@evalops/maestro 0.10.18 → 0.10.21

package/dist/sandbox/native-sandbox.js

@@ -8,10 +8,12 @@
  * This is a TypeScript implementation that spawns sandboxed processes.
  */
 import { exec, spawn, } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, writeFileSync, } from "node:fs";
 import { platform } from "node:os";
-import { dirname, isAbsolute, join } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { isPathWithin } from "../utils/path-containment.js";
 import { resolveShellEnvironment } from "../utils/shell-env.js";
 const _execAsync = promisify(exec);
 // ─────────────────────────────────────────────────────────────
@@ -146,6 +148,25 @@ const SANDBOX_ENV_VAR = "MAESTRO_SANDBOX";
 // ─────────────────────────────────────────────────────────────
 // Helper Functions
 // ─────────────────────────────────────────────────────────────
+function getGitReadOnlySubpaths(cwd) {
+    const gitPath = join(cwd, ".git");
+    if (!existsSync(gitPath)) {
+        return [];
+    }
+    const readOnlySubpaths = [gitPath];
+    try {
+        const gitFile = readFileSync(gitPath, "utf-8");
+        const match = gitFile.match(/^gitdir:\s*(.+?)\s*$/m);
+        const gitDir = match?.[1];
+        if (gitDir) {
+            readOnlySubpaths.push(isAbsolute(gitDir) ? resolve(gitDir) : resolve(cwd, gitDir));
+        }
+    }
+    catch {
+        // .git is usually a directory; only worktree gitfiles need parsing.
+    }
+    return readOnlySubpaths;
+}
 function getWritableRootsWithCwd(policy, cwd) {
     const roots = [];
     if (policy.mode === "danger-full-access") {
@@ -170,21 +191,69 @@ function getWritableRootsWithCwd(policy, cwd) {
         }
     }
     // Add cwd with .git as read-only subpath if present
-    const gitDir = join(cwd, ".git");
-    const readOnlySubpaths = existsSync(gitDir) ? [gitDir] : [];
-    roots.push({ root: cwd, readOnlySubpaths });
-    return roots;
+    roots.push({ root: cwd, readOnlySubpaths: [] });
+    const readOnlySubpaths = getGitReadOnlySubpaths(cwd);
+    if (readOnlySubpaths.length === 0) {
+        return roots;
+    }
+    return roots.map((root) => ({
+        ...root,
+        readOnlySubpaths: readOnlySubpaths.filter((readOnlySubpath) => isPathWithin(canonicalizeForAccess(readOnlySubpath), canonicalizeForAccess(root.root))),
+    }));
 }
 function canonicalize(path) {
     // On macOS, /var is a symlink to /private/var
     try {
-        const { realpathSync } = require("node:fs");
         return realpathSync(path);
     }
     catch {
         return path;
     }
 }
+function canonicalizeForAccess(path, seen = new Set()) {
+    const resolvedPath = resolve(path);
+    const missingSegments = [];
+    let existingParent = resolvedPath;
+    while (true) {
+        try {
+            const stat = lstatSync(existingParent);
+            if (stat.isSymbolicLink()) {
+                if (seen.has(existingParent)) {
+                    return resolve(existingParent, ...missingSegments);
+                }
+                seen.add(existingParent);
+                const target = readlinkSync(existingParent);
+                const resolvedTarget = isAbsolute(target)
+                    ? target
+                    : resolve(dirname(existingParent), target);
+                return resolve(canonicalizeForAccess(resolvedTarget, seen), ...missingSegments);
+            }
+            return resolve(canonicalize(existingParent), ...missingSegments);
+        }
+        catch {
+            // Keep walking upward. Unlike existsSync, lstatSync sees dangling
+            // symlinks, so writes through them are checked against their targets.
+        }
+        const parent = dirname(existingParent);
+        if (parent === existingParent) {
+            return resolvedPath;
+        }
+        missingSegments.unshift(basename(existingParent));
+        existingParent = parent;
+    }
+}
+function canonicalizeDirectoryEntryForAccess(path) {
+    const resolvedPath = resolve(path);
+    return resolve(canonicalizeForAccess(dirname(resolvedPath)), basename(resolvedPath));
+}
+function isSymbolicLinkPath(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
 // ─────────────────────────────────────────────────────────────
 // Seatbelt Implementation (macOS)
 // ─────────────────────────────────────────────────────────────
@@ -272,7 +341,8 @@ export class NativeSandbox {
      * Implements the Sandbox interface.
      */
     async exec(command, cwd, env) {
-        const workingDir = cwd ?? this.cwd;
+        const workingDir = this.resolveWorkingDir(cwd);
+        this.assertExecutionCwd(workingDir);
         const mergedEnv = {
             ...resolveShellEnvironment(env, { workspaceDir: this.cwd }),
             [SANDBOX_ENV_VAR]: this.getSandboxType(),
@@ -283,7 +353,7 @@ export class NativeSandbox {
         return new Promise((resolve, reject) => {
             let child;
             if (platform() === "darwin") {
-                const seatbeltArgs = createSeatbeltArgs(shellCommand, this.policy, workingDir);
+                const seatbeltArgs = createSeatbeltArgs(shellCommand, this.policy, this.cwd);
                 child = spawn(SEATBELT_EXECUTABLE, seatbeltArgs, {
                     cwd: workingDir,
                     env: mergedEnv,
@@ -333,9 +403,11 @@ export class NativeSandbox {
      */
     async execWithArgs(command, args = [], options = {}) {
         const fullCommand = [command, ...args];
+        const workingDir = this.resolveWorkingDir(options.cwd);
+        this.assertExecutionCwd(workingDir);
         const mergedOptions = {
-            cwd: this.cwd,
             ...options,
+            cwd: workingDir,
             env: {
                 ...resolveShellEnvironment(options.env, {
                     workspaceDir: this.cwd,
@@ -395,6 +467,7 @@ export class NativeSandbox {
             throw new Error("Cannot write files in read-only sandbox mode");
         }
         const fullPath = this.resolvePath(path);
+        this.assertWritablePath(fullPath);
         // Ensure parent directory exists
         const dir = dirname(fullPath);
         if (!existsSync(dir)) {
@@ -424,6 +497,13 @@ export class NativeSandbox {
             throw new Error("Cannot delete files in read-only sandbox mode");
         }
         const fullPath = this.resolvePath(path);
+        const canonicalizeTarget = isSymbolicLinkPath(fullPath)
+            ? canonicalizeDirectoryEntryForAccess
+            : canonicalizeForAccess;
+        this.assertWritablePath(fullPath, {
+            blockReadOnlyDescendants: recursive ?? false,
+            canonicalizeTarget,
+        });
         rmSync(fullPath, { recursive: recursive ?? false, force: true });
     }
     async dispose() {
@@ -440,6 +520,54 @@ export class NativeSandbox {
         }
         return join(this.cwd, path);
     }
+    resolveWorkingDir(cwd) {
+        if (!cwd) {
+            return this.cwd;
+        }
+        const cwdPath = typeof cwd === "string" ? cwd : fileURLToPath(cwd);
+        if (isAbsolute(cwdPath)) {
+            return resolve(cwdPath);
+        }
+        return resolve(this.cwd, cwdPath);
+    }
+    assertExecutionCwd(workingDir) {
+        if (this.policy.mode !== "workspace-write") {
+            return;
+        }
+        const targetPath = canonicalizeForAccess(workingDir);
+        const allowedRoots = getWritableRootsWithCwd(this.policy, this.cwd).map((root) => canonicalizeForAccess(root.root));
+        if (!allowedRoots.some((root) => isPathWithin(targetPath, root))) {
+            throw new Error(`Cannot execute workspace-write command outside workspace or explicit writable roots: ${workingDir}`);
+        }
+        this.assertWritablePath(targetPath);
+    }
+    assertWritablePath(path, options) {
+        if (this.policy.mode === "danger-full-access") {
+            return;
+        }
+        const targetPath = (options?.canonicalizeTarget ?? canonicalizeForAccess)(path);
+        const writableRoots = getWritableRootsWithCwd(this.policy, this.cwd);
+        let hasMatchingWritableRoot = false;
+        let blockedByReadOnlySubpath = false;
+        for (const root of writableRoots) {
+            const rootPath = canonicalizeForAccess(root.root);
+            if (!isPathWithin(targetPath, rootPath)) {
+                continue;
+            }
+            hasMatchingWritableRoot = true;
+            if (root.readOnlySubpaths.some((readOnlySubpath) => {
+                const readOnlyPath = canonicalizeForAccess(readOnlySubpath);
+                return (isPathWithin(targetPath, readOnlyPath) ||
+                    (options?.blockReadOnlyDescendants === true &&
+                        isPathWithin(readOnlyPath, targetPath)));
+            })) {
+                blockedByReadOnlySubpath = true;
+            }
+        }
+        if (!hasMatchingWritableRoot || blockedByReadOnlySubpath) {
+            throw new Error(`Cannot write outside writable roots in ${this.policy.mode} sandbox mode: ${path}`);
+        }
+    }
     getSandboxType() {
         if (platform() === "darwin")
             return "seatbelt";
