shennian 0.3.84 → 0.3.86

package/dist/bin/shennian.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import"../src/index.js";
+import '../src/index.js';

package/dist/publish-build-manifest.json

@@ -36,8 +36,8 @@
     },
     {
       "file": "src/agents/codex-managed-room-tools.js",
-      "beforeBytes": 8618,
-      "afterBytes": 4667
+      "beforeBytes": 9529,
+      "afterBytes": 5253
     },
     {
       "file": "src/agents/codex-utils.js",
@@ -46,8 +46,8 @@
     },
     {
       "file": "src/agents/codex.js",
-      "beforeBytes": 57278,
-      "afterBytes": 30048
+      "beforeBytes": 58249,
+      "afterBytes": 30328
     },
     {
       "file": "src/agents/command-spec.js",
@@ -96,8 +96,8 @@
     },
     {
       "file": "src/agents/manager.js",
-      "beforeBytes": 10395,
-      "afterBytes": 5613
+      "beforeBytes": 10725,
+      "afterBytes": 5801
     },
     {
       "file": "src/agents/model-registry/cache.js",
@@ -226,8 +226,8 @@
     },
     {
       "file": "src/commands/room.js",
-      "beforeBytes": 17175,
-      "afterBytes": 9722
+      "beforeBytes": 17685,
+      "afterBytes": 10063
     },
     {
       "file": "src/commands/runtime.js",
@@ -341,8 +341,8 @@
     },
     {
       "file": "src/manager/runtime.js",
-      "beforeBytes": 72214,
-      "afterBytes": 36669
+      "beforeBytes": 72951,
+      "afterBytes": 36995
     },
     {
       "file": "src/native-fusion/codex-files.js",
@@ -461,8 +461,8 @@
     },
     {
       "file": "src/room/activation-service.js",
-      "beforeBytes": 20861,
-      "afterBytes": 10189
+      "beforeBytes": 21587,
+      "afterBytes": 10726
     },
     {
       "file": "src/room/attachment-cache.js",
@@ -496,13 +496,13 @@
     },
     {
       "file": "src/room/managed-context.js",
-      "beforeBytes": 4512,
-      "afterBytes": 2530
+      "beforeBytes": 4521,
+      "afterBytes": 2538
     },
     {
       "file": "src/room/managed-prompt-composer.js",
-      "beforeBytes": 8405,
-      "afterBytes": 7995
+      "beforeBytes": 8751,
+      "afterBytes": 8603
     },
     {
       "file": "src/room/managed-room-binding.js",
@@ -511,8 +511,8 @@
     },
     {
       "file": "src/room/managed-room-ipc.js",
-      "beforeBytes": 11388,
-      "afterBytes": 5518
+      "beforeBytes": 11997,
+      "afterBytes": 5784
     },
     {
       "file": "src/room/mirror-sync-service.js",
@@ -531,13 +531,13 @@
     },
     {
       "file": "src/room/room-action-client.js",
-      "beforeBytes": 27147,
-      "afterBytes": 13584
+      "beforeBytes": 27845,
+      "afterBytes": 13911
     },
     {
       "file": "src/room/room-binding-client.js",
-      "beforeBytes": 7028,
-      "afterBytes": 4032
+      "beforeBytes": 7085,
+      "afterBytes": 4068
     },
     {
       "file": "src/room/session-registry.js",
@@ -556,8 +556,8 @@
     },
     {
       "file": "src/security/managed-agent-policy.js",
-      "beforeBytes": 7298,
-      "afterBytes": 3524
+      "beforeBytes": 6728,
+      "afterBytes": 3141
     },
     {
       "file": "src/security/managed-agent-runtime.js",
@@ -606,8 +606,8 @@
     },
     {
       "file": "src/session/handlers/chat.js",
-      "beforeBytes": 42754,
-      "afterBytes": 17891
+      "beforeBytes": 43645,
+      "afterBytes": 18275
