_id);const t=e.usage??e.message?.usage;this.emitFinalIfOpen({state:"final",agentSessionId:this.agentSessionId??void 0,usage:t?{inputTokens:t.input_tokens,outputTokens:t.output_tokens}:void 0})}else e.subtype==="error"&&this.emitErrorIfOpen({state:"error",message:e.error??e.result??"unknown error"})}handleProcessClose(e,t){if(e!==0&&e!==null){const s=t.trim()||`claude exited with code ${e}`;this.emitErrorIfOpen({state:"error",message:s});return}this.emitFinalIfOpen({state:"final",agentSessionId:this.agentSessionId??void 0})}emitFinalIfOpen(e){this.terminalState==="open"&&(this.terminalState="final",this.emitEvent(e))}emitErrorIfOpen(e){this.terminalState==="open"&&(this.terminalState="error",this.emitEvent(e))}resetRunState(){this.seq=0,this.hasEmittedText=!1,this.terminalState="open"}emitEvent(e){const t={...e,runId:this.runId,seq:this.seq++};this.emit("agentEvent",t)}async killProcess(){const e=this.process;e&&(this.process=null,e.kill("SIGTERM"),await new Promise(t=>{e.on("close",t),setTimeout(()=>{e.kill("SIGKILL"),t()},3e3)}))}}function N(){const n=w(),e=[n.secretFile],t=n.transport==="unix_socket"?[n.endpoint]:[];n.transport==="unix_socket"&&e.push(n.endpoint);const s=m("pi");if(s?.path){e.push(s.path);try{const a=g.realpathSync(s.path);e.push(a,h.dirname(a),h.dirname(h.dirname(a)))}catch{}}return{readPaths:[...new Set(e)].sort(),unixSockets:[...new Set(t)].sort()}}E("claude",()=>new D);export{D as ClaudeAdapter,_ as normalizeClaudeModelId,R as normalizeClaudeReasoningEffort,Q as resetClaudeCapabilityCacheForTests,N as resolveClaudeManagedInternalAccess,T as shouldForwardClaudeStderrLine,O as supportsClaudeReasoningEffort};

package/dist/src/agents/codex-managed-permissions.d.ts

@@ -0,0 +1,32 @@
+import type { ManagedAgentEnforcement } from '@shennian/wire';
+import type { ManagedAgentRuntimeSecurityDeclaration } from '../security/managed-agent-runtime.js';
+export declare const CODEX_MANAGED_PERMISSION_PROFILE_ID = "shennian-managed";
+type JsonObject = Record<string, unknown>;
+export type CodexManagedPermissionOptions = {
+    /** Effective MCP server ids read from Codex before the thread starts. */
+    configuredMcpServerNames?: readonly string[];
+    shellSubprocessPolicy?: {
+        inherit: 'none';
+        allowedEnvKeys: readonly string[];
+        deniedEnvKeys: readonly string[];
+    };
+};
+export type CodexManagedPermissionConfig = {
+    profileId: typeof CODEX_MANAGED_PERMISSION_PROFILE_ID;
+    threadConfig: JsonObject;
+};
+/**
+ * Codex 0.138+ permission profiles are available on all supported local
+ * platforms. A profile is still verified at thread start; registration alone
+ * never permits a silent fallback to a legacy sandbox.
+ */
+export declare const CODEX_MANAGED_RUNTIME_SECURITY: ManagedAgentRuntimeSecurityDeclaration;
+/**
+ * Compile one immutable Codex thread configuration from daemon-verified
+ * effective permissions. The config is passed only as an app-server thread
+ * override and never written into the user's global Codex configuration.
+ */
+export declare function compileCodexManagedPermissions(enforcement: ManagedAgentEnforcement, resolvedWorkDir: string, options?: CodexManagedPermissionOptions): CodexManagedPermissionConfig;
+export declare function extractCodexMcpServerNames(configReadResponse: unknown): string[];
+export declare function assertCodexManagedPermissionProfile(response: unknown, expectedProfileId?: string): void;
+export {};

