@google/gemini-cli-core 0.35.0-preview.2 → 0.36.0-nightly.20260321.fc03891a1

package/dist/src/routing/strategies/overrideStrategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"overrideStrategy.js","sourceRoot":"","sources":["../../../../src/routing/strategies/overrideStrategy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AASnE;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,UAAU,CAAC;IAE3B,KAAK,CAAC,KAAK,CACT,OAAuB,EACvB,MAAc,EACd,cAA6B,EAC7B,oBAAyC;QAEzC,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElE,8DAA8D;QAC9D,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oCAAoC;QACpC,OAAO;YACL,KAAK,EAAE,YAAY,CACjB,aAAa,EACb,MAAM,CAAC,uBAAuB,EAAE,EAAE,IAAI,KAAK,CAC5C;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,sDAAsD,aAAa,EAAE;aACjF;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"overrideStrategy.js","sourceRoot":"","sources":["../../../../src/routing/strategies/overrideStrategy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AASnE;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,UAAU,CAAC;IAE3B,KAAK,CAAC,KAAK,CACT,OAAuB,EACvB,MAAc,EACd,cAA6B,EAC7B,oBAAyC;QAEzC,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElE,8DAA8D;QAC9D,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oCAAoC;QACpC,OAAO;YACL,KAAK,EAAE,YAAY,CACjB,aAAa,EACb,MAAM,CAAC,uBAAuB,EAAE,EAAE,IAAI,KAAK,EAC3C,KAAK,EACL,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,IAAI,EAC7C,MAAM,CACP;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,sDAAsD,aAAa,EAAE;aACjF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/sandbox/macos/MacOsSandboxManager.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type SandboxManager, type SandboxRequest, type SandboxedCommand } from '../../services/sandboxManager.js';
+import { type EnvironmentSanitizationConfig } from '../../services/environmentSanitization.js';
+/**
+ * Options for configuring the MacOsSandboxManager.
+ */
+export interface MacOsSandboxOptions {
+    /** The primary workspace path to allow access to within the sandbox. */
+    workspace: string;
+    /** Additional paths to allow access to within the sandbox. */
+    allowedPaths?: string[];
+    /** Whether network access is allowed. */
+    networkAccess?: boolean;
+    /** Optional base sanitization config. */
+    sanitizationConfig?: EnvironmentSanitizationConfig;
+}
+/**
+ * A SandboxManager implementation for macOS that uses Seatbelt.
+ */
+export declare class MacOsSandboxManager implements SandboxManager {
+    private readonly options;
+    constructor(options: MacOsSandboxOptions);
+    prepareCommand(req: SandboxRequest): Promise<SandboxedCommand>;
+}

package/dist/src/sandbox/macos/MacOsSandboxManager.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/sandbox/macos/MacOsSandboxManager.integration.test.js

