@garuda-agent/garuda 0.0.1 → 0.15.0

package/dist/chunk-SI2QJYCR.js

@@ -0,0 +1,1341 @@
+#!/usr/bin/env node
+import {
+  realRelative
+} from "./chunk-WMOLXTBU.js";
+import {
+  isCommandDisallowedByPolicy,
+  isHostBlockedByPolicy,
+  isPathDeniedByPolicy,
+  isSandboxRequiredByPolicy
+} from "./chunk-HUIK3WXO.js";
+import {
+  CASE_INSENSITIVE_FS,
+  formatRule,
+  fullGlob,
+  parseRule,
+  pathMatches,
+  ruleMatches
+} from "./chunk-3NJNVZTK.js";
+
+// src/net/allowlist.ts
+var NETWORK_PRESETS = {
+  npm: ["registry.npmjs.org", "registry.yarnpkg.com"],
+  pypi: ["pypi.org", "files.pythonhosted.org"],
+  maven: ["repo.maven.apache.org", "repo1.maven.org", "plugins.gradle.org", "services.gradle.org"],
+  go: ["proxy.golang.org", "sum.golang.org"],
+  cargo: ["crates.io", "index.crates.io", "static.crates.io"],
+  github: [
+    "github.com",
+    "api.github.com",
+    "codeload.github.com",
+    "objects.githubusercontent.com",
+    "raw.githubusercontent.com"
+  ]
+};
+var PRESET_NAMES = Object.keys(NETWORK_PRESETS);
+var NETWORK_PORTS = [80, 443];
+var HOST = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,63}$/;
+function expandAllowlist(entries) {
+  const hosts = /* @__PURE__ */ new Set();
+  const problems = [];
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    const preset = NETWORK_PRESETS[entry];
+    if (preset !== void 0) {
+      for (const host of preset) hosts.add(host);
+    } else if (HOST.test(entry)) {
+      hosts.add(entry);
+    } else {
+      problems.push(
+        `"${raw}" is not a preset (${PRESET_NAMES.join(", ")}) or a host name (example.com, *.example.com).`
+      );
+    }
+  }
+  return { hosts: [...hosts], problems };
+}
+function hostAllowed(host, patterns) {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  return patterns.some((p) => p.startsWith("*.") ? h.endsWith(p.slice(1)) : h === p);
+}
+function describeAllowlist(entries) {
+  return entries.map((raw) => {
+    const preset = NETWORK_PRESETS[raw.trim().toLowerCase()];
+    return preset === void 0 ? raw : `${raw}: ${preset.join(", ")}`;
+  });
+}
+
+// src/permissions/sandboxPaths.ts
+import { realpathSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { isAbsolute, join, resolve } from "path";
+import { globbySync } from "globby";
+var DENY_READ_IN_HOME = [
+  ".ssh",
+  ".aws",
+  ".azure",
+  ".gnupg",
+  ".kube",
+  ".docker",
+  ".config/gcloud",
+  ".config/gh",
+  ".netrc",
+  ".npmrc",
+  ".pypirc",
+  ".git-credentials",
+  "Library/Keychains",
+  // Garuda's OAuth tokens for remote MCP servers (0.4). The rest of ~/.garuda stays readable:
+  // skills and their scripts live there (0.5).
+  ".garuda/mcp-auth.json",
+  // Claude Code: its config can hold MCP server tokens in env values; its credentials on Linux.
+  ".claude.json",
+  ".claude/.credentials.json"
+];
+var PROTECTED_IN_ROOT = [".git/hooks", ".git/config", ".garuda"];
+var WRITE_IN_HOME = [
+  ".cache",
+  ".npm",
+  ".local/share/pnpm",
+  "Library/Caches",
+  "Library/pnpm"
+];
+function sandboxPaths(root, settings = {}, home = homedir()) {
+  const expand = (path) => path === "~" ? home : path.startsWith("~/") ? join(home, path.slice(2)) : resolve(root, path);
+  const temp = [.../* @__PURE__ */ new Set([real(tmpdir()), real("/tmp")])];
+  return {
+    writePaths: unique([
+      root,
+      ...temp,
+      ...WRITE_IN_HOME.map((p) => join(home, p)),
+      ...(settings.writePaths ?? []).map(expand)
+    ]),
+    denyWritePaths: PROTECTED_IN_ROOT.map((p) => join(root, p)),
+    denyReadPaths: unique([
+      ...DENY_READ_IN_HOME.map((p) => join(home, p)),
+      ...(settings.denyRead ?? []).map(expand)
+    ])
+  };
+}
+function real(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+}
+function unique(paths) {
+  return [...new Set(paths.filter((p) => isAbsolute(p)))];
+}
+var MAX_POLICY_DENIED_PATHS = 1e3;
+function policyDeniedPaths(root, patterns, ignoreCase = CASE_INSENSITIVE_FS) {
+  if (patterns.length === 0) return [];
+  const found = globbySync(patterns.map(fullGlob), {
+    cwd: root,
+    absolute: true,
+    dot: true,
+    onlyFiles: false,
+    followSymbolicLinks: false,
+    gitignore: false,
+    caseSensitiveMatch: !ignoreCase,
+    ignore: ["**/node_modules/**", "**/.git/**"]
+  });
+  return found.slice(0, MAX_POLICY_DENIED_PATHS);
+}
+
+// src/sandbox/process.ts
+import { spawn } from "child_process";
+
+// src/sandbox/capture.ts
+var OutputCapture = class {
+  headMax;
+  tailMax;
+  head = Buffer.alloc(0);
+  tail = [];
+  tailSize = 0;
+  total = 0;
+  constructor(maxBytes) {
+    this.headMax = Math.ceil(maxBytes / 2);
+    this.tailMax = Math.floor(maxBytes / 2);
+  }
+  push(chunk) {
+    this.total += chunk.length;
+    let rest = chunk;
+    if (this.head.length < this.headMax) {
+      const room = this.headMax - this.head.length;
+      this.head = Buffer.concat([this.head, rest.subarray(0, room)]);
+      rest = rest.subarray(room);
+    }
+    if (rest.length === 0 || this.tailMax === 0) return;
+    this.tail.push(rest);
+    this.tailSize += rest.length;
+    while (this.tail.length > 1 && this.tailSize - (this.tail[0]?.length ?? 0) >= this.tailMax) {
+      this.tailSize -= this.tail.shift()?.length ?? 0;
+    }
+  }
+  result() {
+    const tail = Buffer.concat(this.tail);
+    const keptTail = tail.subarray(Math.max(0, tail.length - this.tailMax));
+    const truncated = this.head.length + keptTail.length < this.total;
+    if (!truncated) {
+      return {
+        text: Buffer.concat([this.head, keptTail]).toString("utf8"),
+        truncated,
+        totalBytes: this.total
+      };
+    }
+    const cut2 = this.total - this.head.length - keptTail.length;
