@downcity/shell 0.1.4

package/bin/sandbox/SandboxPreflight.js

@@ -0,0 +1,122 @@
+/**
+ * SandboxPreflight：本机 shell sandbox 依赖预检。
+ *
+ * 关键点（中文）
+ * - shell 命令必须进入 sandbox；这里提前检查 backend 依赖，避免启动后首次 shell 执行才失败。
+ * - Linux backend 基于 bubblewrap，本质使用 Linux namespaces / bind mount 等内核能力。
+ * - 本模块只诊断并给出修复建议，不自动安装软件，也不修改宿主机 sysctl。
+ */
+import { access, readFile } from "node:fs/promises";
+import path from "node:path";
+import { delimiter } from "node:path";
+async function commandExists(command) {
+    const pathValue = String(process.env.PATH || "").trim();
+    const dirs = pathValue ? pathValue.split(delimiter) : [];
+    for (const dir of dirs) {
+        const candidate = path.join(dir, command);
+        try {
+            await access(candidate);
+            return true;
+        }
+        catch {
+            // continue
+        }
+    }
+    return false;
+}
+async function readProcInt(filePath) {
+    try {
+        const raw = await readFile(filePath, "utf-8");
+        const value = Number.parseInt(raw.trim(), 10);
+        return Number.isFinite(value) && !Number.isNaN(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function isLinuxUserNamespaceEnabled(probe) {
+    const unprivilegedUsernsClone = await probe.readProcInt("/proc/sys/kernel/unprivileged_userns_clone");
+    if (unprivilegedUsernsClone === 0)
+        return false;
+    const maxUserNamespaces = await probe.readProcInt("/proc/sys/user/max_user_namespaces");
+    if (maxUserNamespaces === 0)
+        return false;
+    return true;
+}
+/**
+ * 检查当前宿主是否满足 shell sandbox 运行要求。
+ */
+export async function checkShellSandboxPreflight() {
+    return await checkShellSandboxPreflightWithProbe({
+        commandExists,
+        readProcInt,
+    });
+}
+/**
+ * 使用注入探针检查当前宿主是否满足 shell sandbox 运行要求。
+ */
+export async function checkShellSandboxPreflightWithProbe(probe) {
+    const platform = process.platform;
+    const issues = [];
+    if (platform === "darwin") {
+        if (!(await probe.commandExists("sandbox-exec"))) {
+            issues.push({
+                code: "missing-command",
+                message: "macOS shell sandbox requires sandbox-exec, but it was not found.",
+                fixes: [
+                    "Use a macOS system that includes /usr/bin/sandbox-exec.",
+                ],
+            });
+        }
+        return {
+            ok: issues.length === 0,
+            platform,
+            backend: "macos-seatbelt",
+            issues,
+        };
+    }
+    if (platform === "linux") {
+        if (!(await probe.commandExists("bwrap"))) {
+            issues.push({
+                code: "missing-command",
+                message: "Linux shell sandbox requires bubblewrap (bwrap), but it was not found.",
+                fixes: [
+                    "Debian / Ubuntu: sudo apt install bubblewrap",
+                    "Fedora: sudo dnf install bubblewrap",
+                    "Arch: sudo pacman -S bubblewrap",
+                ],
+            });
+        }
+        if (!(await isLinuxUserNamespaceEnabled(probe))) {
+            issues.push({
+                code: "userns-disabled",
+                message: "Linux user namespaces are disabled, so bubblewrap cannot create the sandbox.",
+                fixes: [
+                    "Check: cat /proc/sys/kernel/unprivileged_userns_clone",
+                    "Check: cat /proc/sys/user/max_user_namespaces",
+                    "Debian / Ubuntu: sudo sysctl kernel.unprivileged_userns_clone=1",
+                ],
+            });
+        }
+        return {
+            ok: issues.length === 0,
+            platform,
+            backend: "linux-bubblewrap",
+            issues,
+        };
+    }
+    return {
+        ok: false,
+        platform,
+        issues: [
+            {
+                code: "unsupported-platform",
+                message: `Shell sandbox is not supported on this platform: ${platform}.`,
+                fixes: [
+                    "Use macOS or Linux for local shell execution.",
+                ],
+            },
+        ],
+    };
+}
+//# sourceMappingURL=SandboxPreflight.js.map

