@google/gemini-cli-core 0.35.0-preview.2 → 0.36.0-nightly.20260321.fc03891a1

package/dist/src/services/sandboxedFileSystemService.js

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawn } from 'node:child_process';
+import {} from './fileSystemService.js';
+import {} from './sandboxManager.js';
+import { debugLogger } from '../utils/debugLogger.js';
+import { isNodeError } from '../utils/errors.js';
+/**
+ * A FileSystemService implementation that performs operations through a sandbox.
+ */
+export class SandboxedFileSystemService {
+    sandboxManager;
+    cwd;
+    constructor(sandboxManager, cwd) {
+        this.sandboxManager = sandboxManager;
+        this.cwd = cwd;
+    }
+    async readTextFile(filePath) {
+        const prepared = await this.sandboxManager.prepareCommand({
+            command: '__read',
+            args: [filePath],
+            cwd: this.cwd,
+            env: process.env,
+        });
+        return new Promise((resolve, reject) => {
+            // Direct spawn is necessary here for streaming large file contents.
+            const child = spawn(prepared.program, prepared.args, {
+                cwd: this.cwd,
+                env: prepared.env,
+            });
+            let output = '';
+            let error = '';
+            child.stdout?.on('data', (data) => {
+                output += data.toString();
+            });
+            child.stderr?.on('data', (data) => {
+                error += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    resolve(output);
+                }
+                else {
+                    reject(new Error(`Sandbox Error: read_file failed for '${filePath}'. Exit code ${code}. ${error ? 'Details: ' + error : ''}`));
+                }
+            });
+            child.on('error', (err) => {
+                reject(new Error(`Sandbox Error: Failed to spawn read_file for '${filePath}': ${err.message}`));
+            });
+        });
+    }
+    async writeTextFile(filePath, content) {
+        const prepared = await this.sandboxManager.prepareCommand({
+            command: '__write',
+            args: [filePath],
+            cwd: this.cwd,
+            env: process.env,
+        });
+        return new Promise((resolve, reject) => {
+            // Direct spawn is necessary here for streaming large file contents.
+            const child = spawn(prepared.program, prepared.args, {
+                cwd: this.cwd,
+                env: prepared.env,
+            });
+            child.stdin?.on('error', (err) => {
+                // Silently ignore EPIPE errors on stdin, they will be caught by the process error/close listeners
+                if (isNodeError(err) && err.code === 'EPIPE') {
+                    return;
+                }
+                debugLogger.error(`Sandbox Error: stdin error for '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+            });
+            child.stdin?.write(content);
+            child.stdin?.end();
+            let error = '';
+            child.stderr?.on('data', (data) => {
+                error += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    resolve();
+                }
+                else {
+                    reject(new Error(`Sandbox Error: write_file failed for '${filePath}'. Exit code ${code}. ${error ? 'Details: ' + error : ''}`));
+                }
+            });
+            child.on('error', (err) => {
+                reject(new Error(`Sandbox Error: Failed to spawn write_file for '${filePath}': ${err.message}`));
+            });
+        });
+    }
+}
+//# sourceMappingURL=sandboxedFileSystemService.js.map

package/dist/src/services/sandboxedFileSystemService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxedFileSystemService.js","sourceRoot":"","sources":["../../../src/services/sandboxedFileSystemService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAA0B,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAuB,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;GAEG;AACH,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,cAA8B,EAC9B,GAAW;QADX,mBAAc,GAAd,cAAc,CAAgB;QAC9B,QAAG,GAAH,GAAG,CAAQ;IAClB,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACxD,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,oEAAoE;YAEpE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