+    const text = `${this.head.toString("utf8")}
+\u2026 [${cut2} bytes cut] \u2026
+${keptTail.toString("utf8")}`;
+    return { text, truncated, totalBytes: this.total };
+  }
+};
+
+// src/sandbox/daemon.ts
+var DEFAULT_MAX_LOG_LINES = 2e3;
+var MAX_LOG_LINE_CHARS = 4e3;
+var MAX_PENDING_CHARS = 64e3;
+var MAX_LOGS_CHARS = 3e4;
+var cut = (line) => line.length <= MAX_LOG_LINE_CHARS ? line : `${line.slice(0, MAX_LOG_LINE_CHARS)}\u2026 [${line.length - MAX_LOG_LINE_CHARS} more chars]`;
+var DaemonManager = class {
+  constructor(executor) {
+    this.executor = executor;
+  }
+  executor;
+  nextId = 1;
+  daemons = /* @__PURE__ */ new Map();
+  spawn(command, policy, options = {}) {
+    const id = `daemon_${this.nextId++}`;
+    const maxBufferLines = options.maxBufferLines ?? DEFAULT_MAX_LOG_LINES;
+    const process2 = this.executor.start(["bash", "-c", command], policy, options.env);
+    process2.stdin.end();
+    const entry = {
+      info: {
+        id,
+        pid: process2.pid,
+        command,
+        startTime: Date.now(),
+        status: "running"
+      },
+      process: process2,
+      logs: [],
+      maxBufferLines,
+      stdoutRemainder: "",
+      stderrRemainder: "",
+      stopRequested: false
+    };
+    const appendChunk = (chunk, stream) => {
+      const text = (stream === "stdout" ? entry.stdoutRemainder : entry.stderrRemainder) + chunk.toString("utf8");
+      const lines = text.split("\n");
+      let remainder = lines.pop() ?? "";
+      if (remainder.length > MAX_PENDING_CHARS) {
+        lines.push(remainder);
+        remainder = "";
+      }
+      if (stream === "stdout") entry.stdoutRemainder = remainder;
+      else entry.stderrRemainder = remainder;
+      const now = Date.now();
+      for (const line of lines) {
+        if (entry.logs.length >= entry.maxBufferLines) {
+          entry.logs.shift();
+        }
+        entry.logs.push({ timestamp: now, stream, line: cut(line) });
+      }
+    };
+    process2.stdout.on("data", (chunk) => appendChunk(chunk, "stdout"));
+    process2.stderr.on("data", (chunk) => appendChunk(chunk, "stderr"));
+    process2.onExit((code, signal) => {
+      if (entry.stdoutRemainder.length > 0) {
+        if (entry.logs.length >= entry.maxBufferLines) entry.logs.shift();
+        entry.logs.push({
+          timestamp: Date.now(),
+          stream: "stdout",
+          line: cut(entry.stdoutRemainder)
+        });
+        entry.stdoutRemainder = "";
+      }
+      if (entry.stderrRemainder.length > 0) {
+        if (entry.logs.length >= entry.maxBufferLines) entry.logs.shift();
+        entry.logs.push({
+          timestamp: Date.now(),
+          stream: "stderr",
+          line: cut(entry.stderrRemainder)
+        });
+        entry.stderrRemainder = "";
+      }
+      entry.info.endTime = Date.now();
+      entry.info.exitCode = code;
+      entry.info.signal = signal;
+      if (entry.stopRequested || signal !== null || code === 0) {
+        entry.info.status = "stopped";
+      } else {
+        entry.info.status = "failed";
+      }
+    });
+    process2.onError((error) => {
+      if (entry.logs.length >= entry.maxBufferLines) entry.logs.shift();
+      entry.logs.push({
+        timestamp: Date.now(),
+        stream: "stderr",
+        line: `Process error: ${error.message}`
+      });
+      entry.info.endTime = Date.now();
+      entry.info.status = "failed";
+    });
+    this.daemons.set(id, entry);
+    return this.toInfo(entry);
+  }
+  list() {
+    return [...this.daemons.values()].map((entry) => this.toInfo(entry));
+  }
+  get(id) {
+    const entry = this.daemons.get(id);
+    return entry ? this.toInfo(entry) : void 0;
+  }
+  logs(id, options = {}) {
+    const entry = this.daemons.get(id);
+    if (!entry) return void 0;
+    const stream = options.stream ?? "all";
+    const filtered = stream === "all" ? entry.logs : entry.logs.filter((log) => log.stream === stream);
+    const limit = options.lines ?? 50;
+    const sliced = limit <= 0 ? filtered : filtered.slice(-limit);
+    const out = [];
+    let size = 0;
+    for (const log of [...sliced].reverse()) {
+      const line = `[${log.stream}] ${log.line}`;
+      if (size + line.length > MAX_LOGS_CHARS) {
+        out.push(`[garuda] \u2026 ${sliced.length - out.length} older line(s) left out`);
+        break;
+      }
+      size += line.length + 1;
+      out.push(line);
+    }
+    return out.reverse();
+  }
+  kill(id) {
+    const entry = this.daemons.get(id);
+    if (!entry) {
+      return { ok: false, message: `Daemon process not found: ${id}` };
+    }
+    if (entry.info.status !== "running") {
+      return {
+        ok: true,
+        message: `Daemon process ${id} was already ${entry.info.status} (exit code: ${entry.info.exitCode ?? "none"}).`
+      };
+    }
+    entry.stopRequested = true;
+    entry.process.stop();
+    return {
+      ok: true,
+      message: `Asked daemon process ${id} (pid: ${entry.info.pid ?? "unknown"}) to stop: SIGTERM now, SIGKILL after 2 s if it is still running.`
+    };
+  }
+  shutdown() {
+    for (const entry of this.daemons.values()) {
+      if (entry.info.status === "running") {
+        try {
+          entry.stopRequested = true;
+          entry.process.stop();
+          entry.info.status = "stopped";
+          entry.info.endTime = Date.now();
+        } catch {
+        }
+      }
+    }
+  }
+  toInfo(entry) {
+    const { id, pid, command, status, startTime, endTime, exitCode, signal } = entry.info;
+    const uptimeMs = (endTime ?? Date.now()) - startTime;
+    return {
+      id,
+      pid,
+      command,
