@anthropic-ai/sandbox-runtime 0.0.34 → 0.0.38

package/README.md

@@ -270,7 +270,8 @@ srt --settings /path/to/srt-settings.json <command>
     "git push": ["/usr/bin/nc"],
     "npm": ["/private/tmp"]
   },
-  "enableWeakerNestedSandbox": false
+  "enableWeakerNestedSandbox": false,
+  "enableWeakerNetworkIsolation": false
 }
 ```
 
@@ -341,6 +342,7 @@ Examples:
 
 - `ignoreViolations` - Object mapping command patterns to arrays of paths where violations should be ignored
 - `enableWeakerNestedSandbox` - Enable weaker sandbox mode for Docker environments (boolean, default: false)
+- `enableWeakerNetworkIsolation` - Allow access to `com.apple.trustd.agent` in the macOS sandbox (boolean, default: false). This is needed for Go programs (`gh`, `gcloud`, `terraform`, `kubectl`, etc.) to verify TLS certificates when using `httpProxyPort` with a MITM proxy and custom CA. **Security warning:** enabling this opens a potential data exfiltration vector through the trustd service.
 
 ### Common Configuration Recipes
 
@@ -637,6 +639,7 @@ Users should be aware of potential risks that come from allowing broad domains l
 - Privilege Escalation via Unix Sockets: The `allowUnixSockets` configuration can inadvertently grant access to powerful system services that could lead to sandbox bypasses. For example, if it is used to allow access to `/var/run/docker.sock` this would effectively grant access to the host system through exploiting the docker socket. Users are encouraged to carefully consider any unix sockets that they allow through the sandbox.
 - Filesystem Permission Escalation: Overly broad filesystem write permissions can enable privilege escalation attacks. Allowing writes to directories containing executables in `$PATH`, system configuration directories, or user shell configuration files (`.bashrc`, `.zshrc`) can lead to code execution in different security contexts when other users or system processes access these files.
 - Linux Sandbox Strength: The Linux implementation provides strong filesystem and network isolation but includes an `enableWeakerNestedSandbox` mode that enables it to work inside of Docker environments without privileged namespaces. This option considerably weakens security and should only be used incases where additional isolation is otherwise enforced.
+- Weaker Network Isolation (macOS): The `enableWeakerNetworkIsolation` option re-enables access to `com.apple.trustd.agent`, which is needed for Go programs to verify TLS certificates via the macOS Security framework. This opens a potential data exfiltration vector through the trustd service and should only be enabled when Go TLS verification is required (e.g., when using `httpProxyPort` with a MITM proxy and custom CA).
 
 ### Known Limitations and Future Work
 

package/dist/cli.js

@@ -121,6 +121,10 @@ async function main() {
             });
             // Handle process exit
             child.on('exit', (code, signal) => {
+                // Clean up bwrap mount point artifacts before exiting.
+                // On Linux, bwrap creates empty files on the host when protecting
+                // non-existent deny paths. This removes them.
+                SandboxManager.cleanupAfterCommand();
                 if (signal) {
                     if (signal === 'SIGINT' || signal === 'SIGTERM') {
                         process.exit(0);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAExB;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,EAAE;SAClB;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;SACd;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAE7B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CACV,oEAAoE,CACrE;SACA,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAA;IAEtD,2CAA2C;IAC3C,OAAO;SACJ,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;SACzD,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CACL,uBAAuB,EACvB,qDAAqD,CACtD;SACA,MAAM,CACL,cAAc,EACd,+DAA+D,CAChE;SACA,MAAM,CACL,mBAAmB,EACnB,gEAAgE,EAChE,QAAQ,CACT;SACA,kBAAkB,EAAE;SACpB,MAAM,CACL,KAAK,EACH,WAAqB,EACrB,OAKC,EACD,EAAE;QACF,IAAI,CAAC;YACH,oCAAoC;YACpC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAA;YAC5B,CAAC;YAED,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAA;YAC7D,IAAI,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;YAE1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,eAAe,CACb,sBAAsB,UAAU,wBAAwB,CACzD,CAAA;gBACD,aAAa,GAAG,gBAAgB,EAAE,CAAA;YACpC,CAAC;YAED,iCAAiC;YACjC,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC1C,MAAM,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;YAE9C,4DAA4D;YAC5D,IAAI,aAAa,GAA8B,IAAI,CAAA;YACnD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE;wBAC5C,EAAE,EAAE,OAAO,CAAC,SAAS;qBACtB,CAAC,CAAA;oBACF,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC;wBACvC,KAAK,EAAE,aAAa;wBACpB,SAAS,EAAE,QAAQ;qBACpB,CAAC,CAAA;oBAEF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;wBAC9B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;wBAC5C,IAAI,SAAS,EAAE,CAAC;4BACd,eAAe,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC/D,CAAA;4BACD,cAAc,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;wBACxC,CAAC;6BAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;4BACvB,gDAAgD;4BAChD,eAAe,CACb,2CAA2C,IAAI,EAAE,CAClD,CAAA;wBACH,CAAC;oBACH,CAAC,CAAC,CAAA;oBAEF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBAC9B,eAAe,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;oBACrD,CAAC,CAAC,CAAA;oBAEF,eAAe,CACb,sCAAsC,OAAO,CAAC,SAAS,EAAE,CAC1D,CAAA;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,eAAe,CACb,6BAA6B,OAAO,CAAC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtG,CAAA;gBACH,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,aAAa,EAAE,KAAK,EAAE,CAAA;YACxB,CAAC,CAAC,CAAA;YAEF,yCAAyC;YACzC,IAAI,OAAe,CAAA;YACnB,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;gBACd,oDAAoD;gBACpD,OAAO,GAAG,OAAO,CAAC,CAAC,CAAA;gBACnB,eAAe,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA;YACzD,CAAC;iBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,4BAA4B;gBAC5B,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC/B,eAAe,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAA;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YAED,eAAe,CACb,IAAI,CAAC,SAAS,CACZ,cAAc,CAAC,2BAA2B,EAAE,EAC5C,IAAI,EACJ,CAAC,CACF,CACF,CAAA;YAED,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;YAEtE,gCAAgC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,sBAAsB;YACtB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACjB,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAA;wBACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACjB,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBACxB,OAAO,CAAC,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;YAEF,8BAA8B;YAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACtB,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnE,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CACF,CAAA;IAEH,OAAO,CAAC,KAAK,EAAE,CAAA;AACjB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAExB;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,EAAE;SAClB;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;SACd;