sliccy 6.87.3 → 6.88.0

package/README.md

@@ -78,7 +78,7 @@ SLICC is for you if:
 - **Boot full x86 virtual machines in the browser.** `v86 start` runs real operating systems (Alpine, FreeDOS, KolibriOS, ...) on the wasm-based [v86](https://github.com/copy/v86) emulator, entirely client-side. The agent drives the guest from the shell — type, click, screenshot, stream the screen live, save/restore state — and `-net <model>,relay=fetch` gives the guest HTTP access through SLICC's fetch proxy. Install with `ipk add v86`.
 - **Delegate parallel work to scoops.** Split tasks into isolated sub-agents with their own sandboxes and context, then let the main agent coordinate the results.
 - **Turn one-off wins into reusable workflows.** Package behavior as skills, build interactive sprinkles, and react to external events with webhooks and cron-driven licks.
-- **Mount your local file system.** By default, SLICC is confined to your browser. But you can ask it to mount folders from your local file system, so it can read and write from there. Mount into an empty path such as `/mnt/myproject` so you do not hide existing skills or scripts.
+- **Mount your local file system.** By default, SLICC is confined to your browser. But you can ask it to mount folders from your local file system, so it can read and write from there. Mount into an empty path such as `/mnt/myproject` so you do not hide existing skills or scripts. Picker mounts ask again after a page reload; for folders you always want available, map them in the launcher's mount table (`npx slicc --mount=~/Projects/foo:/mnt/foo`, or Settings → Mounts in Sliccstart.app) and they are mounted automatically on every launch, with no picker or permission prompt — see [Auto-mounted host folders](docs/mounts.md#auto-mounted-host-folders-the-mount-table).
 - **Mount remote storage as if it were local.** Beyond local folders, `mount --source` bridges S3 buckets, S3-compatible services like Cloudflare R2 and MinIO, and Adobe authoring content — both da.live repositories and Helix 6 sites on the AEM Source Bus — into the same VFS surface. Reads use TTL+ETag caching with conditional revalidation; writes use ETag-conditional PUTs that surface concurrent-edit conflicts as `EBUSY`. Credentials live server-side (`~/.slicc/secrets.env` in CLI, `chrome.storage.local` in the extension via the **Extension options** page) and never reach the agent. After setup: `mount --source s3://my-bucket --profile r2 /mnt/r2`, `mount --source da://my-org/my-repo /mnt/da`, or `mount --source aem://my-org/my-site /mnt/aem`. A `da://` source checks the site config first and re-routes to the Source Bus when the site has been upgraded to Helix 6, rather than quietly mounting a store that no longer holds its content. See [docs/mounts.md](docs/mounts.md) for the full guide.
 
 ## Getting started

package/dist/node-server/hostfs.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Host filesystem bridge — serves the folders named in the mount table
+ * (`--mount=<os-path>:<slicc-path>`) to the webapp over the local /api
+ * surface, so configured mounts appear in the VFS fully automatically,
+ * with no File System Access picker and no Chrome permission prompt.
+ *
+ * Only paths under a configured mount root are reachable. Every request
+ * names a mount by its SLICC target (`?mount=/mnt/project`) plus a
+ * mount-relative path (`?path=sub/file.txt`); the mapping to the OS root
+ * happens here and `resolveWithinRoot` rejects traversal (`..`) and
+ * symlink escapes, so the browser never addresses the host filesystem
+ * directly.
+ *
+ * Protected like every other /api route: same-origin / loopback callers
+ * pass, cross-origin callers need the bridge token (see
+ * `createThinBridgeCorsMiddleware` in index.ts).
+ */
+import type { Express } from 'express';
+import type { HostMountMapping } from './runtime-flags.js';
+/** Matches the webapp's hostfs body cap (backend-hostfs.ts). */
+export declare const HOSTFS_MAX_BODY_BYTES: number;
+/**
+ * Resolve `relPath` against `root`, rejecting anything that leaves the root
+ * either lexically (`..`) or via symlinks. Symlinks *inside* the root that
+ * also point inside the root are followed; a link pointing outside is
+ * rejected. The check walks to the nearest existing ancestor so that writes
+ * to not-yet-existing paths are still validated.
+ */
+export declare function resolveWithinRoot(root: string, relPath: string): Promise<string>;
+interface HostMountRoot {
+    /** SLICC target path, e.g. /mnt/project. */
+    path: string;
+    /** realpath()'d OS root. */
+    root: string;
+}
+/**
+ * Resolve the configured mappings to realpath'd roots. Mappings whose OS
+ * path does not exist (or is not a directory) are dropped with a warning —
+ * a missing folder must not take the whole /api surface down, and the
+ * webapp will surface the absent mount as "not mounted".
+ */
+export declare function resolveHostMountRoots(mounts: readonly HostMountMapping[], warn?: (msg: string) => void): Promise<HostMountRoot[]>;
+/**
+ * Register the /api/hostfs routes for the resolved mount roots. The route
+ * surface mirrors `MountBackend` 1:1 (webapp `backend-hostfs.ts`):
+ *
+ *   GET    /api/hostfs/list?mount=&path=          → { entries: [...] }
+ *   GET    /api/hostfs/stat?mount=&path=          → { kind, size, mtime }
+ *   GET    /api/hostfs/read?mount=&path=          → octet-stream body
+ *   PUT    /api/hostfs/write?mount=&path=         ← octet-stream body
+ *   POST   /api/hostfs/mkdir?mount=&path=
+ *   DELETE /api/hostfs/remove?mount=&path=[&recursive=1]
+ *
+ * Errors are `{ code, message }` JSON with an errno-derived status so the
+ * webapp backend can rethrow faithful `FsError`s.
+ */
+export declare function registerHostFsRoutes(app: Express, roots: readonly HostMountRoot[]): void;
+export {};