+      status,
+      startTime,
+      endTime,
+      uptimeMs,
+      exitCode,
+      signal
+    };
+  }
+};
+
+// src/sandbox/process.ts
+var KILL_GRACE_MS = 2e3;
+var EXIT_DRAIN_MS = 2e3;
+var ProcessExecutor = class {
+  /** Manages background daemon processes (0.14). */
+  daemons = new DaemonManager(this);
+  /** Process group ids of running commands. */
+  running = /* @__PURE__ */ new Set();
+  shutdown() {
+    this.daemons.shutdown();
+    for (const pid of this.running) signalGroup(pid, "SIGKILL");
+    this.running.clear();
+  }
+  start(argv, policy, env = {}) {
+    const { file, args } = this.launch(argv, policy);
+    const child = spawn(file, args, {
+      cwd: policy.root,
+      env: { ...allowedEnv(policy.envAllowlist), ...proxyEnv(policy), ...env },
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: true
+    });
+    const pid = child.pid;
+    if (pid !== void 0) this.running.add(pid);
+    let killTimer;
+    child.on("exit", () => {
+      if (pid !== void 0) {
+        this.running.delete(pid);
+        signalGroup(pid, "SIGKILL");
+      }
+      if (killTimer !== void 0) clearTimeout(killTimer);
+    });
+    return {
+      pid,
+      stdin: child.stdin,
+      stdout: child.stdout,
+      stderr: child.stderr,
+      stop: () => {
+        if (pid === void 0 || child.exitCode !== null || child.signalCode !== null) return;
+        signalGroup(pid, "SIGTERM");
+        killTimer ??= setTimeout(() => signalGroup(pid, "SIGKILL"), KILL_GRACE_MS);
+        killTimer.unref();
+      },
+      onExit: (listener) => {
+        child.on("exit", (code, signal) => listener(code, signal));
+      },
+      onError: (listener) => {
+        child.on("error", listener);
+      }
+    };
+  }
+  run(command, policy, options = {}) {
+    const started = Date.now();
+    const stdout = new OutputCapture(policy.maxOutputBytes);
+    const stderr = new OutputCapture(policy.maxOutputBytes);
+    return new Promise((resolve2, reject) => {
+      if (options.signal?.aborted) {
+        reject(options.signal.reason);
+        return;
+      }
+      const { file, args } = this.launch(["bash", "-c", command], policy);
+      const child = spawn(file, args, {
+        cwd: policy.root,
+        env: { ...allowedEnv(policy.envAllowlist), ...proxyEnv(policy), ...options.env },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true
+      });
+      const pid = child.pid;
+      if (pid !== void 0) this.running.add(pid);
+      let timedOut = false;
+      let aborted = false;
+      let finished = false;
+      let killTimer;
+      let drainTimer;
+      const killTree = () => {
+        if (child.pid === void 0 || finished) return;
+        signalGroup(child.pid, "SIGTERM");
+        killTimer ??= setTimeout(() => {
+          if (child.pid !== void 0) signalGroup(child.pid, "SIGKILL");
+        }, KILL_GRACE_MS);
+      };
+      const timer = setTimeout(() => {
+        timedOut = true;
+        killTree();
+      }, policy.timeoutMs);
+      const onAbort = () => {
+        aborted = true;
+        killTree();
+      };
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      child.stdout.on("data", (chunk) => stdout.push(chunk));
+      child.stderr.on("data", (chunk) => stderr.push(chunk));
+      child.on("error", (error) => {
+        if (finished) return;
+        finished = true;
+        if (pid !== void 0) this.running.delete(pid);
+        clearTimeout(timer);
+        if (drainTimer !== void 0) clearTimeout(drainTimer);
+        options.signal?.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+      const finish = (code, signal) => {
+        if (finished) return;
+        finished = true;
+        if (pid !== void 0) this.running.delete(pid);
+        clearTimeout(timer);
+        if (drainTimer !== void 0) clearTimeout(drainTimer);
+        if (killTimer !== void 0) clearTimeout(killTimer);
+        options.signal?.removeEventListener("abort", onAbort);
+        if (child.pid !== void 0) signalGroup(child.pid, "SIGKILL");
+        resolve2({
+          exitCode: code,
+          signal,
+          stdout: stdout.result(),
+          stderr: stderr.result(),
+          timedOut,
+          aborted,
+          durationMs: Date.now() - started
+        });
+      };
+      child.on("exit", (code, signal) => {
+        drainTimer = setTimeout(() => {
+          if (child.pid !== void 0) signalGroup(child.pid, "SIGKILL");
+          child.stdout.destroy();
+          child.stderr.destroy();
+          finish(code, signal);
+        }, EXIT_DRAIN_MS);
+      });
+      child.on("close", (code, signal) => finish(code, signal));
+    });
+  }
+};
+function signalGroup(pid, signal) {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+  }
+}
+function allowedEnv(allowlist) {
+  const env = {};
+  for (const name of allowlist) {
+    const value = process.env[name];
+    if (value !== void 0) env[name] = value;
+  }
+  return env;
+}
+function proxyEnv(policy, base = allowedEnv(policy.envAllowlist)) {
+  if (!policy.sandbox || policy.network || policy.proxy === void 0) return {};
+  const url = `http://127.0.0.1:${policy.proxy.port}`;
+  const java = `-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=${policy.proxy.port} -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=${policy.proxy.port}`;
+  const add = (name) => `${base[name] === void 0 ? "" : `${base[name]} `}${java}`;
+  return {
+    HTTP_PROXY: url,
+    HTTPS_PROXY: url,
+    http_proxy: url,
+    https_proxy: url,
+    NO_PROXY: "localhost,127.0.0.1,::1",
+    no_proxy: "localhost,127.0.0.1,::1",
+    NODE_USE_ENV_PROXY: "1",
+    MAVEN_OPTS: add("MAVEN_OPTS"),
