@carderne/sandbox-runtime 0.0.40

package/dist/sandbox/sandbox-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAQ7B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,+CAA+C;IAC/C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;QACtD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,wCAAwC;IACxC,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;KAClB,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;KACvD,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,qBAAqB;IACrB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAC9C,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAC9D,MAAM,CAAC,gBAAgB,CACxB,CAAA;QACD,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,kFAAkF;IAClF,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACvE,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,OAAO,aAAa,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,oCAAoC,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CAC9E,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,8CAA8C,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CACxF,CAAA;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,UAAU;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,MAAM,EAAE,4BAA4B,CAAA;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,eAAe,GAAG,CAAC,KAAe,EAAY,EAAE,CACpD,KAAK;SACF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE;QACV,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,eAAe,CACb,mDAAmD,CAAC,EAAE,CACvD,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACN,MAAM,cAAc,GAAG,eAAe,CACpC,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5E,CAAA;IACD,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EAAE,eAAe,CAC9B,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAC1E;KACF,CAAA;IACD,MAAM,WAAW,GACf,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAA;IACzE,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,gBAAgB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAChB,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAAA;IAC3E,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,iBAAiB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,iBAAiB;KACnC,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,cAAc,EAAE,iBAAiB,EAAE;gBACnC,4BAA4B,EAAE,+BAA+B,EAAE;gBAC/D,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,uBAAuB,EAAE,CAAA;AAC3B,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,2CAA2C;IAC3C,mBAAmB,EAAE,CAAA;IAErB,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;AACnC,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,uFAAuF;IACvF,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAgDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}

package/dist/sandbox/sandbox-schemas.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Read restriction config using a "deny then allow-back" pattern.
+ *
+ * Semantics:
+ * - `undefined` = no restrictions (allow all reads)
+ * - `{denyOnly: []}` = no restrictions (empty deny list = allow all reads)
+ * - `{denyOnly: [...paths]}` = deny reads from these paths, allow all others
+ * - `{denyOnly: [...paths], allowWithinDeny: [...paths]}` = deny reads from
+ *   denyOnly paths, but re-allow reads within allowWithinDeny paths.
+ *   allowWithinDeny takes precedence over denyOnly (most-specific rule wins).
+ *
+ * This is maximally permissive by default - only explicitly denied paths are blocked.
+ */
+export interface FsReadRestrictionConfig {
+    denyOnly: string[];
+    allowWithinDeny?: string[];
+}
+/**
+ * Write restriction config using an "allow-only" pattern.
+ *
+ * Semantics:
+ * - `undefined` = no restrictions (allow all writes)
+ * - `{allowOnly: [], denyWithinAllow: []}` = maximally restrictive (deny ALL writes)
+ * - `{allowOnly: [...paths], denyWithinAllow: [...]}` = allow writes only to these paths,
+ *   with exceptions for denyWithinAllow
+ *
+ * This is maximally restrictive by default - only explicitly allowed paths are writable.
+ * Note: Empty `allowOnly` means NO paths are writable (unlike read's empty denyOnly).
+ */
+export interface FsWriteRestrictionConfig {
+    allowOnly: string[];
+    denyWithinAllow: string[];
+}
+/**
+ * Network restriction config (internal structure built from permission rules).
+ *
+ * This uses an "allow-only" pattern (like write restrictions):
+ * - `allowedHosts` = hosts that are explicitly allowed
+ * - `deniedHosts` = hosts that are explicitly denied (checked first, before allowedHosts)
+ *
+ * Semantics:
+ * - `undefined` = maximally restrictive (deny all network)
+ * - `{allowedHosts: [], deniedHosts: []}` = maximally restrictive (nothing allowed)
+ * - `{allowedHosts: [...], deniedHosts: [...]}` = apply allow/deny rules
+ *
+ * Note: Empty `allowedHosts` means NO hosts are allowed (unlike read's empty denyOnly).
