@agentqueue/worker 0.0.0 → 0.3.1-ci.g02c90ca5cd192c5a75a7d1d19329683cefb22d6e

package/dist/src/isolation.js

@@ -0,0 +1,690 @@
+import { accessSync, constants, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { chmod, copyFile, lstat, mkdir, open, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { createRequire } from "node:module";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { execFile, spawn, spawnSync } from "node:child_process";
+import { loadClaudeAuth, workerHome, workspacesPath } from "./config.js";
+const SAFE_ENVIRONMENT = new Set(["LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TERM", "TZ"]);
+const MODEL_ENVIRONMENT = {
+    codex: { openai: ["OPENAI_API_KEY"], azure: ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"] },
+    opencode: {
+        openai: ["OPENAI_API_KEY"],
+        anthropic: ["ANTHROPIC_API_KEY"],
+        openrouter: ["OPENROUTER_API_KEY"],
+        google: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+    },
+    pi: {
+        openai: ["OPENAI_API_KEY"],
+        anthropic: ["ANTHROPIC_API_KEY"],
+        openrouter: ["OPENROUTER_API_KEY"],
+        google: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+    },
+};
+const AUTH_PATHS = {
+    codex: [".codex/auth.json"],
+    opencode: [".local/share/opencode/auth.json"],
+    pi: [".pi/agent/auth.json"],
+};
+function stringValues(value) {
+    if (typeof value === "string")
+        return value.length >= 8 ? [value] : [];
+    if (Array.isArray(value))
+        return value.flatMap(stringValues);
+    if (value && typeof value === "object")
+        return Object.values(value).flatMap(stringValues);
+    return [];
+}
+export function localCredentialValues(harnessId) {
+    const values = [];
+    if (harnessId === "claude") {
+        const auth = loadClaudeAuth();
+        if (auth)
+            values.push(auth.value);
+    }
+    for (const relative of AUTH_PATHS[harnessId] ?? []) {
+        try {
+            const raw = readFileSync(join(homedir(), relative), "utf8");
+            try {
+                values.push(...stringValues(JSON.parse(raw)));
+            }
+            catch {
+                if (raw.trim().length >= 8)
+                    values.push(raw.trim());
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return [...new Set(values)];
+}
+export function credentialValuesFromFiles(paths) {
+    const values = [];
+    for (const path of paths) {
+        try {
+            const raw = readFileSync(path, "utf8");
+            try {
+                values.push(...stringValues(JSON.parse(raw)));
+            }
+            catch {
+                if (raw.trim().length >= 8)
+                    values.push(raw.trim());
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return [...new Set(values)];
+}
+function executable(command) {
+    const candidates = isAbsolute(command)
+        ? [command]
+        : (process.env.PATH ?? "")
+            .split(":")
+            .filter(Boolean)
+            .map((entry) => join(entry, command));
+    for (const candidate of candidates) {
+        try {
+            accessSync(candidate, constants.X_OK);
+            return realpathSync(candidate);
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error(`required executable ${command} is unavailable`);
+}
+function installationRoot(path) {
+    if (basename(dirname(path)) === ".bin")
+        return dirname(dirname(path));
+    const marker = `${process.platform === "win32" ? "\\" : "/"}bin${process.platform === "win32" ? "\\" : "/"}`;
+    const index = path.lastIndexOf(marker);
+    return index > 0 ? path.slice(0, index) : dirname(path);
+}
+export function installationRoots(path) {
+    const root = installationRoot(path);
+    const roots = new Set([root]);
+    const candidates = basename(root) === "node_modules" ? [] : [root, dirname(root)];
+    const pending = candidates.filter((directory) => existsSync(join(directory, "package.json"))).slice(0, 1);
+    const visited = new Set();
+    for (const directory of pending) {
+        const canonical = realpathSync(directory);
+        if (visited.has(canonical))
+            continue;
+        visited.add(canonical);
