@agentbean/daemon 0.1.35 → 0.2.0

package/dist/index.js

@@ -1,368 +0,0 @@
-import { parseArgs } from 'node:util';
-import { pathToFileURL } from 'node:url';
-import { loadConfig, loadDeviceConfig } from './config.js';
-import { createConnection } from './connection.js';
-import { createDeviceDaemon } from './device-daemon.js';
-import { AgentInstance } from './agent-instance.js';
-import { pickAdapter } from './adapters/factory.js';
-import { logger } from './log.js';
-import { scanRuntimes, scanAgentOSAgents, scanLocalAgents, getDeviceId } from './scanner.js';
-import { listAuthProfiles, loadAuth, saveAuth } from './auth-store.js';
-import { deviceInstanceId, localAgentsDir, profileIdForNetwork } from './profile-paths.js';
-export function discoveredAgentId(name, deviceId) {
-    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-    return deviceId ? `scan-${deviceId}-${slug}` : slug;
-}
-async function discoverAgents(deviceId, profileId) {
-    const [_runtimes, agentos, local] = await Promise.all([
-        scanRuntimes(),
-        scanAgentOSAgents(),
-        scanLocalAgents(profileId ? localAgentsDir(profileId) : undefined),
-    ]);
-    const seen = new Set();
-    const results = [];
-    for (const s of [...agentos, ...local]) {
-        if (seen.has(s.command))
-            continue;
-        seen.add(s.command);
-        results.push({
-            id: discoveredAgentId(s.name, deviceId),
-            name: s.name,
-            role: s.category === 'executor-hosted' ? 'executor-agent' : 'gateway-agent',
-            category: s.category,
-            adapter: {
-                kind: s.adapterKind,
-                command: s.command,
-                args: s.args,
-                cwd: s.cwd,
-            },
-            visibility: 'public',
-        });
-    }
-    logger.info({ discovered: results.map((r) => r.name) }, 'agents discovered via scanning');
-    return results;
-}
-async function startDeviceDaemon(cfg) {
-    const agents = new Map();
-    for (const entry of cfg.agents) {
-        const adapter = pickAdapter(entry.adapter);
-        const instance = new AgentInstance(entry, adapter);
-        agents.set(entry.id, instance);
-        logger.info({ id: entry.id, kind: entry.adapter.kind, visibility: entry.visibility }, 'agent instance created');
-    }
-    logger.info({ deviceId: cfg.deviceId, agentCount: agents.size }, 'device daemon starting');
-    const daemon = createDeviceDaemon(cfg, agents);
-    await daemon.start();
-    const shutdown = async (signal) => {
-        logger.info({ signal }, 'shutting down device daemon');
-        await daemon.stop();
-        process.exit(0);
-    };
-    process.on('SIGINT', () => shutdown('SIGINT'));
-    process.on('SIGTERM', () => shutdown('SIGTERM'));
-}
-async function buildCliDeviceConfig(input) {
-    const machineId = input.machineId ?? await getDeviceId();
-    const deviceId = input.explicitDeviceId ?? deviceInstanceId(machineId, input.networkId);
-    logger.info({ serverUrl: input.serverUrl, deviceId, machineId, networkId: input.networkId, profileId: input.profileId }, 'CLI mode: auto-discovering agents');
-    const agents = await discoverAgents(deviceId, input.profileId);
-    if (agents.length === 0) {
-        logger.warn('no agents discovered on this machine. Daemon will start with no agents.');
-    }
-    return {
-        deviceId,
-        machineId,
-        profileId: input.profileId,
-        networkId: input.networkId,
-        server: { url: input.serverUrl, token: input.token },
-        heartbeatIntervalMs: 10_000,
-        agents,
-    };
-}
-async function runDeviceMode(cfgPath) {
-    let cfg;
-    let scannedEntries;
-    try {
-        cfg = loadDeviceConfig(cfgPath);
-    }
-    catch (err) {
-        const shouldScan = err.message?.includes('agents array is required');
-        if (!shouldScan)
-            throw err;
-        let fileSettings = {};
-        try {
-            const { readFileSync } = await import('node:fs');
-            const { load: parseYaml } = await import('js-yaml');
-            const raw = parseYaml(readFileSync(cfgPath, 'utf8'));