package/dist/node-server/hostfs.js

@@ -0,0 +1,257 @@
+/**
+ * Host filesystem bridge — serves the folders named in the mount table
+ * (`--mount=<os-path>:<slicc-path>`) to the webapp over the local /api
+ * surface, so configured mounts appear in the VFS fully automatically,
+ * with no File System Access picker and no Chrome permission prompt.
+ *
+ * Only paths under a configured mount root are reachable. Every request
+ * names a mount by its SLICC target (`?mount=/mnt/project`) plus a
+ * mount-relative path (`?path=sub/file.txt`); the mapping to the OS root
+ * happens here and `resolveWithinRoot` rejects traversal (`..`) and
+ * symlink escapes, so the browser never addresses the host filesystem
+ * directly.
+ *
+ * Protected like every other /api route: same-origin / loopback callers
+ * pass, cross-origin callers need the bridge token (see
+ * `createThinBridgeCorsMiddleware` in index.ts).
+ */
+import express from 'express';
+import { lstat, mkdir, readdir, readFile, realpath, rename, rm, stat, writeFile, } from 'fs/promises';
+import { dirname, resolve, sep } from 'path';
+/** Matches the webapp's hostfs body cap (backend-hostfs.ts). */
+export const HOSTFS_MAX_BODY_BYTES = 100 * 1024 * 1024;
+function errnoCode(err) {
+    const code = err?.code;
+    return typeof code === 'string' ? code : null;
+}
+/** Map an fs errno (or traversal rejection) to an HTTP status + FsError code. */
+function toFsCodeError(err) {
+    const code = errnoCode(err) ?? 'EIO';
+    const message = err instanceof Error ? err.message : String(err);
+    switch (code) {
+        case 'ENOENT':
+            return { status: 404, code, message };
+        case 'EACCES':
+        case 'EPERM':
+            return { status: 403, code: 'EACCES', message };
+        case 'EISDIR':
+        case 'ENOTDIR':
+        case 'ENOTEMPTY':
+        case 'EEXIST':
+            return { status: 409, code, message };
+        default:
+            return { status: 500, code, message };
+    }
+}
+function sendFsError(res, err) {
+    const mapped = toFsCodeError(err);
+    res.status(mapped.status).json({ code: mapped.code, message: mapped.message });
+}
+/** Traversal/symlink escape → EACCES, so it renders as a permission error. */
+function escapeError(target) {
+    const err = new Error(`path escapes the mount root: ${target}`);
+    err.code = 'EACCES';
+    return err;
+}
+function isWithin(root, target) {
+    return target === root || target.startsWith(root + sep);
+}
+/**
+ * Resolve `relPath` against `root`, rejecting anything that leaves the root
+ * either lexically (`..`) or via symlinks. Symlinks *inside* the root that
+ * also point inside the root are followed; a link pointing outside is
+ * rejected. The check walks to the nearest existing ancestor so that writes
+ * to not-yet-existing paths are still validated.
+ */
+export async function resolveWithinRoot(root, relPath) {
+    const cleaned = relPath.replace(/^\/+/, '');
+    const target = resolve(root, cleaned);
+    if (!isWithin(root, target))
+        throw escapeError(target);
+    // Walk up to the nearest existing ancestor and realpath it; a symlinked
+    // ancestor must still land inside the (already realpath'd) root.
+    let probe = target;
+    for (;;) {
+        try {
+            const real = await realpath(probe);
+            if (!isWithin(root, real) && probe !== root)
+                throw escapeError(target);
+            break;
+        }
+        catch (err) {
+            if (errnoCode(err) !== 'ENOENT')
+                throw err;
+            const parent = dirname(probe);
+            if (parent === probe)