+    GRADLE_OPTS: add("GRADLE_OPTS")
+  };
+}
+function plain(argv) {
+  const [file = "", ...args] = argv;
+  return { file, args };
+}
+
+// src/sandbox/host.ts
+var HostExecutor = class extends ProcessExecutor {
+  name = "host";
+  isolation = "none";
+  launch(argv) {
+    return plain(argv);
+  }
+};
+
+// src/sandbox/index.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { delimiter, join as join2 } from "path";
+
+// src/sandbox/bwrap.ts
+import { existsSync, statSync } from "fs";
+var BwrapExecutor = class extends ProcessExecutor {
+  constructor(bwrap) {
+    super();
+    this.bwrap = bwrap;
+  }
+  bwrap;
+  name = "bwrap";
+  isolation = "os";
+  launch(argv, policy) {
+    if (!policy.sandbox) return plain(argv);
+    return { file: this.bwrap, args: bwrapArgv(argv, policy) };
+  }
+};
+function bwrapArgv(argv, policy, kind = pathKind) {
+  const args = ["--ro-bind", "/", "/", "--dev", "/dev"];
+  for (const path of policy.writePaths)
+    if (kind(path) !== void 0) args.push("--bind", path, path);
+  for (const path of policy.denyWritePaths) {
+    if (kind(path) !== void 0) args.push("--ro-bind", path, path);
+  }
+  for (const path of policy.denyReadPaths) {
+    const k = kind(path);
+    if (k === "dir") args.push("--tmpfs", path, "--remount-ro", path);
+    else if (k === "file") args.push("--ro-bind", "/dev/null", path);
+  }
+  if (!policy.network) args.push("--unshare-net");
+  args.push("--unshare-pid", "--proc", "/proc");
+  const run = policy.sandbox && !policy.network ? withBridge(argv, policy) : argv;
+  args.push("--die-with-parent", "--chdir", policy.root, "--", ...run);
+  return args;
+}
+var BRIDGE_JS = 'const n=require("net");const[,s,p]=process.argv;n.createServer(c=>{const u=n.connect(s);c.pipe(u);u.pipe(c);c.on("error",()=>u.destroy());u.on("error",()=>c.destroy())}).listen(+p,"127.0.0.1")';
+var BRIDGE_WRAP = '"$1" -e "$2" "$3" "$4" </dev/null >/dev/null 2>&1 & for i in $(seq 200); do (: </dev/tcp/127.0.0.1/$4) 2>/dev/null && break; sleep 0.01; done; shift 4; exec "$@"';
+function withBridge(argv, policy) {
+  const proxy = policy.proxy;
+  if (proxy?.bridge === void 0) return argv;
+  return [
+    "bash",
+    "-c",
+    BRIDGE_WRAP,
+    "garuda-bridge",
+    proxy.bridge,
+    BRIDGE_JS,
+    proxy.socketPath,
+    String(proxy.port),
+    ...argv
+  ];
+}
+function pathKind(path) {
+  if (!existsSync(path)) return void 0;
+  return statSync(path).isDirectory() ? "dir" : "file";
+}
+
+// src/sandbox/seatbelt.ts
+var SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+var SeatbeltExecutor = class extends ProcessExecutor {
+  name = "seatbelt";
+  isolation = "os";
+  launch(argv, policy) {
+    if (!policy.sandbox) return plain(argv);
+    return { file: SANDBOX_EXEC, args: ["-p", seatbeltProfile(policy), ...argv] };
+  }
+};
+function seatbeltProfile(policy) {
+  const paths = (list) => list.map((p) => `(subpath ${quote(p)})`).join(" ");
+  const lines = [
+    "(version 1)",
+    "(allow default)",
+    "(deny file-write*)",
+    `(allow file-write* ${paths(policy.writePaths)} (literal "/dev/null") (literal "/dev/zero") (literal "/dev/dtracehelper") (regex #"^/dev/tty") (regex #"^/dev/fd/"))`
+  ];
+  if (policy.denyWritePaths.length > 0) {
+    lines.push(`(deny file-write* ${paths(policy.denyWritePaths)})`);
+  }
+  if (policy.denyReadPaths.length > 0) {
+    lines.push(`(deny file-read* ${paths(policy.denyReadPaths)})`);
+  }
+  lines.push("(deny lsopen)", "(deny appleevent-send)");
+  if (!policy.network) {
+    lines.push(
+      '(deny network-outbound (remote ip "*:*"))',
+      '(deny network-inbound (local ip "*:*"))',
+      '(deny network-bind (local ip "*:*"))',
+      '(allow network-outbound (remote ip "localhost:*"))',
+      '(allow network-inbound (local ip "localhost:*"))',
+      '(allow network-bind (local ip "localhost:*"))'
+    );
+  }
+  return lines.join("\n");
+}
+function quote(path) {
+  return `"${path.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+// src/sandbox/index.ts
+var EXECUTOR_NAMES = ["auto", "os", "host"];
+function createExecutor(name = "auto", find = findOsSandbox) {
+  if (name === "host") return { executor: new HostExecutor() };
+  const found = find();
+  if ("executor" in found) return { executor: found.executor };
+  if (name === "os") throw new Error(`No OS sandbox: ${found.problem} ${found.fix}`);
+  return {
+    executor: new HostExecutor(),
+    notice: `No OS sandbox: ${found.problem} Commands run on your machine, and each one asks for approval. ${found.fix}`
+  };
+}
+var cached;
+function findOsSandbox() {
+  cached ??= detect(process.platform);
+  return "make" in cached ? { executor: cached.make() } : cached;
+}
+function detect(platform) {
+  const fix = 'Set "executor": "host" in .garuda/settings.json to hide this notice.';
+  if (platform === "darwin") {
+    if (!existsSync2(SANDBOX_EXEC)) {
+      return { problem: `${SANDBOX_EXEC} is missing.`, fix };
+    }
+    const probe = spawnSync(SANDBOX_EXEC, ["-p", "(version 1)(allow default)", "--", "true"], {
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    if (probe.status === 0) return { make: () => new SeatbeltExecutor() };
+    const why = (probe.stderr || probe.error?.message || "unknown error").trim().split("\n")[0];
+    return { problem: `sandbox-exec cannot start a sandbox here (${why}).`, fix };
+  }
+  if (platform === "linux") {
+    const bwrap = onPath("bwrap");
+    if (bwrap === void 0) {
+      return {
+        problem: "bubblewrap (bwrap) is not installed.",
+        fix: 'Install it (for example: sudo apt install bubblewrap), or set "executor": "host" in .garuda/settings.json.'
