@guilz-dev/belay 0.8.0 → 0.9.0

package/dist/core/audit-recovery-metrics.js

@@ -0,0 +1,146 @@
+import { GATE_EVENTS } from './audit-types.js';
+const RESTORE_EVENTS = new Set(['recoveryApplied', 'recoveryConflict', 'recoveryRejected']);
+const STABLE_FAILURE_REASON = /^[a-z][a-z0-9_]*$/;
+function increment(bucket, key) {
+    bucket[key] = (bucket[key] ?? 0) + 1;
+}
+function percentile(sorted, p) {
+    if (sorted.length === 0) {
+        return null;
+    }
+    const index = Math.ceil((p / 100) * sorted.length) - 1;
+    return sorted[Math.max(0, Math.min(sorted.length - 1, index))] ?? null;
+}
+export function sanitizeRecoveryFailureReason(record) {
+    const reason = record.transactionalSkipReason ?? record.reason;
+    if (typeof reason === 'string' && STABLE_FAILURE_REASON.test(reason)) {
+        return reason;
+    }
+    return 'transactional_execution_failed';
+}
+function isRecoverySnapshotRecord(record) {
+    if (typeof record.transactional === 'boolean') {
+        return true;
+    }
+    if (typeof record.transactionalSkipReason === 'string') {
+        return true;
+    }
+    if (record.recoveryFailClosed === true) {
+        return true;
+    }
+    return false;
+}
+function isRecoveryRestoreRecord(record) {
+    const event = typeof record.event === 'string' ? record.event : '';
+    return RESTORE_EVENTS.has(event);
+}
+function matchesCohort(record, cohort) {
+    return (record.runtimeBuildStamp === cohort.runtimeBuildStamp &&
+        record.configFingerprint === cohort.configFingerprint);
+}
+function emptySnapshotMetrics() {
+    return {
+        attempts: 0,
+        applied: 0,
+        skipped: 0,
+        byBackend: {},
+        byResourceKind: {},
+        prepareSampleCount: 0,
+        prepareMsP50: null,
+        prepareMsP95: null,
+        failuresByReason: {},
+    };
+}
+function emptyRestoreMetrics() {
+    return {
+        applied: 0,
+        conflict: 0,
+        rejected: 0,
+    };
+}
+function isRecoverySnapshotApplied(record) {
+    return (record.transactional === true &&
+        (record.reason === 'transactional_already_applied' ||
+            typeof record.recoveryCheckpointId === 'string' ||
+            record.recoveryState === 'applied'));
+}
+function computeSnapshotMetrics(records) {
+    const metrics = emptySnapshotMetrics();
+    const prepareSamples = [];
+    for (const record of records) {
+        const event = typeof record.event === 'string' ? record.event : '';
+        if (!GATE_EVENTS.has(event)) {
+            continue;
+        }
+        if (!isRecoverySnapshotRecord(record)) {
+            continue;
+        }
+        metrics.attempts += 1;
+        if (isRecoverySnapshotApplied(record)) {
+            metrics.applied += 1;
+        }
+        else {
+            metrics.skipped += 1;
+            if (record.transactionalReason === 'transactional_observed_risk') {
+                increment(metrics.failuresByReason, 'transactional_observed_risk');
+            }
+            else {
+                increment(metrics.failuresByReason, sanitizeRecoveryFailureReason(record));
+            }
+        }
+        const backend = typeof record.transactionalBackend === 'string' ? record.transactionalBackend : 'unknown';
+        increment(metrics.byBackend, backend);
+        const resourceKind = typeof record.resourceKind === 'string' ? record.resourceKind : 'unknown';
+        increment(metrics.byResourceKind, resourceKind);
+        if (typeof record.snapshotPrepareMs === 'number' && Number.isFinite(record.snapshotPrepareMs)) {
+            prepareSamples.push(record.snapshotPrepareMs);
+        }
+    }
+    prepareSamples.sort((left, right) => left - right);
+    metrics.prepareSampleCount = prepareSamples.length;
+    metrics.prepareMsP50 = percentile(prepareSamples, 50);
+    metrics.prepareMsP95 = percentile(prepareSamples, 95);
+    return metrics;
+}
+function computeRestoreMetrics(records) {
+    const metrics = emptyRestoreMetrics();
+    for (const record of records) {
+        const event = typeof record.event === 'string' ? record.event : '';
+        if (event === 'recoveryApplied') {
+            metrics.applied += 1;
+        }
+        else if (event === 'recoveryConflict') {
+            metrics.conflict += 1;
+        }
+        else if (event === 'recoveryRejected') {
+            metrics.rejected += 1;
+        }
+    }
+    return metrics;
+}
+export function computeRecoveryMetrics(records, options = {}) {
+    const gateSnapshotRecords = records.filter((record) => {
+        const event = typeof record.event === 'string' ? record.event : '';
+        return GATE_EVENTS.has(event) && isRecoverySnapshotRecord(record);
+    });
+    const restoreRecords = records.filter(isRecoveryRestoreRecord);
+    const activeCohort = options.activeCohort ?? null;
+    const cohortGateSnapshotRecords = activeCohort
+        ? gateSnapshotRecords.filter((record) => matchesCohort(record, activeCohort))
+        : [];
+    const cohortRestoreRecords = activeCohort
+        ? restoreRecords.filter((record) => matchesCohort(record, activeCohort))
+        : [];
+    return {
+        allTime: {
+            snapshot: computeSnapshotMetrics(gateSnapshotRecords),
+            restore: computeRestoreMetrics(restoreRecords),
+        },
+        currentCohort: {
+            snapshot: computeSnapshotMetrics(cohortGateSnapshotRecords),
+            restore: computeRestoreMetrics(cohortRestoreRecords),
+            excludedSnapshotAttempts: gateSnapshotRecords.length - cohortGateSnapshotRecords.length,
+            excludedRestoreEvents: restoreRecords.length - cohortRestoreRecords.length,
+        },
+    };
+}