+        roots.add(canonical);
+        const manifestPath = join(canonical, "package.json");
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+        const require = createRequire(manifestPath);
+        for (const dependency of Object.keys({ ...manifest.dependencies, ...manifest.optionalDependencies })) {
+            if (!/^(?:@[A-Za-z0-9_.-]+\/)?[A-Za-z0-9_.-]+$/.test(dependency))
+                continue;
+            for (const lookup of require.resolve.paths(dependency) ?? []) {
+                const candidate = join(lookup, dependency);
+                if (!existsSync(join(candidate, "package.json")))
+                    continue;
+                roots.add(candidate);
+                pending.push(candidate);
+                break;
+            }
+        }
+    }
+    const marker = "/Cellar/";
+    const cellarIndex = root.indexOf(marker);
+    if (cellarIndex < 0)
+        return [...roots];
+    const prefix = root.slice(0, cellarIndex);
+    try {
+        const receipt = JSON.parse(readFileSync(join(root, "INSTALL_RECEIPT.json"), "utf8"));
+        for (const dependency of receipt.runtime_dependencies ?? []) {
+            if (typeof dependency.full_name !== "string")
+                continue;
+            const segments = dependency.full_name.split("/");
+            if (segments.length > 3 || segments.some((segment) => !/^[A-Za-z0-9][A-Za-z0-9@+_.-]*$/.test(segment))) {
+                continue;
+            }
+            const name = basename(dependency.full_name);
+            const candidate = join(prefix, "opt", name);
+            if (existsSync(candidate))
+                roots.add(candidate);
+        }
+    }
+    catch {
+        return [...roots];
+    }
+    return [...roots];
+}
+function macosDeveloperReadPaths() {
+    const selectionDirectory = "/private/var/select";
+    try {
+        const developer = realpathSync(join(selectionDirectory, "developer_dir"));
+        const marker = ".app/";
+        const appIndex = developer.indexOf(marker);
+        const toolchain = appIndex < 0 ? developer : developer.slice(0, appIndex + 4);
+        return [selectionDirectory, toolchain, join(tmpdir(), "xcrun_db")];
+    }
+    catch {
+        return [];
+    }
+}
+function shellValue(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function workerPackage(path) {
+    const cli = realpathSync(path);
+    let root = dirname(cli);
+    for (;;) {
+        const manifest = join(root, "package.json");
+        if (existsSync(manifest)) {
+            try {
+                const value = JSON.parse(readFileSync(manifest, "utf8"));
+                if (value.name === "@agentqueue/worker")
+                    return { cli, root };
+            }
+            catch {
+                return null;
+            }
+        }
+        const parent = dirname(root);
+        if (parent === root)
+            return null;
+        root = parent;
+    }
+}
+function workerCli() {
+    const candidates = [process.argv[1]];
+    try {
+        candidates.push(executable("aq"));
+    }
+    catch {
+        candidates.push(undefined);
+    }
+    for (const candidate of candidates) {
+        if (!candidate || !existsSync(candidate))
+            continue;
+        const resolved = workerPackage(candidate);
+        if (resolved)
+            return resolved;
+    }
+    throw new Error("Agent Queue broker CLI is unavailable");
+}
+function modelProvider(model) {
+    if (!model)
+        return undefined;
+    const provider = model.split("/", 1)[0]?.toLowerCase();
+    if (provider?.includes("claude"))
+        return "anthropic";
+    if (provider?.includes("gemini"))
+        return "google";
+    if (provider?.includes("gpt") || provider?.includes("o1") || provider?.includes("o3"))
+        return "openai";
+    return provider;
+}
+export function childEnvironment(workspace, harness, values) {
+    const environment = {
+        PATH: `${dirname(realpathSync(process.execPath))}:${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}`,
+        HOME: join(workspace, ".aq-home"),
+        TMPDIR: join(workspace, ".aq-tmp"),
+        GIT_CONFIG_GLOBAL: "/dev/null",
