@aalis/plugin-code-sandbox-os 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ace Nyan <ace@acenyan.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+import type { Context, PluginModule } from '@aalis/core';
+export declare const name = "@aalis/plugin-code-sandbox-os";
+export declare const displayName = "\u4EE3\u7801\u6C99\u7BB1\uFF08OS\uFF09";
+export declare const provides: string[];
+export declare const inject: {
+    required: string[];
+};
+export declare function apply(ctx: Context): Promise<void>;
+declare const plugin: PluginModule;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAU,YAAY,EAAE,MAAM,aAAa,CAAC;AAMjE,eAAO,MAAM,IAAI,kCAAkC,CAAC;AACpD,eAAO,MAAM,WAAW,2CAAa,CAAC;AACtC,eAAO,MAAM,QAAQ,UAAmB,CAAC;AACzC,eAAO,MAAM,MAAM;;CAElB,CAAC;AAmDF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvD;AAED,QAAA,MAAM,MAAM,EAAE,YAA8B,CAAC;AAC7C,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -0,0 +1,72 @@
+// ============================================================
+// @aalis/plugin-code-sandbox-os — code-sandbox 的 OS 原生实现
+//
+// Linux bubblewrap / macOS sandbox-exec。把不可信代码包成沙箱启动器命令后，
+// **经现有 `process` 服务网关** spawn（不碰 process-api / process-local 的实现，
+// 也不直接 import node:child_process / node:fs——OS 探测靠经网关功能性试跑）。
+// ============================================================
+import { createProcessGateway } from '@aalis/plugin-process-api';
+import { wrapForSandbox } from './sandbox.js';
+export const name = '@aalis/plugin-code-sandbox-os';
+export const displayName = '代码沙箱（OS）';
+export const provides = ['code-sandbox'];
+export const inject = {
+    required: ['process'],
+};
+/**
+ * 功能性探测：经 process 网关真正跑一次最小沙箱命令，跑通才算可用。
+ * 比「命令是否存在」更强——一次覆盖 存在性 + Linux unprivileged userns 是否真能用。
+ */
+async function probeBackend(proc, logger) {
+    const platform = process.platform;
+    try {
+        if (platform === 'darwin') {
+            await proc.execFile('sandbox-exec', ['-p', '(version 1) (allow default)', 'true'], { timeout: 5000 });
+            return 'seatbelt';
+        }
+        if (platform === 'linux') {
+            await proc.execFile('bwrap', ['--ro-bind', '/', '/', '--unshare-all', 'true'], { timeout: 5000 });
+            return 'bwrap';
+        }
+        logger.warn(`平台 ${platform} 暂无 OS 沙箱后端，code_runner auto 模式将 fail-closed`);
+        return 'none';
+    }
+    catch {
+        // 启动器不存在 / 不可用（如 Linux 未安装 bwrap、或 unprivileged user namespaces 被禁）→ 无后端
+        logger.warn(`OS 沙箱后端探测失败（platform=${platform}）：无可用沙箱，code_runner auto 模式将 fail-closed`);
+        return 'none';
+    }
+}
+class OsCodeSandboxService {
+    proc;
+    _backend;
+    constructor(proc, _backend) {
+        this.proc = proc;
+        this._backend = _backend;
+    }
+    get available() {
+        return this._backend !== 'none';
+    }
+    get backend() {
+        return this._backend;
+    }
+    async run(req) {
+        if (this._backend === 'none') {
+            throw new Error('code-sandbox: 无可用后端，run() 不应被调用（调用方应先检查 available）');
+        }
+        const wrapped = wrapForSandbox(this._backend, req.policy, req.cmd, req.args, req.cwd, req.env ?? {});
+        // 经 process 网关 spawn 包好的启动器命令；env 已由 wrapper 的 --clearenv / env -i 注入白名单，
+        // 故此处不再传 env（外层启动器进程继承宿主 env 无妨，wrapper 已为内层不可信子进程清空）。
+        return this.proc.execFile(wrapped.cmd, wrapped.args, { cwd: req.cwd, timeout: req.timeout });
+    }
+}
+export async function apply(ctx) {
+    const logger = ctx.logger.child('code-sandbox-os');
+    const proc = createProcessGateway(ctx);
+    const backend = await probeBackend(proc, logger);
+    ctx.provide('code-sandbox', new OsCodeSandboxService(proc, backend));
+    logger.info(`code-sandbox-os 就绪（后端: ${backend === 'none' ? '无 —— 沙箱不可用，code_runner 将 fail-closed' : backend}）`);
+}
+const plugin = { name, apply };
