@claudexor/core 3.8.0 → 3.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-capability-verifier.d.ts.map +1 -1
- package/dist/auth-capability-verifier.js +0 -1
- package/dist/auth-capability-verifier.js.map +1 -1
- package/dist/capabilities.d.ts +7 -0
- package/dist/capabilities.d.ts.map +1 -1
- package/dist/capabilities.js +13 -0
- package/dist/capabilities.js.map +1 -1
- package/dist/errors.d.ts +12 -21
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +14 -21
- package/dist/errors.js.map +1 -1
- package/dist/index.d.ts +0 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +0 -1
- package/dist/index.js.map +1 -1
- package/dist/isolation-locator.d.ts +1 -1
- package/dist/isolation-locator.js +2 -2
- package/dist/isolation-locator.js.map +1 -1
- package/dist/native/claudexor-process-identity +0 -0
- package/dist/runloop.d.ts.map +1 -1
- package/dist/runloop.js +1 -7
- package/dist/runloop.js.map +1 -1
- package/dist/runtime-env.d.ts +2 -4
- package/dist/runtime-env.d.ts.map +1 -1
- package/dist/runtime-env.js +2 -4
- package/dist/runtime-env.js.map +1 -1
- package/package.json +3 -3
- package/dist/confinement.d.ts +0 -75
- package/dist/confinement.d.ts.map +0 -1
- package/dist/confinement.js +0 -396
- package/dist/confinement.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,
|
|
1
|
+
{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4P3F;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgB/B;IAED,OAAO,CAAC,aAAa;CAYtB"}
|
|
@@ -134,7 +134,6 @@ export class AuthCapabilityVerifier {
|
|
|
134
134
|
browser: null,
|
|
135
135
|
// The auth smoke is not a delegated run and gets no boundary; stated
|
|
136
136
|
// rather than defaulted, so a new spec site cannot omit it silently.
|
|
137
|
-
confinement: null,
|
|
138
137
|
extra_mcp_servers: [],
|
|
139
138
|
stream_deltas: false,
|
|
140
139
|
extra: request.abortSignal ? { abortSignal: request.abortSignal } : {},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,qEAAqE;oBACrE,qEAAqE;oBACrE,WAAW,EAAE,IAAI;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}
|
|
1
|
+
{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,qEAAqE;oBACrE,qEAAqE;oBACrE,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}
|
package/dist/capabilities.d.ts
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
1
|
import { type HarnessCapabilityProfile } from "@claudexor/schema";
|
|
2
2
|
export declare function needsScopedHomeKeychainBridge(profile: HarnessCapabilityProfile, platform?: NodeJS.Platform): boolean;
|
|
3
|
+
/**
|
|
4
|
+
* Whether a harness owns a profile-local keychain rather than borrowing a
|
|
5
|
+
* host keychain through the Claude-specific HOME bridge. This is deliberately
|
|
6
|
+
* a separate capability: callers must not infer the private-keychain route
|
|
7
|
+
* from the bridge containment flag.
|
|
8
|
+
*/
|
|
9
|
+
export declare function needsPrivatePerProfileKeychain(profile: HarnessCapabilityProfile, platform?: NodeJS.Platform): boolean;
|
|
3
10
|
//# sourceMappingURL=capabilities.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,mBAAmB,CAAC;AAM3B,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,wBAAwB,EACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAST"}
|
|
1
|
+
{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,mBAAmB,CAAC;AAM3B,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,wBAAwB,EACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wBAAwB,EACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAST"}
|
package/dist/capabilities.js
CHANGED
|
@@ -9,4 +9,17 @@ export function needsScopedHomeKeychainBridge(profile, platform = process.platfo
|
|
|
9
9
|
return (profile.isolation.supported_containment.includes("scoped_home_keychain_bridge") &&
|
|
10
10
|
credentialTransportsForPlatform(profile.auth, hostPlatform).some((t) => t.kind === "os_keychain" && t.relocatable_by.includes("HOME")));
|
|
11
11
|
}
|
|
12
|
+
/**
|
|
13
|
+
* Whether a harness owns a profile-local keychain rather than borrowing a
|
|
14
|
+
* host keychain through the Claude-specific HOME bridge. This is deliberately
|
|
15
|
+
* a separate capability: callers must not infer the private-keychain route
|
|
16
|
+
* from the bridge containment flag.
|
|
17
|
+
*/
|
|
18
|
+
export function needsPrivatePerProfileKeychain(profile, platform = process.platform) {
|
|
19
|
+
const hostPlatform = supportedPlatform(platform);
|
|
20
|
+
if (!hostPlatform)
|
|
21
|
+
return false;
|
|
22
|
+
return (profile.isolation.supported_containment.includes("private_per_profile_keychain") &&
|
|
23
|
+
credentialTransportsForPlatform(profile.auth, hostPlatform).some((transport) => transport.kind === "os_keychain" && transport.relocatable_by.includes("HOME")));
|
|
24
|
+
}
|
|
12
25
|
//# sourceMappingURL=capabilities.js.map
|
package/dist/capabilities.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAGhC,MAAM,mBAAmB,CAAC;AAE3B,SAAS,iBAAiB,CAAC,QAAyB;IAClD,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAiC,EACjC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC/E,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrE,CACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAGhC,MAAM,mBAAmB,CAAC;AAE3B,SAAS,iBAAiB,CAAC,QAAyB;IAClD,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAiC,EACjC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC/E,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrE,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAiC,EACjC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAChF,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAC9D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC7F,CACF,CAAC;AACJ,CAAC"}
|
package/dist/errors.d.ts
CHANGED
|
@@ -24,34 +24,25 @@ export declare class DelegationBeltUnavailableError extends ClaudexorError {
|
|
|
24
24
|
readonly status = 503;
|
|
25
25
|
}
|
|
26
26
|
/**
|
|
27
|
-
* A run marked `execution.delegated` could not be
|
|
28
|
-
* HOME.
|
|
29
|
-
* the attempt refuses instead of degrading onto the operator's real home (which
|
|
30
|
-
* holds the daemon control token and the caller's own provider settings).
|
|
27
|
+
* A run marked `execution.delegated` could not be assigned its scoped harness
|
|
28
|
+
* HOME. The attempt refuses instead of degrading onto the operator's real home.
|
|
31
29
|
*/
|
|
32
30
|
export declare class DelegatedHomeUnavailableError extends ClaudexorError {
|
|
33
31
|
readonly code = "delegated_home_unavailable";
|
|
34
32
|
readonly category: "internal";
|
|
35
33
|
}
|
|
36
|
-
/**
|
|
37
|
-
*
|
|
38
|
-
* filesystem boundary — the host does not offer one, or the profile did not
|
|
39
|
-
* take effect when probed. The scoped HOME beside it is a convention that an
|
|
40
|
-
* absolute path defeats, so there is nothing to degrade onto: the attempt
|
|
41
|
-
* refuses. See docs/DELEGATED_CONFINEMENT.md.
|
|
42
|
-
*/
|
|
43
|
-
export declare class ConfinementUnavailableError extends ClaudexorError {
|
|
44
|
-
readonly code = "delegated_confinement_unavailable";
|
|
45
|
-
readonly category: "config_error";
|
|
46
|
-
}
|
|
47
|
-
/**
|
|
48
|
-
* A terminal MUTATING delegated run whose attempts do not all carry the applied
|
|
49
|
-
* HOME/access/profile/confinement facts. Asking for confinement is not evidence
|
|
50
|
-
* that it happened, so an unauditable mutating terminal is an infrastructure
|
|
51
|
-
* refusal rather than a pass.