+        GIT_CONFIG_NOSYSTEM: "1",
+        GIT_TERMINAL_PROMPT: "0",
+    };
+    for (const key of SAFE_ENVIRONMENT)
+        if (process.env[key])
+            environment[key] = process.env[key];
+    if (harness) {
+        if (harness.id === "claude") {
+            const auth = loadClaudeAuth();
+            if (auth)
+                environment[auth.name] = auth.value;
+        }
+        else {
+            let provider = modelProvider(harness.model);
+            if (!provider && harness.id === "codex")
+                provider = "openai";
+            const permitted = provider ? (MODEL_ENVIRONMENT[harness.id]?.[provider] ?? []) : [];
+            for (const key of permitted)
+                if (process.env[key])
+                    environment[key] = process.env[key];
+        }
+    }
+    const result = { ...environment, ...values };
+    if (harness?.id === "claude")
+        result.CLAUDE_CODE_TMPDIR = result.TMPDIR;
+    return result;
+}
+function managerEnvironmentNames() {
+    const result = spawnSync("systemctl", ["--user", "show-environment"], { encoding: "utf8" });
+    if (result.status !== 0)
+        return Object.keys(process.env);
+    return result.stdout
+        .split("\n")
+        .map((entry) => entry.slice(0, entry.indexOf("=")))
+        .filter(Boolean);
+}
+function environmentFileValue(environment) {
+    return Object.entries(environment)
+        .filter((entry) => typeof entry[1] === "string")
+        .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
+        .join("\n");
+}
+export async function stopIsolatedUnit(unit) {
+    if (!/^aq-worker-[1-9][0-9]*-[0-9a-f]{12}$/.test(unit))
+        throw new Error("Invalid isolated worker unit identity");
+    const execute = (args) => new Promise((done) => {
+        execFile("systemctl", ["--user", ...args], { timeout: 10000, maxBuffer: 65536 }, (error, stdout) => done({ stdout, failed: Boolean(error) }));
+    });
+    await execute(["stop", unit]);
+    const status = await execute(["show", unit, "--property=ActiveState", "--property=LoadState"]);
+    if (!/^(?:ActiveState=(?:inactive|failed)|LoadState=not-found)$/m.test(status.stdout))
+        throw new Error("Isolated worker process cessation is unconfirmed");
+}
+async function watchIsolatedUnit(unit, marker) {
+    const environment = {
+        PATH: "/usr/local/bin:/usr/bin:/bin",
+        ...(process.env.XDG_RUNTIME_DIR ? { XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR } : {}),
+        ...(process.env.DBUS_SESSION_BUS_ADDRESS ? { DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS } : {}),
+    };
+    const monitor = spawn(executable("systemd-run"), [
+        "--user",
+        "--pipe",
+        "--wait",
+        "--collect",
+        "--quiet",
+        "--service-type=exec",
+        `--unit=${unit}-watchdog`,
+        "--property=KillMode=control-group",
+        "--property=TimeoutStopSec=5",
+        process.execPath,
+        "--input-type=module",
+        "-e",
+        `
+import { execFile } from "node:child_process";
+import { rmSync } from "node:fs";
+process.stdin.resume();
+process.stdin.once("end", () => {
+  rmSync(process.argv[2], { force: true });
+  execFile("systemctl", ["--user", "stop", process.argv[1]], { timeout: 10000 }, () => process.exit(0));
+});
+process.stdout.write("ready");
+`,
+        unit,
+        marker,
+    ], { env: environment, stdio: ["pipe", "pipe", "ignore"] });
+    monitor.stdin.on("error", () => undefined);
+    let released = false;
+    monitor.once("exit", () => {
+        if (!released)
+            void rm(marker, { force: true })
+                .then(() => stopIsolatedUnit(unit))
+                .catch(() => undefined);
+    });
+    await new Promise((done, reject) => {
+        monitor.once("error", reject);
+        monitor.once("exit", () => reject(new Error("Worker process watchdog stopped before startup")));
+        monitor.stdout.once("data", () => done());
+    });
+    return async () => {
+        released = true;
+        monitor.stdin.end();
+        if (monitor.exitCode === null && monitor.signalCode === null)
