@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-DP7FKP6W.js

@@ -0,0 +1,855 @@
+import {
+  getContainedHomeSiblingRuntimeRoot,
+  resolveTrustedBuildHome
+} from "./chunk-56WPYDJH.js";
+import {
+  BUILD_HOME_DIR_NAME
+} from "./chunk-7VRJHTGZ.js";
+
+// src/core/sandbox/provider-manifests.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+// src/core/sandbox/provider-manifest-table.ts
+var sub = (homeRelative, note) => ({
+  kind: "subpath",
+  homeRelative,
+  note
+});
+var lit = (homeRelative, note) => ({
+  kind: "literal",
+  homeRelative,
+  note
+});
+var rgx = (homeRelative, note, probeName) => ({
+  kind: "regex",
+  homeRelative,
+  note,
+  ...probeName ? { probeName } : {}
+});
+var COMMON_TOOLCHAIN_WRITE_PATHS = [
+  sub(".cache", "XDG cache"),
+  sub("Library/Caches", "macOS user caches"),
+  sub(".npm"),
+  sub(".bun"),
+  sub(".m2"),
+  sub(".gradle")
+];
+var CURSOR_KEYCHAIN_WRITE = {
+  kind: "subpath",
+  homeRelative: "Library/Keychains",
+  note: "macOS Keychain state for Cursor CLI login lookup",
+  // The cursor mcp.json authority-deny applies to the config dir, not here.
+  authorityDenyExempt: true
+};
+var CLAUDE_OPTIONAL_STATE_SUBPATHS = [
+  "file-history",
+  "plans",
+  "debug",
+  "paste-cache",
+  "uploads",
+  "session-env",
+  "tasks",
+  "shell-snapshots",
+  "backups",
+  "feedback-bundles",
+  "feedback",
+  "usage-data",
+  "cache",
+  "agent-memory",
+  "skills",
+  "agents",
+  "commands",
+  "workflows",
+  "rules",
+  "output-styles"
+];
+var CLAUDE_STATE_FILE_REGEX = "\\.claude/(?:history\\.jsonl|stats-cache\\.json|\\.credentials\\.json|\\.credentials\\.lock|CLAUDE\\.md)(?:\\.[^/]*)?$";
+var GEMINI_STACK_POLICY_DENY_PATHS = [
+  { kind: "literal", relativePath: "settings.json" },
+  { kind: "literal", relativePath: "trustedFolders.json" },
+  { kind: "subpath", relativePath: "policies" }
+];
+var PROVIDER_MANIFESTS = {
+  "project-verification": {
+    providerId: "project-verification",
+    requiredWritePaths: [
+      ...COMMON_TOOLCHAIN_WRITE_PATHS,
+      sub(".cargo/registry"),
+      sub(".cargo/git"),
+      sub(".nuget/packages"),
+      sub(".pub-cache"),
+      sub(".gem"),
+      sub("Library/pnpm/store"),
+      sub(".local/share/pnpm/store"),
+      sub("go/pkg/mod")
+    ]
+  },
+  claude: {
+    providerId: "claude",
+    authorityStateRoot: ".claude",
+    // Enumerated, not the whole ~/.claude root: Claude writes its own app data
+    // and the content it authors (skills, agents, memory), never settings,
+    // hooks, plugins or the native-install binary. Names follow
+    // https://code.claude.com/docs/en/claude-directory (Application data and
+    // State files to keep). remote-settings.json and policy-limits.json are
+    // server-delivered policy caches and are deliberately not granted.
+    // Each static subpath is authorityDenyExempt: the authority denies below
+    // are joined onto granted roots, and joining them onto these narrow
+    // subpaths would only emit meaningless denies (and would block an authored
+    // skill that happens to be named `hooks`).
+    requiredWritePaths: [
+      ...[
+        sub(".claude/projects", "Claude CLI transcripts and auto memory"),
+        sub(".claude/sessions", "Claude CLI per-session liveness files"),
+        ...CLAUDE_OPTIONAL_STATE_SUBPATHS.map((entry) => ({
+          ...sub(`.claude/${entry}`, "Claude CLI app data or authored content"),
+          probeExempt: true
+        })),
+        sub(".claude.json.lock", "Claude CLI atomic-write lock")
+      ].map((spec) => ({ ...spec, authorityDenyExempt: true })),
+      {
+        ...rgx(CLAUDE_STATE_FILE_REGEX, "Claude CLI state files and their atomic-write temps"),
+        probeExempt: true
+      },
+      lit(".claude.json", "Claude CLI root config"),
+      // Claude writes a lock dir + atomic temp files next to ~/.claude.json;
+      // blocking these forces non-atomic writes that can corrupt the config.
+      // Observed temp name: .claude.json.tmp.<pid>.<12 hex>.