@@ -459,14 +587,7 @@ export function isNativeSandboxAvailable() {
         return existsSync(SEATBELT_EXECUTABLE);
     }
     if (platform() === "linux") {
-        try {
-            const { readFileSync } = require("node:fs");
-            const lsm = readFileSync("/sys/kernel/security/lsm", "utf-8");
-            return lsm.includes("landlock");
-        }
-        catch {
-            return false;
-        }
+        return false;
     }
     return false;
 }

package/dist/sandbox/native-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/native-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGN,IAAI,EACJ,KAAK,GACL,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,MAAM,EACN,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AA4BnC,gEAAgE;AAChE,0BAA0B;AAC1B,gEAAgE;AAEhE,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkG5B,CAAC;AAEF,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB/B,CAAC;AAEF,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,gEAAgE;AAChE,mBAAmB;AACnB,gEAAgE;AAEhE,SAAS,uBAAuB,CAC/B,MAA2B,EAC3B,GAAW;IAEX,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAE5C,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IACjC,8CAA8C;IAC9C,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,gEAAgE;AAChE,kCAAkC;AAClC,gEAAgE;AAEhE,SAAS,kBAAkB,CAC1B,OAAiB,EACjB,MAA2B,EAC3B,GAAW;IAEX,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,eAAe,GAAG,EAAE,CAAC;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1C,eAAe,GAAG,mCAAmC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAE,CAAC;YACjC,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,iBAAiB,KAAK,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YAExC,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,KAAK,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACP,MAAM,YAAY,GAAG,CAAC,oBAAoB,SAAS,KAAK,CAAC,CAAC;gBAC1D,KACC,IAAI,QAAQ,GAAG,CAAC,EAChB,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EACrC,QAAQ,EAAE,EACT,CAAC;oBACF,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAE,CAAC;oBAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;oBACrC,MAAM,OAAO,GAAG,iBAAiB,KAAK,OAAO,QAAQ,EAAE,CAAC;oBACxD,YAAY,CAAC,IAAI,CAAC,iCAAiC,OAAO,MAAM,CAAC,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,eAAe,GAAG,uBAAuB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAClE,CAAC;IACF,CAAC;IAED,oFAAoF;IACpF,MAAM,cAAc,GACnB,uDAAuD,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,oCAAoC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACzD,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,oBAAoB,KAAK,cAAc,KAAK,eAAe,KAAK,aAAa,EAAE,CAAC;IAEtG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEhC,4BAA4B;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAEtB,OAAO,IAAI,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,uBAAuB;AACvB,gEAAgE;AAEhE,MAAM,OAAO,aAAa;IAKzB,YAAY,MAA2B,EAAE,GAAW;QAF5C,oBAAe,GAAsB,IAAI,GAAG,EAAE,CAAC;QAGtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU;QACf,4CAA4C;QAC5C,IAAI,QAAQ,EAAE,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC5B,iEAAiE;YACjE,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/B,OAAO,CAAC,IAAI,CACX,8DAA8D,CAC9D,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACpE,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B;QAE5B,MAAM,UAAU,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,MAAM,SAAS,GAAG;YACjB,GAAG,uBAAuB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3D,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;QAEF,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,IAAI,KAAmB,CAAC;YAExB,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,kBAAkB,CACtC,YAAY,EACZ,IAAI,CAAC,MAAM,EACX,UAAU,CACV,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,YAAY,EAAE;oBAChD,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBACnC,iFAAiF;gBACjF,OAAO,CAAC,IAAI,CACX,uEAAuE,CACvE,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBACpC,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,uBAAuB;gBACvB,OAAO,CAAC,IAAI,CACX,6BAA6B,QAAQ,EAAE,qCAAqC,CAC5E,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBACpC,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,CAAC;oBACP,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CACjB,OAAe,EACf,OAAiB,EAAE,EACnB,UAAwB,EAAE;QAE1B,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACvC,MAAM,aAAa,GAAiB;YACnC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,OAAO;YACV,GAAG,EAAE;gBACJ,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE;oBACvC,YAAY,EAAE,IAAI,CAAC,GAAG;iBACtB,CAAC;gBACF,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE;aACxC;SACD,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,IAAI,KAAmB,CAAC;YAExB,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,kBAAkB,CACtC,WAAW,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,GAAG,CACR,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACX,uEAAuE,CACvE,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CACX,6BAA6B,QAAQ,EAAE,qCAAqC,CAC5E,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,CAAC;oBACP,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAExC,iCAAiC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAmB;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,4BAA4B;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEO,WAAW,CAAC,IAAY;QAC/B,4DAA4D;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACrB,IAAI,QAAQ,EAAE,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC/C,IAAI,QAAQ,EAAE,KAAK,OAAO;YAAE,OAAO,UAAU,CAAC;QAC9C,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED,gEAAgE;AAChE,oBAAoB;AACpB,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACvC,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;YAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IACnC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAC9C,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAA2B,EAC3B,GAAW;IAEX,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["/**\n * Native Sandboxing for Command Execution\n *\n * Provides OS-native sandboxing using:\n * - macOS: Seatbelt (sandbox-exec) with SBPL policies\n * - Linux: Landlock LSM + seccomp (via external helper or kernel APIs)\n *\n * This is a TypeScript implementation that spawns sandboxed processes.\n */\n\nimport {\n\ttype ChildProcess,\n\ttype SpawnOptions,\n\texec,\n\tspawn,\n} from \"node:child_process\";\nimport {\n\texistsSync,\n\tmkdirSync,\n\treadFileSync,\n\treaddirSync,\n\trmSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { platform } from \"node:os\";\nimport { dirname, isAbsolute, join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { resolveShellEnvironment } from \"../utils/shell-env.js\";\nimport type { ExecResult, Sandbox } from \"./types.js\";\n\nconst _execAsync = promisify(exec);\n\n// ─────────────────────────────────────────────────────────────\n// Sandbox Policy Types\n// ─────────────────────────────────────────────────────────────\n\nexport type NativeSandboxMode =\n\t| \"read-only\"\n\t| \"workspace-write\"\n\t| \"danger-full-access\";\n\nexport interface NativeSandboxPolicy {\n\tmode: NativeSandboxMode;\n\t/** Additional writable directories */\n\twritableRoots?: string[];\n\t/** Allow network access */\n\tnetworkAccess?: boolean;\n\t/** Exclude TMPDIR from writable roots */\n\texcludeTmpdir?: boolean;\n\t/** Exclude /tmp from writable roots */\n\texcludeSlashTmp?: boolean;\n}\n\nexport interface WritableRoot {\n\troot: string;\n\treadOnlySubpaths: string[];\n}\n\n// ─────────────────────────────────────────────────────────────\n// Seatbelt Policy (macOS)\n// ─────────────────────────────────────────────────────────────\n\nconst SEATBELT_BASE_POLICY = `(version 1)\n\n; start with closed-by-default\n(deny default)\n\n; child processes inherit the policy of their parent\n(allow process-exec)\n(allow process-fork)\n(allow signal (target same-sandbox))\n\n; Allow cf prefs to work.\n(allow user-preference-read)\n\n; process-info\n(allow process-info* (target same-sandbox))\n\n(allow file-write-data\n  (require-all\n    (path \"/dev/null\")\n    (vnode-type CHARACTER-DEVICE)))\n\n; sysctls permitted.\n(allow sysctl-read\n  (sysctl-name \"hw.activecpu\")\n  (sysctl-name \"hw.busfrequency_compat\")\n  (sysctl-name \"hw.byteorder\")\n  (sysctl-name \"hw.cacheconfig\")\n  (sysctl-name \"hw.cachelinesize_compat\")\n  (sysctl-name \"hw.cpufamily\")\n  (sysctl-name \"hw.cpufrequency_compat\")\n  (sysctl-name \"hw.cputype\")\n  (sysctl-name \"hw.l1dcachesize_compat\")\n  (sysctl-name \"hw.l1icachesize_compat\")\n  (sysctl-name \"hw.l2cachesize_compat\")\n  (sysctl-name \"hw.l3cachesize_compat\")\n  (sysctl-name \"hw.logicalcpu_max\")\n  (sysctl-name \"hw.machine\")\n  (sysctl-name \"hw.memsize\")\n  (sysctl-name \"hw.ncpu\")\n  (sysctl-name \"hw.nperflevels\")\n  (sysctl-name-prefix \"hw.optional.arm.