+ */
+export interface NetworkRestrictionConfig {
+    allowedHosts?: string[];
+    deniedHosts?: string[];
+}
+export type NetworkHostPattern = {
+    host: string;
+    port: number | undefined;
+};
+export type SandboxAskCallback = (params: NetworkHostPattern) => Promise<boolean>;
+//# sourceMappingURL=sandbox-schemas.d.ts.map

package/dist/sandbox/sandbox-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-schemas.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAAC,CAAA"}

package/dist/sandbox/sandbox-schemas.js

@@ -0,0 +1,3 @@
+// Filesystem restriction configs (internal structures built from permission rules)
+export {};
+//# sourceMappingURL=sandbox-schemas.js.map

package/dist/sandbox/sandbox-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-schemas.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAAA,mFAAmF"}

package/dist/sandbox/sandbox-utils.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Dangerous files that should be protected from writes.
+ * These files can be used for code execution or data exfiltration.
+ */
+export declare const DANGEROUS_FILES: readonly [".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc", ".zprofile", ".profile", ".ripgreprc", ".mcp.json"];
+/**
+ * Dangerous directories that should be protected from writes.
+ * These directories contain sensitive configuration or executable files.
+ */
+export declare const DANGEROUS_DIRECTORIES: readonly [".git", ".vscode", ".idea"];
+/**
+ * Get the list of dangerous directories to deny writes to.
+ * Excludes .git since we need it writable for git operations -
+ * instead we block specific paths within .git (hooks and config).
+ */
+export declare function getDangerousDirectories(): string[];
+/**
+ * Normalizes a path for case-insensitive comparison.
+ * This prevents bypassing security checks using mixed-case paths on case-insensitive
+ * filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
+ *
+ * We always normalize to lowercase regardless of platform for consistent security.
+ * @param path The path to normalize
+ * @returns The lowercase path for safe comparison
+ */
+export declare function normalizeCaseForComparison(pathStr: string): string;
+/**
+ * Check if a path pattern contains glob characters
+ */
+export declare function containsGlobChars(pathPattern: string): boolean;
+/**
+ * Remove trailing /** glob suffix from a path pattern
+ * Used to normalize path patterns since /** just means "directory and everything under it"
+ */
+export declare function removeTrailingGlobSuffix(pathPattern: string): string;
+/**
+ * Check if a symlink resolution crosses expected path boundaries.
+ *
+ * When resolving symlinks for sandbox path normalization, we need to ensure
+ * the resolved path doesn't unexpectedly broaden the scope. This function
+ * returns true if the resolved path is an ancestor of the original path
+ * or resolves to a system root, which would indicate the symlink points
+ * outside expected boundaries.
+ *
+ * @param originalPath - The original path before symlink resolution
+ * @param resolvedPath - The path after fs.realpathSync() resolution
+ * @returns true if the resolved path is outside expected boundaries
+ */
+export declare function isSymlinkOutsideBoundary(originalPath: string, resolvedPath: string): boolean;
+/**
+ * Normalize a path for use in sandbox configurations
+ * Handles:
+ * - Tilde (~) expansion for home directory
+ * - Relative paths (./foo, ../foo, etc.) converted to absolute
+ * - Absolute paths remain unchanged
+ * - Symlinks are resolved to their real paths for non-glob patterns
+ * - Glob patterns preserve wildcards after path normalization
+ *
+ * Returns the absolute path with symlinks resolved (or normalized glob pattern)
+ */
+export declare function normalizePathForSandbox(pathPattern: string): string;
+/**
+ * Get recommended system paths that should be writable for commands to work properly
+ *
+ * WARNING: These default paths are intentionally broad for compatibility but may
+ * allow access to files from other processes. In highly security-sensitive
+ * environments, you should configure more restrictive write paths.
+ */
+export declare function getDefaultWritePaths(): string[];
+/**
+ * Generate proxy environment variables for sandboxed processes
+ */
+export declare function generateProxyEnvVars(httpProxyPort?: number, socksProxyPort?: number): string[];
+/**
+ * Encode a command for sandbox monitoring
+ * Truncates to 100 chars and base64 encodes to avoid parsing issues
+ */
+export declare function encodeSandboxedCommand(command: string): string;
+/**
+ * Decode a base64-encoded command from sandbox monitoring
+ */
+export declare function decodeSandboxedCommand(encodedCommand: string): string;
+/**
+ * Convert a glob pattern to a regular expression
+ *
+ * This implements gitignore-style pattern matching to match the behavior of the
+ * `ignore` library used by the permission system.
