@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-B7YRSULE.js

@@ -0,0 +1,1423 @@
+import {
+  LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR
+} from "./chunk-4U6XK2DG.js";
+import {
+  getCheckoutPathForms,
+  getRecursiveWriteGrantRoots,
+  isCheckoutCoveredByWriteGrant,
+  isPathWithinResolved,
+  resolveCheckoutIdentity,
+  resolveRealPathOrThrow
+} from "./chunk-BY6ODHNZ.js";
+import {
+  formatSandboxCapabilityFailure,
+  probeProviderSandboxCapability
+} from "./chunk-3H4MWYIC.js";
+import {
+  getAllProviderWritePathSpecs,
+  getBuildAuthorityWriteDenyPathSpecs,
+  getProviderAuthorityRoots,
+  getProviderAuthorityWriteDenyPathSpecs,
+  getProviderAuthorityWriteReallowPathSpecs,
+  getRequiredWritePathsForProvider,
+  isAllowedRuntimeWritePath,
+  resolveWritePathSpec,
+  withResolvedTarget
+} from "./chunk-DP7FKP6W.js";
+import {
+  resolveAllowAwsCredentialRead
+} from "./chunk-VIFHYTI5.js";
+import {
+  isKernelSandboxActive,
+  isNestedSandboxReinitDenied,
+  isSandboxEnforcementSupported,
+  isSandboxSupported,
+  logLinuxHostClassNote,
+  logSandboxEnforcementUnavailable,
+  logSandboxUnavailable
+} from "./chunk-MJ6WNSIX.js";
+import {
+  execGitSync
+} from "./chunk-MHLEZQQI.js";
+import {
+  ProviderRegistry
+} from "./chunk-QJ6OEH4K.js";
+import {
+  authorizeLinuxHostClassWrites,
+  hasContainerOsSignal,
+  resolveLinuxHostClass
+} from "./chunk-V2TVPO3X.js";
+import {
+  ProviderExecutionError
+} from "./chunk-RRC5BL7B.js";
+import {
+  BUILD_SANDBOX_BOUNDARY_POLICY,
+  BUILD_SANDBOX_CONTAINER_ATTESTED,
+  BUILD_SANDBOX_PROFILE_PATH,
+  BUILD_SANDBOX_PROVENANCE,
+  getRuntimeEnv,
+  isDebugMode,
+  readEnv,
+  readRawEnv
+} from "./chunk-7VRJHTGZ.js";
+
+// src/core/sandbox/index.ts
+import fs3 from "fs";
+import os3 from "os";
+
+// src/telemetry/sandbox-decision-log.ts
+var SANDBOX_DECISION_EVENT = "sandbox_decision";
+var SANDBOX_CAPABILITY_DENIED_EVENT = "sandbox_capability_denied";
+function buildSandboxDecisionEvent(entry, options = {}) {
+  const denial = options.denial ?? false;
+  const event = {
+    event: denial ? SANDBOX_CAPABILITY_DENIED_EVENT : SANDBOX_DECISION_EVENT,
+    providerName: entry.providerName,
+    sandboxed: entry.sandboxed,
+    platform: entry.platform
+  };
+  if (entry.providerId !== void 0) event.providerId = entry.providerId;
+  if (entry.reason !== void 0) event.reason = entry.reason;
+  if (entry.provenance !== void 0) event.provenance = entry.provenance;
+  if (entry.boundaryProof !== void 0) event.boundaryProof = entry.boundaryProof;
+  if (entry.policyProof !== void 0) event.policyProof = entry.policyProof;
+  if (denial && entry.deniedPaths && entry.deniedPaths.length > 0) {
+    event.deniedPaths = entry.deniedPaths;
+  }
+  return event;
+}
+var cachedLogger = null;
+var loaderStarted = false;
+var PENDING_QUEUE_MAX = 32;
+var pendingEvents = [];
+var droppedPendingCount = 0;
+function enqueuePending(payload) {
+  pendingEvents.push(payload);
+  while (pendingEvents.length > PENDING_QUEUE_MAX) {
+    pendingEvents.shift();
+    droppedPendingCount += 1;
+  }
+}
+function flushPending() {
+  if (!cachedLogger || pendingEvents.length === 0) return;
+  const queued = pendingEvents.splice(0, pendingEvents.length);
+  for (const payload of queued) {
+    try {
+      cachedLogger.logCustomEvent(payload);
+    } catch {
+    }
+  }
+  if (droppedPendingCount > 0) {
+    try {
+      cachedLogger.logCustomEvent({
+        event: "sandbox_decision_queue_overflow",
+        dropped: droppedPendingCount
+      });
+    } catch {
+    }
+    droppedPendingCount = 0;
+  }
+}
+function ensureLoggerLoading() {
+  if (cachedLogger || loaderStarted) return;
+  loaderStarted = true;
+  void import("./get-telemetry-logger-MPDVO2JA.js").then(({ getTelemetryLogger }) => {
+    try {
+      cachedLogger = getTelemetryLogger();
+      flushPending();
+    } catch {
+      pendingEvents.length = 0;
+      droppedPendingCount = 0;
+    }
+  }).catch(() => {
+    pendingEvents.length = 0;
+    droppedPendingCount = 0;
+  });
+}
+var recordedDecisionRunId;
+var recordedDecisions = /* @__PURE__ */ new Set();
+function isRepeatedDecision(payload) {
+  const runId = getRuntimeEnv("BUILD_RUN_ID");
+  if (runId !== recordedDecisionRunId) {
+    recordedDecisionRunId = runId;
+    recordedDecisions.clear();
+  }
+  const key = JSON.stringify(payload);
+  if (recordedDecisions.has(key)) return true;
+  recordedDecisions.add(key);
+  return false;
+}
+function recordSandboxDecision(entry) {
+  try {
+    const denial = Boolean(entry.deniedPaths && entry.deniedPaths.length > 0);
+    const payload = buildSandboxDecisionEvent(entry, { denial });
+    if (!denial && isRepeatedDecision(payload)) return;
+    if (!cachedLogger) {
+      enqueuePending(payload);
+      ensureLoggerLoading();
+      return;
+    }
+    cachedLogger.logCustomEvent(payload);
+  } catch {
+  }
+}
+
+// src/core/sandbox/inherited-read-only.ts
+function hasInheritedBoundaryReadOnlyPosture(providerId) {
+  try {
+    return ProviderRegistry.getCapability(providerId, "supports_inherited_boundary_read_only") === true;
+  } catch {
+    return false;
+  }
+}
+function listInheritedBoundaryReadOnlyProviderIds() {
+  try {
+    return ProviderRegistry.getEnabledProviders().filter((provider) => provider.capabilities.supports_inherited_boundary_read_only === true).map((provider) => provider.id).sort();
+  } catch {
+    return [];
+  }
+}
+function assertReadOnlyCanInheritOuterBoundary(providerName, providerId) {
+  if (hasInheritedBoundaryReadOnlyPosture(providerId)) return;
+  const alternatives = listInheritedBoundaryReadOnlyProviderIds();
+  throw new ProviderExecutionError(
+    `[${providerName}] read-only confinement cannot be established inside the host's sandbox: Build cannot nest its own read-only profile and ${providerName} has no read-only posture that holds without it. ${alternatives.length > 0 ? `Use a provider whose read-only posture holds inside the host sandbox (${alternatives.join(", ")}), or run` : "No enabled provider offers that; run"} Build outside the host sandbox [reason=read_only_confinement_unavailable]`,
+    { retryable: false, reason: "read_only_confinement_unavailable", providerName }
+  );
+}
+
+// src/core/sandbox/profile-cache.ts
+import crypto from "crypto";
+import fs2 from "fs";
+import path4 from "path";
+
+// src/core/sandbox/profile-generator.ts
+import fs from "fs";
+import os2 from "os";
+import path3 from "path";
+
+// src/core/sandbox/profile-storage.ts
+import os from "os";
+import path from "path";
+function getSandboxProfileStorageDirectory() {
+  return path.join(os.homedir(), "Library", "Application Support", "Build", "sandbox-profiles");
+}
+
+// src/core/sandbox/provider-authority.ts
+import path2 from "path";
+function renderProviderAuthorityWriteDenyEntries(env, providerId, escapePath, tempVariants) {
+  const entries = /* @__PURE__ */ new Set();
+  for (const spec of getProviderAuthorityWriteDenyPathSpecs(providerId, { env })) {
+    const resolved = resolveWritePathSpec(spec, env?.HOME);
+    if (!resolved) continue;
+    for (const candidate of tempVariants(resolved)) {
+      entries.add(`
+  (${spec.kind} "${escapePath(candidate)}")`);
+    }
+  }
+  if (entries.size === 0) return "";
+  const reallow = /* @__PURE__ */ new Set();
+  for (const spec of getProviderAuthorityWriteReallowPathSpecs(providerId, { env })) {
+    const resolved = resolveWritePathSpec(spec, env?.HOME);
+    if (!resolved) continue;
+    for (const candidate of tempVariants(resolved)) {
+      reallow.add(`
+  (${spec.kind} "${escapePath(candidate)}")`);
+    }
+  }
+  const reallowBlock = reallow.size > 0 ? `;; Runtime data carved out of the denies above (last match wins).
