@embedder/embedder 1.1.1 → 2.0.6

package/bundle/sandbox-macos-permissive-closed.sb

@@ -1,26 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; deny all inbound network traffic EXCEPT on debugger port
-(deny network-inbound)
-(allow network-inbound (local ip "localhost:9229"))
-
-;; deny all outbound network traffic
-(deny network-outbound)

package/bundle/sandbox-macos-permissive-open.sb

@@ -1,19 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)

package/bundle/sandbox-macos-permissive-proxied.sb

@@ -1,31 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; deny all inbound network traffic EXCEPT on debugger port
-(deny network-inbound)
-(allow network-inbound (local ip "localhost:9229"))
-
-;; deny all outbound network traffic EXCEPT through proxy on localhost:8877
-;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
-;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
-(deny network-outbound)
-(allow network-outbound (remote tcp "localhost:8877"))
-
-(allow network-bind (local ip "*:*"))

package/bundle/sandbox-macos-restrictive-closed.sb

@@ -1,87 +0,0 @@
-(version 1)
-
-;; deny everything by default
-(deny default)
-
-;; allow reading files from anywhere on host
-(allow file-read*)
-
-;; allow exec/fork (children inherit policy)
-(allow process-exec)
-(allow process-fork)
-
-;; allow signals to self, e.g. SIGPIPE on write to closed pipe
-(allow signal (target self))
-
-;; allow read access to specific information about system
-;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
-(allow sysctl-read
-  (sysctl-name "hw.activecpu")
-  (sysctl-name "hw.busfrequency_compat")
-  (sysctl-name "hw.byteorder")
-  (sysctl-name "hw.cacheconfig")
-  (sysctl-name "hw.cachelinesize_compat")
-  (sysctl-name "hw.cpufamily")
-  (sysctl-name "hw.cpufrequency_compat")
-  (sysctl-name "hw.cputype")
-  (sysctl-name "hw.l1dcachesize_compat")
-  (sysctl-name "hw.l1icachesize_compat")
-  (sysctl-name "hw.l2cachesize_compat")
-  (sysctl-name "hw.l3cachesize_compat")
-  (sysctl-name "hw.logicalcpu_max")
-  (sysctl-name "hw.machine")
-  (sysctl-name "hw.ncpu")
-  (sysctl-name "hw.nperflevels")
-  (sysctl-name "hw.optional.arm.FEAT_BF16")
-  (sysctl-name "hw.optional.arm.FEAT_DotProd")
-  (sysctl-name "hw.optional.arm.FEAT_FCMA")
-  (sysctl-name "hw.optional.arm.FEAT_FHM")
-  (sysctl-name "hw.optional.arm.FEAT_FP16")
-  (sysctl-name "hw.optional.arm.FEAT_I8MM")
-  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
-  (sysctl-name "hw.optional.arm.FEAT_LSE")
-  (sysctl-name "hw.optional.arm.FEAT_RDM")
-  (sysctl-name "hw.optional.arm.FEAT_SHA512")
-  (sysctl-name "hw.optional.armv8_2_sha512")
-  (sysctl-name "hw.packages")
-  (sysctl-name "hw.pagesize_compat")
-  (sysctl-name "hw.physicalcpu_max")
-  (sysctl-name "hw.tbfrequency_compat")
-  (sysctl-name "hw.vectorunit")
-  (sysctl-name "kern.hostname")
-  (sysctl-name "kern.maxfilesperproc")
-  (sysctl-name "kern.osproductversion")
-  (sysctl-name "kern.osrelease")
-  (sysctl-name "kern.ostype")
-  (sysctl-name "kern.osvariant_status")
-  (sysctl-name "kern.osversion")
-  (sysctl-name "kern.secure_kernel")
-  (sysctl-name "kern.usrstack64")
-  (sysctl-name "kern.version")
-  (sysctl-name "sysctl.proc_cputype")
-  (sysctl-name-prefix "hw.perflevel")
-)
-
-;; allow writes to specific paths
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; allow communication with sysmond for process listing (e.g. for pgrep)
-(allow mach-lookup (global-name "com.apple.sysmond"))
-
-;; enable terminal access required by ink
-;; fixes setRawMode EPERM failure (at node:tty:81:24)
-(allow file-ioctl (regex #"^/dev/tty.*"))
-
-;; allow inbound network traffic on debugger port
-(allow network-inbound (local ip "localhost:9229"))