|
|
52
|
-
*/
|
|
34
|
+
/** A terminal mutating delegated run whose attempts do not all carry complete
|
|
35
|
+
* applied HOME/access/profile/boundary-disclosure facts. */
|
|
53
36
|
export declare class DelegatedEvidenceIncompleteError extends ClaudexorError {
|
|
54
37
|
readonly code = "delegated_evidence_incomplete";
|
|
55
38
|
readonly category: "internal";
|
|
56
39
|
}
|
|
40
|
+
/** A requested access mode cannot be represented by the selected native adapter. */
|
|
41
|
+
export declare class AccessProfileIncompatibleError extends ClaudexorError {
|
|
42
|
+
readonly code = "access_profile_incompatible";
|
|
43
|
+
readonly category: "harness_unavailable";
|
|
44
|
+
readonly status = 400;
|
|
45
|
+
readonly retryable = false;
|
|
46
|
+
readonly requiredActions: string[];
|
|
47
|
+
}
|
|
57
48
|
//# sourceMappingURL=errors.d.ts.map
|
package/dist/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB;AAED
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,cAAc;IAC/D,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED;4DAC4D;AAC5D,qBAAa,gCAAiC,SAAQ,cAAc;IAClE,QAAQ,CAAC,IAAI,mCAAmC;IAChD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED,oFAAoF;AACpF,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,qBAAqB,CAAU;IACnD,QAAQ,CAAC,MAAM,OAAO;IACtB,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,eAAe,WAEtB;CACH"}
|
package/dist/errors.js
CHANGED
|
@@ -25,34 +25,27 @@ export class DelegationBeltUnavailableError extends ClaudexorError {
|
|
|
25
25
|
status = 503;
|
|
26
26
|
}
|
|
27
27
|
/**
|
|
28
|
-
* A run marked `execution.delegated` could not be
|
|
29
|
-
* HOME.
|
|
30
|
-
* the attempt refuses instead of degrading onto the operator's real home (which
|
|
31
|
-
* holds the daemon control token and the caller's own provider settings).
|
|
28
|
+
* A run marked `execution.delegated` could not be assigned its scoped harness
|
|
29
|
+
* HOME. The attempt refuses instead of degrading onto the operator's real home.
|
|
32
30
|
*/
|
|
33
31
|
export class DelegatedHomeUnavailableError extends ClaudexorError {
|
|
34
32
|
code = "delegated_home_unavailable";
|
|
35
33
|
category = "internal";
|
|
36
34
|
}
|
|
37
|
-
/**
|
|
38
|
-
*
|
|
39
|
-
* filesystem boundary — the host does not offer one, or the profile did not
|
|
40
|
-
* take effect when probed. The scoped HOME beside it is a convention that an
|
|
41
|
-
* absolute path defeats, so there is nothing to degrade onto: the attempt
|
|
42
|
-
* refuses. See docs/DELEGATED_CONFINEMENT.md.
|
|
43
|
-
*/
|
|
44
|
-
export class ConfinementUnavailableError extends ClaudexorError {
|
|
45
|
-
code = "delegated_confinement_unavailable";
|
|
46
|
-
category = "config_error";
|
|
47
|
-
}
|
|
48
|
-
/**
|
|
49
|
-
* A terminal MUTATING delegated run whose attempts do not all carry the applied
|
|
50
|
-
* HOME/access/profile/confinement facts. Asking for confinement is not evidence
|
|
51
|
-
* that it happened, so an unauditable mutating terminal is an infrastructure
|
|
52
|
-
* refusal rather than a pass.
|
|
53
|
-
*/
|
|
35
|
+
/** A terminal mutating delegated run whose attempts do not all carry complete
|
|
36
|
+
* applied HOME/access/profile/boundary-disclosure facts. */
|
|
54
37
|
export class DelegatedEvidenceIncompleteError extends ClaudexorError {
|
|
55
38
|
code = "delegated_evidence_incomplete";
|
|
56
39
|
category = "internal";
|
|
57
40
|
}
|
|
41
|
+
/** A requested access mode cannot be represented by the selected native adapter. */
|
|
42
|
+
export class AccessProfileIncompatibleError extends ClaudexorError {
|
|
43
|
+
code = "access_profile_incompatible";
|
|
44
|
+
category = "harness_unavailable";
|
|
45
|
+
status = 400;
|
|
46
|
+
retryable = false;
|
|
47
|
+
requiredActions = [
|
|
48
|
+
"Choose workspace_write on a compatible harness, or explicitly trust the repository and choose full.",
|
|
49
|
+
];
|
|
50
|
+
}
|
|
58
51
|
//# sourceMappingURL=errors.js.map
|
package/dist/errors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB;AAED
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IACtD,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED;4DAC4D;AAC5D,MAAM,OAAO,gCAAiC,SAAQ,cAAc;IACzD,IAAI,GAAG,+BAA+B,CAAC;IACvC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED,oFAAoF;AACpF,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,qBAA8B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC;IACb,SAAS,GAAG,KAAK,CAAC;IAClB,eAAe,GAAG;QACzB,qGAAqG;KACtG,CAAC;CACH"}
|
package/dist/index.d.ts
CHANGED
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}
|
package/dist/index.js
CHANGED
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}
|
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* tree — a locator inside a repository or an arbitrary user dir would put
|
|
6
6
|
* credential state where git or other tools can capture it.
|
|
7
7
|
*
|
|
8
|
-
* The
|
|
8
|
+
* The owned root FOLLOWS the v2 root (release wave round-18 #4): under
|
|
9
9
|
* an explicit CLAUDEXOR_CONFIG_DIR override that override IS the complete
|
|
10
10
|
* relocatable root — a hermetic/disposable run must accept profiles inside
|
|
11
11
|
* it and reject the host's real ~/.claudexor (host credential state must not
|
|
@@ -8,7 +8,7 @@ import { claudexorOwnedRoot } from "@claudexor/util";
|
|
|
8
8
|
* tree — a locator inside a repository or an arbitrary user dir would put
|
|
9
9
|
* credential state where git or other tools can capture it.
|
|
10
10
|
*
|
|
11
|
-
* The
|
|
11
|
+
* The owned root FOLLOWS the v2 root (release wave round-18 #4): under
|
|
12
12
|
* an explicit CLAUDEXOR_CONFIG_DIR override that override IS the complete
|
|
13
13
|
* relocatable root — a hermetic/disposable run must accept profiles inside
|
|
14
14
|
* it and reject the host's real ~/.claudexor (host credential state must not
|
|
@@ -41,7 +41,7 @@ export function canonicalIsolationLocator(locator, label) {
|
|
|
41
41
|
if (!isAbsolute(locator))
|
|
42
42
|
throw new Error(`${label} must be absolute: ${locator}`);
|
|
43
43
|
const dir = normalizeThroughExistingAncestor(locator);
|
|
44
|
-
// Normalize the
|
|
44
|
+
// Normalize the owned root the SAME way as the locator (round-19,
|
|
45
45
|
// fable checkpoint): a not-yet-created CLAUDEXOR_CONFIG_DIR under a
|
|
46
46
|
// symlinked parent (/var → /private/var on macOS) would otherwise compare
|
|
47
47
|
// unequal to a locator that was resolved through that symlink, and
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isolation-locator.js","sourceRoot":"","sources":["../src/isolation-locator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH;;;kCAGkC;AAClC,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,IAAI,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACtD,
|
|
1
|
+
{"version":3,"file":"isolation-locator.js","sourceRoot":"","sources":["../src/isolation-locator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH;;;kCAGkC;AAClC,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,IAAI,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACtD,kEAAkE;IAClE,oEAAoE;IACpE,0EAA0E;IAC1E,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,KAAK,GAAG,gCAAgC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
Binary file
|
package/dist/runloop.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAkC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAOjF;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;IAChF,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,KAAK,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;KAC1C,CAAC;IACF;;iCAE6B;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CACjF;AAED,wBAAuB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC,YAAY,CAAC,CAkL1F"}
|
package/dist/runloop.js
CHANGED
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import { confinedInvocation } from "./confinement.js";
|
|
2
1
|
import { spawnProcess } from "./proc.js";
|
|
3
2
|
/**
|
|
4
3
|
* Shared CLI adapter run loop.