+            await new Promise((done) => monitor.once("exit", () => done()));
+    };
+}
+async function saveIsolatedUnit(unit, cleanup, directory = join(workerHome(), "active-units")) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, `${unit}.json`);
+    const file = await open(path, "wx", 0o600);
+    try {
+        await file.writeFile(JSON.stringify({ unit, parentPid: process.pid, cleanup }));
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    return path;
+}
+export async function recoverIsolatedUnits(options = {}) {
+    if (process.platform !== "linux")
+        return;
+    const directory = options.directory ?? join(workerHome(), "active-units");
+    const names = await readdir(directory).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    for (const name of names) {
+        if (!/^aq-worker-[1-9][0-9]*-[0-9a-f]{12}\.json$/.test(name))
+            continue;
+        const path = join(directory, name);
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (value.unit !== name.slice(0, -5) || !Number.isSafeInteger(value.parentPid) || value.parentPid < 1)
+            throw new Error("Invalid isolated worker process journal");
+        try {
+            process.kill(value.parentPid, 0);
+            throw new Error("Another worker still owns an isolated process; stop it before starting this worker");
+        }
+        catch (error) {
+            if (error.code !== "ESRCH")
+                throw error;
+        }
+        if (!Array.isArray(value.cleanup) ||
+            value.cleanup.some((path) => typeof path !== "string" ||
+                !resolve(path).startsWith(`${resolve(options.workspaceRoot ?? workspacesPath())}/`)))
+            throw new Error("Invalid isolated worker cleanup paths");
+        await stopIsolatedUnit(value.unit);
+        await options.onCessation?.(value.unit);
+        for (const target of value.cleanup)
+            await rm(target, { recursive: true, force: true });
+        await rm(path, { force: true });
+    }
+}
+export function isolationStatus() {
+    if (process.platform === "linux") {
+        const result = spawnSync("systemd-run", [
+            "--user",
+            "--wait",
+            "--collect",
+            "--quiet",
+            "--property",
+            "PrivateUsers=yes",
+            "--property",
+            "ProtectHome=tmpfs",
+            "--property",
+            "ProtectSystem=strict",
+            "--property",
+            "TemporaryFileSystem=/run",
+            "/bin/true",
+        ], { stdio: "ignore" });
+        return {
+            ready: result.status === 0,
+            guidance: "A systemd user manager with filesystem sandboxing is required.",
+        };
+    }
+    if (process.platform === "darwin") {
+        try {
+            executable("sandbox-exec");
+            return { ready: true, guidance: "" };
+        }
+        catch {
+            return { ready: false, guidance: "macOS sandbox-exec is required." };
+        }
+    }
+    return { ready: false, guidance: `Workflow process isolation is unavailable on ${process.platform}.` };
+}
+function sandboxPathValues(paths) {
+    const resolved = paths.flatMap((path) => {
+        const lexical = resolve(path);
+        try {
+            return [lexical, realpathSync(lexical)];
+        }
+        catch {
+            return [lexical];
+        }
+    });
+    return [...new Set(resolved)];
+}
+function sandboxPaths(paths) {
+    return sandboxPathValues(paths)
+        .map((path) => `(subpath ${JSON.stringify(path)})`)
+        .join(" ");
+}
+export function macosSandboxProfile(readablePaths, writablePaths, skillRoot) {
+    const readable = sandboxPaths(readablePaths);
+    const writable = sandboxPaths(writablePaths);
+    return [
+        "(version 1)",
+        "(deny default)",
+        "(allow process-exec)",
+        "(allow process-fork)",
+        "(allow process-info* (target same-sandbox))",
+        "(allow signal (target same-sandbox))",
+        "(allow sysctl-read)",
+        '(allow sysctl-write (sysctl-name "kern.grade_cputype"))',
+        '(allow iokit-open (iokit-registry-entry-class "RootDomainUserClient"))',
+        "(allow ipc-posix-sem)",
