@cdoing/core 0.1.0

package/dist/sandbox/manager.js

@@ -0,0 +1,220 @@
+"use strict";
+/**
+ * Sandbox Manager — orchestrates filesystem and network sandbox enforcement.
+ *
+ * Loads sandbox configuration from .claude/settings.json files using the
+ * same hierarchy as the permission system (local → shared → user).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxManager = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const types_1 = require("./types");
+const filesystem_1 = require("./filesystem");
+const network_1 = require("./network");
+const HOME_DIR = os.homedir();
+const USER_SETTINGS_FILE = path.join(HOME_DIR, ".claude", "settings.json");
+class SandboxManager {
+    config;
+    workingDir;
+    projectDir;
+    sessionApprovedDomains = new Set();
+    domainPromptFn = null;
+    constructor(workingDir, projectDir) {
+        this.workingDir = path.resolve(workingDir);
+        this.projectDir = projectDir ? path.resolve(projectDir) : this.workingDir;
+        this.config = (0, types_1.defaultSandboxConfig)();
+        this.loadConfig();
+    }
+    // ── Config loading ──────────────────────────────────────────────────────────
+    /**
+     * Load and merge sandbox config from settings files.
+     * Precedence: local project → shared project → user (highest to lowest).
+     * Arrays are merged (not replaced) across scopes.
+     */
+    loadConfig() {
+        const candidates = [
+            path.join(this.projectDir, ".claude", "settings.local.json"),
+            path.join(this.projectDir, ".claude", "settings.json"),
+            USER_SETTINGS_FILE,
+        ];
+        const merged = (0, types_1.defaultSandboxConfig)();
+        for (const filePath of candidates) {
+            try {
+                if (!fs.existsSync(filePath))
+                    continue;
+                const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+                if (!data.sandbox)
+                    continue;
+                const sb = data.sandbox;
+                // enabled: any scope can enable
+                if (sb.enabled === true)
+                    merged.enabled = true;
+                // mode: highest-precedence scope wins (first found)
+                if (sb.mode && merged.mode === "regular") {
+                    merged.mode = sb.mode;
+                }
+                // Filesystem arrays are merged
+                if (sb.filesystem) {
+                    if (Array.isArray(sb.filesystem.allowWrite)) {
+                        merged.filesystem.allowWrite.push(...sb.filesystem.allowWrite);
+                    }
+                    if (Array.isArray(sb.filesystem.denyWrite)) {
+                        merged.filesystem.denyWrite.push(...sb.filesystem.denyWrite);
+                    }
+                    if (Array.isArray(sb.filesystem.denyRead)) {
+                        merged.filesystem.denyRead.push(...sb.filesystem.denyRead);
+                    }
+                }
+                // Network: merge domains
+                if (sb.network) {
+                    if (Array.isArray(sb.network.allowedDomains)) {
+                        merged.network.allowedDomains.push(...sb.network.allowedDomains);
+                    }
+                    if (sb.network.allowManagedDomainsOnly === true) {
+                        merged.network.allowManagedDomainsOnly = true;
+                    }
+                }
+                // Excluded commands: merge
+                if (Array.isArray(sb.excludedCommands)) {
+                    merged.excludedCommands.push(...sb.excludedCommands);
+                }
+                // allowUnsandboxedCommands: false from any scope wins (restrictive)
+                if (sb.allowUnsandboxedCommands === false) {
+                    merged.allowUnsandboxedCommands = false;
+                }
+            }
+            catch {
+                // Skip malformed files
+            }
+        }
+        // Deduplicate arrays
+        merged.filesystem.allowWrite = [...new Set(merged.filesystem.allowWrite)];
+        merged.filesystem.denyWrite = [...new Set(merged.filesystem.denyWrite)];
+        merged.filesystem.denyRead = [...new Set(merged.filesystem.denyRead)];
+        merged.network.allowedDomains = [...new Set(merged.network.allowedDomains)];
+        merged.excludedCommands = [...new Set(merged.excludedCommands)];
+        this.config = merged;
+    }
+    // ── Public API ──────────────────────────────────────────────────────────────
+    getConfig() {
+        return this.config;
+    }
+    isEnabled() {
+        return this.config.enabled;
+    }
+    getMode() {
+        return this.config.mode;
+    }
+    setDomainPromptFn(fn) {
+        this.domainPromptFn = fn;
+    }
+    approveDomain(domain) {
+        this.sessionApprovedDomains.add(domain);
+    }
+    // ── Access checks ─────────────────────────────────────────────────────────
+    checkFileRead(filePath) {
+        return (0, filesystem_1.checkReadAccess)(filePath, this.config, this.workingDir, this.projectDir);
+    }
+    checkFileWrite(filePath) {
+        return (0, filesystem_1.checkWriteAccess)(filePath, this.config, this.workingDir, this.projectDir);
+    }
+    /**
+     * Check if a shell command is allowed by sandbox rules.
+     * Returns denied if dangerouslyDisableSandbox is used but not allowed.
+     */
+    checkShellCommand(command, dangerouslyDisableSandbox) {
+        if (!this.config.enabled)
+            return { allowed: true };
+        // Handle dangerouslyDisableSandbox escape hatch
+        if (dangerouslyDisableSandbox) {
+            if (!this.config.allowUnsandboxedCommands) {
+                return {
+                    allowed: false,
+                    reason: "Sandbox: dangerouslyDisableSandbox is not allowed (allowUnsandboxedCommands is false)",
+                };
+            }
+            // Allowed to bypass sandbox — permission system still applies
+            return { allowed: true };
+        }
+        // Check if command is excluded from sandbox
+        if (this.isExcludedCommand(command)) {
+            return { allowed: true };
+        }
+        // Check command paths heuristically
+        return (0, filesystem_1.checkShellCommandPaths)(command, this.config, this.workingDir, this.projectDir);
+    }
+    /**
+     * Check if network access to a URL is allowed.
+     * If the domain needs user approval, triggers the domain prompt.
+     */
+    async checkNetworkAccess(url) {
+        const result = (0, network_1.checkDomainAccess)(url, this.config, this.sessionApprovedDomains);
+        if (result.promptUser && result.domain && this.domainPromptFn) {
+            const approved = await this.domainPromptFn(result.domain);
+            if (approved) {
+                this.sessionApprovedDomains.add(result.domain);
+                return { allowed: true };
+            }
+            return {
+                allowed: false,
+                reason: `Sandbox: user denied network access to domain "${result.domain}"`,
+            };
+        }
+        return result;
+    }
+    /**
+     * Check if a command prefix matches any excluded command.
+     */
+    isExcludedCommand(command) {
+        const trimmed = command.trimStart();
+        for (const excluded of this.config.excludedCommands) {
+            if (trimmed === excluded || trimmed.startsWith(excluded + " ") || trimmed.startsWith(excluded + "\t")) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get a sandboxed environment for shell command execution.
+     */
+    getShellEnv() {
+        return (0, network_1.buildSandboxedEnv)(this.config, process.env);
+    }
+}
+exports.SandboxManager = SandboxManager;
+//# sourceMappingURL=manager.js.map