package/bin/sandbox/SandboxPreflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxPreflight.js","sourceRoot":"","sources":["../../src/sandbox/SandboxPreflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAuEtC,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAiC;IAEjC,MAAM,uBAAuB,GAAG,MAAM,KAAK,CAAC,WAAW,CACrD,4CAA4C,CAC7C,CAAC;IACF,IAAI,uBAAuB,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IACxF,IAAI,iBAAiB,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,OAAO,MAAM,mCAAmC,CAAC;QAC/C,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAiC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,kEAAkE;gBAC3E,KAAK,EAAE;oBACL,yDAAyD;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YACvB,QAAQ;YACR,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,wEAAwE;gBACjF,KAAK,EAAE;oBACL,8CAA8C;oBAC9C,qCAAqC;oBACrC,iCAAiC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,8EAA8E;gBACvF,KAAK,EAAE;oBACL,uDAAuD;oBACvD,+CAA+C;oBAC/C,iEAAiE;iBAClE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YACvB,QAAQ;YACR,OAAO,EAAE,kBAAkB;YAC3B,MAAM;SACP,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ;QACR,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,oDAAoD,QAAQ,GAAG;gBACxE,KAAK,EAAE;oBACL,+CAA+C;iBAChD;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/bin/sandbox/SandboxRunner.d.ts

@@ -0,0 +1,61 @@
+/**
+ * SandboxRunner 入口。
+ *
+ * 关键点（中文）
+ * - 这里不实现完整的 session/read/write 协议，只负责本地子进程创建时统一进入 agent sandbox backend。
+ * - 当前版本接入 macOS seatbelt 与 Linux bubblewrap backend。
+ * - 本地命令不再允许回退到宿主机普通子进程执行。
+ */
+import type { ShellHostContext } from "../types/ShellHostContext.js";
+import type { SandboxSpawnResult } from "../sandbox/types/SandboxRuntime.js";
+/**
+ * 启动 shell 子进程。
+ */
+export declare function spawnShellProcess(params: {
+    context: ShellHostContext;
+    shellId: string;
+    shellDir: string;
+    cmd: string;
+    cwd: string;
+    shellPath: string;
+    login: boolean;
+    baseEnv: NodeJS.ProcessEnv;
+    sandboxMode?: "safe" | "unrestricted";
+}): Promise<SandboxSpawnResult>;
+/**
+ * 在当前 agent sandbox 中启动本地子进程。
+ */
+export declare function spawnInSandbox(params: {
+    context: ShellHostContext;
+    executionId: string;
+    executionDir: string;
+    cmd: string;
+    cwd: string;
+    shellPath: string;
+    login: boolean;
+    baseEnv: NodeJS.ProcessEnv;
+    sandboxMode?: "safe" | "unrestricted";
+}): Promise<SandboxSpawnResult>;
+/**
+ * 执行一次 one-shot sandbox 命令并等待结束。
+ *
+ * 关键点（中文）
+ * - 供 task script 这类“直接执行命令但不需要 shell session 管理”的路径复用。
+ * - 非零退出码会直接抛错，行为与原先 `execa(..., { reject: true })` 保持一致。
+ */
+export declare function runSandboxCommand(params: {
+    context: ShellHostContext;
+    executionId: string;
+    executionDir: string;
+    cmd: string;
+    cwd: string;
+    shellPath: string;
+    login: boolean;
+    baseEnv: NodeJS.ProcessEnv;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    spawn: SandboxSpawnResult;
+}>;
+//# sourceMappingURL=SandboxRunner.d.ts.map

package/bin/sandbox/SandboxRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxRunner.d.ts","sourceRoot":"","sources":["../../src/sandbox/SandboxRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAM5E;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;CACvC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY9B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;CACvC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsC9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;CAC3B,CAAC,CAiCD"}