+      rgx(
+        "\\.claude\\.json\\.tmp\\.[^/]+$",
+        "Claude CLI atomic-write temp",
+        ".claude.json.tmp.build-cap-{id}"
+      )
+    ],
+    // A CLAUDE_CONFIG_DIR runtime root is granted whole (a dedicated dir), so
+    // these are re-denied beneath it. Settings and hooks alter policy; plugins,
+    // local (native install) and dev-mods supply code that later runs.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "settings.json" },
+      { kind: "literal", relativePath: "settings.local.json" },
+      { kind: "subpath", relativePath: "hooks" },
+      { kind: "subpath", relativePath: "plugins" },
+      { kind: "subpath", relativePath: "local" },
+      { kind: "subpath", relativePath: "dev-mods" }
+    ],
+    // ${CLAUDE_PLUGIN_DATA} resolves to ~/.claude/plugins/data/<id>/: runtime
+    // plugin data (dependencies, caches), kept across plugin updates. Plugin
+    // code and config stay denied. Source:
+    // https://code.claude.com/docs/en/plugins/manifest-reference#environment-variables
+    persistentAuthorityWriteReallowPaths: [{ kind: "subpath", relativePath: "plugins/data" }]
+  },
+  codex: {
+    providerId: "codex",
+    requiredWritePaths: [sub(".codex", "Codex CLI state (CODEX_HOME)")],
+    // config.toml / profile sidecars steer later invocations (model_provider,
+    // approvals); rules/ is the exec policy, hooks.json supplies commands, and
+    // requirements/managed_config are managed policy. auth.json stays writable
+    // — it is required Codex state, not a deferred-execution policy surface.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "config.toml" },
+      { kind: "literal", relativePath: "requirements.toml" },
+      { kind: "literal", relativePath: "managed_config.toml" },
+      { kind: "literal", relativePath: "hooks.json" },
+      { kind: "subpath", relativePath: "rules" }
+    ]
+  },
+  copilot: {
+    providerId: "copilot",
+    requiredWritePaths: [
+      sub(".copilot", "Copilot CLI state"),
+      {
+        ...sub("Library/Application Support/github-copilot", "Copilot macOS state"),
+        authorityDenyExempt: true
+      },
+      {
+        ...sub("Library/Application Support/GitHub Copilot", "Copilot macOS state"),
+        authorityDenyExempt: true
+      },
+      { ...sub(".config/gh", "gh CLI auth used by Copilot"), authorityDenyExempt: true }
+    ],
+    // config.json carries trusted folders and permissions, settings.json the
+    // user settings, mcp-config.json the MCP servers and hooks/ the hook code
+    // that later turns load.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "config.json" },
+      { kind: "literal", relativePath: "settings.json" },
+      { kind: "literal", relativePath: "mcp-config.json" },
+      { kind: "literal", relativePath: "permissions-config.json" },
+      { kind: "literal", relativePath: "permissions-config" },
+      { kind: "subpath", relativePath: "hooks" }
+    ]
+  },
+  cursor: {
+    providerId: "cursor",
+    requiredWritePaths: [sub(".cursor", "Cursor CLI state"), CURSOR_KEYCHAIN_WRITE],
+    // User-level MCP config and hooks are loaded by later Cursor turns
+    // (`--approve-mcps` and project `.cursor/mcp.json` are the documented MCP
+    // surfaces). cli-config.json holds the permission allow/deny lists,
+    // approval mode and sandbox settings, so it is denied too; the login
+    // itself lives in the Keychain and the Build-seeded runtime copy is
+    // written before launch, not by the confined process.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "mcp.json" },
+      { kind: "literal", relativePath: "cli-config.json", staticRootOnly: true },
+      { kind: "literal", relativePath: "hooks.json" },
+      { kind: "literal", relativePath: "sandbox.json" },
+      { kind: "subpath", relativePath: "sandbox-policies" }
+    ]
+  },
+  gemini: {
+    providerId: "gemini",
+    requiredWritePaths: [
+      sub(".gemini", "Gemini CLI state"),
+      { ...sub(".gcloud", "gcloud auth cache"), authorityDenyExempt: true },
+      { ...sub(".config/gcloud", "gcloud auth config"), authorityDenyExempt: true },
+      // Gemini CLI 0.53.1 stores an interactively-entered API key in the macOS
+      // Keychain (service "gemini-cli-api-key"). Security.framework updates
+      // lock/session state and the keychain db during an ordinary LOOKUP, so
+      // reading a secret requires WRITE access here — a read grant is not
+      // sufficient. Established by bisection: granting only login.keychain-db,
+      // that file plus the session UUID dir, or plus a .fl* lock regex all fail,
+      // and granting the directory then re-denying the db also fails.
+      //
+      // Declared per-provider (not in the shared write block) so only providers
+      // that actually need the keychain receive it, and so the inherited-sandbox
+      // capability probe checks it — an outer sandbox that denies this path now
+      // fails closed as sandbox_capability_denied instead of launching Gemini
+      // with its internal protections bypassed and failing at credential access.