|
|
@@ -59,13 +58,8 @@ export async function* runCliHarness(opts) {
|
|
|
59
58
|
// Box the stdin handle: it is assigned inside the onSpawn callback, which
|
|
60
59
|
// TypeScript's control-flow narrowing cannot see through a plain let.
|
|
61
60
|
const session = { io: null };
|
|
62
|
-
// The OS boundary is applied HERE, at the one seam every local-CLI adapter
|
|
63
|
-
// already funnels through, rather than in each adapter's argv builder: an
|
|
64
|
-
// adapter that forgot to opt in would run a delegated child unconfined while
|
|
65
|
-
// the run record still said it asked for confinement.
|
|
66
|
-
const invocation = confinedInvocation(spec.confinement, opts.bin, opts.args);
|
|
67
61
|
try {
|
|
68
|
-
for await (const ev of spawnProcess(
|
|
62
|
+
for await (const ev of spawnProcess(opts.bin, opts.args, {
|
|
69
63
|
cwd: spec.cwd,
|
|
70
64
|
env: opts.env,
|
|
71
65
|
inheritEnv: spec.env_inheritance,
|
package/dist/runloop.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAmB,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAG,MAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU;QAC/F,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAyCD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,sBAAsB,GAGf,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,sBAAsB,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,CAAC,EAAc,EAAE,EAAE;wBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;wBAChB,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;4BAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACtE,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,EAAE,CAAC;YACH,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBAC1C,yEAAyE;gBACzE,oEAAoE;gBACpE,sBAAsB,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;gBAChF,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;wBAAE,QAAQ,GAAG,IAAI,CAAC;oBAC1C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,yBAAyB,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC1C,MAAM,GAAG,CAAC;gBACV,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,kDAAkD,sBAAsB,CAAC,SAAS,CAAC,MAAM,sBACtG,sBAAsB,CAAC,UAAU,CAAC,MAAM;gBACtC,CAAC,CAAC,KAAK,sBAAsB,CAAC,UAAU,CAAC,MAAM,oCAAoC;gBACnF,CAAC,CAAC,EACN,EAAE;SACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACxE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,yBAAyB,UAAU,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,oBAAoB,GAAG,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,oBAAoB,CAAC;IACvF,IAAI,yBAAyB,GAAG,CAAC;QAC/B,OAAO,CAAC,6BAA6B,CAAC,GAAG,yBAAyB,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACvD,iFAAiF;IACjF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,yBAAyB,CAAC,GAAG;YACnC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,OAAO,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAChD,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,YAAY;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC;IACxD,MAAM;QACJ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,EAAE,EAAE;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}
|
package/dist/runtime-env.d.ts
CHANGED
|
@@ -28,10 +28,8 @@ export declare function managedRunnerNodeDir(execPath?: string, platform?: NodeJ
|
|
|
28
28
|
* The managed toolchain root under `home`: the notarized Node distribution
|
|
29
29
|
* Claudexor installs plus the pinned vendor CLI shims (`<home>/.claudexor/node`
|
|
30
30
|
* — `bin/codex`, `bin/claude`, the `node` that runs them, and their
|
|
31
|
-
* `lib/node_modules` payloads). ONE spelling
|
|
32
|
-
* producer
|
|
33
|
-
* (`packages/core/src/confinement.ts`): the launcher resolving a binary from
|
|
34
|
-
* here and the sandbox profile allowing its exec must never drift apart.
|
|
31
|
+
* `lib/node_modules` payloads). ONE spelling shared by every harness PATH
|
|
32
|
+
* producer.
|
|
35
33
|
* Deliberately HOME-anchored, not config-dir-anchored — a
|
|
36
34
|
* `CLAUDEXOR_CONFIG_DIR` override relocates the runtime root, never the
|
|
37
35
|
* installed toolchain.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAef;AAYD
|
|
1
|
+
{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAef;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAoCR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAEnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAcf;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,YAAY,GAAE,SAAS,MAAM,EAAsB,GAClD,MAAM,GAAG,IAAI,CAuDf;AA4CD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAQf"}
|
package/dist/runtime-env.js
CHANGED
|
@@ -62,10 +62,8 @@ function dirIsGroupOrWorldWritable(dir) {
|
|
|
62
62
|
* The managed toolchain root under `home`: the notarized Node distribution
|
|
63
63
|
* Claudexor installs plus the pinned vendor CLI shims (`<home>/.claudexor/node`
|
|
64
64
|
* — `bin/codex`, `bin/claude`, the `node` that runs them, and their
|
|
65
|
-
* `lib/node_modules` payloads). ONE spelling
|
|
66
|
-
* producer
|
|
67
|
-
* (`packages/core/src/confinement.ts`): the launcher resolving a binary from
|
|
68
|
-
* here and the sandbox profile allowing its exec must never drift apart.
|
|
65
|
+
* `lib/node_modules` payloads). ONE spelling shared by every harness PATH
|
|
66
|
+
* producer.
|
|
69
67
|
* Deliberately HOME-anchored, not config-dir-anchored — a
|
|
70
68
|
* `CLAUDEXOR_CONFIG_DIR` override relocates the runtime root, never the
|
|
71
69
|
* installed toolchain.
|
package/dist/runtime-env.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,yEAAyE;IACzE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gFAAgF;IAChF,IAAI,QAAQ,KAAK,OAAO,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;gFACgF;AAChF,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,yEAAyE;IACzE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gFAAgF;IAChF,IAAI,QAAQ,KAAK,OAAO,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;gFACgF;AAChF,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,GAAG;YACzC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3B,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;QACzB,mBAAmB;QACnB,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,WAAW;QACX,OAAO;KACR,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC;SAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3D,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAyB;IAClE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,YAAY,GAAsB,iBAAiB;IAEnD,IAAI,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;aAC1B,KAAK,CAAC,SAAS,CAAC;aAChB,MAAM,CAAC,OAAO,CAAC;aACf,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,gBAAgB,MAAM,GAAG,CAAC;QAClF,MAAM,GAAG,GACP,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1C,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,IAAI,KAAK,KAAK;gBACd,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,sBAAsB,CAAC;QAC/B,MAAM,GAAG,GACP,eAAe,CAAC,MAAM,IAAI,SAAS,CAAC;YACpC,aAAa,IAAI,oDAAoD,CAAC;QACxE,OAAO,GAAG,KAAK,eAAe,GAAG,MAAM,GAAG,EAAE,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS;YAClD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,mFAAmF,IAAI,0CAA0C,CAAC;QAC7J,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,UAAU,EAAE,SAAS,CAAC;YACvB,CAAC,QAAQ,EAAE,EAAE,CAAC;SACN,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC;oBAC9B,CAAC,CAAC,2BAA2B,GAAG,iBAAiB;oBACjD,CAAC,CAAC,2CAA2C,CAAC;gBAChD,OAAO,wBAAwB,IAAI,kBAAkB,GAAG,SAAS,QAAQ,0CAA0C,IAAI,IAAI,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7L,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;6EAE6E;AAC7E,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;yCAEyC;AACzC,SAAS,SAAS,CAAC,OAAe,EAAE,IAA2B;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,+BAA+B,IAAI,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,wBAAwB,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GACV,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACrC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,WAAW,QAAQ,yIAAyI,CAAC;AACtK,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@claudexor/core",
|
|
3
|
-
"version": "3.8.