\")\n  (sysctl-name-prefix \"hw.optional.armv8_\")\n  (sysctl-name \"hw.packages\")\n  (sysctl-name \"hw.pagesize_compat\")\n  (sysctl-name \"hw.pagesize\")\n  (sysctl-name \"hw.physicalcpu\")\n  (sysctl-name \"hw.physicalcpu_max\")\n  (sysctl-name \"hw.tbfrequency_compat\")\n  (sysctl-name \"hw.vectorunit\")\n  (sysctl-name \"kern.argmax\")\n  (sysctl-name \"kern.hostname\")\n  (sysctl-name \"kern.maxfilesperproc\")\n  (sysctl-name \"kern.maxproc\")\n  (sysctl-name \"kern.osproductversion\")\n  (sysctl-name \"kern.osrelease\")\n  (sysctl-name \"kern.ostype\")\n  (sysctl-name \"kern.osvariant_status\")\n  (sysctl-name \"kern.osversion\")\n  (sysctl-name \"kern.secure_kernel\")\n  (sysctl-name \"kern.usrstack64\")\n  (sysctl-name \"kern.version\")\n  (sysctl-name \"sysctl.proc_cputype\")\n  (sysctl-name \"vm.loadavg\")\n  (sysctl-name-prefix \"hw.perflevel\")\n  (sysctl-name-prefix \"kern.proc.pgrp.\")\n  (sysctl-name-prefix \"kern.proc.pid.\")\n  (sysctl-name-prefix \"net.routetable.\")\n)\n\n; Allow Java to read some CPU info.\n(allow sysctl-write\n  (sysctl-name \"kern.grade_cputype\"))\n\n; IOKit\n(allow iokit-open\n  (iokit-registry-entry-class \"RootDomainUserClient\")\n)\n\n; needed to look up user info\n(allow mach-lookup\n  (global-name \"com.apple.system.opendirectoryd.libinfo\")\n)\n\n; Needed for python multiprocessing on MacOS for the SemLock\n(allow ipc-posix-sem)\n\n(allow mach-lookup\n  (global-name \"com.apple.PowerManagement.control\")\n)\n\n; allow openpty()\n(allow pseudo-tty)\n(allow file-read* file-write* file-ioctl (literal \"/dev/ptmx\"))\n(allow file-read* file-write*\n  (require-all\n    (regex #\"^/dev/ttys[0-9]+\")\n    (extension \"com.apple.sandbox.pty\")))\n(allow file-ioctl (regex #\"^/dev/ttys[0-9]+\"))\n`;\n\nconst SEATBELT_NETWORK_POLICY = `\n; Network access policies\n(allow network-outbound)\n(allow network-inbound)\n(allow system-socket)\n\n(allow mach-lookup\n    (global-name \"com.apple.bsd.dirhelper\")\n    (global-name \"com.apple.system.opendirectoryd.membership\")\n    (global-name \"com.apple.SecurityServer\")\n    (global-name \"com.apple.networkd\")\n    (global-name \"com.apple.ocspd\")\n    (global-name \"com.apple.trustd.agent\")\n    (global-name \"com.apple.SystemConfiguration.DNSConfiguration\")\n    (global-name \"com.apple.SystemConfiguration.configd\")\n)\n\n(allow sysctl-read\n  (sysctl-name-regex #\"^net.routetable\")\n)\n\n(allow file-write*\n  (subpath (param \"DARWIN_USER_CACHE_DIR\"))\n)\n`;\n\nconst SEATBELT_EXECUTABLE = \"/usr/bin/sandbox-exec\";\nconst SANDBOX_ENV_VAR = \"MAESTRO_SANDBOX\";\n\n// ─────────────────────────────────────────────────────────────\n// Helper Functions\n// ─────────────────────────────────────────────────────────────\n\nfunction getWritableRootsWithCwd(\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): WritableRoot[] {\n\tconst roots: WritableRoot[] = [];\n\n\tif (policy.mode === \"danger-full-access\") {\n\t\treturn roots;\n\t}\n\n\tif (policy.mode === \"read-only\") {\n\t\treturn roots;\n\t}\n\n\t// Add user-specified roots\n\tfor (const root of policy.writableRoots ?? []) {\n\t\troots.push({ root, readOnlySubpaths: [] });\n\t}\n\n\t// Add /tmp unless excluded\n\tif (!policy.excludeSlashTmp) {\n\t\troots.push({ root: \"/tmp\", readOnlySubpaths: [] });\n\t}\n\n\t// Add TMPDIR unless excluded\n\tif (!policy.excludeTmpdir && process.env.TMPDIR) {\n\t\tconst tmpdir = process.env.TMPDIR;\n\t\tif (tmpdir !== \"/tmp\") {\n\t\t\troots.push({ root: tmpdir, readOnlySubpaths: [] });\n\t\t}\n\t}\n\n\t// Add cwd with .git as read-only subpath if present\n\tconst gitDir = join(cwd, \".git\");\n\tconst readOnlySubpaths = existsSync(gitDir) ? [gitDir] : [];\n\troots.push({ root: cwd, readOnlySubpaths });\n\n\treturn roots;\n}\n\nfunction canonicalize(path: string): string {\n\t// On macOS, /var is a symlink to /private/var\n\ttry {\n\t\tconst { realpathSync } = require(\"node:fs\");\n\t\treturn realpathSync(path);\n\t} catch {\n\t\treturn path;\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────\n// Seatbelt Implementation (macOS)\n// ─────────────────────────────────────────────────────────────\n\nfunction createSeatbeltArgs(\n\tcommand: string[],\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): string[] {\n\tconst params: [string, string][] = [];\n\tlet fileWritePolicy = \"\";\n\n\tif (policy.mode === \"danger-full-access\") {\n\t\tfileWritePolicy = '(allow file-write* (regex #\"^/\"))';\n\t} else {\n\t\tconst writableRoots = getWritableRootsWithCwd(policy, cwd);\n\t\tconst policies: string[] = [];\n\n\t\tfor (let index = 0; index < writableRoots.length; index++) {\n\t\t\tconst wr = writableRoots[index]!;\n\t\t\tconst canonicalRoot = canonicalize(wr.root);\n\t\t\tconst rootParam = `WRITABLE_ROOT_${index}`;\n\t\t\tparams.push([rootParam, canonicalRoot]);\n\n\t\t\tif (wr.readOnlySubpaths.length === 0) {\n\t\t\t\tpolicies.push(`(subpath (param \"${rootParam}\"))`);\n\t\t\t} else {\n\t\t\t\tconst requireParts = [`(subpath (param \"${rootParam}\"))`];\n\t\t\t\tfor (\n\t\t\t\t\tlet subIndex = 0;\n\t\t\t\t\tsubIndex < wr.readOnlySubpaths.length;\n\t\t\t\t\tsubIndex++\n\t\t\t\t) {\n\t\t\t\t\tconst ro = wr.readOnlySubpaths[subIndex]!;\n\t\t\t\t\tconst canonicalRo = canonicalize(ro);\n\t\t\t\t\tconst roParam = `WRITABLE_ROOT_${index}_RO_${subIndex}`;\n\t\t\t\t\trequireParts.push(`(require-not (subpath (param \"${roParam}\")))`);\n\t\t\t\t\tparams.push([roParam, canonicalRo]);\n\t\t\t\t}\n\t\t\t\tpolicies.push(`(require-all ${requireParts.join(\" \")} )`);\n\t\t\t}\n\t\t}\n\n\t\tif (policies.length > 0) {\n\t\t\tfileWritePolicy = `(allow file-write*\\n${policies.join(\" \")}\\n)`;\n\t\t}\n\t}\n\n\t// Always allow file reads - the difference between modes is about WRITE permissions\n\tconst fileReadPolicy =\n\t\t\"; allow read-only file operations\\n(allow file-read*)\";\n\n\tconst networkPolicy = policy.networkAccess ? SEATBELT_NETWORK_POLICY : \"\";\n\n\t// Add Darwin cache dir if available\n\tconst darwinCacheDir = process.env.DARWIN_USER_CACHE_DIR;\n\tif (darwinCacheDir) {\n\t\tparams.push([\"DARWIN_USER_CACHE_DIR\", canonicalize(darwinCacheDir)]);\n\t}\n\n\tconst fullPolicy = `${SEATBELT_BASE_POLICY}\\n${fileReadPolicy}\\n${fileWritePolicy}\\n${networkPolicy}`;\n\n\tconst args = [\"-p\", fullPolicy];\n\n\t// Add parameter definitions\n\tfor (const [key, value] of params) {\n\t\targs.push(`-D${key}=${value}`);\n\t}\n\n\targs.push(\"--\");\n\targs.push(...command);\n\n\treturn args;\n}\n\n// ─────────────────────────────────────────────────────────────\n// Native Sandbox Class\n// ─────────────────────────────────────────────────────────────\n\nexport class NativeSandbox implements Sandbox {\n\tprivate policy: NativeSandboxPolicy;\n\tprivate cwd: string;\n\tprivate activeProcesses: Set<ChildProcess> = new Set();\n\n\tconstructor(policy: NativeSandboxPolicy, cwd: string) {\n\t\tthis.policy = policy;\n\t\tthis.cwd = cwd;\n\t}\n\n\tasync initialize(): Promise<void> {\n\t\t// Verify sandbox-exec is available on macOS\n\t\tif (platform() === \"darwin\" && !existsSync(SEATBELT_EXECUTABLE)) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Seatbelt (sandbox-exec) not found at /usr/bin/sandbox-exec\",\n\t\t\t);\n\t\t}\n\n\t\t// On Linux, we would verify Landlock support here\n\t\tif (platform() === \"linux\") {\n\t\t\t// Check for Landlock support by reading /sys/kernel/security/lsm\n\t\t\ttry {\n\t\t\t\tconst lsm = readFileSync(\"/sys/kernel/security/lsm\", \"utf-8\");\n\t\t\t\tif (!lsm.includes(\"landlock\")) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\"[native-sandbox] Landlock not available on this Linux system\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\tconsole.warn(\"[native-sandbox] Could not verify Landlock support\");\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Execute a command in the sandbox.\n\t * Implements the Sandbox interface.\n\t */\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t): Promise<ExecResult> {\n\t\tconst workingDir = cwd ?? this.cwd;\n\t\tconst mergedEnv = {\n\t\t\t...resolveShellEnvironment(env, { workspaceDir: this.cwd }),\n\t\t\t[SANDBOX_ENV_VAR]: this.getSandboxType(),\n\t\t};\n\n\t\t// For the Sandbox interface, command is a full shell command string\n\t\t// We need to wrap it in a shell\n\t\tconst shellCommand = [\"sh\", \"-c\", command];\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tlet child: ChildProcess;\n\n\t\t\tif (platform() === \"darwin\") {\n\t\t\t\tconst seatbeltArgs = createSeatbeltArgs(\n\t\t\t\t\tshellCommand,\n\t\t\t\t\tthis.policy,\n\t\t\t\t\tworkingDir,\n\t\t\t\t);\n\t\t\t\tchild = spawn(SEATBELT_EXECUTABLE, seatbeltArgs, {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t} else if (platform() === \"linux\") {\n\t\t\t\t// On Linux, spawn directly (Landlock would need kernel support or helper binary)\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[native-sandbox] Linux native sandbox requires Landlock helper binary\",\n\t\t\t\t);\n\t\t\t\tchild = spawn(\"sh\", [\"-c\", command], {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\t// Unsupported platform\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[native-sandbox] Platform ${platform()} not supported, running unsandboxed`,\n\t\t\t\t);\n\t\t\t\tchild = spawn(\"sh\", [\"-c\", command], {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tthis.activeProcesses.add(child);\n\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstdout += data.toString();\n\t\t\t});\n\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstderr += data.toString();\n\t\t\t});\n\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\tresolve({\n\t\t\t\t\tstdout,\n\t\t\t\t\tstderr,\n\t\t\t\t\texitCode: code ?? 