+      {
+        ...sub("Library/Keychains", "macOS Keychain state for Gemini CLI API-key lookup"),
+        authorityDenyExempt: true
+      }
+    ],
+    persistentAuthorityWriteDenyPaths: GEMINI_STACK_POLICY_DENY_PATHS
+  },
+  grok: {
+    providerId: "grok",
+    requiredWritePaths: [sub(".grok", "Grok CLI session/auth state")],
+    // ~/.grok stays writable for sessions, auth, skills, plugins, AGENTS.md and
+    // memory. These are the paths Grok's own sandbox write-denies under every
+    // built-in profile (docs/user-guide/18-sandbox.md, "Direct global write
+    // protection"): settings, folder trust, managed policy and sandbox
+    // profiles (unmatched tools inherit always-approve / ask rules from
+    // config.toml), hook sources, and bundle caches that load as built-ins.
+    // bin/, downloads/ and vendor/ hold the executables a later launch runs.
+    // hooks-paths lists further hook sources, which are denied as well.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "config.toml" },
+      { kind: "literal", relativePath: "sandbox.toml" },
+      { kind: "literal", relativePath: "requirements.toml" },
+      { kind: "literal", relativePath: "managed_config.toml" },
+      { kind: "literal", relativePath: "trusted_folders.toml" },
+      { kind: "literal", relativePath: "hooks-paths" },
+      { kind: "subpath", relativePath: "hooks" },
+      { kind: "subpath", relativePath: "bundled" },
+      { kind: "subpath", relativePath: "bundles" },
+      { kind: "subpath", relativePath: "bin" },
+      { kind: "subpath", relativePath: "downloads" },
+      { kind: "subpath", relativePath: "vendor" }
+    ],
+    authorityPathRegistry: "hooks-paths"
+  },
+  kiro: {
+    providerId: "kiro",
+    requiredWritePaths: [sub(".kiro", "Kiro CLI state"), sub(".config/kiro", "Kiro CLI config")],
+    // CLI settings and MCP servers are loaded by later turns. settings/ also
+    // holds runtime feed and survey state, so only the two files are denied.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "settings/cli.json" },
+      { kind: "literal", relativePath: "settings/mcp.json" }
+    ]
+  },
+  antigravity: {
+    providerId: "antigravity",
+    // Antigravity (`agy`) is built on the Gemini stack and writes across the
+    // whole ~/.gemini tree at runtime: OAuth token (~/.gemini/oauth_creds.json),
+    // auto-created project config (~/.gemini/config/projects/*.json), and CLI
+    // state (~/.gemini/antigravity-cli/). Granting the subtree mirrors the
+    // gemini manifest; scoping to subdirs caused `operation not permitted` on
+    // the project-config write and a hard exit 2 under the seatbelt.
+    requiredWritePaths: [sub(".gemini", "Antigravity/Gemini CLI state, OAuth, and project config")],
+    persistentAuthorityWriteDenyPaths: GEMINI_STACK_POLICY_DENY_PATHS
+  },
+  opencode: {
+    providerId: "opencode",
+    requiredWritePaths: [sub(".config/opencode", "OpenCode CLI state")],
+    // Isolated runs already treat these as user config (commands / agents)
+    // that would otherwise leak into later invocations.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "opencode/opencode.json" },
+      { kind: "literal", relativePath: "opencode/opencode.jsonc" },
+      { kind: "literal", relativePath: "opencode/config.json" },
+      { kind: "subpath", relativePath: "opencode/agent" }
+    ]
+  },
+  pi: {
+    providerId: "pi",
+    // Pi writes auth.json, models.json, the model store, and a security event
+    // log under ~/.pi/agent. Build passes --no-session so session files are not
+    // created, but the agent dir itself is still written at startup: without
+    // this grant Pi dies with EPERM on mkdir before the model is reached.
+    requiredWritePaths: [
+      {
+        ...sub(".pi", "Pi agent auth, model catalog, and event log"),
+        authorityPathPrefix: "agent"
+      }
+    ],
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "subpath", relativePath: "extensions" },
+      { kind: "subpath", relativePath: "npm" },
+      { kind: "subpath", relativePath: "git" },
+      { kind: "literal", relativePath: "settings.json" },
+      { kind: "literal", relativePath: "trust.json" },
+      { kind: "literal", relativePath: "models.json" }
+    ],
+    protectAuthorityRoot: true
+  }
+};
+
+// src/core/sandbox/provider-manifests.ts
+var isRuntimeOverride = (spec) => !!spec.absolutePath && !spec.staticAlias;
+var absoluteSubpath = (absolutePath, note) => ({
+  kind: "subpath",
+  homeRelative: absolutePath,
+  absolutePath,
+  note
+});
+var absoluteLiteral = (absolutePath, note) => ({
+  kind: "literal",
+  homeRelative: absolutePath,
+  absolutePath,
+  note
+});
+var rejectedRuntimeDir = (absolutePath, note) => ({
+  kind: "subpath",
+  homeRelative: absolutePath,
+  absolutePath,
+  note,
+  rejected: true
+});
+var BUILD_SHARED_WRITE_PATHS = [
+  // `.build` covers the default config/data/state roots (~/.build/{config,data,state})
+  // as well as the runtime dirs that always lived there. The two XDG entries remain
+  // for installs that explicitly set XDG_STATE_HOME / XDG_DATA_HOME.