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAE7B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CACV,oEAAoE,CACrE;SACA,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAA;IAEtD,2CAA2C;IAC3C,OAAO;SACJ,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;SACzD,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CACL,uBAAuB,EACvB,qDAAqD,CACtD;SACA,MAAM,CACL,cAAc,EACd,+DAA+D,CAChE;SACA,MAAM,CACL,mBAAmB,EACnB,gEAAgE,EAChE,QAAQ,CACT;SACA,kBAAkB,EAAE;SACpB,MAAM,CACL,KAAK,EACH,WAAqB,EACrB,OAKC,EACD,EAAE;QACF,IAAI,CAAC;YACH,oCAAoC;YACpC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAA;YAC5B,CAAC;YAED,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAA;YAC7D,IAAI,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;YAE1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,eAAe,CACb,sBAAsB,UAAU,wBAAwB,CACzD,CAAA;gBACD,aAAa,GAAG,gBAAgB,EAAE,CAAA;YACpC,CAAC;YAED,iCAAiC;YACjC,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC1C,MAAM,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;YAE9C,4DAA4D;YAC5D,IAAI,aAAa,GAA8B,IAAI,CAAA;YACnD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE;wBAC5C,EAAE,EAAE,OAAO,CAAC,SAAS;qBACtB,CAAC,CAAA;oBACF,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC;wBACvC,KAAK,EAAE,aAAa;wBACpB,SAAS,EAAE,QAAQ;qBACpB,CAAC,CAAA;oBAEF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;wBAC9B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;wBAC5C,IAAI,SAAS,EAAE,CAAC;4BACd,eAAe,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC/D,CAAA;4BACD,cAAc,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;wBACxC,CAAC;6BAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;4BACvB,gDAAgD;4BAChD,eAAe,CACb,2CAA2C,IAAI,EAAE,CAClD,CAAA;wBACH,CAAC;oBACH,CAAC,CAAC,CAAA;oBAEF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBAC9B,eAAe,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;oBACrD,CAAC,CAAC,CAAA;oBAEF,eAAe,CACb,sCAAsC,OAAO,CAAC,SAAS,EAAE,CAC1D,CAAA;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,eAAe,CACb,6BAA6B,OAAO,CAAC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtG,CAAA;gBACH,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,aAAa,EAAE,KAAK,EAAE,CAAA;YACxB,CAAC,CAAC,CAAA;YAEF,yCAAyC;YACzC,IAAI,OAAe,CAAA;YACnB,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;gBACd,oDAAoD;gBACpD,OAAO,GAAG,OAAO,CAAC,CAAC,CAAA;gBACnB,eAAe,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA;YACzD,CAAC;iBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,4BAA4B;gBAC5B,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC/B,eAAe,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAA;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YAED,eAAe,CACb,IAAI,CAAC,SAAS,CACZ,cAAc,CAAC,2BAA2B,EAAE,EAC5C,IAAI,EACJ,CAAC,CACF,CACF,CAAA;YAED,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;YAEtE,gCAAgC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,sBAAsB;YACtB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,uDAAuD;gBACvD,kEAAkE;gBAClE,8CAA8C;gBAC9C,cAAc,CAAC,mBAAmB,EAAE,CAAA;gBAEpC,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACjB,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAA;wBACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACjB,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBACxB,OAAO,CAAC,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;YAEF,8BAA8B;YAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACtB,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnE,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CACF,CAAA;IAEH,OAAO,CAAC,KAAK,EAAE,CAAA;AACjB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/sandbox/linux-sandbox-utils.d.ts

@@ -36,6 +36,21 @@ export interface LinuxSandboxParams {
     /** Abort signal to cancel the ripgrep scan */
     abortSignal?: AbortSignal;
 }
+/**
+ * Clean up mount point files created by bwrap for non-existent deny paths.
+ *
+ * When protecting non-existent deny paths, bwrap creates empty files on the
+ * host filesystem as mount points for --ro-bind. These files persist after
+ * bwrap exits. This function removes them.
+ *
+ * This should be called after each sandboxed command completes to prevent
+ * ghost dotfiles (e.g. .bashrc, .gitconfig) from appearing in the working
+ * directory. It is also called automatically on process exit as a safety net.
+ *
+ * Safe to call at any time — it only removes files that were tracked during
+ * generateFilesystemArgs() and skips any that no longer exist.
+ */
+export declare function cleanupBwrapMountPoints(): void;
 /**
  * Detailed status of Linux sandbox dependencies
  */

package/dist/sandbox/linux-sandbox-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAWtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAQ7B,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAmLD;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,aAAa,EAAE,OAAO,CAAA;IACtB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,CAAC,EAAE;IACvD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,qBAAqB,CAiBxB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,CAAC,EAAE;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,sBAAsB,CAuBzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,yBAAyB,CAAC,CA2HpC;AA4MD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CA2PjB"}
+{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAYtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAQ7B,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAiQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA2B9C;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,aAAa,EAAE,OAAO,CAAA;IACtB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,CAAC,EAAE;IACvD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,qBAAqB,CAQxB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,CAAC,EAAE;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,sBAAsB,CAezB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,yBAAyB,CAAC,CA2HpC;AAgSD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAwPjB"}

package/dist/sandbox/linux-sandbox-utils.js

@@ -1,12 +1,13 @@
 import shellquote from 'shell-quote';
 import { logForDebugging } from '../utils/debug.js';
+import { whichSync } from '../utils/which.js';
 import { randomBytes } from 'node:crypto';
 import * as fs from 'fs';
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import path, { join } from 'node:path';
 import { ripGrep } from '../utils/ripgrep.js';
-import { generateProxyEnvVars, normalizePathForSandbox, normalizeCaseForComparison, DANGEROUS_FILES, getDangerousDirectories, } from './sandbox-utils.js';
+import { generateProxyEnvVars, normalizePathForSandbox, normalizeCaseForComparison, isSymlinkOutsideBoundary, DANGEROUS_FILES, getDangerousDirectories, } from './sandbox-utils.js';
 import { generateSeccompFilter, cleanupSeccompFilter, getPreGeneratedBpfPath, getApplySeccompBinaryPath, } from './generate-seccomp-filter.js';
 /** Default max depth for searching dangerous files */
 const DEFAULT_MANDATORY_DENY_SEARCH_DEPTH = 3;
@@ -42,6 +43,57 @@ function findSymlinkInPath(targetPath, allowedWritePaths) {
     }
     return null;
 }
+/**
+ * Check if any existing component in the path is a file (not a directory).