+(allow file-write*${[...reallow].join("")}
+)
+` : "";
+  const roots = /* @__PURE__ */ new Set();
+  for (const authorityRoot of getProviderAuthorityRoots(providerId, { env })) {
+    for (let current = authorityRoot; current !== path2.dirname(current); current = path2.dirname(current)) {
+      for (const form of getCheckoutPathForms(current)) {
+        for (const candidate of tempVariants(form)) roots.add(candidate);
+      }
+    }
+  }
+  const unlink = [...roots].map((root) => `
+  (literal "${escapePath(root)}")`).join("");
+  return `;; PROVIDER SETTINGS AND HOOK SURFACES (DENY)
+(deny file-write*${[...entries].join("")}
+)
+${reallowBlock}${unlink ? `;; Keep authority roots in place without blocking mkdir, auth or lock writes.
+(deny file-write-unlink${unlink}
+)
+` : ""}`;
+}
+
+// src/core/sandbox/profile-generator.ts
+var CREDENTIAL_DENY_SPECS = [
+  { kind: "subpath", homeRelative: ".ssh" },
+  { kind: "subpath", homeRelative: ".azure" },
+  { kind: "subpath", homeRelative: ".gnupg" },
+  { kind: "subpath", homeRelative: ".kube" },
+  { kind: "subpath", homeRelative: ".docker/config.json" },
+  { kind: "literal", homeRelative: ".npmrc" },
+  { kind: "literal", homeRelative: ".git-credentials" },
+  { kind: "literal", homeRelative: ".config/git/credentials" },
+  { kind: "subpath", homeRelative: ".op" },
+  { kind: "subpath", homeRelative: ".config/op" },
+  { kind: "literal", homeRelative: ".netrc" },
+  { kind: "literal", homeRelative: ".pypirc" },
+  { kind: "subpath", homeRelative: ".gem/credentials" },
+  { kind: "literal", homeRelative: ".cargo/credentials" },
+  { kind: "literal", homeRelative: ".cargo/credentials.toml" },
+  { kind: "subpath", homeRelative: ".config/heroku" },
+  { kind: "subpath", homeRelative: ".terraform.d" },
+  { kind: "literal", homeRelative: ".vault-token" },
+  { kind: "subpath", homeRelative: ".config/stripe" },
+  { kind: "subpath", homeRelative: ".cloudflare" },
+  { kind: "subpath", homeRelative: ".wrangler" },
+  { kind: "literal", homeRelative: ".pulumi/credentials.json" },
+  { kind: "subpath", homeRelative: ".config/vercel" },
+  { kind: "subpath", homeRelative: ".config/netlify" },
+  // Local CI publication MAC key. Outside the sandbox-writable `~/.build`
+  // tree; denied for read+write so a confined agent cannot mint a valid
+  // success publication.
+  {
+    kind: "subpath",
+    homeRelative: LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR
+  }
+];
+var AWS_CREDENTIAL_DENY_SPECS = [
+  { kind: "subpath", homeRelative: ".aws" },
+  { kind: "literal", homeRelative: ".aws/credentials" }
+];
+function getCredentialDenySpecs(allowAwsCredentialRead = false) {
+  return allowAwsCredentialRead ? CREDENTIAL_DENY_SPECS : [...CREDENTIAL_DENY_SPECS, ...AWS_CREDENTIAL_DENY_SPECS];
+}
+var TOOLCHAIN_CREDENTIAL_DENY_SPECS = [
+  { kind: "literal", homeRelative: ".m2/settings.xml" },
+  { kind: "literal", homeRelative: ".m2/settings-security.xml" },
+  { kind: "literal", homeRelative: ".gradle/gradle.properties" },
+  // Gradle init scripts auto-execute as the user on the next build (deferred
+  // exec). ~/.gradle is write-granted via COMMON_TOOLCHAIN_WRITE_PATHS, so these
+  // must be re-denied post-allow to block planted init scripts.
+  { kind: "subpath", homeRelative: ".gradle/init.d" },
+  { kind: "literal", homeRelative: ".gradle/init.gradle" },
+  { kind: "literal", homeRelative: ".gradle/init.gradle.kts" }
+];
+var PROVIDER_TOKEN_WRITE_DENY_SPECS = [
+  { kind: "literal", homeRelative: ".config/gh/hosts.yml" },
+  { kind: "literal", homeRelative: ".gemini/oauth_creds.json" },
+  {
+    kind: "literal",
+    homeRelative: ".config/gcloud/application_default_credentials.json"
+  },
+  // gcloud stores live OAuth/access tokens in SQLite stores under the recursively
+  // write-granted ~/.config/gcloud tree, not just the ADC json. credentials.db and
+  // access_tokens.db are the actual token stores gcloud reads/refreshes. Deny WRITES
+  // to them (reads stay allowed) so a confined agent cannot overwrite/forge tokens.
+  // Note: denying writes may interfere with in-sandbox gcloud token refresh, which
+  // is the same posture already chosen for .config/gh/hosts.yml and .gemini tokens.
+  { kind: "literal", homeRelative: ".config/gcloud/credentials.db" },
+  { kind: "literal", homeRelative: ".config/gcloud/access_tokens.db" },
+  // Codex stores browser-login tokens in auth.json under the recursively
+  // write-granted ~/.codex (CODEX_HOME) tree. Re-deny writes (reads stay
+  // allowed) so a confined agent cannot overwrite/forge the login secret.
+  // Isolated/custom CODEX_HOME is re-denied separately via absolute paths
+  // (see renderCodexAuthJsonRedenyEntries) so every granted state root is covered.