;gBACnD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,QAAQ,CAAC,GAAG;aAClB,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,KAAK,GAAG,EAAE,CAAC;YAEf,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,KAAK,CACP,wCAAwC,QAAQ,gBAAgB,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5G,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,MAAM,CACJ,IAAI,KAAK,CACP,iDAAiD,QAAQ,MAAM,GAAG,CAAC,OAAO,EAAE,CAC7E,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACxD,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,oEAAoE;YAEpE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;gBACnD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,QAAQ,CAAC,GAAG;aAClB,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,kGAAkG;gBAClG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBACD,WAAW,CAAC,KAAK,CACf,mCAAmC,QAAQ,MACzC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YAEnB,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,KAAK,CACP,yCAAyC,QAAQ,gBAAgB,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7G,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,MAAM,CACJ,IAAI,KAAK,CACP,kDAAkD,QAAQ,MAAM,GAAG,CAAC,OAAO,EAAE,CAC9E,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/services/sandboxedFileSystemService.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/services/sandboxedFileSystemService.test.js

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach, } from 'vitest';
+import { SandboxedFileSystemService } from './sandboxedFileSystemService.js';
+import { spawn } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+vi.mock('node:child_process', () => ({
+    spawn: vi.fn(),
+}));
+class MockSandboxManager {
+    async prepareCommand(req) {
+        return {
+            program: 'sandbox.exe',
+            args: ['0', req.cwd, req.command, ...req.args],
+            env: req.env || {},
+        };
+    }
+}
+describe('SandboxedFileSystemService', () => {
+    let sandboxManager;
+    let service;
+    const cwd = '/test/cwd';
+    beforeEach(() => {
+        sandboxManager = new MockSandboxManager();
+        service = new SandboxedFileSystemService(sandboxManager, cwd);
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('should read a file through the sandbox', async () => {
+        const mockChild = new EventEmitter();
+        Object.assign(mockChild, {
+            stdout: new EventEmitter(),
+            stderr: new EventEmitter(),
+        });
+        vi.mocked(spawn).mockReturnValue(mockChild);
+        const readPromise = service.readTextFile('/test/file.txt');
+        // Use setImmediate to ensure events are emitted after the promise starts executing
+        setImmediate(() => {
+            mockChild.stdout.emit('data', Buffer.from('file content'));
+            mockChild.emit('close', 0);
+        });
+        const content = await readPromise;
+        expect(content).toBe('file content');
+        expect(spawn).toHaveBeenCalledWith('sandbox.exe', ['0', cwd, '__read', '/test/file.txt'], expect.any(Object));
+    });
+    it('should write a file through the sandbox', async () => {
+        const mockChild = new EventEmitter();
+        const mockStdin = new EventEmitter();
+        Object.assign(mockStdin, {
+            write: vi.fn(),
+            end: vi.fn(),
+        });
+        Object.assign(mockChild, {
+            stdin: mockStdin,
+            stderr: new EventEmitter(),
+        });
+        vi.mocked(spawn).mockReturnValue(mockChild);
+        const writePromise = service.writeTextFile('/test/file.txt', 'new content');
+        setImmediate(() => {
+            mockChild.emit('close', 0);
+        });
+        await writePromise;
+        expect(mockStdin.write).toHaveBeenCalledWith('new content');
+        expect(mockStdin.end).toHaveBeenCalled();
+        expect(spawn).toHaveBeenCalledWith('sandbox.exe', ['0', cwd, '__write', '/test/file.txt'], expect.any(Object));
+    });
+    it('should reject if sandbox command fails', async () => {
+        const mockChild = new EventEmitter();
+        Object.assign(mockChild, {
+            stdout: new EventEmitter(),
+            stderr: new EventEmitter(),
+        });
+        vi.mocked(spawn).mockReturnValue(mockChild);
+        const readPromise = service.readTextFile('/test/file.txt');
