@evalops/maestro 0.10.17 → 0.10.20

package/dist/safety/suspicious-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"suspicious-patterns.js","sourceRoot":"","sources":["../../src/safety/suspicious-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE9E;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,kCAAkC;YAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CACpE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0DAA0D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChH,eAAe,EAAE,cAAc;iBAC/B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,aAAa;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,+BAA+B;YAC/B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,gDAAgD,aAAa,CAAC,MAAM,GAAG,CAAC,UAAU;oBAC1F,eAAe,EAAE,aAAa;iBAC9B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAE7C,kDAAkD;YAClD,MAAM,WAAW,GAAG;gBACnB,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,aAAa;gBACb,mBAAmB;aACnB,CAAC;YAEF,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,IAAI;gBACnC,WAAW,CAAC,SAAS;gBACrB,WAAW,CAAC,MAAM,CAAuB,CAAC;YAE3C,IACC,UAAU;gBACV,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvD,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAClD,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,yCAAyC,UAAU,EAAE;iBAC7D,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,yCAAyC;YACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CACrE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,IACC,qBAAqB,CAAC,WAAW,CAAC;gBAClC,kBAAkB,CAAC,MAAM,IAAI,CAAC,EAC7B,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,oCAAoC,kBAAkB,CAAC,MAAM,GAAG,CAAC,2BAA2B;oBACpG,eAAe,EAAE,kBAAkB;iBACnC,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,SAAS,GACd,cAAc,KAAK,MAAM;gBACzB,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;gBACvC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,iDAAiD;YACjD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,MAAM;oBAAE,OAAO,KAAK,CAAC;gBAEjC,0CAA0C;gBAC1C,MAAM,GAAG,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBAC7C,OAAO,CACN,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBAC5D,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CACpD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD;iBAC9D,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,aAAa;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,kCAAkC,aAAa,CAAC,MAAM,GAAG,CAAC,UAAU;oBAC5E,eAAe,EAAE,aAAa;iBAC9B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,oCAAoC;YACpC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACnE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,MAAM,OAAO,GAAI,WAAW,CAAC,OAAkB,IAAI,EAAE,CAAC;YACtD,MAAM,kBAAkB,GAAG;gBAC1B,cAAc;gBACd,cAAc;gBACd,cAAc;gBACd,YAAY;gBACZ,eAAe;gBACf,aAAa;aACb,CAAC;YAEF,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEzE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;gBACpD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD;oBAC9D,eAAe,EAAE,eAAe;iBAChC,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,4CAA4C;YAC5C,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,IAAI;gBACnC,WAAW,CAAC,SAAS;gBACrB,WAAW,CAAC,MAAM,CAAuB,CAAC;YAC3C,MAAM,YAAY,GAAG;gBACpB,SAAS;gBACT,cAAc;gBACd,UAAU;gBACV,QAAQ;gBACR,UAAU;gBACV,SAAS;aACT,CAAC;YACF,MAAM,aAAa,GAClB,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAE5D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0BAA0B,WAAW,CAAC,MAAM,+BAA+B,UAAU,EAAE;oBAC/F,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,8BAA8B;QAClC,WAAW,EAAE,0DAA0D;QACvE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,OAAO,GAAI,WAAW,CAAC,OAAkB,IAAI,EAAE,CAAC;YACtD,MAAM,kBAAkB,GAAG;gBAC1B,QAAQ;gBACR,yBAAyB,EAAE,yBAAyB;gBACpD,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,UAAU;gBACV,SAAS;aACT,CAAC;YAEF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,0CAA0C;YAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,MAAM;oBAAE,OAAO,KAAK,CAAC;gBAEjC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC;gBACxE,MAAM,cAAc,GAAG;oBACtB,SAAS;oBACT,SAAS;oBACT,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,cAAc;iBACd,CAAC;gBACF,OAAO,CACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;oBAClB,OAAO;oBACP,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC3C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;oBACpF,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6DAA6D;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAEhC,kCAAkC;gBAClC,MAAM,OAAO,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG;oBACnB,aAAa,EAAE,wBAAwB;oBACvC,OAAO,EAAE,cAAc;oBACvB,UAAU,EAAE,mBAAmB;oBAC/B,UAAU,EAAE,2BAA2B;oBACvC,cAAc,EAAE,qBAAqB;oBACrC,aAAa,EAAE,oBAAoB;oBACnC,OAAO,EAAE,kBAAkB;iBAC3B,CAAC;gBAEF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC;gBACxE,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEnD,OAAO,CACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;oBACvB,SAAS;oBACT,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACxC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,2DAA2D;oBACnE,eAAe,EAAE,SAAS;iBAC1B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,YAAY,GACjB,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7B,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEjC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,MAAM,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,gDAAgD;YAChD,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,WAAW,GAAG,KAAK,CAAC;YAExB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,MAAM,GACX,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAEvC,IAAI,MAAM,EAAE,CAAC;oBACZ,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC,WAAW,IAAI,SAAS,GAAG,CAAC;wBAAE,YAAY,EAAE,CAAC;oBAClD,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBACnB,SAAS,EAAE,CAAC;oBACZ,WAAW,GAAG,KAAK,CAAC;gBACrB,CAAC;YACF,CAAC;YAED,IAAI,YAAY,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,mCAAmC,SAAS,cAAc,SAAS,WAAW,YAAY,eAAe;iBACjH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6BAA6B;YAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,SAAS,GAAG,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,oCAAoC,UAAU,CAAC,MAAM,GAAG,CAAC,6BAA6B;oBAC9F,eAAe,EAAE,UAAU;iBAC3B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC","sourcesContent":["/**\n * Suspicious sequence patterns for the tool sequence analyzer\n *\n * Contains the pattern definitions that detect potentially malicious\n * tool call sequences.\n *\n * @module safety/suspicious-patterns\n */\n\nimport type { SequencePattern } from \"./sequence-analyzer-types.js\";\nimport { containsSensitivePath, getToolTags } from \"./tool-categorization.js\";\n\n/**\n * Suspicious sequence patterns\n */\nexport const SUSPICIOUS_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"read-then-egress\",\n\t\tdescription: \"Sensitive file read followed by network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"egress\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent sensitive reads\n\t\t\tconst sensitiveReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 60000 && r.tags.has(\"read\") && containsSensitivePath(r.args)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (sensitiveReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Network egress detected after reading sensitive files: ${sensitiveReads.map((r) => r.tool).join(\", \")}`,\n\t\t\t\t\tmatchingRecords: sensitiveReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"rapid-auth-failures\",\n\t\tdescription: \"Multiple authentication attempts in short time\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 30000, // 30 seconds\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"auth\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count recent auth operations\n\t\t\tconst recentAuthOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 30000 && r.tags.has(\"auth\");\n\t\t\t});\n\n\t\t\tif (recentAuthOps.length >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Multiple authentication operations detected (${recentAuthOps.length + 1} in 30s)`,\n\t\t\t\t\tmatchingRecords: recentAuthOps,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"system-path-escalation\",\n\t\tdescription: \"Normal operations followed by system path modifications\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\n\t\t\t// Check if current operation targets system paths\n\t\t\tconst systemPaths = [\n\t\t\t\t\"/etc/\",\n\t\t\t\t\"/usr/\",\n\t\t\t\t\"/var/\",\n\t\t\t\t\"/boot/\",\n\t\t\t\t\"/sys/\",\n\t\t\t\t\"/proc/\",\n\t\t\t\t\"/dev/\",\n\t\t\t\t\"C:\\\\Windows\",\n\t\t\t\t\"C:\\\\Program Files\",\n\t\t\t];\n\n\t\t\tconst targetPath = (currentArgs.path ||\n\t\t\t\tcurrentArgs.file_path ||\n\t\t\t\tcurrentArgs.target) as string | undefined;\n\n\t\t\tif (\n\t\t\t\ttargetPath &&\n\t\t\t\t(currentTags.has(\"write\") || currentTags.has(\"delete\")) &&\n\t\t\t\tsystemPaths.some((sp) => targetPath.startsWith(sp))\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Modification of system path detected: ${targetPath}`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"reconnaissance-pattern\",\n\t\tdescription: \"Systematic reading of configuration/credential files\",\n\t\tseverity: \"medium\",\n\t\taction: \"log\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"read\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count reads to sensitive-looking paths\n\t\t\tconst sensitivePathReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 120000 && r.tags.has(\"read\") && containsSensitivePath(r.args)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\t// If current read is also to sensitive path and we have many recent ones\n\t\t\tif (\n\t\t\t\tcontainsSensitivePath(currentArgs) &&\n\t\t\t\tsensitivePathReads.length >= 3\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Reconnaissance pattern detected: ${sensitivePathReads.length + 1} reads of sensitive paths`,\n\t\t\t\t\tmatchingRecords: sensitivePathReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"git-push-without-review\",\n\t\tdescription: \"Git push without apparent review or testing\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 300000, // 5 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tconst isGitPush =\n\t\t\t\tnormalizedTool === \"bash\" &&\n\t\t\t\ttypeof currentArgs.command === \"string\" &&\n\t\t\t\t/git\\s+push/.test(currentArgs.command);\n\n\t\t\tif (!isGitPush) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent test runs or review operations\n\t\t\tconst recentTests = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 300000) return false;\n\n\t\t\t\t// Check if it looks like a test or review\n\t\t\t\tconst cmd = (r.args.command as string) || \"\";\n\t\t\t\treturn (\n\t\t\t\t\t/test|spec|lint|check|review|verify/.test(cmd.toLowerCase()) ||\n\t\t\t\t\t/npm\\s+test|bun\\s+test|pytest|jest|vitest/.test(cmd)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (recentTests.length === 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Git push detected without apparent testing or review\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"rapid-file-deletions\",\n\t\tdescription: \"Multiple file deletions in rapid succession\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 30000, // 30 seconds\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"delete\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst recentDeletes = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 30000 && r.tags.has(\"delete\");\n\t\t\t});\n\n\t\t\tif (recentDeletes.length >= 5) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Rapid file deletions detected (${recentDeletes.length + 1} in 30s)`,\n\t\t\t\t\tmatchingRecords: recentDeletes,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exec-after-download\",\n\t\tdescription: \"Execution shortly after downloading content\",\n\t\tseverity: \"critical\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"exec\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent downloads/fetches\n\t\t\tconst recentDownloads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 60000 && (r.tags.has(\"egress\") || r.tool.includes(\"fetch\"))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\t// Check if current command might be executing downloaded content\n\t\t\tconst command = (currentArgs.command as string) || \"\";\n\t\t\tconst suspiciousPatterns = [\n\t\t\t\t/curl.*\\|.*sh/,\n\t\t\t\t/wget.*\\|.*sh/,\n\t\t\t\t/bash\\s+\\/tmp/,\n\t\t\t\t/sh\\s+\\/tmp/,\n\t\t\t\t/python.*\\/tmp/,\n\t\t\t\t/node.