+      };
+    }
+    const probe = spawnSync(
+      bwrap,
+      ["--ro-bind", "/", "/", "--dev", "/dev", "--unshare-net", "--die-with-parent", "--", "true"],
+      { encoding: "utf8", timeout: 5e3 }
+    );
+    if (probe.status === 0) return { make: () => new BwrapExecutor(bwrap) };
+    const why = (probe.stderr || probe.error?.message || "unknown error").trim().split("\n")[0];
+    return { problem: `bubblewrap cannot start a sandbox here (${why}).`, fix };
+  }
+  return { problem: `Garuda has no OS sandbox for ${platform}.`, fix };
+}
+function onPath(program) {
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    const path = join2(dir, program);
+    if (dir !== "" && existsSync2(path)) return path;
+  }
+  return void 0;
+}
+
+// src/permissions/settings.ts
+import { readFile } from "fs/promises";
+import { join as join3 } from "path";
+import { z } from "zod";
+
+// src/model/types.ts
+var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+var ZERO_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function addUsage(a, b) {
+  const searches = (a.webSearches ?? 0) + (b.webSearches ?? 0);
+  return {
+    inputTokens: a.inputTokens + b.inputTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+    cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+    cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+    ...searches === 0 ? {} : { webSearches: searches }
+  };
+}
+
+// src/permissions/settings.ts
+var SETTINGS_FILE = join3(".garuda", "settings.json");
+var NOTIFY_CHOICES = ["auto", "osc9", "bell", "off"];
+var schema = z.strictObject({
+  executor: z.enum(EXECUTOR_NAMES).optional(),
+  sandbox: z.strictObject({
+    writePaths: z.array(z.string()).optional(),
+    denyRead: z.array(z.string()).optional()
+  }).optional(),
+  /** Code index tools for the model: "off", "lookup" or "all" (true = "all", false = "off"). */
+  codeIndex: z.union([z.boolean(), z.enum(["off", "lookup", "all"])]).optional(),
+  permissions: z.strictObject({
+    allow: z.array(z.string()).optional(),
+    deny: z.array(z.string()).optional()
+  }).optional(),
+  env: z.strictObject({ allow: z.array(z.string()).optional() }).optional(),
+  /** The network allowlist for sandboxed commands (0.13): presets (npm, pypi …) or hosts. */
+  network: z.strictObject({ allow: z.array(z.string()).optional() }).optional(),
+  /** web_fetch. enabled: default true. allowLocalhost: default false (loopback only, never private ranges). */
+  web: z.strictObject({ enabled: z.boolean().optional(), allowLocalhost: z.boolean().optional() }).optional(),
+  limits: z.strictObject({
+    maxSteps: z.number().int().min(1).max(1e3).optional(),
+    tokenBudget: z.number().int().min(1e3).optional()
+  }).optional(),
+  /** The todo_write tool (0.4). enabled: default false. */
+  todo: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /** Undo snapshots before each turn (0.4). enabled: default true. */
+  undo: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /** Skills (0.5). enabled: default true (the skill tool appears only when skills exist). */
+  skills: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /** Custom agents (0.5). enabled: default true (the agent tool appears only when agents exist). */
+  agents: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /**
+   * Notifications in the chat (0.6): when an approval waits, and when a turn that ran at least
+   * `afterSeconds` (default 10) ends. channel: default "auto". GARUDA_NOTIFY overrides the channel.
+   */
+  notifications: z.strictObject({
+    channel: z.enum(NOTIFY_CHOICES).optional(),
+    afterSeconds: z.number().int().min(0).max(86400).optional()
+  }).optional(),
+  /** Language server diagnostics after edits (0.4). enabled: default false. */
+  lsp: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /**
+   * The project's formatter after edits (0.10). enabled: default false (A/B first). commands: by
+   * name, false turns a detected formatter off; a command adds one or replaces a detected one.
+   */
+  formatters: z.strictObject({
+    enabled: z.boolean().optional(),
+    commands: z.record(
+      z.string().regex(/^[a-z][a-z0-9-]*$/),
+      z.union([
+        z.literal(false),
+        z.strictObject({
+          extensions: z.array(z.string().min(1)).min(1),
+          command: z.array(z.string().min(1)).min(1)
+        })
+      ])
+    ).optional()
+  }).optional(),
+  /**
+   * Claude's thinking (0.9). keepBlocks: send thinking blocks back (default true, as the API asks);
+   * false is for A/B runs only. enabled, effort, show: the start value of /thinking.
+   */
+  thinking: z.strictObject({
+    keepBlocks: z.boolean().optional(),
+    enabled: z.boolean().optional(),
+    effort: z.enum(EFFORTS).optional(),
+    show: z.boolean().optional()
+  }).optional(),
+  /** The explore subagent (0.3). enabled: default false. Limits per explore run. */
+  subagents: z.strictObject({
+    enabled: z.boolean().optional(),
+    maxSteps: z.number().int().min(1).max(200).optional(),
+    tokenBudget: z.number().int().min(1e4).optional()
+  }).optional(),
+  /**
+   * Background processes (0.14): bash is_daemon and the process_manager tool. Off by default
+   * (merge gate): no measured gain yet, and they add tools and long-lived processes.