     },
     {
       "file": "src/session/handlers/control.js",
@@ -666,8 +666,8 @@
     },
     {
       "file": "src/session/manager.js",
-      "beforeBytes": 30775,
-      "afterBytes": 15951
+      "beforeBytes": 30970,
+      "afterBytes": 16083
     },
     {
       "file": "src/session/native-cleanup-outbox.js",
@@ -686,8 +686,8 @@
     },
     {
       "file": "src/session/queue.js",
-      "beforeBytes": 26251,
-      "afterBytes": 11986
+      "beforeBytes": 30478,
+      "afterBytes": 13987
     },
     {
       "file": "src/session/store.js",

package/dist/src/agents/adapter.js

@@ -1 +1,19 @@
-import{EventEmitter as r}from"node:events";class s extends r{}const n=new Map;function g(e,t){n.set(e,t)}function i(e){n.delete(e)}function c(e){const t=n.get(e);return t?t():null}function p(){return[...n.keys()]}export{s as AgentAdapter,c as createAgent,p as getRegisteredAgents,g as registerAgent,i as unregisterAgent};
+// @arch docs/architecture/cli/agent-adapters.md
+// @test src/__tests__/agents-e2e.ts
+import { EventEmitter } from 'node:events';
+export class AgentAdapter extends EventEmitter {
+}
+const registry = new Map();
+export function registerAgent(type, factory) {
+    registry.set(type, factory);
+}
+export function unregisterAgent(type) {
+    registry.delete(type);
+}
+export function createAgent(type) {
+    const factory = registry.get(type);
+    return factory ? factory() : null;
+}
+export function getRegisteredAgents() {
+    return [...registry.keys()];
+}

package/dist/src/agents/claude-managed-permissions.js

@@ -1 +1,248 @@
-import g from"node:fs";import n from"node:path";import{resolveProtectedShennianDirectories as N}from"../security/managed-agent-credential-paths.js";const m={commandNetwork:{allow:!0,deny:!0},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},M={minimumRuntimeVersion:"2.1.260",maximumRuntimeVersionExclusive:"2.2.0",platforms:{darwin:{level:"hard",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m},linux:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},wsl:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},win32:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:{commandNetwork:{allow:!0,deny:!1},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},knownGaps:["sandbox.nativeWindowsUnavailable"]}}},P=["//**/.env","//**/.env.*","//**/*.key","//**/*.pem","~/.ssh/**","~/.aws/**","~/.azure/**","~/.config/gcloud/**","~/.netrc","~/.npmrc","~/.shennian/**"],f=["/**/.env","/**/.env.*","/**/*.key","/**/*.pem","~/.ssh","~/.aws","~/.azure","~/.config/gcloud","~/.netrc","~/.npmrc"],x="~/.shennian",W=["Read","Glob","Grep","LSP"],z=["Edit","Write","NotebookEdit"];function G(a,e,l={}){const b=D(e),t=a.effectivePolicy,s=a.platform!=="win32",_=A(l.internalReadPaths),h=A(l.internalUnixSockets),S=d(n.parse(b).root),u=d(b),i=t.fileAccess==="host-full",c=t.fileAccess==="workspace-write",p=N(),o=[];c&&o.push("Edit(/**)"),i&&o.push("Read","Edit"),t.externalCapabilities.webSearch&&o.push("WebSearch","WebFetch"),t.externalCapabilities.mcp&&o.push("mcp__*"),s||o.push("Bash","PowerShell");const E=[...P.flatMap(r=>[`Read(${r})`,`Edit(${r})`]),...p.flatMap(r=>[`Read(${y(r)}/**)`,`Edit(${y(r)}/**)`]),...t.externalCapabilities.webSearch?[]:["WebSearch","WebFetch"],...t.externalCapabilities.mcp?