*\\/tmp/,\n\t\t\t];\n\n\t\t\tconst isSuspiciousExec = suspiciousPatterns.some((p) => p.test(command));\n\n\t\t\tif (recentDownloads.length > 0 && isSuspiciousExec) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Execution of potentially downloaded content detected\",\n\t\t\t\t\tmatchingRecords: recentDownloads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"data-staging\",\n\t\tdescription: \"Multiple file reads followed by write to temporary location\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"write\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Check if writing to temp/staging location\n\t\t\tconst targetPath = (currentArgs.path ||\n\t\t\t\tcurrentArgs.file_path ||\n\t\t\t\tcurrentArgs.target) as string | undefined;\n\t\t\tconst tempPatterns = [\n\t\t\t\t/\\/tmp\\//,\n\t\t\t\t/\\/var\\/tmp\\//,\n\t\t\t\t/\\/temp\\//,\n\t\t\t\t/\\.tmp$/,\n\t\t\t\t/staging/i,\n\t\t\t\t/upload/i,\n\t\t\t];\n\t\t\tconst isWriteToTemp =\n\t\t\t\ttargetPath && tempPatterns.some((p) => p.test(targetPath));\n\n\t\t\tif (!isWriteToTemp) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for multiple recent reads\n\t\t\tconst recentReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 120000 && r.tags.has(\"read\");\n\t\t\t});\n\n\t\t\tif (recentReads.length >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Data staging detected: ${recentReads.length} reads followed by write to ${targetPath}`,\n\t\t\t\t\tmatchingRecords: recentReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privilege-escalation-attempt\",\n\t\tdescription: \"Privilege escalation command after reading configuration\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (normalizedTool !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst command = (currentArgs.command as string) || \"\";\n\t\t\tconst escalationPatterns = [\n\t\t\t\t/sudo\\s/,\n\t\t\t\t/chmod\\s+[0-7]*[7][0-7]*/, // chmod with execute bit\n\t\t\t\t/chown\\s/,\n\t\t\t\t/chgrp\\s/,\n\t\t\t\t/setuid/,\n\t\t\t\t/setgid/,\n\t\t\t\t/visudo/,\n\t\t\t\t/passwd/,\n\t\t\t\t/usermod/,\n\t\t\t\t/groupadd/,\n\t\t\t\t/useradd/,\n\t\t\t];\n\n\t\t\tconst isEscalationCommand = escalationPatterns.some((p) =>\n\t\t\t\tp.test(command),\n\t\t\t);\n\n\t\t\tif (!isEscalationCommand) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent config/credential reads\n\t\t\tconst configReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120000) return false;\n\n\t\t\t\tconst pathArg = (r.args.path || r.args.file_path) as string | undefined;\n\t\t\t\tconst configPatterns = [\n\t\t\t\t\t/\\/etc\\//,\n\t\t\t\t\t/\\.conf$/,\n\t\t\t\t\t/\\.cfg$/,\n\t\t\t\t\t/config/i,\n\t\t\t\t\t/\\.env/,\n\t\t\t\t\t/credentials/i,\n\t\t\t\t];\n\t\t\t\treturn (\n\t\t\t\t\tr.tags.has(\"read\") &&\n\t\t\t\t\tpathArg &&\n\t\t\t\t\tconfigPatterns.some((p) => p.test(pathArg))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (configReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Privilege escalation attempt after reading config: ${command.slice(0, 50)}`,\n\t\t\t\t\tmatchingRecords: configReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"env-exfiltration\",\n\t\tdescription: \"Environment variable access followed by network call\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"egress\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent env reads or commands that access env vars\n\t\t\tconst envAccess = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 60000) return false;\n\n\t\t\t\t// Check if command reads env vars\n\t\t\t\tconst command = (r.args.command as string) || \"\";\n\t\t\t\tconst envPatterns = [\n\t\t\t\t\t/\\$\\{?\\w+\\}?/, // Shell variable access\n\t\t\t\t\t/env\\s/, // env command\n\t\t\t\t\t/printenv/, // printenv command\n\t\t\t\t\t/export\\s/, // export (might show vars)\n\t\t\t\t\t/process\\.env/, // Node.js env access\n\t\t\t\t\t/os\\.environ/, // Python env access\n\t\t\t\t\t/ENV\\[/, // Ruby env access\n\t\t\t\t];\n\n\t\t\t\tconst pathArg = (r.args.path || r.args.file_path) as string | undefined;\n\t\t\t\tconst isEnvFile = pathArg && /\\.env/.test(pathArg);\n\n\t\t\t\treturn (\n\t\t\t\t\tr.tags.has(\"sensitive\") ||\n\t\t\t\t\tisEnvFile ||\n\t\t\t\t\tenvPatterns.some((p) => p.test(command))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (envAccess.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Network egress detected after environment variable access\",\n\t\t\t\t\tmatchingRecords: envAccess,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"systematic-exploration\",\n\t\tdescription: \"Systematic directory listing and reading pattern\",\n\t\tseverity: \"medium\",\n\t\taction: \"log\",\n\t\twindowMs: 180000, // 3 minutes\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tconst isListOrRead =\n\t\t\t\tnormalizedTool.includes(\"glob\") ||\n\t\t\t\tnormalizedTool.includes(\"ls\") ||\n\t\t\t\tnormalizedTool.includes(\"read\") ||\n\t\t\t\tnormalizedTool.includes(\"list\");\n\n\t\t\tif (!isListOrRead) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count alternating list/read operations\n\t\t\tconst recentOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 180000;\n\t\t\t});\n\n\t\t\t// Look for list -> read -> list -> read pattern\n\t\t\tlet listCount = 0;\n\t\t\tlet readCount = 0;\n\t\t\tlet alternations = 0;\n\t\t\tlet lastWasRead = false;\n\n\t\t\tfor (const r of recentOps) {\n\t\t\t\tconst isRead = r.tags.has(\"read\");\n\t\t\t\tconst isList =\n\t\t\t\t\tr.tool.toLowerCase().includes(\"glob\") ||\n\t\t\t\t\tr.tool.toLowerCase().includes(\"ls\") ||\n\t\t\t\t\tr.tool.toLowerCase().includes(\"list\");\n\n\t\t\t\tif (isRead) {\n\t\t\t\t\treadCount++;\n\t\t\t\t\tif (!lastWasRead && listCount > 0) alternations++;\n\t\t\t\t\tlastWasRead = true;\n\t\t\t\t} else if (isList) {\n\t\t\t\t\tlistCount++;\n\t\t\t\t\tlastWasRead = false;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (alternations >= 3 && listCount >= 2 && readCount >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Systematic exploration pattern: ${listCount} listings, ${readCount} reads, ${alternations} alternations`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"mass-modification\",\n\t\tdescription: \"Large number of file modifications in short period\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"write\") && !currentTags.has(\"edit\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count recent modifications\n\t\t\tconst recentMods = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 60000 && (r.tags.has(\"write\") || r.tags.has(\"edit\"));\n\t\t\t});\n\n\t\t\t// Different thresholds for edit vs write\n\t\t\tconst threshold = 10;\n\t\t\tif (recentMods.length >= threshold) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Mass file modification detected (${recentMods.length + 1} modifications in 1 minute)`,\n\t\t\t\t\tmatchingRecords: recentMods,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n"]}
+{"version":3,"file":"suspicious-patterns.js","sourceRoot":"","sources":["../../src/safety/suspicious-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE9E;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,kCAAkC;YAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CACpE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0DAA0D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChH,eAAe,EAAE,cAAc;iBAC/B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,aAAa;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,+BAA+B;YAC/B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,gDAAgD,aAAa,CAAC,MAAM,GAAG,CAAC,UAAU;oBAC1F,eAAe,EAAE,aAAa;iBAC9B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAE7C,kDAAkD;YAClD,MAAM,WAAW,GAAG;gBACnB,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,aAAa;gBACb,mBAAmB;aACnB,CAAC;YAEF,MAAM,WAAW,GAChB,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa;gBAC3C,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ;gBACpC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzC,CAAC,CAAC;oBACA,CAAC,WAAW,CAAC,IAAI;wBAChB,WAAW,CAAC,SAAS;wBACrB,WAAW,CAAC,MAAM,CAAuB;iBAC1C,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;YAEhE,IACC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvD,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC/B,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CACnD,EACA,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,yCAAyC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACzE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,yCAAyC;YACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CACrE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,IACC,qBAAqB,CAAC,WAAW,CAAC;gBAClC,kBAAkB,CAAC,MAAM,IAAI,CAAC,EAC7B,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,oCAAoC,kBAAkB,CAAC,MAAM,GAAG,CAAC,2BAA2B;oBACpG,eAAe,EAAE,kBAAkB;iBACnC,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,SAAS,GACd,cAAc,KAAK,MAAM;gBACzB,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;gBACvC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,iDAAiD;YACjD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,MAAM;oBAAE,OAAO,KAAK,CAAC;gBAEjC,0CAA0C;gBAC1C,MAAM,GAAG,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBAC7C,OAAO,CACN,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBAC5D,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CACpD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD;iBAC9D,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,aAAa;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,kCAAkC,aAAa,CAAC,MAAM,GAAG,CAAC,UAAU;oBAC5E,eAAe,EAAE,aAAa;iBAC9B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,oCAAoC;YACpC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,CACN,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACnE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,MAAM,OAAO,GAAI,WAAW,CAAC,OAAkB,IAAI,EAAE,CAAC;YACtD,MAAM,kBAAkB,GAAG;gBAC1B,cAAc;gBACd,cAAc;gBACd,cAAc;gBACd,YAAY;gBACZ,eAAe;gBACf,aAAa;aACb,CAAC;YAEF,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEzE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;gBACpD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD;oBAC9D,eAAe,EAAE,eAAe;iBAChC,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,4CAA4C;YAC5C,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,IAAI;gBACnC,WAAW,CAAC,SAAS;gBACrB,WAAW,CAAC,MAAM,CAAuB,CAAC;YAC3C,MAAM,YAAY,GAAG;gBACpB,SAAS;gBACT,cAAc;gBACd,UAAU;gBACV,QAAQ;gBACR,UAAU;gBACV,SAAS;aACT,CAAC;YACF,MAAM,aAAa,GAClB,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAE5D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0BAA0B,WAAW,CAAC,MAAM,+BAA+B,UAAU,EAAE;oBAC/F,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,8BAA8B;QAClC,WAAW,EAAE,0DAA0D;QACvE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,OAAO,GAAI,WAAW,CAAC,OAAkB,IAAI,EAAE,CAAC;YACtD,MAAM,kBAAkB,GAAG;gBAC1B,QAAQ;gBACR,yBAAyB,EAAE,yBAAyB;gBACpD,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,UAAU;gBACV,SAAS;aACT,CAAC;YAEF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,0CAA0C;YAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,MAAM;oBAAE,OAAO,KAAK,CAAC;gBAEjC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC;gBACxE,MAAM,cAAc,GAAG;oBACtB,SAAS;oBACT,SAAS;oBACT,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,cAAc;iBACd,CAAC;gBACF,OAAO,CACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;oBAClB,OAAO;oBACP,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC3C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,sDAAsD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;oBACpF,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6DAA6D;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAEhC,kCAAkC;gBAClC,MAAM,OAAO,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG;oBACnB,aAAa,EAAE,wBAAwB;oBACvC,OAAO,EAAE,cAAc;oBACvB,UAAU,EAAE,mBAAmB;oBAC/B,UAAU,EAAE,2BAA2B;oBACvC,cAAc,EAAE,qBAAqB;oBACrC,aAAa,EAAE,oBAAoB;oBACnC,OAAO,EAAE,kBAAkB;iBAC3B,CAAC;gBAEF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC;gBACxE,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEnD,OAAO,CACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;oBACvB,SAAS;oBACT,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACxC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,2DAA2D;oBACnE,eAAe,EAAE,SAAS;iBAC1B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM,EAAE,YAAY;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,YAAY,GACjB,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7B,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEjC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,MAAM,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,gDAAgD;YAChD,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,WAAW,GAAG,KAAK,CAAC;YAExB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,MAAM,GACX,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAEvC,IAAI,MAAM,EAAE,CAAC;oBACZ,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC,WAAW,IAAI,SAAS,GAAG,CAAC;wBAAE,YAAY,EAAE,CAAC;oBAClD,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBACnB,SAAS,EAAE,CAAC;oBACZ,WAAW,GAAG,KAAK,CAAC;gBACrB,CAAC;YACF,CAAC;YAED,IAAI,YAAY,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,mCAAmC,SAAS,cAAc,SAAS,WAAW,YAAY,eAAe;iBACjH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6BAA6B;YAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,SAAS,GAAG,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,oCAAoC,UAAU,CAAC,MAAM,GAAG,CAAC,6BAA6B;oBAC9F,eAAe,EAAE,UAAU;iBAC3B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC","sourcesContent":["/**\n * Suspicious sequence patterns for the tool sequence analyzer\n *\n * Contains the pattern definitions that detect potentially malicious\n * tool call sequences.