+ * If so, the target path can never be created because you can't mkdir under a file.
+ *
+ * This handles the git worktree case: .git is a file, so .git/hooks can never
+ * exist and there's nothing to deny.
+ */
+function hasFileAncestor(targetPath) {
+    const parts = targetPath.split(path.sep);
+    let currentPath = '';
+    for (const part of parts) {
+        if (!part)
+            continue; // Skip empty parts (leading /)
+        const nextPath = currentPath + path.sep + part;
+        try {
+            const stat = fs.statSync(nextPath);
+            if (stat.isFile() || stat.isSymbolicLink()) {
+                // This component exists as a file — nothing below it can be created
+                return true;
+            }
+        }
+        catch {
+            // Path doesn't exist — stop checking
+            break;
+        }
+        currentPath = nextPath;
+    }
+    return false;
+}
+/**
+ * Find the first non-existent path component.
+ * E.g., for "/existing/parent/nonexistent/child/file.txt" where /existing/parent exists,
+ * returns "/existing/parent/nonexistent"
+ *
+ * This is used to block creation of non-existent deny paths by mounting /dev/null
+ * at the first missing component, preventing mkdir from creating the parent directories.
+ */
+function findFirstNonExistentComponent(targetPath) {
+    const parts = targetPath.split(path.sep);
+    let currentPath = '';
+    for (const part of parts) {
+        if (!part)
+            continue; // Skip empty parts (leading /)
+        const nextPath = currentPath + path.sep + part;
+        if (!fs.existsSync(nextPath)) {
+            return nextPath;
+        }
+        currentPath = nextPath;
+    }
+    return targetPath; // Shouldn't reach here if called correctly
+}
 /**
  * Get mandatory deny paths using ripgrep (Linux only).
  * Uses a SINGLE ripgrep call with multiple glob patterns for efficiency.
@@ -59,12 +111,27 @@ async function linuxGetMandatoryDenyPaths(ripgrepConfig = { command: 'rg' }, max
         ...DANGEROUS_FILES.map(f => path.resolve(cwd, f)),
         // Dangerous directories in CWD
         ...dangerousDirectories.map(d => path.resolve(cwd, d)),
-        // Git hooks always blocked for security
-        path.resolve(cwd, '.git/hooks'),
     ];
-    // Git config conditionally blocked based on allowGitConfig setting
-    if (!allowGitConfig) {
-        denyPaths.push(path.resolve(cwd, '.git/config'));
+    // Git hooks and config are only denied when .git exists as a directory.
+    // In git worktrees, .git is a file (e.g., "gitdir: /path/..."), so
+    // .git/hooks can never exist — denying it would cause bwrap to fail.
+    // When .git doesn't exist at all, mounting at .git would block its
+    // creation and break git init.
+    const dotGitPath = path.resolve(cwd, '.git');
+    let dotGitIsDirectory = false;
+    try {
+        dotGitIsDirectory = fs.statSync(dotGitPath).isDirectory();
+    }
+    catch {
+        // .git doesn't exist
+    }
+    if (dotGitIsDirectory) {
+        // Git hooks always blocked for security
+        denyPaths.push(path.resolve(cwd, '.git/hooks'));
+        // Git config conditionally blocked based on allowGitConfig setting
+        if (!allowGitConfig) {
+            denyPaths.push(path.resolve(cwd, '.git/config'));
+        }
     }
     // Build iglob args for all patterns in one ripgrep call
     const iglobArgs = [];
@@ -134,11 +201,16 @@ async function linuxGetMandatoryDenyPaths(ripgrepConfig = { command: 'rg' }, max
 }
 // Track generated seccomp filters for cleanup on process exit
 const generatedSeccompFilters = new Set();
+// Track mount points created by bwrap for non-existent deny paths.
+// When bwrap does --ro-bind /dev/null /nonexistent/path, it creates an empty
+// file on the host as a mount point. These persist after bwrap exits and must
+// be cleaned up explicitly.
+const bwrapMountPoints = new Set();
 let exitHandlerRegistered = false;
 /**
- * Register cleanup handler for generated seccomp filters
+ * Register cleanup handler for generated seccomp filters and bwrap mount points
  */
-function registerSeccompCleanupHandler() {
+function registerExitCleanupHandler() {
     if (exitHandlerRegistered) {
         return;
     }
@@ -151,24 +223,57 @@ function registerSeccompCleanupHandler() {
                 // Ignore cleanup errors during exit
             }
         }
+        cleanupBwrapMountPoints();
     });
     exitHandlerRegistered = true;
 }
+/**
+ * Clean up mount point files created by bwrap for non-existent deny paths.
+ *
+ * When protecting non-existent deny paths, bwrap creates empty files on the
+ * host filesystem as mount points for --ro-bind. These files persist after
+ * bwrap exits. This function removes them.
+ *
+ * This should be called after each sandboxed command completes to prevent
+ * ghost dotfiles (e.g. .bashrc, .gitconfig) from appearing in the working
+ * directory. It is also called automatically on process exit as a safety net.
+ *
+ * Safe to call at any time — it only removes files that were tracked during
+ * generateFilesystemArgs() and skips any that no longer exist.
+ */
+export function cleanupBwrapMountPoints() {
+    for (const mountPoint of bwrapMountPoints) {
+        try {
+            // Only remove if it's still the empty file/directory bwrap created.
+            // If something else has written real content, leave it alone.