[]:["mcp__*"]],C=s?{disabled:!1,allowRead:[...new Set([u,..._])],allowWrite:i?[S]:c?[u]:[],denyRead:[...f,x,...p],denyWrite:[...f,x,...p,...!i&&!c?[u]:[]]}:void 0,v=s?{allowedDomains:t.externalCapabilities.commandNetwork?["*"]:[],deniedDomains:t.externalCapabilities.commandNetwork?[]:["*"],strictAllowlist:!0,allowLocalBinding:t.externalCapabilities.commandNetwork,allowUnixSockets:a.platform==="darwin"?h:[],allowAllUnixSockets:(a.platform==="linux"||a.platform==="wsl")&&h.length>0}:void 0,k={permissions:{defaultMode:"dontAsk",disableBypassPermissionsMode:"disable",disableAutoMode:"disable",blockReadsOutsideWorkingDirectories:!i,allow:[...new Set(o)].sort(),deny:[...new Set(E)].sort()},disableArtifact:!0,disableRemoteControl:!0,disableWorkflows:!0,disableClaudeAiConnectors:!t.externalCapabilities.mcp,...s?{sandbox:{enabled:!0,failIfUnavailable:!0,autoAllowBashIfSandboxed:!0,allowUnsandboxedCommands:!1,excludedCommands:[],allowAppleEvents:!1,filesystem:C,network:v,credentials:{files:f.map(r=>({path:r,mode:"deny"})),envVars:I(l.shellSubprocessPolicy?.deniedEnvKeys).map(r=>({name:r,mode:"deny"}))}}}:{}},R=["Bash",...W,...c||i?z:[],...t.externalCapabilities.webSearch?["WebSearch","WebFetch"]:[]],w=["--restricted","--setting-sources","","--settings",JSON.stringify(k),"--permission-mode","dontAsk","--tools",[...new Set(R)].join(","),t.externalCapabilities.browser?"--chrome":"--no-chrome"];return i&&w.push("--add-dir",S),t.externalCapabilities.mcp||w.push("--strict-mcp-config","--mcp-config",JSON.stringify({mcpServers:{}})),{settings:k,args:w}}function D(a){const e=n.normalize(a.trim());if(!e||!n.isAbsolute(e))throw new Error("claude_managed_workdir_invalid");let l;try{l=g.realpathSync(e)}catch{throw new Error("claude_managed_workdir_unavailable")}if(n.normalize(l)!==e)throw new Error("claude_managed_workdir_not_realpath");return e}function A(a){return[...new Set(a??[])].map(e=>n.normalize(e.trim())).filter(e=>e&&n.isAbsolute(e)).map(d).sort()}function d(a){return a.replaceAll("\\","/")}function y(a){const e=d(a);return e.startsWith("/")?`/${e}`:`//${e}`}function I(a){return[...new Set(a??[])].filter(e=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)).sort()}export{M as CLAUDE_MANAGED_RUNTIME_SECURITY,G as compileClaudeManagedPermissions};
+// @arch docs/features/managed-agent-restricted-runtime.md
+// @test src/__tests__/claude-managed-permissions.test.ts
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveProtectedShennianDirectories } from '../security/managed-agent-credential-paths.js';
+const fullExternalCapabilitySupport = {
+    commandNetwork: { allow: true, deny: true },
+    webSearch: { allow: true, deny: true },
+    browser: { allow: true, deny: true },
+    // Claude Code's computer-use surface controls the real desktop and does not
+    // currently expose a Shennian-verifiable, non-interactive permission gate.
+    computerUse: { allow: false, deny: true },
+    mcp: { allow: true, deny: true },
+};
+/**
+ * v2.1.260 is the first evidence baseline used by Shennian: it includes
+ * restricted mode, source isolation, fail-closed sandbox startup, credential
+ * scrubbing, outside-workspace read blocking, and the macOS fix for that read
+ * boundary. Unknown and older builds therefore resolve as unverified.