-            fileSettings = {
-                deviceId: raw.deviceId,
-                networkId: raw.networkId,
-                server: raw.server,
-                heartbeatIntervalMs: raw.heartbeatIntervalMs,
-            };
-        }
-        catch { /* ignore */ }
-        const deviceId = fileSettings.deviceId ?? process.env.DEVICE_ID ?? await getDeviceId();
-        scannedEntries = await discoverAgents(deviceId);
-        if (scannedEntries.length === 0) {
-            throw new Error('device config missing and no agents discovered via scanning');
-        }
-        cfg = {
-            deviceId,
-            networkId: fileSettings.networkId ?? process.env.NETWORK_ID ?? 'default',
-            server: fileSettings.server ?? {
-                url: process.env.SERVER_URL ?? 'http://localhost:3000/agent',
-                token: process.env.SERVER_TOKEN ?? '',
-            },
-            heartbeatIntervalMs: fileSettings.heartbeatIntervalMs ?? 10_000,
-            agents: scannedEntries,
-        };
-    }
-    if (cfg.scan === true) {
-        scannedEntries = await discoverAgents(cfg.deviceId);
-        if (scannedEntries.length > 0) {
-            cfg = { ...cfg, agents: scannedEntries };
-        }
-    }
-    await startDeviceDaemon(cfg);
-}
-async function runSingleAgentMode(cfgPath) {
-    const cfg = loadConfig(cfgPath);
-    const adapter = pickAdapter(cfg.adapter);
-    logger.info({ id: cfg.id, kind: cfg.adapter.kind }, 'agent daemon starting (single-agent mode)');
-    const conn = createConnection(cfg, adapter);
-    await conn.start();
-    const shutdown = async (signal) => {
-        logger.info({ signal }, 'shutting down');
-        await conn.stop();
-        process.exit(0);
-    };
-    process.on('SIGINT', () => shutdown('SIGINT'));
-    process.on('SIGTERM', () => shutdown('SIGTERM'));
-}
-async function runCliMode() {
-    const { values } = parseArgs({
-        options: {
-            'server-url': { type: 'string' },
-            'token': { type: 'string' },
-            'invite': { type: 'string' },
-            'device-id': { type: 'string' },
-            'network-id': { type: 'string' },
-            'profile': { type: 'string' },
-            'all-profiles': { type: 'boolean' },
-            'help': { type: 'boolean' },
-        },
-        strict: true,
-    });
-    if (values.help) {
-        console.log(`Usage: agentbean-daemon --server-url <url> --token <token> [--device-id <id>] [--network-id <id>] [--profile <id>]
-
-Options:
-  --server-url   AgentBean Server URL (required)
-  --token        Authentication token (required)
-  --device-id    Device ID (default: auto-detected from hardware)
-  --network-id   Team ID (default: default)
-  --profile      Team profile for local auth/cache isolation
-  --all-profiles Start one connection for every saved team profile
-`);
-        process.exit(0);
-    }
-    if (values['all-profiles']) {
-        const profiles = listAuthProfiles();
-        if (profiles.length === 0) {
-            console.error('Error: no saved AgentBean team profiles found.');
-            process.exit(1);
-        }
-        const machineId = values['device-id'] ?? await getDeviceId();
-        const configs = await Promise.all(profiles.map((profile) => buildCliDeviceConfig({
-            serverUrl: profile.serverUrl,
-            token: profile.token,
-            networkId: profile.networkId ?? networkIdFromToken(profile.token) ?? 'default',
-            machineId,
-            profileId: profile.profileId,
-        })));
-        await Promise.all(configs.map((cfg) => startDeviceDaemon(cfg)));
-        return;
-    }
-    let serverUrl = values['server-url'] ?? process.env.AGENT_BEAN_SERVER_URL;
-    let token = values['token'] ?? process.env.AGENT_BEAN_AGENT_TOKEN;
-    let savedAuth = null;
-    let networkId = values['network-id'] ?? 'default';
-    let profileId = values.profile ?? process.env.AGENTBEAN_PROFILE;
-    if (values.invite) {
-        if (!serverUrl) {
-            console.error('Error: --server-url is required with --invite.');
-            process.exit(1);
-        }
