@galaxy-stack/ai-coder-core 0.1.0 → 0.3.0-alpha.10

package/dist/adapters/node/config/manual-provider-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-provider-config.js","sourceRoot":"","sources":["../../../../src/adapters/node/config/manual-provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqBjC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,UAAkB;IAC/C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzG,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAA0C,EAAE;IAE5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,YAAY,IAAI,iBAAiB,CAAC;IACjD,MAAM,gBAAgB,GAAqB,YAAY,KAAK,SAAS;QACnE,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,iBAAiB,KAAK,SAAS;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,OAAO,GAAG,mBAAmB,CACjC,OAAO,CAAC,OAAO;WACV,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;WACjC,8BAA8B,CAAC,WAAW,CAAC,OAAO,CACxD,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;WACtB,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;WAC/B,8BAA8B,CAAC,WAAW,CAAC,KAAK,CAAC;IACtD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC;QACzD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/node/host/command-containment.d.ts

@@ -0,0 +1,45 @@
+export type CommandContainmentMode = "best_effort" | "required";
+export type CommandContainmentBackend = "linux_bubblewrap" | "macos_sandbox_exec" | "none";
+export interface CommandContainmentProbeResult {
+    readonly available: boolean;
+    readonly backend: CommandContainmentBackend;
+    readonly descendantChildSpawned: boolean;
+    readonly descendantQuiescent: boolean;
+    readonly executable: string | null;
+    readonly hardLinkWriteDenied: boolean;
+    readonly networkDenied: boolean;
+    readonly outsideWriteDenied: boolean;
+    readonly privateTempWrite: boolean;
+    readonly reason: string | null;
+    readonly systemRead: boolean;
+    readonly toolchainExecution: boolean;
+    readonly verified: boolean;
+    readonly workspaceWrite: boolean;
+}
+export interface CommandContainmentStatus {
+    readonly active: boolean;
+    readonly backend: CommandContainmentBackend;
+    readonly executable: string | null;
+    readonly filesystemReads: "host_visible" | "system_and_workspace";
+    readonly filesystemWrites: "uncontained" | "workspace_and_private_temp";
+    readonly mode: CommandContainmentMode;
+    readonly network: "denied" | "uncontained";
+    readonly reason: string | null;
+    readonly state: "active" | "probe_failed" | "unavailable" | "unverified";
+    readonly verified: boolean;
+}
+/**
+ * Run the host conformance check once per process. A binary merely existing is
+ * not enough. Only a backend that passes every probe assertion can activate.
+ */
+export declare function probeCommandContainment(): Promise<CommandContainmentProbeResult>;
+export declare function containmentStatus(mode: CommandContainmentMode, probe: CommandContainmentProbeResult): CommandContainmentStatus;
+export declare function buildBubblewrapArguments(input: Readonly<{
+    command: string;
+    commandArguments: readonly string[];
+    cwd: string;
+    environment: NodeJS.ProcessEnv;
+    workspace: string;
+}>): readonly string[];
+export declare function assertWorkspaceHasNoHardLinks(workspace: string): Promise<void>;
+//# sourceMappingURL=command-containment.d.ts.map

package/dist/adapters/node/host/command-containment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-containment.d.ts","sourceRoot":"","sources":["../../../../src/adapters/node/host/command-containment.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GACjC,kBAAkB,GAClB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,cAAc,GAAG,sBAAsB,CAAC;IAClE,QAAQ,CAAC,gBAAgB,EAAE,aAAa,GAAG,4BAA4B,CAAC;IACxE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,CAAC;IACzE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAohBD;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,6BAA6B,CAAC,CAGtF;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,6BAA6B,GACnC,wBAAwB,CAmC1B;AAMD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,GAAG,SAAS,MAAM,EAAE,CAuBrB;AAED,wBAAsB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpF"}

package/dist/adapters/node/host/command-containment.js

@@ -0,0 +1,580 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { constants, existsSync } from "node:fs";
+import { access, link, lstat, mkdtemp, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { delimiter, join, relative, sep } from "node:path";
+const MACOS_SANDBOX_EXECUTABLE = "/usr/bin/sandbox-exec";
+/*
+ * Prototype profile used only by the conformance probe. It is intentionally
+ * not selected for real NodeCommandPort runs: the probe currently demonstrates
+ * that pathname-based Seatbelt write rules do not protect outside inodes
+ * reachable through workspace hard links, and do not supervise descendants
+ * that create a new process group.