+  { kind: "literal", homeRelative: ".codex/auth.json" }
+];
+var CLIENT_SIDE_GIT_HOOK_NAMES = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "post-rewrite",
+  "post-index-change",
+  "pre-auto-gc"
+];
+function renderWritePathDirectives(home, specs) {
+  const render = (spec, p) => `
+  (${spec.kind} "${escapeSeatbeltString(p)}")`;
+  return specs.flatMap((s) => withResolvedTarget(`${home}/${s.homeRelative}`).map((p) => render(s, p))).join("");
+}
+function escapeSeatbeltString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+function regexEscapeString(value) {
+  return value.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
+function renderProviderStateWriteEntries(home, env, providerId) {
+  const specs = providerId ? getRequiredWritePathsForProvider(providerId, { env }) : getAllProviderWritePathSpecs({ env });
+  return specs.flatMap((spec) => {
+    if (spec.rejected) return [];
+    if (spec.kind === "regex") {
+      const anchoredPrefix = `^${regexEscapeString(home)}/`;
+      return [`
+  (regex "${escapeSeatbeltString(anchoredPrefix)}${spec.homeRelative}")`];
+    }
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) return [];
+    switch (spec.kind) {
+      case "literal":
+        return [`
+  (literal "${escapeSeatbeltString(resolved)}")`];
+      default:
+        return [`
+  (subpath "${escapeSeatbeltString(resolved)}")`];
+    }
+  }).join("");
+}
+function renderProviderStateWriteEntriesWithinWorkingDir(home, checkout, env, providerId) {
+  const specs = providerId ? getRequiredWritePathsForProvider(providerId, { env }) : getAllProviderWritePathSpecs({ env });
+  const workingDirVariants = checkout.forms.flatMap(getMacosTempRootSymlinkVariants);
+  const entries = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    if (spec.rejected || spec.kind === "regex") continue;
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) continue;
+    const candidates = getCheckoutPathForms(resolved).flatMap(getMacosTempRootSymlinkVariants);
+    for (const candidate of candidates) {
+      const contained = workingDirVariants.some(
+        (workingDirVariant) => candidate !== workingDirVariant && isPathUnder(candidate, workingDirVariant)
+      );
+      if (!contained) continue;
+      const directive = spec.kind === "literal" ? "literal" : "subpath";
+      entries.add(`
+  (${directive} "${escapeSeatbeltString(candidate)}")`);
+    }
+  }
+  return [...entries].join("");
+}
+function renderOperatorXdgGitCredentialsEntry() {
+  const xdgConfigHome = process.env.XDG_CONFIG_HOME?.trim();
+  if (!xdgConfigHome || !path3.isAbsolute(xdgConfigHome)) return "";
+  return withResolvedTarget(path3.join(xdgConfigHome, "git", "credentials")).flatMap(getMacosTempRootSymlinkVariants).map((credentialsPath) => `
+  (literal "${escapeSeatbeltString(credentialsPath)}")`).join("");
+}
+function renderCredentialWriteDenyEntries(realHome, envHome, allowAwsCredentialRead = false) {
+  return `${renderWritePathDirectives(realHome, getCredentialDenySpecs(allowAwsCredentialRead))}${renderOperatorXdgGitCredentialsEntry()}${renderWritePathDirectives(
+    realHome,
+    TOOLCHAIN_CREDENTIAL_DENY_SPECS
+  )}${renderWritePathDirectives(envHome, PROVIDER_TOKEN_WRITE_DENY_SPECS)}`;
+}
+function renderCodexAuthJsonRedenyEntries(home, env) {
+  const authPaths = /* @__PURE__ */ new Set();
+  authPaths.add(path3.join(home, ".codex", "auth.json"));
+  const specs = getRequiredWritePathsForProvider("codex", {
+    env: env ?? { HOME: home },
+    includeSharedPaths: false
+  });
+  for (const spec of specs) {
+    if (spec.rejected) continue;
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) continue;
+    authPaths.add(path3.join(resolved, "auth.json"));
+  }
+  return [...authPaths].flatMap((authPath) => getMacosTempRootSymlinkVariants(authPath)).map((authPath) => `
+  (literal "${escapeSeatbeltString(authPath)}")`).join("");
+}
+function renderCredentialRedenyEntries(realHome, envHome, env, allowAwsCredentialRead = false) {
+  return `
+  ;; Credential directories/files must be re-denied after the write allow block.
+  ;; macOS seatbelt uses last-match-wins, so the early read/write deny is not
+  ;; enough if a runtime provider path accidentally overlaps a credential path.${renderCredentialWriteDenyEntries(realHome, envHome, allowAwsCredentialRead)}${renderCodexAuthJsonRedenyEntries(envHome, env)}`;
+}
+function renderBuildAuthorityWriteDenyEntries(env) {
+  const entries = /* @__PURE__ */ new Set();
+  for (const spec of getBuildAuthorityWriteDenyPathSpecs(env)) {
+    const resolved = resolveWritePathSpec(spec, env?.HOME);
+    if (!resolved) continue;
+    for (const candidate of getMacosTempRootSymlinkVariants(resolved)) {
+      entries.add(`
+  (${spec.kind} "${escapeSeatbeltString(candidate)}")`);
+    }
+  }
+  return [...entries].join("");
+}
+var MACOS_TEMP_ROOT_PREFIXES = [
+  "/tmp",
+  "/private/tmp",
+  "/var/folders",
+  "/private/var/folders"
+];
+function normalizeSeatbeltPath(candidatePath) {
+  return path3.sep === "\\" ? candidatePath.replace(/\\/g, "/") : candidatePath;
+}
+function isPathUnder(candidate, parent) {
+  const rel = path3.relative(parent, candidate);
+  return rel === "" || !!rel && !rel.startsWith("..") && !path3.isAbsolute(rel);
+}
+function isUnderMacosTempRoot(resolvedPath) {
+  const normalized = normalizeSeatbeltPath(path3.resolve(resolvedPath));
+  return MACOS_TEMP_ROOT_PREFIXES.some(
+    (root) => normalized === root || normalized.startsWith(`${root}/`)
+  );
+}
+function getMacosTempRootSymlinkVariants(resolvedPath) {
+  const normalized = normalizeSeatbeltPath(path3.resolve(resolvedPath));
+  const variants = /* @__PURE__ */ new Set([normalized]);
+  if (normalized === "/private/tmp" || normalized.startsWith("/private/tmp/")) {
+    variants.add(normalized.replace(/^\/private\/tmp/, "/tmp"));
+  } else if (normalized === "/tmp" || normalized.startsWith("/tmp/")) {
+    variants.add(normalized.replace(/^\/tmp/, "/private/tmp"));
+  }
+  if (normalized === "/private/var/folders" || normalized.startsWith("/private/var/folders/")) {
+    variants.add(normalized.replace(/^\/private\/var\/folders/, "/var/folders"));
+  } else if (normalized === "/var/folders" || normalized.startsWith("/var/folders/")) {
+    variants.add(normalized.replace(/^\/var\/folders/, "/private/var/folders"));
+  }
+  if (normalized === "/private/var/tmp" || normalized.startsWith("/private/var/tmp/")) {
+    variants.add(normalized.replace(/^\/private\/var\/tmp/, "/var/tmp"));
+  } else if (normalized === "/var/tmp" || normalized.startsWith("/var/tmp/")) {
+    variants.add(normalized.replace(/^\/var\/tmp/, "/private/var/tmp"));
+  }
+  return Array.from(variants).sort();
+}
+function renderReadOnlyCheckoutDenyEntry(checkout, readOnlyWorkingDir, grantedRoots) {
+  if (!readOnlyWorkingDir || !isCheckoutCoveredByWriteGrant(checkout, grantedRoots)) return "";
+  return [...new Set(checkout.forms.flatMap(getMacosTempRootSymlinkVariants))].map((candidate) => `
+  (subpath "${escapeSeatbeltString(candidate)}")`).join("");
+}
+var GIT_AUTHORITY_READ_TIMEOUT_MS = 5e3;
+function getGitWorktreeLayout(worktreePath) {
+  try {
+    const probe = execGitSync(
+      ["rev-parse", "--path-format=absolute", "--git-common-dir", "--git-dir"],
+      {
+        cwd: worktreePath,
+        timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+        scrubGitConfigFileOverrides: true
+      }
+    );
+    const [commonDir, worktreeGitDir] = probe.exitCode === 0 ? probe.stdout.trim().split(/\r?\n/) : [];
+    if (commonDir) return { sharedGitDir: commonDir, worktreeGitDir };
+  } catch {
+  }
+  const normalizedPath = worktreePath.replace(/\\/g, "/");
+  const tmpWorktreeMarker = "/.build-project/tmp/worktrees/";
+  const tmpIdx = normalizedPath.indexOf(tmpWorktreeMarker);
+  if (tmpIdx > 0) {
+    return { sharedGitDir: path3.join(normalizedPath.slice(0, tmpIdx), ".git") };
+  }
+  const labWorktreeMarker = "/.build-project/labs/";
+  const labIdx = normalizedPath.indexOf(labWorktreeMarker);
+  if (labIdx > 0) {
+    const suffix = normalizedPath.slice(labIdx + labWorktreeMarker.length);
+    const segments = suffix.split("/").filter(Boolean);
+    const isLabWorktreePath = segments.length >= 5 && segments[1] === "runs" && segments[3] === "worktrees";
+    if (isLabWorktreePath) {
+      return { sharedGitDir: path3.join(normalizedPath.slice(0, labIdx), ".git") };
+    }
+  }
+  return {};
+}