+                break;
+            probe = parent;
+        }
+    }
+    return target;
+}
+function statPayload(s) {
+    return {
+        kind: s.isDirectory() ? 'directory' : 'file',
+        size: s.isDirectory() ? 0 : s.size,
+        mtime: Math.round(s.mtimeMs),
+    };
+}
+/**
+ * Resolve the configured mappings to realpath'd roots. Mappings whose OS
+ * path does not exist (or is not a directory) are dropped with a warning —
+ * a missing folder must not take the whole /api surface down, and the
+ * webapp will surface the absent mount as "not mounted".
+ */
+export async function resolveHostMountRoots(mounts, warn = (msg) => console.warn(msg)) {
+    const roots = [];
+    for (const mapping of mounts) {
+        try {
+            const root = await realpath(mapping.hostPath);
+            const s = await stat(root);
+            if (!s.isDirectory()) {
+                warn(`--mount ${mapping.hostPath}: not a directory, skipping`);
+                continue;
+            }
+            roots.push({ path: mapping.path, root });
+        }
+        catch {
+            warn(`--mount ${mapping.hostPath}: does not exist, skipping`);
+        }
+    }
+    return roots;
+}
+function queryString(req, name) {
+    const value = req.query[name];
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/**
+ * Register the /api/hostfs routes for the resolved mount roots. The route
+ * surface mirrors `MountBackend` 1:1 (webapp `backend-hostfs.ts`):
+ *
+ *   GET    /api/hostfs/list?mount=&path=          → { entries: [...] }
+ *   GET    /api/hostfs/stat?mount=&path=          → { kind, size, mtime }
+ *   GET    /api/hostfs/read?mount=&path=          → octet-stream body
+ *   PUT    /api/hostfs/write?mount=&path=         ← octet-stream body
+ *   POST   /api/hostfs/mkdir?mount=&path=
+ *   DELETE /api/hostfs/remove?mount=&path=[&recursive=1]
+ *
+ * Errors are `{ code, message }` JSON with an errno-derived status so the
+ * webapp backend can rethrow faithful `FsError`s.
+ */
+export function registerHostFsRoutes(app, roots) {
+    const byPath = new Map(roots.map((r) => [r.path, r]));
+    const withTarget = (handler) => {
+        return (req, res) => {
+            void (async () => {
+                const mount = queryString(req, 'mount');
+                const rel = queryString(req, 'path') ?? '';
+                const entry = mount ? byPath.get(mount) : undefined;
+                if (!entry) {
+                    res.status(404).json({ code: 'ENOENT', message: `no such mount: ${mount ?? ''}` });
+                    return;
+                }
+                try {
+                    const target = await resolveWithinRoot(entry.root, rel);
+                    await handler(target, req, res);
+                }
+                catch (err) {
+                    sendFsError(res, err);
+                }
+            })();
+        };
+    };
+    app.get('/api/hostfs/list', withTarget(async (target, _req, res) => {
+        const dirents = await readdir(target, { withFileTypes: true });
+        const entries = await Promise.all(dirents.map(async (d) => {
+            if (d.isDirectory())
+                return { name: d.name, kind: 'directory' };
+            try {
+                // stat() follows symlinks, so a link to a directory classifies as
+                // a directory — matching what every subsequent access sees (and
+                // the swift server, whose fileExists follows links). Escaping
+                // links are still refused at access time by resolveWithinRoot.
+                const s = await stat(resolve(target, d.name));