\n *\n * @module safety/suspicious-patterns\n */\n\nimport { parseApplyPatchPaths } from \"../tools/apply-patch-parser.js\";\nimport type { SequencePattern } from \"./sequence-analyzer-types.js\";\nimport { containsSensitivePath, getToolTags } from \"./tool-categorization.js\";\n\n/**\n * Suspicious sequence patterns\n */\nexport const SUSPICIOUS_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"read-then-egress\",\n\t\tdescription: \"Sensitive file read followed by network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"egress\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent sensitive reads\n\t\t\tconst sensitiveReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 60000 && r.tags.has(\"read\") && containsSensitivePath(r.args)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (sensitiveReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Network egress detected after reading sensitive files: ${sensitiveReads.map((r) => r.tool).join(\", \")}`,\n\t\t\t\t\tmatchingRecords: sensitiveReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"rapid-auth-failures\",\n\t\tdescription: \"Multiple authentication attempts in short time\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 30000, // 30 seconds\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"auth\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count recent auth operations\n\t\t\tconst recentAuthOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 30000 && r.tags.has(\"auth\");\n\t\t\t});\n\n\t\t\tif (recentAuthOps.length >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Multiple authentication operations detected (${recentAuthOps.length + 1} in 30s)`,\n\t\t\t\t\tmatchingRecords: recentAuthOps,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"system-path-escalation\",\n\t\tdescription: \"Normal operations followed by system path modifications\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\n\t\t\t// Check if current operation targets system paths\n\t\t\tconst systemPaths = [\n\t\t\t\t\"/etc/\",\n\t\t\t\t\"/usr/\",\n\t\t\t\t\"/var/\",\n\t\t\t\t\"/boot/\",\n\t\t\t\t\"/sys/\",\n\t\t\t\t\"/proc/\",\n\t\t\t\t\"/dev/\",\n\t\t\t\t\"C:\\\\Windows\",\n\t\t\t\t\"C:\\\\Program Files\",\n\t\t\t];\n\n\t\t\tconst targetPaths =\n\t\t\t\tcurrentTool.toLowerCase() === \"apply_patch\" &&\n\t\t\t\ttypeof currentArgs.patch === \"string\"\n\t\t\t\t\t? parseApplyPatchPaths(currentArgs.patch)\n\t\t\t\t\t: [\n\t\t\t\t\t\t\t(currentArgs.path ||\n\t\t\t\t\t\t\t\tcurrentArgs.file_path ||\n\t\t\t\t\t\t\t\tcurrentArgs.target) as string | undefined,\n\t\t\t\t\t\t].filter((path): path is string => typeof path === \"string\");\n\n\t\t\tif (\n\t\t\t\t(currentTags.has(\"write\") || currentTags.has(\"delete\")) &&\n\t\t\t\ttargetPaths.some((targetPath) =>\n\t\t\t\t\tsystemPaths.some((sp) => targetPath.startsWith(sp)),\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Modification of system path detected: ${targetPaths.join(\", \")}`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"reconnaissance-pattern\",\n\t\tdescription: \"Systematic reading of configuration/credential files\",\n\t\tseverity: \"medium\",\n\t\taction: \"log\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"read\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count reads to sensitive-looking paths\n\t\t\tconst sensitivePathReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 120000 && r.tags.has(\"read\") && containsSensitivePath(r.args)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\t// If current read is also to sensitive path and we have many recent ones\n\t\t\tif (\n\t\t\t\tcontainsSensitivePath(currentArgs) &&\n\t\t\t\tsensitivePathReads.length >= 3\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Reconnaissance pattern detected: ${sensitivePathReads.length + 1} reads of sensitive paths`,\n\t\t\t\t\tmatchingRecords: sensitivePathReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"git-push-without-review\",\n\t\tdescription: \"Git push without apparent review or testing\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 300000, // 5 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tconst isGitPush =\n\t\t\t\tnormalizedTool === \"bash\" &&\n\t\t\t\ttypeof currentArgs.command === \"string\" &&\n\t\t\t\t/git\\s+push/.test(currentArgs.command);\n\n\t\t\tif (!isGitPush) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent test runs or review operations\n\t\t\tconst recentTests = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 300000) return false;\n\n\t\t\t\t// Check if it looks like a test or review\n\t\t\t\tconst cmd = (r.args.command as string) || \"\";\n\t\t\t\treturn (\n\t\t\t\t\t/test|spec|lint|check|review|verify/.test(cmd.toLowerCase()) ||\n\t\t\t\t\t/npm\\s+test|bun\\s+test|pytest|jest|vitest/.test(cmd)\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (recentTests.length === 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Git push detected without apparent testing or review\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"rapid-file-deletions\",\n\t\tdescription: \"Multiple file deletions in rapid succession\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 30000, // 30 seconds\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"delete\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst recentDeletes = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 30000 && r.tags.has(\"delete\");\n\t\t\t});\n\n\t\t\tif (recentDeletes.length >= 5) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Rapid file deletions detected (${recentDeletes.length + 1} in 30s)`,\n\t\t\t\t\tmatchingRecords: recentDeletes,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exec-after-download\",\n\t\tdescription: \"Execution shortly after downloading content\",\n\t\tseverity: \"critical\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"exec\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent downloads/fetches\n\t\t\tconst recentDownloads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn (\n\t\t\t\t\tageMs < 60000 && (r.tags.has(\"egress\") || r.tool.includes(\"fetch\"))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\t// Check if current command might be executing downloaded content\n\t\t\tconst command = (currentArgs.command as string) || \"\";\n\t\t\tconst suspiciousPatterns = [\n\t\t\t\t/curl.*\\|.*sh/,\n\t\t\t\t/wget.*\\|.*sh/,\n\t\t\t\t/bash\\s+\\/tmp/,\n\t\t\t\t/sh\\s+\\/tmp/,\n\t\t\t\t/python.*\\/tmp/,\n\t\t\t\t/node.*\\/tmp/,\n\t\t\t];\n\n\t\t\tconst isSuspiciousExec = suspiciousPatterns.some((p) => p.test(command));\n\n\t\t\tif (recentDownloads.length > 0 && isSuspiciousExec) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Execution of potentially downloaded content detected\",\n\t\t\t\t\tmatchingRecords: recentDownloads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"data-staging\",\n\t\tdescription: \"Multiple file reads followed by write to temporary location\",\n\t\tseverity: \"medium\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"write\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Check if writing to temp/staging location\n\t\t\tconst targetPath = (currentArgs.path ||\n\t\t\t\tcurrentArgs.file_path ||\n\t\t\t\tcurrentArgs.target) as string | undefined;\n\t\t\tconst tempPatterns = [\n\t\t\t\t/\\/tmp\\//,\n\t\t\t\t/\\/var\\/tmp\\//,\n\t\t\t\t/\\/temp\\//,\n\t\t\t\t/\\.tmp$/,\n\t\t\t\t/staging/i,\n\t\t\t\t/upload/i,\n\t\t\t];\n\t\t\tconst isWriteToTemp =\n\t\t\t\ttargetPath && tempPatterns.some((p) => p.test(targetPath));\n\n\t\t\tif (!isWriteToTemp) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for multiple recent reads\n\t\t\tconst recentReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 120000 && r.tags.has(\"read\");\n\t\t\t});\n\n\t\t\tif (recentReads.length >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Data staging detected: ${recentReads.length} reads followed by write to ${targetPath}`,\n\t\t\t\t\tmatchingRecords: recentReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privilege-escalation-attempt\",\n\t\tdescription: \"Privilege escalation command after reading configuration\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 120000, // 2 minutes\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (normalizedTool !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst command = (currentArgs.command as string) || \"\";\n\t\t\tconst escalationPatterns = [\n\t\t\t\t/sudo\\s/,\n\t\t\t\t/chmod\\s+[0-7]*[7][0-7]*/, // chmod with execute bit\n\t\t\t\t/chown\\s/,\n\t\t\t\t/chgrp\\s/,\n\t\t\t\t/setuid/,\n\t\t\t\t/setgid/,\n\t\t\t\t/visudo/,\n\t\t\t\t/passwd/,\n\t\t\t\t/usermod/,\n\t\t\t\t/groupadd/,\n\t\t\t\t/useradd/,\n\t\t\t];\n\n\t\t\tconst isEscalationCommand = escalationPatterns.some((p) =>\n\t\t\t\tp.test(command),\n\t\t\t);\n\n\t\t\tif (!isEscalationCommand) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent config/credential reads\n\t\t\tconst configReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120000) return false;\n\n\t\t\t\tconst pathArg = (r.args.path || r.args.file_path) as string | undefined;\n\t\t\t\tconst configPatterns = [\n\t\t\t\t\t/\\/etc\\//,\n\t\t\t\t\t/\\.conf$/,\n\t\t\t\t\t/\\.cfg$/,\n\t\t\t\t\t/config/i,\n\t\t\t\t\t/\\.env/,\n\t\t\t\t\t/credentials/i,\n\t\t\t\t];\n\t\t\t\treturn (\n\t\t\t\t\tr.tags.has(\"read\") &&\n\t\t\t\t\tpathArg &&\n\t\t\t\t\tconfigPatterns.some((p) => p.test(pathArg))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (configReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Privilege escalation attempt after reading config: ${command.slice(0, 50)}`,\n\t\t\t\t\tmatchingRecords: configReads,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"env-exfiltration\",\n\t\tdescription: \"Environment variable access followed by network call\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"egress\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent env reads or commands that access env vars\n\t\t\tconst envAccess = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 60000) return false;\n\n\t\t\t\t// Check if command reads env vars\n\t\t\t\tconst command = (r.args.command as string) || \"\";\n\t\t\t\tconst envPatterns = [\n\t\t\t\t\t/\\$\\{?\\w+\\}?/, // Shell variable access\n\t\t\t\t\t/env\\s/, // env command\n\t\t\t\t\t/printenv/, // printenv command\n\t\t\t\t\t/export\\s/, // export (might show vars)\n\t\t\t\t\t/process\\.env/, // Node.js env access\n\t\t\t\t\t/os\\.environ/, // Python env access\n\t\t\t\t\t/ENV\\[/, // Ruby env access\n\t\t\t\t];\n\n\t\t\t\tconst pathArg = (r.args.path || r.args.file_path) as string | undefined;\n\t\t\t\tconst isEnvFile = pathArg && /\\.env/.test(pathArg);\n\n\t\t\t\treturn (\n\t\t\t\t\tr.tags.has(\"sensitive\") ||\n\t\t\t\t\tisEnvFile ||\n\t\t\t\t\tenvPatterns.some((p) => p.test(command))\n\t\t\t\t);\n\t\t\t});\n\n\t\t\tif (envAccess.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Network egress detected after environment variable access\",\n\t\t\t\t\tmatchingRecords: envAccess,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"systematic-exploration\",\n\t\tdescription: \"Systematic directory listing and reading pattern\",\n\t\tseverity: \"medium\",\n\t\taction: \"log\",\n\t\twindowMs: 180000, // 3 minutes\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tconst isListOrRead =\n\t\t\t\tnormalizedTool.includes(\"glob\") ||\n\t\t\t\tnormalizedTool.includes(\"ls\") ||\n\t\t\t\tnormalizedTool.includes(\"read\") ||\n\t\t\t\tnormalizedTool.includes(\"list\");\n\n\t\t\tif (!isListOrRead) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count alternating list/read operations\n\t\t\tconst recentOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 180000;\n\t\t\t});\n\n\t\t\t// Look for list -> read -> list -> read pattern\n\t\t\tlet listCount = 0;\n\t\t\tlet readCount = 0;\n\t\t\tlet alternations = 0;\n\t\t\tlet lastWasRead = false;\n\n\t\t\tfor (const r of recentOps) {\n\t\t\t\tconst isRead = r.tags.has(\"read\");\n\t\t\t\tconst isList =\n\t\t\t\t\tr.tool.toLowerCase().includes(\"glob\") ||\n\t\t\t\t\tr.tool.toLowerCase().includes(\"ls\") ||\n\t\t\t\t\tr.tool.toLowerCase().includes(\"list\");\n\n\t\t\t\tif (isRead) {\n\t\t\t\t\treadCount++;\n\t\t\t\t\tif (!lastWasRead && listCount > 0) alternations++;\n\t\t\t\t\tlastWasRead = true;\n\t\t\t\t} else if (isList) {\n\t\t\t\t\tlistCount++;\n\t\t\t\t\tlastWasRead = false;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (alternations >= 3 && listCount >= 2 && readCount >= 3) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Systematic exploration pattern: ${listCount} listings, ${readCount} reads, ${alternations} alternations`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"mass-modification\",\n\t\tdescription: \"Large number of file modifications in short period\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60000, // 1 minute\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst currentTags = getToolTags(currentTool);\n\t\t\tif (!currentTags.has(\"write\") && !currentTags.has(\"edit\")) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Count recent modifications\n\t\t\tconst recentMods = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\treturn ageMs < 60000 && (r.tags.has(\"write\") || r.tags.has(\"edit\"));\n\t\t\t});\n\n\t\t\t// Different thresholds for edit vs write\n\t\t\tconst threshold = 10;\n\t\t\tif (recentMods.length >= threshold) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Mass file modification detected (${recentMods.length + 1} modifications in 1 minute)`,\n\t\t\t\t\tmatchingRecords: recentMods,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n"]}