+  sub(BUILD_HOME_DIR_NAME, "Build home (config/data/state and runtime dirs)"),
+  sub(".local/state/build", "Build XDG state (legacy/explicit XDG_STATE_HOME)"),
+  sub(".local/share/build", "Build XDG data (legacy/explicit XDG_DATA_HOME)")
+];
+function getKnownSandboxProviderIds() {
+  return Object.keys(PROVIDER_MANIFESTS).sort();
+}
+function getProviderFilesystemManifest(providerId) {
+  if (!providerId) return void 0;
+  return PROVIDER_MANIFESTS[providerId.toLowerCase()];
+}
+function getRequiredWritePathsForProvider(providerId, options = {}) {
+  const manifest = getProviderFilesystemManifest(providerId);
+  const providerPaths = resolveRuntimeProviderWritePaths(providerId, manifest, options.env);
+  return [
+    ...providerPaths,
+    ...options.includeSharedPaths === false ? [] : resolveRuntimeSharedWritePaths(options.env)
+  ];
+}
+function getProviderAuthorityWriteDenyPathSpecs(providerId, options = {}) {
+  return collectAuthorityPathSpecs(providerId, options, "deny");
+}
+function getProviderAuthorityWriteReallowPathSpecs(providerId, options = {}) {
+  return collectAuthorityPathSpecs(providerId, options, "reallow");
+}
+var MAX_AUTHORITY_REGISTRY_BYTES = 64 * 1024;
+var MAX_AUTHORITY_REGISTRY_ENTRIES = 256;
+function readAuthorityRegistryTargets(registryPath, home) {
+  let text;
+  try {
+    const stat = fs.lstatSync(registryPath);
+    if (!stat.isFile() || stat.size > MAX_AUTHORITY_REGISTRY_BYTES) return [];
+    text = fs.readFileSync(registryPath, "utf8");
+  } catch {
+    return [];
+  }
+  if (text.includes("\0")) return [];
+  const resolvedHome = home ? path.resolve(home) : void 0;
+  const targets = /* @__PURE__ */ new Set();
+  for (const rawLine of text.split(/\r?\n/).slice(0, MAX_AUTHORITY_REGISTRY_ENTRIES)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#") || !path.isAbsolute(line)) continue;
+    const lexical = path.resolve(line);
+    const real = resolveExistingPathPrefix(lexical);
+    const candidates = real ? [lexical, real] : [lexical];
+    for (const candidate of candidates) {
+      const containsHome = resolvedHome ? isPathWithin(resolvedHome, candidate) : false;
+      if (candidate === path.parse(candidate).root || containsHome) continue;
+      targets.add(candidate);
+    }
+  }
+  return [...targets];
+}
+function collectAuthorityPathSpecs(providerId, options, mode) {
+  const manifests = providerId ? [getProviderFilesystemManifest(providerId)].filter(
+    (manifest) => !!manifest
+  ) : Object.values(PROVIDER_MANIFESTS);
+  const seen = /* @__PURE__ */ new Set();
+  const results = [];
+  for (const manifest of manifests) {
+    const entries = mode === "deny" ? manifest.persistentAuthorityWriteDenyPaths ?? [] : manifest.persistentAuthorityWriteReallowPaths ?? [];
+    const registry = mode === "deny" ? manifest.authorityPathRegistry : void 0;
+    if (!entries.length && !registry) continue;
+    const runtimeRoots = resolveRuntimeProviderWritePaths(
+      manifest.providerId,
+      manifest,
+      options.env
+    );
+    const runtimeRootPaths = new Set(
+      runtimeRoots.flatMap((spec) => isRuntimeOverride(spec) ? [spec.absolutePath] : [])
+    );
+    const stateRoot = manifest.authorityStateRoot && (!providerId || !runtimeRoots.some(isRuntimeOverride)) ? [sub(manifest.authorityStateRoot)] : [];
+    const roots = [
+      ...providerId ? runtimeRoots : [...manifest.requiredWritePaths, ...runtimeRoots],
+      ...stateRoot
+    ];
+    for (const rootSpec of roots) {
+      if (rootSpec.rejected || rootSpec.kind !== "subpath") continue;
+      if (rootSpec.authorityDenyExempt) continue;
+      const isOpencode = manifest.providerId === "opencode";
+      const isOpencodeRuntimeRoot = rootSpec.note?.includes("OpenCode XDG_") === true;
+      if (isOpencodeRuntimeRoot && !rootSpec.note?.includes("XDG_CONFIG_HOME")) continue;
+      const root = resolveWritePathSpec(rootSpec, options.env?.HOME);
+      if (!root) continue;
+      const isRuntimeRoot = isRuntimeOverride(rootSpec) || runtimeRootPaths.has(root);
+      const push = (kind, absolutePath) => {