package/bin/sandbox/SandboxRunner.js

@@ -0,0 +1,107 @@
+/**
+ * SandboxRunner 入口。
+ *
+ * 关键点（中文）
+ * - 这里不实现完整的 session/read/write 协议，只负责本地子进程创建时统一进入 agent sandbox backend。
+ * - 当前版本接入 macOS seatbelt 与 Linux bubblewrap backend。
+ * - 本地命令不再允许回退到宿主机普通子进程执行。
+ */
+import { resolveSandboxConfig, resolveSandboxCwd } from "../sandbox/SandboxConfigResolver.js";
+import { spawnMacOsSeatbeltSandbox } from "../sandbox/MacOsSeatbeltSandbox.js";
+import { spawnLinuxBubblewrapSandbox } from "../sandbox/LinuxBubblewrapSandbox.js";
+import { spawnUnrestrictedSandbox } from "../sandbox/UnrestrictedSandbox.js";
+/**
+ * 启动 shell 子进程。
+ */
+export async function spawnShellProcess(params) {
+    return spawnInSandbox({
+        context: params.context,
+        executionId: params.shellId,
+        executionDir: params.shellDir,
+        cmd: params.cmd,
+        cwd: params.cwd,
+        shellPath: params.shellPath,
+        login: params.login,
+        baseEnv: params.baseEnv,
+        sandboxMode: params.sandboxMode,
+    });
+}
+/**
+ * 在当前 agent sandbox 中启动本地子进程。
+ */
+export async function spawnInSandbox(params) {
+    if (params.sandboxMode === "unrestricted") {
+        return spawnUnrestrictedSandbox({
+            executionId: params.executionId,
+            executionDir: params.executionDir,
+            cmd: params.cmd,
+            cwd: params.cwd,
+            shellPath: params.shellPath,
+            login: params.login,
+            baseEnv: params.baseEnv,
+            actualCwd: params.cwd,
+        });
+    }
+    const config = resolveSandboxConfig(params.context);
+    const actualCwd = resolveSandboxCwd({
+        rootPath: config.rootPath,
+        requestedCwd: params.cwd,
+        context: params.context,
+    });
+    const spawnParams = {
+        executionId: params.executionId,
+        executionDir: params.executionDir,
+        cmd: params.cmd,
+        cwd: params.cwd,
+        shellPath: params.shellPath,
+        login: params.login,
+        baseEnv: params.baseEnv,
+        config,
+        actualCwd,
+    };
+    if (config.backend === "macos-seatbelt") {
+        return spawnMacOsSeatbeltSandbox(spawnParams);
+    }
+    if (config.backend === "linux-bubblewrap") {
+        return spawnLinuxBubblewrapSandbox(spawnParams);
+    }
+    throw new Error(`unsupported sandbox backend: ${config.backend}`);
+}
+/**
+ * 执行一次 one-shot sandbox 命令并等待结束。
+ *
+ * 关键点（中文）
+ * - 供 task script 这类“直接执行命令但不需要 shell session 管理”的路径复用。
+ * - 非零退出码会直接抛错，行为与原先 `execa(..., { reject: true })` 保持一致。
+ */
+export async function runSandboxCommand(params) {
+    const spawn = await spawnInSandbox(params);
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    spawn.child.stdout.on("data", (chunk) => {
+        stdoutChunks.push(String(chunk ?? ""));
+    });
+    spawn.child.stderr.on("data", (chunk) => {
+        stderrChunks.push(String(chunk ?? ""));
+    });
+    const exitCode = await new Promise((resolve, reject) => {
+        spawn.child.on("error", (error) => reject(error));
+        spawn.child.on("close", (code) => resolve(typeof code === "number" ? code : -1));
+    });
+    const stdout = stdoutChunks.join("");
+    const stderr = stderrChunks.join("");
+    if (exitCode !== 0) {
+        const message = [stdout.trim(), stderr.trim()]
+            .filter(Boolean)
+            .join("\n")
+            .trim();
+        throw new Error(message || `Sandbox command failed with exit code ${exitCode}`);
+    }
+    return {
+        stdout,
+        stderr,
+        exitCode,
+        spawn,
+    };
+}
+//# sourceMappingURL=SandboxRunner.js.map

package/bin/sandbox/SandboxRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxRunner.js","sourceRoot":"","sources":["../../src/sandbox/SandboxRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAUvC;IACC,OAAO,cAAc,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,OAAO;QAC3B,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAUpC;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QAC1C,OAAO,wBAAwB,CAAC;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,GAAG;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG;QAClB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,SAAS;KACV,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACxC,OAAO,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QAC1C,OAAO,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MASvC;IAMC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;QACvD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;QACvD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM;QACN,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC"}