package/dist/safety/tool-categorization.js

@@ -12,7 +12,7 @@ export const TOOL_TAGS = {
     // Read operations
     read: ["read", "file_read", "cat", "head", "tail", "grep"],
     // Write operations
-    write: ["write", "edit", "file_write", "touch", "mkdir"],
+    write: ["write", "edit", "apply_patch", "file_write", "touch", "mkdir"],
     // Delete operations
     delete: ["delete_file", "rm", "rmdir", "unlink"],
     // Network egress

package/dist/safety/tool-categorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-categorization.js","sourceRoot":"","sources":["../../src/safety/tool-categorization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B;IAClD,kBAAkB;IAClB,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,mBAAmB;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;IACxD,oBAAoB;IACpB,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;IAChD,iBAAiB;IACjB,MAAM,EAAE;QACP,WAAW;QACX,UAAU;QACV,OAAO;QACP,cAAc;QACd,MAAM;QACN,MAAM;QACN,YAAY;QACZ,cAAc;KACd;IACD,YAAY;IACZ,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;IAC/C,eAAe;IACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC5C,wBAAwB;IACxB,SAAS,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;IACzE,iBAAiB;IACjB,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC;IAC5C,iBAAiB;IACjB,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC;CACjE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAe;IACnE,cAAc;IACd,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,kCAAkC;IAClC,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,aAAa,OAAO,YAAY,EAAE,GAAG,CAAC,CAAC;IAE5E,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,yCAAyC;QACzC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IAClE,MAAM,iBAAiB,GAAG;QACzB,SAAS;QACT,cAAc;QACd,SAAS;QACT,SAAS;QACT,OAAO;QACP,cAAc;QACd,WAAW;QACX,WAAW;QACX,QAAQ;QACR,kBAAkB;KAClB,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Tool categorization utilities for the sequence analyzer\n *\n * Provides tag-based classification of tools and sensitive path detection.\n *\n * @module safety/tool-categorization\n */\n\n/**\n * Tool tags for categorization\n */\nexport const TOOL_TAGS: Record<string, string[]> = {\n\t// Read operations\n\tread: [\"read\", \"file_read\", \"cat\", \"head\", \"tail\", \"grep\"],\n\t// Write operations\n\twrite: [\"write\", \"edit\", \"file_write\", \"touch\", \"mkdir\"],\n\t// Delete operations\n\tdelete: [\"delete_file\", \"rm\", \"rmdir\", \"unlink\"],\n\t// Network egress\n\tegress: [\n\t\t\"web_fetch\",\n\t\t\"webfetch\",\n\t\t\"fetch\",\n\t\t\"http_request\",\n\t\t\"curl\",\n\t\t\"wget\",\n\t\t\"send_email\",\n\t\t\"send_message\",\n\t],\n\t// Execution\n\texec: [\"bash\", \"exec\", \"run\", \"spawn\", \"shell\"],\n\t// System paths\n\tsystem: [\"sudo\", \"chmod\", \"chown\", \"chroot\"],\n\t// Sensitive data access\n\tsensitive: [\"read_env\", \"read_secrets\", \"read_config\", \"get_credentials\"],\n\t// Git operations\n\tgit: [\"git\", \"gh\", \"git_push\", \"git_commit\"],\n\t// Authentication\n\tauth: [\"login\", \"authenticate\", \"verify_token\", \"check_password\"],\n};\n\n/**\n * Check if tool name matches a pattern using word-boundary logic\n * This handles cases like:\n * - \"read\" matches \"read\" (exact)\n * - \"file_read\" matches \"read\" (ends with pattern)\n * - \"read_file\" matches \"read\" (starts with pattern)\n * - \"my_read_file\" matches \"read\" (pattern in middle at word boundary)\n * But avoids false positives like:\n * - \"reader\" should NOT match \"read\" (pattern is substring, not word)\n */\nexport function matchesToolPattern(toolName: string, pattern: string): boolean {\n\t// Exact match\n\tif (toolName === pattern) {\n\t\treturn true;\n\t}\n\n\t// Word-boundary match using regex\n\t// Match pattern at start, end, or surrounded by word separators (_, -)\n\tconst escaped = pattern.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\tconst wordBoundaryRegex = new RegExp(`(?:^|[_-])${escaped}(?:[_-]|$)`, \"i\");\n\n\treturn wordBoundaryRegex.test(toolName);\n}\n\n/**\n * Get tags for a tool based on its name\n */\nexport function getToolTags(toolName: string): Set<string> {\n\tconst tags = new Set<string>();\n\n\tconst normalizedName = toolName.toLowerCase();\n\n\tfor (const [tag, patterns] of Object.entries(TOOL_TAGS)) {\n\t\tif (patterns.some((p) => matchesToolPattern(normalizedName, p))) {\n\t\t\ttags.add(tag);\n\t\t}\n\t}\n\n\t// Special cases based on tool naming conventions\n\tif (normalizedName.includes(\"mcp_\")) {\n\t\t// MCP tools might need specific handling\n\t\tif (normalizedName.includes(\"send\") || normalizedName.includes(\"post\")) {\n\t\t\ttags.add(\"egress\");\n\t\t}\n\t\tif (normalizedName.includes(\"read\") || normalizedName.includes(\"get\")) {\n\t\t\ttags.add(\"read\");\n\t\t}\n\t}\n\n\treturn tags;\n}\n\n/**\n * Check if args contain paths to sensitive locations\n */\nexport function containsSensitivePath(args: Record<string, unknown>): boolean {\n\tconst sensitivePatterns = [\n\t\t/\\/etc\\//,\n\t\t/\\/var\\/log\\//,\n\t\t/\\.ssh\\//,\n\t\t/\\.aws\\//,\n\t\t/\\.env/,\n\t\t/credentials/i,\n\t\t/secrets?/i,\n\t\t/password/i,\n\t\t/token/i,\n\t\t/private[_-]?key/i,\n\t];\n\n\tconst checkValue = (value: unknown): boolean => {\n\t\tif (typeof value === \"string\") {\n\t\t\treturn sensitivePatterns.some((p) => p.test(value));\n\t\t}\n\t\tif (Array.isArray(value)) {\n\t\t\treturn value.some(checkValue);\n\t\t}\n\t\tif (value && typeof value === \"object\") {\n\t\t\treturn Object.values(value).some(checkValue);\n\t\t}\n\t\treturn false;\n\t};\n\n\treturn checkValue(args);\n}\n"]}
+{"version":3,"file":"tool-categorization.js","sourceRoot":"","sources":["../../src/safety/tool-categorization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B;IAClD,kBAAkB;IAClB,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,mBAAmB;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;IACvE,oBAAoB;IACpB,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;IAChD,iBAAiB;IACjB,MAAM,EAAE;QACP,WAAW;QACX,UAAU;QACV,OAAO;QACP,cAAc;QACd,MAAM;QACN,MAAM;QACN,YAAY;QACZ,cAAc;KACd;IACD,YAAY;IACZ,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;IAC/C,eAAe;IACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC5C,wBAAwB;IACxB,SAAS,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;IACzE,iBAAiB;IACjB,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC;IAC5C,iBAAiB;IACjB,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC;CACjE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAe;IACnE,cAAc;IACd,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,kCAAkC;IAClC,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,aAAa,OAAO,YAAY,EAAE,GAAG,CAAC,CAAC;IAE5E,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,yCAAyC;QACzC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IAClE,MAAM,iBAAiB,GAAG;QACzB,SAAS;QACT,cAAc;QACd,SAAS;QACT,SAAS;QACT,OAAO;QACP,cAAc;QACd,WAAW;QACX,WAAW;QACX,QAAQ;QACR,kBAAkB;KAClB,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Tool categorization utilities for the sequence analyzer\n *\n * Provides tag-based classification of tools and sensitive path detection.\n *\n * @module safety/tool-categorization\n */\n\n/**\n * Tool tags for categorization\n */\nexport const TOOL_TAGS: Record<string, string[]> = {\n\t// Read operations\n\tread: [\"read\", \"file_read\", \"cat\", \"head\", \"tail\", \"grep\"],\n\t// Write operations\n\twrite: [\"write\", \"edit\", \"apply_patch\", \"file_write\", \"touch\", \"mkdir\"],\n\t// Delete operations\n\tdelete: [\"delete_file\", \"rm\", \"rmdir\", \"unlink\"],\n\t// Network egress\n\tegress: [\n\t\t\"web_fetch\",\n\t\t\"webfetch\",\n\t\t\"fetch\",\n\t\t\"http_request\",\n\t\t\"curl\",\n\t\t\"wget\",\n\t\t\"send_email\",\n\t\t\"send_message\",\n\t],\n\t// Execution\n\texec: [\"bash\", \"exec\", \"run\", \"spawn\", \"shell\"],\n\t// System paths\n\tsystem: [\"sudo\", \"chmod\", \"chown\", \"chroot\"],\n\t// Sensitive data access\n\tsensitive: [\"read_env\", \"read_secrets\", \"read_config\", \"get_credentials\"],\n\t// Git operations\n\tgit: [\"git\", \"gh\", \"git_push\", \"git_commit\"],\n\t// Authentication\n\tauth: [\"login\", \"authenticate\", \"verify_token\", \"check_password\"],\n};\n\n/**\n * Check if tool name matches a pattern using word-boundary logic\n * This handles cases like:\n * - \"read\" matches \"read\" (exact)\n * - \"file_read\" matches \"read\" (ends with pattern)\n * - \"read_file\" matches \"read\" (starts with pattern)\n * - \"my_read_file\" matches \"read\" (pattern in middle at word boundary)\n * But avoids false positives like:\n * - \"reader\" should NOT match \"read\" (pattern is substring, not word)\n */\nexport function matchesToolPattern(toolName: string, pattern: string): boolean {\n\t// Exact match\n\tif (toolName === pattern) {\n\t\treturn true;\n\t}\n\n\t// Word-boundary match using regex\n\t// Match pattern at start, end, or surrounded by word separators (_, -)\n\tconst escaped = pattern.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\tconst wordBoundaryRegex = new RegExp(`(?:^|[_-])${escaped}(?:[_-]|$)`, \"i\");\n\n\treturn wordBoundaryRegex.test(toolName);\n}\n\n/**\n * Get tags for a tool based on its name\n */\nexport function getToolTags(toolName: string): Set<string> {\n\tconst tags = new Set<string>();\n\n\tconst normalizedName = toolName.toLowerCase();\n\n\tfor (const [tag, patterns] of Object.entries(TOOL_TAGS)) {\n\t\tif (patterns.some((p) => matchesToolPattern(normalizedName, p))) {\n\t\t\ttags.add(tag);\n\t\t}\n\t}\n\n\t// Special cases based on tool naming conventions\n\tif (normalizedName.includes(\"mcp_\")) {\n\t\t// MCP tools might need specific handling\n\t\tif (normalizedName.includes(\"send\") || normalizedName.includes(\"post\")) {\n\t\t\ttags.add(\"egress\");\n\t\t}\n\t\tif (normalizedName.includes(\"read\") || normalizedName.includes(\"get\")) {\n\t\t\ttags.add(\"read\");\n\t\t}\n\t}\n\n\treturn tags;\n}\n\n/**\n * Check if args contain paths to sensitive locations\n */\nexport function containsSensitivePath(args: Record<string, unknown>): boolean {\n\tconst sensitivePatterns = [\n\t\t/\\/etc\\//,\n\t\t/\\/var\\/log\\//,\n\t\t/\\.ssh\\//,\n\t\t/\\.aws\\//,\n\t\t/\\.env/,\n\t\t/credentials/i,\n\t\t/secrets?/i,\n\t\t/password/i,\n\t\t/token/i,\n\t\t/private[_-]?key/i,\n\t];\n\n\tconst checkValue = (value: unknown): boolean => {\n\t\tif (typeof value === \"string\") {\n\t\t\treturn sensitivePatterns.some((p) => p.test(value));\n\t\t}\n\t\tif (Array.isArray(value)) {\n\t\t\treturn value.some(checkValue);\n\t\t}\n\t\tif (value && typeof value === \"object\") {\n\t\t\treturn Object.values(value).some(checkValue);\n\t\t}\n\t\treturn false;\n\t};\n\n\treturn checkValue(args);\n}\n"]}