+ *
+ * Supported patterns:
+ * - * matches any characters except / (e.g., *.ts matches foo.ts but not foo/bar.ts)
+ * - ** matches any characters including / (e.g., src/**\/*.ts matches all .ts files in src/)
+ * - ? matches any single character except / (e.g., file?.txt matches file1.txt)
+ * - [abc] matches any character in the set (e.g., file[0-9].txt matches file3.txt)
+ *
+ * Exported for testing and shared between macOS sandbox profiles and Linux glob expansion.
+ */
+export declare function globToRegex(globPattern: string): string;
+/**
+ * Expand a glob pattern into concrete file paths.
+ *
+ * Used on Linux where bubblewrap doesn't support glob patterns natively.
+ * Resolves the static directory prefix, lists files recursively, and filters
+ * using globToRegex().
+ *
+ * @param globPath - A path pattern containing glob characters (e.g., ~/test/*.env)
+ * @returns Array of absolute paths matching the glob pattern
+ */
+export declare function expandGlobPattern(globPath: string): string[];
+//# sourceMappingURL=sandbox-utils.d.ts.map

package/dist/sandbox/sandbox-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,eAAO,MAAM,eAAe,kIAUlB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uCAAwC,CAAA;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAMlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAuGT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA6DnE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAgB/C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,CAAC,EAAE,MAAM,EACtB,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,EAAE,CAgGV;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAkBvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsD5D"}

package/dist/sandbox/sandbox-utils.js

@@ -0,0 +1,429 @@
+import { homedir } from 'os';
+import * as path from 'path';
+import * as fs from 'fs';
+import { getPlatform } from '../utils/platform.js';
+import { logForDebugging } from '../utils/debug.js';
+/**
+ * Dangerous files that should be protected from writes.
+ * These files can be used for code execution or data exfiltration.
+ */
+export const DANGEROUS_FILES = [
+    '.gitconfig',
+    '.gitmodules',
+    '.bashrc',
+    '.bash_profile',
+    '.zshrc',
+    '.zprofile',
+    '.profile',
+    '.ripgreprc',
+    '.mcp.json',
+];
+/**
+ * Dangerous directories that should be protected from writes.
+ * These directories contain sensitive configuration or executable files.
+ */
+export const DANGEROUS_DIRECTORIES = ['.git', '.vscode', '.idea'];
+/**
+ * Get the list of dangerous directories to deny writes to.
+ * Excludes .git since we need it writable for git operations -
+ * instead we block specific paths within .git (hooks and config).
+ */
+export function getDangerousDirectories() {
+    return [
+        ...DANGEROUS_DIRECTORIES.filter(d => d !== '.git'),
+        '.claude/commands',
+        '.claude/agents',
+    ];
+}
+/**
+ * Normalizes a path for case-insensitive comparison.
+ * This prevents bypassing security checks using mixed-case paths on case-insensitive
+ * filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
+ *
+ * We always normalize to lowercase regardless of platform for consistent security.
+ * @param path The path to normalize
+ * @returns The lowercase path for safe comparison
+ */
+export function normalizeCaseForComparison(pathStr) {
+    return pathStr.toLowerCase();
+}
+/**
+ * Check if a path pattern contains glob characters
+ */
+export function containsGlobChars(pathPattern) {
+    return (pathPattern.includes('*') ||
+        pathPattern.includes('?') ||
+        pathPattern.includes('[') ||
+        pathPattern.includes(']'));
+}
+/**
+ * Remove trailing /** glob suffix from a path pattern
+ * Used to normalize path patterns since /** just means "directory and everything under it"
+ */
+export function removeTrailingGlobSuffix(pathPattern) {
+    const stripped = pathPattern.replace(/\/\*\*$/, '');
+    return stripped || '/';
+}
+/**
+ * Check if a symlink resolution crosses expected path boundaries.
+ *
+ * When resolving symlinks for sandbox path normalization, we need to ensure
+ * the resolved path doesn't unexpectedly broaden the scope. This function
+ * returns true if the resolved path is an ancestor of the original path
+ * or resolves to a system root, which would indicate the symlink points
+ * outside expected boundaries.