@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { MacOsSandboxManager } from './MacOsSandboxManager.js';
+import { ShellExecutionService } from '../../services/shellExecutionService.js';
+import { getSecureSanitizationConfig } from '../../services/environmentSanitization.js';
+import {} from '../../services/sandboxManager.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+/**
+ * A simple asynchronous wrapper for execFile that returns the exit status,
+ * stdout, and stderr. Unlike spawnSync, this does not block the Node.js
+ * event loop, allowing the local HTTP test server to function.
+ */
+async function runCommand(command) {
+    try {
+        const { stdout, stderr } = await promisify(execFile)(command.program, command.args, {
+            cwd: command.cwd,
+            env: command.env,
+            encoding: 'utf-8',
+        });
+        return { status: 0, stdout, stderr };
+    }
+    catch (error) {
+        const err = error;
+        return {
+            status: err.code ?? 1,
+            stdout: err.stdout ?? '',
+            stderr: err.stderr ?? '',
+        };
+    }
+}
+describe.skipIf(os.platform() !== 'darwin')('MacOsSandboxManager Integration', () => {
+    describe('Basic Execution', () => {
+        it('should execute commands within the workspace', async () => {
+            const manager = new MacOsSandboxManager({ workspace: process.cwd() });
+            const command = await manager.prepareCommand({
+                command: 'echo',
+                args: ['sandbox test'],
+                cwd: process.cwd(),
+                env: process.env,
+            });
+            const execResult = await runCommand(command);
+            expect(execResult.status).toBe(0);
+            expect(execResult.stdout.trim()).toBe('sandbox test');
+        });
+        it('should support interactive pseudo-terminals (node-pty)', async () => {
+            const manager = new MacOsSandboxManager({ workspace: process.cwd() });
+            const abortController = new AbortController();
+            // Verify that node-pty file descriptors are successfully allocated inside the sandbox
+            // by using the bash [ -t 1 ] idiom to check if stdout is a TTY.
+            const handle = await ShellExecutionService.execute('bash -c "if [ -t 1 ]; then echo True; else echo False; fi"', process.cwd(), () => { }, abortController.signal, true, {
+                sanitizationConfig: getSecureSanitizationConfig(),
+                sandboxManager: manager,
+            });
+            const result = await handle.result;
+            expect(result.error).toBeNull();
+            expect(result.exitCode).toBe(0);
+            expect(result.output).toContain('True');
+        });
+    });
+    describe('File System Access', () => {
+        it('should block file system access outside the workspace', async () => {
+            const manager = new MacOsSandboxManager({ workspace: process.cwd() });
+            const blockedPath = '/Users/Shared/.gemini_test_sandbox_blocked';
+            const command = await manager.prepareCommand({
+                command: 'touch',
+                args: [blockedPath],
+                cwd: process.cwd(),
+                env: process.env,
+            });
+            const execResult = await runCommand(command);
+            expect(execResult.status).not.toBe(0);
+            expect(execResult.stderr).toContain('Operation not permitted');
+        });
+        it('should grant file system access to explicitly allowed paths', async () => {
+            // Create a unique temporary directory to prevent artifacts and test flakiness
+            const allowedDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-sandbox-test-'));
+            try {
+                const manager = new MacOsSandboxManager({
+                    workspace: process.cwd(),
+                    allowedPaths: [allowedDir],
+                });
+                const testFile = path.join(allowedDir, 'test.txt');
+                const command = await manager.prepareCommand({
+                    command: 'touch',
+                    args: [testFile],
+                    cwd: process.cwd(),
+                    env: process.env,
+                });
+                const execResult = await runCommand(command);
+                expect(execResult.status).toBe(0);
+            }
+            finally {
+                fs.rmSync(allowedDir, { recursive: true, force: true });
+            }
+        });
+    });
+    describe('Network Access', () => {
+        let testServer;
+        let testServerUrl;
+        beforeAll(async () => {
+            testServer = http.createServer((_, res) => {
+                // Ensure connections are closed immediately to prevent hanging
+                res.setHeader('Connection', 'close');
+                res.writeHead(200);
+                res.end('ok');
+            });
+            await new Promise((resolve, reject) => {
+                testServer.on('error', reject);
+                testServer.listen(0, '127.0.0.1', () => {
+                    const address = testServer.address();
+                    testServerUrl = `http://127.0.0.1:${address.port}`;
+                    resolve();
+                });
+            });
+        });
+        afterAll(async () => {
+            if (testServer) {
+                await new Promise((resolve) => {
+                    testServer.close(() => resolve());
+                });
+            }
+        });
+        it('should block network access by default', async () => {
+            const manager = new MacOsSandboxManager({ workspace: process.cwd() });
+            const command = await manager.prepareCommand({
+                command: 'curl',
+                args: ['-s', '--connect-timeout', '1', testServerUrl],
+                cwd: process.cwd(),
+                env: process.env,
+            });
+            const execResult = await runCommand(command);
+            expect(execResult.status).not.toBe(0);
+        });
+        it('should grant network access when explicitly allowed', async () => {
+            const manager = new MacOsSandboxManager({
+                workspace: process.cwd(),
+                networkAccess: true,
+            });
+            const command = await manager.prepareCommand({
+                command: 'curl',
+                args: ['-s', '--connect-timeout', '1', testServerUrl],
+                cwd: process.cwd(),
+                env: process.env,
+            });
+            const execResult = await runCommand(command);
+            expect(execResult.status).toBe(0);
+            expect(execResult.stdout.trim()).toBe('ok');
+        });
+    });
+});
+//# sourceMappingURL=MacOsSandboxManager.integration.test.js.map