package/dist/sandbox/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/sandbox/manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAEzB,mCAA+C;AAC/C,6CAAyF;AACzF,uCAAiE;AAEjE,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAE3E,MAAa,cAAc;IACjB,MAAM,CAAgB;IACtB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,cAAc,GAAkD,IAAI,CAAC;IAE7E,YAAY,UAAkB,EAAE,UAAmB;QACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,IAAA,4BAAoB,GAAE,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,+EAA+E;IAE/E;;;;OAIG;IACH,UAAU;QACR,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,qBAAqB,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC;YACtD,kBAAkB;SACnB,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,4BAAoB,GAAE,CAAC;QAEtC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;gBAExB,gCAAgC;gBAChC,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;oBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBAE/C,oDAAoD;gBACpD,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,IAAmB,CAAC;gBACvC,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC5C,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;oBACjE,CAAC;oBACD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC3C,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBAC/D,CAAC;oBACD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC1C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAED,yBAAyB;gBACzB,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACf,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC7C,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;oBACnE,CAAC;oBACD,IAAI,EAAE,CAAC,OAAO,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;wBAChD,MAAM,CAAC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAED,2BAA2B;gBAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;gBACvD,CAAC;gBAED,oEAAoE;gBACpE,IAAI,EAAE,CAAC,wBAAwB,KAAK,KAAK,EAAE,CAAC;oBAC1C,MAAM,CAAC,wBAAwB,GAAG,KAAK,CAAC;gBAC1C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,+EAA+E;IAE/E,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,iBAAiB,CAAC,EAAwC;QACxD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,6EAA6E;IAE7E,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAA,4BAAe,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClF,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAA,6BAAgB,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,OAAe,EAAE,yBAAmC;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEnD,gDAAgD;QAChD,IAAI,yBAAyB,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;gBAC1C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uFAAuF;iBAChG,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,oCAAoC;QACpC,OAAO,IAAA,mCAAsB,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,IAAA,2BAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAEhF,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kDAAkD,MAAM,CAAC,MAAM,GAAG;aAC3E,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,OAAe;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACpD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtG,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAA,2BAAiB,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;CACF;AAlMD,wCAkMC"}