+            const stat = fs.statSync(mountPoint);
+            if (stat.isFile() && stat.size === 0) {
+                fs.unlinkSync(mountPoint);
+                logForDebugging(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${mountPoint}`);
+            }
+            else if (stat.isDirectory()) {
+                // Empty directory mount points are created for intermediate
+                // components (Fix 2). Only remove if still empty.
+                const entries = fs.readdirSync(mountPoint);
+                if (entries.length === 0) {
+                    fs.rmdirSync(mountPoint);
+                    logForDebugging(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${mountPoint}`);
+                }
+            }
+        }
+        catch {
+            // Ignore cleanup errors — the file may have already been removed
+        }
+    }
+    bwrapMountPoints.clear();
+}
 /**
  * Get detailed status of Linux sandbox dependencies
  */
 export function getLinuxDependencyStatus(seccompConfig) {
-    const bwrapResult = spawnSync('which', ['bwrap'], {
-        stdio: 'ignore',
-        timeout: 1000,
-    });
-    const socatResult = spawnSync('which', ['socat'], {
-        stdio: 'ignore',
-        timeout: 1000,
-    });
     return {
-        hasBwrap: bwrapResult.status === 0,
-        hasSocat: socatResult.status === 0,
+        hasBwrap: whichSync('bwrap') !== null,
+        hasSocat: whichSync('socat') !== null,
         hasSeccompBpf: getPreGeneratedBpfPath(seccompConfig?.bpfPath) !== null,
         hasSeccompApply: getApplySeccompBinaryPath(seccompConfig?.applyPath) !== null,
     };
@@ -179,17 +284,9 @@ export function getLinuxDependencyStatus(seccompConfig) {
 export function checkLinuxDependencies(seccompConfig) {
     const errors = [];
     const warnings = [];
-    const bwrap = spawnSync('which', ['bwrap'], {
-        stdio: 'ignore',
-        timeout: 1000,
-    });
-    const socat = spawnSync('which', ['socat'], {
-        stdio: 'ignore',
-        timeout: 1000,
-    });
-    if (bwrap.status !== 0)
+    if (whichSync('bwrap') === null)
         errors.push('bubblewrap (bwrap) not installed');
-    if (socat.status !== 0)
+    if (whichSync('socat') === null)
         errors.push('socat not installed');
     const hasBpf = getPreGeneratedBpfPath(seccompConfig?.bpfPath) !== null;
     const hasApply = getApplySeccompBinaryPath(seccompConfig?.applyPath) !== null;
@@ -401,6 +498,26 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
                 logForDebugging(`[Sandbox Linux] Skipping non-existent write path: ${normalizedPath}`);
                 continue;
             }
+            // Check if path is a symlink pointing outside expected boundaries
+            // bwrap follows symlinks, so --bind on a symlink makes the target writable
+            // This could unexpectedly expose paths the user didn't intend to allow
+            try {
+                const resolvedPath = fs.realpathSync(normalizedPath);
+                // Trim trailing slashes before comparing: realpathSync never returns
+                // a trailing slash, but normalizedPath may have one, which would cause
+                // a false mismatch and incorrectly treat the path as a symlink.
+                const normalizedForComparison = normalizedPath.replace(/\/+$/, '');
+                if (resolvedPath !== normalizedForComparison &&
+                    isSymlinkOutsideBoundary(normalizedPath, resolvedPath)) {
+                    logForDebugging(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${pathPattern} -> ${resolvedPath}`);
+                    continue;
+                }
+            }
+            catch {
+                // realpathSync failed - path might not exist or be accessible, skip it
+                logForDebugging(`[Sandbox Linux] Skipping write path that could not be resolved: ${normalizedPath}`);
+                continue;
+            }
             args.push('--bind', normalizedPath, normalizedPath);
             allowedWritePaths.push(normalizedPath);
         }
@@ -425,10 +542,55 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
                 logForDebugging(`[Sandbox Linux] Mounted /dev/null at symlink ${symlinkInPath} to prevent symlink replacement attack`);
                 continue;
             }
-            // Skip non-existent paths - no protection needed
-            // Mounting /dev/null over non-existent paths creates empty files on host
+            // Handle non-existent paths by mounting /dev/null to block creation.
+            // Without this, a sandboxed process could mkdir+write a denied path that
+            // doesn't exist yet, bypassing the deny rule entirely.
+            //
+            // bwrap creates empty files on the host as mount points for these binds.
+            // We track them in bwrapMountPoints so cleanupBwrapMountPoints() can
+            // remove them after the command exits.
             if (!fs.existsSync(normalizedPath)) {
-                logForDebugging(`[Sandbox Linux] Skipping non-existent deny path: ${normalizedPath}`);
+                // Fix 1 (worktree): If any existing component in the deny path is a
+                // file (not a directory), skip the deny entirely. You can't mkdir
+                // under a file, so the deny path can never be created. This handles
+                // git worktrees where .git is a file.
+                if (hasFileAncestor(normalizedPath)) {
+                    logForDebugging(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${normalizedPath}`);
+                    continue;
+                }
+                // Find the deepest existing ancestor directory
+                let ancestorPath = path.dirname(normalizedPath);
+                while (ancestorPath !== '/' && !fs.existsSync(ancestorPath)) {
+                    ancestorPath = path.dirname(ancestorPath);
+                }
+                // Only protect if the existing ancestor is within an allowed write path.
+                // If not, the path is already read-only from --ro-bind / /.
+                const ancestorIsWithinAllowedPath = allowedWritePaths.some(allowedPath => ancestorPath.startsWith(allowedPath + '/') ||
+                    ancestorPath === allowedPath ||
+                    normalizedPath.startsWith(allowedPath + '/'));
+                if (ancestorIsWithinAllowedPath) {
+                    const firstNonExistent = findFirstNonExistentComponent(normalizedPath);
+                    // Fix 2: If firstNonExistent is an intermediate component (not the
+                    // leaf deny path itself), mount a read-only empty directory instead
+                    // of /dev/null. This prevents the component from appearing as a file
+                    // which breaks tools that expect to traverse it as a directory.