package/bundle/sandbox-macos-restrictive-open.sb

@@ -1,90 +0,0 @@
-(version 1)
-
-;; deny everything by default
-(deny default)
-
-;; allow reading files from anywhere on host
-(allow file-read*)
-
-;; allow exec/fork (children inherit policy)
-(allow process-exec)
-(allow process-fork)
-
-;; allow signals to self, e.g. SIGPIPE on write to closed pipe
-(allow signal (target self))
-
-;; allow read access to specific information about system
-;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
-(allow sysctl-read
-  (sysctl-name "hw.activecpu")
-  (sysctl-name "hw.busfrequency_compat")
-  (sysctl-name "hw.byteorder")
-  (sysctl-name "hw.cacheconfig")
-  (sysctl-name "hw.cachelinesize_compat")
-  (sysctl-name "hw.cpufamily")
-  (sysctl-name "hw.cpufrequency_compat")
-  (sysctl-name "hw.cputype")
-  (sysctl-name "hw.l1dcachesize_compat")
-  (sysctl-name "hw.l1icachesize_compat")
-  (sysctl-name "hw.l2cachesize_compat")
-  (sysctl-name "hw.l3cachesize_compat")
-  (sysctl-name "hw.logicalcpu_max")
-  (sysctl-name "hw.machine")
-  (sysctl-name "hw.ncpu")
-  (sysctl-name "hw.nperflevels")
-  (sysctl-name "hw.optional.arm.FEAT_BF16")
-  (sysctl-name "hw.optional.arm.FEAT_DotProd")
-  (sysctl-name "hw.optional.arm.FEAT_FCMA")
-  (sysctl-name "hw.optional.arm.FEAT_FHM")
-  (sysctl-name "hw.optional.arm.FEAT_FP16")
-  (sysctl-name "hw.optional.arm.FEAT_I8MM")
-  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
-  (sysctl-name "hw.optional.arm.FEAT_LSE")
-  (sysctl-name "hw.optional.arm.FEAT_RDM")
-  (sysctl-name "hw.optional.arm.FEAT_SHA512")
-  (sysctl-name "hw.optional.armv8_2_sha512")
-  (sysctl-name "hw.packages")
-  (sysctl-name "hw.pagesize_compat")
-  (sysctl-name "hw.physicalcpu_max")
-  (sysctl-name "hw.tbfrequency_compat")
-  (sysctl-name "hw.vectorunit")
-  (sysctl-name "kern.hostname")
-  (sysctl-name "kern.maxfilesperproc")
-  (sysctl-name "kern.osproductversion")
-  (sysctl-name "kern.osrelease")
-  (sysctl-name "kern.ostype")
-  (sysctl-name "kern.osvariant_status")
-  (sysctl-name "kern.osversion")
-  (sysctl-name "kern.secure_kernel")
-  (sysctl-name "kern.usrstack64")
-  (sysctl-name "kern.version")
-  (sysctl-name "sysctl.proc_cputype")
-  (sysctl-name-prefix "hw.perflevel")
-)
-
-;; allow writes to specific paths
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; allow communication with sysmond for process listing (e.g. for pgrep)
-(allow mach-lookup (global-name "com.apple.sysmond"))
-
-;; enable terminal access required by ink
-;; fixes setRawMode EPERM failure (at node:tty:81:24)
-(allow file-ioctl (regex #"^/dev/tty.*"))
-
-;; allow inbound network traffic on debugger port
-(allow network-inbound (local ip "localhost:9229"))
-
-;; allow all outbound network traffic
-(allow network-outbound)