+ *
+ * The profile is a write/network experiment, not a confidentiality boundary.
+ * Broad reads keep the installed Node/toolchain visible. There are no TTY,
+ * pseudo-terminal, or network allowances.
+ */
+const MACOS_CONFORMANCE_PROFILE = `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read)
+(allow file-write*
+  (subpath (param "WORKSPACE"))
+  (subpath (param "PRIVATE_TMP"))
+  (literal "/dev/stdout")
+  (literal "/dev/stderr")
+  (literal "/dev/null"))
+(allow mach-lookup
+  (global-name "com.apple.system.opendirectoryd.libinfo")
+  (global-name "com.apple.system.opendirectoryd.membership")
+  (global-name "com.apple.bsd.dirhelper")
+  (global-name "com.apple.SecurityServer")
+  (global-name "com.apple.trustd")
+  (global-name "com.apple.trustd.agent"))`;
+const PROBE_TIMEOUT_MS = 5_000;
+const DESCENDANT_OBSERVATION_MS = 700;
+const MACOS_PROBE_SCRIPT = String.raw `
+const fs = require("node:fs");
+const net = require("node:net");
+const { spawn } = require("node:child_process");
+const result = {
+  descendantChildSpawned: false,
+  hardLinkWriteDenied: false,
+  networkDenied: false,
+  outsideWriteDenied: false,
+  privateTempWrite: false,
+  systemRead: false,
+  workspaceWrite: false,
+};
+try {
+  fs.readFileSync("/etc/hosts");
+  result.systemRead = true;
+  fs.writeFileSync(process.env.GALAXY_PROBE_WORKSPACE_FILE, "workspace-ok", "utf8");
+  result.workspaceWrite = true;
+  fs.writeFileSync(process.env.GALAXY_PROBE_TEMP_FILE, "temp-ok", "utf8");
+  result.privateTempWrite = true;
+  try {
+    fs.writeFileSync(process.env.GALAXY_PROBE_OUTSIDE_FILE, "changed", "utf8");
+  } catch (error) {
+    result.outsideWriteDenied = Boolean(error);
+  }
+  try {
+    fs.writeFileSync(process.env.GALAXY_PROBE_HARD_LINK_FILE, "changed-through-link", "utf8");
+  } catch (error) {
+    result.hardLinkWriteDenied = error && (error.code === "EACCES" || error.code === "EPERM");
+  }
+  const lateScript = 'setTimeout(() => require("node:fs").writeFileSync(process.env.GALAXY_PROBE_LATE_FILE, "late", "utf8"), 250)';
+  const child = spawn(process.execPath, ["-e", lateScript], {
+    detached: true,
+    env: process.env,
+    stdio: "ignore",
+  });
+  result.descendantChildSpawned = child.pid !== undefined;
+  child.unref();
+} catch {}
+let finished = false;
+const finish = () => {
+  if (finished) return;
+  finished = true;
+  process.stdout.write(JSON.stringify(result));
+};
+const socket = net.createConnection({
+  host: "127.0.0.1",
+  port: Number(process.env.GALAXY_PROBE_PORT),
+});
+socket.once("connect", () => {
+  socket.destroy();
+  finish();
+});
+socket.once("error", (error) => {
+  result.networkDenied = Boolean(error);
+  finish();
+});
+socket.setTimeout(2_000, () => {
+  result.networkDenied = true;
+  socket.destroy();
+  finish();
+});
+`;
+let cachedProbe;
+function freezeProbe(result) {
+    return Object.freeze({ ...result });
+}
+function unavailableProbe(backend, executable, available, reason) {
+    return freezeProbe({
+        available,
+        backend,
+        descendantChildSpawned: false,
+        descendantQuiescent: false,
+        executable,
+        hardLinkWriteDenied: false,
+        networkDenied: false,
+        outsideWriteDenied: false,
+        privateTempWrite: false,
+        reason,
+        systemRead: false,
+        toolchainExecution: false,
+        verified: false,
+        workspaceWrite: false,
+    });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function delay(milliseconds) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
+}
+async function isExecutable(path) {
+    try {
+        await access(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function executableOnPath(name) {
+    for (const entry of (process.env.PATH ?? "").split(delimiter)) {
+        if (entry.length === 0)
+            continue;
+        const candidate = join(entry, name);
+        if (await isExecutable(candidate))
+            return candidate;
+    }
+    return null;
+}
+function killProbeProcessGroup(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch {
+        try {
+            process.kill(pid, "SIGKILL");
+        }
+        catch {
+            // Nothing remains to terminate.