0,\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\treject(error);\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Execute a command with explicit args (internal use).\n\t */\n\tasync execWithArgs(\n\t\tcommand: string,\n\t\targs: string[] = [],\n\t\toptions: SpawnOptions = {},\n\t): Promise<ExecResult> {\n\t\tconst fullCommand = [command, ...args];\n\t\tconst mergedOptions: SpawnOptions = {\n\t\t\tcwd: this.cwd,\n\t\t\t...options,\n\t\t\tenv: {\n\t\t\t\t...resolveShellEnvironment(options.env, {\n\t\t\t\t\tworkspaceDir: this.cwd,\n\t\t\t\t}),\n\t\t\t\t[SANDBOX_ENV_VAR]: this.getSandboxType(),\n\t\t\t},\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tlet child: ChildProcess;\n\n\t\t\tif (platform() === \"darwin\") {\n\t\t\t\tconst seatbeltArgs = createSeatbeltArgs(\n\t\t\t\t\tfullCommand,\n\t\t\t\t\tthis.policy,\n\t\t\t\t\tthis.cwd,\n\t\t\t\t);\n\t\t\t\tchild = spawn(SEATBELT_EXECUTABLE, seatbeltArgs, mergedOptions);\n\t\t\t} else if (platform() === \"linux\") {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[native-sandbox] Linux native sandbox requires Landlock helper binary\",\n\t\t\t\t);\n\t\t\t\tchild = spawn(command, args, mergedOptions);\n\t\t\t} else {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[native-sandbox] Platform ${platform()} not supported, running unsandboxed`,\n\t\t\t\t);\n\t\t\t\tchild = spawn(command, args, mergedOptions);\n\t\t\t}\n\n\t\t\tthis.activeProcesses.add(child);\n\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstdout += data.toString();\n\t\t\t});\n\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstderr += data.toString();\n\t\t\t});\n\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\tresolve({\n\t\t\t\t\tstdout,\n\t\t\t\t\tstderr,\n\t\t\t\t\texitCode: code ?? 0,\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\treject(error);\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Read a file from the sandbox.\n\t */\n\tasync readFile(path: string): Promise<string> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn readFileSync(fullPath, \"utf-8\");\n\t}\n\n\t/**\n\t * Write a file to the sandbox.\n\t */\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\tif (this.policy.mode === \"read-only\") {\n\t\t\tthrow new Error(\"Cannot write files in read-only sandbox mode\");\n\t\t}\n\n\t\tconst fullPath = this.resolvePath(path);\n\n\t\t// Ensure parent directory exists\n\t\tconst dir = dirname(fullPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true });\n\t\t}\n\n\t\twriteFileSync(fullPath, content, \"utf-8\");\n\t}\n\n\t/**\n\t * Check if a file exists.\n\t */\n\tasync exists(path: string): Promise<boolean> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn existsSync(fullPath);\n\t}\n\n\t/**\n\t * List files in a directory.\n\t */\n\tasync list(path: string): Promise<string[]> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn readdirSync(fullPath);\n\t}\n\n\t/**\n\t * Delete a file or directory.\n\t */\n\tasync delete(path: string, recursive?: boolean): Promise<void> {\n\t\tif (this.policy.mode === \"read-only\") {\n\t\t\tthrow new Error(\"Cannot delete files in read-only sandbox mode\");\n\t\t}\n\n\t\tconst fullPath = this.resolvePath(path);\n\t\trmSync(fullPath, { recursive: recursive ?? false, force: true });\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\t// Kill any active processes\n\t\tfor (const proc of this.activeProcesses) {\n\t\t\tproc.kill(\"SIGTERM\");\n\t\t}\n\t\tthis.activeProcesses.clear();\n\t}\n\n\tprivate resolvePath(path: string): string {\n\t\t// If absolute, use as-is; otherwise resolve relative to cwd\n\t\tif (isAbsolute(path)) {\n\t\t\treturn path;\n\t\t}\n\t\treturn join(this.cwd, path);\n\t}\n\n\tprivate getSandboxType(): string {\n\t\tif (platform() === \"darwin\") return \"seatbelt\";\n\t\tif (platform() === \"linux\") return \"landlock\";\n\t\treturn \"none\";\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────\n// Factory Functions\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Check if native sandboxing is available on this platform.\n */\nexport function isNativeSandboxAvailable(): boolean {\n\tif (platform() === \"darwin\") {\n\t\treturn existsSync(SEATBELT_EXECUTABLE);\n\t}\n\tif (platform() === \"linux\") {\n\t\ttry {\n\t\t\tconst { readFileSync } = require(\"node:fs\");\n\t\t\tconst lsm = readFileSync(\"/sys/kernel/security/lsm\", \"utf-8\");\n\t\t\treturn lsm.includes(\"landlock\");\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn false;\n}\n\n/**\n * Get the native sandbox type for the current platform.\n */\nexport function getNativeSandboxType(): \"seatbelt\" | \"landlock\" | \"none\" {\n\tif (platform() === \"darwin\") return \"seatbelt\";\n\tif (platform() === \"linux\") return \"landlock\";\n\treturn \"none\";\n}\n\n/**\n * Create a native sandbox instance.\n */\nexport function createNativeSandbox(\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): NativeSandbox {\n\treturn new NativeSandbox(policy, cwd);\n}\n"]}
+{"version":3,"file":"native-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/native-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGN,IAAI,EACJ,KAAK,GACL,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,UAAU,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AA4BnC,gEAAgE;AAChE,0BAA0B;AAC1B,gEAAgE;AAEhE,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkG5B,CAAC;AAEF,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB/B,CAAC;AAEF,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,gEAAgE;AAChE,mBAAmB;AACnB,gEAAgE;AAEhE,SAAS,sBAAsB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,EAAE,CAAC;YACZ,gBAAgB,CAAC,IAAI,CACpB,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAC3D,CAAC;QACH,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAA2B,EAC3B,GAAW;IAEX,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,GAAG,IAAI;QACP,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,EAAE,CAC7D,YAAY,CACX,qBAAqB,CAAC,eAAe,CAAC,EACtC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAChC,CACD;KACD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IACjC,8CAA8C;IAC9C,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAO,IAAI,GAAG,EAAU;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,cAAc,GAAG,YAAY,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC9B,OAAO,OAAO,CAAC,cAAc,EAAE,GAAG,eAAe,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzB,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;oBACxC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC5C,OAAO,OAAO,CACb,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC,EAC3C,GAAG,eAAe,CAClB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,GAAG,eAAe,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;YAClE,sEAAsE;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,cAAc,GAAG,MAAM,CAAC;IACzB,CAAC;AACF,CAAC;AAED,SAAS,mCAAmC,CAAC,IAAY;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,OAAO,CACb,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAC5C,QAAQ,CAAC,YAAY,CAAC,CACtB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,gEAAgE;AAChE,kCAAkC;AAClC,gEAAgE;AAEhE,SAAS,kBAAkB,CAC1B,OAAiB,EACjB,MAA2B,EAC3B,GAAW;IAEX,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,eAAe,GAAG,EAAE,CAAC;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1C,eAAe,GAAG,mCAAmC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAE,CAAC;YACjC,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,iBAAiB,KAAK,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YAExC,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,KAAK,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACP,MAAM,YAAY,GAAG,CAAC,oBAAoB,SAAS,KAAK,CAAC,CAAC;gBAC1D,KACC,IAAI,QAAQ,GAAG,CAAC,EAChB,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EACrC,QAAQ,EAAE,EACT,CAAC;oBACF,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAE,CAAC;oBAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;oBACrC,MAAM,OAAO,GAAG,iBAAiB,KAAK,OAAO,QAAQ,EAAE,CAAC;oBACxD,YAAY,CAAC,IAAI,CAAC,iCAAiC,OAAO,MAAM,CAAC,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,eAAe,GAAG,uBAAuB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAClE,CAAC;IACF,CAAC;IAED,oFAAoF;IACpF,MAAM,cAAc,GACnB,uDAAuD,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,oCAAoC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACzD,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,oBAAoB,KAAK,cAAc,KAAK,eAAe,KAAK,aAAa,EAAE,CAAC;IAEtG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEhC,4BAA4B;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAEtB,OAAO,IAAI,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,uBAAuB;AACvB,gEAAgE;AAEhE,MAAM,OAAO,aAAa;IAKzB,YAAY,MAA2B,EAAE,GAAW;QAF5C,oBAAe,GAAsB,IAAI,GAAG,EAAE,CAAC;QAGtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU;QACf,4CAA4C;QAC5C,IAAI,QAAQ,EAAE,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC5B,iEAAiE;YACjE,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/B,OAAO,CAAC,IAAI,CACX,8DAA8D,CAC9D,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACpE,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B;QAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG;YACjB,GAAG,uBAAuB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3D,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;QAEF,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,IAAI,KAAmB,CAAC;YAExB,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,kBAAkB,CACtC,YAAY,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,GAAG,CACR,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,YAAY,EAAE;oBAChD,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBACnC,iFAAiF;gBACjF,OAAO,CAAC,IAAI,CACX,uEAAuE,CACvE,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBACpC,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,uBAAuB;gBACvB,OAAO,CAAC,IAAI,CACX,6BAA6B,QAAQ,EAAE,qCAAqC,CAC5E,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBACpC,GAAG,EAAE,UAAU;oBACf,GAAG,EAAE,SAAS;iBACd,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,CAAC;oBACP,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CACjB,OAAe,EACf,OAAiB,EAAE,EACnB,UAAwB,EAAE;QAE1B,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,aAAa,GAAiB;YACnC,GAAG,OAAO;YACV,GAAG,EAAE,UAAU;YACf,GAAG,EAAE;gBACJ,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE;oBACvC,YAAY,EAAE,IAAI,CAAC,GAAG;iBACtB,CAAC;gBACF,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE;aACxC;SACD,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,IAAI,KAAmB,CAAC;YAExB,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,kBAAkB,CACtC,WAAW,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,GAAG,CACR,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACX,uEAAuE,CACvE,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CACX,6BAA6B,QAAQ,EAAE,qCAAqC,CAC5E,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,CAAC;oBACP,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAElC,iCAAiC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAmB;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,CAAC;YACtD,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,qBAAqB,CAAC;QACzB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACjC,wBAAwB,EAAE,SAAS,IAAI,KAAK;YAC5C,kBAAkB;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,4BAA4B;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEO,WAAW,CAAC,IAAY;QAC/B,4DAA4D;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,iBAAiB,CAAC,GAAkB;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,GAAG,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAEO,kBAAkB,CAAC,UAAkB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CACtE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACd,wFAAwF,UAAU,EAAE,CACpG,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAEO,kBAAkB,CACzB,IAAY,EACZ,OAGC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/C,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,CAAC,CACxE,IAAI,CACJ,CAAC;QACF,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzC,SAAS;YACV,CAAC;YAED,uBAAuB,GAAG,IAAI,CAAC;YAC/B,IACC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE;gBAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;gBAC5D,OAAO,CACN,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;oBACtC,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI;wBAC1C,YAAY,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CACxC,CAAC;YACH,CAAC,CAAC,EACD,CAAC;gBACF,wBAAwB,GAAG,IAAI,CAAC;YACjC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,uBAAuB,IAAI,wBAAwB,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACd,0CAA0C,IAAI,CAAC,MAAM,CAAC,IAAI,kBAAkB,IAAI,EAAE,CAClF,CAAC;QACH,CAAC;IACF,CAAC;IAEO,cAAc;QACrB,IAAI,QAAQ,EAAE,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC/C,IAAI,QAAQ,EAAE,KAAK,OAAO;YAAE,OAAO,UAAU,CAAC;QAC9C,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED,gEAAgE;AAChE,oBAAoB;AACpB,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACvC,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IACnC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAC9C,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAA2B,EAC3B,GAAW;IAEX,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["/**\n * Native Sandboxing for Command Execution\n *\n * Provides OS-native sandboxing using:\n * - macOS: Seatbelt (sandbox-exec) with SBPL policies\n * - Linux: Landlock LSM + seccomp (via external helper or kernel APIs)\n *\n * This is a TypeScript implementation that spawns sandboxed processes.\n */\n\nimport {\n\ttype ChildProcess,\n\ttype SpawnOptions,\n\texec,\n\tspawn,\n} from \"node:child_process\";\nimport {\n\texistsSync,\n\tlstatSync,\n\tmkdirSync,\n\treadFileSync,\n\treaddirSync,\n\treadlinkSync,\n\trealpathSync,\n\trmSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { platform } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { promisify } from \"node:util\";\nimport { isPathWithin } from \"../utils/path-containment.js\";\nimport { resolveShellEnvironment } from \"../utils/shell-env.js\";\nimport type { ExecResult, Sandbox } from \"./types.js\";\n\nconst _execAsync = promisify(exec);\n\n// ─────────────────────────────────────────────────────────────\n// Sandbox Policy Types\n// ─────────────────────────────────────────────────────────────\n\nexport type NativeSandboxMode =\n\t| \"read-only\"\n\t| \"workspace-write\"\n\t| \"danger-full-access\";\n\nexport interface NativeSandboxPolicy {\n\tmode: NativeSandboxMode;\n\t/** Additional writable directories */\n\twritableRoots?: string[];\n\t/** Allow network access */\n\tnetworkAccess?: boolean;\n\t/** Exclude TMPDIR from writable roots */\n\texcludeTmpdir?: boolean;\n\t/** Exclude /tmp from writable roots */\n\texcludeSlashTmp?: boolean;\n}\n\nexport interface WritableRoot {\n\troot: string;\n\treadOnlySubpaths: string[];\n}\n\n// ─────────────────────────────────────────────────────────────\n// Seatbelt Policy (macOS)\n// ─────────────────────────────────────────────────────────────\n\nconst SEATBELT_BASE_POLICY = `(version 1)\n\n; start with closed-by-default\n(deny default)\n\n; child processes inherit the policy of their parent\n(allow process-exec)\n(allow process-fork)\n(allow signal (target same-sandbox))\n\n; Allow cf prefs to work.\n(allow user-preference-read)\n\n; process-info\n(allow process-info* (target same-sandbox))\n\n(allow file-write-data\n  (require-all\n    (path \"/dev/null\")\n    (vnode-type CHARACTER-DEVICE)))\n\n; sysctls permitted.\n(allow sysctl-read\n  (sysctl-name \"hw.activecpu\")\n  (sysctl-name \"hw.busfrequency_compat\")\n  (sysctl-name \"hw.byteorder\")\n  (sysctl-name \"hw.cacheconfig\")\n  (sysctl-name \"hw.cachelinesize_compat\")\n  (sysctl-name \"hw.cpufamily\")\n  (sysctl-name \"hw.cpufrequency_compat\")\n  (sysctl-name \"hw.cputype\")\n  (sysctl-name \"hw.l1dcachesize_compat\")\n  (sysctl-name \"hw.l1icachesize_compat\")\n  (sysctl-name \"hw.l2cachesize_compat\")\n  (sysctl-name \"hw.l3cachesize_compat\")\n  (sysctl-name \"hw.logicalcpu_max\")\n  (sysctl-name \"hw.machine\")\n  (sysctl-name \"hw.memsize\")\n  (sysctl-name \"hw.ncpu\")\n  (sysctl-name \"hw.nperflevels\")\n  (sysctl-name-prefix \"hw.optional.arm.\")\n  (sysctl-name-prefix \"hw.optional.armv8_\")\n  (sysctl-name \"hw.packages\")\n  (sysctl-name \"hw.pagesize_compat\")\n  (sysctl-name \"hw.pagesize\")\n  (sysctl-name \"hw.physicalcpu\")\n  (sysctl-name \"hw.physicalcpu_max\")\n  (sysctl-name \"hw.tbfrequency_compat\")\n  (sysctl-name \"hw.vectorunit\")\n  (sysctl-name \"kern.argmax\")\n  (sysctl-name \"kern.hostname\")\n  (sysctl-name \"kern.maxfilesperproc\")\n  (sysctl-name \"kern.maxproc\")\n  (sysctl-name \"kern.osproductversion\")\n  (sysctl-name \"kern.osrelease\")\n  (sysctl-name \"kern.ostype\")\n  (sysctl-name \"kern.osvariant_status\")\n  (sysctl-name \"kern.osversion\")\n  (sysctl-name \"kern.secure_kernel\")\n  (sysctl-name \"kern.usrstack64\")\n  (sysctl-name \"kern.version\")\n  (sysctl-name \"sysctl.proc_cputype\")\n  (sysctl-name \"vm.loadavg\")\n  (sysctl-name-prefix \"hw.perflevel\")\n  (sysctl-name-prefix \"kern.proc.pgrp.\")\n  (sysctl-name-prefix \"kern.proc.pid.\")\n  (sysctl-name-prefix \"net.routetable.\")\n)\n\n; Allow Java to read some CPU info.