+        const key = `${kind}:${absolutePath}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        results.push({
+          kind,
+          homeRelative: absolutePath,
+          absolutePath,
+          note: `${manifest.providerId} persistent authority surface`
+        });
+      };
+      for (const entry of entries) {
+        if (entry.staticRootOnly && isRuntimeRoot) continue;
+        const relativePath = isOpencode && !isOpencodeRuntimeRoot ? entry.relativePath.replace(/^opencode\//, "") : entry.relativePath;
+        push(entry.kind, path.join(root, rootSpec.authorityPathPrefix ?? "", relativePath));
+      }
+      if (registry) {
+        const registryPath = path.join(root, rootSpec.authorityPathPrefix ?? "", registry);
+        for (const target of readAuthorityRegistryTargets(registryPath, options.env?.HOME)) {
+          push("subpath", target);
+        }
+      }
+    }
+  }
+  return results;
+}
+function getProviderAuthorityRoots(providerId, options = {}) {
+  const manifests = providerId ? [getProviderFilesystemManifest(providerId)].filter(
+    (manifest) => !!manifest
+  ) : Object.values(PROVIDER_MANIFESTS);
+  const roots = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    if (!manifest.protectAuthorityRoot) continue;
+    const runtimeRoots = resolveRuntimeProviderWritePaths(
+      manifest.providerId,
+      manifest,
+      options.env
+    );
+    for (const spec of providerId ? runtimeRoots : [...manifest.requiredWritePaths, ...runtimeRoots]) {
+      if (spec.rejected || spec.kind !== "subpath" || spec.authorityDenyExempt) continue;
+      const root = resolveWritePathSpec(spec, options.env?.HOME);
+      if (root) roots.add(path.join(root, spec.authorityPathPrefix ?? ""));
+    }
+  }
+  return [...roots];
+}
+function isPathWithin(candidate, parent) {
+  const relative = path.relative(parent, candidate);
+  return relative === "" || !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function allowedRuntimeConfigRoots(env = process.env) {
+  const roots = /* @__PURE__ */ new Set();
+  const home = env?.HOME ?? process.env.HOME ?? os.homedir();
+  if (home) {
+    const resolvedHome = path.resolve(home);
+    const realHome = resolveExistingPathPrefix(resolvedHome);
+    const addHomeRoot = (root) => {
+      const real = resolveExistingPathPrefix(root);
+      if (!real || !realHome) return;
+      if (real === path.parse(real).root || isPathWithin(realHome, real)) return;
+      roots.add(root);
+    };
+    addHomeRoot(path.join(resolvedHome, ".config", "build"));
+    addHomeRoot(path.join(resolvedHome, ".build"));
+    addHomeRoot(path.join(resolvedHome, ".local", "share", "build"));
+    addHomeRoot(path.join(resolvedHome, ".local", "state", "build"));
+    addHomeRoot(path.join(resolvedHome, ".claude"));
+    addHomeRoot(path.join(resolvedHome, ".codex"));
+    addHomeRoot(path.join(resolvedHome, ".grok"));
+    addHomeRoot(path.join(resolvedHome, ".pi"));
+    addHomeRoot(path.join(resolvedHome, ".cursor"));
+  }
+  const containedRuntimeRoot = getContainedHomeSiblingRuntimeRoot(env);
+  if (containedRuntimeRoot) {
+    roots.add(containedRuntimeRoot);
+  }
+  for (const leaf of ["state", "data"]) {
+    const buildHomeLeaf = resolveTrustedBuildHomeLeaf(env, leaf);
+    if (buildHomeLeaf) roots.add(buildHomeLeaf);
+  }
+  roots.add(path.join(path.resolve(process.cwd()), ".build-project"));
+  for (const tmpRoot of [
+    os.tmpdir(),
+    "/tmp",
+    "/private/tmp",
+    "/var/folders",
+    "/private/var/folders"
+  ]) {
+    if (tmpRoot) roots.add(path.resolve(tmpRoot));
+  }
+  return [...roots];
+}
+function resolveTrustedBuildHomeLeaf(env, leaf) {
+  const rawHome = expandLeadingTilde(env?.BUILD_HOME);
+  if (!rawHome) return void 0;
+  const home = env?.HOME ?? process.env.HOME ?? os.homedir();
+  const resolvedHome = resolveTrustedBuildHome(path.resolve(rawHome), env, home);
+  if (!resolvedHome) return void 0;
+  const resolvedLeaf = resolveExistingPathPrefix(path.join(resolvedHome, leaf));
+  return resolvedLeaf && isPathWithin(resolvedLeaf, resolvedHome) ? resolvedLeaf : void 0;
+}
+function withResolvedTarget(lexical) {
+  const real = resolveExistingPathPrefix(lexical);