package/dist/core/audit-types.d.ts

@@ -1,7 +1,7 @@
 import type { AuditActionSnapshot, AuditReplayContext } from './audit-replay-context.js';
 import type { Assessment } from './types.js';
 export type { AuditActionSnapshot, AuditReplayContext } from './audit-replay-context.js';
-export declare const AUDIT_METRICS_SCHEMA_VERSION = 3;
+export declare const AUDIT_METRICS_SCHEMA_VERSION = 4;
 export declare const GATE_EVENTS: Set<string>;
 export interface AuditRecord {
     timestamp?: string;
@@ -42,6 +42,12 @@ export interface AuditRecord {
     recoveryState?: string;
     replayContext?: AuditReplayContext;
     actionSnapshot?: AuditActionSnapshot;
+    wouldMediate?: boolean;
+    receiptHash?: string;
+    imageId?: string;
+    mirrorBackend?: 'file_copy';
+    exitCode?: number | null;
+    timedOut?: boolean;
     [key: string]: unknown;
 }
 export interface AuditFilter {

package/dist/core/audit-types.js

@@ -1,2 +1,2 @@
-export const AUDIT_METRICS_SCHEMA_VERSION = 3;
+export const AUDIT_METRICS_SCHEMA_VERSION = 4;
 export const GATE_EVENTS = new Set(['beforeShellExecution', 'preToolUse', 'subagentGate']);

package/dist/core/bounded-output.d.ts

@@ -0,0 +1,11 @@
+export declare const OUTPUT_TAIL_LIMIT_BYTES = 16384;
+export interface BoundedOutputTail {
+    tail: Buffer;
+    truncated: boolean;
+}
+export declare function appendBoundedOutputTail(current: Buffer, chunk: Buffer | string, limitBytes?: number): BoundedOutputTail;
+export declare function decodeBoundedOutputTail(tail: Buffer): string;
+export declare function boundedUtf8Tail(value: string, limitBytes?: number): {
+    value: string;
+    truncated: boolean;
+};