-        const machineId = values['device-id'] ?? await getDeviceId();
-        const auth = await runInviteMode(serverUrl, values.invite, machineId);
-        serverUrl = auth.serverUrl;
-        token = auth.token;
-        networkId = auth.networkId ?? networkId;
-        profileId = profileId ?? profileIdForNetwork(networkId);
-        saveAuth(auth, { profileId });
-    }
-    else if (!token) {
-        savedAuth = loadAuth({ profileId });
-        if (savedAuth) {
-            serverUrl = serverUrl ?? savedAuth.serverUrl;
-            token = savedAuth.token;
-        }
-    }
-    if (!serverUrl || !token) {
-        console.error('Error: --server-url and --token are required.');
-        console.error('Usage: agentbean-daemon --server-url <url> --token <token>');
-        process.exit(1);
-    }
-    const tokenNetworkId = networkIdFromToken(token);
-    if (values['network-id'] && tokenNetworkId && values['network-id'] !== tokenNetworkId) {
-        console.error('Error: --network-id does not match the provided token.');
-        console.error('Use the team ID embedded in the token, or omit --network-id and let the daemon detect it.');
-        process.exit(1);
-    }
-    networkId = resolveCliNetworkId({
-        explicitNetworkId: values['network-id'],
-        token,
-        savedNetworkId: savedAuth?.networkId,
-        fallbackNetworkId: networkId,
-    });
-    profileId = profileId ?? profileIdForNetwork(networkId);
-    const machineId = values['device-id'] ?? await getDeviceId();
-    const cfg = await buildCliDeviceConfig({
-        serverUrl,
-        token,
-        networkId,
-        machineId,
-        explicitDeviceId: values['device-id'] ? values['device-id'] : undefined,
-        profileId,
-    });
-    await startDeviceDaemon(cfg);
-}
-function normalizeBaseUrl(serverUrl) {
-    return serverUrl.replace(/\/agent\/?$/, '').replace(/\/web\/?$/, '');
-}
-function normalizeAgentUrl(serverUrl) {
-    const base = normalizeBaseUrl(serverUrl);
-    return `${base}/agent`;
-}
-export function networkIdFromToken(token) {
-    const parts = String(token ?? '').split(':');
-    if (parts.length !== 3)
-        return undefined;
-    const networkId = parts[1]?.trim();
-    return networkId || undefined;
-}
-export function resolveCliNetworkId(input) {
-    return input.explicitNetworkId
-        ?? networkIdFromToken(input.token)
-        ?? input.savedNetworkId
-        ?? input.fallbackNetworkId
-        ?? 'default';
-}
-export const INVITE_CONNECTION_TIMEOUT_MS = 20_000;
-export function createInviteSocketOptions() {
-    return {
-        auth: { invite: true },
-        reconnection: false,
-        timeout: INVITE_CONNECTION_TIMEOUT_MS,
-    };
-}
-export function socketErrorMessage(err) {
-    const details = [
-        err?.message,
-        err?.description?.message,
-        err?.context?.statusText?.code,
-        err?.context?.statusText?.message,
-        err?.context?.responseText,
-    ]
-        .filter((value) => typeof value === 'string' && value.trim())
-        .map((value) => value.trim());
-    return [...new Set(details)].join(': ') || 'unknown socket error';
-}
-async function runInviteMode(serverUrl, inviteCode, deviceId) {
-    const { io } = await import('socket.io-client');
-    const { execFile } = await import('node:child_process');
-    const baseUrl = normalizeBaseUrl(serverUrl);
-    const webSocketUrl = `${baseUrl}/web`;
-    console.log(`Connecting to AgentBean at ${baseUrl}...`);
-    logger.info({ serverUrl: baseUrl, inviteCode }, 'invite mode: connecting to server');
-    const socket = io(webSocketUrl, createInviteSocketOptions());
-    return new Promise((resolve, reject) => {
-        let connectTimer;
-        const fail = (err) => {
-            clearTimeout(connectTimer);
-            socket.disconnect();
-            reject(err);
-        };
-        connectTimer = setTimeout(() => {
-            fail(new Error(`connection timed out after 20s. Check network access to ${baseUrl} and try again.`));
-        }, INVITE_CONNECTION_TIMEOUT_MS);
-        socket.on('connect_error', (err) => {