+  return real && real !== lexical ? [lexical, real] : [lexical];
+}
+function resolveExistingPathPrefix(candidate) {
+  const segments = [];
+  let current = candidate;
+  while (!fs.existsSync(current)) {
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return path.resolve(candidate);
+    }
+    segments.unshift(path.basename(current));
+    current = parent;
+  }
+  try {
+    const realPrefix = fs.realpathSync(current);
+    return path.join(realPrefix, ...segments);
+  } catch {
+    return void 0;
+  }
+}
+function expandLeadingTilde(rawValue) {
+  if (rawValue === void 0) return void 0;
+  const trimmed = rawValue.trim();
+  if (!trimmed) return trimmed;
+  if (trimmed !== "~" && !trimmed.startsWith("~/")) return trimmed;
+  const home = process.env.HOME ?? os.homedir();
+  if (!home) return trimmed;
+  return trimmed === "~" ? home : path.join(home, trimmed.slice(2));
+}
+function resolveAllowedRuntimeConfigDir(rawValue, env) {
+  const trimmed = rawValue?.trim();
+  if (!trimmed) return void 0;
+  const resolved = resolveExistingPathPrefix(path.resolve(trimmed));
+  if (!resolved) return void 0;
+  return isAllowedRuntimeWritePath(resolved, env) ? resolved : void 0;
+}
+function isAllowedRuntimeWritePath(absolutePath, env = process.env) {
+  if (!absolutePath || !path.isAbsolute(absolutePath)) return false;
+  const resolved = resolveExistingPathPrefix(path.resolve(absolutePath));
+  if (!resolved) return false;
+  return allowedRuntimeConfigRoots(env).some((root) => {
+    const resolvedRoot = resolveExistingPathPrefix(root);
+    return resolvedRoot ? isPathWithin(resolved, resolvedRoot) : false;
+  });
+}
+function withCanonicalStateTargets(specs, env) {
+  const home = env?.HOME ?? process.env.HOME ?? os.homedir();
+  if (!home) return specs;
+  let realHome;
+  try {
+    realHome = fs.realpathSync(home);
+  } catch {
+    return specs;
+  }
+  const result = [];
+  for (const spec of specs) {
+    result.push(spec);
+    if (spec.kind === "regex" || spec.rejected || spec.absolutePath) continue;
+    let real;
+    try {
+      real = fs.realpathSync(path.join(home, spec.homeRelative));
+    } catch {
+      continue;
+    }
+    if (real === path.join(realHome, spec.homeRelative)) continue;
+    if (real === path.parse(real).root || isPathWithin(realHome, real)) continue;
+    result.push({
+      ...spec,
+      homeRelative: real,
+      absolutePath: real,
+      note: `${spec.note ?? spec.homeRelative} (symlink target)`,
+      staticAlias: true
+    });
+  }
+  return result;
+}
+function resolveRuntimeProviderWritePaths(providerId, manifest, env) {
+  return withCanonicalStateTargets(
+    resolveRuntimeProviderWritePathsUncanonical(providerId, manifest, env),
+    env
+  );
+}
+function resolveRuntimeProviderWritePathsUncanonical(providerId, manifest, env) {
+  const normalized = providerId?.toLowerCase();
+  const basePaths = manifest?.requiredWritePaths ?? [];
+  if (normalized === "claude") {
+    const configDir = resolveAllowedRuntimeConfigDir(env?.CLAUDE_CONFIG_DIR, env);
+    if (configDir) {
+      return [absoluteSubpath(configDir, "Claude CLI config dir (CLAUDE_CONFIG_DIR)")];
+    }
+    return basePaths;
+  }
+  if (normalized === "cursor") {
+    const configDir = resolveAllowedRuntimeConfigDir(
+      env?.CURSOR_CONFIG_DIR ?? env?.BUILD_CURSOR_CONFIG_DIR,
+      env
+    );
+    if (configDir) {
+      return [
+        absoluteSubpath(configDir, "Cursor CLI config dir (CURSOR_CONFIG_DIR)"),
+        CURSOR_KEYCHAIN_WRITE
+      ];
+    }
+    return basePaths;
+  }
+  if (normalized === "codex") {
+    const rawCodexHome = expandLeadingTilde(env?.CODEX_HOME);
+    if (rawCodexHome) {
+      const configDir = resolveAllowedRuntimeConfigDir(rawCodexHome, env);
+      return [
+        configDir ? absoluteSubpath(configDir, "Codex CLI state (CODEX_HOME)") : rejectedRuntimeDir(
+          path.resolve(rawCodexHome),
+          "Codex CLI state (CODEX_HOME, rejected: outside allowed roots)"
+        )
+      ];
+    }
+    return basePaths;
+  }
+  if (normalized === "grok") {
+    const rawGrokHome = expandLeadingTilde(env?.GROK_HOME);