+ */
+export const CLAUDE_MANAGED_RUNTIME_SECURITY = {
+    minimumRuntimeVersion: '2.1.260',
+    maximumRuntimeVersionExclusive: '2.2.0',
+    platforms: {
+        darwin: {
+            level: 'hard',
+            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
+            externalCapabilities: fullExternalCapabilitySupport,
+        },
+        linux: {
+            level: 'partial',
+            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
+            externalCapabilities: fullExternalCapabilitySupport,
+            knownGaps: ['internalTransport.unixSocketGranularity'],
+        },
+        wsl: {
+            level: 'partial',
+            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
+            externalCapabilities: fullExternalCapabilitySupport,
+            knownGaps: ['internalTransport.unixSocketGranularity'],
+        },
+        win32: {
+            level: 'partial',
+            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
+            externalCapabilities: {
+                commandNetwork: { allow: true, deny: false },
+                webSearch: { allow: true, deny: true },
+                browser: { allow: true, deny: true },
+                computerUse: { allow: false, deny: true },
+                mcp: { allow: true, deny: true },
+            },
+            knownGaps: ['sandbox.nativeWindowsUnavailable'],
+        },
+    },
+};
+const SENSITIVE_PERMISSION_PATHS = [
+    '//**/.env',
+    '//**/.env.*',
+    '//**/*.key',
+    '//**/*.pem',
+    '~/.ssh/**',
+    '~/.aws/**',
+    '~/.azure/**',
+    '~/.config/gcloud/**',
+    '~/.netrc',
+    '~/.npmrc',
+    '~/.shennian/**',
+];
+const SENSITIVE_SANDBOX_PATHS = [
+    '/**/.env',
+    '/**/.env.*',
+    '/**/*.key',
+    '/**/*.pem',
+    '~/.ssh',
+    '~/.aws',
+    '~/.azure',
+    '~/.config/gcloud',
+    '~/.netrc',
+    '~/.npmrc',
+];
+const SHENNIAN_HOME_SANDBOX_PATH = '~/.shennian';
+const READ_TOOLS = ['Read', 'Glob', 'Grep', 'LSP'];
+const WRITE_TOOLS = ['Edit', 'Write', 'NotebookEdit'];
+/**
+ * Converts the daemon-verified effective policy into Claude Code's native,
+ * invocation-scoped permission and sandbox configuration. It never writes to
+ * ~/.claude or the project's .claude directory.
+ */
+export function compileClaudeManagedPermissions(enforcement, resolvedWorkDir, options = {}) {
+    const workDir = validateResolvedWorkDir(resolvedWorkDir);
+    const policy = enforcement.effectivePolicy;
+    const hardSandbox = enforcement.platform !== 'win32';
+    const internalReadPaths = normalizeAbsolutePaths(options.internalReadPaths);
+    const internalUnixSockets = normalizeAbsolutePaths(options.internalUnixSockets);
+    const fileRoot = normalizeForClaude(path.parse(workDir).root);
+    const normalizedWorkDir = normalizeForClaude(workDir);
+    const hostFull = policy.fileAccess === 'host-full';
+    const workspaceWritable = policy.fileAccess === 'workspace-write';
+    const shennianDirectories = resolveProtectedShennianDirectories();
+    const allowRules = [];
+    if (workspaceWritable)
+        allowRules.push('Edit(/**)');
+    if (hostFull)
+        allowRules.push('Read', 'Edit');
+    if (policy.externalCapabilities.webSearch)
+        allowRules.push('WebSearch', 'WebFetch');
+    if (policy.externalCapabilities.mcp)
+        allowRules.push('mcp__*');
+    // Native Windows has no Bash sandbox. The compiler has already widened the
+    // effective policy and required limited-protection confirmation before this
+    // unsandboxed command surface can be reached.
+    if (!hardSandbox)
+        allowRules.push('Bash', 'PowerShell');
+    const denyRules = [
+        ...SENSITIVE_PERMISSION_PATHS.flatMap((entry) => [`Read(${entry})`, `Edit(${entry})`]),
+        ...shennianDirectories.flatMap((entry) => [
+            `Read(${toClaudeAbsolutePermissionPattern(entry)}/**)`,
+            `Edit(${toClaudeAbsolutePermissionPattern(entry)}/**)`,
+        ]),
+        ...(!policy.externalCapabilities.webSearch ? ['WebSearch', 'WebFetch'] : []),
+        ...(!policy.externalCapabilities.mcp ? ['mcp__*'] : []),
+    ];
+    const filesystem = hardSandbox
+        ? {
+            disabled: false,
+            // Claude's sandbox allowRead entries take precedence over denyRead.
+            // This keeps the product-owned directory opaque while restoring only
+            // the exact daemon transport files needed by the scoped Room CLI.
+            allowRead: [...new Set([normalizedWorkDir, ...internalReadPaths])],
+            allowWrite: hostFull ? [fileRoot] : workspaceWritable ? [normalizedWorkDir] : [],
+            denyRead: [
+                ...SENSITIVE_SANDBOX_PATHS,
+                SHENNIAN_HOME_SANDBOX_PATH,
+                ...shennianDirectories,
+            ],
+            denyWrite: [
+                ...SENSITIVE_SANDBOX_PATHS,
+                SHENNIAN_HOME_SANDBOX_PATH,
+                ...shennianDirectories,
+                ...(!hostFull && !workspaceWritable ? [normalizedWorkDir] : []),
+            ],
+        }
+        : undefined;
+    const network = hardSandbox
+        ? {
+            allowedDomains: policy.externalCapabilities.commandNetwork ? ['*'] : [],
+            deniedDomains: policy.externalCapabilities.commandNetwork ? [] : ['*'],
+            strictAllowlist: true,
+            allowLocalBinding: policy.externalCapabilities.commandNetwork,
+            allowUnixSockets: enforcement.platform === 'darwin' ? internalUnixSockets : [],
+            // Linux/WSL only expose an all-or-nothing AF_UNIX switch. The
+            // filesystem layer still exposes only the exact daemon path, but the
+            // runtime declaration reports this platform as partial.