package/dist/safety/validators/path-policy-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-policy-validator.d.ts","sourceRoot":"","sources":["../../../src/safety/validators/path-policy-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiDrD;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,qBAAqB,GAC5B,MAAM,EAAE,CAoFV;AAED,wBAAgB,eAAe,CAC9B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAChD;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBvC"}
+{"version":3,"file":"path-policy-validator.d.ts","sourceRoot":"","sources":["../../../src/safety/validators/path-policy-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAG5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiDrD;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,qBAAqB,GAC5B,MAAM,EAAE,CA2FV;AAED,wBAAgB,eAAe,CAC9B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAChD;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBvC"}

package/dist/safety/validators/path-policy-validator.js

@@ -1,3 +1,4 @@
+import { parseApplyPatchPaths } from "../../tools/apply-patch-parser.js";
 import { matchesPathPattern } from "../../utils/path-matcher.js";
 const PATH_KEYS = [
     "path",
@@ -45,6 +46,12 @@ export function extractPolicyFilePaths(context) {
     if (!args)
         return [];
     const paths = [];
+    if (context.toolName === "apply_patch") {
+        const patch = getStringArg(context, "patch");
+        if (patch) {
+            paths.push(...parseApplyPatchPaths(patch));
+        }
+    }
     for (const key of PATH_KEYS) {
         const value = args[key];
         if (typeof value === "string" && value.length > 0) {

package/dist/safety/validators/path-policy-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-policy-validator.js","sourceRoot":"","sources":["../../../src/safety/validators/path-policy-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,SAAS,GAAG;IACjB,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,OAAO;IACP,WAAW;IACX,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,aAAa;IACb,kBAAkB;CAClB,CAAC;AAEF,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAA8B;IAE9B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,YAAY,GACjB,qQAAqQ,CAAC;YAEvQ,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;gBACvE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;oBAChD,IACC,OAAO;wBACP,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;wBACxB,OAAO,CAAC,MAAM,GAAG,CAAC;wBAClB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EACxB,CAAC;wBACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACF,CAAC;YACF,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;YACrD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC1D,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACF,CAAC;YAED,MAAM,aAAa,GAAG,kCAAkC,CAAC;YACzD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBACrD,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;wBACvC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,IAAI,CAAC,YAAY;4BAAE,SAAS;wBAC5B,MAAM,aAAa,GAClB,YAAY,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;wBAC5D,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;4BACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;4BAChD,IACC,OAAO;gCACP,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gCACxB,OAAO,CAAC,MAAM,GAAG,CAAC;gCAClB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EACxB,CAAC;gCACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;4BACrB,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,KAAe,EACf,UAAkD;IAElD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IACC,UAAU,CAAC,OAAO,EAAE,MAAM;YAC1B,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAC/C,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,QAAQ,oCAAoC;aAC7D,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,IACC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC/B,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAChD,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,QAAQ,qCAAqC;iBAC9D,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import type { ActionApprovalContext } from \"../../agent/action-approval.js\";\nimport { matchesPathPattern } from \"../../utils/path-matcher.js\";\nimport type { EnterprisePolicy } from \"../policy.js\";\n\nconst PATH_KEYS = [\n\t\"path\",\n\t\"file_path\",\n\t\"filePath\",\n\t\"file\",\n\t\"files\",\n\t\"directory\",\n\t\"dir\",\n\t\"target\",\n\t\"source\",\n\t\"destination\",\n\t\"cwd\",\n\t\"output\",\n\t\"input\",\n\t\"src\",\n\t\"dest\",\n\t\"config\",\n\t\"workspace\",\n\t\"folder\",\n\t\"target_file\",\n\t\"target_directory\",\n];\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\n/**\n * Extract file paths from tool arguments.\n */\nexport function extractPolicyFilePaths(\n\tcontext: ActionApprovalContext,\n): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\n\tconst paths: string[] = [];\n\n\tfor (const key of PATH_KEYS) {\n\t\tconst value = args[key];\n\t\tif (typeof value === \"string\" && value.length > 0) {\n\t\t\tpaths.push(value);\n\t\t}\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const item of value) {\n\t\t\t\tif (typeof item === \"string\" && item.length > 0) {\n\t\t\t\t\tpaths.push(item);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\tconst fileCommands =\n\t\t\t\t/(?:cd|cat|rm|mv|cp|mkdir|touch|nano|vim|vi|less|more|head|tail|chmod|chown|strings|hexdump|dd|tee|ln|readlink|stat|file|wc|grep|sed|awk|sort|uniq|diff|patch|tar|gzip|gunzip|zip|unzip|find|rsync|scp)\\s+((?:[^\\s;&|<>`$()]|\\\\.)+(?:\\s+(?:[^\\s;&|<>`$()]|\\\\.)+)*)/gi;\n\n\t\t\tconst matches = command.matchAll(fileCommands);\n\t\t\tfor (const match of matches) {\n\t\t\t\tconst argsStr = match[1];\n\t\t\t\tif (!argsStr) continue;\n\t\t\t\tconst argParts = argsStr.match(/(?:[^\\s\"']+|\"[^\"]*\"|'[^']*')+/g) || [];\n\t\t\t\tfor (const arg of argParts) {\n\t\t\t\t\tconst cleaned = arg.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\t\tif (\n\t\t\t\t\t\tcleaned &&\n\t\t\t\t\t\t!cleaned.startsWith(\"-\") &&\n\t\t\t\t\t\tcleaned.length > 0 &&\n\t\t\t\t\t\t!/^[<>|&;]/.test(cleaned)\n\t\t\t\t\t) {\n\t\t\t\t\t\tpaths.push(cleaned);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst redirectPattern = /[<>]{1,2}\\s*([^\\s<>|&;]+)/g;\n\t\t\tconst redirectMatches = command.matchAll(redirectPattern);\n\t\t\tfor (const match of redirectMatches) {\n\t\t\t\tconst rawPath = match[1];\n\t\t\t\tif (!rawPath) continue;\n\t\t\t\tconst path = rawPath.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\tif (path && path.length > 0) {\n\t\t\t\t\tpaths.push(path);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst cmdSubPattern = /(?:\\$\\(|<\\()([^)]+)\\)|`([^`]+)`/g;\n\t\t\tconst cmdSubMatches = command.matchAll(cmdSubPattern);\n\t\t\tfor (const match of cmdSubMatches) {\n\t\t\t\tconst innerCmd = match[1] || match[2];\n\t\t\t\tif (innerCmd) {\n\t\t\t\t\tconst innerMatches = innerCmd.matchAll(fileCommands);\n\t\t\t\t\tfor (const innerMatch of innerMatches) {\n\t\t\t\t\t\tconst innerArgsStr = innerMatch[1];\n\t\t\t\t\t\tif (!innerArgsStr) continue;\n\t\t\t\t\t\tconst innerArgParts =\n\t\t\t\t\t\t\tinnerArgsStr.match(/(?:[^\\s\"']+|\"[^\"]*\"|'[^']*')+/g) || [];\n\t\t\t\t\t\tfor (const arg of innerArgParts) {\n\t\t\t\t\t\t\tconst cleaned = arg.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\tcleaned &&\n\t\t\t\t\t\t\t\t!cleaned.startsWith(\"-\") &&\n\t\t\t\t\t\t\t\tcleaned.length > 0 &&\n\t\t\t\t\t\t\t\t!/^[<>|&;]/.test(cleaned)\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tpaths.push(cleaned);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function checkPathPolicy(\n\tpaths: string[],\n\tpathPolicy: NonNullable<EnterprisePolicy[\"paths\"]>,\n): { allowed: boolean; reason?: string } {\n\tfor (const filePath of paths) {\n\t\tif (\n\t\t\tpathPolicy.blocked?.length &&\n\t\t\tmatchesPathPattern(filePath, pathPolicy.blocked)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Path \"${filePath}\" is blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t\tif (pathPolicy.allowed) {\n\t\t\tif (\n\t\t\t\tpathPolicy.allowed.length === 0 ||\n\t\t\t\t!matchesPathPattern(filePath, pathPolicy.allowed)\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Path \"${filePath}\" is not in the allowed paths list.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n"]}
+{"version":3,"file":"path-policy-validator.js","sourceRoot":"","sources":["../../../src/safety/validators/path-policy-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,SAAS,GAAG;IACjB,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,OAAO;IACP,WAAW;IACX,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,aAAa;IACb,kBAAkB;CAClB,CAAC;AAEF,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAA8B;IAE9B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,YAAY,GACjB,qQAAqQ,CAAC;YAEvQ,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;gBACvE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;oBAChD,IACC,OAAO;wBACP,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;wBACxB,OAAO,CAAC,MAAM,GAAG,CAAC;wBAClB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EACxB,CAAC;wBACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACF,CAAC;YACF,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;YACrD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC1D,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACF,CAAC;YAED,MAAM,aAAa,GAAG,kCAAkC,CAAC;YACzD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBACrD,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;wBACvC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,IAAI,CAAC,YAAY;4BAAE,SAAS;wBAC5B,MAAM,aAAa,GAClB,YAAY,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;wBAC5D,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;4BACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;4BAChD,IACC,OAAO;gCACP,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gCACxB,OAAO,CAAC,MAAM,GAAG,CAAC;gCAClB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EACxB,CAAC;gCACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;4BACrB,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,KAAe,EACf,UAAkD;IAElD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IACC,UAAU,CAAC,OAAO,EAAE,MAAM;YAC1B,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAC/C,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,QAAQ,oCAAoC;aAC7D,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,IACC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC/B,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAChD,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,QAAQ,qCAAqC;iBAC9D,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import type { ActionApprovalContext } from \"../../agent/action-approval.js\";\nimport { parseApplyPatchPaths } from \"../../tools/apply-patch-parser.js\";\nimport { matchesPathPattern } from \"../../utils/path-matcher.js\";\nimport type { EnterprisePolicy } from \"../policy.js\";\n\nconst PATH_KEYS = [\n\t\"path\",\n\t\"file_path\",\n\t\"filePath\",\n\t\"file\",\n\t\"files\",\n\t\"directory\",\n\t\"dir\",\n\t\"target\",\n\t\"source\",\n\t\"destination\",\n\t\"cwd\",\n\t\"output\",\n\t\"input\",\n\t\"src\",\n\t\"dest\",\n\t\"config\",\n\t\"workspace\",\n\t\"folder\",\n\t\"target_file\",\n\t\"target_directory\",\n];\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\n/**\n * Extract file paths from tool arguments.\n */\nexport function extractPolicyFilePaths(\n\tcontext: ActionApprovalContext,\n): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\n\tconst paths: string[] = [];\n\n\tif (context.toolName === \"apply_patch\") {\n\t\tconst patch = getStringArg(context, \"patch\");\n\t\tif (patch) {\n\t\t\tpaths.push(...parseApplyPatchPaths(patch));\n\t\t}\n\t}\n\n\tfor (const key of PATH_KEYS) {\n\t\tconst value = args[key];\n\t\tif (typeof value === \"string\" && value.length > 0) {\n\t\t\tpaths.push(value);\n\t\t}\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const item of value) {\n\t\t\t\tif (typeof item === \"string\" && item.length > 0) {\n\t\t\t\t\tpaths.push(item);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\tconst fileCommands =\n\t\t\t\t/(?:cd|cat|rm|mv|cp|mkdir|touch|nano|vim|vi|less|more|head|tail|chmod|chown|strings|hexdump|dd|tee|ln|readlink|stat|file|wc|grep|sed|awk|sort|uniq|diff|patch|tar|gzip|gunzip|zip|unzip|find|rsync|scp)\\s+((?:[^\\s;&|<>`$()]|\\\\.)+(?:\\s+(?:[^\\s;&|<>`$()]|\\\\.)+)*)/gi;\n\n\t\t\tconst matches = command.matchAll(fileCommands);\n\t\t\tfor (const match of matches) {\n\t\t\t\tconst argsStr = match[1];\n\t\t\t\tif (!argsStr) continue;\n\t\t\t\tconst argParts = argsStr.match(/(?:[^\\s\"']+|\"[^\"]*\"|'[^']*')+/g) || [];\n\t\t\t\tfor (const arg of argParts) {\n\t\t\t\t\tconst cleaned = arg.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\t\tif (\n\t\t\t\t\t\tcleaned &&\n\t\t\t\t\t\t!cleaned.startsWith(\"-\") &&\n\t\t\t\t\t\tcleaned.length > 0 &&\n\t\t\t\t\t\t!/^[<>|&;]/.test(cleaned)\n\t\t\t\t\t) {\n\t\t\t\t\t\tpaths.push(cleaned);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst redirectPattern = /[<>]{1,2}\\s*([^\\s<>|&;]+)/g;\n\t\t\tconst redirectMatches = command.matchAll(redirectPattern);\n\t\t\tfor (const match of redirectMatches) {\n\t\t\t\tconst rawPath = match[1];\n\t\t\t\tif (!rawPath) continue;\n\t\t\t\tconst path = rawPath.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\tif (path && path.length > 0) {\n\t\t\t\t\tpaths.push(path);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst cmdSubPattern = /(?:\\$\\(|<\\()([^)]+)\\)|`([^`]+)`/g;\n\t\t\tconst cmdSubMatches = command.matchAll(cmdSubPattern);\n\t\t\tfor (const match of cmdSubMatches) {\n\t\t\t\tconst innerCmd = match[1] || match[2];\n\t\t\t\tif (innerCmd) {\n\t\t\t\t\tconst innerMatches = innerCmd.matchAll(fileCommands);\n\t\t\t\t\tfor (const innerMatch of innerMatches) {\n\t\t\t\t\t\tconst innerArgsStr = innerMatch[1];\n\t\t\t\t\t\tif (!innerArgsStr) continue;\n\t\t\t\t\t\tconst innerArgParts =\n\t\t\t\t\t\t\tinnerArgsStr.match(/(?:[^\\s\"']+|\"[^\"]*\"|'[^']*')+/g) || [];\n\t\t\t\t\t\tfor (const arg of innerArgParts) {\n\t\t\t\t\t\t\tconst cleaned = arg.replace(/^[\"']|[\"']$/g, \"\");\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\tcleaned &&\n\t\t\t\t\t\t\t\t!cleaned.startsWith(\"-\") &&\n\t\t\t\t\t\t\t\tcleaned.length > 0 &&\n\t\t\t\t\t\t\t\t!/^[<>|&;]/.test(cleaned)\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tpaths.push(cleaned);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function checkPathPolicy(\n\tpaths: string[],\n\tpathPolicy: NonNullable<EnterprisePolicy[\"paths\"]>,\n): { allowed: boolean; reason?: string } {\n\tfor (const filePath of paths) {\n\t\tif (\n\t\t\tpathPolicy.blocked?.length &&\n\t\t\tmatchesPathPattern(filePath, pathPolicy.blocked)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Path \"${filePath}\" is blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t\tif (pathPolicy.allowed) {\n\t\t\tif (\n\t\t\t\tpathPolicy.allowed.length === 0 ||\n\t\t\t\t!matchesPathPattern(filePath, pathPolicy.allowed)\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Path \"${filePath}\" is not in the allowed paths list.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n"]}