\n(allow sysctl-write\n  (sysctl-name \"kern.grade_cputype\"))\n\n; IOKit\n(allow iokit-open\n  (iokit-registry-entry-class \"RootDomainUserClient\")\n)\n\n; needed to look up user info\n(allow mach-lookup\n  (global-name \"com.apple.system.opendirectoryd.libinfo\")\n)\n\n; Needed for python multiprocessing on MacOS for the SemLock\n(allow ipc-posix-sem)\n\n(allow mach-lookup\n  (global-name \"com.apple.PowerManagement.control\")\n)\n\n; allow openpty()\n(allow pseudo-tty)\n(allow file-read* file-write* file-ioctl (literal \"/dev/ptmx\"))\n(allow file-read* file-write*\n  (require-all\n    (regex #\"^/dev/ttys[0-9]+\")\n    (extension \"com.apple.sandbox.pty\")))\n(allow file-ioctl (regex #\"^/dev/ttys[0-9]+\"))\n`;\n\nconst SEATBELT_NETWORK_POLICY = `\n; Network access policies\n(allow network-outbound)\n(allow network-inbound)\n(allow system-socket)\n\n(allow mach-lookup\n    (global-name \"com.apple.bsd.dirhelper\")\n    (global-name \"com.apple.system.opendirectoryd.membership\")\n    (global-name \"com.apple.SecurityServer\")\n    (global-name \"com.apple.networkd\")\n    (global-name \"com.apple.ocspd\")\n    (global-name \"com.apple.trustd.agent\")\n    (global-name \"com.apple.SystemConfiguration.DNSConfiguration\")\n    (global-name \"com.apple.SystemConfiguration.configd\")\n)\n\n(allow sysctl-read\n  (sysctl-name-regex #\"^net.routetable\")\n)\n\n(allow file-write*\n  (subpath (param \"DARWIN_USER_CACHE_DIR\"))\n)\n`;\n\nconst SEATBELT_EXECUTABLE = \"/usr/bin/sandbox-exec\";\nconst SANDBOX_ENV_VAR = \"MAESTRO_SANDBOX\";\n\n// ─────────────────────────────────────────────────────────────\n// Helper Functions\n// ─────────────────────────────────────────────────────────────\n\nfunction getGitReadOnlySubpaths(cwd: string): string[] {\n\tconst gitPath = join(cwd, \".git\");\n\tif (!existsSync(gitPath)) {\n\t\treturn [];\n\t}\n\n\tconst readOnlySubpaths = [gitPath];\n\ttry {\n\t\tconst gitFile = readFileSync(gitPath, \"utf-8\");\n\t\tconst match = gitFile.match(/^gitdir:\\s*(.+?)\\s*$/m);\n\t\tconst gitDir = match?.[1];\n\t\tif (gitDir) {\n\t\t\treadOnlySubpaths.push(\n\t\t\t\tisAbsolute(gitDir) ? resolve(gitDir) : resolve(cwd, gitDir),\n\t\t\t);\n\t\t}\n\t} catch {\n\t\t// .git is usually a directory; only worktree gitfiles need parsing.\n\t}\n\n\treturn readOnlySubpaths;\n}\n\nfunction getWritableRootsWithCwd(\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): WritableRoot[] {\n\tconst roots: WritableRoot[] = [];\n\n\tif (policy.mode === \"danger-full-access\") {\n\t\treturn roots;\n\t}\n\n\tif (policy.mode === \"read-only\") {\n\t\treturn roots;\n\t}\n\n\t// Add user-specified roots\n\tfor (const root of policy.writableRoots ?? []) {\n\t\troots.push({ root, readOnlySubpaths: [] });\n\t}\n\n\t// Add /tmp unless excluded\n\tif (!policy.excludeSlashTmp) {\n\t\troots.push({ root: \"/tmp\", readOnlySubpaths: [] });\n\t}\n\n\t// Add TMPDIR unless excluded\n\tif (!policy.excludeTmpdir && process.env.TMPDIR) {\n\t\tconst tmpdir = process.env.TMPDIR;\n\t\tif (tmpdir !== \"/tmp\") {\n\t\t\troots.push({ root: tmpdir, readOnlySubpaths: [] });\n\t\t}\n\t}\n\n\t// Add cwd with .git as read-only subpath if present\n\troots.push({ root: cwd, readOnlySubpaths: [] });\n\n\tconst readOnlySubpaths = getGitReadOnlySubpaths(cwd);\n\tif (readOnlySubpaths.length === 0) {\n\t\treturn roots;\n\t}\n\n\treturn roots.map((root) => ({\n\t\t...root,\n\t\treadOnlySubpaths: readOnlySubpaths.filter((readOnlySubpath) =>\n\t\t\tisPathWithin(\n\t\t\t\tcanonicalizeForAccess(readOnlySubpath),\n\t\t\t\tcanonicalizeForAccess(root.root),\n\t\t\t),\n\t\t),\n\t}));\n}\n\nfunction canonicalize(path: string): string {\n\t// On macOS, /var is a symlink to /private/var\n\ttry {\n\t\treturn realpathSync(path);\n\t} catch {\n\t\treturn path;\n\t}\n}\n\nfunction canonicalizeForAccess(path: string, seen = new Set<string>()): string {\n\tconst resolvedPath = resolve(path);\n\tconst missingSegments: string[] = [];\n\tlet existingParent = resolvedPath;\n\n\twhile (true) {\n\t\ttry {\n\t\t\tconst stat = lstatSync(existingParent);\n\t\t\tif (stat.isSymbolicLink()) {\n\t\t\t\tif (seen.has(existingParent)) {\n\t\t\t\t\treturn resolve(existingParent, ...missingSegments);\n\t\t\t\t}\n\t\t\t\tseen.add(existingParent);\n\t\t\t\tconst target = readlinkSync(existingParent);\n\t\t\t\tconst resolvedTarget = isAbsolute(target)\n\t\t\t\t\t? target\n\t\t\t\t\t: resolve(dirname(existingParent), target);\n\t\t\t\treturn resolve(\n\t\t\t\t\tcanonicalizeForAccess(resolvedTarget, seen),\n\t\t\t\t\t...missingSegments,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn resolve(canonicalize(existingParent), ...missingSegments);\n\t\t} catch {\n\t\t\t// Keep walking upward. Unlike existsSync, lstatSync sees dangling\n\t\t\t// symlinks, so writes through them are checked against their targets.\n\t\t}\n\n\t\tconst parent = dirname(existingParent);\n\t\tif (parent === existingParent) {\n\t\t\treturn resolvedPath;\n\t\t}\n\t\tmissingSegments.unshift(basename(existingParent));\n\t\texistingParent = parent;\n\t}\n}\n\nfunction canonicalizeDirectoryEntryForAccess(path: string): string {\n\tconst resolvedPath = resolve(path);\n\treturn resolve(\n\t\tcanonicalizeForAccess(dirname(resolvedPath)),\n\t\tbasename(resolvedPath),\n\t);\n}\n\nfunction isSymbolicLinkPath(path: string): boolean {\n\ttry {\n\t\treturn lstatSync(path).isSymbolicLink();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────\n// Seatbelt Implementation (macOS)\n// ─────────────────────────────────────────────────────────────\n\nfunction createSeatbeltArgs(\n\tcommand: string[],\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): string[] {\n\tconst params: [string, string][] = [];\n\tlet fileWritePolicy = \"\";\n\n\tif (policy.mode === \"danger-full-access\") {\n\t\tfileWritePolicy = '(allow file-write* (regex #\"^/\"))';\n\t} else {\n\t\tconst writableRoots = getWritableRootsWithCwd(policy, cwd);\n\t\tconst policies: string[] = [];\n\n\t\tfor (let index = 0; index < writableRoots.length; index++) {\n\t\t\tconst wr = writableRoots[index]!;\n\t\t\tconst canonicalRoot = canonicalize(wr.root);\n\t\t\tconst rootParam = `WRITABLE_ROOT_${index}`;\n\t\t\tparams.push([rootParam, canonicalRoot]);\n\n\t\t\tif (wr.readOnlySubpaths.length === 0) {\n\t\t\t\tpolicies.push(`(subpath (param \"${rootParam}\"))`);\n\t\t\t} else {\n\t\t\t\tconst requireParts = [`(subpath (param \"${rootParam}\"))`];\n\t\t\t\tfor (\n\t\t\t\t\tlet subIndex = 0;\n\t\t\t\t\tsubIndex < wr.readOnlySubpaths.length;\n\t\t\t\t\tsubIndex++\n\t\t\t\t) {\n\t\t\t\t\tconst ro = wr.readOnlySubpaths[subIndex]!;\n\t\t\t\t\tconst canonicalRo = canonicalize(ro);\n\t\t\t\t\tconst roParam = `WRITABLE_ROOT_${index}_RO_${subIndex}`;\n\t\t\t\t\trequireParts.push(`(require-not (subpath (param \"${roParam}\")))`);\n\t\t\t\t\tparams.push([roParam, canonicalRo]);\n\t\t\t\t}\n\t\t\t\tpolicies.push(`(require-all ${requireParts.join(\" \")} )`);\n\t\t\t}\n\t\t}\n\n\t\tif (policies.length > 0) {\n\t\t\tfileWritePolicy = `(allow file-write*\\n${policies.join(\" \")}\\n)`;\n\t\t}\n\t}\n\n\t// Always allow file reads - the difference between modes is about WRITE permissions\n\tconst fileReadPolicy =\n\t\t\"; allow read-only file operations\\n(allow file-read*)\";\n\n\tconst networkPolicy = policy.networkAccess ? SEATBELT_NETWORK_POLICY : \"\";\n\n\t// Add Darwin cache dir if available\n\tconst darwinCacheDir = process.env.DARWIN_USER_CACHE_DIR;\n\tif (darwinCacheDir) {\n\t\tparams.push([\"DARWIN_USER_CACHE_DIR\", canonicalize(darwinCacheDir)]);\n\t}\n\n\tconst fullPolicy = `${SEATBELT_BASE_POLICY}\\n${fileReadPolicy}\\n${fileWritePolicy}\\n${networkPolicy}`;\n\n\tconst args = [\"-p\", fullPolicy];\n\n\t// Add parameter definitions\n\tfor (const [key, value] of params) {\n\t\targs.push(`-D${key}=${value}`);\n\t}\n\n\targs.push(\"--\");\n\targs.push(...command);\n\n\treturn args;\n}\n\n// ─────────────────────────────────────────────────────────────\n// Native Sandbox Class\n// ─────────────────────────────────────────────────────────────\n\nexport class NativeSandbox implements Sandbox {\n\tprivate policy: NativeSandboxPolicy;\n\tprivate cwd: string;\n\tprivate activeProcesses: Set<ChildProcess> = new Set();\n\n\tconstructor(policy: NativeSandboxPolicy, cwd: string) {\n\t\tthis.policy = policy;\n\t\tthis.cwd = cwd;\n\t}\n\n\tasync initialize(): Promise<void> {\n\t\t// Verify sandbox-exec is available on macOS\n\t\tif (platform() === \"darwin\" && !existsSync(SEATBELT_EXECUTABLE)) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Seatbelt (sandbox-exec) not found at /usr/bin/sandbox-exec\",\n\t\t\t);\n\t\t}\n\n\t\t// On Linux, we would verify Landlock support here\n\t\tif (platform() === \"linux\") {\n\t\t\t// Check for Landlock support by reading /sys/kernel/security/lsm\n\t\t\ttry {\n\t\t\t\tconst lsm = readFileSync(\"/sys/kernel/security/lsm\", \"utf-8\");\n\t\t\t\tif (!lsm.includes(\"landlock\")) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\"[native-sandbox] Landlock not available on this Linux system\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\tconsole.warn(\"[native-sandbox] Could not verify Landlock support\");\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Execute a command in the sandbox.\n\t * Implements the Sandbox interface.