package/dist/src/sandbox/macos/MacOsSandboxManager.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacOsSandboxManager.integration.test.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/MacOsSandboxManager.integration.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAyB,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,OAAyB;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAClD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,IAAI,EACZ;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO;SAClB,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAIX,CAAC;QACF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;YACrB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC,CACzC,iCAAiC,EACjC,GAAG,EAAE;IACH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC3C,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;YAE9C,sFAAsF;YACtF,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAChD,4DAA4D,EAC5D,OAAO,CAAC,GAAG,EAAE,EACb,GAAG,EAAE,GAAE,CAAC,EACR,eAAe,CAAC,MAAM,EACtB,IAAI,EACJ;gBACE,kBAAkB,EAAE,2BAA2B,EAAE;gBACjD,cAAc,EAAE,OAAO;aACxB,CACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,WAAW,GAAG,4CAA4C,CAAC;YAEjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC3C,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC3E,8EAA8E;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;oBACtC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;oBACxB,YAAY,EAAE,CAAC,UAAU,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAEnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,CAAC,QAAQ,CAAC;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;oBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB,CAAC,CAAC;gBAEH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBAE7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,IAAI,UAAuB,CAAC;QAC5B,IAAI,aAAqB,CAAC;QAE1B,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;gBACxC,+DAA+D;gBAC/D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC/B,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;oBACrC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAA+B,CAAC;oBAClE,aAAa,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;oBACnD,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC3C,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa,CAAC;gBACrD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;gBACxB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC3C,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa,CAAC;gBACrD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/src/sandbox/macos/MacOsSandboxManager.js

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {} from '../../services/sandboxManager.js';
+import { sanitizeEnvironment, getSecureSanitizationConfig, } from '../../services/environmentSanitization.js';
+import { buildSeatbeltArgs } from './seatbeltArgsBuilder.js';
+/**
+ * A SandboxManager implementation for macOS that uses Seatbelt.
+ */
+export class MacOsSandboxManager {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async prepareCommand(req) {
+        const sanitizationConfig = getSecureSanitizationConfig(req.config?.sanitizationConfig, this.options.sanitizationConfig);
+        const sanitizedEnv = sanitizeEnvironment(req.env, sanitizationConfig);
+        const sandboxArgs = buildSeatbeltArgs({
+            workspace: this.options.workspace,
+            allowedPaths: this.options.allowedPaths,
+            networkAccess: this.options.networkAccess,
+        });
+        return {
+            program: '/usr/bin/sandbox-exec',
+            args: [...sandboxArgs, '--', req.command, ...req.args],
+            env: sanitizedEnv,
+            cwd: req.cwd,
+        };
+    }
+}
+//# sourceMappingURL=MacOsSandboxManager.js.map

package/dist/src/sandbox/macos/MacOsSandboxManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacOsSandboxManager.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/MacOsSandboxManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIN,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAE5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAgB7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;IAAG,CAAC;IAE7D,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAC9B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAChC,CAAC;QAEF,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SAC1C,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACtD,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC;IACJ,CAAC;CACF"}

package/dist/src/sandbox/macos/MacOsSandboxManager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/sandbox/macos/MacOsSandboxManager.test.js