package/dist/sandbox/index.d.ts

@@ -5,7 +5,8 @@ export type { Sandbox, ExecResult } from "./types.js";
 export { DockerSandbox, type DockerSandboxConfig } from "./docker-sandbox.js";
 export { LocalSandbox } from "./local-sandbox.js";
 export { NativeSandbox, isNativeSandboxAvailable, getNativeSandboxType, createNativeSandbox, type NativeSandboxPolicy, type NativeSandboxMode, } from "./native-sandbox.js";
-export type SandboxMode = "docker" | "local" | "native" | "none";
+export type SandboxBackendMode = "docker" | "local" | "native" | "none";
+export type SandboxMode = SandboxBackendMode | NativeSandboxMode;
 export interface NativeSandboxConfig {
     /** Sandbox policy mode */
     policy?: NativeSandboxMode;
@@ -13,6 +14,10 @@ export interface NativeSandboxConfig {
     writableRoots?: string[];
     /** Allow network access */
     networkAccess?: boolean;
+    /** Exclude TMPDIR from writable roots */
+    excludeTmpdir?: boolean;
+    /** Exclude /tmp from writable roots */
+    excludeSlashTmp?: boolean;
 }
 export interface SandboxConfig {
     mode: SandboxMode;

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EAEN,KAAK,iBAAiB,EAKtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IACnC,0BAA0B;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAgBxE;AAkBD,MAAM,WAAW,oBAAoB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAClC,OAAO,GAAE,oBAAyB,GAChC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA+G9B;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,GAAG,SAAS,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EAEN,KAAK,iBAAiB,EAKtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AACxE,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IACnC,0BAA0B;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAgBxE;AAqCD,MAAM,WAAW,oBAAoB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAClC,OAAO,GAAE,oBAAyB,GAChC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAwI9B;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,GAAG,SAAS,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/sandbox/index.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { buildNativeSandboxPolicy } from "../safety/permission-profile.js";
 import { DockerSandbox } from "./docker-sandbox.js";
 import { LocalSandbox } from "./local-sandbox.js";
 import { createNativeSandbox, getNativeSandboxType, isNativeSandboxAvailable, } from "./native-sandbox.js";
@@ -42,6 +43,17 @@ async function isDockerAvailable() {
         return false;
     }
 }
+function isNativeSandboxMode(mode) {
+    return (mode === "read-only" ||
+        mode === "workspace-write" ||
+        mode === "danger-full-access");
+}
+function resolveSandboxMode(mode) {
+    if (isNativeSandboxMode(mode)) {
+        return { backendMode: "native", nativePolicy: mode };
+    }
+    return { backendMode: mode };
+}
 /**
  * Creates a sandbox instance based on the specified mode.
  *
@@ -84,8 +96,9 @@ export async function createSandbox(options = {}) {
             nativeConfig = config.native ?? nativeConfig;
         }
     }
+    const { backendMode, nativePolicy } = resolveSandboxMode(mode);
     // Handle each mode
-    switch (mode) {
+    switch (backendMode) {
         case "none":
             return undefined;
         case "local":
@@ -94,19 +107,29 @@ export async function createSandbox(options = {}) {
             }
             return new LocalSandbox();
         case "native": {
+            const requestedPolicy = nativePolicy ?? nativeConfig?.policy ?? "workspace-write";
+            if (requestedPolicy === "danger-full-access") {
+                return undefined;
+            }
+            const policyModeRequested = nativePolicy !== undefined;
             // Check native sandbox availability
             if (!isNativeSandboxAvailable()) {
                 const sandboxType = getNativeSandboxType();
                 console.warn(`[sandbox] Native sandbox (${sandboxType}) not available on this platform.`);
+                if (policyModeRequested) {
+                    throw new Error(`Native sandbox policy mode "${nativePolicy}" requires native sandbox support; refusing to fall back to local execution.`);
+                }
                 const fallback = isWebServer ? "none" : "local";
                 console.warn(`[sandbox] Falling back to ${fallback} sandbox.`);
                 return isWebServer ? undefined : new LocalSandbox();
             }
-            const policy = {
-                mode: nativeConfig?.policy ?? "workspace-write",
+            const policy = buildNativeSandboxPolicy({
+                mode: requestedPolicy,
                 writableRoots: nativeConfig?.writableRoots,
                 networkAccess: nativeConfig?.networkAccess ?? true,
-            };
+                excludeTmpdir: nativeConfig?.excludeTmpdir,
+                excludeSlashTmp: nativeConfig?.excludeSlashTmp,
+            }, cwd);
             const sandbox = createNativeSandbox(policy, cwd);
             try {
                 await sandbox.initialize();
@@ -114,6 +137,9 @@ export async function createSandbox(options = {}) {
             }
             catch (error) {
                 console.warn("[sandbox] Failed to initialize native sandbox:", error instanceof Error ? error.message : String(error));
+                if (policyModeRequested) {
+                    throw new Error(`Native sandbox policy mode "${nativePolicy}" failed to initialize; refusing to fall back to local execution.`, { cause: error });
+                }
                 const fallback = isWebServer ? "none" : "local";
                 console.warn(`[sandbox] Falling back to ${fallback} sandbox.`);
                 return isWebServer ? undefined : new LocalSandbox();