+export default plugin;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,mEAAmE;AACnE,6DAA6D;AAC7D,+DAA+D;AAK/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAuB,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,CAAC,MAAM,IAAI,GAAG,+BAA+B,CAAC;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AACtC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,CAAC,SAAS,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,IAAoB,EAAE,MAAc;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtG,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,8CAA8C,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,0CAA0C,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB;IAEL;IACA;IAFnB,YACmB,IAAoB,EACpB,QAAwB;QADxB,SAAI,GAAJ,IAAI,CAAgB;QACpB,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC;IAClC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAsB;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrG,0EAA0E;QAC1E,uDAAuD;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,OAAO,GAAG,CACnG,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7C,eAAe,MAAM,CAAC"}

package/dist/sandbox.d.ts

@@ -0,0 +1,23 @@
+import type { SandboxPolicy } from '@aalis/plugin-code-sandbox-api';
+export type SandboxBackend = 'seatbelt' | 'bwrap' | 'none';
+/**
+ * 生成 macOS Seatbelt (SBPL) profile：默认拒绝；放开 进程/读/常见系统调用；
+ * 写仅限 fsWrite + /dev 标准设备；网络按 policy。
+ */
+export declare function buildSeatbeltProfile(policy: SandboxPolicy): string;
+/** macOS：sandbox-exec -p profile env -i <allowlist> cmd args（env -i 清空 env 仅留白名单） */
+export declare function buildSeatbeltArgs(policy: SandboxPolicy, cmd: string, args: readonly string[], env: Record<string, string | undefined>): {
+    cmd: string;
+    args: string[];
+};
+/** Linux：bwrap 只读绑根（可读+取解释器/库）、rw 绑写白名单、清 env 仅留白名单、按 policy 隔离网络。 */
+export declare function buildBwrapArgs(policy: SandboxPolicy, cmd: string, args: readonly string[], cwd: string | undefined, env: Record<string, string | undefined>): {
+    cmd: string;
+    args: string[];
+};
+/** 按后端把 (cmd,args) 改写为「经沙箱启动器运行」。backend==='none' 不应调用（调用方先 fail-closed）。 */
+export declare function wrapForSandbox(backend: SandboxBackend, policy: SandboxPolicy, cmd: string, args: readonly string[], cwd: string | undefined, env: Record<string, string | undefined>): {
+    cmd: string;
+    args: string[];
+};
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAY3D;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAgBlE;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIjC;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBjC;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIjC"}

package/dist/sandbox.js

@@ -0,0 +1,82 @@
+// ============================================================
+// sandbox.ts — OS 沙箱命令改写（纯逻辑，便于单测）
+//
+// 把不可信代码的子进程包到 OS 沙箱启动器里运行（仍 shell-free）：
+//   - macOS → sandbox-exec -p '<SBPL>' env -i <allowlist> <cmd> <args>
+//   - Linux → bwrap <flags> --clearenv --setenv ... -- <cmd> <args>
+// v1 语义：读放开（解释器需系统库）、写限定 fsWrite、网络粗粒度开关、env 仅白名单（防 secrets 泄漏）。
+// 后端探测（功能性 probe）在 index.ts 经 process 网关做；本文件只做纯生成。
+// ============================================================
+/** 取 env 中非空键值对（保序），用于 --setenv / `env -i` */
+function envPairs(env) {
+    return Object.entries(env).filter((e) => e[1] != null);
+}
+/** SBPL 字符串字面量转义 */
+function sbplQuote(p) {
+    return `"${p.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/**
+ * 生成 macOS Seatbelt (SBPL) profile：默认拒绝；放开 进程/读/常见系统调用；
+ * 写仅限 fsWrite + /dev 标准设备；网络按 policy。
+ */
+export function buildSeatbeltProfile(policy) {
+    const lines = [
+        '(version 1)',
+        '(deny default)',
+        '(allow process-fork)',
+        '(allow process-exec)',
+        '(allow file-read*)',
+        '(allow sysctl-read)',
+        '(allow mach-lookup)',