+        }
+    }
+}
+async function runProbeProcess(executable, args, env) {
+    return await new Promise((resolveResult) => {
+        const child = spawn(executable, args, {
+            detached: true,
+            env,
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let didTimeOut = false;
+        let forceFinish;
+        let settled = false;
+        let stderr = "";
+        let stdout = "";
+        const finish = (exitCode) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            if (forceFinish !== undefined)
+                clearTimeout(forceFinish);
+            resolveResult(Object.freeze({ exitCode, stderr, stdout, timedOut: didTimeOut }));
+        };
+        const timeout = setTimeout(() => {
+            didTimeOut = true;
+            killProbeProcessGroup(child.pid);
+            forceFinish = setTimeout(() => finish(null), 1_000);
+            forceFinish.unref();
+        }, PROBE_TIMEOUT_MS);
+        timeout.unref();
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            if (stdout.length < 64_000)
+                stdout += chunk;
+        });
+        child.stderr?.on("data", (chunk) => {
+            if (stderr.length < 64_000)
+                stderr += chunk;
+        });
+        child.once("error", (error) => {
+            stderr += errorMessage(error);
+            finish(null);
+        });
+        child.once("close", (exitCode) => finish(exitCode));
+    });
+}
+async function listenOnLoopback(server) {
+    return await new Promise((resolvePort, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", onError);
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                reject(new Error("The containment probe did not receive a TCP port."));
+                return;
+            }
+            resolvePort(address.port);
+        });
+    });
+}
+async function closeServer(server) {
+    if (!server.listening)
+        return;
+    await new Promise((resolveClose) => server.close(() => resolveClose()));
+}
+async function probeMacOsSeatbelt() {
+    if (!(await isExecutable(MACOS_SANDBOX_EXECUTABLE))) {
+        return unavailableProbe("macos_sandbox_exec", MACOS_SANDBOX_EXECUTABLE, false, `${MACOS_SANDBOX_EXECUTABLE} is not executable.`);
+    }
+    const temporaryRoots = [];
+    const server = createServer((socket) => socket.destroy());
+    let networkConnections = 0;
+    server.on("connection", () => {
+        networkConnections += 1;
+    });
+    try {
+        const makeTemporaryRoot = async (prefix) => {
+            const root = await mkdtemp(join(tmpdir(), prefix));
+            temporaryRoots.push(root);
+            return await realpath(root);
+        };
+        // Allocate sequentially so a rejection cannot race successful siblings
+        // that have not yet registered themselves for the finally cleanup.
+        const workspace = await makeTemporaryRoot("galaxy-containment-workspace-");
+        const privateTemp = await makeTemporaryRoot("galaxy-containment-temp-");
+        const outside = await makeTemporaryRoot("galaxy-containment-outside-");
+        const workspaceFile = join(workspace, `workspace-${randomUUID()}`);
+        const privateTempFile = join(privateTemp, `temp-${randomUUID()}`);
+        const outsideFile = join(outside, `sentinel-${randomUUID()}`);
+        const outsideHardLinkTarget = join(outside, `hard-link-target-${randomUUID()}`);
+        const workspaceHardLink = join(workspace, `hard-link-${randomUUID()}`);
+        const lateFile = join(workspace, `late-${randomUUID()}`);
+        const sentinel = `outside-${randomUUID()}`;
+        const hardLinkSentinel = `hard-link-outside-${randomUUID()}`;
+        await Promise.all([
+            writeFile(outsideFile, sentinel, "utf8"),
+            writeFile(outsideHardLinkTarget, hardLinkSentinel, "utf8"),
+        ]);
+        await link(outsideHardLinkTarget, workspaceHardLink);
+        const port = await listenOnLoopback(server);
+        const environment = {
+            CI: "1",
+            FORCE_COLOR: "0",
+            GALAXY_PROBE_HARD_LINK_FILE: workspaceHardLink,
+            GALAXY_PROBE_LATE_FILE: lateFile,
+            GALAXY_PROBE_OUTSIDE_FILE: outsideFile,
+            GALAXY_PROBE_PORT: String(port),
+            GALAXY_PROBE_TEMP_FILE: privateTempFile,
+            GALAXY_PROBE_WORKSPACE_FILE: workspaceFile,
+            PATH: process.env.PATH,
+            TEMP: privateTemp,
+            TMP: privateTemp,
+            TMPDIR: privateTemp,
+        };
+        const processResult = await runProbeProcess(MACOS_SANDBOX_EXECUTABLE, [
+            "-D",