package/dist/core/bounded-output.js

@@ -0,0 +1,26 @@
+export const OUTPUT_TAIL_LIMIT_BYTES = 16_384;
+export function appendBoundedOutputTail(current, chunk, limitBytes = OUTPUT_TAIL_LIMIT_BYTES) {
+    const next = Buffer.concat([current, Buffer.from(chunk)]);
+    return {
+        tail: next.length > limitBytes ? next.subarray(-limitBytes) : next,
+        truncated: next.length > limitBytes,
+    };
+}
+export function decodeBoundedOutputTail(tail) {
+    for (let offset = 0; offset <= Math.min(3, tail.length); offset += 1) {
+        try {
+            return new TextDecoder('utf-8', { fatal: true }).decode(tail.subarray(offset));
+        }
+        catch {
+            // A byte cap may have cut a leading multi-byte character; try its next boundary.
+        }
+    }
+    return tail.toString('utf8');
+}
+export function boundedUtf8Tail(value, limitBytes = OUTPUT_TAIL_LIMIT_BYTES) {
+    const encoded = Buffer.from(value);
+    if (encoded.length <= limitBytes)
+        return { value, truncated: false };
+    const tail = encoded.subarray(-limitBytes);
+    return { value: decodeBoundedOutputTail(tail), truncated: true };
+}

package/dist/core/capability/attestation.d.ts

@@ -1,5 +1,56 @@
 export declare const BOUNDARY_ATTESTATION_VERSION: 1;
+export declare const CONTAINED_EXECUTION_ATTESTATION_VERSION: 1;
 export type BoundaryDriverId = 'container' | 'cursor-sandbox' | 'seatbelt' | 'landlock' | 'host-integration';
+export interface ContainedExecutionResourceLimits {
+    timeoutMs: number;
+    memoryMiB: number;
+    cpus: number;
+    pids: number;
+}
+export interface DockerSubstrateIdentity {
+    binaryPath: string;
+    binarySha256: string;
+    endpoint: string;
+    daemonId: string;
+}
+/** A separate execution-only capability; it does not attest L1 grant enforcement. */
+export interface ContainedExecutionAttestation {
+    version: typeof CONTAINED_EXECUTION_ATTESTATION_VERSION;
+    imageId: string;
+    imageReference: string;
+    networkNone: true;
+    isolatesWorkspaceMirror: true;
+    readOnlyRoot: true;
+    sanitizedEnvironment: true;
+    dockerSubstrate: DockerSubstrateIdentity;
+    dockerConfiguration: {
+        executable: string;
+        host: string;
+    };
+    user: string;
+    entrypoint: '/bin/sh';
+    capDropAll: true;
+    noNewPrivileges: true;
+    logDriver: 'none';
+    proxyEnvironment: 'neutralized-empty';
+    tmpfs: {
+        path: '/tmp';
+        sizeBytes: number;
+        mode: 0o1777;
+        exec: false;
+        nosuid: true;
+        nodev: true;
+    };
+    memorySwapMiB: number;
+    shmSizeMiB: number;
+    healthcheckDisabled: true;
+    privateNamespaces: true;
+    privileged: false;
+    devicesNone: true;
+    resourceLimits: ContainedExecutionResourceLimits;
+    probedAt: string;
+    expiresAt: string;
+}
 export interface BoundaryAttestation {
     version: typeof BOUNDARY_ATTESTATION_VERSION;
     driver: BoundaryDriverId;
@@ -10,7 +61,12 @@ export interface BoundaryAttestation {
     probeSignals: string[];
     /** When true, the driver can mount an execution mirror at the original workspace path. */
     isolatesWorkspaceMounts?: boolean;
+    /** Optional, execution-only proof. This must never be treated as an L1-full attestation. */
+    containedExecution?: ContainedExecutionAttestation;
 }
 export declare function validateBoundaryAttestation(value: unknown): value is BoundaryAttestation;
+export declare function validateContainedExecutionAttestation(value: unknown): value is ContainedExecutionAttestation;
+export declare function isContainedExecutionAttestationFresh(attestation: ContainedExecutionAttestation | null | undefined, now?: number): boolean;
+export declare function isAttestationCurrent(attestation: BoundaryAttestation, now?: number): boolean;
 export declare function isAttestationFresh(attestation: BoundaryAttestation, now?: number): boolean;
 export declare function attestsWorkspaceMountIsolation(attestation: BoundaryAttestation | null | undefined): boolean;