+ *
+ * @param originalPath - The original path before symlink resolution
+ * @param resolvedPath - The path after fs.realpathSync() resolution
+ * @returns true if the resolved path is outside expected boundaries
+ */
+export function isSymlinkOutsideBoundary(originalPath, resolvedPath) {
+    const normalizedOriginal = path.normalize(originalPath);
+    const normalizedResolved = path.normalize(resolvedPath);
+    // Same path after normalization - OK
+    if (normalizedResolved === normalizedOriginal) {
+        return false;
+    }
+    // Handle macOS /tmp -> /private/tmp canonical resolution
+    // This is a legitimate system symlink that should be allowed
+    // /tmp/claude -> /private/tmp/claude is OK
+    // /var/folders/... -> /private/var/folders/... is OK
+    if (normalizedOriginal.startsWith('/tmp/') &&
+        normalizedResolved === '/private' + normalizedOriginal) {
+        return false;
+    }
+    if (normalizedOriginal.startsWith('/var/') &&
+        normalizedResolved === '/private' + normalizedOriginal) {
+        return false;
+    }
+    // Also handle the reverse: /private/tmp/... resolving to itself
+    if (normalizedOriginal.startsWith('/private/tmp/') &&
+        normalizedResolved === normalizedOriginal) {
+        return false;
+    }
+    if (normalizedOriginal.startsWith('/private/var/') &&
+        normalizedResolved === normalizedOriginal) {
+        return false;
+    }
+    // If resolved path is "/" it's outside expected boundaries
+    if (normalizedResolved === '/') {
+        return true;
+    }
+    // If resolved path is very short (single component like /tmp, /usr, /var),
+    // it's likely outside expected boundaries
+    const resolvedParts = normalizedResolved.split('/').filter(Boolean);
+    if (resolvedParts.length <= 1) {
+        return true;
+    }
+    // If original path starts with resolved path, the resolved path is an ancestor
+    // e.g., /tmp/claude -> /tmp means the symlink points to a broader scope
+    if (normalizedOriginal.startsWith(normalizedResolved + '/')) {
+        return true;
+    }
+    // Also check the canonical form of the original path for macOS
+    // e.g., /tmp/claude should also be checked as /private/tmp/claude
+    let canonicalOriginal = normalizedOriginal;
+    if (normalizedOriginal.startsWith('/tmp/')) {
+        canonicalOriginal = '/private' + normalizedOriginal;
+    }
+    else if (normalizedOriginal.startsWith('/var/')) {
+        canonicalOriginal = '/private' + normalizedOriginal;
+    }
+    if (canonicalOriginal !== normalizedOriginal &&
+        canonicalOriginal.startsWith(normalizedResolved + '/')) {
+        return true;
+    }
+    // STRICT CHECK: Only allow resolutions that stay within the expected path tree
+    // The resolved path must either:
+    // 1. Start with the original path (deeper/same) - already covered by returning false below
+    // 2. Start with the canonical original (deeper/same under canonical form)
+    // 3. BE the canonical form of the original (e.g., /tmp/x -> /private/tmp/x)
+    // Any other resolution (e.g., /tmp/claude -> /Users/dworken) is outside expected bounds
+    const resolvedStartsWithOriginal = normalizedResolved.startsWith(normalizedOriginal + '/');
+    const resolvedStartsWithCanonical = canonicalOriginal !== normalizedOriginal &&
+        normalizedResolved.startsWith(canonicalOriginal + '/');
+    const resolvedIsCanonical = canonicalOriginal !== normalizedOriginal &&
+        normalizedResolved === canonicalOriginal;
+    const resolvedIsSame = normalizedResolved === normalizedOriginal;
+    // If resolved path is not within expected tree, it's outside boundary
+    if (!resolvedIsSame &&
+        !resolvedIsCanonical &&
+        !resolvedStartsWithOriginal &&