+   */
+  daemons: z.strictObject({ enabled: z.boolean().optional() }).optional(),
+  /** Mixture-of-Experts language specialist subagent dispatch (0.17). */
+  moe: z.strictObject({
+    enabled: z.boolean().optional(),
+    maxSteps: z.number().int().min(1).max(200).optional(),
+    tokenBudget: z.number().int().min(1e4).optional()
+  }).optional(),
+  model: z.strictObject({
+    contextWindow: z.number().int().min(1e4).optional(),
+    /** USD per million tokens. */
+    price: z.strictObject({
+      input: z.number().min(0),
+      output: z.number().min(0),
+      cacheRead: z.number().min(0),
+      cacheWrite: z.number().min(0)
+    }).optional()
+  }).optional()
+});
+var DEFAULT_SETTINGS = Object.freeze({
+  executor: "auto",
+  allow: Object.freeze([]),
+  deny: Object.freeze([]),
+  envAllow: Object.freeze([])
+});
+function parseSettings(json, source = SETTINGS_FILE) {
+  const parsed = schema.safeParse(json);
+  if (!parsed.success) throw new Error(`${source}: ${z.prettifyError(parsed.error)}`);
+  const {
+    executor = "auto",
+    sandbox,
+    web,
+    permissions = {},
+    env = {},
+    limits = {},
+    model = {},
+    codeIndex,
+    subagents,
+    moe,
+    daemons,
+    todo,
+    lsp,
+    undo,
+    skills,
+    agents,
+    notifications,
+    thinking,
+    formatters,
+    network
+  } = parsed.data;
+  const networkProblems = expandAllowlist(network?.allow ?? []).problems;
+  if (networkProblems.length > 0) {
+    throw new Error(`${source}: network.allow: ${networkProblems.join(" ")}`);
+  }
+  const rules = (list = []) => list.map((text) => {
+    try {
+      return parseRule(text);
+    } catch (error) {
+      throw new Error(`${source}: ${error.message}`);
+    }
+  });
+  return {
+    executor,
+    allow: rules(permissions.allow),
+    deny: rules(permissions.deny),
+    envAllow: env.allow ?? [],
+    ...network?.allow === void 0 || network.allow.length === 0 ? {} : { network: { allow: network.allow } },
+    ...web === void 0 ? {} : { web: { enabled: web.enabled ?? true, allowLocalhost: web.allowLocalhost ?? false } },
+    ...sandbox === void 0 ? {} : {
+      sandbox: {
+        ...sandbox.writePaths === void 0 ? {} : { writePaths: sandbox.writePaths },
+        ...sandbox.denyRead === void 0 ? {} : { denyRead: sandbox.denyRead }
+      }
+    },
+    ...codeIndex === void 0 ? {} : { codeIndex: codeIndex === true ? "all" : codeIndex === false ? "off" : codeIndex },
+    ...limits.maxSteps === void 0 ? {} : { maxSteps: limits.maxSteps },
+    ...limits.tokenBudget === void 0 ? {} : { tokenBudget: limits.tokenBudget },
+    ...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
+    ...model.price === void 0 ? {} : { price: model.price },
+    ...todo?.enabled === void 0 ? {} : { todo: { enabled: todo.enabled } },
+    ...lsp?.enabled === void 0 ? {} : { lsp: { enabled: lsp.enabled } },
+    ...undo?.enabled === void 0 ? {} : { undo: { enabled: undo.enabled } },
+    ...skills?.enabled === void 0 ? {} : { skills: { enabled: skills.enabled } },
+    ...agents?.enabled === void 0 ? {} : { agents: { enabled: agents.enabled } },
+    ...formatters === void 0 ? {} : {
+      formatters: {
+        enabled: formatters.enabled ?? false,
+        commands: formatters.commands ?? {}
+      }
+    },
+    ...thinking === void 0 ? {} : {
+      thinking: {
+        ...thinking.keepBlocks === void 0 ? {} : { keepBlocks: thinking.keepBlocks },
+        ...thinking.enabled === void 0 ? {} : { enabled: thinking.enabled },
+        ...thinking.effort === void 0 ? {} : { effort: thinking.effort },
+        ...thinking.show === void 0 ? {} : { show: thinking.show }
+      }
+    },
+    ...notifications === void 0 ? {} : {
+      notifications: {
+        ...notifications.channel === void 0 ? {} : { channel: notifications.channel },
+        ...notifications.afterSeconds === void 0 ? {} : { afterSeconds: notifications.afterSeconds }
+      }
+    },
+    ...subagents === void 0 ? {} : {
+      subagents: {
+        ...subagents.enabled === void 0 ? {} : { enabled: subagents.enabled },
+        ...subagents.maxSteps === void 0 ? {} : { maxSteps: subagents.maxSteps },
+        ...subagents.tokenBudget === void 0 ? {} : { tokenBudget: subagents.tokenBudget }
+      }
+    },
+    ...daemons?.enabled === void 0 ? {} : { daemons: { enabled: daemons.enabled } },
+    ...moe === void 0 ? {} : {
+      moe: {
+        ...moe.enabled === void 0 ? {} : { enabled: moe.enabled },
+        ...moe.maxSteps === void 0 ? {} : { maxSteps: moe.maxSteps },
+        ...moe.tokenBudget === void 0 ? {} : { tokenBudget: moe.tokenBudget }
+      }
+    }
+  };
+}
+async function loadSettings(root) {
+  let text;
+  try {
+    text = await readFile(join3(root, SETTINGS_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return DEFAULT_SETTINGS;
+    throw error;
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (error) {
+    throw new Error(`${SETTINGS_FILE}: invalid JSON: ${error.message}`);
+  }
+  return parseSettings(json);
+}
+
+// src/permissions/engine.ts
+import { sep } from "path";
+
+// src/permissions/sensitive.ts
+var SENSITIVE_PATTERNS = [
+  ".env",
+  ".env.*",
+  ".envrc",
+  "**/.ssh/**",
+  "**/.aws/**",
+  "**/.gnupg/**",
+  "**/.docker/config.json",
+  "**/.kube/config",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  ".git-credentials",
+  "credentials",
+  "credentials.json",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "*.keystore",
+  "id_rsa*",
+  "id_ecdsa*",
+  "id_ed25519*"
+];
+var PROTECTED_WRITE_PATTERNS = [".git/**"];
+function isSensitive(path, ignoreCase) {
+  return SENSITIVE_PATTERNS.some((pattern) => pathMatches(pattern, path, ignoreCase));
+}
+function isProtectedFromWrites(path) {
+  return PROTECTED_WRITE_PATTERNS.some((pattern) => pathMatches(pattern, path));
+}
+
+// src/permissions/engine.ts
+var DEFAULT_ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TMPDIR",
+  "TZ"
+];
+var DEFAULT_MAX_OUTPUT_BYTES = 3e4;
+var JOB_DENIAL = "This call is not in the approved list of this scheduled job, and nobody can approve it now. Do not retry it. Continue without it if you can, and list it in your final answer as work left for the user.";
+var PLAN_MODE_DENIAL = "Plan mode is on: this call would change something. Put the change in your plan instead; the user switches to build mode to carry it out.";
+var PermissionEngine = class {
+  root;
+  approver;
+  settings;
+  policy;
+  auditLogger;
+  isolation;
+  access;
+  mode;
+  unattended;
+  sessionRules = [];