+function generateSandboxProfile(workingDir, extraWritePaths, readOnlyWorkingDir = false, env, providerId, allowGitWrites = true, allowAwsCredentialRead = false) {
+  const realHome = resolveCheckoutIdentity(process.env.HOME ?? os2.homedir()).canonical;
+  const home = resolveCheckoutIdentity(env?.HOME ?? realHome).canonical;
+  const homeEnv = { ...env, HOME: home };
+  const checkout = resolveCheckoutIdentity(workingDir);
+  const resolvedWorkingDir = checkout.canonical;
+  const { sharedGitDir: commonGitDir, worktreeGitDir } = getGitWorktreeLayout(resolvedWorkingDir);
+  const sharedGitDir = commonGitDir ? resolveCheckoutIdentity(commonGitDir).canonical : void 0;
+  const sharedGitDirEntry = sharedGitDir && !readOnlyWorkingDir && allowGitWrites ? `
+  (subpath "${escapeSeatbeltString(sharedGitDir)}")` : "";
+  const workingDirWriteEntry = readOnlyWorkingDir ? "" : `
+  (subpath "${escapeSeatbeltString(resolvedWorkingDir)}")`;
+  const gitWriteGuardDirs = Array.from(
+    new Set([sharedGitDir, path3.join(resolvedWorkingDir, ".git")].filter((d) => !!d))
+  );
+  const gitTail = "/(config[.]worktree|worktrees/[^/]+/config[.]worktree|(worktrees/[^/]+/)?modules/.+/(config|config[.]worktree|hooks(/.*)?))$";
+  let gitHookConfigDenyEntry = gitWriteGuardDirs.map(
+    (g) => `
+  (subpath "${escapeSeatbeltString(`${g}/hooks`)}")
+  (literal "${escapeSeatbeltString(`${g}/config`)}")` + getMacosTempRootSymlinkVariants(g).map((v) => `
+  (regex "${escapeSeatbeltString(`^${regexEscapeString(v)}${gitTail}`)}")`).join("")
+  ).join("");
+  if (!allowGitWrites || readOnlyWorkingDir) {
+    gitHookConfigDenyEntry += gitWriteGuardDirs.flatMap((gitDir) => getMacosTempRootSymlinkVariants(gitDir)).map((gitDir) => `
+  (subpath "${escapeSeatbeltString(gitDir)}")`).join("");
+  }
+  let sharedGitRefDenyEntry = "";
+  let activeGitRefAllowEntry = "";
+  if (sharedGitDir && !readOnlyWorkingDir && allowGitWrites) {
+    const protectedGitPaths = [
+      path3.join(sharedGitDir, "refs"),
+      path3.join(sharedGitDir, "logs", "refs"),
+      path3.join(sharedGitDir, "packed-refs")
+      // Not the lock: every ref deletion takes it; new content goes to packed-refs.new, then a rename.
+    ];
+    sharedGitRefDenyEntry = protectedGitPaths.flatMap((protectedPath) => getMacosTempRootSymlinkVariants(protectedPath)).map((protectedPath) => `
+  (subpath "${escapeSeatbeltString(protectedPath)}")`).join("");
+    try {
+      const head = execGitSync(["symbolic-ref", "--quiet", "HEAD"], {
+        cwd: resolvedWorkingDir,
+        timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+        scrubGitConfigFileOverrides: true
+      });
+      const activeRef = head.exitCode === 0 ? head.stdout.trim() : "";
+      if (activeRef && /^refs\/heads\/[A-Za-z0-9._/-]+$/.test(activeRef) && !activeRef.includes("..")) {
+        const refPath = path3.join(sharedGitDir, activeRef);
+        const logPath = path3.join(sharedGitDir, "logs", activeRef);
+        activeGitRefAllowEntry = [refPath, `${refPath}.lock`, logPath, `${logPath}.lock`].flatMap((activePath) => getMacosTempRootSymlinkVariants(activePath)).map((activePath) => `
+  (literal "${escapeSeatbeltString(activePath)}")`).join("");
+      }
+    } catch {
+    }
+  }
+  const worktreeGitfile = path3.join(resolvedWorkingDir, ".git");
+  if (sharedGitDir) {
+    try {
+      const stat = fs.lstatSync(worktreeGitfile);
+      const match = stat.isFile() ? /^gitdir:\s*(.+)\s*$/i.exec(fs.readFileSync(worktreeGitfile, "utf8").trim()) : null;
+      if (match?.[1]) {
+        const declaredGitDir = path3.resolve(resolvedWorkingDir, match[1]);
+        if (!worktreeGitDir) throw new Error("Git did not report a worktree git directory");
+        const realDeclaredGitDir = resolveRealPathOrThrow(declaredGitDir);
+        const realActualGitDir = resolveRealPathOrThrow(worktreeGitDir);
+        const realWorktreesDir = resolveRealPathOrThrow(path3.join(sharedGitDir, "worktrees"));
+        if (realDeclaredGitDir === realActualGitDir && isPathUnder(realActualGitDir, realWorktreesDir)) {
+          gitHookConfigDenyEntry += getMacosTempRootSymlinkVariants(worktreeGitfile).map((gitfile) => `
+  (literal "${escapeSeatbeltString(gitfile)}")`).join("");
+        }
+      }
+    } catch {
+    }
+  }
+  const profileStorageDenyEntry = `
+  (subpath "${escapeSeatbeltString(
+    getSandboxProfileStorageDirectory()
+  )}")`;
+  const isAllowedExtraWritePath = (resolved) => isPathWithinResolved(resolved, resolvedWorkingDir) || !!sharedGitDir && isPathWithinResolved(resolved, sharedGitDir) || isUnderMacosTempRoot(resolved) || isAllowedRuntimeWritePath(resolved, env);
+  const droppedExtraWritePaths = [];
+  const grantedExtraWritePaths = (extraWritePaths || []).map((p) => resolveCheckoutIdentity(p).canonical).filter((p) => p && p !== resolvedWorkingDir && p !== sharedGitDir).filter((p) => {
+    if (isAllowedExtraWritePath(p)) return true;
+    droppedExtraWritePaths.push(p);
+    return false;
+  }).sort();
+  const isUnderBroadWriteRoot = (candidate) => isUnderMacosTempRoot(candidate) || !!sharedGitDir && (candidate === sharedGitDir || isPathUnder(candidate, sharedGitDir)) || grantedExtraWritePaths.some((root) => candidate === root || isPathUnder(candidate, root));
+  try {
+    const hooksPathProbe = execGitSync(["config", "--get", "core.hooksPath"], {
+      cwd: resolvedWorkingDir,
+      timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+      scrubGitConfigFileOverrides: true
+    });
+    const hooksPathRaw = hooksPathProbe.exitCode === 0 ? hooksPathProbe.stdout.trim() : "";
+    if (hooksPathRaw) {
+      const absHooksPath = path3.isAbsolute(hooksPathRaw) ? path3.resolve(hooksPathRaw) : path3.resolve(resolvedWorkingDir, hooksPathRaw);
+      const rel = path3.relative(resolvedWorkingDir, absHooksPath);
+      if (rel === "") {
+        if (!readOnlyWorkingDir) {
+          for (const hookName of CLIENT_SIDE_GIT_HOOK_NAMES) {
+            gitHookConfigDenyEntry += `
+  (literal "${escapeSeatbeltString(
+              path3.join(resolvedWorkingDir, hookName)
+            )}")`;
+          }
+        }
+      } else {
+        const strictlyInside = !rel.startsWith("..") && !path3.isAbsolute(rel);
+        if (strictlyInside) {
+          if (!readOnlyWorkingDir) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(absHooksPath)}")`;
+            try {
+              const realHooksPath = resolveRealPathOrThrow(absHooksPath);
+              if (realHooksPath !== absHooksPath) {
+                gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(realHooksPath)}")`;
+              }
+            } catch {
+            }
+          }
+        } else {
+          let realHooksPath;
+          try {
+            realHooksPath = resolveRealPathOrThrow(absHooksPath);
+          } catch {
+          }
+          if (isUnderBroadWriteRoot(absHooksPath)) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(absHooksPath)}")`;
+          }
+          if (realHooksPath && realHooksPath !== absHooksPath && isUnderBroadWriteRoot(realHooksPath)) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(realHooksPath)}")`;
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  const extraWritePathsEntry = grantedExtraWritePaths.map((p) => `
+  (subpath "${escapeSeatbeltString(p)}")`).join("");
+  if (droppedExtraWritePaths.length > 0 && isDebugMode()) {
+    process.stderr.write(
+      `[sandbox] dropped out-of-allowed-root extraWritePaths: ${droppedExtraWritePaths.join(", ")}
+`
+    );
+  }
+  const readOnlyCheckoutDenyEntry = renderReadOnlyCheckoutDenyEntry(checkout, readOnlyWorkingDir, [
+    ...MACOS_TEMP_ROOT_PREFIXES,
+    ...getRecursiveWriteGrantRoots({ home, env, providerId }),
+    ...grantedExtraWritePaths
+  ]);
+  const readOnlyProviderStateReallowEntry = readOnlyCheckoutDenyEntry ? renderProviderStateWriteEntriesWithinWorkingDir(home, checkout, env, providerId) : "";
+  const providerAuthorityWriteDenyEntry = renderProviderAuthorityWriteDenyEntries(
+    homeEnv,
+    providerId,
+    escapeSeatbeltString,
+    getMacosTempRootSymlinkVariants
+  );
+  const buildAuthorityWriteDenyEntry = renderBuildAuthorityWriteDenyEntries(homeEnv);
+  return `(version 1)
+(deny default)
+
+;; ============================================
+;; FILESYSTEM READ ACCESS (BROAD)
+;; ============================================
+;; Allow reading most of the filesystem - the security
+;; boundary is on WRITE access, not read access.