\n\t */\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t): Promise<ExecResult> {\n\t\tconst workingDir = this.resolveWorkingDir(cwd);\n\t\tthis.assertExecutionCwd(workingDir);\n\t\tconst mergedEnv = {\n\t\t\t...resolveShellEnvironment(env, { workspaceDir: this.cwd }),\n\t\t\t[SANDBOX_ENV_VAR]: this.getSandboxType(),\n\t\t};\n\n\t\t// For the Sandbox interface, command is a full shell command string\n\t\t// We need to wrap it in a shell\n\t\tconst shellCommand = [\"sh\", \"-c\", command];\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tlet child: ChildProcess;\n\n\t\t\tif (platform() === \"darwin\") {\n\t\t\t\tconst seatbeltArgs = createSeatbeltArgs(\n\t\t\t\t\tshellCommand,\n\t\t\t\t\tthis.policy,\n\t\t\t\t\tthis.cwd,\n\t\t\t\t);\n\t\t\t\tchild = spawn(SEATBELT_EXECUTABLE, seatbeltArgs, {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t} else if (platform() === \"linux\") {\n\t\t\t\t// On Linux, spawn directly (Landlock would need kernel support or helper binary)\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[native-sandbox] Linux native sandbox requires Landlock helper binary\",\n\t\t\t\t);\n\t\t\t\tchild = spawn(\"sh\", [\"-c\", command], {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\t// Unsupported platform\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[native-sandbox] Platform ${platform()} not supported, running unsandboxed`,\n\t\t\t\t);\n\t\t\t\tchild = spawn(\"sh\", [\"-c\", command], {\n\t\t\t\t\tcwd: workingDir,\n\t\t\t\t\tenv: mergedEnv,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tthis.activeProcesses.add(child);\n\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstdout += data.toString();\n\t\t\t});\n\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstderr += data.toString();\n\t\t\t});\n\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\tresolve({\n\t\t\t\t\tstdout,\n\t\t\t\t\tstderr,\n\t\t\t\t\texitCode: code ?? 0,\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\treject(error);\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Execute a command with explicit args (internal use).\n\t */\n\tasync execWithArgs(\n\t\tcommand: string,\n\t\targs: string[] = [],\n\t\toptions: SpawnOptions = {},\n\t): Promise<ExecResult> {\n\t\tconst fullCommand = [command, ...args];\n\t\tconst workingDir = this.resolveWorkingDir(options.cwd);\n\t\tthis.assertExecutionCwd(workingDir);\n\t\tconst mergedOptions: SpawnOptions = {\n\t\t\t...options,\n\t\t\tcwd: workingDir,\n\t\t\tenv: {\n\t\t\t\t...resolveShellEnvironment(options.env, {\n\t\t\t\t\tworkspaceDir: this.cwd,\n\t\t\t\t}),\n\t\t\t\t[SANDBOX_ENV_VAR]: this.getSandboxType(),\n\t\t\t},\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tlet child: ChildProcess;\n\n\t\t\tif (platform() === \"darwin\") {\n\t\t\t\tconst seatbeltArgs = createSeatbeltArgs(\n\t\t\t\t\tfullCommand,\n\t\t\t\t\tthis.policy,\n\t\t\t\t\tthis.cwd,\n\t\t\t\t);\n\t\t\t\tchild = spawn(SEATBELT_EXECUTABLE, seatbeltArgs, mergedOptions);\n\t\t\t} else if (platform() === \"linux\") {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t\"[native-sandbox] Linux native sandbox requires Landlock helper binary\",\n\t\t\t\t);\n\t\t\t\tchild = spawn(command, args, mergedOptions);\n\t\t\t} else {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[native-sandbox] Platform ${platform()} not supported, running unsandboxed`,\n\t\t\t\t);\n\t\t\t\tchild = spawn(command, args, mergedOptions);\n\t\t\t}\n\n\t\t\tthis.activeProcesses.add(child);\n\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstdout += data.toString();\n\t\t\t});\n\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tstderr += data.toString();\n\t\t\t});\n\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\tresolve({\n\t\t\t\t\tstdout,\n\t\t\t\t\tstderr,\n\t\t\t\t\texitCode: code ?? 0,\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tthis.activeProcesses.delete(child);\n\t\t\t\treject(error);\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Read a file from the sandbox.\n\t */\n\tasync readFile(path: string): Promise<string> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn readFileSync(fullPath, \"utf-8\");\n\t}\n\n\t/**\n\t * Write a file to the sandbox.\n\t */\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\tif (this.policy.mode === \"read-only\") {\n\t\t\tthrow new Error(\"Cannot write files in read-only sandbox mode\");\n\t\t}\n\n\t\tconst fullPath = this.resolvePath(path);\n\t\tthis.assertWritablePath(fullPath);\n\n\t\t// Ensure parent directory exists\n\t\tconst dir = dirname(fullPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true });\n\t\t}\n\n\t\twriteFileSync(fullPath, content, \"utf-8\");\n\t}\n\n\t/**\n\t * Check if a file exists.\n\t */\n\tasync exists(path: string): Promise<boolean> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn existsSync(fullPath);\n\t}\n\n\t/**\n\t * List files in a directory.\n\t */\n\tasync list(path: string): Promise<string[]> {\n\t\tconst fullPath = this.resolvePath(path);\n\t\treturn readdirSync(fullPath);\n\t}\n\n\t/**\n\t * Delete a file or directory.\n\t */\n\tasync delete(path: string, recursive?: boolean): Promise<void> {\n\t\tif (this.policy.mode === \"read-only\") {\n\t\t\tthrow new Error(\"Cannot delete files in read-only sandbox mode\");\n\t\t}\n\n\t\tconst fullPath = this.resolvePath(path);\n\t\tconst canonicalizeTarget = isSymbolicLinkPath(fullPath)\n\t\t\t? canonicalizeDirectoryEntryForAccess\n\t\t\t: canonicalizeForAccess;\n\t\tthis.assertWritablePath(fullPath, {\n\t\t\tblockReadOnlyDescendants: recursive ?? false,\n\t\t\tcanonicalizeTarget,\n\t\t});\n\t\trmSync(fullPath, { recursive: recursive ?? false, force: true });\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\t// Kill any active processes\n\t\tfor (const proc of this.activeProcesses) {\n\t\t\tproc.kill(\"SIGTERM\");\n\t\t}\n\t\tthis.activeProcesses.clear();\n\t}\n\n\tprivate resolvePath(path: string): string {\n\t\t// If absolute, use as-is; otherwise resolve relative to cwd\n\t\tif (isAbsolute(path)) {\n\t\t\treturn path;\n\t\t}\n\t\treturn join(this.cwd, path);\n\t}\n\n\tprivate resolveWorkingDir(cwd?: string | URL): string {\n\t\tif (!cwd) {\n\t\t\treturn this.cwd;\n\t\t}\n\t\tconst cwdPath = typeof cwd === \"string\" ? cwd : fileURLToPath(cwd);\n\t\tif (isAbsolute(cwdPath)) {\n\t\t\treturn resolve(cwdPath);\n\t\t}\n\t\treturn resolve(this.cwd, cwdPath);\n\t}\n\n\tprivate assertExecutionCwd(workingDir: string): void {\n\t\tif (this.policy.mode !== \"workspace-write\") {\n\t\t\treturn;\n\t\t}\n\n\t\tconst targetPath = canonicalizeForAccess(workingDir);\n\t\tconst allowedRoots = getWritableRootsWithCwd(this.policy, this.cwd).map(\n\t\t\t(root) => canonicalizeForAccess(root.root),\n\t\t);\n\n\t\tif (!allowedRoots.some((root) => isPathWithin(targetPath, root))) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cannot execute workspace-write command outside workspace or explicit writable roots: ${workingDir}`,\n\t\t\t);\n\t\t}\n\n\t\tthis.assertWritablePath(targetPath);\n\t}\n\n\tprivate assertWritablePath(\n\t\tpath: string,\n\t\toptions?: {\n\t\t\tblockReadOnlyDescendants?: boolean;\n\t\t\tcanonicalizeTarget?: (path: string) => string;\n\t\t},\n\t): void {\n\t\tif (this.policy.mode === \"danger-full-access\") {\n\t\t\treturn;\n\t\t}\n\n\t\tconst targetPath = (options?.canonicalizeTarget ?? canonicalizeForAccess)(\n\t\t\tpath,\n\t\t);\n\t\tconst writableRoots = getWritableRootsWithCwd(this.policy, this.cwd);\n\t\tlet hasMatchingWritableRoot = false;\n\t\tlet blockedByReadOnlySubpath = false;\n\n\t\tfor (const root of writableRoots) {\n\t\t\tconst rootPath = canonicalizeForAccess(root.root);\n\t\t\tif (!isPathWithin(targetPath, rootPath)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\thasMatchingWritableRoot = true;\n\t\t\tif (\n\t\t\t\troot.readOnlySubpaths.some((readOnlySubpath) => {\n\t\t\t\t\tconst readOnlyPath = canonicalizeForAccess(readOnlySubpath);\n\t\t\t\t\treturn (\n\t\t\t\t\t\tisPathWithin(targetPath, readOnlyPath) ||\n\t\t\t\t\t\t(options?.blockReadOnlyDescendants === true &&\n\t\t\t\t\t\t\tisPathWithin(readOnlyPath, targetPath))\n\t\t\t\t\t);\n\t\t\t\t})\n\t\t\t) {\n\t\t\t\tblockedByReadOnlySubpath = true;\n\t\t\t}\n\t\t}\n\n\t\tif (!hasMatchingWritableRoot || blockedByReadOnlySubpath) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cannot write outside writable roots in ${this.policy.mode} sandbox mode: ${path}`,\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate getSandboxType(): string {\n\t\tif (platform() === \"darwin\") return \"seatbelt\";\n\t\tif (platform() === \"linux\") return \"landlock\";\n\t\treturn \"none\";\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────\n// Factory Functions\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Check if native sandboxing is available on this platform.\n */\nexport function isNativeSandboxAvailable(): boolean {\n\tif (platform() === \"darwin\") {\n\t\treturn existsSync(SEATBELT_EXECUTABLE);\n\t}\n\tif (platform() === \"linux\") {\n\t\treturn false;\n\t}\n\treturn false;\n}\n\n/**\n * Get the native sandbox type for the current platform.\n */\nexport function getNativeSandboxType(): \"seatbelt\" | \"landlock\" | \"none\" {\n\tif (platform() === \"darwin\") return \"seatbelt\";\n\tif (platform() === \"linux\") return \"landlock\";\n\treturn \"none\";\n}\n\n/**\n * Create a native sandbox instance.\n */\nexport function createNativeSandbox(\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string,\n): NativeSandbox {\n\treturn new NativeSandbox(policy, cwd);\n}\n"]}

package/dist/sentry.d.ts

@@ -0,0 +1,17 @@
+interface SentryRuntimeConfig {
+    dsn: string;
+    environment: string;
+    release: string;
+    tracesSampleRate: number;
+    profilesSampleRate: number;
+    sendDefaultPii: boolean;
+}
+export declare function filterSentryIntegrations<T extends {
+    name?: string;
+}>(integrations: T[]): T[];
+export declare function sentryConfigFromEnv(): SentryRuntimeConfig | null;