+        '(allow ipc-posix-shm-read-data ipc-posix-shm-write-create ipc-posix-shm-write-unlink (ipc-posix-name-regex #"^/__KMP_REGISTERED_LIB_[0-9]+$"))',
+        "(allow pseudo-tty)",
+        '(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))',
+        '(allow file-read* file-write* (require-all (regex #"^/dev/ttys[0-9]+") (extension "com.apple.sandbox.pty")))',
+        '(allow file-ioctl (regex #"^/dev/ttys[0-9]+"))',
+        '(allow file-read* file-test-existence (literal "/dev/random") (literal "/dev/urandom"))',
+        '(allow file-read* file-test-existence file-write-data (literal "/dev/null") (literal "/dev/zero"))',
+        '(allow file-read-data file-test-existence file-write-data (subpath "/dev/fd"))',
+        '(allow file-read-data (literal "/"))',
+        '(allow file-read-metadata (literal "/etc"))',
+        '(allow file-read-metadata (literal "/tmp"))',
+        '(allow file-read-metadata (literal "/var"))',
+        "(allow mach-lookup)",
+        '(deny mach-lookup (global-name "com.apple.securityd") (global-name "com.apple.securityd.xpc"))',
+        "(allow network*)",
+        "(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))",
+        `(allow file-read* file-test-existence ${readable})`,
+        `(allow file-map-executable ${readable})`,
+        `(allow file-write* ${writable})`,
+        ...sandboxPathValues([skillRoot]).map((path) => `(deny file-write* (subpath ${JSON.stringify(path)}))`),
+    ].join(" ");
+}
+async function privateCredentialDirectory(root, segments) {
+    const existing = await lstat(root).catch((error) => {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    });
+    if (existing?.isSymbolicLink() || (existing && !existing.isDirectory()))
+        throw new Error("Credential home must be a private directory");
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    let directory = root;
+    for (const segment of segments) {
+        directory = join(directory, segment);
+        await mkdir(directory, { mode: 0o700 }).catch((error) => {
+            if (error.code !== "EEXIST")
+                throw error;
+        });
+        const info = await lstat(directory);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("Credential directory contains a symlink");
+    }
+    return directory;
+}
+export async function isolate(command, args, workspace, workingDirectory, environment, harnessId, brokerAccess = true, writablePaths = [], copyModelAuth = true, isolationOptions = {}) {
+    const resolvedCommand = executable(command);
+    const sandboxHome = resolve(environment.HOME ?? join(workspace, ".aq-home"));
+    const sandboxTmp = resolve(environment.TMPDIR ?? join(workspace, ".aq-tmp"));
+    const skillRoot = join(sandboxHome, ".agents", "skills");
+    const broker = harnessId && brokerAccess ? workerCli() : null;
+    const brokerBin = broker ? join(sandboxHome, ".aq-bin") : null;
+    const credentialDirectory = resolve(workerHome());
+    const roots = new Set([...installationRoots(resolvedCommand), ...installationRoots(realpathSync(process.execPath))]);
+    for (const path of isolationOptions.readOnlyPaths ?? [])
+        roots.add(resolve(path));
+    if (broker) {
+        roots.add(broker.root);
+        for (const root of installationRoots(broker.cli))
+            roots.add(root);
+    }
+    const canonicalPaths = (paths) => paths.flatMap((path) => (existsSync(path) ? [resolve(path), realpathSync(path)] : [resolve(path)]));
+    const ownerHomes = canonicalPaths([homedir()]);
+    const privatePaths = canonicalPaths([
+        credentialDirectory,
+        workspacesPath(),
+        workspace,
+        ...Object.values(AUTH_PATHS).flatMap((paths) => paths.map((path) => dirname(join(homedir(), path)))),
+        ...[".ssh", ".aws", ".claude", ".config/gh", ".config/gcloud"].map((path) => join(homedir(), path)),
+    ]);
+    for (const root of roots) {
+        for (const path of new Set([resolve(root), realpathSync(root)])) {
+            if (["/", "/tmp", "/var/tmp", "/home", "/root", "/run"].includes(path) ||
+                path.startsWith("/run/") ||
+                ownerHomes.some((home) => home === path || home.startsWith(`${path}/`)) ||