+            `WORKSPACE=${workspace}`,
+            "-D",
+            `PRIVATE_TMP=${privateTemp}`,
+            "-p",
+            MACOS_CONFORMANCE_PROFILE,
+            process.execPath,
+            "-e",
+            MACOS_PROBE_SCRIPT,
+        ], environment);
+        await delay(DESCENDANT_OBSERVATION_MS);
+        let payload;
+        try {
+            payload = JSON.parse(processResult.stdout);
+        }
+        catch {
+            payload = undefined;
+        }
+        const [workspaceContent, privateTempContent, outsideContent, hardLinkContent, lateContent] = await Promise.all([
+            readFile(workspaceFile, "utf8").catch(() => ""),
+            readFile(privateTempFile, "utf8").catch(() => ""),
+            readFile(outsideFile, "utf8").catch(() => ""),
+            readFile(outsideHardLinkTarget, "utf8").catch(() => ""),
+            readFile(lateFile, "utf8").catch(() => ""),
+        ]);
+        const systemRead = payload?.systemRead === true;
+        const workspaceWrite = payload?.workspaceWrite === true && workspaceContent === "workspace-ok";
+        const privateTempWrite = payload?.privateTempWrite === true && privateTempContent === "temp-ok";
+        const outsideWriteDenied = payload?.outsideWriteDenied === true && outsideContent === sentinel;
+        const hardLinkWriteDenied = payload?.hardLinkWriteDenied === true && hardLinkContent === hardLinkSentinel;
+        const networkDenied = payload?.networkDenied === true && networkConnections === 0;
+        const descendantChildSpawned = payload?.descendantChildSpawned === true;
+        const descendantQuiescent = descendantChildSpawned && lateContent.length === 0;
+        const toolchainExecution = processResult.exitCode === 0 && !processResult.timedOut;
+        const assertions = {
+            descendantChildSpawned,
+            descendantQuiescent,
+            hardLinkWriteDenied,
+            networkDenied,
+            outsideWriteDenied,
+            privateTempWrite,
+            systemRead,
+            toolchainExecution,
+            workspaceWrite,
+        };
+        const failedAssertions = Object.entries(assertions)
+            .filter(([, passed]) => !passed)
+            .map(([name]) => name);
+        const verified = failedAssertions.length === 0;
+        const detail = processResult.timedOut
+            ? "The Seatbelt conformance probe timed out."
+            : processResult.exitCode !== 0
+                ? `The Seatbelt conformance probe exited with ${String(processResult.exitCode)}: ${processResult.stderr.trim()}`
+                : !verified
+                    ? `The Seatbelt conformance probe failed: ${failedAssertions.join(", ")}.`
+                    : null;
+        return freezeProbe({
+            available: true,
+            backend: "macos_sandbox_exec",
+            descendantChildSpawned,
+            descendantQuiescent,
+            executable: MACOS_SANDBOX_EXECUTABLE,
+            hardLinkWriteDenied,
+            networkDenied,
+            outsideWriteDenied,
+            privateTempWrite,
+            reason: detail,
+            systemRead,
+            toolchainExecution,
+            verified,
+            workspaceWrite,
+        });
+    }
+    catch (error) {
+        return unavailableProbe("macos_sandbox_exec", MACOS_SANDBOX_EXECUTABLE, true, `The Seatbelt conformance probe failed: ${errorMessage(error)}`);
+    }
+    finally {
+        await closeServer(server).catch(() => undefined);
+        await Promise.all(temporaryRoots.map(async (root) => {
+            await rm(root, { force: true, recursive: true });
+        })).catch(() => undefined);
+    }
+}
+async function probeLinuxBubblewrap() {
+    const executable = await executableOnPath("bwrap");
+    if (executable === null) {
+        return unavailableProbe("linux_bubblewrap", null, false, "bubblewrap (bwrap) is not available on PATH.");
+    }
+    const temporaryRoots = [];
+    const server = createServer((socket) => socket.destroy());
+    let networkConnections = 0;
+    server.on("connection", () => {
+        networkConnections += 1;
+    });
+    try {
+        const makeTemporaryRoot = async (prefix) => {
+            const root = await mkdtemp(join(tmpdir(), prefix));
+            temporaryRoots.push(root);
+            return await realpath(root);
+        };
+        const workspace = await makeTemporaryRoot("galaxy-bwrap-workspace-");
+        const outside = await makeTemporaryRoot("galaxy-bwrap-outside-");
+        const workspaceFile = join(workspace, `workspace-${randomUUID()}`);