+        !resolvedStartsWithCanonical) {
+        return true;
+    }
+    // Allow resolution to same directory level or deeper within expected tree
+    return false;
+}
+/**
+ * Normalize a path for use in sandbox configurations
+ * Handles:
+ * - Tilde (~) expansion for home directory
+ * - Relative paths (./foo, ../foo, etc.) converted to absolute
+ * - Absolute paths remain unchanged
+ * - Symlinks are resolved to their real paths for non-glob patterns
+ * - Glob patterns preserve wildcards after path normalization
+ *
+ * Returns the absolute path with symlinks resolved (or normalized glob pattern)
+ */
+export function normalizePathForSandbox(pathPattern) {
+    const cwd = process.cwd();
+    let normalizedPath = pathPattern;
+    // Expand ~ to home directory
+    if (pathPattern === '~') {
+        normalizedPath = homedir();
+    }
+    else if (pathPattern.startsWith('~/')) {
+        normalizedPath = homedir() + pathPattern.slice(1);
+    }
+    else if (pathPattern.startsWith('./') || pathPattern.startsWith('../')) {
+        // Convert relative to absolute based on current working directory
+        normalizedPath = path.resolve(cwd, pathPattern);
+    }
+    else if (!path.isAbsolute(pathPattern)) {
+        // Handle other relative paths (e.g., ".", "..", "foo/bar")
+        normalizedPath = path.resolve(cwd, pathPattern);
+    }
+    // For glob patterns, resolve symlinks for the directory portion only
+    if (containsGlobChars(normalizedPath)) {
+        // Extract the static directory prefix before glob characters
+        const staticPrefix = normalizedPath.split(/[*?[\]]/)[0];
+        if (staticPrefix && staticPrefix !== '/') {
+            // Get the directory containing the glob pattern
+            // If staticPrefix ends with /, remove it to get the directory
+            const baseDir = staticPrefix.endsWith('/')
+                ? staticPrefix.slice(0, -1)
+                : path.dirname(staticPrefix);
+            // Try to resolve symlinks for the base directory
+            try {
+                const resolvedBaseDir = fs.realpathSync(baseDir);
+                // Validate that resolution stays within expected boundaries
+                if (!isSymlinkOutsideBoundary(baseDir, resolvedBaseDir)) {
+                    // Reconstruct the pattern with the resolved directory
+                    const patternSuffix = normalizedPath.slice(baseDir.length);
+                    return resolvedBaseDir + patternSuffix;
+                }
+                // If resolution would broaden scope, keep original pattern
+            }
+            catch {
+                // If directory doesn't exist or can't be resolved, keep the original pattern
+            }
+        }
+        return normalizedPath;
+    }
+    // Resolve symlinks to real paths to avoid bwrap issues
+    // Validate that the resolution stays within expected boundaries
+    try {
+        const resolvedPath = fs.realpathSync(normalizedPath);
+        // Only use resolved path if it doesn't cross boundary (e.g., symlink to parent dir)
+        if (isSymlinkOutsideBoundary(normalizedPath, resolvedPath)) {
+            // Symlink points outside expected boundaries - keep original path
+        }
+        else {
+            normalizedPath = resolvedPath;
+        }
+    }
+    catch {
+        // If path doesn't exist or can't be resolved, keep the normalized path
+    }
+    return normalizedPath;
+}
+/**
+ * Get recommended system paths that should be writable for commands to work properly
+ *
+ * WARNING: These default paths are intentionally broad for compatibility but may
+ * allow access to files from other processes. In highly security-sensitive
+ * environments, you should configure more restrictive write paths.