+                privatePaths.some((privatePath) => privatePath === path || privatePath.startsWith(`${path}/`) || path.startsWith(`${privatePath}/`)))
+                throw new Error("Runtime installation must be separate from private worker data and workspaces");
+        }
+    }
+    const invocationEnvironment = { ...environment };
+    await Promise.all([
+        privateCredentialDirectory(sandboxHome, []),
+        privateCredentialDirectory(sandboxTmp, []),
+        ...(brokerBin ? [privateCredentialDirectory(sandboxHome, [".aq-bin"])] : []),
+    ]);
+    if (broker && brokerBin) {
+        await writeFile(join(brokerBin, "aq"), `#!/bin/sh\n[ "$1" = "broker" ] || exit 64\nshift\nexec ${shellValue(realpathSync(process.execPath))} ${shellValue(broker.cli)} broker "$@"\n`, { mode: 0o700 });
+        invocationEnvironment.PATH = `${brokerBin}:${invocationEnvironment.PATH ?? "/usr/local/bin:/usr/bin:/bin"}`;
+    }
+    const copiedAuth = [];
+    for (const relative of harnessId && copyModelAuth ? (AUTH_PATHS[harnessId] ?? []) : []) {
+        const source = join(homedir(), relative);
+        if (!existsSync(source) || statSync(source).isDirectory())
+            continue;
+        const target = harnessId === "codex" && invocationEnvironment.CODEX_HOME
+            ? join(invocationEnvironment.CODEX_HOME, "auth.json")
+            : join(sandboxHome, relative);
+        const credentialRoot = harnessId === "codex" && invocationEnvironment.CODEX_HOME ? invocationEnvironment.CODEX_HOME : sandboxHome;
+        const relativeParts = harnessId === "codex" && invocationEnvironment.CODEX_HOME ? [] : relative.split("/").slice(0, -1);
+        await privateCredentialDirectory(credentialRoot, relativeParts);
+        await rm(target, { force: true });
+        await copyFile(source, target, constants.COPYFILE_EXCL);
+        await chmod(target, 0o600);
+        copiedAuth.push(target);
+    }
+    if (process.platform === "linux") {
+        const systemdRun = executable("systemd-run");
+        const unit = `aq-worker-${process.pid}-${randomBytes(6).toString("hex")}`;
+        const environmentPath = join(dirname(workspace), `.${unit}.env`);
+        await writeFile(environmentPath, `${environmentFileValue(invocationEnvironment)}\n`, { mode: 0o600 });
+        const guardDirectory = join(dirname(workspace), `.${unit}.guard`);
+        const marker = join(guardDirectory, "owner");
+        await mkdir(guardDirectory, { mode: 0o700 });
+        await writeFile(marker, "alive", { mode: 0o600 });
+        const properties = [
+            "ProtectHome=tmpfs",
+            "ProtectSystem=strict",
+            "TemporaryFileSystem=/run",
+            ...(existsSync("/etc/resolv.conf") ? [`BindReadOnlyPaths=${realpathSync("/etc/resolv.conf")}`] : []),
+            `TemporaryFileSystem=${dirname(workspace)}`,
+            ...(isolationOptions.maskedDirectories ?? []).map((path) => `TemporaryFileSystem=${resolve(path)}`),
+            "KillMode=control-group",
+            "TimeoutStopSec=5",
+            "SendSIGKILL=yes",
+            `BindReadOnlyPaths=${guardDirectory}`,
+            `ExecStartPre=/usr/bin/test -e ${JSON.stringify(marker)}`,
+            `BindPaths=${workspace}`,
+            ...(sandboxHome.startsWith(`${workspace}/`) ? [] : [`BindPaths=${sandboxHome}`]),
+            ...(sandboxTmp.startsWith(`${workspace}/`) || sandboxTmp.startsWith(`${sandboxHome}/`)
+                ? []
+                : [`BindPaths=${sandboxTmp}`]),
+            ...writablePaths.map((path) => `BindPaths=${resolve(path)}`),
+            "PrivateTmp=yes",
+            "PrivateDevices=yes",
+            "PrivateUsers=yes",
+            "ProtectProc=invisible",
+            "ProcSubset=pid",
+            "NoNewPrivileges=yes",
+            "RestrictNamespaces=yes",
+            "ProtectKernelTunables=yes",
+            "ProtectKernelModules=yes",
+            "ProtectKernelLogs=yes",
+            "ProtectControlGroups=yes",
+            "ProtectClock=yes",
+            "RestrictSUIDSGID=yes",
+            "LockPersonality=yes",
+            "RemoveIPC=yes",
+            "CapabilityBoundingSet=",