+;; This matches Claude Code's default behavior.
+(allow file-read* (subpath "/"))
+
+;; ============================================
+;; EXPLICIT DENY - SENSITIVE DIRECTORIES
+;; ============================================
+;; Protect credentials, keys, and secrets from read/write
+;; These are blocked even with broad filesystem read access
+(deny file-read* file-write*
+${renderWritePathDirectives(realHome, getCredentialDenySpecs(allowAwsCredentialRead))}${renderOperatorXdgGitCredentialsEntry()}
+)
+
+;; ============================================
+;; EXPLICIT DENY - TOOLCHAIN CREDENTIAL WRITES
+;; ============================================
+;; Allow build caches, but prevent tampering with common local credential files.
+;; Safe for ordinary target builds against public package registries, and reduces
+;; the risk of an AI process modifying user credential configuration.
+(deny file-write*
+${renderWritePathDirectives(realHome, TOOLCHAIN_CREDENTIAL_DENY_SPECS)}
+)
+
+;; ============================================
+;; AI CLI PROVIDER CREDENTIALS (ALLOWED)
+;; ============================================
+;; These directories are needed for AI CLI tools to authenticate.
+;; Read access is allowed by removing them from the deny list. Some CLIs also
+;; require small, scoped write access for token caches (e.g. AWS SSO), which is
+;; granted below under FILESYSTEM WRITE ACCESS.
+;; - ~/.aws: Bedrock backends only (allowAwsCredentialRead);
+;;   missing attestation fails closed and denies ~/.aws)
+;; - ~/.config/gh: GitHub Copilot CLI
+;; - ~/.gcloud, ~/.config/gcloud: Gemini CLI
+;; - ~/.config/opencode: OpenCode CLI state
+
+;; ============================================
+;; FILESYSTEM WRITE ACCESS (RESTRICTED)
+;; ============================================
+;; This is the main security boundary - writes are
+;; restricted to worktree, temp dirs, caches, and
+;; CLI tool state directories.
+  (allow file-write*${workingDirWriteEntry}${sharedGitDirEntry}
+  ;; macOS temp directories - allow both symlinked and canonical paths
+  ;; /var/folders is a symlink to /private/var/folders, but sandbox-exec
+  ;; doesn't resolve symlinks when checking paths, so we need both
+  (subpath "/var/folders")
+  (subpath "/private/var/folders")
+  (subpath "/private/tmp")
+  (subpath "/tmp")
+  ;; Credential/token caches required by some provider auth flows. These are not
+  ;; declared in provider manifests (they live under the otherwise-denied ~/.aws
+  ;; tree and are scoped to the cache subdirs only).
+  (subpath "${escapeSeatbeltString(`${home}/.aws/cli/cache`)}")
+  (subpath "${escapeSeatbeltString(`${home}/.aws/sso/cache`)}")
+  ;; NOTE: macOS Keychain write access is NOT granted here. Providers that store
+  ;; credentials in the system keychain declare ~/Library/Keychains in their own
+  ;; manifest (provider-manifests.ts) so the grant is provider-scoped and is
+  ;; covered by the inherited-sandbox capability probe. Reading a keychain secret
+  ;; genuinely requires WRITE access (Security.framework updates lock/session
+  ;; state and the db during a lookup), so a keychain-backed provider that also
+  ;; hits a GUI authorization prompt on first read has TWO independent gates:
+  ;; this profile and the keychain item's own per-item ACL, which no sandbox
+  ;; profile can satisfy. An unattended run blocks on that prompt until a human
+  ;; chooses "Always Allow"; a provider that stalls unattended after working
+  ;; interactively is the ACL gate, not this profile.
+  ;; Provider state/config/cache and Build runtime paths, derived from the
+  ;; filesystem manifests (provider-manifests.ts) so the granted allowlist stays
+  ;; in lockstep with the sandbox capability probe.${renderProviderStateWriteEntries(home, env, providerId)}
+  (subpath "/dev")${extraWritePathsEntry}
+)
+
+${readOnlyCheckoutDenyEntry ? `;; ============================================
+;; READ-ONLY CHECKOUT (RESOLVED DENY)
+;; ============================================
+;; readOnlyWorkingDir omits the working-dir write entry, but other allows can still
+;; cover the checkout: the temp roots are granted wholesale, and the checkout can
+;; sit inside a granted state or extra write root. Re-deny it as the kernel names it.
+(deny file-write*${readOnlyCheckoutDenyEntry}
+)
+
+` : ""}${readOnlyProviderStateReallowEntry ? `;; ============================================
+;; PROVIDER RUNTIME STATE INSIDE READ-ONLY WORKTREE (ALLOW)
+;; ============================================
+;; Re-open only manifest-declared provider runtime state beneath the worktree.
+;; Credential files are re-denied by the following block.
+(allow file-write*${readOnlyProviderStateReallowEntry}
+)
+
+` : ""};; ============================================
+;; CREDENTIAL WRITE SURFACES (DENY)
+;; ============================================
+;; Re-deny credential writes after the provider write allow block so
+;; environment-derived paths cannot reopen sensitive locations under
+;; last-match-wins seatbelt semantics. Includes Codex auth.json under the
+;; default ~/.codex root and any granted isolated/custom CODEX_HOME.
+(deny file-write*${renderCredentialRedenyEntries(realHome, home, env, allowAwsCredentialRead)}
+)
+
+${providerAuthorityWriteDenyEntry}${buildAuthorityWriteDenyEntry ? `;; ============================================
+;; BUILD CONFIGURATION AUTHORITY (DENY)
+;; ============================================
+;; Shared runtime state remains writable, but provider runs must not rewrite
+;; Build's executable-selection or policy configuration for future runs.
+(deny file-write*${buildAuthorityWriteDenyEntry}
+)
+
+` : ""};; ============================================
+;; GIT EXECUTABLE/AUTHORITY SURFACES (DENY)
+;; ============================================
+;; Block writes to git hooks and config even though the surrounding .git is
+;; writable for normal worktree operations. This closes deferred host code
+;; execution (planted hooks / core.hooksPath) without breaking commits.
+;; Placed AFTER the write-allow block so it wins under last-match-wins.