+                if (s.isDirectory())
+                    return { name: d.name, kind: 'directory' };
+                return {
+                    name: d.name,
+                    kind: 'file',
+                    size: s.size,
+                    lastModified: Math.round(s.mtimeMs),
+                };
+            }
+            catch {
+                // Raced deletion / dangling link / unreadable: name only.
+                return { name: d.name, kind: 'file' };
+            }
+        }));
+        res.json({ entries });
+    }));
+    app.get('/api/hostfs/stat', withTarget(async (target, _req, res) => {
+        res.json(statPayload(await stat(target)));
+    }));
+    app.get('/api/hostfs/read', withTarget(async (target, _req, res) => {
+        // lstat first so a dangling symlink is ENOENT, a directory is EISDIR.
+        const s = await stat(target);
+        if (s.isDirectory()) {
+            sendFsError(res, Object.assign(new Error(`is a directory: ${target}`), { code: 'EISDIR' }));
+            return;
+        }
+        if (s.size > HOSTFS_MAX_BODY_BYTES) {
+            res.status(413).json({
+                code: 'EFBIG',
+                message: `file exceeds the ${HOSTFS_MAX_BODY_BYTES} byte hostfs cap`,
+            });
+            return;
+        }
+        const body = await readFile(target);
+        res.setHeader('Content-Type', 'application/octet-stream');
+        res.send(body);
+    }));
+    app.put('/api/hostfs/write', express.raw({ type: () => true, limit: HOSTFS_MAX_BODY_BYTES }), withTarget(async (target, req, res) => {
+        // Refuse to clobber a directory with a file (fs would throw EISDIR on
+        // open, but check explicitly so the error is deterministic).
+        try {
+            const existing = await lstat(target);
+            if (existing.isDirectory()) {
+                sendFsError(res, Object.assign(new Error(`is a directory: ${target}`), { code: 'EISDIR' }));
+                return;
+            }
+        }
+        catch {
+            /* ENOENT — fresh file */
+        }
+        await mkdir(dirname(target), { recursive: true });
+        const body = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+        // Write-then-rename would break hardlinks and xattrs on user files;
+        // plain writeFile matches what local tools do.
+        await writeFile(target, body);
+        res.json({ ok: true });
+    }));
+    app.post('/api/hostfs/mkdir', withTarget(async (target, _req, res) => {
+        await mkdir(target, { recursive: true });
+        res.json({ ok: true });
+    }));
+    app.post('/api/hostfs/rename', withTarget(async (target, req, res) => {
+        const mount = queryString(req, 'mount');
+        const toRel = queryString(req, 'to');
+        const entry = mount ? byPath.get(mount) : undefined;
+        if (!entry || !toRel) {
+            res.status(400).json({ code: 'EINVAL', message: 'rename requires mount and to' });
+            return;
+        }
+        const to = await resolveWithinRoot(entry.root, toRel);
+        await rename(target, to);
+        res.json({ ok: true });
+    }));
+    app.delete('/api/hostfs/remove', withTarget(async (target, req, res) => {
+        const isRoot = roots.some((r) => r.root === target);
+        if (isRoot) {
+            res.status(403).json({ code: 'EACCES', message: 'refusing to remove a mount root' });
+            return;
+        }
+        const recursive = queryString(req, 'recursive') === '1';
+        await rm(target, { recursive, force: false });
+        res.json({ ok: true });
+    }));
+}