|
|
3
|
+
"version": "3.8.1",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "HarnessAdapter contract, process helpers, typed errors, and low-level execution utilities.",
|
|
6
6
|
"type": "module",
|
|
@@ -20,8 +20,8 @@
|
|
|
20
20
|
],
|
|
21
21
|
"dependencies": {
|
|
22
22
|
"@playwright/mcp": "0.0.78",
|
|
23
|
-
"@claudexor/schema": "3.8.
|
|
24
|
-
"@claudexor/util": "3.8.
|
|
23
|
+
"@claudexor/schema": "3.8.1",
|
|
24
|
+
"@claudexor/util": "3.8.1"
|
|
25
25
|
},
|
|
26
26
|
"repository": {
|
|
27
27
|
"type": "git",
|
package/dist/confinement.d.ts
DELETED
|
@@ -1,75 +0,0 @@
|
|
|
1
|
-
import type { HarnessConfinement } from "@claudexor/schema";
|
|
2
|
-
export interface ConfinementInput {
|
|
3
|
-
/** The operator's REAL home — the thing the child must not be able to mine. */
|
|
4
|
-
operatorHome: string;
|
|
5
|
-
/** Claudexor's runtime tree: daemon token/socket, trust, every project's state. */
|
|
6
|
-
runtimeRoot: string;
|
|
7
|
-
/** Vendor credential state the harness itself authenticates out of (§8 carve-out). */
|
|
8
|
-
nativeStateRoot: string;
|
|
9
|
-
/** This attempt's scoped HOME. */
|
|
10
|
-
scopedHome: string;
|
|
11
|
-
/** This attempt's worktree (its cwd). */
|
|
12
|
-
worktree: string;
|
|
13
|
-
/** Scratch root the toolchain writes to; defaults to the process TMPDIR. */
|
|
14
|
-
tmpDir?: string;
|
|
15
|
-
}
|
|
16
|
-
/**
|
|
17
|
-
* The host the boundary is being applied ON. Injectable so the platform
|
|
18
|
-
* branches are TESTABLE without booting that platform: the availability probe
|
|
19
|
-
* and every exec go through here.
|
|
20
|
-
*/
|
|
21
|
-
export interface ConfinementHost {
|
|
22
|
-
platform: NodeJS.Platform;
|
|
23
|
-
exists(path: string): boolean;
|
|
24
|
-
run(bin: string, args: readonly string[]): {
|
|
25
|
-
status: number | null;
|
|
26
|
-
stderr?: string;
|
|
27
|
-
};
|
|
28
|
-
}
|
|
29
|
-
/**
|
|
30
|
-
* The paths this profile must make unreadable. Also the probe surface: the
|
|
31
|
-
* boundary is verified by trying to read the FIRST of them.
|
|
32
|
-
*/
|
|
33
|
-
export declare function confinementDeniedReadPaths(input: ConfinementInput): string[];
|
|
34
|
-
/** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
|
|
35
|
-
export declare function buildConfinementProfile(input: ConfinementInput): string;
|
|
36
|
-
/**
|
|
37
|
-
* The one question a caller outside this file may ask about the host.
|
|
38
|
-
*
|
|
39
|
-
* Deliberately NOT "which mechanism": the routing decision that depends on this
|
|
40
|
-
* — whether to tell the adapter to stand its own sandbox down — turns on
|
|
41
|
-
* whether Claudexor will actually provide a boundary, never on which one or on
|
|
42
|
-
* the platform's name.
|
|
43
|
-
*/
|
|
44
|
-
export declare function confinementBoundaryAvailable(host?: ConfinementHost): {
|
|
45
|
-
available: boolean;
|
|
46
|
-
reason: string | null;
|
|
47
|
-
};
|
|
48
|
-
/** What one attempt's boundary turned out to be: applied, or absent and why. */
|
|
49
|
-
export interface ConfinementOutcome {
|
|
50
|
-
/** The APPLIED boundary, or null when this host has none. */
|
|
51
|
-
confinement: HarnessConfinement | null;
|
|
52
|
-
/** Why no boundary was applied; null exactly when one was. */
|
|
53
|
-
unavailableReason: string | null;
|
|
54
|
-
}
|
|
55
|
-
/**
|
|
56
|
-
* Build, verify and describe the boundary for one attempt.
|
|
57
|
-
*
|
|
58
|
-
* Degrades HONESTLY where the platform offers nothing — the run proceeds and
|
|
59
|
-
* the outcome carries the reason, which the caller writes onto the attempt,
|
|
60
|
-
* into the child's prompt and into its own result. It never degrades SILENTLY,
|
|
61
|
-
* and it never names a mechanism it did not just prove on this host.
|
|
62
|
-
*
|
|
63
|
-
* Still refuses for the three conditions that are Claudexor's own layout or
|
|
64
|
-
* this host's rather than the platform's: an allowed root that swallows a
|
|
65
|
-
* denied one, a host where no denied path exists so nothing can be proven
|
|
66
|
-
* denied, and a policy that a working mechanism failed to enforce for this
|
|
67
|
-
* attempt.
|
|
68
|
-
*/
|
|
69
|
-
export declare function applyConfinement(input: ConfinementInput, host?: ConfinementHost): ConfinementOutcome;
|
|
70
|
-
/** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
|
|
71
|
-
export declare function confinedInvocation(confinement: HarnessConfinement | null | undefined, bin: string, args: readonly string[]): {
|
|
72
|
-
bin: string;
|
|
73
|
-
args: string[];
|
|
74
|
-
};
|
|
75
|
-
//# sourceMappingURL=confinement.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAgD5D,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAkID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQ5E;AA8DD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAEvE;AA6HD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,eAA8B,GAAG;IAClF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAGA;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE,eAA8B,GACnC,kBAAkB,CA8CpB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjC"}
|
package/dist/confinement.js
DELETED
|
@@ -1,396 +0,0 @@
|
|
|
1
|
-
import { spawnSync } from "node:child_process";
|
|
2
|
-
import { existsSync, realpathSync } from "node:fs";
|
|
3
|
-
import { dirname, join, relative, sep } from "node:path";
|
|
4
|
-
import { sensitiveResourcePolicy, sha256 } from "@claudexor/util";
|
|
5
|
-
import { ConfinementUnavailableError } from "./errors.js";
|
|
6
|
-
import { managedNodeRoot } from "./runtime-env.js";
|
|
7
|
-
/**
|
|
8
|
-
* OS-enforced filesystem confinement for a delegated harness process.
|
|
9
|
-
*
|
|
10
|
-
* WHY THIS IS NOT AN ENV VAR. A scoped `HOME` redirects `~`-relative lookups
|
|
11
|
-
* and nothing else; `/Users/<op>/.claudexor/v3/daemon/token` — a bearer for the
|
|
12
|
-
* whole control API — stays one absolute path away. The threat model, the
|
|
13
|
-
* live reproduction and the list of what this does NOT cover are in
|
|
14
|
-
* docs/DELEGATED_CONFINEMENT.md; keep them in step with this file.