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach, } from 'vitest';
+import { MacOsSandboxManager } from './MacOsSandboxManager.js';
+import * as seatbeltArgsBuilder from './seatbeltArgsBuilder.js';
+describe('MacOsSandboxManager', () => {
+    const mockWorkspace = '/test/workspace';
+    const mockAllowedPaths = ['/test/allowed'];
+    const mockNetworkAccess = true;
+    let manager;
+    let buildArgsSpy;
+    beforeEach(() => {
+        manager = new MacOsSandboxManager({
+            workspace: mockWorkspace,
+            allowedPaths: mockAllowedPaths,
+            networkAccess: mockNetworkAccess,
+        });
+        buildArgsSpy = vi
+            .spyOn(seatbeltArgsBuilder, 'buildSeatbeltArgs')
+            .mockReturnValue([
+            '-p',
+            '(mock profile)',
+            '-D',
+            'WORKSPACE=/test/workspace',
+        ]);
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('should correctly invoke buildSeatbeltArgs with the configured options', async () => {
+        await manager.prepareCommand({
+            command: 'echo',
+            args: ['hello'],
+            cwd: mockWorkspace,
+            env: {},
+        });
+        expect(buildArgsSpy).toHaveBeenCalledWith({
+            workspace: mockWorkspace,
+            allowedPaths: mockAllowedPaths,
+            networkAccess: mockNetworkAccess,
+        });
+    });
+    it('should format the executable and arguments correctly for sandbox-exec', async () => {
+        const result = await manager.prepareCommand({
+            command: 'echo',
+            args: ['hello'],
+            cwd: mockWorkspace,
+            env: {},
+        });
+        expect(result.program).toBe('/usr/bin/sandbox-exec');
+        expect(result.args).toEqual([
+            '-p',
+            '(mock profile)',
+            '-D',
+            'WORKSPACE=/test/workspace',
+            '--',
+            'echo',
+            'hello',
+        ]);
+    });
+    it('should correctly pass through the cwd to the resulting command', async () => {
+        const result = await manager.prepareCommand({
+            command: 'echo',
+            args: ['hello'],
+            cwd: '/test/different/cwd',
+            env: {},
+        });
+        expect(result.cwd).toBe('/test/different/cwd');
+    });
+    it('should apply environment sanitization via the default mechanisms', async () => {
+        const result = await manager.prepareCommand({
+            command: 'echo',
+            args: ['hello'],
+            cwd: mockWorkspace,
+            env: {
+                SAFE_VAR: '1',
+                GITHUB_TOKEN: 'sensitive',
+            },
+        });
+        expect(result.env['SAFE_VAR']).toBe('1');
+        expect(result.env['GITHUB_TOKEN']).toBeUndefined();
+    });
+});
+//# sourceMappingURL=MacOsSandboxManager.test.js.map

package/dist/src/sandbox/macos/MacOsSandboxManager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacOsSandboxManager.test.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/MacOsSandboxManager.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,QAAQ,EACR,EAAE,EACF,MAAM,EACN,EAAE,EACF,UAAU,EACV,SAAS,GAEV,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,mBAAmB,MAAM,0BAA0B,CAAC;AAEhE,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,aAAa,GAAG,iBAAiB,CAAC;IACxC,MAAM,gBAAgB,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAE/B,IAAI,OAA4B,CAAC;IACjC,IAAI,YAAwE,CAAC;IAE7E,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,IAAI,mBAAmB,CAAC;YAChC,SAAS,EAAE,aAAa;YACxB,YAAY,EAAE,gBAAgB;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;QAEH,YAAY,GAAG,EAAE;aACd,KAAK,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;aAC/C,eAAe,CAAC;YACf,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,2BAA2B;SAC5B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,CAAC,cAAc,CAAC;YAC3B,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE,EAAE;SACR,CAAC,CAAC;QAEH,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC;YACxC,SAAS,EAAE,aAAa;YACxB,YAAY,EAAE,gBAAgB;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC1C,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE,EAAE;SACR,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC1B,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,2BAA2B;YAC3B,IAAI;YACJ,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC1C,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,qBAAqB;YAC1B,GAAG,EAAE,EAAE;SACR,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC1C,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE;gBACH,QAAQ,EAAE,GAAG;gBACb,YAAY,EAAE,WAAW;aAC1B;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/sandbox/macos/baseProfile.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * The base macOS Seatbelt (SBPL) profile for tool execution.
+ *
+ * This uses a strict allowlist (deny default) but imports Apple's base system profile
+ * to handle undocumented internal dependencies, sysctls, and IPC mach ports required
+ * by standard tools to avoid "Abort trap: 6".
+ */
+export declare const BASE_SEATBELT_PROFILE = "(version 1)\n(deny default)\n\n(import \"system.sb\")\n\n; Core execution requirements\n(allow process-exec)\n(allow process-fork)\n(allow signal (target same-sandbox))\n(allow process-info* (target same-sandbox))\n\n; Allow basic read access to system frameworks and libraries required to run\n(allow file-read*\n  (subpath \"/System\")\n  (subpath \"/usr/lib\")\n  (subpath \"/usr/share\")\n  (subpath \"/usr/bin\")\n  (subpath \"/bin\")\n  (subpath \"/sbin\")\n  (subpath \"/usr/local/bin\")\n  (subpath \"/opt/homebrew\")\n  (subpath \"/Library\")\n  (subpath \"/private/var/run\")\n  (subpath \"/private/var/db\")\n  (subpath \"/private/etc\")\n)\n\n; PTY and Terminal support\n(allow pseudo-tty)\n(allow file-read* file-write* file-ioctl (literal \"/dev/ptmx\"))\n(allow file-read* file-write* file-ioctl (regex #\"^/dev/ttys[0-9]+\"))\n\n; Allow read/write access to temporary directories and common device nodes\n(allow file-read* file-write*\n  (literal \"/dev/null\")\n  (literal \"/dev/zero\")\n  (subpath \"/tmp\")\n  (subpath \"/private/tmp\")\n  (subpath (param \"TMPDIR\"))\n)\n\n; Workspace access using parameterized paths\n(allow file-read* file-write*\n  (subpath (param \"WORKSPACE\"))\n)\n";
+/**
+ * The network-specific macOS Seatbelt (SBPL) profile rules.
+ *
+ * These rules are appended to the base profile when network access is enabled,
+ * allowing standard socket creation, DNS resolution, and TLS certificate validation.
+ */
+export declare const NETWORK_SEATBELT_PROFILE = "\n; Network Access\n(allow network*)\n\n(allow system-socket\n  (require-all\n    (socket-domain AF_SYSTEM)\n    (socket-protocol 2)\n  )\n)\n\n(allow mach-lookup\n    (global-name \"com.apple.bsd.dirhelper\")\n    (global-name \"com.apple.system.opendirectoryd.membership\")\n    (global-name \"com.apple.SecurityServer\")\n    (global-name \"com.apple.networkd\")\n    (global-name \"com.apple.ocspd\")\n    (global-name \"com.apple.trustd.agent\")\n    (global-name \"com.apple.mDNSResponder\")\n    (global-name \"com.apple.mDNSResponderHelper\")\n    (global-name \"com.apple.SystemConfiguration.DNSConfiguration\")\n    (global-name \"com.apple.SystemConfiguration.configd\")\n)\n\n(allow sysctl-read\n  (sysctl-name-regex #\"^net.routetable\")\n)\n";