+    const home = env?.HOME ?? process.env.HOME ?? os.homedir();
+    if (rawGrokHome && path.resolve(rawGrokHome) !== path.join(path.resolve(home), ".grok")) {
+      const configDir = resolveAllowedRuntimeConfigDir(rawGrokHome, env);
+      return [
+        configDir ? absoluteSubpath(configDir, "Grok CLI state (GROK_HOME)") : rejectedRuntimeDir(
+          path.resolve(rawGrokHome),
+          "Grok CLI state (GROK_HOME, rejected: outside allowed roots)"
+        )
+      ];
+    }
+    return basePaths;
+  }
+  if (normalized === "opencode") {
+    const xdgDirs = [
+      { value: env?.XDG_DATA_HOME, note: "OpenCode XDG_DATA_HOME (isolated)" },
+      {
+        value: env?.XDG_CONFIG_HOME,
+        note: "OpenCode XDG_CONFIG_HOME (isolated)"
+      },
+      {
+        value: env?.XDG_STATE_HOME,
+        note: "OpenCode XDG_STATE_HOME (isolated)"
+      },
+      {
+        value: env?.XDG_CACHE_HOME,
+        note: "OpenCode XDG_CACHE_HOME (isolated)"
+      }
+    ];
+    const anyPresent = xdgDirs.some((d) => d.value?.trim());
+    if (!anyPresent) {
+      return basePaths;
+    }
+    const resolvedSpecs = [];
+    for (const { value, note } of xdgDirs) {
+      const trimmed = value?.trim();
+      if (!trimmed) continue;
+      const resolved = resolveAllowedRuntimeConfigDir(trimmed, env);
+      resolvedSpecs.push(
+        resolved ? absoluteSubpath(resolved, note) : rejectedRuntimeDir(path.resolve(trimmed), `${note} (rejected: outside allowed roots)`)
+      );
+    }
+    return resolvedSpecs.length > 0 ? resolvedSpecs : basePaths;
+  }
+  if (normalized === "pi") {
+    const rawAgentDir = expandLeadingTilde(env?.PI_CODING_AGENT_DIR);
+    if (rawAgentDir) {
+      const configDir = resolveAllowedRuntimeConfigDir(rawAgentDir, env);
+      return [
+        configDir ? absoluteSubpath(configDir, "Pi agent dir (PI_CODING_AGENT_DIR)") : rejectedRuntimeDir(
+          path.resolve(rawAgentDir),
+          "Pi agent dir (PI_CODING_AGENT_DIR, rejected: outside allowed roots)"
+        )
+      ];
+    }
+    return basePaths;
+  }
+  return basePaths;
+}
+function resolveRuntimeBuildStatePath(env) {
+  const buildHome = expandLeadingTilde(env.BUILD_HOME);
+  if (buildHome) {
+    const statePath = path.join(buildHome, "state");
+    const resolved = resolveAllowedRuntimeConfigDir(statePath, env);
+    return resolved ? absoluteSubpath(resolved, "Build home state dir (BUILD_HOME/state)") : rejectedRuntimeDir(
+      path.resolve(statePath),
+      "Build home state dir (BUILD_HOME/state, rejected: outside allowed roots)"
+    );
+  }
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome) {
+    const resolved = resolveAllowedRuntimeConfigDir(path.join(xdgStateHome, "build"), env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Build XDG state (XDG_STATE_HOME)");
+    }
+  }
+  return void 0;
+}
+function resolveRuntimeSharedWritePaths(env) {
+  if (!env) return BUILD_SHARED_WRITE_PATHS;
+  const stateDir = resolveRuntimeBuildStatePath(env);
+  const dataDir = resolveRuntimeBuildDataPath(env);
+  const configDir = resolveAllowedRuntimeConfigDir(env.BUILD_CONFIG_DIR, env);
+  if (!stateDir && !dataDir && !configDir) return BUILD_SHARED_WRITE_PATHS;
+  return [
+    stateDir ?? sub(BUILD_HOME_DIR_NAME, "Build home state (default ~/.build/state)"),
+    dataDir ?? sub(BUILD_HOME_DIR_NAME, "Build home data (default ~/.build/data)"),
+    configDir ? absoluteSubpath(configDir, "Build config dir (BUILD_CONFIG_DIR)") : sub(BUILD_HOME_DIR_NAME, "Build home config and runtime dirs")
+  ];
+}
+function getBuildAuthorityWriteDenyPathSpecs(env = process.env) {
+  const specs = [
+    sub(`${BUILD_HOME_DIR_NAME}/config`, "Build executable-selection config (default)")
+  ];
+  const explicitConfigDir = env.BUILD_CONFIG_DIR?.trim();
+  if (explicitConfigDir) {
+    const resolved = resolveAllowedRuntimeConfigDir(explicitConfigDir, env);
+    if (resolved) specs.push(absoluteSubpath(resolved, "Build executable-selection config"));
+  }
+  const buildHome = expandLeadingTilde(env.BUILD_HOME);
+  if (buildHome) {
+    const lexical = path.resolve(buildHome, "config");