+                    if (firstNonExistent !== normalizedPath) {
+                        const emptyDir = fs.mkdtempSync(path.join(tmpdir(), 'claude-empty-'));
+                        args.push('--ro-bind', emptyDir, firstNonExistent);
+                        bwrapMountPoints.add(firstNonExistent);
+                        registerExitCleanupHandler();
+                        logForDebugging(`[Sandbox Linux] Mounted empty dir at ${firstNonExistent} to block creation of ${normalizedPath}`);
+                    }
+                    else {
+                        args.push('--ro-bind', '/dev/null', firstNonExistent);
+                        bwrapMountPoints.add(firstNonExistent);
+                        registerExitCleanupHandler();
+                        logForDebugging(`[Sandbox Linux] Mounted /dev/null at ${firstNonExistent} to block creation of ${normalizedPath}`);
+                    }
+                }
+                else {
+                    logForDebugging(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${normalizedPath}`);
+                }
                 continue;
             }
             // Only add deny binding if this path is within an allowed write path
@@ -555,7 +717,7 @@ export async function wrapCommandWithSandboxLinux(params) {
                 // Only track runtime-generated filters (not pre-generated ones from vendor/)
                 if (!seccompFilterPath.includes('/vendor/seccomp/')) {
                     generatedSeccompFilters.add(seccompFilterPath);
-                    registerSeccompCleanupHandler();
+                    registerExitCleanupHandler();
                 }
                 logForDebugging('[Sandbox Linux] Generated seccomp BPF filter for Unix socket blocking');
             }
@@ -627,13 +789,10 @@ export async function wrapCommandWithSandboxLinux(params) {
         // Use the user's shell (zsh, bash, etc.) to ensure aliases/snapshots work
         // Resolve the full path to the shell binary since bwrap doesn't use $PATH
         const shellName = binShell || 'bash';
-        const shellPathResult = spawnSync('which', [shellName], {
-            encoding: 'utf8',
-        });
-        if (shellPathResult.status !== 0) {
+        const shell = whichSync(shellName);
+        if (!shell) {
             throw new Error(`Shell '${shellName}' not found in PATH`);
         }
-        const shell = shellPathResult.stdout.trim();
         bwrapArgs.push('--', shell, '-c');
         // If we have network restrictions, use the network bridge setup with apply-seccomp for seccomp
         // Otherwise, just run the command directly with apply-seccomp if needed

package/dist/sandbox/linux-sandbox-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"linux-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAA;AAkCrC,sDAAsD;AACtD,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,iBAA2B;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAE9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,WAAW,CACrE,CAAA;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;YAC7C,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,WAAmB,mCAAmC,EACtD,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAA;IACvD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAA;IAEtD,uEAAuE;IACvE,MAAM,SAAS,GAAG;QAChB,yBAAyB;QACzB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,+BAA+B;QAC/B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtD,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;KAChC,CAAA;IAED,mEAAmE;IACnE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,2CAA2C;IAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAE7C,mDAAmD;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CACrB;YACE,SAAS;YACT,UAAU;YACV,aAAa;YACb,MAAM,CAAC,QAAQ,CAAC;YAChB,GAAG,SAAS;YACZ,IAAI;YACJ,qBAAqB;SACtB,EACD,GAAG,EACH,MAAM,EACN,aAAa,CACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7C,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CACjC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,iBAAiB,CACzD,CAAA;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC5C,CAAC;yBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBACzC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAK;YACP,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,uBAAuB,GAAgB,IAAI,GAAG,EAAE,CAAA;AACtD,IAAI,qBAAqB,GAAG,KAAK,CAAA;AAEjC;;GAEG;AACH,SAAS,6BAA6B;IACpC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,UAAU,IAAI,uBAAuB,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,UAAU,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,qBAAqB,GAAG,IAAI,CAAA;AAC9B,CAAC;AAoBD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAGxC;IACC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QAChD,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QAChD,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEF,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,aAAa,EAAE,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI;QACtE,eAAe,EACb,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI;KAC/D,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAGtC;IACC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1C,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1C,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI,CAAA;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,QAAQ,OAAO,CAAC,CAAA;IACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,QAAQ,OAAO,CAAC,CAAA;IAEvE,oBAAoB;IACpB,MAAM,aAAa,GAAG;QACpB,eAAe,cAAc,iBAAiB;QAC9C,iBAAiB,aAAa,8CAA8C;KAC7E,CAAA;IAED,eAAe,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE;QACtD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAClC,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC5C,eAAe,CACb,wCAAwC,IAAI,YAAY,MAAM,EAAE,EAChE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,eAAe,eAAe,iBAAiB;QAC/C,iBAAiB,cAAc,8CAA8C;KAC9E,CAAA;IAED,eAAe,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE3E,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE;QACxD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QAC5B,uBAAuB;QACvB,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IAED,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACnC,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7C,eAAe,CACb,yCAAyC,IAAI,YAAY,MAAM,EAAE,EACjE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IACE,CAAC,iBAAiB,CAAC,GAAG;YACtB,iBAAiB,CAAC,MAAM;YACxB,CAAC,kBAAkB,CAAC,GAAG;YACvB,kBAAkB,CAAC,MAAM,EACzB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpE,eAAe,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC9D,MAAK;YACP,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE;gBACnE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YAC1B,0BAA0B;YAC1B,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,WAAW,WAAW,CAChE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,aAAa;QACb,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,cAAsB,EACtB,eAAuB,EACvB,WAAmB,EACnB,iBAAqC,EACrC,KAAc,EACd,gBAAyB;IAEzB,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,CAAA;IACjC,MAAM,aAAa,GAAG;QACpB,qDAAqD,cAAc,oBAAoB;QACvF,qDAAqD,eAAe,oBAAoB;QACxF,0CAA0C;KAC3C,CAAA;IAED,+DAA+D;IAC/D,IAAI,iBAAiB,EAAE,CAAC;QACtB,0BAA0B;QAC1B,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,EAAE;QACF,4CAA4C;QAC5C,6BAA6B;QAC7B,6DAA6D;QAC7D,2BAA2B;QAC3B,EAAE;QACF,oFAAoF;QACpF,