package/bin/sandbox/UnrestrictedSandbox.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Unrestricted sandbox backend。
+ *
+ * 关键点（中文）
+ * - 这是 Downcity Runtime 管理的高权限执行环境，不是 agent 直接访问宿主 shell。
+ * - 进程继承宿主可见文件系统与环境边界，但必须由上层 approval 流程批准后才能调用。
+ * - 本 backend 只负责 spawn，不做审批、审计或风险判断。
+ */
+import type { SandboxSpawnParams, SandboxSpawnResult } from "../sandbox/types/SandboxRuntime.js";
+/**
+ * 在 unrestricted sandbox 中启动 shell 子进程。
+ */
+export declare function spawnUnrestrictedSandbox(params: Omit<SandboxSpawnParams, "config"> & {
+    actualCwd: string;
+}): Promise<SandboxSpawnResult>;
+//# sourceMappingURL=UnrestrictedSandbox.d.ts.map

package/bin/sandbox/UnrestrictedSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnrestrictedSandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/UnrestrictedSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,kBAAkB,CAAC,CA+B7B"}

package/bin/sandbox/UnrestrictedSandbox.js

@@ -0,0 +1,39 @@
+/**
+ * Unrestricted sandbox backend。
+ *
+ * 关键点（中文）
+ * - 这是 Downcity Runtime 管理的高权限执行环境，不是 agent 直接访问宿主 shell。
+ * - 进程继承宿主可见文件系统与环境边界，但必须由上层 approval 流程批准后才能调用。
+ * - 本 backend 只负责 spawn，不做审批、审计或风险判断。
+ */
+import { spawn } from "node:child_process";
+import fs from "fs-extra";
+/**
+ * 在 unrestricted sandbox 中启动 shell 子进程。
+ */
+export async function spawnUnrestrictedSandbox(params) {
+    await fs.ensureDir(params.executionDir);
+    const child = spawn(params.shellPath, [
+        params.login ? "-lc" : "-c",
+        params.cmd,
+    ], {
+        cwd: params.actualCwd,
+        stdio: "pipe",
+        env: params.baseEnv,
+    });
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    return {
+        child,
+        cwd: params.actualCwd,
+        sandboxed: false,
+        sandboxMode: "unrestricted",
+        backend: "unrestricted-host",
+        networkMode: "full",
+        sandboxDir: "",
+        homeDir: String(params.baseEnv.HOME || ""),
+        tmpDir: String(params.baseEnv.TMPDIR || "/tmp"),
+        cacheDir: String(params.baseEnv.XDG_CACHE_HOME || ""),
+    };
+}
+//# sourceMappingURL=UnrestrictedSandbox.js.map