+    specs.push(absoluteSubpath(lexical, "Build executable-selection config"));
+    const real = resolveExistingPathPrefix(lexical);
+    if (real && real !== lexical) {
+      specs.push(absoluteSubpath(real, "Build executable-selection config (resolved)"));
+    }
+  }
+  const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
+  if (xdgConfigHome) {
+    const resolved = resolveAllowedRuntimeConfigDir(path.join(xdgConfigHome, "build"), env);
+    if (resolved) specs.push(absoluteSubpath(resolved, "Build executable-selection config"));
+  }
+  specs.push(...getHomeDotEnvWriteDenyPathSpecs(env));
+  return specs;
+}
+function getHomeDotEnvWriteDenyPathSpecs(env) {
+  const homes = /* @__PURE__ */ new Set();
+  for (const home of [env.HOME, process.env.HOME ?? os.homedir()]) {
+    if (home) homes.add(path.resolve(home));
+  }
+  const specs = [];
+  for (const home of homes) {
+    const lexical = path.join(home, ".build", ".env");
+    specs.push(absoluteLiteral(lexical, "Build home dotenv file"));
+    const real = resolveExistingPathPrefix(lexical);
+    if (real && real !== lexical) {
+      specs.push(absoluteLiteral(real, "Build home dotenv file (resolved)"));
+    }
+  }
+  return specs;
+}
+function resolveRuntimeBuildDataPath(env) {
+  const explicitDataDir = env.BUILD_DATA_DIR?.trim();
+  if (explicitDataDir) {
+    const resolved = resolveAllowedRuntimeConfigDir(explicitDataDir, env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Build data dir (BUILD_DATA_DIR)");
+    }
+  }
+  const buildHome = expandLeadingTilde(env.BUILD_HOME);
+  if (buildHome) {
+    const dataPath = path.join(buildHome, "data");
+    const resolved = resolveAllowedRuntimeConfigDir(dataPath, env);
+    return resolved ? absoluteSubpath(resolved, "Build home data dir (BUILD_HOME/data)") : rejectedRuntimeDir(
+      path.resolve(dataPath),
+      "Build home data dir (BUILD_HOME/data, rejected: outside allowed roots)"
+    );
+  }
+  const xdgDataHome = env.XDG_DATA_HOME?.trim();
+  if (xdgDataHome) {
+    const resolved = resolveAllowedRuntimeConfigDir(path.join(xdgDataHome, "build"), env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Build XDG data (XDG_DATA_HOME)");
+    }
+  }
+  return void 0;
+}
+function getAllProviderWritePathSpecs(options = {}) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  const pushUnique = (spec) => {
+    const key = `${spec.kind}:${spec.absolutePath ?? spec.homeRelative}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    result.push(spec);
+  };
+  for (const manifest of Object.values(PROVIDER_MANIFESTS)) {
+    for (const spec of withCanonicalStateTargets(manifest.requiredWritePaths, options.env)) {
+      pushUnique(spec);
+    }
+  }
+  const claudeRuntimeConfigDir = resolveAllowedRuntimeConfigDir(
+    options.env?.CLAUDE_CONFIG_DIR,
+    options.env
+  );
+  if (claudeRuntimeConfigDir) {
+    pushUnique(
+      absoluteSubpath(claudeRuntimeConfigDir, "Claude CLI config dir (CLAUDE_CONFIG_DIR)")
+    );
+  }
+  const cursorRuntimeConfigDir = resolveAllowedRuntimeConfigDir(
+    options.env?.CURSOR_CONFIG_DIR ?? options.env?.BUILD_CURSOR_CONFIG_DIR,
+    options.env
+  );
+  if (cursorRuntimeConfigDir) {
+    pushUnique(
+      absoluteSubpath(cursorRuntimeConfigDir, "Cursor CLI config dir (CURSOR_CONFIG_DIR)")
+    );
+  }
+  for (const spec of resolveRuntimeSharedWritePaths(options.env)) pushUnique(spec);
+  for (const spec of COMMON_TOOLCHAIN_WRITE_PATHS) pushUnique(spec);
+  return result;
+}
+function resolveWritePathSpec(spec, home = process.env.HOME ?? os.homedir()) {
+  if (spec.kind === "regex") return void 0;
+  if (spec.absolutePath) return spec.absolutePath;
+  return `${home}/${spec.homeRelative}`;
+}
+
+export {
+  getKnownSandboxProviderIds,
+  getRequiredWritePathsForProvider,
+  getProviderAuthorityWriteDenyPathSpecs,
+  getProviderAuthorityWriteReallowPathSpecs,
+  getProviderAuthorityRoots,
+  withResolvedTarget,
+  isAllowedRuntimeWritePath,
+  getBuildAuthorityWriteDenyPathSpecs,
+  getAllProviderWritePathSpecs,
+  resolveWritePathSpec
+};
+//# sourceMappingURL=chunk-DP7FKP6W.js.map