+  /** The network proxy for sandboxed commands (0.13), when it runs. */
+  network;
+  constructor(options) {
+    this.root = options.root;
+    this.approver = options.approver;
+    this.settings = options.settings ?? DEFAULT_SETTINGS;
+    this.policy = options.policy;
+    this.auditLogger = options.auditLogger;
+    this.isolation = options.isolation ?? "none";
+    this.access = options.access ?? { writePaths: [], envAllow: [] };
+    this.mode = options.mode ?? (() => "build");
+    this.unattended = options.unattended;
+  }
+  async check(request, signal) {
+    const { decision, userChoice } = await this.evaluateCheck(request, signal);
+    await this.auditLogger?.logPermissionDecision({
+      tool: request.tool,
+      ...request.info?.target === void 0 ? {} : { target: request.info.target },
+      readOnly: request.readOnly,
+      decision,
+      ...userChoice === void 0 ? {} : { userChoice }
+    });
+    return decision;
+  }
+  async evaluateCheck(request, signal) {
+    const { tool, info } = request;
+    const target = info?.target;
+    const allowRule = this.settings.allow.find((r) => ruleMatches(r, tool, target, "allow"));
+    if (target?.kind === "path") {
+      const real2 = await realRelative(this.root, target.path);
+      if (real2 !== void 0) {
+        const denial = this.pathDenial(tool, { kind: "path", path: real2 }, request.readOnly);
+        if (denial !== void 0) {
+          return {
+            decision: { ...denial, reason: `${target.path} leads to ${real2}. ${denial.reason}` }
+          };
+        }
+      }
+    }
+    if (this.policy !== void 0) {
+      if (target?.kind === "command") {
+        const sandboxViolation = isSandboxRequiredByPolicy(
+          this.policy,
+          target.outsideSandbox === true || this.isolation === "none"
+        );
+        if (sandboxViolation.disallowed) {
+          return {
+            decision: {
+              allowed: false,
+              by: "policy",
+              reason: sandboxViolation.reason ?? "Running commands outside the sandbox is disallowed by team policy."
+            }
+          };
+        }
+        const cmdViolation = isCommandDisallowedByPolicy(this.policy, target.command);
+        if (cmdViolation.disallowed) {
+          return {
+            decision: {
+              allowed: false,
+              by: "policy",
+              reason: cmdViolation.reason ?? "Command disallowed by team policy."
+            }
+          };
+        }
+      }
+      if (target?.kind === "path") {
+        const pathViolation = isPathDeniedByPolicy(this.policy, target.path);
+        if (pathViolation.denied) {
+          return {
+            decision: {
+              allowed: false,
+              by: "policy",
+              reason: pathViolation.reason ?? "Path disallowed by team policy."
+            }
+          };
+        }
+      }
+      if (target?.kind === "url") {
+        const hostViolation = isHostBlockedByPolicy(this.policy, target.host);
+        if (hostViolation.blocked) {
+          return {
+            decision: {
+              allowed: false,
+              by: "policy",
+              reason: hostViolation.reason ?? "Host blocked by team policy."
+            }
+          };
+        }
+        if (this.policy.network?.strictAllowlist === true && allowRule === void 0) {
+          return {
+            decision: {
+              allowed: false,
+              by: "policy",
+              reason: `Host "${target.host}" is not on the network allowlist and strict policy prohibits user overrides.`
+            }
+          };
+        }
+      }
+    }
+    if (target?.kind === "path" && isSensitive(target.path)) {
+      const named = this.settings.allow.some(
+        (r) => r.pattern !== void 0 && ruleMatches(r, tool, target, "allow")
+      );
+      if (!named) {
+        return {
+          decision: {
+            allowed: false,
+            by: "sensitive",
+            reason: `${target.path} is a sensitive file. Add "${tool}(${target.path})" to permissions.allow in .garuda/settings.json to allow it.`
+          }
+        };
+      }
+    }
+    if (target?.kind === "path" && !request.readOnly && isProtectedFromWrites(target.path)) {
+      return {
+        decision: {
+          allowed: false,
+          by: "rule",
+          reason: `${target.path} is inside .git/.`,
+          kind: "protected"
+        }
+      };
+    }
+    const denyRule = this.settings.deny.find((r) => ruleMatches(r, tool, target, "deny"));
+    if (denyRule !== void 0) {
+      return {
+        decision: {
+          allowed: false,
+          by: "rule",
+          reason: `A deny rule blocks this call: ${formatRule(denyRule)}.`
+        }
+      };
+    }
+    if (this.mode() === "plan" && !request.readOnly) {
+      return { decision: this.planDecision(tool, target, allowRule !== void 0) };
+    }
+    if (request.readOnly) return { decision: { allowed: true, by: "read_only" } };
+    if (target?.kind === "command" && !target.outsideSandbox && this.isolation !== "none") {
+      return { decision: { allowed: true, by: "sandbox" } };
+    }
+    const mustAsk = target?.kind === "url" && target.alwaysAsk === true;
+    if (allowRule !== void 0 && !mustAsk) return { decision: { allowed: true, by: "rule" } };
+    if (!mustAsk && this.sessionRules.some((r) => ruleMatches(r, tool, target, "allow"))) {
+      return { decision: { allowed: true, by: "session" } };
+    }
+    const asked = target ?? { kind: "input", json: "{}" };
+    if (this.unattended !== void 0) {
+      this.unattended.onDeny?.(tool, asked);
+      return { decision: { allowed: false, by: "unattended", reason: this.unattended.reason } };
+    }
+    let accepted;
+    const choice = await this.approver.ask(
+      {
+        tool,
+        target: asked,
+        preview: info?.preview ?? describeTarget(asked),
+        isolation: this.isolation,
+        ...request.callId === void 0 ? {} : { callId: request.callId },
+        ...info?.change === void 0 ? {} : { change: info.change },
+        ...info?.title === void 0 ? {} : { title: info.title },
+        ...info?.hunks === true ? {
+          selectHunks: (hunks) => {
+            accepted = [...hunks];
+          }
+        } : {}
+      },
+      signal
+    );
+    if (choice === "deny") {
+      return {
+        decision: {
+          allowed: false,
+          by: "user",
+          reason: "The user denied this call. Do not retry it. Ask the user what to do instead."