+(deny file-write*${gitHookConfigDenyEntry}${profileStorageDenyEntry}
+)
+
+${sharedGitRefDenyEntry ? `;; Shared Git refs are global across linked worktrees. Deny all ref writes, then
+;; reopen only this worktree's active branch ref and reflog for normal commits.
+(deny file-write*${sharedGitRefDenyEntry}
+)` : ""}
+${activeGitRefAllowEntry ? `(allow file-write*${activeGitRefAllowEntry}
+)` : ""}
+
+;; ============================================
+;; IPC & MACH (FOR CLI AUTH + SUBPROCESSES)
+;; ============================================
+(allow mach*)
+(allow ipc*)
+
+;; ============================================
+;; NETWORK (OUTBOUND + LOCAL SERVER)
+;; ============================================
+(allow network-outbound)
+;; Some CLIs (notably OpenCode) start a local loopback server even for one-shot
+;; commands (e.g. "opencode run"). Allow inbound connections but restrict binds
+;; to loopback interfaces only.
+(allow network-inbound)
+(allow network-bind (local ip "localhost:*"))
+
+;; ============================================
+;; PROCESS EXECUTION
+;; ============================================
+(allow process-exec*)
+(allow process-fork)
+(allow signal)
+(allow sysctl-read)
+`;
+}
+
+// src/core/sandbox/profile-cache.ts
+var profileCache = /* @__PURE__ */ new Map();
+function getProfileBaseDir() {
+  return getSandboxProfileStorageDirectory();
+}
+function getProfileCacheKey(profile) {
+  return crypto.createHash("sha256").update(profile).digest("hex");
+}
+function isExpectedProfile(profilePath, profile) {
+  try {
+    const stat = fs2.lstatSync(profilePath);
+    return stat.isFile() && !stat.isSymbolicLink() && (stat.mode & 511) === 384 && fs2.readFileSync(profilePath, "utf8") === profile;
+  } catch {
+    return false;
+  }
+}
+function ensurePrivateStorageDirectory(baseDir) {
+  fs2.mkdirSync(baseDir, { recursive: true, mode: 448 });
+  const stat = fs2.lstatSync(baseDir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Sandbox profile storage is not a private directory: ${baseDir}`);
+  }
+  if ((stat.mode & 511) !== 448) {
+    fs2.chmodSync(baseDir, 448);
+  }
+}
+function writeProfileAtomically(profilePath, profile) {
+  const temporaryPath = `${profilePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs2.writeFileSync(temporaryPath, profile, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs2.renameSync(temporaryPath, profilePath);
+    fs2.chmodSync(profilePath, 384);
+  } finally {
+    try {
+      fs2.rmSync(temporaryPath, { force: true });
+    } catch {
+    }
+  }
+}
+function getOrCreateProfile(workingDir, extraWritePaths, readOnlyWorkingDir = false, env, providerId, allowGitWrites = true, allowAwsCredentialRead = false) {
+  const profile = generateSandboxProfile(
+    workingDir,
+    extraWritePaths,
+    readOnlyWorkingDir,
+    env,
+    providerId,
+    allowGitWrites,
+    allowAwsCredentialRead
+  );
+  const cacheKey = getProfileCacheKey(profile);
+  const baseDir = getProfileBaseDir();
+  ensurePrivateStorageDirectory(baseDir);
+  const profilePath = path4.join(baseDir, `${cacheKey}.sb`);
+  const cached = profileCache.get(cacheKey);
+  if (cached === profilePath && isExpectedProfile(cached, profile)) {
+    return cached;
+  }
+  if (!isExpectedProfile(profilePath, profile)) {
+    writeProfileAtomically(profilePath, profile);
+  }
+  profileCache.set(cacheKey, profilePath);
+  return profilePath;
+}
+function registerGlobalCleanup() {
+}
+
+// src/core/sandbox/index.ts
+function isTestRuntime() {
+  return Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID);
+}
+function isBooleanTrueEnv(value) {
+  if (value === void 0) return false;
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+function isContainerAttestedByEnv(env) {
+  const source = env ?? process.env;
+  const attestedClaim = env ? isBooleanTrueEnv(source[BUILD_SANDBOX_CONTAINER_ATTESTED.name]) : readEnv(BUILD_SANDBOX_CONTAINER_ATTESTED).value === true;
+  const provenanceClaim = env ? source[BUILD_SANDBOX_PROVENANCE.name] === "container" : readRawEnv(BUILD_SANDBOX_PROVENANCE) === "container";
+  if (!attestedClaim && !provenanceClaim) return false;
+  return hasContainerOsSignal();
+}
+function isLinuxHostClassProvenance(provenance) {
+  return provenance === "linux_isolated" || provenance === "linux_acknowledged" || provenance === "linux_desktop_unacked";
+}
+function isLinuxWriteProvenance(provenance) {
+  return provenance === "linux_isolated" || provenance === "linux_acknowledged";
+}
+function normalizeProviderName(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function hasExplicitSandboxOptOut(providerName, providerId) {
+  if (!isImplicitTestRuntimeSandboxDisable()) {
+    return !isSandboxEnabled(providerName, providerId);
+  }
+  return isProviderSandboxOptOut(providerName, providerId);
+}
+function isSandboxEnabledForProvider(providerName, providerId) {
+  return isSandboxEnabled(providerName, providerId);
+}
+function willSandboxBeActive(providerName, providerId, options) {
+  const enabled = isSandboxEnabled(providerName, providerId);
+  if (!enabled) return false;
+  if (isSandboxSupported() && !(isKernelSandboxActive() && isNestedSandboxReinitDenied())) {
+    return true;
+  }
+  const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+  if (isLinuxHostClassProvenance(attestation.provenance)) {
+    return false;
+  }
+  return isSandboxBoundaryAccepted(attestation, resolveEnvSandboxBoundaryPolicy());
+}
+function isSandboxEnforcementOperational(providerName, providerId) {
+  if (!willSandboxBeActive(providerName, providerId)) return false;
+  return isSandboxEnforcementSupported();
+}
+function isSelfGeneratedSeatbeltOperational(providerName, providerId) {
+  if (!isSandboxEnabled(providerName, providerId)) return false;
+  if (!isSandboxSupported()) return false;
+  return isSandboxEnforcementSupported();
+}
+function requireActiveSandboxBoundary(providerName, reason, providerId, options) {
+  const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+  const effectivePolicy = resolveEnvSandboxBoundaryPolicy();
+  const accepted = isSandboxBoundaryAccepted(attestation, effectivePolicy);
+  if (accepted) {
+    return attestation;
+  }
+  if (os3.platform() === "linux") {
+    const authorized = authorizeLinuxHostClassWrites(options);
+    if (authorized.status === "allowed") {
+      return {
+        provenance: authorized.provenance,
+        evidence: attestation.evidence
+      };
+    }
+  }
+  throw new ProviderExecutionError(
+    `[${providerName}] ${reason} requires an active sandbox boundary, but none is available (provenance=${attestation.provenance}) [reason=sandbox_boundary_required]`,
+    { retryable: false, reason: "sandbox_boundary_required" }
+  );
+}
+function provenanceProvesPolicyByConstruction(attestation) {
+  return attestation.provenance === "seatbelt_self";
+}
+function provenanceSkipsCapabilityProbe(attestation) {
+  return attestation.provenance === "seatbelt_self" || attestation.provenance === "linux_isolated" || attestation.provenance === "linux_acknowledged";
+}
+function policyProofForAcceptedBoundary(attestation, providerId, env) {
+  if (isLinuxWriteProvenance(attestation.provenance)) {
+    return "linux_host_class";
+  }
+  if (provenanceProvesPolicyByConstruction(attestation)) {
+    return "wrap_applied";
+  }
+  const capability = probeProviderSandboxCapability(providerId, {
+    env,
+    includeSharedPaths: false
+  });
+  return capability.capable ? "capability_probe" : void 0;
+}
+function boundaryProofForProvenance(provenance) {