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAIN,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,GAGnB,MAAM,qBAAqB,CAAC;AAmB7B;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE;YACvD,UAAU;YACV,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;IAE3D,gEAAgE;IAChE,IAAI,IAAI,GAAgB,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IAC/C,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAElC,qFAAqF;IACrF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,OAAO,GACZ,UAAU,IAAI,UAAU,KAAK,WAAW;QACvC,CAAC,CAAE,UAA0B;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,CAAC;IAChB,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;YAC7C,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,mBAAmB;IACnB,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,MAAM;YACV,OAAO,SAAS,CAAC;QAElB,KAAK,OAAO;YACX,IAAI,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACd,gGAAgG,CAChG,CAAC;YACH,CAAC;YACD,OAAO,IAAI,YAAY,EAAE,CAAC;QAE3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,oCAAoC;YACpC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CACX,6BAA6B,WAAW,mCAAmC,CAC3E,CAAC;gBACF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,MAAM,GAAwB;gBACnC,IAAI,EAAE,YAAY,EAAE,MAAM,IAAI,iBAAiB;gBAC/C,aAAa,EAAE,YAAY,EAAE,aAAa;gBAC1C,aAAa,EAAE,YAAY,EAAE,aAAa,IAAI,IAAI;aAClD,CAAC;YAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAEjD,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACX,gDAAgD,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;gBACF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;QACF,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,4BAA4B;YAC5B,MAAM,eAAe,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CACX,mDAAmD,QAAQ,WAAW,CACtE,CAAC;gBACF,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBACjC,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,cAAc;gBAC5C,cAAc,EAAE,YAAY,EAAE,cAAc,IAAI,YAAY;aAC5D,CAAC,CAAC;YAEH,2BAA2B;YAC3B,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACX,gDAAgD,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;gBACF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;QACF,CAAC;QAED;YACC,OAAO,CAAC,IAAI,CAAC,mCAAmC,IAAI,eAAe,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAA4B;IAE5B,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;AACF,CAAC","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { DockerSandbox, type DockerSandboxConfig } from \"./docker-sandbox.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport {\n\tNativeSandbox,\n\ttype NativeSandboxMode,\n\ttype NativeSandboxPolicy,\n\tcreateNativeSandbox,\n\tgetNativeSandboxType,\n\tisNativeSandboxAvailable,\n} from \"./native-sandbox.js\";\nimport type { Sandbox } from \"./types.js\";\n\nexport type { Sandbox, ExecResult } from \"./types.js\";\nexport { DockerSandbox, type DockerSandboxConfig } from \"./docker-sandbox.js\";\nexport { LocalSandbox } from \"./local-sandbox.js\";\nexport {\n\tNativeSandbox,\n\tisNativeSandboxAvailable,\n\tgetNativeSandboxType,\n\tcreateNativeSandbox,\n\ttype NativeSandboxPolicy,\n\ttype NativeSandboxMode,\n} from \"./native-sandbox.js\";\n\nexport type SandboxMode = \"docker\" | \"local\" | \"native\" | \"none\";\n\nexport interface NativeSandboxConfig {\n\t/** Sandbox policy mode */\n\tpolicy?: NativeSandboxMode;\n\t/** Additional writable directories */\n\twritableRoots?: string[];\n\t/** Allow network access */\n\tnetworkAccess?: boolean;\n}\n\nexport interface SandboxConfig {\n\tmode: SandboxMode;\n\tdocker?: DockerSandboxConfig;\n\tnative?: NativeSandboxConfig;\n}\n\n/**\n * Loads sandbox configuration from .maestro/sandbox.json if present.\n * Returns undefined if no config file exists.\n */\nexport function loadSandboxConfig(cwd: string): SandboxConfig | undefined {\n\tconst configPath = join(cwd, \".maestro\", \"sandbox.json\");\n\tif (!existsSync(configPath)) {\n\t\treturn undefined;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(configPath, \"utf-8\");\n\t\treturn JSON.parse(content) as SandboxConfig;\n\t} catch (error) {\n\t\tconsole.warn(\"[sandbox] Failed to load sandbox config\", {\n\t\t\tconfigPath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Checks if Docker is available on the system.\n */\nasync function isDockerAvailable(): Promise<boolean> {\n\tconst { exec } = await import(\"node:child_process\");\n\tconst { promisify } = await import(\"node:util\");\n\tconst execAsync = promisify(exec);\n\n\ttry {\n\t\tawait execAsync(\"docker info\");\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport interface CreateSandboxOptions {\n\t/** Explicit mode override */\n\tmode?: SandboxMode;\n\t/** Working directory for config lookup */\n\tcwd?: string;\n\t/** Docker-specific configuration */\n\tdocker?: DockerSandboxConfig;\n\t/** Native sandbox configuration */\n\tnative?: NativeSandboxConfig;\n}\n\n/**\n * Creates a sandbox instance based on the specified mode.\n *\n * @param options - Configuration options for sandbox creation\n * @returns A Sandbox instance (Docker or Local) or undefined for \"none\" mode\n *\n * @example\n * ```typescript\n * // Auto-detect based on config file\n * const sandbox = await createSandbox();\n *\n * // Force Docker mode\n * const dockerSandbox = await createSandbox({ mode: \"docker\" });\n *\n * // No sandbox\n * const noSandbox = await createSandbox({ mode: \"none\" });\n * ```\n */\nexport async function createSandbox(\n\toptions: CreateSandboxOptions = {},\n): Promise<Sandbox | undefined> {\n\tconst cwd = options.cwd ?? process.cwd();\n\tconst isWebServer = process.env.MAESTRO_WEB_SERVER === \"1\";\n\n\t// Priority: explicit mode > env var > config file > auto-detect\n\tlet mode: SandboxMode = options.mode ?? \"none\";\n\tlet dockerConfig = options.docker;\n\tlet nativeConfig = options.native;\n\n\t// Check environment variable (handle \"undefined\" string from process.env assignment)\n\tconst envModeRaw = process.env.MAESTRO_SANDBOX_MODE;\n\tconst envMode =\n\t\tenvModeRaw && envModeRaw !== \"undefined\"\n\t\t\t? (envModeRaw as SandboxMode)\n\t\t\t: undefined;\n\tif (!options.mode && envMode) {\n\t\tmode = envMode;\n\t}\n\n\t// Check config file if no explicit mode\n\tif (!options.mode && !envMode) {\n\t\tconst config = loadSandboxConfig(cwd);\n\t\tif (config) {\n\t\t\tmode = config.mode;\n\t\t\tdockerConfig = config.docker ?? dockerConfig;\n\t\t\tnativeConfig = config.native ?? nativeConfig;\n\t\t}\n\t}\n\n\t// Handle each mode\n\tswitch (mode) {\n\t\tcase \"none\":\n\t\t\treturn undefined;\n\n\t\tcase \"local\":\n\t\t\tif (isWebServer) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"Local sandbox is disabled in web-server mode. Use Docker sandbox or MAESTRO_SANDBOX_MODE=none.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn new LocalSandbox();\n\n\t\tcase \"native\": {\n\t\t\t// Check native sandbox availability\n\t\t\tif (!isNativeSandboxAvailable()) {\n\t\t\t\tconst sandboxType = getNativeSandboxType();\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sandbox] Native sandbox (${sandboxType}) not available on this platform.`,\n\t\t\t\t);\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\n\t\t\tconst policy: NativeSandboxPolicy = {\n\t\t\t\tmode: nativeConfig?.policy ?? \"workspace-write\",\n\t\t\t\twritableRoots: nativeConfig?.writableRoots,\n\t\t\t\tnetworkAccess: nativeConfig?.networkAccess ?? true,\n\t\t\t};\n\n\t\t\tconst sandbox = createNativeSandbox(policy, cwd);\n\n\t\t\ttry {\n\t\t\t\tawait sandbox.initialize();\n\t\t\t\treturn sandbox;\n\t\t\t} catch (error) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[sandbox] Failed to initialize native sandbox:\",\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t);\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\t\t}\n\n\t\tcase \"docker\": {\n\t\t\t// Check Docker availability\n\t\t\tconst dockerAvailable = await isDockerAvailable();\n\t\t\tif (!dockerAvailable) {\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sandbox] Docker not available. Falling back to ${fallback} sandbox.`,\n\t\t\t\t);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\n\t\t\tconst sandbox = new DockerSandbox({\n\t\t\t\timage: dockerConfig?.image ?? \"node:20-slim\",\n\t\t\t\tworkspaceMount: dockerConfig?.workspaceMount ?? \"/workspace\",\n\t\t\t});\n\n\t\t\t// Initialize the container\n\t\t\ttry {\n\t\t\t\tawait sandbox.initialize();\n\t\t\t\treturn sandbox;\n\t\t\t} catch (error) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[sandbox] Failed to initialize Docker sandbox:\",\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t);\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\t\t}\n\n\t\tdefault:\n\t\t\tconsole.warn(`[sandbox] Unknown sandbox mode: ${mode}. Using none.`);\n\t\t\treturn undefined;\n\t}\n}\n\n/**\n * Cleans up a sandbox instance, stopping containers if needed.\n */\nexport async function disposeSandbox(\n\tsandbox: Sandbox | undefined,\n): Promise<void> {\n\tif (sandbox) {\n\t\tawait sandbox.dispose();\n\t}\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAIN,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,GAGnB,MAAM,qBAAqB,CAAC;AAwB7B;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE;YACvD,UAAU;YACV,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,OAAO,CACN,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,oBAAoB,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiB;IAI5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;IAE3D,gEAAgE;IAChE,IAAI,IAAI,GAAgB,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IAC/C,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAElC,qFAAqF;IACrF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,OAAO,GACZ,UAAU,IAAI,UAAU,KAAK,WAAW;QACvC,CAAC,CAAE,UAA0B;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,CAAC;IAChB,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;YAC7C,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAE/D,mBAAmB;IACnB,QAAQ,WAAW,EAAE,CAAC;QACrB,KAAK,MAAM;YACV,OAAO,SAAS,CAAC;QAElB,KAAK,OAAO;YACX,IAAI,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACd,gGAAgG,CAChG,CAAC;YACH,CAAC;YACD,OAAO,IAAI,YAAY,EAAE,CAAC;QAE3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,eAAe,GACpB,YAAY,IAAI,YAAY,EAAE,MAAM,IAAI,iBAAiB,CAAC;YAC3D,IAAI,eAAe,KAAK,oBAAoB,EAAE,CAAC;gBAC9C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,MAAM,mBAAmB,GAAG,YAAY,KAAK,SAAS,CAAC;YACvD,oCAAoC;YACpC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CACX,6BAA6B,WAAW,mCAAmC,CAC3E,CAAC;gBACF,IAAI,mBAAmB,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACd,+BAA+B,YAAY,8EAA8E,CACzH,CAAC;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,MAAM,GAAwB,wBAAwB,CAC3D;gBACC,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE,YAAY,EAAE,aAAa;gBAC1C,aAAa,EAAE,YAAY,EAAE,aAAa,IAAI,IAAI;gBAClD,aAAa,EAAE,YAAY,EAAE,aAAa;gBAC1C,eAAe,EAAE,YAAY,EAAE,eAAe;aAC9C,EACD,GAAG,CACH,CAAC;YAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAEjD,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACX,gDAAgD,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;gBACF,IAAI,mBAAmB,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACd,+BAA+B,YAAY,mEAAmE,EAC9G,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;QACF,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,4BAA4B;YAC5B,MAAM,eAAe,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CACX,mDAAmD,QAAQ,WAAW,CACtE,CAAC;gBACF,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBACjC,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,cAAc;gBAC5C,cAAc,EAAE,YAAY,EAAE,cAAc,IAAI,YAAY;aAC5D,CAAC,CAAC;YAEH,2BAA2B;YAC3B,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACX,gDAAgD,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;gBACF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,WAAW,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACrD,CAAC;QACF,CAAC;QAED;YACC,OAAO,CAAC,IAAI,CAAC,mCAAmC,IAAI,eAAe,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAA4B;IAE5B,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;AACF,CAAC","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { buildNativeSandboxPolicy } from \"../safety/permission-profile.js\";\nimport { DockerSandbox, type DockerSandboxConfig } from \"./docker-sandbox.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport {\n\tNativeSandbox,\n\ttype NativeSandboxMode,\n\ttype NativeSandboxPolicy,\n\tcreateNativeSandbox,\n\tgetNativeSandboxType,\n\tisNativeSandboxAvailable,\n} from \"./native-sandbox.js\";\nimport type { Sandbox } from \"./types.js\";\n\nexport type { Sandbox, ExecResult } from \"./types.js\";\nexport { DockerSandbox, type DockerSandboxConfig } from \"./docker-sandbox.js\";\nexport { LocalSandbox } from \"./local-sandbox.js\";\nexport {\n\tNativeSandbox,\n\tisNativeSandboxAvailable,\n\tgetNativeSandboxType,\n\tcreateNativeSandbox,\n\ttype NativeSandboxPolicy,\n\ttype NativeSandboxMode,\n} from \"./native-sandbox.js\";\n\nexport type SandboxBackendMode = \"docker\" | \"local\" | \"native\" | \"none\";\nexport type SandboxMode = SandboxBackendMode | NativeSandboxMode;\n\nexport interface NativeSandboxConfig {\n\t/** Sandbox policy mode */\n\tpolicy?: NativeSandboxMode;\n\t/** Additional writable directories */\n\twritableRoots?: string[];\n\t/** Allow network access */\n\tnetworkAccess?: boolean;\n\t/** Exclude TMPDIR from writable roots */\n\texcludeTmpdir?: boolean;\n\t/** Exclude /tmp from writable roots */\n\texcludeSlashTmp?: boolean;\n}\n\nexport interface SandboxConfig {\n\tmode: SandboxMode;\n\tdocker?: DockerSandboxConfig;\n\tnative?: NativeSandboxConfig;\n}\n\n/**\n * Loads sandbox configuration from .maestro/sandbox.json if present.\n * Returns undefined if no config file exists.\n */\nexport function loadSandboxConfig(cwd: string): SandboxConfig | undefined {\n\tconst configPath = join(cwd, \".maestro\", \"sandbox.json\");\n\tif (!existsSync(configPath)) {\n\t\treturn undefined;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(configPath, \"utf-8\");\n\t\treturn JSON.parse(content) as SandboxConfig;\n\t} catch (error) {\n\t\tconsole.warn(\"[sandbox] Failed to load sandbox config\", {\n\t\t\tconfigPath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Checks if Docker is available on the system.\n */\nasync function isDockerAvailable(): Promise<boolean> {\n\tconst { exec } = await import(\"node:child_process\");\n\tconst { promisify } = await import(\"node:util\");\n\tconst execAsync = promisify(exec);\n\n\ttry {\n\t\tawait execAsync(\"docker info\");\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isNativeSandboxMode(mode: string): mode is NativeSandboxMode {\n\treturn (\n\t\tmode === \"read-only\" ||\n\t\tmode === \"workspace-write\" ||\n\t\tmode === \"danger-full-access\"\n\t);\n}\n\nfunction resolveSandboxMode(mode: SandboxMode): {\n\tbackendMode: SandboxBackendMode;\n\tnativePolicy?: NativeSandboxMode;\n} {\n\tif (isNativeSandboxMode(mode)) {\n\t\treturn { backendMode: \"native\", nativePolicy: mode };\n\t}\n\n\treturn { backendMode: mode };\n}\n\nexport interface CreateSandboxOptions {\n\t/** Explicit mode override */\n\tmode?: SandboxMode;\n\t/** Working directory for config lookup */\n\tcwd?: string;\n\t/** Docker-specific configuration */\n\tdocker?: DockerSandboxConfig;\n\t/** Native sandbox configuration */\n\tnative?: NativeSandboxConfig;\n}\n\n/**\n * Creates a sandbox instance based on the specified mode.\n *\n * @param options - Configuration options for sandbox creation\n * @returns A Sandbox instance (Docker or Local) or undefined for \"none\" mode\n *\n * @example\n * ```typescript\n * // Auto-detect based on config file\n * const sandbox = await createSandbox();\n *\n * // Force Docker mode\n * const dockerSandbox = await createSandbox({ mode: \"docker\" });\n *\n * // No sandbox\n * const noSandbox = await createSandbox({ mode: \"none\" });\n * ```\n */\nexport async function createSandbox(\n\toptions: CreateSandboxOptions = {},\n): Promise<Sandbox | undefined> {\n\tconst cwd = options.cwd ?? process.cwd();\n\tconst isWebServer = process.env.MAESTRO_WEB_SERVER === \"1\";\n\n\t// Priority: explicit mode > env var > config file > auto-detect\n\tlet mode: SandboxMode = options.mode ?? \"none\";\n\tlet dockerConfig = options.docker;\n\tlet nativeConfig = options.native;\n\n\t// Check environment variable (handle \"undefined\" string from process.env assignment)\n\tconst envModeRaw = process.env.MAESTRO_SANDBOX_MODE;\n\tconst envMode =\n\t\tenvModeRaw && envModeRaw !== \"undefined\"\n\t\t\t? (envModeRaw as SandboxMode)\n\t\t\t: undefined;\n\tif (!options.mode && envMode) {\n\t\tmode = envMode;\n\t}\n\n\t// Check config file if no explicit mode\n\tif (!options.mode && !envMode) {\n\t\tconst config = loadSandboxConfig(cwd);\n\t\tif (config) {\n\t\t\tmode = config.mode;\n\t\t\tdockerConfig = config.docker ?? dockerConfig;\n\t\t\tnativeConfig = config.native ?? nativeConfig;\n\t\t}\n\t}\n\n\tconst { backendMode, nativePolicy } = resolveSandboxMode(mode);\n\n\t// Handle each mode\n\tswitch (backendMode) {\n\t\tcase \"none\":\n\t\t\treturn undefined;\n\n\t\tcase \"local\":\n\t\t\tif (isWebServer) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"Local sandbox is disabled in web-server mode. Use Docker sandbox or MAESTRO_SANDBOX_MODE=none.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn new LocalSandbox();\n\n\t\tcase \"native\": {\n\t\t\tconst requestedPolicy =\n\t\t\t\tnativePolicy ?? nativeConfig?.policy ?? \"workspace-write\";\n\t\t\tif (requestedPolicy === \"danger-full-access\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\tconst policyModeRequested = nativePolicy !== undefined;\n\t\t\t// Check native sandbox availability\n\t\t\tif (!isNativeSandboxAvailable()) {\n\t\t\t\tconst sandboxType = getNativeSandboxType();\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sandbox] Native sandbox (${sandboxType}) not available on this platform.`,\n\t\t\t\t);\n\t\t\t\tif (policyModeRequested) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Native sandbox policy mode \"${nativePolicy}\" requires native sandbox support; refusing to fall back to local execution.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\n\t\t\tconst policy: NativeSandboxPolicy = buildNativeSandboxPolicy(\n\t\t\t\t{\n\t\t\t\t\tmode: requestedPolicy,\n\t\t\t\t\twritableRoots: nativeConfig?.writableRoots,\n\t\t\t\t\tnetworkAccess: nativeConfig?.networkAccess ?? true,\n\t\t\t\t\texcludeTmpdir: nativeConfig?.excludeTmpdir,\n\t\t\t\t\texcludeSlashTmp: nativeConfig?.excludeSlashTmp,\n\t\t\t\t},\n\t\t\t\tcwd,\n\t\t\t);\n\n\t\t\tconst sandbox = createNativeSandbox(policy, cwd);\n\n\t\t\ttry {\n\t\t\t\tawait sandbox.initialize();\n\t\t\t\treturn sandbox;\n\t\t\t} catch (error) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[sandbox] Failed to initialize native sandbox:\",\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t);\n\t\t\t\tif (policyModeRequested) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Native sandbox policy mode \"${nativePolicy}\" failed to initialize; refusing to fall back to local execution.`,\n\t\t\t\t\t\t{ cause: error },\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\t\t}\n\n\t\tcase \"docker\": {\n\t\t\t// Check Docker availability\n\t\t\tconst dockerAvailable = await isDockerAvailable();\n\t\t\tif (!dockerAvailable) {\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sandbox] Docker not available. Falling back to ${fallback} sandbox.`,\n\t\t\t\t);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\n\t\t\tconst sandbox = new DockerSandbox({\n\t\t\t\timage: dockerConfig?.image ?? \"node:20-slim\",\n\t\t\t\tworkspaceMount: dockerConfig?.workspaceMount ?? \"/workspace\",\n\t\t\t});\n\n\t\t\t// Initialize the container\n\t\t\ttry {\n\t\t\t\tawait sandbox.initialize();\n\t\t\t\treturn sandbox;\n\t\t\t} catch (error) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[sandbox] Failed to initialize Docker sandbox:\",\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t);\n\t\t\t\tconst fallback = isWebServer ? \"none\" : \"local\";\n\t\t\t\tconsole.warn(`[sandbox] Falling back to ${fallback} sandbox.`);\n\t\t\t\treturn isWebServer ? undefined : new LocalSandbox();\n\t\t\t}\n\t\t}\n\n\t\tdefault:\n\t\t\tconsole.warn(`[sandbox] Unknown sandbox mode: ${mode}. Using none.`);\n\t\t\treturn undefined;\n\t}\n}\n\n/**\n * Cleans up a sandbox instance, stopping containers if needed.\n */\nexport async function disposeSandbox(\n\tsandbox: Sandbox | undefined,\n): Promise<void> {\n\tif (sandbox) {\n\t\tawait sandbox.dispose();\n\t}\n}\n"]}