package/dist/sandbox/network.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Sandbox Network — domain access checks and environment restrictions.
+ */
+import type { SandboxConfig, SandboxCheckResult } from "./types";
+/**
+ * Check whether accessing a URL is allowed by sandbox network rules.
+ */
+export declare function checkDomainAccess(url: string, config: SandboxConfig, sessionApprovedDomains: Set<string>): SandboxCheckResult;
+/**
+ * Build a sandboxed environment for shell command execution.
+ * Sets proxy env vars as a best-effort network restriction.
+ */
+export declare function buildSandboxedEnv(config: SandboxConfig, baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=network.d.ts.map

package/dist/sandbox/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/sandbox/network.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEjE;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,GAClC,kBAAkB,CA0CpB;AAeD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,CAAC,UAAU,GACzB,MAAM,CAAC,UAAU,CAuBnB"}

package/dist/sandbox/network.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Sandbox Network — domain access checks and environment restrictions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDomainAccess = checkDomainAccess;
+exports.buildSandboxedEnv = buildSandboxedEnv;
+/**
+ * Check whether accessing a URL is allowed by sandbox network rules.
+ */
+function checkDomainAccess(url, config, sessionApprovedDomains) {
+    if (!config.enabled)
+        return { allowed: true };
+    let hostname;
+    try {
+        hostname = new URL(url).hostname;
+    }
+    catch {
+        return { allowed: false, reason: `Sandbox: invalid URL "${url}"` };
+    }
+    // Check against allowed domains (exact or subdomain match)
+    if (isDomainAllowed(hostname, config.network.allowedDomains)) {
+        return { allowed: true };
+    }
+    // Check session-approved domains
+    if (sessionApprovedDomains.has(hostname)) {
+        return { allowed: true };
+    }
+    // Check if any parent domain was session-approved
+    for (const approved of sessionApprovedDomains) {
+        if (hostname.endsWith("." + approved)) {
+            return { allowed: true };
+        }
+    }
+    // Domain not allowed
+    if (config.network.allowManagedDomainsOnly) {
+        return {
+            allowed: false,
+            reason: `Sandbox: network access denied for domain "${hostname}" (not in allowedDomains and allowManagedDomainsOnly is enabled)`,
+        };
+    }
+    // Prompt user for approval
+    return {
+        allowed: false,
+        promptUser: true,
+        domain: hostname,
+        reason: `Sandbox: domain "${hostname}" is not in the allowed list`,
+    };
+}
+/**
+ * Check if a hostname matches any of the allowed domains.
+ * Supports exact match and subdomain match (e.g., "github.com" matches "api.github.com").
+ */
+function isDomainAllowed(hostname, allowedDomains) {
+    for (const domain of allowedDomains) {
+        if (hostname === domain || hostname.endsWith("." + domain)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Build a sandboxed environment for shell command execution.
+ * Sets proxy env vars as a best-effort network restriction.
+ */
+function buildSandboxedEnv(config, baseEnv) {
+    if (!config.enabled)
+        return { ...baseEnv };
+    const env = { ...baseEnv };
+    // Remove potentially dangerous env vars that could leak credentials
+    const sensitiveVars = [
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "NPM_TOKEN",
+        "DOCKER_PASSWORD",
+    ];
+    for (const v of sensitiveVars) {
+        // Only remove if sandbox is actively restricting network
+        if (config.network.allowedDomains.length > 0 || config.network.allowManagedDomainsOnly) {
+            delete env[v];
+        }
+    }
+    return env;
+}
+//# sourceMappingURL=network.js.map

package/dist/sandbox/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/sandbox/network.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAOH,8CA8CC;AAmBD,8CA0BC;AA9FD;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,GAAW,EACX,MAAqB,EACrB,sBAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE9C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,GAAG,EAAE,CAAC;IACrE,CAAC;IAED,2DAA2D;IAC3D,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,iCAAiC;IACjC,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,8CAA8C,QAAQ,kEAAkE;SACjI,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,OAAO;QACL,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,oBAAoB,QAAQ,8BAA8B;KACnE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,cAAwB;IACjE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,MAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAE3B,oEAAoE;IACpE,MAAM,aAAa,GAAG;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,UAAU;QACV,cAAc;QACd,WAAW;QACX,iBAAiB;KAClB,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,yDAAyD;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/sandbox/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Sandbox Types — configuration and check result interfaces.
+ */
+export interface SandboxFilesystemConfig {
+    /** Additional paths (beyond workingDir) where writes are allowed */
+    allowWrite: string[];
+    /** Paths where writes are denied */
+    denyWrite: string[];
+    /** Paths where reads are denied */
+    denyRead: string[];
+}
+export interface SandboxNetworkConfig {
+    /** Whitelisted domains for network access */
+    allowedDomains: string[];
+    /** If true, block non-allowed domains without prompting the user */
+    allowManagedDomainsOnly: boolean;
+}
+/** Sandbox operation mode */
+export type SandboxMode = "auto-allow" | "regular";
+/** Full sandbox configuration (loaded from settings files) */
+export interface SandboxConfig {
+    enabled: boolean;
+    mode: SandboxMode;
+    filesystem: SandboxFilesystemConfig;
+    network: SandboxNetworkConfig;
+    /** Commands that bypass the sandbox (e.g. "docker") */
+    excludedCommands: string[];
+    /** Whether dangerouslyDisableSandbox param is respected */
+    allowUnsandboxedCommands: boolean;
+}
+/** Result of a sandbox access check */
+export interface SandboxCheckResult {
+    allowed: boolean;
+    reason?: string;
+    /** For network checks: whether the user should be prompted about a new domain */
+    promptUser?: boolean;
+    /** The domain being requested (when promptUser is true) */
+    domain?: string;
+}
+/** Returns a default (disabled) sandbox config */
+export declare function defaultSandboxConfig(): SandboxConfig;
+//# sourceMappingURL=types.d.ts.map