|
|
15
|
-
*
|
|
16
|
-
* WHY THE HARNESS SANDBOX STANDS DOWN. macOS refuses `sandbox_apply` inside an
|
|
17
|
-
* already-restricted process (measured: any deny clause in the outer profile is
|
|
18
|
-
* enough), and codex shells out to `/usr/bin/sandbox-exec` for its own
|
|
19
|
-
* workspace-write sandbox. An outer boundary and the harness's own are
|
|
20
|
-
* mutually exclusive, so the engine states `external_sandbox_full` — the
|
|
21
|
-
* access profile that already means "I am providing the sandbox" — and each
|
|
22
|
-
* adapter maps that onto its own switch. No harness name is branched on. That
|
|
23
|
-
* stand-down is spent ONLY where a boundary was actually proven available: a
|
|
24
|
-
* host with none keeps whatever enforcement the harness brings itself.
|
|
25
|
-
*
|
|
26
|
-
* WHERE THERE IS NO BOUNDARY — every platform but macOS, by owner decision, and
|
|
27
|
-
* a macOS host missing `sandbox-exec`. The run still runs, on the scoped `HOME`
|
|
28
|
-
* alone. It does not pretend: the absence and its reason are recorded on the
|
|
29
|
-
* attempt, told to the child, and returned to the caller. Refusing instead would
|
|
30
|
-
* make "delegated" a macOS-only feature; claiming a boundary we did not prove
|
|
31
|
-
* would be worse than having none, so the type below cannot express a mechanism
|
|
32
|
-
* name without the path it was proven to deny.
|
|
33
|
-
*/
|
|
34
|
-
const SEATBELT_BIN = "/usr/bin/sandbox-exec";
|
|
35
|
-
/** System prefixes a workspace-scoped run has no business writing to. */
|
|
36
|
-
const SYSTEM_WRITE_DENY = [
|
|
37
|
-
"/usr",
|
|
38
|
-
"/opt",
|
|
39
|
-
"/Library",
|
|
40
|
-
"/Applications",
|
|
41
|
-
"/System",
|
|
42
|
-
"/bin",
|
|
43
|
-
"/sbin",
|
|
44
|
-
"/etc",
|
|
45
|
-
"/var",
|
|
46
|
-
];
|
|
47
|
-
const DEFAULT_HOST = {
|
|
48
|
-
platform: process.platform,
|
|
49
|
-
exists: existsSync,
|
|
50
|
-
run: (bin, args) => spawnSync(bin, [...args], { encoding: "utf8", timeout: 15_000 }),
|
|
51
|
-
};
|
|
52
|
-
/**
|
|
53
|
-
* Seatbelt matches RESOLVED paths (`/tmp` is `/private/tmp`), so a profile
|
|
54
|
-
* written against the symlinked spelling silently allows what it names.
|
|
55
|
-
* Resolution falls back to the literal for a path that does not exist yet —
|
|
56
|
-
* a deny on a not-yet-created path is still worth emitting.
|
|
57
|
-
*/
|
|
58
|
-
function resolved(path) {
|
|
59
|
-
try {
|
|
60
|
-
return realpathSync.native(path);
|
|
61
|
-
}
|
|
62
|
-
catch {
|
|
63
|
-
return path;
|
|
64
|
-
}
|
|
65
|
-
}
|
|
66
|
-
/** Whether `root` is `path` or an ancestor of it, after resolution. */
|
|
67
|
-
function contains(root, path) {
|
|
68
|
-
const rel = relative(resolved(root), resolved(path));
|
|
69
|
-
return rel === "" || (!rel.startsWith("..") && !rel.startsWith(sep) && !/^[A-Za-z]:/.test(rel));
|
|
70
|
-
}
|
|
71
|
-
function subpath(paths) {
|
|
72
|
-
return paths.map((path) => `(subpath ${JSON.stringify(resolved(path))})`).join(" ");
|
|
73
|
-
}
|
|
74
|
-
function literal(paths) {
|
|
75
|
-
return paths.map((path) => `(literal ${JSON.stringify(resolved(path))})`).join(" ");
|
|
76
|
-
}
|
|
77
|
-
/**
|
|
78
|
-
* The strict ancestors of the run's OWN roots that lie INSIDE the denied
|
|
79
|
-
* runtime root: for each own root, `dirname(root)` walking up to and including
|
|
80
|
-
* `runtimeRoot` itself, deduplicated in first-encounter order.
|
|
81
|
-
*
|
|
82
|
-
* WHY THESE NEED A METADATA CARVE-OUT. Path canonicalization — libc
|
|
83
|
-
* `realpath(3)`, Rust `fs::canonicalize`, SQLite's unix VFS full-path
|
|
84
|
-
* resolution — lstat/readlinks every intermediate path component. The
|
|
85
|
-
* own-roots allow re-opens each root's SUBTREE, but the components BETWEEN
|
|
86
|
-
* the runtime root and the root still match the runtime-root read deny, so
|
|
87
|
-
* the walk dies with EPERM before the harness runs a single turn. Measured
|
|
88
|
-
* live on two different own roots: codex canonicalizes its CODEX_HOME under
|
|
89
|
-
* the native state root at startup (2026-08-10, `failed to canonicalize
|
|
90
|
-
* CODEX_HOME`), and cursor-agent opens its SQLite chat store under the scoped
|
|
91
|
-
* HOME, whose open canonicalizes the database path (2026-08-15,
|
|
92
|
-
* `RetriableError: [internal] unable to open database file`, SQLITE_CANTOPEN,
|
|
93
|
-
* 100% of mutating delegated cursor runs). These directories get
|
|
94
|
-
* `file-read-metadata` on the LITERAL path only: stat/readlink of the
|
|
95
|
-
* directory entry itself, never the data of any file under the runtime root
|
|
96
|
-
* and never a directory listing (readdir is a data read on the directory).
|
|
97
|
-
*/
|
|
98
|
-
function ownRootTraversalAncestors(input) {
|
|
99
|
-
const root = resolved(input.runtimeRoot);
|
|
100
|
-
const chain = [];
|
|
101
|
-
for (const ownRoot of ownRoots(input)) {
|
|
102
|
-
let current = dirname(resolved(ownRoot));
|
|
103
|
-
// An already-collected ancestor proves the rest of its chain up to the
|
|
104
|
-
// runtime root was collected with it, so the walk can stop there.
|
|
105
|
-
while (contains(root, current) && !chain.includes(current)) {
|
|
106
|
-
chain.push(current);
|
|
107
|
-
if (current === root)
|
|
108
|
-
break;
|
|
109
|
-
const parent = dirname(current);
|
|
110
|
-
if (parent === current)
|
|
111
|
-
break; // filesystem root; cannot ascend further
|
|
112
|
-
current = parent;
|
|
113
|
-
}
|
|
114
|
-
}
|
|
115
|
-
return chain;
|
|
116
|
-
}
|
|
117
|
-
/**
|
|
118
|
-
* The managed toolchain subtree (`<operator home>/.claudexor/node` — the Node
|
|
119
|
-
* distribution plus the pinned vendor CLI shims), WHEN it lies inside the
|
|
120
|
-
* denied runtime root. Null when it does not — nothing denies it there, so a
|
|
121
|
-
* carve-out would be a no-op, mirroring the own-roots traversal pattern above.
|
|
122
|
-
*
|
|
123
|
-
* WHY THIS NEEDS A READ+EXEC CARVE-OUT. In the DEFAULT layout the runtime
|
|
124
|
-
* root IS `~/.claudexor`, so the very binaries the spawn layer resolves for
|
|
125
|
-
* the child (`~/.claudexor/node/bin/codex`, the `node` that runs them, their
|
|
126
|
-
* `lib/node_modules` payloads) sit inside the read-denied tree — and exec IS
|
|
127
|
-
* a read: the kernel refuses execvp of a binary the profile makes unreadable.