+        },
+        userChoice: choice
+      };
+    }
+    if (choice === "session") this.sessionRules.push(sessionRule(tool, asked));
+    if (choice === "once" && accepted !== void 0) {
+      return { decision: { allowed: true, by: "user", hunks: accepted }, userChoice: choice };
+    }
+    return { decision: { allowed: true, by: "user" }, userChoice: choice };
+  }
+  /**
+   * Plan mode: file changes and memory are always denied; a command runs only in the OS sandbox
+   * (which then cannot write the project, see execPolicy); other calls (web_fetch, MCP tools)
+   * need an allow rule. Plan mode never asks: the plan is the place for changes.
+   */
+  planDecision(tool, target, allowed) {
+    const deny = {
+      allowed: false,
+      by: "rule",
+      reason: PLAN_MODE_DENIAL,
+      kind: "plan"
+    };
+    if (target?.kind === "command") {
+      if (target.outsideSandbox || this.isolation === "none") return deny;
+      return { allowed: true, by: "sandbox" };
+    }
+    if (target?.kind === "path" || tool === "remember") return deny;
+    const mustAsk = target?.kind === "url" && target.alwaysAsk === true;
+    return allowed && !mustAsk ? { allowed: true, by: "rule" } : deny;
+  }
+  /** The denials that depend only on the path: team policy, sensitive files, .git, deny rules. */
+  pathDenial(tool, target, readOnly) {
+    if (this.policy !== void 0) {
+      const violation = isPathDeniedByPolicy(this.policy, target.path);
+      if (violation.denied) {
+        return {
+          allowed: false,
+          by: "policy",
+          reason: violation.reason ?? "Denied by team policy."
+        };
+      }
+    }
+    if (isSensitive(target.path)) {
+      const named = this.settings.allow.some(
+        (r) => r.pattern !== void 0 && ruleMatches(r, tool, target, "allow")
+      );
+      if (!named) {
+        return { allowed: false, by: "sensitive", reason: `${target.path} is a sensitive file.` };
+      }
+    }
+    if (!readOnly && isProtectedFromWrites(target.path)) {
+      return {
+        allowed: false,
+        by: "rule",
+        reason: `${target.path} is inside .git/.`,
+        kind: "protected"
+      };
+    }
+    const deny = this.settings.deny.find((r) => ruleMatches(r, tool, target, "deny"));
+    if (deny !== void 0) {
+      return {
+        allowed: false,
+        by: "rule",
+        reason: `A deny rule blocks this call: ${formatRule(deny)}.`
+      };
+    }
+    return void 0;
+  }
+  commandPolicyDenial(command, outsideSandbox) {
+    if (this.policy === void 0) return void 0;
+    const sandbox = isSandboxRequiredByPolicy(
+      this.policy,
+      outsideSandbox || this.isolation === "none"
+    );
+    if (sandbox.disallowed) {
+      return sandbox.reason ?? "Running commands outside the sandbox is disallowed by team policy.";
+    }
+    const command_ = isCommandDisallowedByPolicy(this.policy, command);
+    if (command_.disallowed) return command_.reason ?? "Command disallowed by team policy.";
+    return void 0;
+  }
+  deniedByPolicy(path) {
+    return this.policy !== void 0 && isPathDeniedByPolicy(this.policy, path).denied;
+  }
+  /**
+   * The policy for one command. `readOnlyRoot` (plan mode, language servers): the project is
+   * read-only; temp folders and package caches stay writable.
+   */
+  execPolicy(timeoutMs, {
+    sandbox = true,
+    readOnlyRoot = this.mode() === "plan"
+  } = {}) {
+    const paths = sandboxPaths(this.root, this.settings.sandbox);
+    const denied = policyDeniedPaths(this.root, this.policy?.denyPaths ?? []);
+    let writePaths = [.../* @__PURE__ */ new Set([...paths.writePaths, ...this.access.writePaths])];
+    let denyWritePaths = [...paths.denyWritePaths, ...denied];
+    if (readOnlyRoot) {
+      const inRoot = (p) => p === this.root || p.startsWith(`${this.root}${sep}`);
+      writePaths = writePaths.filter((p) => !inRoot(p));
+      denyWritePaths = [this.root, ...denyWritePaths];
+    }
+    return {
+      root: this.root,
+      sandbox,
+      ...paths,
+      denyReadPaths: [...paths.denyReadPaths, ...denied],
+      writePaths,
+      denyWritePaths,
+      network: !sandbox,
+      ...sandbox && this.network !== void 0 ? { proxy: this.network.policy } : {},
+      envAllowlist: [
+        .../* @__PURE__ */ new Set([...DEFAULT_ENV_ALLOWLIST, ...this.access.envAllow, ...this.settings.envAllow])
+      ],
+      timeoutMs,
+      maxOutputBytes: DEFAULT_MAX_OUTPUT_BYTES
+    };
+  }
+  /** The network allowlist (0.13): the runtime sets it when the proxy runs. */
+  setNetwork(network) {
+    this.network = network;
+  }
+  takeNetworkBlocks() {
+    return this.network?.takeBlocked() ?? [];
+  }
+  /**
+   * The policy for a language server (0.4): in the sandbox, project read-only, no network, no
+   * time limit (it runs for the session).
+   */
+  serverPolicy() {
+    const { proxy: _proxy, ...policy } = this.execPolicy(0, { readOnlyRoot: true });
+    return { ...policy, maxOutputBytes: 0 };
+  }
+};
+function sessionRule(tool, target) {
+  if (target.kind === "command") return { tool, pattern: target.command, exact: true };
+  if (target.kind === "url") return { tool, pattern: target.host };
+  return { tool };
+}
+function describeTarget(target) {
+  if (target.kind === "path") return target.path;
+  if (target.kind === "command") {
+    return target.outsideSandbox ? `[outside sandbox] ${target.command}` : target.command;
+  }
+  if (target.kind === "url") return target.url;
+  return target.json;
+}
+
+export {
+  EFFORTS,
+  ZERO_USAGE,
+  addUsage,
+  isSensitive,
+  NETWORK_PORTS,
+  expandAllowlist,
+  hostAllowed,
+  describeAllowlist,
+  sandboxPaths,
+  HostExecutor,
+  EXECUTOR_NAMES,
+  createExecutor,
+  parseSettings,
+  loadSettings,
+  DEFAULT_ENV_ALLOWLIST,
+  JOB_DENIAL,
+  PermissionEngine
+};
+//# sourceMappingURL=chunk-SI2QJYCR.js.map