+        const outsideFile = join(outside, `sentinel-${randomUUID()}`);
+        const lateFile = join(workspace, `late-${randomUUID()}`);
+        const hardLinkTarget = join(outside, `hard-link-target-${randomUUID()}`);
+        const hardLinkPath = join(workspace, `hard-link-${randomUUID()}`);
+        const sentinel = `outside-${randomUUID()}`;
+        await Promise.all([
+            writeFile(outsideFile, sentinel, "utf8"),
+            writeFile(hardLinkTarget, sentinel, "utf8"),
+        ]);
+        await link(hardLinkTarget, hardLinkPath);
+        let hardLinkWriteDenied = false;
+        try {
+            await assertWorkspaceHasNoHardLinks(workspace);
+        }
+        catch {
+            hardLinkWriteDenied = true;
+        }
+        await rm(hardLinkPath);
+        const port = await listenOnLoopback(server);
+        const environment = {
+            CI: "1",
+            FORCE_COLOR: "0",
+            GALAXY_PROBE_HARD_LINK_FILE: "/workspace/nonexistent-hard-link",
+            GALAXY_PROBE_LATE_FILE: `/workspace/${lateFile.split(sep).at(-1) ?? "late"}`,
+            GALAXY_PROBE_OUTSIDE_FILE: outsideFile,
+            GALAXY_PROBE_PORT: String(port),
+            GALAXY_PROBE_TEMP_FILE: "/tmp/probe-temp",
+            GALAXY_PROBE_WORKSPACE_FILE: `/workspace/${workspaceFile.split(sep).at(-1) ?? "workspace"}`,
+            PATH: "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+            TEMP: "/tmp",
+            TMP: "/tmp",
+            TMPDIR: "/tmp",
+        };
+        const processResult = await runProbeProcess(executable, buildBubblewrapArguments({
+            command: process.execPath,
+            commandArguments: Object.freeze(["-e", MACOS_PROBE_SCRIPT]),
+            cwd: workspace,
+            environment,
+            workspace,
+        }), environment);
+        await delay(DESCENDANT_OBSERVATION_MS);
+        let payload;
+        try {
+            payload = JSON.parse(processResult.stdout);
+        }
+        catch {
+            payload = undefined;
+        }
+        const [workspaceContent, outsideContent, lateContent] = await Promise.all([
+            readFile(workspaceFile, "utf8").catch(() => ""),
+            readFile(outsideFile, "utf8").catch(() => ""),
+            readFile(lateFile, "utf8").catch(() => ""),
+        ]);
+        const assertions = {
+            descendantChildSpawned: payload?.descendantChildSpawned === true,
+            descendantQuiescent: payload?.descendantChildSpawned === true && lateContent.length === 0,
+            hardLinkWriteDenied,
+            networkDenied: payload?.networkDenied === true && networkConnections === 0,
+            outsideWriteDenied: payload?.outsideWriteDenied === true && outsideContent === sentinel,
+            privateTempWrite: payload?.privateTempWrite === true,
+            systemRead: payload?.systemRead === true,
+            toolchainExecution: processResult.exitCode === 0 && !processResult.timedOut,
+            workspaceWrite: payload?.workspaceWrite === true && workspaceContent === "workspace-ok",
+        };
+        const failed = Object.entries(assertions).filter(([, passed]) => !passed).map(([name]) => name);
+        return freezeProbe({
+            available: true,
+            backend: "linux_bubblewrap",
+            ...assertions,
+            executable,
+            reason: failed.length === 0 ? null : `The bubblewrap conformance probe failed: ${failed.join(", ")}.`,
+            verified: failed.length === 0,
+        });
+    }
+    catch (error) {
+        return unavailableProbe("linux_bubblewrap", executable, true, `The bubblewrap conformance probe failed: ${errorMessage(error)}`);
+    }
+    finally {
+        await closeServer(server).catch(() => undefined);
+        await Promise.all(temporaryRoots.map(async (root) => rm(root, { force: true, recursive: true }))).catch(() => undefined);
+    }
+}
+async function detectCommandContainment() {
+    try {
+        return process.platform === "darwin"
+            ? await probeMacOsSeatbelt()
+            : process.platform === "linux"
+                ? await probeLinuxBubblewrap()
+                : unavailableProbe("none", null, false, `No command-containment backend is implemented for '${process.platform}'.`);
+    }
+    catch (error) {
+        return unavailableProbe("none", null, false, `Command-containment detection failed closed: ${errorMessage(error)}`);
+    }
+}
+/**
+ * Run the host conformance check once per process. A binary merely existing is
+ * not enough. Only a backend that passes every probe assertion can activate.