|
|
128
|
-
* Measured live in the 3.3.15 VM battery (default config, phase 13):
|
|
129
|
-
* `sandbox-exec: execvp() of '<runtime root>/node/bin/codex' failed:
|
|
130
|
-
* Operation not permitted`, exit 71, before the harness ran an instruction.
|
|
131
|
-
* The development-host smoke missed it because scratch mode relocates the
|
|
132
|
-
* config root, putting the toolchain outside the denied tree.
|
|
133
|
-
*
|
|
134
|
-
* The subtree holds no secrets (a Node distribution and CLI shims), so it
|
|
135
|
-
* gets a full `file-read*` allow — data, metadata and listings — which is
|
|
136
|
-
* what execvp, `#!/usr/bin/env node` shim resolution and the CLI's own
|
|
137
|
-
* resource loads need. It does NOT re-open writes: the later operator-home
|
|
138
|
-
* write deny still covers the toolchain, so a confined child cannot trojan
|
|
139
|
-
* the shims the operator's own daemon executes. The path is derived from the
|
|
140
|
-
* same helper the launcher's PATH producer uses (`managedNodeRoot`), keyed on
|
|
141
|
-
* the operator home — the anchor `composeBaseEnv` resolves binaries against —
|
|
142
|
-
* so the profile and the spawn layer cannot drift apart.
|
|
143
|
-
*/
|
|
144
|
-
function managedToolchainSubtree(input) {
|
|
145
|
-
const toolchain = managedNodeRoot(input.operatorHome);
|
|
146
|
-
return contains(input.runtimeRoot, toolchain) ? toolchain : null;
|
|
147
|
-
}
|
|
148
|
-
/**
|
|
149
|
-
* The paths this profile must make unreadable. Also the probe surface: the
|
|
150
|
-
* boundary is verified by trying to read the FIRST of them.
|
|
151
|
-
*/
|
|
152
|
-
export function confinementDeniedReadPaths(input) {
|
|
153
|
-
return [
|
|
154
|
-
join(input.runtimeRoot, "daemon"),
|
|
155
|
-
input.runtimeRoot,
|
|
156
|
-
...sensitiveResourcePolicy
|
|
157
|
-
.homeRelativeCredentialEntries()
|
|
158
|
-
.map((entry) => join(input.operatorHome, entry)),
|
|
159
|
-
];
|
|
160
|
-
}
|
|
161
|
-
/** The run's own roots: allowed, and the reason the deny set needs carve-outs. */
|
|
162
|
-
function ownRoots(input) {
|
|
163
|
-
return [input.scopedHome, input.worktree, input.nativeStateRoot];
|
|
164
|
-
}
|
|
165
|
-
/** macOS: kernel-enforced per-path denial for the process and every descendant. */
|
|
166
|
-
const SEATBELT = {
|
|
167
|
-
id: "seatbelt",
|
|
168
|
-
platform: "darwin",
|
|
169
|
-
bins: [SEATBELT_BIN],
|
|
170
|
-
/** SBPL text. Last match wins, so the carve-outs follow the denies. */
|
|
171
|
-
buildProfile(input) {
|
|
172
|
-
const scratch = input.tmpDir ?? process.env.TMPDIR ?? "/tmp";
|
|
173
|
-
const traversal = ownRootTraversalAncestors(input);
|
|
174
|
-
const toolchain = managedToolchainSubtree(input);
|
|
175
|
-
// SBPL is last-match-wins, and the order below is the policy. The scratch
|
|
176
|
-
// allow sits ABOVE the operator-home deny on purpose: a `TMPDIR` configured
|
|
177
|
-
// inside `$HOME` would otherwise re-open the whole home for writing. The run's
|
|
178
|
-
// own roots come last because they outrank every deny above them, including
|
|
179
|
-
// the case where the worktree lives inside the operator's home (isolation:
|
|
180
|
-
// live, which is exactly the delegated shape). The two read carve-outs sit
|
|
181
|
-
// directly AFTER the read deny they punch through, and BEFORE the write
|
|
182
|
-
// section so neither can outrank a write deny: literal-only stat/readlink
|
|
183
|
-
// on the own roots' intermediate directories, so `realpath(CODEX_HOME)` and
|
|
184
|
-
// cursor's SQLite open under the scoped HOME work while file data and
|
|
185
|
-
// directory listings under the runtime root stay denied (see
|
|
186
|
-
// ownRootTraversalAncestors); then a full read allow on the
|
|
187
|
-
// managed toolchain subtree, so the child can exec the very binaries the
|
|
188
|
-
// spawn layer resolved for it (see managedToolchainSubtree). Writes to the
|
|
189
|
-
// toolchain stay denied by the operator-home deny below.
|
|
190
|
-
return [
|
|
191
|
-
"(version 1)",
|
|
192
|
-
"(allow default)",
|
|
193
|
-
`(deny file-read* ${subpath(confinementDeniedReadPaths(input))})`,
|
|
194
|
-
...(traversal.length ? [`(allow file-read-metadata ${literal(traversal)})`] : []),
|
|
195
|
-
...(toolchain ? [`(allow file-read* ${subpath([toolchain])})`] : []),
|
|
196
|
-
`(deny file-write* ${subpath([...SYSTEM_WRITE_DENY])})`,
|
|
197
|
-
`(allow file-write* ${subpath([scratch, "/tmp"])})`,
|
|
198
|
-
`(deny file-write* ${subpath([input.operatorHome])})`,
|
|
199
|
-
`(allow file-read* file-write* ${subpath(ownRoots(input))})`,
|
|
200
|
-
"",
|
|
201
|
-
].join("\n");
|
|
202
|
-
},
|
|
203
|
-
invocation(profile, bin, args) {
|
|
204
|
-
return { bin: SEATBELT_BIN, args: ["-p", profile, bin, ...args] };
|
|
205
|
-
},
|
|
206
|
-
};
|
|
207
|
-
/**
|
|
208
|
-
* The registry. ONE mechanism today, by owner decision: Seatbelt on macOS, and
|
|
209
|
-
* NO kernel boundary anywhere else. Linux bubblewrap/Landlock and a Windows
|
|
210
|
-
* equivalent were considered and declined — see docs/DELEGATED_CONFINEMENT.md §6.
|
|
211
|
-
* Non-macOS is served by the scoped HOME plus a disclosed, typed absence, which
|
|
212
|
-
* is what the rest of this file and the delegated terminal are shaped around.
|
|
213
|
-
*
|
|
214
|
-
* The list stays a list because the mechanism id is OPAQUE end to end: the only
|
|
215
|
-
* place a name selects behaviour is the lookup in `confinedInvocation`.
|
|
216
|
-
*/
|
|
217
|
-
const MECHANISMS = [SEATBELT];
|
|
218
|
-
/** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
|
|
219
|
-
export function buildConfinementProfile(input) {
|
|
220
|
-
return SEATBELT.buildProfile(input, SEATBELT_BIN);
|
|
221
|
-
}
|
|
222
|
-
/** Read `probePath` from inside the policy, the way the harness child would. */
|
|
223
|
-
function readUnder(mechanism, profile, probePath, host) {
|
|
224
|
-
const invocation = mechanism.invocation(profile, "/bin/ls", [probePath]);
|
|
225
|
-
return host.run(invocation.bin, invocation.args);
|
|
226
|
-
}
|
|
227
|
-
/** A trimmed, bounded stderr tail for a probe's failure reason. */
|
|
228
|
-
function describeProbeFault(stderr) {
|
|
229
|
-
return stderr && stderr.trim() ? ` (${stderr.trim().slice(0, 200)})` : "";
|
|
230
|
-
}
|
|
231
|
-
/**
|
|
232
|
-
* stderr signatures of the SANDBOX ITSELF failing to launch or apply the
|
|
233
|
-
* profile — a refused `sandbox_apply`, a profile that would not compile/parse —
|
|
234
|
-
* as opposed to the wrapped program running and hitting a real policy deny.