+            allowAllUnixSockets: (enforcement.platform === 'linux' || enforcement.platform === 'wsl') &&
+                internalUnixSockets.length > 0,
+        }
+        : undefined;
+    const settings = {
+        permissions: {
+            defaultMode: 'dontAsk',
+            disableBypassPermissionsMode: 'disable',
+            disableAutoMode: 'disable',
+            blockReadsOutsideWorkingDirectories: !hostFull,
+            allow: [...new Set(allowRules)].sort(),
+            deny: [...new Set(denyRules)].sort(),
+        },
+        disableArtifact: true,
+        disableRemoteControl: true,
+        disableWorkflows: true,
+        disableClaudeAiConnectors: !policy.externalCapabilities.mcp,
+        ...(hardSandbox
+            ? {
+                sandbox: {
+                    enabled: true,
+                    failIfUnavailable: true,
+                    autoAllowBashIfSandboxed: true,
+                    allowUnsandboxedCommands: false,
+                    excludedCommands: [],
+                    allowAppleEvents: false,
+                    filesystem,
+                    network,
+                    credentials: {
+                        files: SENSITIVE_SANDBOX_PATHS.map((entry) => ({ path: entry, mode: 'deny' })),
+                        envVars: normalizeEnvKeys(options.shellSubprocessPolicy?.deniedEnvKeys).map((name) => ({ name, mode: 'deny' })),
+                    },
+                },
+            }
+            : {}),
+    };
+    const tools = [
+        'Bash',
+        ...READ_TOOLS,
+        ...(workspaceWritable || hostFull ? WRITE_TOOLS : []),
+        ...(policy.externalCapabilities.webSearch ? ['WebSearch', 'WebFetch'] : []),
+    ];
+    const args = [
+        '--restricted',
+        '--setting-sources',
+        '',
+        '--settings',
+        JSON.stringify(settings),
+        '--permission-mode',
+        'dontAsk',
+        '--tools',
+        [...new Set(tools)].join(','),
+        policy.externalCapabilities.browser ? '--chrome' : '--no-chrome',
+    ];
+    if (hostFull)
+        args.push('--add-dir', fileRoot);
+    if (!policy.externalCapabilities.mcp) {
+        args.push('--strict-mcp-config', '--mcp-config', JSON.stringify({ mcpServers: {} }));
+    }
+    return { settings, args };
+}
+function validateResolvedWorkDir(value) {
+    const normalized = path.normalize(value.trim());
+    if (!normalized || !path.isAbsolute(normalized)) {
+        throw new Error('claude_managed_workdir_invalid');
+    }
+    let realPath;
+    try {
+        realPath = fs.realpathSync(normalized);
+    }
+    catch {
+        throw new Error('claude_managed_workdir_unavailable');
+    }
+    if (path.normalize(realPath) !== normalized) {
+        throw new Error('claude_managed_workdir_not_realpath');
+    }
+    return normalized;
+}
+function normalizeAbsolutePaths(values) {
+    return [...new Set(values ?? [])]
+        .map((entry) => path.normalize(entry.trim()))
+        .filter((entry) => entry && path.isAbsolute(entry))
+        .map(normalizeForClaude)
+        .sort();
+}
+function normalizeForClaude(value) {
+    return value.replaceAll('\\', '/');
+}
+function toClaudeAbsolutePermissionPattern(value) {
+    const normalized = normalizeForClaude(value);
+    return normalized.startsWith('/') ? `/${normalized}` : `//${normalized}`;
+}
+function normalizeEnvKeys(values) {
+    return [...new Set(values ?? [])].filter((value) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(value)).sort();
+}