package/dist/src/agents/codex-managed-permissions.js

@@ -0,0 +1 @@
+import a from"node:fs";import h from"node:os";import s from"node:path";import{resolveProtectedShennianDirectories as y}from"../security/managed-agent-credential-paths.js";const i="shennian-managed",E={".env":"deny",".env.*":"deny","**/.env":"deny","**/.env.*":"deny","*.key":"deny","**/*.key":"deny","*.pem":"deny","**/*.pem":"deny",".ssh":"deny","**/.ssh":"deny",".aws":"deny","**/.aws":"deny",".azure":"deny","**/.azure":"deny",".config/gcloud":"deny","**/.config/gcloud":"deny"},l=e=>({commandNetwork:{allow:e,deny:!0},webSearch:{allow:e,deny:!0},browser:{allow:e,deny:!0},computerUse:{allow:e,deny:!0},mcp:{allow:e,deny:!0}}),I={minimumRuntimeVersion:"0.138.0",maximumRuntimeVersionExclusive:"0.153.0",platforms:{darwin:{level:"hard",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:l(!0)},linux:{level:"hard",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:l(!0)},win32:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!1},externalCapabilities:l(!0),knownGaps:["sandbox.nativeWindowsReadIsolationUnavailable"]}}};function M(e,n,r={}){const t=O(n),o=e.effectivePolicy,m=g(x(e.platform)),f=o.fileAccess==="workspace-write"?"write":"read",c=o.fileAccess==="workspace-read"?":read-only":o.fileAccess==="workspace-write"?":workspace":null,_={":root":o.fileAccess==="host-full"?"write":"deny",...o.fileAccess==="host-full"?{}:{":minimal":"read",":tmpdir":"deny",":slash_tmp":"deny",...Object.fromEntries(m.map(w=>[w,"read"]))},...b(),glob_scan_max_depth:8,":workspace_roots":{".":o.fileAccess==="host-full"?"write":f,...E}},d=o.externalCapabilities.commandNetwork,p={enabled:!0,domains:d?{"*":"allow"}:{},unix_sockets:{},allow_local_binding:d,dangerously_allow_all_unix_sockets:!1};return{profileId:i,threadConfig:{default_permissions:i,permissions:{[i]:{description:"Shennian managed Agent permissions",...c?{extends:c}:{},workspace_roots:{[t]:!0},filesystem:_,network:p}},web_search:o.externalCapabilities.webSearch?"live":"disabled",features:v(o.externalCapabilities),allow_login_shell:!1,shell_environment_policy:A(r.shellSubprocessPolicy),...P(o.externalCapabilities.mcp,r.configuredMcpServerNames),...e.platform==="win32"?{windows:{sandbox:"elevated"}}:{}}}}function x(e){return e==="darwin"&&a.existsSync("/System/Library/OpenSSL")?["/System/Library/OpenSSL"]:[]}function b(){const e=s.normalize(h.homedir()),n=[...y(),...e&&s.isAbsolute(e)?[".shennian",".ssh",".aws",".azure",s.join(".config","gcloud"),".netrc",".npmrc"].map(r=>s.join(e,r)):[]].filter(r=>r&&s.isAbsolute(r));return Object.fromEntries([...new Set(n)].map(r=>[r,"deny"]))}function A(e){const n=[...new Set(e?.allowedEnvKeys??["PATH","HOME","USERPROFILE","LANG","LC_ALL","LC_CTYPE","TMPDIR","TMP","TEMP"])].filter(u).filter(t=>!S.has(t)).sort(),r=[...new Set(e?.deniedEnvKeys??["OPENAI_BASE_URL","OPENAI_API_KEY"])].filter(u).sort();return{inherit:"all",experimental_use_profile:!1,ignore_default_excludes:!0,filters:{...Object.fromEntries(n.map(t=>[t,"include"])),...Object.fromEntries(r.map(t=>[t,"exclude"]))}}}const S=new Set(["SHENNIAN_MANAGED_ROOM_CONTEXT","SHENNIAN_MANAGED_ROOM_IPC_ROOT"]);function u(e){return/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)}function D(e){if(!e||typeof e!="object")throw new Error("codex_managed_config_read_invalid");const n=e.config;if(!n||typeof n!="object"||Array.isArray(n))throw new Error("codex_managed_config_read_invalid");const r=n.mcp_servers;if(r===void 0)return[];if(!r||typeof r!="object"||Array.isArray(r))throw new Error("codex_managed_config_read_invalid");return Object.keys(r).sort()}function j(e,n=i){if((e&&typeof e=="object"?e.activePermissionProfile:void 0)?.id!==n)throw new Error("codex_managed_permission_profile_unavailable")}function v(e){return{network_proxy:!0,apps:e.mcp,plugins:e.mcp,hooks:e.mcp,request_permissions_tool:!1,browser_use:e.browser,browser_use_external:e.browser,browser_use_full_cdp_access:!1,computer_use:e.computerUse}}function P(e,n){if(e)return{};const r=[...new Set(n??[])].filter(Boolean).sort();return r.length?{mcp_servers:Object.fromEntries(r.map(t=>[t,{enabled:!1}]))}:{}}function O(e){const n=s.normalize(e.trim());if(!n||!s.isAbsolute(n))throw new Error("codex_managed_workdir_invalid");let r;try{r=a.realpathSync(n)}catch{throw new Error("codex_managed_workdir_unavailable")}if(s.normalize(r)!==n)throw new Error("codex_managed_workdir_not_realpath");return n}function g(e){const n=[...new Set(e??[])].map(r=>s.normalize(r.trim())).filter(r=>r&&s.isAbsolute(r)).flatMap(r=>{try{const t=a.realpathSync(r);return t===r?[r]:[r,t]}catch{try{const t=a.realpathSync(s.dirname(r)),o=s.join(t,s.basename(r));return o===r?[r]:[r,o]}catch{return[r]}}});return[...new Set(n)].sort()}export{i as CODEX_MANAGED_PERMISSION_PROFILE_ID,I as CODEX_MANAGED_RUNTIME_SECURITY,j as assertCodexManagedPermissionProfile,M as compileCodexManagedPermissions,D as extractCodexMcpServerNames};