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAA;QACtE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,uFAAuF,CAC1F,CAAA;QACH,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;YACvC,kBAAkB;YAClB,iBAAiB;YACjB,SAAS;YACT,IAAI;YACJ,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,CAAC,GAAG,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAA+C,EAC/C,WAAiD,EACjD,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,2BAAmC,mCAAmC,EACtE,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,sBAAsB;IAEtB,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,qFAAqF;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAEhC,4DAA4D;QAC5D,MAAM,iBAAiB,GAAa,EAAE,CAAA;QAEtC,iCAAiC;QACjC,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,eAAe,CACb,0CAA0C,WAAW,OAAO,cAAc,EAAE,CAC7E,CAAA;YAED,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;gBACxE,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,eAAe,CACb,qDAAqD,cAAc,EAAE,CACtE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACnD,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxC,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG;YAChB,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,0BAA0B,CAClC,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAC;SACH,CAAA;QAED,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,SAAQ;YACV,CAAC;YAED,yEAAyE;YACzE,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;YAC1E,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;gBAClD,eAAe,CACb,gDAAgD,aAAa,wCAAwC,CACtG,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,iDAAiD;YACjD,yEAAyE;YACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,eAAe,CACb,oDAAoD,cAAc,EAAE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC5C,cAAc,KAAK,WAAW,CACjC,CAAA;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACxD,CAAC;iBAAM,CAAC;gBACN,eAAe,CACb,gEAAgE,cAAc,EAAE,CACjF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,+DAA+D;IAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IAEvD,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,eAAe,CACb,yDAAyD,cAAc,EAAE,CAC1E,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA0B;IAE1B,MAAM,EACJ,OAAO,EACP,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EACjC,wBAAwB,GAAG,mCAAmC,EAC9D,cAAc,GAAG,KAAK,EACtB,aAAa,EACb,WAAW,GACZ,GAAG,MAAM,CAAA;IAEV,6CAA6C;IAC7C,6DAA6D;IAC7D,4FAA4F;IAC5F,MAAM,mBAAmB,GAAG,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,MAAM,oBAAoB,GAAG,WAAW,KAAK,SAAS,CAAA;IAEtD,kCAAkC;IAClC,IACE,CAAC,uBAAuB;QACxB,CAAC,mBAAmB;QACpB,CAAC,oBAAoB,EACrB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,SAAS,GAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAClE,IAAI,iBAAiB,GAAuB,SAAS,CAAA;IAErD,IAAI,CAAC;QACH,8DAA8D;QAC9D,kFAAkF;QAClF,EAAE;QACF,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,iBAAiB;gBACf,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,SAAS,CAAA;YAC5D,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9C,8EAA8E;gBAC9E,eAAe,CACb,kFAAkF;oBAChF,qEAAqE,EACvE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,kDAAkD;gBAClD,iBAAiB,GAAG,SAAS,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,qDAAqD;gBACrD,6EAA6E;gBAC7E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;oBAC9C,6BAA6B,EAAE,CAAA;gBACjC,CAAC;gBAED,eAAe,CACb,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe,CACb,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,uBAAuB,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,wEAAwE;YACxE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAE/B,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;gBACtC,6DAA6D;gBAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,IAAI;wBAC5D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CACb,6CAA6C,eAAe,IAAI;wBAC9D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBAED,qCAAqC;gBACrC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;gBACxD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAA;gBAE1D,kCAAkC;gBAClC,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,EAAE,8BAA8B;gBACpC,IAAI,CACL,CAAA;gBACD,SAAS,CAAC,IAAI,CACZ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAChC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBACpC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;gBAED,uEAAuE;gBACvE,iEAAiE;gBACjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CAAC,aAAa,CAAC,CACtB,CAAA;gBACH,CAAC;gBACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,mCAAmC,EACnC,MAAM,CAAC,cAAc,CAAC,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,sFAAsF;QACxF,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAA;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAEzB,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE/B,gDAAgD;QAChD,6EAA6E;QAC7E,kEAAkE;QAClE,wEAAwE;QACxE,qGAAqG;QACrG,mGAAmG;QACnG,4DAA4D;QAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC/B,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,CAAC;QAED,gCAAgC;QAChC,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,CAAA;QACpC,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAA;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,qBAAqB,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAEjC,+FAA+F;QAC/F,wEAAwE;QACxE,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACjE,2EAA2E;YAC3E,uDAAuD;YACvD,MAAM,cAAc,GAAG,mBAAmB,CACxC,cAAc,EACd,eAAe,EACf,OAAO,EACP,iBAAiB,EACjB,KAAK,EACL,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChC,CAAC;aAAM,IAAI,iBAAiB,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,4FAA4F;YAC5F,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;oBACtE,uFAAuF,CAC1F,CAAA;YACH,CAAC;YAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;gBACvC,kBAAkB;gBAClB,iBAAiB;gBACjB,KAAK;gBACL,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;QAEhE,MAAM,YAAY,GAAG,EAAE,CAAA;QACvB,IAAI,uBAAuB;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,mBAAmB,IAAI,oBAAoB;YAC7C,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,IAAI,iBAAiB;YAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAE/D,eAAe,CACb,+CAA+C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACvF,CAAA;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC;QACnC,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,eAAe,CACb,+DAA+D,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACH,CAAC;QACH,CAAC;QACD,8BAA8B;QAC9B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"linux-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAA;AAkCrC,sDAAsD;AACtD,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,iBAA2B;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAE9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,WAAW,CACrE,CAAA;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;YAC7C,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CAAC,UAAkB;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,UAAU,CAAA,CAAC,2CAA2C;AAC/D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,WAAmB,mCAAmC,EACtD,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAA;IACvD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAA;IAEtD,uEAAuE;IACvE,MAAM,SAAS,GAAG;QAChB,yBAAyB;QACzB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,+BAA+B;QAC/B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;KACvD,CAAA;IAED,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,wCAAwC;QACxC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QAE/C,mEAAmE;QACnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,2CAA2C;IAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAE7C,mDAAmD;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CACrB;YACE,SAAS;YACT,UAAU;YACV,aAAa;YACb,MAAM,CAAC,QAAQ,CAAC;YAChB,GAAG,SAAS;YACZ,IAAI;YACJ,qBAAqB;SACtB,EACD,GAAG,EACH,MAAM,EACN,aAAa,CACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7C,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CACjC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,iBAAiB,CACzD,CAAA;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC5C,CAAC;yBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBACzC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAK;YACP,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,uBAAuB,GAAgB,IAAI,GAAG,EAAE,CAAA;AAEtD,mEAAmE;AACnE,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAA;AAE/C,IAAI,qBAAqB,GAAG,KAAK,CAAA;AAEjC;;GAEG;AACH,SAAS,0BAA0B;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,UAAU,IAAI,uBAAuB,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,UAAU,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;QACD,uBAAuB,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,qBAAqB,GAAG,IAAI,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACrC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBACzB,eAAe,CACb,wDAAwD,UAAU,EAAE,CACrE,CAAA;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,kDAAkD;gBAClD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;gBAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;oBACxB,eAAe,CACb,uDAAuD,UAAU,EAAE,CACpE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,CAAA;AAC1B,CAAC;AAoBD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAGxC;IACC,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,aAAa,EAAE,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI;QACtE,eAAe,EACb,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI;KAC/D,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAGtC;IACC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAC7B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAEnE,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI,CAAA;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,QAAQ,OAAO,CAAC,CAAA;IACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,QAAQ,OAAO,CAAC,CAAA;IAEvE,oBAAoB;IACpB,MAAM,aAAa,GAAG;QACpB,eAAe,cAAc,iBAAiB;QAC9C,iBAAiB,aAAa,8CAA8C;KAC7E,CAAA;IAED,eAAe,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE;QACtD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAClC,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC5C,eAAe,CACb,wCAAwC,IAAI,YAAY,MAAM,EAAE,EAChE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,eAAe,eAAe,iBAAiB;QAC/C,iBAAiB,cAAc,8CAA8C;KAC9E,CAAA;IAED,eAAe,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE3E,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE;QACxD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QAC5B,uBAAuB;QACvB,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IAED,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACnC,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7C,eAAe,CACb,yCAAyC,IAAI,YAAY,MAAM,EAAE,EACjE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IACE,CAAC,iBAAiB,CAAC,GAAG;YACtB,iBAAiB,CAAC,MAAM;YACxB,CAAC,kBAAkB,CAAC,GAAG;YACvB,kBAAkB,CAAC,MAAM,EACzB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpE,eAAe,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC9D,MAAK;YACP,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE;gBACnE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YAC1B,0BAA0B;YAC1B,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,WAAW,WAAW,CAChE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,aAAa;QACb,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,cAAsB,EACtB,eAAuB,EACvB,WAAmB,EACnB,iBAAqC,EACrC,KAAc,EACd,gBAAyB;IAEzB,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,CAAA;IACjC,MAAM,aAAa,GAAG;QACpB,qDAAqD,cAAc,oBAAoB;QACvF,qDAAqD,eAAe,oBAAoB;QACxF,0CAA0C;KAC3C,CAAA;IAED,+DAA+D;IAC/D,IAAI,iBAAiB,EAAE,CAAC;QACtB,0BAA0B;QAC1B,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,EAAE;QACF,4CAA4C;QAC5C,6BAA6B;QAC7B,6DAA6D;QAC7D,2BAA2B;QAC3B,EAAE;QACF,oFAAoF;QACpF,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAA;QACtE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,uFAAuF,CAC1F,CAAA;QACH,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;YACvC,kBAAkB;YAClB,iBAAiB;YACjB,SAAS;YACT,IAAI;YACJ,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,CAAC,GAAG,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAA+C,EAC/C,WAAiD,EACjD,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,2BAAmC,mCAAmC,EACtE,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,sBAAsB;IAEtB,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,qFAAqF;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAEhC,4DAA4D;QAC5D,MAAM,iBAAiB,GAAa,EAAE,CAAA;QAEtC,iCAAiC;QACjC,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,eAAe,CACb,0CAA0C,WAAW,OAAO,cAAc,EAAE,CAC7E,CAAA;YAED,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;gBACxE,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,eAAe,CACb,qDAAqD,cAAc,EAAE,CACtE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,kEAAkE;YAClE,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;gBACpD,qEAAqE;gBACrE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,uBAAuB,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBAClE,IACE,YAAY,KAAK,uBAAuB;oBACxC,wBAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,EACtD,CAAC;oBACD,eAAe,CACb,mFAAmF,WAAW,OAAO,YAAY,EAAE,CACpH,CAAA;oBACD,SAAQ;gBACV,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,eAAe,CACb,mEAAmE,cAAc,EAAE,CACpF,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACnD,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxC,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG;YAChB,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,0BAA0B,CAClC,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAC;SACH,CAAA;QAED,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,SAAQ;YACV,CAAC;YAED,yEAAyE;YACzE,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;YAC1E,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;gBAClD,eAAe,CACb,gDAAgD,aAAa,wCAAwC,CACtG,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,uDAAuD;YACvD,EAAE;YACF,yEAAyE;YACzE,qEAAqE;YACrE,uCAAuC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,sCAAsC;gBACtC,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC;oBACpC,eAAe,CACb,6FAA6F,cAAc,EAAE,CAC9G,CAAA;oBACD,SAAQ;gBACV,CAAC;gBAED,+CAA+C;gBAC/C,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBAC/C,OAAO,YAAY,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,CAAC;gBAED,yEAAyE;gBACzE,4DAA4D;gBAC5D,MAAM,2BAA2B,GAAG,iBAAiB,CAAC,IAAI,CACxD,WAAW,CAAC,EAAE,CACZ,YAAY,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;oBAC1C,YAAY,KAAK,WAAW;oBAC5B,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAC/C,CAAA;gBAED,IAAI,2BAA2B,EAAE,CAAC;oBAChC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAA;oBAEtE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,gEAAgE;oBAChE,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;wBACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CACrC,CAAA;wBACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;wBAClD,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAA;wBACrD,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