package/dist/src/sandbox/macos/baseProfile.js

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * The base macOS Seatbelt (SBPL) profile for tool execution.
+ *
+ * This uses a strict allowlist (deny default) but imports Apple's base system profile
+ * to handle undocumented internal dependencies, sysctls, and IPC mach ports required
+ * by standard tools to avoid "Abort trap: 6".
+ */
+export const BASE_SEATBELT_PROFILE = `(version 1)
+(deny default)
+
+(import "system.sb")
+
+; Core execution requirements
+(allow process-exec)
+(allow process-fork)
+(allow signal (target same-sandbox))
+(allow process-info* (target same-sandbox))
+
+; Allow basic read access to system frameworks and libraries required to run
+(allow file-read*
+  (subpath "/System")
+  (subpath "/usr/lib")
+  (subpath "/usr/share")
+  (subpath "/usr/bin")
+  (subpath "/bin")
+  (subpath "/sbin")
+  (subpath "/usr/local/bin")
+  (subpath "/opt/homebrew")
+  (subpath "/Library")
+  (subpath "/private/var/run")
+  (subpath "/private/var/db")
+  (subpath "/private/etc")
+)
+
+; PTY and Terminal support
+(allow pseudo-tty)
+(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
+(allow file-read* file-write* file-ioctl (regex #"^/dev/ttys[0-9]+"))
+
+; Allow read/write access to temporary directories and common device nodes
+(allow file-read* file-write*
+  (literal "/dev/null")
+  (literal "/dev/zero")
+  (subpath "/tmp")
+  (subpath "/private/tmp")
+  (subpath (param "TMPDIR"))
+)
+
+; Workspace access using parameterized paths
+(allow file-read* file-write*
+  (subpath (param "WORKSPACE"))
+)
+`;
+/**
+ * The network-specific macOS Seatbelt (SBPL) profile rules.
+ *
+ * These rules are appended to the base profile when network access is enabled,
+ * allowing standard socket creation, DNS resolution, and TLS certificate validation.
+ */
+export const NETWORK_SEATBELT_PROFILE = `
+; Network Access
+(allow network*)
+
+(allow system-socket
+  (require-all
+    (socket-domain AF_SYSTEM)
+    (socket-protocol 2)
+  )
+)
+
+(allow mach-lookup
+    (global-name "com.apple.bsd.dirhelper")
+    (global-name "com.apple.system.opendirectoryd.membership")
+    (global-name "com.apple.SecurityServer")
+    (global-name "com.apple.networkd")
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.trustd.agent")
+    (global-name "com.apple.mDNSResponder")
+    (global-name "com.apple.mDNSResponderHelper")
+    (global-name "com.apple.SystemConfiguration.DNSConfiguration")
+    (global-name "com.apple.SystemConfiguration.configd")
+)
+
+(allow sysctl-read
+  (sysctl-name-regex #"^net.routetable")
+)
+`;
+//# sourceMappingURL=baseProfile.js.map