|
|
235
|
-
* `sandbox-exec` prefixes its OWN failures with `sandbox-exec:` and never runs
|
|
236
|
-
* the wrapped tool; a denied read instead surfaces from the tool itself
|
|
237
|
-
* (`ls: <path>: Operation not permitted`). A nonzero exit carrying one of these
|
|
238
|
-
* is infrastructure, not proof.
|
|
239
|
-
*/
|
|
240
|
-
const SANDBOX_APPLICATION_FAULT_RE = /sandbox-exec:|sandbox_apply|sandbox_compile|failed to (parse|compile|apply|initialize)|could not (parse|compile)|error parsing/i;
|
|
241
|
-
function isSandboxApplicationFault(stderr) {
|
|
242
|
-
return typeof stderr === "string" && SANDBOX_APPLICATION_FAULT_RE.test(stderr);
|
|
243
|
-
}
|
|
244
|
-
/**
|
|
245
|
-
* Prove the policy denies, on THIS host, before anything runs under it.
|
|
246
|
-
*
|
|
247
|
-
* Returns the reason it could NOT be proven, or null when it was. A policy that
|
|
248
|
-
* fails to compile, that a launcher refuses to apply, or that a future OS
|
|
249
|
-
* quietly stops enforcing, would otherwise produce a run that records a false
|
|
250
|
-
* `verified_denied_path` and reports `confined` when it is not.
|
|
251
|
-
*
|
|
252
|
-
* Three guards, because a nonzero exit alone means nothing:
|
|
253
|
-
* NEGATIVE control — the denied path must be readable UNCONFINED, or an
|
|
254
|
-
* ENOENT there would masquerade as a policy deny.
|
|
255
|
-
* POSITIVE control — an ALLOWED path must stay readable UNDER the sandbox. If
|
|
256
|
-
* it does not, the sandbox never applied (failed `sandbox_apply`, a profile
|
|
257
|
-
* that would not compile), so any subsequent "deny" is the launcher
|
|
258
|
-
* failing, not the policy denying. This is the guard the audit was missing.
|
|
259
|
-
* FAULT discrimination — even with the sandbox applied, a nonzero exit whose
|
|
260
|
-
* stderr is a launch/application fault, or that never completed, is never
|
|
261
|
-
* recorded as proof. Only an explained nonzero (positive control passed, no
|
|
262
|
-
* fault signature, path proven readable unconfined) is a real deny.
|
|
263
|
-
*/
|
|
264
|
-
function proveConfinementDenial(mechanism, profile, probePath, allowedControlPaths, host) {
|
|
265
|
-
// NEGATIVE CONTROL.
|
|
266
|
-
if (host.run("/bin/ls", [probePath]).status !== 0) {
|
|
267
|
-
return `the probe path ${probePath} is not readable even unconfined, so a denial there proves nothing`;
|
|
268
|
-
}
|
|
269
|
-
// POSITIVE CONTROL. Pick an allowed path that is readable unconfined, then
|
|
270
|
-
// require it to STAY readable under the sandbox. A failure here is the sandbox
|
|
271
|
-
// not applying, not the policy working.
|
|
272
|
-
const control = allowedControlPaths
|
|
273
|
-
.map((path) => resolved(path))
|
|
274
|
-
.find((path) => host.run("/bin/ls", [path]).status === 0);
|
|
275
|
-
if (!control) {
|
|
276
|
-
return `no allowed control path was readable unconfined, so the ${mechanism.id} sandbox application could not be confirmed`;
|
|
277
|
-
}
|
|
278
|
-
const positive = readUnder(mechanism, profile, control, host);
|
|
279
|
-
if (positive.status !== 0) {
|
|
280
|
-
return `the ${mechanism.id} sandbox did not apply: the allowed control path ${control} was not readable under it${describeProbeFault(positive.stderr)}`;
|
|
281
|
-
}
|
|
282
|
-
// THE TEST: the denied path must now be denied under the proven-applied sandbox.
|
|
283
|
-
const probe = readUnder(mechanism, profile, probePath, host);
|
|
284
|
-
if (probe.status === 0)
|
|
285
|
-
return `${probePath} stayed readable under the ${mechanism.id} policy`;
|
|
286
|
-
if (isSandboxApplicationFault(probe.stderr)) {
|
|
287
|
-
return `the ${mechanism.id} probe hit a sandbox application fault, not a policy deny${describeProbeFault(probe.stderr)}`;
|
|
288
|
-
}
|
|
289
|
-
if (probe.status === null) {
|
|
290
|
-
return `the ${mechanism.id} probe did not complete${describeProbeFault(probe.stderr)}`;
|
|
291
|
-
}
|
|
292
|
-
return null;
|
|
293
|
-
}
|
|
294
|
-
/**
|
|
295
|
-
* Whether an OS-enforced boundary exists on this host, and which one.
|
|
296
|
-
*
|
|
297
|
-
* A platform with no mechanism is a DECISION, not a gap to be discovered at
|
|
298
|
-
* spawn time, so the answer is a stated reason rather than a throw. Nothing here
|
|
299
|
-
* hunts for a boundary the owner declined to build: the question is only whether
|
|
300
|
-
* THIS platform's declared mechanism is present.
|
|
301
|
-
*/
|
|
302
|
-
function confinementMechanism(host) {
|
|
303
|
-
const mechanism = MECHANISMS.find((candidate) => candidate.platform === host.platform);
|
|
304
|
-
if (!mechanism) {
|
|
305
|
-
return {
|
|
306
|
-
mechanism: null,
|
|
307
|
-
bin: null,
|
|
308
|
-
reason: `Claudexor applies no OS-enforced filesystem boundary on ${host.platform}; only macOS has one`,
|
|
309
|
-
};
|
|
310
|
-
}
|
|
311
|
-
const bin = mechanism.bins.find((candidate) => host.exists(candidate));
|
|
312
|
-
if (!bin) {
|
|
313
|
-
return {
|
|
314
|
-
mechanism: null,
|
|
315
|
-
bin: null,
|
|
316
|
-
reason: `${host.platform} enforces a boundary with ${mechanism.id}, which is not installed here (looked for ${mechanism.bins.join(", ")})`,
|
|
317
|
-
};
|
|
318
|
-
}
|
|
319
|
-
return { mechanism, bin, reason: null };
|
|
320
|
-
}
|
|
321
|
-
/**
|
|
322
|
-
* The one question a caller outside this file may ask about the host.
|
|
323
|
-
*
|
|
324
|
-
* Deliberately NOT "which mechanism": the routing decision that depends on this
|
|
325
|
-
* — whether to tell the adapter to stand its own sandbox down — turns on
|
|
326
|
-
* whether Claudexor will actually provide a boundary, never on which one or on
|
|
327
|
-
* the platform's name.
|
|
328
|
-
*/
|
|
329
|
-
export function confinementBoundaryAvailable(host = DEFAULT_HOST) {
|
|
330
|
-
const availability = confinementMechanism(host);
|
|
331
|
-
return { available: availability.mechanism !== null, reason: availability.reason };
|
|
332
|
-
}
|
|
333
|
-
/**
|
|
334
|
-
* Build, verify and describe the boundary for one attempt.