-            const message = socketErrorMessage(err);
-            logger.error({ err: message }, 'invite mode: connection failed');
-            fail(new Error(`connection failed: ${message}`));
-        });
-        socket.on('connect', () => {
-            clearTimeout(connectTimer);
-            logger.info('invite mode: connected, validating invite code');
-            console.log('Connected. Validating invite code...');
-            socket.emit('auth:invite:validate', { code: inviteCode, deviceId }, (res) => {
-                if (!res?.ok) {
-                    fail(new Error(res?.error ?? 'invalid invite code'));
-                    return;
-                }
-                const registerUrl = res.registerUrl;
-                logger.info({ registerUrl }, 'invite mode: opening browser');
-                console.log(`\nOpen this URL to finish joining AgentBean:\n${registerUrl}\n`);
-                execFile('open', [registerUrl], (err) => {
-                    if (err) {
-                        logger.info({ registerUrl }, 'invite mode: could not open browser automatically');
-                    }
-                });
-                console.log('Waiting for registration to complete...');
-            });
-        });
-        socket.on('auth:token:deliver', (payload) => {
-            if (!payload?.token)
-                return;
-            const auth = {
-                token: payload.token,
-                serverUrl: normalizeAgentUrl(serverUrl),
-                userId: payload.userId,
-                networkId: payload.networkId,
-            };
-            logger.info({ networkId: auth.networkId }, 'invite mode: token received and saved');
-            console.log('Registration complete! Starting daemon...');
-            socket.disconnect();
-            resolve(auth);
-        });
-    });
-}
-export async function main() {
-    // Check for CLI flags first (npx mode)
-    const hasCliFlags = process.argv.some((a) => a === '--server-url' || a === '--token' || a === '--invite' || a === '--profile' || a === '--all-profiles' || a === '--help');
-    if (hasCliFlags) {
-        await runCliMode();
-        return;
-    }
-    // Fallback: YAML config mode
-    const cfgPath = process.env.DEVICE_CONFIG ?? process.env.AGENT_CONFIG ?? './agent.config.yaml';
-    try {
-        await runDeviceMode(cfgPath);
-    }
-    catch (deviceErr) {
-        if (deviceErr.message?.includes('deviceId') || deviceErr.message?.includes('agents')) {
-            logger.info({ reason: deviceErr.message }, 'not a device config, falling back to single-agent mode');
-            await runSingleAgentMode(cfgPath);
-        }
-        else {
-            throw deviceErr;
-        }
-    }
-}
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-    main().catch((err) => {
-        console.error('fatal:', err.message);
-        process.exit(1);
-    });
-}

package/dist/log.js

@@ -1,7 +0,0 @@
-import pino from 'pino';
-export const logger = pino({
-    level: process.env.LOG_LEVEL ?? 'info',
-    transport: process.env.NODE_ENV === 'production'
-        ? undefined
-        : { target: 'pino-pretty', options: { colorize: true } },
-});

package/dist/post-process.js

@@ -1,177 +0,0 @@
-import { readdirSync, realpathSync, statSync, existsSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
-import { logger } from './log.js';
-const CODE_BLOCK_RE = /```python\n([\s\S]*?)```/g;
-const CODEX_IMG_DIR = join(homedir(), '.codex', 'generated_images');
-const OUTPUT_FILE_EXT_RE = /\.(png|jpe?g|gif|webp|svg|pdf|txt|csv|json|md|mp4|mov|zip)$/i;
-const IGNORED_OUTPUT_DIRS = new Set([
-    '.git',
-    '.hg',
-    '.svn',
-    '.cache',
-    '.next',
-    '.nuxt',
-    '.turbo',
-    'node_modules',
-    'vendor',
-]);
-const MAX_OUTPUT_FILES_PER_ROOT = 2000;
-const OUTPUT_DIR_ENV = 'AGENT_BEAN_OUTPUT_DIRS';
-export function listAllFiles(dir, maxDepth = 10, depth = 0) {
-    if (!existsSync(dir) || depth > maxDepth)
-        return [];
-    const results = [];
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-        const full = join(dir, entry.name);
-        if (entry.isSymbolicLink())