package/bin/sandbox/UnrestrictedSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnrestrictedSandbox.js","sourceRoot":"","sources":["../../src/sandbox/UnrestrictedSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,UAAU,CAAC;AAM1B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAkE;IAElE,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,CAAC,SAAS,EAChB;QACE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC3B,MAAM,CAAC,GAAG;KACX,EACD;QACE,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,MAAM,CAAC,OAAO;KACpB,CACF,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAEjC,OAAO;QACL,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/bin/sandbox/types/Sandbox.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Sandbox 共享类型定义。
+ *
+ * 关键点（中文）
+ * - 这里放的是 console 模块与 agent 执行层都会使用的最小 sandbox 协议。
+ * - 当前版本不引入复杂 profile / binding / permission 模型，只表达“命令执行边界”。
+ * - 运行时句柄与状态化 session 类型放在 `src/sandbox/types/`。
+ */
+/**
+ * Sandbox 网络模式。
+ *
+ * 说明（中文）
+ * - `off`：完全禁止网络访问。
+ * - `restricted`：允许受限网络访问（后续实现白名单时再细化）。
+ * - `full`：允许完整网络访问。
+ */
+export type SandboxNetworkMode = "off" | "restricted" | "full";
+/**
+ * Sandbox 路径访问模式。
+ *
+ * 说明（中文）
+ * - `ro`：只读。
+ * - `rw`：可读写。
+ */
+export type SandboxPathAccessMode = "ro" | "rw";
+/**
+ * 单条路径边界规则。
+ */
+export interface SandboxPathRule {
+    /**
+     * 宿主机上的绝对路径。
+     */
+    path: string;
+    /**
+     * 当前路径在 sandbox 中的访问模式。
+     */
+    access: SandboxPathAccessMode;
+    /**
+     * 当前规则的说明文本。
+     */
+    reason?: string;
+}
+/**
+ * sandbox 最小配置。
+ *
+ * 说明（中文）
+ * - 当前只表达命令执行边界，不表达 chat 用户授权与审批流。
+ * - `rootPath` 是默认工作根目录。
+ * - `writablePaths` 决定哪些路径允许写入。
+ * - `envAllowlist` 决定哪些环境变量允许导出到 sandbox。
+ */
+export interface SandboxConfig {
+    /**
+     * 当前 sandbox 的默认根目录。
+     */
+    rootPath: string;
+    /**
+     * 允许导出的环境变量名集合。
+     *
+     * 说明（中文）
+     * - 这里仅声明允许导出的 key，不在共享配置层直接保存明文值。
+     */
+    envAllowlist: string[];
+    /**
+     * 允许写入的路径集合。
+     *
+     * 说明（中文）
+     * - 路径可以是绝对路径，也可以是相对 `rootPath` 的相对路径。
+     * - 运行时会统一解析为绝对路径，并限制在 `rootPath` 范围内。
+     */
+    writablePaths: string[];
+    /**
+     * 当前 sandbox 的网络模式。
+     */
+    networkMode: SandboxNetworkMode;
+}
+/**
+ * 项目级 sandbox 配置。
+ *
+ * 说明（中文）
+ * - 这是 `downcity.json` 中面向用户暴露的最小配置。
+ * - 当前版本只服务 CLI / shell 执行边界，不扩展到审批或用户权限系统。
+ */
+export interface SandboxProjectConfig {
+    /**
+     * 允许导出的环境变量名集合。
+     *
+     * 说明（中文）
+     * - 这里只声明允许导出的 key，不直接保存变量值。
+     * - 运行时仍会注入少量必需变量，例如隔离后的 `HOME`、`TMPDIR`。
+     */
+    envAllowlist?: string[];
+    /**
+     * 允许写入的路径集合。
+     *
+     * 说明（中文）
+     * - 路径可以是绝对路径，也可以是相对 `rootPath` 的相对路径。
+     * - 当前版本会把越出 `rootPath` 的路径裁掉，避免把宿主文件系统重新暴露回去。
+     */
+    writablePaths?: string[];
+    /**
+     * 当前 sandbox 的网络模式。
+     *
+     * 说明（中文）
+     * - 默认建议使用 `off`。
+     * - `restricted` 先保留为受限网络语义占位，当前实现会按保守策略处理。
+     */
+    networkMode?: SandboxNetworkMode;
+}
+/**
+ * console 模块中保存的 agent sandbox 配置记录。
+ */
+export interface AgentSandboxConfigRecord {
+    /**
+     * 当前 agent 的稳定标识。
+     *
+     * 说明（中文）
+     * - 当前建议直接使用 agent 项目根目录绝对路径。
+     */
+    agentId: string;
+    /**
+     * 当前 agent 使用的 sandbox 配置。
+     */
+    config: SandboxConfig;
+    /**
+     * 最近更新时间（ISO8601）。
+     */
+    updatedAt: string;
+}
+//# sourceMappingURL=Sandbox.d.ts.map

package/bin/sandbox/types/Sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sandbox.d.ts","sourceRoot":"","sources":["../../../src/sandbox/types/Sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,YAAY,GAAG,MAAM,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,MAAM,EAAE,qBAAqB,CAAC;IAE9B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB;;OAEG;IACH,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/bin/sandbox/types/Sandbox.js

@@ -0,0 +1,10 @@
+/**
+ * Sandbox 共享类型定义。
+ *
+ * 关键点（中文）
+ * - 这里放的是 console 模块与 agent 执行层都会使用的最小 sandbox 协议。
+ * - 当前版本不引入复杂 profile / binding / permission 模型，只表达“命令执行边界”。
+ * - 运行时句柄与状态化 session 类型放在 `src/sandbox/types/`。
+ */
+export {};
+//# sourceMappingURL=Sandbox.js.map

package/bin/sandbox/types/Sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sandbox.js","sourceRoot":"","sources":["../../../src/sandbox/types/Sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}