+ */
+export async function probeCommandContainment() {
+    cachedProbe ??= detectCommandContainment();
+    return await cachedProbe;
+}
+export function containmentStatus(mode, probe) {
+    const assertionsVerified = probe.descendantChildSpawned
+        && probe.descendantQuiescent
+        && probe.hardLinkWriteDenied
+        && probe.networkDenied
+        && probe.outsideWriteDenied
+        && probe.privateTempWrite
+        && probe.systemRead
+        && probe.toolchainExecution
+        && probe.workspaceWrite;
+    const active = probe.backend === "linux_bubblewrap" && probe.verified && assertionsVerified;
+    const state = !probe.available
+        ? "unavailable"
+        : active
+            ? "active"
+            : probe.verified
+                ? "unverified"
+                : "probe_failed";
+    const reason = active ? null : probe.verified && !assertionsVerified
+        ? "The backend claimed verification without passing every containment assertion."
+        : probe.verified
+            ? "The backend passed its probe but this platform implementation is not activated."
+            : probe.reason;
+    return Object.freeze({
+        active,
+        backend: probe.backend,
+        executable: probe.executable,
+        filesystemReads: active ? "system_and_workspace" : "host_visible",
+        filesystemWrites: active ? "workspace_and_private_temp" : "uncontained",
+        mode,
+        network: active ? "denied" : "uncontained",
+        reason,
+        state,
+        verified: active,
+    });
+}
+const BUBBLEWRAP_READ_ONLY_ROOTS = Object.freeze([
+    "/bin", "/etc", "/lib", "/lib64", "/nix/store", "/opt", "/sbin", "/usr",
+]);
+export function buildBubblewrapArguments(input) {
+    const relativeCwd = relative(input.workspace, input.cwd);
+    if (relativeCwd === ".." || relativeCwd.startsWith(`..${sep}`)) {
+        throw new Error("Contained command cwd must remain inside the workspace.");
+    }
+    const args = [
+        "--die-with-parent", "--new-session", "--unshare-all", "--disable-userns", "--cap-drop", "ALL",
+        "--clearenv", "--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp",
+    ];
+    for (const root of BUBBLEWRAP_READ_ONLY_ROOTS) {
+        try {
+            if (existsSync(root))
+                args.push("--ro-bind", root, root);
+        }
+        catch {
+            // Missing optional system roots are intentionally invisible.
+        }
+    }
+    args.push("--bind", input.workspace, "/workspace");
+    for (const [name, value] of Object.entries(input.environment).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
+        if (value !== undefined)
+            args.push("--setenv", name, value);
+    }
+    const sandboxCwd = relativeCwd.length === 0 ? "/workspace" : `/workspace/${relativeCwd.split(sep).join("/")}`;
+    args.push("--chdir", sandboxCwd, "--", input.command, ...input.commandArguments);
+    return Object.freeze(args);
+}
+export async function assertWorkspaceHasNoHardLinks(workspace) {
+    let entries = 0;
+    const visit = async (directory) => {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            entries += 1;
+            if (entries > 100_000) {
+                throw Object.assign(new Error("Contained command hard-link scan exceeded 100000 workspace entries."), {
+                    code: "LIMIT_EXCEEDED",
+                });
+            }
+            const path = join(directory, entry.name);
+            const info = await lstat(path);
+            if (info.isSymbolicLink())
+                continue;
+            if (info.isDirectory()) {
+                await visit(path);
+            }
+            else if (info.isFile() && info.nlink > 1) {
+                throw Object.assign(new Error(`Contained command refused hard-linked workspace file '${relative(workspace, path)}'.`), {
+                    code: "PERMISSION_DENIED",
+                });
+            }
+        }
+    };
+    await visit(workspace);
+}
+//# sourceMappingURL=command-containment.js.map