+ */
+export function getDefaultWritePaths() {
+    const homeDir = homedir();
+    const recommendedPaths = [
+        '/dev/stdout',
+        '/dev/stderr',
+        '/dev/null',
+        '/dev/tty',
+        '/dev/dtracehelper',
+        '/dev/autofs_nowait',
+        '/tmp/claude',
+        '/private/tmp/claude',
+        path.join(homeDir, '.npm/_logs'),
+        path.join(homeDir, '.claude/debug'),
+    ];
+    return recommendedPaths;
+}
+/**
+ * Generate proxy environment variables for sandboxed processes
+ */
+export function generateProxyEnvVars(httpProxyPort, socksProxyPort) {
+    // Respect CLAUDE_TMPDIR if set, otherwise default to /tmp/claude
+    const tmpdir = process.env.CLAUDE_TMPDIR || '/tmp/claude';
+    const envVars = [`SANDBOX_RUNTIME=1`, `TMPDIR=${tmpdir}`];
+    // If no proxy ports provided, return minimal env vars
+    if (!httpProxyPort && !socksProxyPort) {
+        return envVars;
+    }
+    // Always set NO_PROXY to exclude localhost and private networks from proxying
+    const noProxyAddresses = [
+        'localhost',
+        '127.0.0.1',
+        '::1',
+        '*.local',
+        '.local',
+        '169.254.0.0/16', // Link-local
+        '10.0.0.0/8', // Private network
+        '172.16.0.0/12', // Private network
+        '192.168.0.0/16', // Private network
+    ].join(',');
+    envVars.push(`NO_PROXY=${noProxyAddresses}`);
+    envVars.push(`no_proxy=${noProxyAddresses}`);
+    if (httpProxyPort) {
+        envVars.push(`HTTP_PROXY=http://localhost:${httpProxyPort}`);
+        envVars.push(`HTTPS_PROXY=http://localhost:${httpProxyPort}`);
+        // Lowercase versions for compatibility with some tools
+        envVars.push(`http_proxy=http://localhost:${httpProxyPort}`);
+        envVars.push(`https_proxy=http://localhost:${httpProxyPort}`);
+    }
+    if (socksProxyPort) {
+        // Use socks5h:// for proper DNS resolution through proxy
+        envVars.push(`ALL_PROXY=socks5h://localhost:${socksProxyPort}`);
+        envVars.push(`all_proxy=socks5h://localhost:${socksProxyPort}`);
+        // Configure Git to use SSH through SOCKS proxy (platform-aware)
+        if (getPlatform() === 'macos') {
+            // macOS has nc available
+            // Note: No outer quotes - bwrap --setenv sets the value directly without shell interpretation
+            envVars.push(`GIT_SSH_COMMAND=ssh -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`);
+        }
+        // FTP proxy support (use socks5h for DNS resolution through proxy)
+        envVars.push(`FTP_PROXY=socks5h://localhost:${socksProxyPort}`);
+        envVars.push(`ftp_proxy=socks5h://localhost:${socksProxyPort}`);
+        // rsync proxy support
+        envVars.push(`RSYNC_PROXY=localhost:${socksProxyPort}`);
+        // Database tools NOTE: Most database clients don't have built-in proxy support
+        // You typically need to use SSH tunneling or a SOCKS wrapper like tsocks/proxychains
+        // Docker CLI uses HTTP for the API
+        // This makes Docker use the HTTP proxy for registry operations
+        envVars.push(`DOCKER_HTTP_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
+        envVars.push(`DOCKER_HTTPS_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
+        // Kubernetes kubectl - uses standard HTTPS_PROXY
+        // kubectl respects HTTPS_PROXY which we already set above
+        // AWS CLI - uses standard HTTPS_PROXY (v2 supports it well)
+        // AWS CLI v2 respects HTTPS_PROXY which we already set above
+        // Google Cloud SDK - has specific proxy settings
+        // Use HTTPS proxy to match other HTTP-based tools
+        if (httpProxyPort) {
+            envVars.push(`CLOUDSDK_PROXY_TYPE=https`);
+            envVars.push(`CLOUDSDK_PROXY_ADDRESS=localhost`);
+            envVars.push(`CLOUDSDK_PROXY_PORT=${httpProxyPort}`);
+        }
+        // Azure CLI - uses HTTPS_PROXY
+        // Azure CLI respects HTTPS_PROXY which we already set above
+        // Terraform - uses standard HTTP/HTTPS proxy vars
+        // Terraform respects HTTP_PROXY/HTTPS_PROXY which we already set above
+        // gRPC-based tools - use standard proxy vars
+        envVars.push(`GRPC_PROXY=socks5h://localhost:${socksProxyPort}`);
+        envVars.push(`grpc_proxy=socks5h://localhost:${socksProxyPort}`);
+    }
+    // WARNING: Do not set HTTP_PROXY/HTTPS_PROXY to SOCKS URLs when only SOCKS proxy is available
+    // Most HTTP clients do not support SOCKS URLs in these variables and will fail, and we want
+    // to avoid overriding the client otherwise respecting the ALL_PROXY env var which points to SOCKS.