package/dist/node-server/index.js

@@ -30,6 +30,7 @@ import { getElectronAppPorts } from './electron-runtime.js';
 import { ElectronTrayFollower } from './electron-tray-follower.js';
 import { FileLogger } from './file-logger.js';
 import { registerHostedBootstrapEndpoint } from './hosted-bootstrap.js';
+import { registerHostFsRoutes, resolveHostMountRoots } from './hostfs.js';
 import { runInstallCli } from './install-cli.js';
 import { resolveCliBrowserLaunchUrl } from './launch-url.js';
 import { createHttpCdp, registerLeaderRestartEndpoint } from './leader-restart.js';
@@ -197,6 +198,7 @@ function createServerState() {
         electronFollower: null,
         shuttingDown: false,
         discoveredTrayJoinUrl: RUNTIME_FLAGS.joinUrl ?? null,
+        hostMountRoots: [],
         bridgeToken: resolveServerBridgeToken(process.env, { thinBridgeMode: THIN_BRIDGE_MODE }),
         cdpUrl: null,
         chromeWs: null,
@@ -1106,6 +1108,10 @@ async function main() {
             // after `server.listen()`, so this endpoint must NOT close over a
             // pre-launch snapshot or it would always return null.
             trayJoinUrl: state.discoveredTrayJoinUrl ?? null,
+            // Mount table (--mount=<os-path>:<slicc-path>): served over
+            // /api/hostfs and auto-mounted by the webapp at boot. Only mappings
+            // whose OS folder existed at startup are advertised.
+            autoMounts: state.hostMountRoots.map(({ path, root }) => ({ path, hostPath: root })),
         });
     });
     // Localhost API descriptor — the discoverable surface advertised by the
@@ -1144,6 +1150,10 @@ async function main() {
         registerHostedBootstrapEndpoint(app, { secretStore });
         registerSecretsReloadEndpoint(app, { secretProxy, secretStore, oauthStore });
     }
+    // Host-FS bridge for the mount table (--mount=<os>:<vfs>), every mode.
+    // Roots are resolved once at startup; a folder created later needs a restart.
+    state.hostMountRoots = await resolveHostMountRoots(RUNTIME_FLAGS.mounts);
+    registerHostFsRoutes(app, state.hostMountRoots);
     // Sudo approval endpoint — raises a native OS dialog / TTY prompt from this
     // trusted process so the in-browser agent can request, but never fabricate,
     // an approval. Loopback-only; selects a backend by environment at call time.

package/dist/node-server/runtime-flags.d.ts

@@ -24,7 +24,29 @@ export interface CliRuntimeFlags {
     installCli: boolean;
     /** Target directory for --install-cli (default: OS-idiomatic, see install-cli.ts) */
     installDir: string | null;
+    /**
+     * Mount table: OS-folder → SLICC-target mappings served over the local
+     * host-FS bridge (`/api/hostfs`) and auto-mounted by the webapp at boot,
+     * with no picker and no Chrome permission prompt. Filled by repeatable
+     * `--mount=<os-path>:<slicc-path>` / `--mount <os-path>:<slicc-path>`
+     * flags. Picker-initiated (`mount <path>`) FS-Access mounts are
+     * unaffected and keep asking for permission.
+     */
+    mounts: HostMountMapping[];
+}
+/** One `--mount` entry: an absolute OS folder mapped to a VFS target. */
+export interface HostMountMapping {
+    hostPath: string;
+    path: string;
 }
 export declare const DEFAULT_CLI_CDP_PORT = 9222;
 export declare const DEFAULT_ELECTRON_ATTACH_CDP_PORT = 9223;
+/**
+ * Parse a `--mount` value of the form `<os-path>:<slicc-path>`. The split is
+ * on the LAST `:` whose remainder is an absolute path, so OS paths containing
+ * `:` still parse. A leading `~/` on the OS side expands against `homeDir`.
+ * Returns null (never a partial mapping) for anything else, so a stray
+ * `--mount=` or a one-sided value never lands in the table.
+ */
+export declare function parseMountTableMapping(value: string, homeDir?: string): HostMountMapping | null;
 export declare function parseCliRuntimeFlags(argv: string[]): CliRuntimeFlags;

