crucible 0.38.0

github-actions released this 06 Sep 02:45

· 46 commits to main since this release

d6e70be

Fixed

The prompt no longer draws window unknown. Before a model has said how
much of its window a session has used, the reading row keeps its place and
says nothing; the bare status row ends at the session facts. The box that
takes a key is its own screen and carries none of the prompt's chrome.
A command's answer is no longer clipped by the mark it hangs under. An
answer that reached the window's edge lost its last word once the corner
mark was put in front of it; it now folds short of the mark, so the /logout
answer about an environment key and the /login answer about a store that
cannot be written are read whole.
Unsupported sandbox errors no longer recommend a removed setting. The
native-backend refusal no longer suggests the rejected sandbox.mode key.
Protected names remain protected across macOS filesystem aliases. The
Seatbelt policy matches repository and Crucible metadata names without case,
so a case-only APFS directory rename cannot make their contents writable or
move them outside the protected namespace.
Sandbox reports preserve fractional time limits. Command and session
ceilings retain their exact duration instead of rounding down to whole seconds.
A drag scrolls the transcript. A drag resting at the top or foot of the
transcript carries it a row at a time, and the wheel scrolls it while the
button is held. The highlight stays on the words it began on, and a release
copies what scrolled off the window along with what is still on it.
Long call, result and table lines wrap instead of ending in an ellipsis.
A tool call's arguments, the row its result hangs on, a command's answer and
a table cell now wrap under their first row, indented to where their words
began. toolDetail is the measure they wrap at rather than where they are cut.
Links, bullets and references are drawn the way a reader finds them. A
link is its underlined words carrying the address, without the address in
brackets after them; a list bullet is heavier than the dot that parts two
things on one row; PR #435 and issue #12 are one link, the word included.
Command answers hang off the line that asked. A slash command's answer
starts directly under the command with the corner mark in front of it, the
opening card no longer draws an authentication: row, a successful /login
says login successful, and a failed turn is drawn red without the mark.
Replay draws tool calls as they were drawn live. A resumed session names
calls to tools the model had looked up, such as web search and fetch, with
their arguments rather than as bare names, and draws each call line as its
result comes past rather than every line of a batch before any result.
Failed server startup keeps cleanup failures visible. MCP handshake and
catalogue failures stop the process explicitly; optional servers are skipped
only when cleanup is confirmed. Missing-pipe failures in the MCP and RPC
hosts preserve the original cause and stop error in Unstarted::Unreaped.
MCP servers are replaced only after confirmed cleanup. An unconfirmed
stop remains a disposal failure and prevents another preparation or restart.
Failed partial preparation retains cleanup failures for the runner to report,
while disposal still attempts every started server.
MCP sandbox audit records reach the session journal. Preparation, restart
and cleanup retain their run attribution, including lifecycle failures.
Audit delivery happens before the next provider request and after disposal;
a delivery error preserves the original operation and cleanup failures.
Failed sandbox startup keeps uncertain cleanup visible. Startup errors
stop and reap a spawned command within bounded waits. If cleanup cannot be
confirmed, Crucible retains staging data, Linux projection evidence and the
command slot instead of reporting successful cleanup or deleting the evidence.
Unavailable audit collectors no longer discard earlier records. If one
collector cannot be read, the registry retains every undelivered sandbox fact
and returns an error.
Background commands remain reachable when cleanup fails. Their rows and
command slots stay held until cleanup succeeds, including when the original
result was abandoned. A failed stop keeps the panel open with
Stop failed; x retries; the next press retries the same command.
Failed local process cleanup remains visible. Compatibility-mode stops
retry unfinished cleanup, and a cached exit status cannot hide a prior
supervisor failure. Unconfirmed cleanup retains staging data and its command
slot instead of admitting more work on an unproved cleanup result.
Windows command cleanup confirms job membership. After requesting
termination, Crucible checks that the command's job has no active processes
before reporting completion. Unavailable job state is an error, and an
explicit stop bounds its wait for an empty job.