+    return envVars;
+}
+/**
+ * Encode a command for sandbox monitoring
+ * Truncates to 100 chars and base64 encodes to avoid parsing issues
+ */
+export function encodeSandboxedCommand(command) {
+    const truncatedCommand = command.slice(0, 100);
+    return Buffer.from(truncatedCommand).toString('base64');
+}
+/**
+ * Decode a base64-encoded command from sandbox monitoring
+ */
+export function decodeSandboxedCommand(encodedCommand) {
+    return Buffer.from(encodedCommand, 'base64').toString('utf8');
+}
+/**
+ * Convert a glob pattern to a regular expression
+ *
+ * This implements gitignore-style pattern matching to match the behavior of the
+ * `ignore` library used by the permission system.
+ *
+ * Supported patterns:
+ * - * matches any characters except / (e.g., *.ts matches foo.ts but not foo/bar.ts)
+ * - ** matches any characters including / (e.g., src/**\/*.ts matches all .ts files in src/)
+ * - ? matches any single character except / (e.g., file?.txt matches file1.txt)
+ * - [abc] matches any character in the set (e.g., file[0-9].txt matches file3.txt)
+ *
+ * Exported for testing and shared between macOS sandbox profiles and Linux glob expansion.
+ */
+export function globToRegex(globPattern) {
+    return ('^' +
+        globPattern
+            // Escape regex special characters (except glob chars * ? [ ])
+            .replace(/[.^$+{}()|\\]/g, '\\$&')
+            // Escape unclosed brackets (no matching ])
+            .replace(/\[([^\]]*?)$/g, '\\[$1')
+            // Convert glob patterns to regex (order matters - ** before *)
+            .replace(/\*\*\//g, '__GLOBSTAR_SLASH__') // Placeholder for **/
+            .replace(/\*\*/g, '__GLOBSTAR__') // Placeholder for **
+            .replace(/\*/g, '[^/]*') // * matches anything except /
+            .replace(/\?/g, '[^/]') // ? matches single character except /
+            // Restore placeholders
+            .replace(/__GLOBSTAR_SLASH__/g, '(.*/)?') // **/ matches zero or more dirs
+            .replace(/__GLOBSTAR__/g, '.*') + // ** matches anything including /
+        '$');
+}
+/**
+ * Expand a glob pattern into concrete file paths.
+ *
+ * Used on Linux where bubblewrap doesn't support glob patterns natively.
+ * Resolves the static directory prefix, lists files recursively, and filters
+ * using globToRegex().
+ *
+ * @param globPath - A path pattern containing glob characters (e.g., ~/test/*.env)
+ * @returns Array of absolute paths matching the glob pattern
+ */
+export function expandGlobPattern(globPath) {
+    const normalizedPattern = normalizePathForSandbox(globPath);
+    // Extract the static directory prefix before any glob characters
+    const staticPrefix = normalizedPattern.split(/[*?[\]]/)[0];
+    if (!staticPrefix || staticPrefix === '/') {
+        logForDebugging(`[Sandbox] Glob pattern too broad, skipping: ${globPath}`);
+        return [];
+    }
+    // Get the base directory from the static prefix
+    const baseDir = staticPrefix.endsWith('/')
+        ? staticPrefix.slice(0, -1)
+        : path.dirname(staticPrefix);
+    if (!fs.existsSync(baseDir)) {
+        logForDebugging(`[Sandbox] Base directory for glob does not exist: ${baseDir}`);
+        return [];
+    }
+    // Build regex from the normalized glob pattern
+    const regex = new RegExp(globToRegex(normalizedPattern));
+    // List all entries recursively under the base directory
+    const results = [];
+    try {
+        const entries = fs.readdirSync(baseDir, {
+            recursive: true,
+            withFileTypes: true,
+        });
+        for (const entry of entries) {
+            // Build the full path for this entry
+            // entry.parentPath is the directory containing this entry (available in Node 20+/Bun)
+            // For compatibility, fall back to entry.path if parentPath is not available
+            const parentDir = entry.parentPath ??
+                entry.path ??
+                baseDir;
+            const fullPath = path.join(parentDir, entry.name);
+            if (regex.test(fullPath)) {
+                results.push(fullPath);
+            }
+        }
+    }
+    catch (err) {
+        logForDebugging(`[Sandbox] Error expanding glob pattern ${globPath}: ${err}`);
+    }
+    return results;
+}
+//# sourceMappingURL=sandbox-utils.js.map