package/dist/node-server/runtime-flags.js

@@ -1,5 +1,72 @@
 export const DEFAULT_CLI_CDP_PORT = 9222;
 export const DEFAULT_ELECTRON_ATTACH_CDP_PORT = 9223;
+/** `.`/`..` segments or empty (`//`) segments make raw != canonical. */
+function hasDotOrEmptySegments(path) {
+    return path
+        .split(/[/\\]/)
+        .slice(1)
+        .some((segment) => segment === '' || segment === '.' || segment === '..');
+}
+/**
+ * Normalize an absolute POSIX path. Dot/empty segments are rejected rather
+ * than resolved so the accepted value IS its canonical form — the webapp,
+ * the /api/hostfs mount key, and VirtualFS.normalizePath all agree on it.
+ */
+function normalizeAbsolutePath(value) {
+    const trimmed = value.trim();
+    if (!trimmed.startsWith('/'))
+        return null;
+    const stripped = trimmed.length > 1 ? trimmed.replace(/\/+$/, '') : trimmed;
+    if (!stripped || (stripped.length > 1 && hasDotOrEmptySegments(stripped)))
+        return null;
+    return stripped;
+}
+/**
+ * Normalize the OS side of a mapping: POSIX absolute, or a Windows drive
+ * path (`C:\…` / `C:/…`) — node-server ships on Windows too.
+ */
+function normalizeHostPath(value) {
+    const trimmed = value.trim();
+    if (/^[A-Za-z]:[/\\]/.test(trimmed)) {
+        const stripped = trimmed.replace(/[/\\]+$/, '');
+        // Keep the root slash on a bare drive (`C:\`).
+        if (/^[A-Za-z]:$/.test(stripped))
+            return trimmed.slice(0, 3);
+        return hasDotOrEmptySegments(stripped.slice(2)) ? null : stripped;
+    }
+    return normalizeAbsolutePath(trimmed);
+}
+/**
+ * Parse a `--mount` value of the form `<os-path>:<slicc-path>`. The split is
+ * on the LAST `:` whose remainder is an absolute path, so OS paths containing
+ * `:` still parse. A leading `~/` on the OS side expands against `homeDir`.
+ * Returns null (never a partial mapping) for anything else, so a stray
+ * `--mount=` or a one-sided value never lands in the table.
+ */
+export function parseMountTableMapping(value, homeDir = process.env['HOME'] ?? '') {
+    const trimmed = value.trim();
+    const sep = trimmed.lastIndexOf(':');
+    if (sep <= 0)
+        return null;
+    let hostRaw = trimmed.slice(0, sep).trim();
+    const targetRaw = trimmed.slice(sep + 1).trim();
+    if (hostRaw === '~' || hostRaw.startsWith('~/')) {
+        if (!homeDir)
+            return null;
+        hostRaw = homeDir + hostRaw.slice(1);
+    }
+    const hostPath = normalizeHostPath(hostRaw);
+    const path = normalizeAbsolutePath(targetRaw);
+    if (!hostPath || !path || path === '/')
+        return null;
+    return { hostPath, path };
+}
+function addMountTablePath(flags, value) {
+    const mapping = parseMountTableMapping(value);
+    if (mapping && !flags.mounts.some((m) => m.path === mapping.path)) {
+        flags.mounts.push(mapping);
+    }
+}
 function looksLikeUrl(value) {
     return /^[a-z][a-z0-9+.-]*:\/\//i.test(value.trim());
 }
@@ -25,6 +92,7 @@ function createDefaultFlags() {
         hosted: false,
         installCli: false,
         installDir: null,
+        mounts: [],
     };
 }
 /** Next argv entry, but only when it exists and is not itself a `--` flag. */
@@ -103,6 +171,10 @@ function applyEqualsFlag(flags, arg) {
         flags.joinUrl = arg.slice('--join='.length).trim() || null;
         return true;
     }
+    if (arg.startsWith('--mount=')) {
+        addMountTablePath(flags, arg.slice('--mount='.length));
+        return true;
+    }
     if (arg.startsWith('--electron-app=')) {
         flags.electron = true;
         flags.electronApp = arg.slice('--electron-app='.length).trim() || null;
@@ -110,7 +182,7 @@ function applyEqualsFlag(flags, arg) {
     }
     return false;
 }
-/** `--prompt`/`--env-file`/`--profile`/`--install-dir` followed by a value token. Returns tokens consumed. */
+/** `--prompt`/`--env-file`/`--profile`/`--install-dir`/`--mount` followed by a value token. Returns tokens consumed. */
 function applyPlainValueFlag(flags, argv, index, arg) {
     const next = nextValueArg(argv, index);
     if (next === null) {
@@ -125,6 +197,9 @@ function applyPlainValueFlag(flags, argv, index, arg) {
     else if (arg === '--install-dir') {
         flags.installDir = next.trim() || null;
     }
+    else if (arg === '--mount') {
+        addMountTablePath(flags, next);
+    }
     else {
         flags.profile = next.trim() || null;
     }
@@ -176,7 +251,8 @@ function applyValueFlag(flags, argv, index, arg) {
     if (arg === '--prompt' ||
         arg === '--env-file' ||
         arg === '--profile' ||
-        arg === '--install-dir') {
+        arg === '--install-dir' ||
+        arg === '--mount') {
         return applyPlainValueFlag(flags, argv, index, arg);
     }
     if (arg === '--lead' || arg === '--join') {