+        setImmediate(() => {
+            mockChild.stderr.emit('data', Buffer.from('access denied'));
+            mockChild.emit('close', 1);
+        });
+        await expect(readPromise).rejects.toThrow("Sandbox Error: read_file failed for '/test/file.txt'. Exit code 1. Details: access denied");
+    });
+});
+//# sourceMappingURL=sandboxedFileSystemService.test.js.map

package/dist/src/services/sandboxedFileSystemService.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxedFileSystemService.test.js","sourceRoot":"","sources":["../../../src/services/sandboxedFileSystemService.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,EAAE,EACF,MAAM,EACN,EAAE,EACF,UAAU,EACV,SAAS,GAEV,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAM7E,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC,CAAC;AAEJ,MAAM,kBAAkB;IACtB,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAC9C,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE;SACnB,CAAC;IACJ,CAAC;CACF;AAED,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,cAAkC,CAAC;IACvC,IAAI,OAAmC,CAAC;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC;IAExB,UAAU,CAAC,GAAG,EAAE;QACd,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC1C,OAAO,GAAG,IAAI,0BAA0B,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,IAAI,YAAY,EAA6B,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,MAAM,EAAE,IAAI,YAAY,EAAE;YAC1B,MAAM,EAAE,IAAI,YAAY,EAAE;SAC3B,CAAC,CAAC;QAEH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE3D,mFAAmF;QACnF,YAAY,CAAC,GAAG,EAAE;YAChB,SAAS,CAAC,MAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,aAAa,EACb,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,SAAS,GAAG,IAAI,YAAY,EAA6B,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;YACd,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,KAAK,EAAE,SAAgC;YACvC,MAAM,EAAE,IAAI,YAAY,EAAE;SAC3B,CAAC,CAAC;QAEH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAE5E,YAAY,CAAC,GAAG,EAAE;YAChB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,CAAC;QACnB,MAAM,CACH,SAAwC,CAAC,KAAK,CAChD,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAE,SAAsC,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,aAAa,EACb,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,EACvC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,IAAI,YAAY,EAA6B,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,MAAM,EAAE,IAAI,YAAY,EAAE;YAC1B,MAAM,EAAE,IAAI,YAAY,EAAE;SAC3B,CAAC,CAAC;QAEH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE3D,YAAY,CAAC,GAAG,EAAE;YAChB,SAAS,CAAC,MAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,OAAO,CACvC,2FAA2F,CAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/services/scripts/GeminiSandbox.cs

@@ -0,0 +1,370 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+using System;
+using System.Runtime.InteropServices;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Security.Principal;
+using System.IO;
+
+public class GeminiSandbox {
+    [StructLayout(LayoutKind.Sequential)]
+    public struct STARTUPINFO {
+        public uint cb;
+        public string lpReserved;
+        public string lpDesktop;
+        public string lpTitle;
+        public uint dwX;
+        public uint dwY;
+        public uint dwXSize;
+        public uint dwYSize;
+        public uint dwXCountChars;
+        public uint dwYCountChars;
+        public uint dwFillAttribute;
+        public uint dwFlags;
+        public ushort wShowWindow;
+        public ushort cbReserved2;
+        public IntPtr lpReserved2;
+        public IntPtr hStdInput;
+        public IntPtr hStdOutput;
+        public IntPtr hStdError;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct PROCESS_INFORMATION {
+        public IntPtr hProcess;
+        public IntPtr hThread;
+        public uint dwProcessId;
+        public uint dwThreadId;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct JOBOBJECT_BASIC_LIMIT_INFORMATION {
+        public Int64 PerProcessUserTimeLimit;
+        public Int64 PerJobUserTimeLimit;
+        public uint LimitFlags;
+        public UIntPtr MinimumWorkingSetSize;
+        public UIntPtr MaximumWorkingSetSize;
+        public uint ActiveProcessLimit;
+        public UIntPtr Affinity;
+        public uint PriorityClass;
+        public uint SchedulingClass;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct IO_COUNTERS {