Changed

/login asks for a key in a labelled box that takes a paste. The first
panel offers the ChatGPT and Kimi Code plans and Provide your own API key,
which replaces Console account; the provider list names each provider with
the variable it reads from, set ANTHROPIC_API_KEY and so on. The key box is
framed and labelled with the provider, takes a pasted key whole, draws a dot
per character, and saves on Enter only once something is held. A store that
cannot be written is answered with the key could not be saved and the way
back in for what stopped it — the permissions, another crucible holding the
store, or a store that cannot be read and should be moved aside — never with
a path. Leaving the box says cancelled, nothing signed in; a window too
short to stand the box says so and asks for a taller one.
OS sandboxing is now opt-in through sandbox.enabled only. Set it to
true to require confinement; omitted settings default to off, and project
settings cannot disable it. Breaking: sandbox.mode is rejected; replace
required with enabled: true and off with enabled: false, and choose
either explicit behavior if you previously used degraded.

Added

Native Windows can now enforce the opt-in sandbox. After the explicit
Administrator setup, commands run as a dedicated low-privilege account under
path-capability ACLs, persistent WFP network denial, a privilege-stripped
write-restricted token, a private desktop, exact standard-handle inheritance,
and a kill-on-close Job Object with an aggregate CPU ceiling. Native x86_64
and ARM64 Windows CI provision the real backend and test workspace/protected
writes, loopback denial, input forwarding, exit status, identity and
descendant cleanup. Each command also receives a private TEMP/TMP
directory. Windows retains the sandbox account's ordinary ACL access so the
protected Win32 loader and developer tools can start; Crucible grants only
declared roots, but ACLs that already grant the sandbox account or Everyone
can remain writable. Explicit unreadable paths and patterns fail closed rather
than claiming a read boundary Windows cannot apply with these stable APIs.
Windows sandbox setup is explicit, repairable, and account-scoped. Run
crucible sandbox setup once from an Administrator PowerShell to create a
dedicated local identity, protect its random credential with machine-scope
DPAPI, and install persistent outbound-deny WFP rules. Setup does not
auto-elevate, can target another developer with --owner, and
crucible sandbox uninstall disables the identity before removing it.
macOS can now enforce the opt-in sandbox with Seatbelt. The native
backend denies network access and writes outside declared roots, protects
repository metadata, closes inherited descriptors, applies the open-file
limit, and uses a private temporary directory. Intel and Apple silicon CI
now require its native confinement tests to pass. The security guide records
the trusted macOS code-validation metadata effect and the authority checks
that remain mandatory before release.
Windows cleanup tests exercise failed observation and recovery. Native
job tests cover a refused state query after termination, a live job that
reaches the stop deadline, and successful observation after that job ends.
Sandbox admission is tested before workspace materialization. Concurrent
preparations and cloned services share the requested command ceiling and the
absolute sixteen-command limit, and dropping a session releases its slot.
These regression tests run against compatibility and the enforcing backend;
the enforcing CI job fails if its backend is missing.
A sandbox backend's capability claims are now checked against what it
does. crucible_tools::conformance is published for adapters outside this
repository: it offers each backend the smallest policy that requires one
feature and reads the claim and the answer together, so a backend that takes
a policy it says it cannot hold, or refuses one it says it can, is a fault
rather than a passing table. Answers are grouped into the families a backend
is chosen by — isolation, materialization, network, resources, terminal,
persistence, accounting and cost — and a feature no policy can name is
reported as untested rather than kept.
crucible --sandbox prints the confinement a command here would run
under. Which backend enforces it and at what version, every feature that
backend can and cannot hold, the reach and ceilings a command would get with
each ceiling beside the claim it rests on, and whether anything was given up.
The inspection record already held all of this; there was no way to read it
without running something. Nothing is run to produce the report, and every
path in it except your workspace root is a digest, so it can be pasted into an
issue.
The sandbox now holds a process ceiling. The broker is PID 1 of the
namespace and caps the processes beneath it at 1024 whether or not a policy
mentions one, the way it already zeroes the core-dump ceiling. A workload that
forked in a loop was previously bounded by nothing the sandbox owned: the
processor and descriptor ceilings do not help, because each new process gets
its own. A policy may state fewer and the lower of the two applies.

Stating a ceiling is a separate claim, and the Linux backend makes it only
where the kernel counts processes per user namespace — 5.14 and newer. On an
older kernel the count is the real user's across the whole machine, so
required refuses a stated ceiling rather than applying a number that would
bound the host's other work. The broker's own 1024 applies either way.

Assets 14