+  switch (provenance) {
+    case "seatbelt_self":
+      return void 0;
+    case "container":
+      return "container";
+    case "inherited_outer":
+      return "inherited_outer";
+    case "linux_isolated":
+      return "linux_isolated";
+    case "linux_acknowledged":
+      return "linux_acknowledged";
+    default:
+      return void 0;
+  }
+}
+function requireActivePolicyBoundary(providerName, reason, providerId, options = {}) {
+  const attestation = requireActiveSandboxBoundary(providerName, reason, providerId, options);
+  if (provenanceSkipsCapabilityProbe(attestation)) {
+    return { attestation, kind: "policy" };
+  }
+  const capability = probeProviderSandboxCapability(providerId ?? providerName.toLowerCase(), {
+    env: options.env,
+    includeSharedPaths: false
+  });
+  if (capability.capable) {
+    return { attestation, kind: "policy", capability };
+  }
+  recordSandboxDecision({
+    providerName,
+    providerId: providerId ?? providerName.toLowerCase(),
+    sandboxed: false,
+    reason: "sandbox_capability_denied",
+    provenance: attestation.provenance,
+    deniedPaths: capability.missing.map((entry) => entry.path),
+    platform: os3.platform()
+  });
+  throw new ProviderExecutionError(
+    `[${providerName}] ${reason}: ${formatSandboxCapabilityFailure(capability)} [reason=sandbox_capability_denied]`,
+    { retryable: false, reason: "sandbox_capability_denied" }
+  );
+}
+function shouldBypassProviderInternalSandbox(providerName, reason, providerId, options = {}) {
+  requireActivePolicyBoundary(providerName, reason, providerId, options);
+  return true;
+}
+function detectSandboxBoundaryAttestation(providerName, providerId, options) {
+  const seatbeltSelfOperational = isSelfGeneratedSeatbeltOperational(providerName, providerId);
+  const sandboxRuntimeEnv = process.env.SANDBOX_RUNTIME === "1";
+  const kernelSandboxActive = isKernelSandboxActive();
+  const nestedSandboxReinitDenied = isNestedSandboxReinitDenied();
+  const containerAttested = isContainerAttestedByEnv(options?.env);
+  const evidence = {
+    seatbeltSelfOperational,
+    sandboxRuntimeEnv,
+    kernelSandboxActive,
+    nestedSandboxReinitDenied,
+    containerAttested
+  };
+  if (seatbeltSelfOperational) {
+    return { provenance: "seatbelt_self", evidence };
+  }
+  const linuxResolution = os3.platform() === "linux" ? resolveLinuxHostClass(options) : null;
+  const forcedDesktop = linuxResolution?.source === "env_desktop" || linuxResolution?.evidence.envHostClass === "desktop";
+  if (containerAttested && !forcedDesktop) {
+    return { provenance: "container", evidence };
+  }
+  if (linuxResolution?.hostClass === "isolated" && linuxResolution.source !== "container_attested") {
+    logLinuxHostClassNote(linuxResolution);
+    return { provenance: "linux_isolated", evidence };
+  }
+  const inheritedOuterAttested = kernelSandboxActive && (sandboxRuntimeEnv || nestedSandboxReinitDenied);
+  if (inheritedOuterAttested) {
+    return { provenance: "inherited_outer", evidence };
+  }
+  if (linuxResolution?.hostClass === "desktop-acked") {
+    logLinuxHostClassNote(linuxResolution);
+    return { provenance: "linux_acknowledged", evidence };
+  }
+  if (linuxResolution?.hostClass === "desktop-unacked") {
+    return { provenance: "linux_desktop_unacked", evidence };
+  }
+  return { provenance: "none", evidence };
+}
+function resolveSandboxBoundaryPolicy(raw) {
+  return raw === "strict" ? "strict" : "attested_outer_ok";
+}
+function resolveEnvSandboxBoundaryPolicy() {
+  return resolveSandboxBoundaryPolicy(readRawEnv(BUILD_SANDBOX_BOUNDARY_POLICY));
+}
+function isAttestedInheritedOuterBoundary(attestation) {
+  return attestation.provenance === "inherited_outer" && attestation.evidence.kernelSandboxActive && attestation.evidence.nestedSandboxReinitDenied;
+}
+function isSandboxBoundaryAccepted(attestation, policy) {
+  if (attestation.provenance === "seatbelt_self" || attestation.provenance === "container") {
+    return true;
+  }
+  if (isLinuxWriteProvenance(attestation.provenance)) {
+    return os3.platform() === "linux";
+  }
+  if (policy === "attested_outer_ok" && isAttestedInheritedOuterBoundary(attestation)) {
+    return true;
+  }
+  return false;
+}
+function warnSandboxEnforcementUnavailable() {
+  logSandboxEnforcementUnavailable();
+}
+function isImplicitTestRuntimeSandboxDisable() {
+  return isTestRuntime() && process.env.BUILD_SANDBOX_ENABLED === void 0;
+}
+function isSandboxEnabled(providerName, providerId) {
+  if (isImplicitTestRuntimeSandboxDisable()) {
+    return false;
+  }
+  return !isProviderSandboxOptOut(providerName, providerId);
+}
+function isProviderSandboxOptOut(providerName, providerId) {
+  const globalDisabled = process.env.BUILD_SANDBOX_ENABLED === "0";
+  if (globalDisabled) return true;
+  const normalizedName = normalizeProviderName(providerName);
+  const nameOverride = process.env[`BUILD_SANDBOX_${normalizedName}_ENABLED`];
+  if (nameOverride === "0") return true;
+  if (providerId) {
+    const normalizedId = normalizeProviderName(providerId);
+    const idOverride = process.env[`BUILD_SANDBOX_${normalizedId}_ENABLED`];
+    if (idOverride === "0") return true;
+  }
+  return false;
+}
+function validateCustomSandboxProfile(profilePath) {
+  let contents;
+  try {
+    const stat = fs3.statSync(profilePath);
+    if (!stat.isFile()) {
+      throw new ProviderExecutionError(
+        `[Sandbox] BUILD_SANDBOX_PROFILE_PATH is not a regular file: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+        { retryable: false, reason: "invalid_custom_sandbox_profile" }
+      );
+    }
+    contents = fs3.readFileSync(profilePath, "utf8");
+  } catch (error) {
+    if (error instanceof ProviderExecutionError) throw error;
+    throw new ProviderExecutionError(
+      `[Sandbox] BUILD_SANDBOX_PROFILE_PATH could not be read: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+  const policy = contents.replace(/;.*$/gm, "");
+  const hasDenyDefault = /\(\s*deny\s+default\s*\)/.test(policy);
+  const hasAllowDefault = /\(\s*allow\s+default\s*\)/.test(policy);
+  if (hasAllowDefault) {
+    throw new ProviderExecutionError(
+      `[Sandbox] Custom sandbox profile contains (allow default), which grants an unrestricted sandbox: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+  if (!hasDenyDefault) {
+    throw new ProviderExecutionError(
+      `[Sandbox] Custom sandbox profile must contain (deny default): ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+}
+function unwrappedAcceptedBoundaryResult(attestation, config, platform) {
+  const boundaryProof = boundaryProofForProvenance(attestation.provenance);
+  if (boundaryProof === void 0) {
+    return void 0;
+  }
+  const policyProof = policyProofForAcceptedBoundary(
+    attestation,
+    config.providerId ?? config.providerName.toLowerCase(),
+    config.env
+  );
+  const linuxHostClass = isLinuxWriteProvenance(attestation.provenance);
+  logSandboxTelemetry(
+    {
+      providerName: config.providerName,
+      sandboxed: !linuxHostClass,
+      reason: attestation.provenance,
+      platform,
+      workingDir: config.workingDir
+    },
+    {
+      provenance: attestation.provenance,
+      boundaryProof,
+      policyProof,
+      providerId: config.providerId ?? config.providerName.toLowerCase()
+    }
+  );
+  return {
+    command: config.command,
+    args: config.args,
+    // Host class is write permission, not confinement. Gate 3 checks proofs.