-            continue;
-        if (entry.isDirectory()) {
-            if (IGNORED_OUTPUT_DIRS.has(entry.name))
-                continue;
-            results.push(...listAllFiles(full, maxDepth, depth + 1));
-        }
-        else
-            results.push(full);
-        if (results.length >= MAX_OUTPUT_FILES_PER_ROOT)
-            break;
-    }
-    return results;
-}
-function normalizeCandidatePath(raw) {
-    const cleaned = raw
-        .trim()
-        .replace(/^file:\/\//, '')
-        .replace(/^["'`<({\[]+/, '')
-        .replace(/["'`>)}\].,;:]+$/, '');
-    if (!cleaned || !OUTPUT_FILE_EXT_RE.test(cleaned))
-        return null;
-    return cleaned.replace(/^~(?=$|\/)/, homedir());
-}
-function extractMentionedFiles(reply, workspace, dispatchStart) {
-    const candidates = new Set();
-    const markdownLinkRe = /!?\[[^\]]*]\(([^)\s]+)\)/g;
-    const plainPathRe = /(?:^|[\s"'`(<:：])((?:~?\/|\.{1,2}\/)?[\w@%+=:,./-]+\.(?:png|jpe?g|gif|webp|svg|pdf|txt|csv|json|md|mp4|mov|zip))(?:$|[\s"'`)>.,;:：])/gim;
-    let match;
-    while ((match = markdownLinkRe.exec(reply)) !== null) {
-        const normalized = normalizeCandidatePath(match[1]);
-        if (normalized)
-            candidates.add(normalized);
-    }
-    while ((match = plainPathRe.exec(reply)) !== null) {
-        const normalized = normalizeCandidatePath(match[1]);
-        if (normalized)
-            candidates.add(normalized);
-    }
-    const files = [];
-    for (const candidate of candidates) {
-        const abs = isAbsolute(candidate) ? candidate : workspace ? resolve(workspace, candidate) : null;
-        if (!abs)
-            continue;
-        try {
-            const st = statSync(abs);
-            if (st.isFile())
-                files.push(abs);
-        }
-        catch { }
-    }
-    return files;
-}
-function outputDirsFromEnv() {
-    const raw = process.env[OUTPUT_DIR_ENV];
-    if (!raw?.trim())
-        return [];
-    return raw
-        .split(/[,:;]/)
-        .map((item) => item.trim())
-        .filter(Boolean);
-}
-function canonicalPath(path) {
-    try {
-        return realpathSync(path);
-    }
-    catch {
-        return path;
-    }
-}
-function resolveOutputRoots(workspace, outputDirs = [], includeWorkspace = false) {
-    const roots = new Set();
-    if (workspace && includeWorkspace)
-        roots.add(resolve(workspace));
-    for (const raw of [...outputDirs, ...outputDirsFromEnv()]) {
-        const expanded = raw.replace(/^~(?=$|\/)/, homedir());
-        const root = isAbsolute(expanded)
-            ? expanded
-            : workspace
-                ? resolve(workspace, expanded)
-                : resolve(expanded);
-        roots.add(root);
-    }
-    return [...roots].filter((root) => {
-        try {
-            return statSync(root).isDirectory();
-        }
-        catch {
-            return false;
-        }
-    });
-}
-function collectRecentOutputFiles(roots, dispatchStart) {
-    const files = new Set();
-    for (const root of roots) {
-        for (const filePath of listAllFiles(root, 8)) {
-            if (!OUTPUT_FILE_EXT_RE.test(filePath))
-                continue;
-            try {
-                const st = statSync(filePath);
-                if (st.isFile() && st.mtimeMs > dispatchStart) {
-                    files.add(canonicalPath(filePath));
-                }
-            }
-            catch { }
-        }
-    }
-    return [...files];
-}
-export async function postProcess(reply, workspace, kind, dispatchStart, options = {}) {
-    const outputFiles = new Set();
-    // Codex native image detection
-    if (kind === 'codex') {
-        const allCodexFiles = listAllFiles(CODEX_IMG_DIR, 4);
-        for (const f of allCodexFiles) {
-            if (!OUTPUT_FILE_EXT_RE.test(f))
-                continue;
-            try {
-                const st = statSync(f);
-                if (st.mtimeMs > dispatchStart) {
-                    outputFiles.add(canonicalPath(f));
-                }
-            }
-            catch { }
-        }
-    }
-    for (const filePath of extractMentionedFiles(reply, workspace, dispatchStart)) {