,eAAe,CACb,6EAA6E,cAAc,EAAE,CAC9F,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC5C,cAAc,KAAK,WAAW,CACjC,CAAA;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACxD,CAAC;iBAAM,CAAC;gBACN,eAAe,CACb,gEAAgE,cAAc,EAAE,CACjF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,+DAA+D;IAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IAEvD,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,eAAe,CACb,yDAAyD,cAAc,EAAE,CAC1E,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA0B;IAE1B,MAAM,EACJ,OAAO,EACP,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EACjC,wBAAwB,GAAG,mCAAmC,EAC9D,cAAc,GAAG,KAAK,EACtB,aAAa,EACb,WAAW,GACZ,GAAG,MAAM,CAAA;IAEV,6CAA6C;IAC7C,6DAA6D;IAC7D,4FAA4F;IAC5F,MAAM,mBAAmB,GAAG,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,MAAM,oBAAoB,GAAG,WAAW,KAAK,SAAS,CAAA;IAEtD,kCAAkC;IAClC,IACE,CAAC,uBAAuB;QACxB,CAAC,mBAAmB;QACpB,CAAC,oBAAoB,EACrB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,SAAS,GAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAClE,IAAI,iBAAiB,GAAuB,SAAS,CAAA;IAErD,IAAI,CAAC;QACH,8DAA8D;QAC9D,kFAAkF;QAClF,EAAE;QACF,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,iBAAiB;gBACf,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,SAAS,CAAA;YAC5D,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9C,8EAA8E;gBAC9E,eAAe,CACb,kFAAkF;oBAChF,qEAAqE,EACvE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,kDAAkD;gBAClD,iBAAiB,GAAG,SAAS,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,qDAAqD;gBACrD,6EAA6E;gBAC7E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;oBAC9C,0BAA0B,EAAE,CAAA;gBAC9B,CAAC;gBAED,eAAe,CACb,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe,CACb,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,uBAAuB,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,wEAAwE;YACxE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAE/B,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;gBACtC,6DAA6D;gBAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,IAAI;wBAC5D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CACb,6CAA6C,eAAe,IAAI;wBAC9D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBAED,qCAAqC;gBACrC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;gBACxD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAA;gBAE1D,kCAAkC;gBAClC,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,EAAE,8BAA8B;gBACpC,IAAI,CACL,CAAA;gBACD,SAAS,CAAC,IAAI,CACZ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAChC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBACpC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;gBAED,uEAAuE;gBACvE,iEAAiE;gBACjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CAAC,aAAa,CAAC,CACtB,CAAA;gBACH,CAAC;gBACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,mCAAmC,EACnC,MAAM,CAAC,cAAc,CAAC,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,sFAAsF;QACxF,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAA;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAEzB,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE/B,gDAAgD;QAChD,6EAA6E;QAC7E,kEAAkE;QAClE,wEAAwE;QACxE,qGAAqG;QACrG,mGAAmG;QACnG,4DAA4D;QAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC/B,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,CAAC;QAED,gCAAgC;QAChC,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,CAAA;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,qBAAqB,CAAC,CAAA;QAC3D,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAEjC,+FAA+F;QAC/F,wEAAwE;QACxE,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACjE,2EAA2E;YAC3E,uDAAuD;YACvD,MAAM,cAAc,GAAG,mBAAmB,CACxC,cAAc,EACd,eAAe,EACf,OAAO,EACP,iBAAiB,EACjB,KAAK,EACL,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChC,CAAC;aAAM,IAAI,iBAAiB,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,4FAA4F;YAC5F,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;oBACtE,uFAAuF,CAC1F,CAAA;YACH,CAAC;YAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;gBACvC,kBAAkB;gBAClB,iBAAiB;gBACjB,KAAK;gBACL,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;QAEhE,MAAM,YAAY,GAAG,EAAE,CAAA;QACvB,IAAI,uBAAuB;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,mBAAmB,IAAI,oBAAoB;YAC7C,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,IAAI,iBAAiB;YAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAE/D,eAAe,CACb,+CAA+C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACvF,CAAA;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC;QACnC,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,eAAe,CACb,+DAA+D,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACH,CAAC;QACH,CAAC;QACD,8BAA8B;QAC9B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/sandbox/macos-sandbox-utils.d.ts

@@ -13,6 +13,7 @@ export interface MacOSSandboxParams {
     ignoreViolations?: IgnoreViolationsConfig | undefined;
     allowPty?: boolean;
     allowGitConfig?: boolean;
+    enableWeakerNetworkIsolation?: boolean;
     binShell?: string;
 }
 /**
@@ -27,24 +28,6 @@ export interface SandboxViolationEvent {
     timestamp: Date;
 }
 export type SandboxViolationCallback = (violation: SandboxViolationEvent) => void;
-/**
- * Convert a glob pattern to a regular expression for macOS sandbox profiles
- *
- * This implements gitignore-style pattern matching to match the behavior of the
- * `ignore` library used by the permission system/
- *
- * Supported patterns:
- * - * matches any characters except / (e.g., *.ts matches foo.ts but not foo/bar.ts)
- * - ** matches any characters including / (e.g., src/** /*.ts matches all .ts files in src/)
- * - ? matches any single character except / (e.g., file?.txt matches file1.txt)
- * - [abc] matches any character in the set (e.g., file[0-9].txt matches file3.txt)
- *
- * Note: This is designed for macOS sandbox (regex ...) syntax. The resulting regex
- * will be used in sandbox profiles like: (deny file-write* (regex "pattern"))
- *
- * Exported for testing purposes.
- */
-export declare function globToRegex(globPattern: string): string;
 /**
  * Wrap command with macOS sandbox
  */

package/dist/sandbox/macos-sandbox-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macos-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox-utils.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC/C,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAA;IACjD,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,UAAQ,GAAG,MAAM,EAAE,CA2B5E;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,qBAAqB,KAC7B,IAAI,CAAA;AAIT;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAkBvD;AAqgBD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAyFR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,wBAAwB,EAClC,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,MAAM,IAAI,CA8GZ"}
+{"version":3,"file":"macos-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox-utils.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC/C,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAA;IACjD,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,UAAQ,GAAG,MAAM,EAAE,CA2B5E;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,qBAAqB,KAC7B,IAAI,CAAA;AA0iBT;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,GACzB,MAAM,CA0FR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,wBAAwB,EAClC,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,MAAM,IAAI,CA8GZ"}