package/dist/sandbox/native-sandbox.d.ts

@@ -62,6 +62,9 @@ export declare class NativeSandbox implements Sandbox {
     delete(path: string, recursive?: boolean): Promise<void>;
     dispose(): Promise<void>;
     private resolvePath;
+    private resolveWorkingDir;
+    private assertExecutionCwd;
+    private assertWritablePath;
     private getSandboxType;
 }
 /**

package/dist/sandbox/native-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/native-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEN,KAAK,YAAY,EAGjB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,MAAM,iBAAiB,GAC1B,WAAW,GACX,iBAAiB,GACjB,oBAAoB,CAAC;AAExB,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC3B;AA4QD,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,eAAe,CAAgC;gBAE3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM;IAK9C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC;;;OAGG;IACG,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,OAAO,CAAC,UAAU,CAAC;IAyEtB;;OAEG;IACG,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,YAAiB,GACxB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;OAEG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7C;;OAEG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5C;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK3C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IASxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,cAAc;CAKtB;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAclD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,GAAG,UAAU,GAAG,MAAM,CAIvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,MAAM,GACT,aAAa,CAEf"}
+{"version":3,"file":"native-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/native-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEN,KAAK,YAAY,EAGjB,MAAM,oBAAoB,CAAC;AAkB5B,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,MAAM,iBAAiB,GAC1B,WAAW,GACX,iBAAiB,GACjB,oBAAoB,CAAC;AAExB,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC3B;AAkWD,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,eAAe,CAAgC;gBAE3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM;IAK9C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC;;;OAGG;IACG,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,OAAO,CAAC,UAAU,CAAC;IA0EtB;;OAEG;IACG,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,YAAiB,GACxB,OAAO,CAAC,UAAU,CAAC;IAkEtB;;OAEG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7C;;OAEG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB7D;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5C;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK3C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,kBAAkB;IA8C1B,OAAO,CAAC,cAAc;CAKtB;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAQlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,GAAG,UAAU,GAAG,MAAM,CAIvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,MAAM,GACT,aAAa,CAEf"}