+        public ulong ReadOperationCount;
+        public ulong WriteOperationCount;
+        public ulong OtherOperationCount;
+        public ulong ReadTransferCount;
+        public ulong WriteTransferCount;
+        public ulong OtherTransferCount;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION {
+        public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
+        public IO_COUNTERS IoInfo;
+        public UIntPtr ProcessMemoryLimit;
+        public UIntPtr JobMemoryLimit;
+        public UIntPtr PeakProcessMemoryUsed;
+        public UIntPtr PeakJobMemoryUsed;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SID_AND_ATTRIBUTES {
+        public IntPtr Sid;
+        public uint Attributes;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct TOKEN_MANDATORY_LABEL {
+        public SID_AND_ATTRIBUTES Label;
+    }
+
+    public enum JobObjectInfoClass {
+        ExtendedLimitInformation = 9
+    }
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetCurrentProcess();
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    public static extern bool CreateRestrictedToken(IntPtr ExistingTokenHandle, uint Flags, uint DisableSidCount, IntPtr SidsToDisable, uint DeletePrivilegeCount, IntPtr PrivilegesToDelete, uint RestrictedSidCount, IntPtr SidsToRestrict, out IntPtr NewTokenHandle);
+
+    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern IntPtr CreateJobObject(IntPtr lpJobAttributes, string lpName);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool SetInformationJobObject(IntPtr hJob, JobObjectInfoClass JobObjectInfoClass, IntPtr lpJobObjectInfo, uint cbJobObjectInfoLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool AssignProcessToJobObject(IntPtr hJob, IntPtr hProcess);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern uint ResumeThread(IntPtr hThread);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr hObject);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetStdHandle(int nStdHandle);
+
+    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern bool ConvertStringSidToSid(string StringSid, out IntPtr Sid);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    public static extern bool SetTokenInformation(IntPtr TokenHandle, int TokenInformationClass, IntPtr TokenInformation, uint TokenInformationLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr LocalFree(IntPtr hMem);
+
+    public const uint TOKEN_DUPLICATE = 0x0002;
+    public const uint TOKEN_QUERY = 0x0008;
+    public const uint TOKEN_ASSIGN_PRIMARY = 0x0001;
+    public const uint TOKEN_ADJUST_DEFAULT = 0x0080;
+    public const uint DISABLE_MAX_PRIVILEGE = 0x1;
+    public const uint CREATE_SUSPENDED = 0x00000004;
+    public const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
+    public const uint JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000;
+    public const uint STARTF_USESTDHANDLES = 0x00000100;
+    public const int TokenIntegrityLevel = 25;
+    public const uint SE_GROUP_INTEGRITY = 0x00000020;
+    public const uint INFINITE = 0xFFFFFFFF;
+
+    static int Main(string[] args) {
+        if (args.Length < 3) {
+            Console.WriteLine("Usage: GeminiSandbox.exe <network:0|1> <cwd> <command> [args...]");
+            Console.WriteLine("Internal commands: __read <path>, __write <path>");
+            return 1;
+        }
+
+        bool networkAccess = args[0] == "1";
+        string cwd = args[1];
+        string command = args[2];
+
+        IntPtr hToken = IntPtr.Zero;
+        IntPtr hRestrictedToken = IntPtr.Zero;
+        IntPtr hJob = IntPtr.Zero;
+        IntPtr pSidsToDisable = IntPtr.Zero;
+        IntPtr pSidsToRestrict = IntPtr.Zero;
+        IntPtr networkSid = IntPtr.Zero;
+        IntPtr restrictedSid = IntPtr.Zero;
+        IntPtr lowIntegritySid = IntPtr.Zero;
+
+        try {
+            // 1. Setup Token
+            IntPtr hCurrentProcess = GetCurrentProcess();
+            if (!OpenProcessToken(hCurrentProcess, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_DEFAULT, out hToken)) {
+                Console.Error.WriteLine("Failed to open process token");
+                return 1;
+            }
+
+            uint sidCount = 0;
+            uint restrictCount = 0;
+
+            // "networkAccess == false" implies Strict Sandbox Level 1.