package/bundle/sandbox-macos-restrictive-proxied.sb

@@ -1,92 +0,0 @@
-(version 1)
-
-;; deny everything by default
-(deny default)
-
-;; allow reading files from anywhere on host
-(allow file-read*)
-
-;; allow exec/fork (children inherit policy)
-(allow process-exec)
-(allow process-fork)
-
-;; allow signals to self, e.g. SIGPIPE on write to closed pipe
-(allow signal (target self))
-
-;; allow read access to specific information about system
-;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
-(allow sysctl-read
-  (sysctl-name "hw.activecpu")
-  (sysctl-name "hw.busfrequency_compat")
-  (sysctl-name "hw.byteorder")
-  (sysctl-name "hw.cacheconfig")
-  (sysctl-name "hw.cachelinesize_compat")
-  (sysctl-name "hw.cpufamily")
-  (sysctl-name "hw.cpufrequency_compat")
-  (sysctl-name "hw.cputype")
-  (sysctl-name "hw.l1dcachesize_compat")
-  (sysctl-name "hw.l1icachesize_compat")
-  (sysctl-name "hw.l2cachesize_compat")
-  (sysctl-name "hw.l3cachesize_compat")
-  (sysctl-name "hw.logicalcpu_max")
-  (sysctl-name "hw.machine")
-  (sysctl-name "hw.ncpu")
-  (sysctl-name "hw.nperflevels")
-  (sysctl-name "hw.optional.arm.FEAT_BF16")
-  (sysctl-name "hw.optional.arm.FEAT_DotProd")
-  (sysctl-name "hw.optional.arm.FEAT_FCMA")
-  (sysctl-name "hw.optional.arm.FEAT_FHM")
-  (sysctl-name "hw.optional.arm.FEAT_FP16")
-  (sysctl-name "hw.optional.arm.FEAT_I8MM")
-  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
-  (sysctl-name "hw.optional.arm.FEAT_LSE")
-  (sysctl-name "hw.optional.arm.FEAT_RDM")
-  (sysctl-name "hw.optional.arm.FEAT_SHA512")
-  (sysctl-name "hw.optional.armv8_2_sha512")
-  (sysctl-name "hw.packages")
-  (sysctl-name "hw.pagesize_compat")
-  (sysctl-name "hw.physicalcpu_max")
-  (sysctl-name "hw.tbfrequency_compat")
-  (sysctl-name "hw.vectorunit")
-  (sysctl-name "kern.hostname")
-  (sysctl-name "kern.maxfilesperproc")
-  (sysctl-name "kern.osproductversion")
-  (sysctl-name "kern.osrelease")
-  (sysctl-name "kern.ostype")
-  (sysctl-name "kern.osvariant_status")
-  (sysctl-name "kern.osversion")
-  (sysctl-name "kern.secure_kernel")
-  (sysctl-name "kern.usrstack64")
-  (sysctl-name "kern.version")
-  (sysctl-name "sysctl.proc_cputype")
-  (sysctl-name-prefix "hw.perflevel")
-)
-
-;; allow writes to specific paths
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.embedder"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; allow communication with sysmond for process listing (e.g. for pgrep)
-(allow mach-lookup (global-name "com.apple.sysmond"))
-
-;; enable terminal access required by ink
-;; fixes setRawMode EPERM failure (at node:tty:81:24)
-(allow file-ioctl (regex #"^/dev/tty.*"))
-
-;; allow inbound network traffic on debugger port
-(allow network-inbound (local ip "localhost:9229"))
-
-;; allow outbound network traffic through proxy on localhost:8877
-;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
-;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
-(allow network-outbound (remote tcp "localhost:8877"))

package/postinstall.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-/**
- * Cross-platform postinstall runner.
- * Prefers bundle/postinstall-for-users.js when present (tarball installs),
- * falls back to scripts/postinstall-for-users.js for source installs.
- */
-
-import { spawnSync } from 'child_process';
-import { existsSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const candidates = [
-  join(__dirname, 'bundle', 'postinstall-for-users.js'),
-  join(__dirname, 'scripts', 'postinstall-for-users.js'),
-];
-
-const target = candidates.find((p) => existsSync(p));
-
-if (!target) {
-  console.log('No postinstall script found. Skipping.');
-  process.exit(0);
-}
-
-const result = spawnSync(process.execPath, [target], {
-  stdio: 'inherit',
-  shell: false,
-  windowsHide: true,
-});
-
-if (result.error) {
-  console.error('Failed to run postinstall script:', result.error.message);
-  if (process.env.FAIL_ON_PYTHON_ERROR === 'true') {
-    process.exit(1);
-  }
-  process.exit(0);
-}
-
-process.exit(typeof result.status === 'number' ? result.status : 0);