+    sandboxed: !linuxHostClass,
+    boundaryProof,
+    policyProof
+  };
+}
+function willReadOnlyWorkspaceBeEnforced(providerName, providerId) {
+  if (!isSandboxEnabled(providerName, providerId)) return false;
+  if (readEnv(BUILD_SANDBOX_PROFILE_PATH).value) return false;
+  if (!isSelfGeneratedSeatbeltOperational(providerName, providerId)) return false;
+  if (isKernelSandboxActive() && isNestedSandboxReinitDenied()) return false;
+  return true;
+}
+function wrapWithSandbox(config, options) {
+  const {
+    workingDir,
+    command,
+    args,
+    providerName,
+    extraWritePaths,
+    readOnlyWorkingDir,
+    allowGitWrites,
+    requiresBoundaryForWrites,
+    providerId,
+    env
+  } = config;
+  const platform = os3.platform();
+  let reason;
+  const runningUnderVitest = isTestRuntime();
+  if (!isSandboxEnabled(providerName, providerId)) {
+    const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+    const boundaryPolicy = resolveEnvSandboxBoundaryPolicy();
+    if (isSandboxBoundaryAccepted(attestation, boundaryPolicy)) {
+      const accepted = unwrappedAcceptedBoundaryResult(attestation, config, platform);
+      if (accepted) {
+        return accepted;
+      }
+    }
+    const globalDisabled = process.env.BUILD_SANDBOX_ENABLED === "0";
+    const disabledKey = providerId ? `provider_disabled_${providerId}` : `provider_disabled_${providerName}`;
+    reason = globalDisabled ? "globally_disabled" : disabledKey;
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    if (requiresBoundaryForWrites && !readOnlyWorkingDir && !hasExplicitSandboxOptOut(providerName, providerId)) {
+      if (platform === "linux") {
+        authorizeLinuxHostClassWrites(options);
+      }
+      throw new ProviderExecutionError(
+        `[${providerName}] write-capable provider execution requires an active sandbox boundary; the sandbox is disabled only by an implicit test-runtime signal (reason=${reason}). Set BUILD_SANDBOX_ENABLED=0 explicitly to accept unconfined execution [reason=sandbox_boundary_required]`,
+        { retryable: false, reason: "sandbox_boundary_required", providerName }
+      );
+    }
+    return { command, args, sandboxed: false };
+  }
+  if (!isSandboxSupported()) {
+    const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+    const boundaryPolicy = resolveEnvSandboxBoundaryPolicy();
+    if (isSandboxBoundaryAccepted(attestation, boundaryPolicy)) {
+      const accepted = unwrappedAcceptedBoundaryResult(attestation, config, platform);
+      if (accepted) {
+        return accepted;
+      }
+    }
+    if (platform !== "linux") {
+      logSandboxUnavailable();
+    }
+    reason = platform === "darwin" ? "sandbox_exec_not_found" : "unsupported_platform";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    if (requiresBoundaryForWrites && !readOnlyWorkingDir) {
+      if (platform === "linux") {
+        const authorized = authorizeLinuxHostClassWrites(options);
+        if (authorized.status === "allowed") {
+          const allowedAttestation = {
+            provenance: authorized.provenance,
+            evidence: attestation.evidence
+          };
+          const accepted = unwrappedAcceptedBoundaryResult(allowedAttestation, config, platform);
+          if (accepted) {
+            return accepted;
+          }
+        }
+      }
+      throw new ProviderExecutionError(
+        `[${providerName}] write-capable provider execution requires an active sandbox boundary, but none is available on this platform (platform=${platform}, provenance=${attestation.provenance}) [reason=sandbox_boundary_required]`,
+        { retryable: false, reason: "sandbox_boundary_required", providerName }
+      );
+    }
+    return { command, args, sandboxed: false };
+  }
+  if (!runningUnderVitest && isKernelSandboxActive() && isNestedSandboxReinitDenied()) {
+    if (readOnlyWorkingDir) {
+      assertReadOnlyCanInheritOuterBoundary(providerName, providerId ?? providerName.toLowerCase());
+    }
+    const inheritedAttestation = {
+      provenance: "inherited_outer",
+      evidence: {
+        seatbeltSelfOperational: false,
+        sandboxRuntimeEnv: process.env.SANDBOX_RUNTIME === "1",
+        kernelSandboxActive: true,
+        nestedSandboxReinitDenied: true,
+        containerAttested: isContainerAttestedByEnv()
+      }
+    };
+    if (!isSandboxBoundaryAccepted(inheritedAttestation, resolveEnvSandboxBoundaryPolicy())) {
+      logSandboxTelemetry({
+        providerName,
+        sandboxed: false,
+        reason: "inherited_outer_rejected_by_policy",
+        platform,
+        workingDir
+      });
+      if (requiresBoundaryForWrites) {
+        throw new ProviderExecutionError(
+          `[${providerName}] ${readOnlyWorkingDir ? "read-only" : "write-capable"} provider execution requires an active sandbox boundary, but the inherited outer boundary is rejected under BUILD_SANDBOX_BOUNDARY_POLICY=strict [reason=sandbox_boundary_required]`,
+          { retryable: false, reason: "sandbox_boundary_required", providerName }
+        );
+      }
+      return { command, args, sandboxed: false };
+    }
+    reason = "inherited_outer";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: true,
+      reason,
+      platform,
+      workingDir
+    });
+    return {
+      command,
+      args,
+      sandboxed: true,
+      boundaryProof: "inherited_outer",
+      policyProof: policyProofForAcceptedBoundary(
+        inheritedAttestation,
+        providerId ?? providerName.toLowerCase(),
+        env
+      )
+    };
+  }
+  const customProfile = process.env.BUILD_SANDBOX_PROFILE_PATH;
+  let profilePath;
+  try {
+    if (customProfile) {
+      validateCustomSandboxProfile(customProfile);
+      profilePath = customProfile;
+    } else {
+      profilePath = getOrCreateProfile(
+        workingDir,
+        extraWritePaths,
+        readOnlyWorkingDir,
+        env,
+        providerId ?? providerName.toLowerCase(),
+        allowGitWrites,
+        resolveAllowAwsCredentialRead({
+          providerId: providerId ?? providerName.toLowerCase(),
+          env,
+          workingDir
+        })
+      );
+      registerGlobalCleanup();
+    }
+  } catch (error) {
+    reason = "profile_generation_failed";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    throw error;
+  }
+  const policyProof = customProfile ? void 0 : "wrap_applied";
+  logSandboxTelemetry(
+    {
+      providerName,
+      sandboxed: true,
+      platform,
+      workingDir,
+      customProfile: !!customProfile
+    },
+    {
+      provenance: "seatbelt_self",
+      boundaryProof: "wrap_applied",
+      policyProof,
+      providerId: providerId ?? providerName.toLowerCase()
+    }
+  );
+  return {
+    command: "sandbox-exec",
+    args: ["-f", profilePath, command, ...args],
+    sandboxed: true,
+    boundaryProof: "wrap_applied",
+    policyProof
+  };
+}
+function logSandboxTelemetry(entry, durable) {
+  recordSandboxDecision({
+    providerName: entry.providerName,
+    providerId: durable?.providerId,
+    sandboxed: entry.sandboxed,
+    reason: entry.reason,
+    provenance: durable?.provenance,
+    boundaryProof: durable?.boundaryProof,
+    policyProof: durable?.policyProof,
+    platform: entry.platform
+  });
+}
+
+export {
+  hasExplicitSandboxOptOut,
+  isSandboxEnabledForProvider,
+  willSandboxBeActive,
+  isSandboxEnforcementOperational,
+  requireActiveSandboxBoundary,
+  requireActivePolicyBoundary,
+  shouldBypassProviderInternalSandbox,
+  detectSandboxBoundaryAttestation,
+  resolveSandboxBoundaryPolicy,
+  resolveEnvSandboxBoundaryPolicy,
+  isAttestedInheritedOuterBoundary,
+  isSandboxBoundaryAccepted,
+  warnSandboxEnforcementUnavailable,
+  willReadOnlyWorkspaceBeEnforced,
+  wrapWithSandbox
+};
+//# sourceMappingURL=chunk-B7YRSULE.js.map