+            if (!networkAccess) {
+                if (ConvertStringSidToSid("S-1-5-2", out networkSid)) {
+                    sidCount = 1;
+                    int saaSize = Marshal.SizeOf(typeof(SID_AND_ATTRIBUTES));
+                    pSidsToDisable = Marshal.AllocHGlobal(saaSize);
+                    SID_AND_ATTRIBUTES saa = new SID_AND_ATTRIBUTES();
+                    saa.Sid = networkSid;
+                    saa.Attributes = 0;
+                    Marshal.StructureToPtr(saa, pSidsToDisable, false);
+                }
+
+                // S-1-5-12 is Restricted Code SID
+                if (ConvertStringSidToSid("S-1-5-12", out restrictedSid)) {
+                    restrictCount = 1;
+                    int saaSize = Marshal.SizeOf(typeof(SID_AND_ATTRIBUTES));
+                    pSidsToRestrict = Marshal.AllocHGlobal(saaSize);
+                    SID_AND_ATTRIBUTES saa = new SID_AND_ATTRIBUTES();
+                    saa.Sid = restrictedSid;
+                    saa.Attributes = 0;
+                    Marshal.StructureToPtr(saa, pSidsToRestrict, false);
+                }
+            }
+
+            if (!CreateRestrictedToken(hToken, DISABLE_MAX_PRIVILEGE, sidCount, pSidsToDisable, 0, IntPtr.Zero, restrictCount, pSidsToRestrict, out hRestrictedToken)) {
+                Console.Error.WriteLine("Failed to create restricted token");
+                return 1;
+            }
+
+            // 2. Set Integrity Level to Low
+            if (ConvertStringSidToSid("S-1-16-4096", out lowIntegritySid)) {
+                TOKEN_MANDATORY_LABEL tml = new TOKEN_MANDATORY_LABEL();
+                tml.Label.Sid = lowIntegritySid;
+                tml.Label.Attributes = SE_GROUP_INTEGRITY;
+                int tmlSize = Marshal.SizeOf(tml);
+                IntPtr pTml = Marshal.AllocHGlobal(tmlSize);
+                try {
+                    Marshal.StructureToPtr(tml, pTml, false);
+                    SetTokenInformation(hRestrictedToken, TokenIntegrityLevel, pTml, (uint)tmlSize);
+                } finally {
+                    Marshal.FreeHGlobal(pTml);
+                }
+            }
+
+            // 3. Handle Internal Commands or External Process
+            if (command == "__read") {
+                string path = args[3];
+                return RunInImpersonation(hRestrictedToken, () => {
+                    try {
+                        using (FileStream fs = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
+                        using (StreamReader sr = new StreamReader(fs, System.Text.Encoding.UTF8)) {
+                            char[] buffer = new char[4096];
+                            int bytesRead;
+                            while ((bytesRead = sr.Read(buffer, 0, buffer.Length)) > 0) {
+                                Console.Write(buffer, 0, bytesRead);
+                            }
+                        }
+                        return 0;
+                    } catch (Exception e) {
+                        Console.Error.WriteLine(e.Message);
+                        return 1;
+                    }
+                });
+            } else if (command == "__write") {
+                string path = args[3];
+                return RunInImpersonation(hRestrictedToken, () => {
+                    try {
+                        using (StreamReader reader = new StreamReader(Console.OpenStandardInput(), System.Text.Encoding.UTF8))
+                        using (FileStream fs = new FileStream(path, FileMode.Create, FileAccess.Write, FileShare.None))
+                        using (StreamWriter writer = new StreamWriter(fs, System.Text.Encoding.UTF8)) {
+                            char[] buffer = new char[4096];
+                            int bytesRead;
+                            while ((bytesRead = reader.Read(buffer, 0, buffer.Length)) > 0) {
+                                writer.Write(buffer, 0, bytesRead);
+                            }
+                        }
+                        return 0;
+                    } catch (Exception e) {
+                        Console.Error.WriteLine(e.Message);
+                        return 1;
+                    }
+                });
+            }
+
+            // 4. Setup Job Object for external process
+            hJob = CreateJobObject(IntPtr.Zero, null);
+            if (hJob != IntPtr.Zero) {
+                JOBOBJECT_EXTENDED_LIMIT_INFORMATION limitInfo = new JOBOBJECT_EXTENDED_LIMIT_INFORMATION();
+                limitInfo.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+                int limitSize = Marshal.SizeOf(limitInfo);
+                IntPtr pLimit = Marshal.AllocHGlobal(limitSize);
+                try {
+                    Marshal.StructureToPtr(limitInfo, pLimit, false);