package/dist/src/sandbox/macos/baseProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseProfile.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/baseProfile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BvC,CAAC"}

package/dist/src/sandbox/macos/seatbeltArgsBuilder.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Options for building macOS Seatbelt arguments.
+ */
+export interface SeatbeltArgsOptions {
+    /** The primary workspace path to allow access to. */
+    workspace: string;
+    /** Additional paths to allow access to. */
+    allowedPaths?: string[];
+    /** Whether to allow network access. */
+    networkAccess?: boolean;
+}
+/**
+ * Builds the arguments array for sandbox-exec using a strict allowlist profile.
+ * It relies on parameters passed to sandbox-exec via the -D flag to avoid
+ * string interpolation vulnerabilities, and normalizes paths against symlink escapes.
+ *
+ * Returns arguments up to the end of sandbox-exec configuration (e.g. ['-p', '<profile>', '-D', ...])
+ * Does not include the final '--' separator or the command to run.
+ */
+export declare function buildSeatbeltArgs(options: SeatbeltArgsOptions): string[];

package/dist/src/sandbox/macos/seatbeltArgsBuilder.js

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { BASE_SEATBELT_PROFILE, NETWORK_SEATBELT_PROFILE, } from './baseProfile.js';
+/**
+ * Resolves symlinks for a given path to prevent sandbox escapes.
+ * If a file does not exist (ENOENT), it recursively resolves the parent directory.
+ * Other errors (e.g. EACCES) are re-thrown.
+ */
+function tryRealpath(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch (e) {
+        if (e instanceof Error && 'code' in e && e.code === 'ENOENT') {
+            const parentDir = path.dirname(p);
+            if (parentDir === p) {
+                return p;
+            }
+            return path.join(tryRealpath(parentDir), path.basename(p));
+        }
+        throw e;
+    }
+}
+/**
+ * Builds the arguments array for sandbox-exec using a strict allowlist profile.
+ * It relies on parameters passed to sandbox-exec via the -D flag to avoid
+ * string interpolation vulnerabilities, and normalizes paths against symlink escapes.
+ *
+ * Returns arguments up to the end of sandbox-exec configuration (e.g. ['-p', '<profile>', '-D', ...])
+ * Does not include the final '--' separator or the command to run.
+ */
+export function buildSeatbeltArgs(options) {
+    let profile = BASE_SEATBELT_PROFILE + '\n';
+    const args = [];
+    const workspacePath = tryRealpath(options.workspace);
+    args.push('-D', `WORKSPACE=${workspacePath}`);
+    const tmpPath = tryRealpath(os.tmpdir());
+    args.push('-D', `TMPDIR=${tmpPath}`);
+    if (options.allowedPaths) {
+        for (let i = 0; i < options.allowedPaths.length; i++) {
+            const allowedPath = tryRealpath(options.allowedPaths[i]);
+            args.push('-D', `ALLOWED_PATH_${i}=${allowedPath}`);
+            profile += `(allow file-read* file-write* (subpath (param "ALLOWED_PATH_${i}")))\n`;
+        }
+    }
+    if (options.networkAccess) {
+        profile += NETWORK_SEATBELT_PROFILE;
+    }
+    args.unshift('-p', profile);
+    return args;
+}
+//# sourceMappingURL=seatbeltArgsBuilder.js.map

package/dist/src/sandbox/macos/seatbeltArgsBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbeltArgsBuilder.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/seatbeltArgsBuilder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAc1B;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,IAAI,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,aAAa,EAAE,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,+DAA+D,CAAC,QAAQ,CAAC;QACtF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,IAAI,wBAAwB,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/sandbox/macos/seatbeltArgsBuilder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/sandbox/macos/seatbeltArgsBuilder.test.js