+        '(allow ipc-posix-shm)',
+        '(allow signal)',
+        '(allow file-write-data (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (literal "/dev/dtracehelper") (literal "/dev/urandom"))',
+    ];
+    for (const dir of policy.fsWrite)
+        lines.push(`(allow file-write* (subpath ${sbplQuote(dir)}))`);
+    lines.push(policy.network === 'allow' ? '(allow network*)' : '(deny network*)');
+    return `${lines.join('\n')}\n`;
+}
+/** macOS：sandbox-exec -p profile env -i <allowlist> cmd args（env -i 清空 env 仅留白名单） */
+export function buildSeatbeltArgs(policy, cmd, args, env) {
+    const profile = buildSeatbeltProfile(policy);
+    const envArgs = envPairs(env).map(([k, v]) => `${k}=${v}`);
+    return { cmd: 'sandbox-exec', args: ['-p', profile, 'env', '-i', ...envArgs, cmd, ...args] };
+}
+/** Linux：bwrap 只读绑根（可读+取解释器/库）、rw 绑写白名单、清 env 仅留白名单、按 policy 隔离网络。 */
+export function buildBwrapArgs(policy, cmd, args, cwd, env) {
+    const a = [
+        '--ro-bind',
+        '/',
+        '/',
+        '--dev',
+        '/dev',
+        '--proc',
+        '/proc',
+        '--tmpfs',
+        '/tmp', // 私有可写 /tmp；写白名单的 bind 在其后，故 /tmp 下的真实临时目录会被重新暴露为可写
+        '--unshare-all', // 含 net 命名空间隔离（断网）
+        '--die-with-parent',
+        '--new-session',
+        '--clearenv',
+    ];
+    for (const [k, v] of envPairs(env))
+        a.push('--setenv', k, v);
+    if (policy.network === 'allow')
+        a.push('--share-net');
+    for (const dir of policy.fsWrite)
+        a.push('--bind', dir, dir);
+    if (cwd)
+        a.push('--chdir', cwd);
+    a.push('--', cmd, ...args);
+    return { cmd: 'bwrap', args: a };
+}
+/** 按后端把 (cmd,args) 改写为「经沙箱启动器运行」。backend==='none' 不应调用（调用方先 fail-closed）。 */
+export function wrapForSandbox(backend, policy, cmd, args, cwd, env) {
+    if (backend === 'seatbelt')
+        return buildSeatbeltArgs(policy, cmd, args, env);
+    if (backend === 'bwrap')
+        return buildBwrapArgs(policy, cmd, args, cwd, env);
+    throw new Error(`不支持的沙箱后端: ${backend}`);
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,mCAAmC;AACnC,EAAE;AACF,0CAA0C;AAC1C,uEAAuE;AACvE,oEAAoE;AACpE,iEAAiE;AACjE,oDAAoD;AACpD,+DAA+D;AAM/D,8CAA8C;AAC9C,SAAS,QAAQ,CAAC,GAAuC;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,oBAAoB;AACpB,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,MAAM,KAAK,GAAa;QACtB,aAAa;QACb,gBAAgB;QAChB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAChB,sJAAsJ;KACvJ,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAC/B,MAAqB,EACrB,GAAW,EACX,IAAuB,EACvB,GAAuC;IAEvC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAAW,EACX,IAAuB,EACvB,GAAuB,EACvB,GAAuC;IAEvC,MAAM,CAAC,GAAa;QAClB,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO;QACP,MAAM;QACN,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM,EAAE,oDAAoD;QAC5D,eAAe,EAAE,mBAAmB;QACpC,mBAAmB;QACnB,eAAe;QACf,YAAY;KACb,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG;QAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,MAAqB,EACrB,GAAW,EACX,IAAuB,EACvB,GAAuB,EACvB,GAAuC;IAEvC,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@aalis/plugin-code-sandbox-os",
+  "version": "0.4.0",
+  "license": "MIT",
+  "description": "代码沙箱（OS 原生）：Linux bubblewrap / macOS sandbox-exec 隔离不可信代码执行",
+  "type": "module",
+  "keywords": [
+    "aalis",
+    "aalis-plugin"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@aalis/plugin-process-api": "^0.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "@aalis/core": "0.4.0",
+    "@aalis/plugin-code-sandbox-api": "0.4.0"
+  },
+  "peerDependencies": {
+    "@aalis/core": ">=0.2.0 <1.0.0"
+  },
+  "aalis": {
+    "service": {
+      "required": [
+        "process"
+      ],
+      "provides": [
+        "code-sandbox"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch"
+  }
+}