-        outputFiles.add(canonicalPath(filePath));
-    }
-    for (const filePath of collectRecentOutputFiles(resolveOutputRoots(workspace, options.outputDirs, options.scanWorkspace), dispatchStart)) {
-        outputFiles.add(filePath);
-    }
-    // Extract code blocks for logging but do NOT auto-execute (security)
-    if (workspace) {
-        const codeBlocks = [];
-        let m;
-        const re = new RegExp(CODE_BLOCK_RE.source, 'g');
-        while ((m = re.exec(reply)) !== null) {
-            codeBlocks.push(m[1]);
-        }
-        if (codeBlocks.length > 0) {
-            logger.info({ count: codeBlocks.length }, 'code blocks detected but not executed (auto-exec disabled)');
-        }
-    }
-    let replyText = reply;
-    const files = [...outputFiles];
-    if (files.length > 0) {
-        replyText += '\n\n已生成文件:\n' + files.map((f) => `- ${f}`).join('\n');
-    }
-    return { replyText, outputFiles: files };
-}

package/dist/profile-paths.js

@@ -1,39 +0,0 @@
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-export function agentbeanHome() {
-    return process.env.AGENTBEAN_HOME?.trim() || join(homedir(), '.agentbean');
-}
-export function profileIdForNetwork(networkId) {
-    const source = networkId?.trim() || 'default';
-    const slug = source.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-    return slug || 'default';
-}
-export function profileRoot(profileId) {
-    const explicitDir = process.env.AGENTBEAN_PROFILE_DIR?.trim();
-    if (explicitDir && profileId)
-        return explicitDir;
-    if (!profileId)
-        return agentbeanHome();
-    return join(agentbeanHome(), 'teams', profileIdForNetwork(profileId));
-}
-export function ensureProfileRoot(profileId) {
-    const root = profileRoot(profileId);
-    if (!existsSync(root))
-        mkdirSync(root, { recursive: true });
-    return root;
-}
-export function authFile(profileId) {
-    return join(profileRoot(profileId), 'auth.json');
-}
-export function scanCacheFile(profileId) {
-    return join(profileRoot(profileId), 'scanned-agents.json');
-}
-export function localAgentsDir(profileId) {
-    return join(profileRoot(profileId), 'agents');
-}
-export function deviceInstanceId(machineId, networkId) {
-    const hash = createHash('sha256').update(`${networkId}:${machineId}`).digest('hex');
-    return `dev_${hash.slice(0, 24)}`;
-}

package/dist/sandbox.js

@@ -1,53 +0,0 @@
-import { accessSync, constants, existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-function escapeSchemeString(value) {
-    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-}
-export function getWorkspaceDir(agentId) {
-    const dir = join(homedir(), '.agentbean', 'workspaces', agentId);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    return dir;
-}
-export function isSandboxAvailable() {
-    if (process.platform !== 'darwin')
-        return false;
-    try {
-        accessSync('/usr/bin/sandbox-exec', constants.X_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function generateSandboxProfile(agentId, runtimePath, writableDirs = []) {
-    const workspaceDir = getWorkspaceDir(agentId);
-    const runtimeDir = runtimePath.includes('/') ? dirname(runtimePath) : '/usr/bin';
-    const profilePath = `/tmp/agentbean-sandbox-${agentId}.sb`;
-    const extraWritableRules = writableDirs
-        .filter(Boolean)
-        .map((dir) => `(allow file-read* file-write*
-  (subpath "${escapeSchemeString(dir)}"))`)
-        .join('\n');
-    const profile = `(version 1)
-(allow file-read* file-write*
-  (subpath "${escapeSchemeString(workspaceDir)}"))
-(allow file-read* file-write*
-  (subpath "/tmp"))
-${extraWritableRules ? `${extraWritableRules}\n` : ''}(allow file-read*
-  (subpath "${escapeSchemeString(runtimeDir)}"))
-(allow file-read*
-  (subpath "/bin")
-  (subpath "/usr/bin")
-  (subpath "/usr/local/bin")
-  (subpath "/opt/homebrew/bin"))
-(allow network-outbound
-  (remote tcp "api.anthropic.com" 443))
-(allow network-outbound
-  (remote tcp "api.openai.com" 443))
-(deny default)
-`;
-    writeFileSync(profilePath, profile);
-    return profilePath;
-}