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { buildSeatbeltArgs } from './seatbeltArgsBuilder.js';
+import fs from 'node:fs';
+import os from 'node:os';
+describe('seatbeltArgsBuilder', () => {
+    it('should build a strict allowlist profile allowing the workspace via param', () => {
+        // Mock realpathSync to just return the path for testing
+        vi.spyOn(fs, 'realpathSync').mockImplementation((p) => p);
+        const args = buildSeatbeltArgs({ workspace: '/Users/test/workspace' });
+        expect(args[0]).toBe('-p');
+        const profile = args[1];
+        expect(profile).toContain('(version 1)');
+        expect(profile).toContain('(deny default)');
+        expect(profile).toContain('(allow process-exec)');
+        expect(profile).toContain('(subpath (param "WORKSPACE"))');
+        expect(profile).not.toContain('(allow network*)');
+        expect(args).toContain('-D');
+        expect(args).toContain('WORKSPACE=/Users/test/workspace');
+        expect(args).toContain(`TMPDIR=${os.tmpdir()}`);
+        vi.restoreAllMocks();
+    });
+    it('should allow network when networkAccess is true', () => {
+        const args = buildSeatbeltArgs({ workspace: '/test', networkAccess: true });
+        const profile = args[1];
+        expect(profile).toContain('(allow network*)');
+    });
+    it('should parameterize allowed paths and normalize them', () => {
+        vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
+            if (p === '/test/symlink')
+                return '/test/real_path';
+            return p;
+        });
+        const args = buildSeatbeltArgs({
+            workspace: '/test',
+            allowedPaths: ['/custom/path1', '/test/symlink'],
+        });
+        const profile = args[1];
+        expect(profile).toContain('(subpath (param "ALLOWED_PATH_0"))');
+        expect(profile).toContain('(subpath (param "ALLOWED_PATH_1"))');
+        expect(args).toContain('-D');
+        expect(args).toContain('ALLOWED_PATH_0=/custom/path1');
+        expect(args).toContain('ALLOWED_PATH_1=/test/real_path');
+        vi.restoreAllMocks();
+    });
+    it('should resolve parent directories if a file does not exist', () => {
+        vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
+            if (p === '/test/symlink/nonexistent.txt') {
+                const error = new Error('ENOENT');
+                Object.assign(error, { code: 'ENOENT' });
+                throw error;
+            }
+            if (p === '/test/symlink') {
+                return '/test/real_path';
+            }
+            return p;
+        });
+        const args = buildSeatbeltArgs({
+            workspace: '/test/symlink/nonexistent.txt',
+        });
+        expect(args).toContain('WORKSPACE=/test/real_path/nonexistent.txt');
+        vi.restoreAllMocks();
+    });
+    it('should throw if realpathSync throws a non-ENOENT error', () => {
+        vi.spyOn(fs, 'realpathSync').mockImplementation(() => {
+            const error = new Error('Permission denied');
+            Object.assign(error, { code: 'EACCES' });
+            throw error;
+        });
+        expect(() => buildSeatbeltArgs({
+            workspace: '/test/workspace',
+        })).toThrow('Permission denied');
+        vi.restoreAllMocks();
+    });
+});
+//# sourceMappingURL=seatbeltArgsBuilder.test.js.map

package/dist/src/sandbox/macos/seatbeltArgsBuilder.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbeltArgsBuilder.test.js","sourceRoot":"","sources":["../../../../src/sandbox/macos/seatbeltArgsBuilder.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,wDAAwD;QACxD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAW,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAEvE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEhD,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;YACpD,IAAI,CAAC,KAAK,eAAe;gBAAE,OAAO,iBAAiB,CAAC;YACpD,OAAO,CAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,iBAAiB,CAAC;YAC7B,SAAS,EAAE,OAAO;YAClB,YAAY,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAEhE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAEzD,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;YACpD,IAAI,CAAC,KAAK,+BAA+B,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1B,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,OAAO,CAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,iBAAiB,CAAC;YAC7B,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACpE,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACnD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CACV,iBAAiB,CAAC;YAChB,SAAS,EAAE,iBAAiB;SAC7B,CAAC,CACH,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAE/B,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}