|
|
335
|
-
*
|
|
336
|
-
* Degrades HONESTLY where the platform offers nothing — the run proceeds and
|
|
337
|
-
* the outcome carries the reason, which the caller writes onto the attempt,
|
|
338
|
-
* into the child's prompt and into its own result. It never degrades SILENTLY,
|
|
339
|
-
* and it never names a mechanism it did not just prove on this host.
|
|
340
|
-
*
|
|
341
|
-
* Still refuses for the three conditions that are Claudexor's own layout or
|
|
342
|
-
* this host's rather than the platform's: an allowed root that swallows a
|
|
343
|
-
* denied one, a host where no denied path exists so nothing can be proven
|
|
344
|
-
* denied, and a policy that a working mechanism failed to enforce for this
|
|
345
|
-
* attempt.
|
|
346
|
-
*/
|
|
347
|
-
export function applyConfinement(input, host = DEFAULT_HOST) {
|
|
348
|
-
const denied = confinementDeniedReadPaths(input);
|
|
349
|
-
// The carve-outs re-open whatever they contain, so an "own root" that CONTAINS
|
|
350
|
-
// a denied path silently defeats the policy. This contradiction is Claudexor's
|
|
351
|
-
// own layout being wrong, not a platform fact, so it is refused BEFORE the
|
|
352
|
-
// host is asked whether it can enforce anything: a host with no boundary must
|
|
353
|
-
// not turn a self-defeating policy into a quiet scoped-HOME run. Refuse rather
|
|
354
|
-
// than emit one that reads like a boundary and is not.
|
|
355
|
-
const swallowed = ownRoots(input).find((root) => denied.some((path) => path !== root && contains(root, path)));
|
|
356
|
-
if (swallowed) {
|
|
357
|
-
throw new ConfinementUnavailableError(`filesystem confinement would be self-defeating: the allowed root ${swallowed} contains a path the policy must deny`);
|
|
358
|
-
}
|
|
359
|
-
const available = confinementMechanism(host);
|
|
360
|
-
if (!available.mechanism)
|
|
361
|
-
return { confinement: null, unavailableReason: available.reason };
|
|
362
|
-
const profile = available.mechanism.buildProfile(input, available.bin);
|
|
363
|
-
const probeCandidate = denied.find((path) => host.exists(path));
|
|
364
|
-
if (!probeCandidate) {
|
|
365
|
-
throw new ConfinementUnavailableError("filesystem confinement could not be verified: none of the denied paths exists on this host, so the policy cannot be proven to deny anything");
|
|
366
|
-
}
|
|
367
|
-
const probePath = resolved(probeCandidate);
|
|
368
|
-
// The run's own allow-listed roots double as the positive-control surface:
|
|
369
|
-
// one of them staying readable under the sandbox is what proves the profile
|
|
370
|
-
// actually applied before any denial is credited.
|
|
371
|
-
const why = proveConfinementDenial(available.mechanism, profile, probePath, ownRoots(input), host);
|
|
372
|
-
if (why)
|
|
373
|
-
throw new ConfinementUnavailableError(`filesystem confinement failed: ${why}`);
|
|
374
|
-
return {
|
|
375
|
-
confinement: {
|
|
376
|
-
mechanism: available.mechanism.id,
|
|
377
|
-
profile,
|
|
378
|
-
profile_digest: sha256(profile),
|
|
379
|
-
verified_denied_path: probePath,
|
|
380
|
-
},
|
|
381
|
-
unavailableReason: null,
|
|
382
|
-
};
|
|
383
|
-
}
|
|
384
|
-
/** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
|
|
385
|
-
export function confinedInvocation(confinement, bin, args) {
|
|
386
|
-
if (!confinement)
|
|
387
|
-
return { bin, args: [...args] };
|
|
388
|
-
const mechanism = MECHANISMS.find((candidate) => candidate.id === confinement.mechanism);
|
|
389
|
-
if (!mechanism) {
|
|
390
|
-
// The record names a boundary this engine cannot apply. Spawning unwrapped
|
|
391
|
-
// would run the child outside the boundary its own record claims.
|
|
392
|
-
throw new ConfinementUnavailableError(`the attempt records confinement mechanism '${confinement.mechanism}', which this engine cannot apply`);
|
|
393
|
-
}
|
|
394
|
-
return mechanism.invocation(confinement.profile, bin, args);
|
|
395
|
-
}
|
|
396
|
-
//# sourceMappingURL=confinement.js.map
|
package/dist/confinement.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"confinement.js","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,UAAU;IACV,eAAe;IACf,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACE,CAAC;AA4BX,MAAM,YAAY,GAAoB;IACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;CACrF,CAAC;AAyBF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAuB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,yCAAyC;YACxE,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,uBAAuB,CAAC,KAAuB;IACtD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;QACjC,KAAK,CAAC,WAAW;QACjB,GAAG,uBAAuB;aACvB,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAAyB;IACrC,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,uEAAuE;IACvE,YAAY,CAAC,KAAK;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QAC7D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACjD,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,6DAA6D;QAC7D,4DAA4D;QAC5D,yEAAyE;QACzE,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,aAAa;YACb,iBAAiB;YACjB,oBAAoB,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG;YACjE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,6BAA6B,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,qBAAqB,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG;YACvD,sBAAsB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG;YACnD,qBAAqB,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG;YACrD,iCAAiC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG;YAC5D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI;QAC3B,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAoC,CAAC,QAAQ,CAAC,CAAC;AAE/D,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAChB,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,IAAqB;IAErB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,SAAS,kBAAkB,CAAC,MAA0B;IACpD,OAAO,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAChC,iIAAiI,CAAC;AAEpI,SAAS,yBAAyB,CAAC,MAA0B;IAC3D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,sBAAsB,CAC7B,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,mBAAsC,EACtC,IAAqB;IAErB,oBAAoB;IACpB,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,kBAAkB,SAAS,oEAAoE,CAAC;IACzG,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,OAAO,GAAG,mBAAmB;SAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,2DAA2D,SAAS,CAAC,EAAE,6CAA6C,CAAC;IAC9H,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,SAAS,CAAC,EAAE,oDAAoD,OAAO,6BAA6B,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1J,CAAC;IAED,iFAAiF;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,SAAS,8BAA8B,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/F,IAAI,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,SAAS,CAAC,EAAE,4DAA4D,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3H,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,OAAO,SAAS,CAAC,EAAE,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAqB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,2DAA2D,IAAI,CAAC,QAAQ,sBAAsB;SACvG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,6BAA6B,SAAS,CAAC,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3I,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAI,GAAoB,YAAY;IAI/E,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAuB,EACvB,IAAI,GAAoB,YAAY;IAEpC,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,uDAAuD;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC7D,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CACnC,oEAAoE,SAAS,uCAAuC,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,2BAA2B,CACnC,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAChC,SAAS,CAAC,SAAS,EACnB,OAAO,EACP,SAAS,EACT,QAAQ,CAAC,KAAK,CAAC,EACf,IAAI,CACL,CAAC;IACF,IAAI,GAAG;QAAE,MAAM,IAAI,2BAA2B,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACxF,OAAO;QACL,WAAW,EAAE;YACX,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;YACjC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;YAC/B,oBAAoB,EAAE,SAAS;SAChC;QACD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,WAAkD,EAClD,GAAW,EACX,IAAuB;IAEvB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,WAAW,CAAC,SAAS,mCAAmC,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}
|