package/dist/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oCAAoC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,6BAA6B;AAC7B,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,SAAS,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,uBAAuB,CAAC;IACpC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kDAAkD;AAClD,wBAAgB,oBAAoB,IAAI,aAAa,CAgBpD"}

package/dist/sandbox/types.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Sandbox Types — configuration and check result interfaces.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultSandboxConfig = defaultSandboxConfig;
+/** Returns a default (disabled) sandbox config */
+function defaultSandboxConfig() {
+    return {
+        enabled: false,
+        mode: "regular",
+        filesystem: {
+            allowWrite: [],
+            denyWrite: [],
+            denyRead: [],
+        },
+        network: {
+            allowedDomains: [],
+            allowManagedDomainsOnly: false,
+        },
+        excludedCommands: [],
+        allowUnsandboxedCommands: true,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA4CH,oDAgBC;AAjBD,kDAAkD;AAClD,SAAgB,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAS;QACf,UAAU,EAAE;YACV,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;SACb;QACD,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,uBAAuB,EAAE,KAAK;SAC/B;QACD,gBAAgB,EAAE,EAAE;QACpB,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/tools/ast-edit.d.ts

@@ -0,0 +1,57 @@
+/**
+ * AST Edit Tool — Tree-sitter powered structural code editing.
+ *
+ * Uses tree-sitter to parse source code into an AST, then performs
+ * targeted edits on specific AST nodes (functions, classes, methods,
+ * imports, etc.) by name rather than by string matching.
+ *
+ * This is more reliable than string-based editing for:
+ *   - Renaming functions/methods/classes across a file
+ *   - Replacing entire function bodies
+ *   - Adding/removing imports
+ *   - Inserting methods into classes
+ *   - Extracting or inlining code blocks
+ */
+import type { BaseTool, ToolDefinition, ToolResult } from "./types";
+import type { SandboxManager } from "../sandbox";
+export declare class ASTEditTool implements BaseTool {
+    definition: ToolDefinition;
+    private workingDir;
+    private sandboxManager?;
+    constructor(workingDir: string, sandboxManager?: SandboxManager);
+    execute(input: Record<string, unknown>): Promise<ToolResult>;
+    /**
+     * Initialize tree-sitter parser for the given file's language.
+     */
+    private initParser;
+    /**
+     * Parse source code and apply a single AST operation.
+     */
+    private applyOperation;
+    /**
+     * Find an AST node by type and name.
+     */
+    private findNode;
+    /**
+     * Walk the AST tree depth-first, calling visitor on each node.
+     */
+    private walkTree;
+    /**
+     * Check if an AST node matches the requested type category.
+     */
+    private matchesNodeType;
+    /**
+     * Extract the name identifier from an AST node.
+     */
+    private getNodeName;
+    /**
+     * Find the body/block node within a function, method, or class.
+     */
+    private findBody;
+    /**
+     * Rename a node by replacing all occurrences of the old name with the new name
+     * within the node's text range.
+     */
+    private renameNode;
+}
+//# sourceMappingURL=ast-edit.d.ts.map

package/dist/tools/ast-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-edit.d.ts","sourceRoot":"","sources":["../../src/tools/ast-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiDjD,qBAAa,WAAY,YAAW,QAAQ;IAC1C,UAAU,EAAE,cAAc,CA8DxB;IAEF,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc;IAKzD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAoElE;;OAEG;YACW,UAAU;IAgCxB;;OAEG;IACH,OAAO,CAAC,cAAc;IAqEtB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAOhB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmEvB;;OAEG;IACH,OAAO,CAAC,WAAW;IAqCnB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAgBhB;;;OAGG;IACH,OAAO,CAAC,UAAU;CAiBnB"}