+                    SetInformationJobObject(hJob, JobObjectInfoClass.ExtendedLimitInformation, pLimit, (uint)limitSize);
+                } finally {
+                    Marshal.FreeHGlobal(pLimit);
+                }
+            }
+
+            // 5. Launch Process
+            STARTUPINFO si = new STARTUPINFO();
+            si.cb = (uint)Marshal.SizeOf(si);
+            si.dwFlags = STARTF_USESTDHANDLES;
+            si.hStdInput = GetStdHandle(-10);
+            si.hStdOutput = GetStdHandle(-11);
+            si.hStdError = GetStdHandle(-12);
+
+            string commandLine = "";
+            for (int i = 2; i < args.Length; i++) {
+                if (i > 2) commandLine += " ";
+                commandLine += QuoteArgument(args[i]);
+            }
+
+            PROCESS_INFORMATION pi;
+            if (!CreateProcessAsUser(hRestrictedToken, null, commandLine, IntPtr.Zero, IntPtr.Zero, true, CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT, IntPtr.Zero, cwd, ref si, out pi)) {
+                Console.Error.WriteLine("Failed to create process. Error: " + Marshal.GetLastWin32Error());
+                return 1;
+            }
+
+            try {
+                if (hJob != IntPtr.Zero) {
+                    AssignProcessToJobObject(hJob, pi.hProcess);
+                }
+
+                ResumeThread(pi.hThread);
+                WaitForSingleObject(pi.hProcess, INFINITE);
+
+                uint exitCode = 0;
+                GetExitCodeProcess(pi.hProcess, out exitCode);
+                return (int)exitCode;
+            } finally {
+                CloseHandle(pi.hProcess);
+                CloseHandle(pi.hThread);
+            }
+        } catch (Exception e) {
+            Console.Error.WriteLine("Unexpected error: " + e.Message);
+            return 1;
+        } finally {
+            if (hRestrictedToken != IntPtr.Zero) CloseHandle(hRestrictedToken);
+            if (hToken != IntPtr.Zero) CloseHandle(hToken);
+            if (hJob != IntPtr.Zero) CloseHandle(hJob);
+            if (pSidsToDisable != IntPtr.Zero) Marshal.FreeHGlobal(pSidsToDisable);
+            if (pSidsToRestrict != IntPtr.Zero) Marshal.FreeHGlobal(pSidsToRestrict);
+            if (networkSid != IntPtr.Zero) LocalFree(networkSid);
+            if (restrictedSid != IntPtr.Zero) LocalFree(restrictedSid);
+            if (lowIntegritySid != IntPtr.Zero) LocalFree(lowIntegritySid);
+        }
+    }
+
+    private static string QuoteArgument(string arg) {
+        if (string.IsNullOrEmpty(arg)) return "\"\"";
+
+        bool hasSpace = arg.IndexOfAny(new char[] { ' ', '\t' }) != -1;
+        if (!hasSpace && arg.IndexOf('\"') == -1) return arg;
+
+        // Windows command line escaping for arguments is complex.
+        // Rule: Backslashes only need escaping if they precede a double quote or the end of the string.
+        System.Text.StringBuilder sb = new System.Text.StringBuilder();
+        sb.Append('\"');
+        for (int i = 0; i < arg.Length; i++) {
+            int backslashCount = 0;
+            while (i < arg.Length && arg[i] == '\\') {
+                backslashCount++;
+                i++;
+            }
+
+            if (i == arg.Length) {
+                // Escape backslashes before the closing double quote
+                sb.Append('\\', backslashCount * 2);
+            } else if (arg[i] == '\"') {
+                // Escape backslashes before a literal double quote
+                sb.Append('\\', backslashCount * 2 + 1);
+                sb.Append('\"');
+            } else {
+                // Backslashes don't need escaping here
+                sb.Append('\\', backslashCount);
+                sb.Append(arg[i]);
+            }
+        }
+        sb.Append('\"');
+        return sb.ToString();
+    }
+
+    private static int RunInImpersonation(IntPtr hToken, Func<int> action) {
+        using (WindowsIdentity.Impersonate(hToken)) {
+            return action();
+        }
+    }
+}

package/dist/src/services/shellExecutionService.d.ts

@@ -5,6 +5,7 @@
  */
 import { type EnvironmentSanitizationConfig } from './environmentSanitization.js';
 import { type SandboxManager } from './sandboxManager.js';
+import type { SandboxConfig } from '../config/config.js';
 import { type ExecutionHandle, type ExecutionOutputEvent, type ExecutionResult } from './executionLifecycleService.js';
 /**
  * An environment variable that is set for shell executions. This can be used
@@ -33,6 +34,7 @@ export interface ShellExecutionConfig {
     disableDynamicLineTrimming?: boolean;
     scrollback?: number;
     maxSerializedLines?: number;
+    sandboxConfig?: SandboxConfig;
 }
 /**
  * Describes a structured event emitted during shell command execution.