+            "UMask=0077",
+            "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+            "IPAddressDeny=link-local",
+            "IPAddressDeny=multicast",
+            `EnvironmentFile=${environmentPath}`,
+            `UnsetEnvironment=${managerEnvironmentNames()
+                .filter((name) => !(name in invocationEnvironment))
+                .join(" ")}`,
+        ];
+        for (const path of canonicalPaths([credentialDirectory, ...(isolationOptions.protectedPaths ?? [])]))
+            properties.push(`InaccessiblePaths=-${path}`);
+        for (const root of roots) {
+            const source = realpathSync(root);
+            const target = resolve(root);
+            properties.push(`BindReadOnlyPaths=${source === target ? source : `${source}:${target}`}`);
+        }
+        if (existsSync(skillRoot))
+            properties.push(`ReadOnlyPaths=${skillRoot}`);
+        const cleanupPaths = [environmentPath, guardDirectory, ...(brokerBin ? [brokerBin] : []), ...copiedAuth];
+        const journal = await saveIsolatedUnit(unit, cleanupPaths, isolationOptions.journalDirectory);
+        const stopWatchdog = await watchIsolatedUnit(unit, marker);
+        return {
+            executablePath: resolvedCommand,
+            command: systemdRun,
+            args: [
+                "--user",
+                "--wait",
+                "--pipe",
+                "--collect",
+                "--quiet",
+                `--unit=${unit}`,
+                `--working-directory=${workingDirectory}`,
+                ...properties.flatMap((property) => ["--property", property]),
+                resolvedCommand,
+                ...args,
+            ],
+            env: {
+                PATH: "/usr/local/bin:/usr/bin:/bin",
+                LANG: process.env.LANG ?? "C.UTF-8",
+                ...(process.env.XDG_RUNTIME_DIR ? { XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR } : {}),
+                ...(process.env.DBUS_SESSION_BUS_ADDRESS
+                    ? { DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS }
+                    : {}),
+            },
+            unit,
+            credentialFiles: copiedAuth,
+            cleanup: async () => {
+                await stopIsolatedUnit(unit);
+                await stopWatchdog();
+                await isolationOptions.onCessation?.(unit);
+                await rm(journal, { force: true });
+                await Promise.all([
+                    rm(environmentPath, { force: true }),
+                    rm(guardDirectory, { recursive: true, force: true }),
+                    ...(brokerBin ? [rm(brokerBin, { recursive: true, force: true })] : []),
+                    ...copiedAuth.map((path) => rm(path, { force: true })),
+                ]);
+            },
+        };
+    }
+    if (process.platform === "darwin") {
+        const sandboxExec = executable("sandbox-exec");
+        const reads = [
+            "/System",
+            "/usr",
+            "/bin",
+            "/sbin",
+            "/Library",
+            "/private/etc",
+            "/private/var/db",
+            workspace,
+            sandboxHome,
+            sandboxTmp,
+            ...roots,
+            ...macosDeveloperReadPaths(),
+            ...writablePaths.map((path) => resolve(path)),
+        ];
+        const profile = macosSandboxProfile(reads, [workspace, sandboxHome, sandboxTmp, "/private/tmp", ...writablePaths], skillRoot);
+        return {
+            executablePath: resolvedCommand,
+            command: sandboxExec,
+            args: ["-p", profile, resolvedCommand, ...args],
+            env: invocationEnvironment,
+            credentialFiles: copiedAuth,
+            cleanup: async () => {
+                await Promise.all([
+                    ...(brokerBin ? [rm(brokerBin, { recursive: true, force: true })] : []),
+                    ...copiedAuth.map((path) => rm(path, { force: true })),
+                ]);
+            },
+        };
+    }
+    throw new Error(`self-hosted workflow isolation is not supported on ${process.platform}`);
+}
+//# sourceMappingURL=isolation.js.map