+export declare function initSentry(serviceName: string): boolean;
+export declare function captureSentryException(error: unknown): void;
+export declare function flushSentry(timeoutMs?: number): Promise<boolean>;
+export {};
+//# sourceMappingURL=sentry.d.ts.map

package/dist/sentry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.d.ts","sourceRoot":"","sources":["../src/sentry.ts"],"names":[],"mappings":"AAGA,UAAU,mBAAmB;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;CACxB;AASD,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACnE,YAAY,EAAE,CAAC,EAAE,GACf,CAAC,EAAE,CAIL;AAgCD,wBAAgB,mBAAmB,IAAI,mBAAmB,GAAG,IAAI,CA2BhE;AAED,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CA4BvD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAO3D;AAED,wBAAsB,WAAW,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAKpE"}

package/dist/sentry.js

@@ -0,0 +1,91 @@
+import * as Sentry from "@sentry/node";
+import { readPackageVersion } from "./package-version.js";
+let initialized = false;
+const globalCrashIntegrationNames = new Set([
+    "OnUncaughtException",
+    "OnUnhandledRejection",
+]);
+export function filterSentryIntegrations(integrations) {
+    return integrations.filter((integration) => !globalCrashIntegrationNames.has(integration.name ?? ""));
+}
+function firstNonBlank(...values) {
+    for (const value of values) {
+        const trimmed = value?.trim();
+        if (trimmed) {
+            return trimmed;
+        }
+    }
+    return "";
+}
+function readSampleRate(key, fallback) {
+    const raw = process.env[key]?.trim();
+    if (!raw) {
+        return fallback;
+    }
+    const parsed = Number.parseFloat(raw);
+    if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
+        return fallback;
+    }
+    return parsed;
+}
+function readBooleanFlag(key, fallback) {
+    const raw = process.env[key]?.trim().toLowerCase();
+    if (!raw) {
+        return fallback;
+    }
+    return ["1", "true", "t", "yes", "y", "on"].includes(raw);
+}
+export function sentryConfigFromEnv() {
+    const dsn = process.env.SENTRY_DSN?.trim();
+    if (!dsn) {
+        return null;
+    }
+    const release = firstNonBlank(process.env.SENTRY_RELEASE, process.env.MAESTRO_RELEASE, process.env.MAESTRO_VERSION, `maestro@${readPackageVersion()}`);
+    return {
+        dsn,
+        environment: firstNonBlank(process.env.SENTRY_ENVIRONMENT, process.env.MAESTRO_ENVIRONMENT, process.env.MAESTRO_PROFILE, process.env.NODE_ENV, "development"),
+        release,
+        tracesSampleRate: readSampleRate("SENTRY_TRACES_SAMPLE_RATE", 0),
+        profilesSampleRate: readSampleRate("SENTRY_PROFILES_SAMPLE_RATE", 0),
+        sendDefaultPii: readBooleanFlag("SENTRY_SEND_DEFAULT_PII", false),
+    };
+}
+export function initSentry(serviceName) {
+    const config = sentryConfigFromEnv();
+    if (!config) {
+        return false;
+    }
+    if (!initialized) {
+        const options = {
+            dsn: config.dsn,
+            environment: config.environment,
+            release: config.release,
+            tracesSampleRate: config.tracesSampleRate,
+            profilesSampleRate: config.profilesSampleRate,
+            sendDefaultPii: config.sendDefaultPii,
+            skipOpenTelemetrySetup: true,
+        };
+        if (serviceName === "maestro-web-server") {
+            options.integrations = (integrations) => filterSentryIntegrations(integrations);
+        }
+        Sentry.init(options);
+        initialized = true;
+    }
+    Sentry.setTag("service.name", serviceName);
+    Sentry.setTag("service.namespace", "maestro");
+    Sentry.setTag("runtime", "node");
+    return true;
+}
+export function captureSentryException(error) {
+    if (!initialized) {
+        return;
+    }
+    Sentry.captureException(error instanceof Error ? error : new Error(String(error)));
+}
+export async function flushSentry(timeoutMs = 2000) {
+    if (!initialized) {
+        return true;
+    }
+    return Sentry.flush(timeoutMs);
+}
+//# sourceMappingURL=sentry.js.map

package/dist/sentry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.js","sourceRoot":"","sources":["../src/sentry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAW1D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC3C,qBAAqB;IACrB,sBAAsB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CACvC,YAAiB;IAEjB,OAAO,YAAY,CAAC,MAAM,CACzB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAG,MAAiC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,QAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,EAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAC3B,WAAW,kBAAkB,EAAE,EAAE,CACjC,CAAC;IAEF,OAAO;QACN,GAAG;QACH,WAAW,EAAE,aAAa,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAC/B,OAAO,CAAC,GAAG,CAAC,eAAe,EAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,aAAa,CACb;QACD,OAAO;QACP,gBAAgB,EAAE,cAAc,CAAC,2BAA2B,EAAE,CAAC,CAAC;QAChE,kBAAkB,EAAE,cAAc,CAAC,6BAA6B,EAAE,CAAC,CAAC;QACpE,cAAc,EAAE,eAAe,CAAC,yBAAyB,EAAE,KAAK,CAAC;KACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC7C,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,OAAO,GAAsC;YAClD,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,sBAAsB,EAAE,IAAI;SAC5B,CAAC;QACF,IAAI,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1C,OAAO,CAAC,YAAY,GAAG,CAAC,YAAY,EAAE,EAAE,CACvC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,WAAW,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO;IACR,CAAC;IACD,MAAM,CAAC,gBAAgB,CACtB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAS,GAAG,IAAI;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import * as Sentry from \"@sentry/node\";\nimport { readPackageVersion } from \"./package-version.js\";\n\ninterface SentryRuntimeConfig {\n\tdsn: string;\n\tenvironment: string;\n\trelease: string;\n\ttracesSampleRate: number;\n\tprofilesSampleRate: number;\n\tsendDefaultPii: boolean;\n}\n\nlet initialized = false;\n\nconst globalCrashIntegrationNames = new Set([\n\t\"OnUncaughtException\",\n\t\"OnUnhandledRejection\",\n]);\n\nexport function filterSentryIntegrations<T extends { name?: string }>(\n\tintegrations: T[],\n): T[] {\n\treturn integrations.filter(\n\t\t(integration) => !globalCrashIntegrationNames.has(integration.name ?? \"\"),\n\t);\n}\n\nfunction firstNonBlank(...values: Array<string | undefined>): string {\n\tfor (const value of values) {\n\t\tconst trimmed = value?.trim();\n\t\tif (trimmed) {\n\t\t\treturn trimmed;\n\t\t}\n\t}\n\treturn \"\";\n}\n\nfunction readSampleRate(key: string, fallback: number): number {\n\tconst raw = process.env[key]?.trim();\n\tif (!raw) {\n\t\treturn fallback;\n\t}\n\tconst parsed = Number.parseFloat(raw);\n\tif (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {\n\t\treturn fallback;\n\t}\n\treturn parsed;\n}\n\nfunction readBooleanFlag(key: string, fallback: boolean): boolean {\n\tconst raw = process.env[key]?.trim().toLowerCase();\n\tif (!raw) {\n\t\treturn fallback;\n\t}\n\treturn [\"1\", \"true\", \"t\", \"yes\", \"y\", \"on\"].includes(raw);\n}\n\nexport function sentryConfigFromEnv(): SentryRuntimeConfig | null {\n\tconst dsn = process.env.SENTRY_DSN?.trim();\n\tif (!dsn) {\n\t\treturn null;\n\t}\n\n\tconst release = firstNonBlank(\n\t\tprocess.env.SENTRY_RELEASE,\n\t\tprocess.env.MAESTRO_RELEASE,\n\t\tprocess.env.MAESTRO_VERSION,\n\t\t`maestro@${readPackageVersion()}`,\n\t);\n\n\treturn {\n\t\tdsn,\n\t\tenvironment: firstNonBlank(\n\t\t\tprocess.env.SENTRY_ENVIRONMENT,\n\t\t\tprocess.env.MAESTRO_ENVIRONMENT,\n\t\t\tprocess.env.MAESTRO_PROFILE,\n\t\t\tprocess.env.NODE_ENV,\n\t\t\t\"development\",\n\t\t),\n\t\trelease,\n\t\ttracesSampleRate: readSampleRate(\"SENTRY_TRACES_SAMPLE_RATE\", 0),\n\t\tprofilesSampleRate: readSampleRate(\"SENTRY_PROFILES_SAMPLE_RATE\", 0),\n\t\tsendDefaultPii: readBooleanFlag(\"SENTRY_SEND_DEFAULT_PII\", false),\n\t};\n}\n\nexport function initSentry(serviceName: string): boolean {\n\tconst config = sentryConfigFromEnv();\n\tif (!config) {\n\t\treturn false;\n\t}\n\n\tif (!initialized) {\n\t\tconst options: Parameters<typeof Sentry.init>[0] = {\n\t\t\tdsn: config.dsn,\n\t\t\tenvironment: config.environment,\n\t\t\trelease: config.release,\n\t\t\ttracesSampleRate: config.tracesSampleRate,\n\t\t\tprofilesSampleRate: config.profilesSampleRate,\n\t\t\tsendDefaultPii: config.sendDefaultPii,\n\t\t\tskipOpenTelemetrySetup: true,\n\t\t};\n\t\tif (serviceName === \"maestro-web-server\") {\n\t\t\toptions.integrations = (integrations) =>\n\t\t\t\tfilterSentryIntegrations(integrations);\n\t\t}\n\t\tSentry.init(options);\n\t\tinitialized = true;\n\t}\n\n\tSentry.setTag(\"service.name\", serviceName);\n\tSentry.setTag(\"service.namespace\", \"maestro\");\n\tSentry.setTag(\"runtime\", \"node\");\n\treturn true;\n}\n\nexport function captureSentryException(error: unknown): void {\n\tif (!initialized) {\n\t\treturn;\n\t}\n\tSentry.captureException(\n\t\terror instanceof Error ? error : new Error(String(error)),\n\t);\n}\n\nexport async function flushSentry(timeoutMs = 2000): Promise<boolean> {\n\tif (!initialized) {\n\t\treturn true;\n\t}\n\treturn Sentry.flush(timeoutMs);\n}\n"]}