package/dist/core/capability/attestation.js

@@ -1,4 +1,6 @@
+import path from 'node:path';
 export const BOUNDARY_ATTESTATION_VERSION = 1;
+export const CONTAINED_EXECUTION_ATTESTATION_VERSION = 1;
 const KNOWN_DRIVERS = new Set([
     'container',
     'cursor-sandbox',
@@ -6,15 +8,21 @@ const KNOWN_DRIVERS = new Set([
     'landlock',
     'host-integration',
 ]);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isBoundaryDriver(value) {
+    return typeof value === 'string' && KNOWN_DRIVERS.has(value);
+}
 export function validateBoundaryAttestation(value) {
-    if (!value || typeof value !== 'object') {
+    if (!isRecord(value)) {
         return false;
     }
     const record = value;
     if (record.version !== BOUNDARY_ATTESTATION_VERSION) {
         return false;
     }
-    if (!KNOWN_DRIVERS.has(record.driver)) {
+    if (!isBoundaryDriver(record.driver)) {
         return false;
     }
     if (typeof record.probedAt !== 'string' || typeof record.expiresAt !== 'string') {
@@ -34,6 +42,12 @@ export function validateBoundaryAttestation(value) {
         typeof record.isolatesWorkspaceMounts !== 'boolean') {
         return false;
     }
+    if (record.containedExecution !== undefined) {
+        if (record.driver !== 'container' ||
+            !validateContainedExecutionAttestation(record.containedExecution)) {
+            return false;
+        }
+    }
     if (record.driver === 'host-integration' && record.materializesGrants) {
         return false;
     }
@@ -44,7 +58,94 @@ export function validateBoundaryAttestation(value) {
     }
     return true;
 }
-export function isAttestationFresh(attestation, now = Date.now()) {
+function hasPositiveLimit(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+function hasPositiveIntegerLimit(value) {
+    return hasPositiveLimit(value) && Number.isSafeInteger(value);
+}
+export function validateContainedExecutionAttestation(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    const record = value;
+    const dockerSubstrate = record.dockerSubstrate;
+    const dockerConfiguration = record.dockerConfiguration;
+    if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION ||
+        typeof record.imageId !== 'string' ||
+        !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) ||
+        typeof record.imageReference !== 'string' ||
+        !record.imageReference ||
+        /[\0\n\r]/.test(record.imageReference) ||
+        record.networkNone !== true ||
+        record.isolatesWorkspaceMirror !== true ||
+        record.readOnlyRoot !== true ||
+        record.sanitizedEnvironment !== true ||
+        !isRecord(dockerSubstrate) ||
+        typeof dockerSubstrate.binaryPath !== 'string' ||
+        !path.isAbsolute(dockerSubstrate.binaryPath) ||
+        /[\0\n\r]/.test(dockerSubstrate.binaryPath) ||
+        typeof dockerSubstrate.binarySha256 !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) ||
+        typeof dockerSubstrate.endpoint !== 'string' ||
+        !dockerSubstrate.endpoint.startsWith('unix:///') ||
+        !path.isAbsolute(dockerSubstrate.endpoint.slice('unix://'.length)) ||
+        /[\0\n\r]/.test(dockerSubstrate.endpoint) ||
+        typeof dockerSubstrate.daemonId !== 'string' ||
+        !dockerSubstrate.daemonId ||
+        /[\0\n\r]/.test(dockerSubstrate.daemonId) ||
+        !isRecord(dockerConfiguration) ||
+        typeof dockerConfiguration.executable !== 'string' ||
+        !path.isAbsolute(dockerConfiguration.executable) ||
+        /[\0\n\r]/.test(dockerConfiguration.executable) ||
+        typeof dockerConfiguration.host !== 'string' ||
+        !dockerConfiguration.host.startsWith('unix:///') ||
+        !path.isAbsolute(dockerConfiguration.host.slice('unix://'.length)) ||
+        /[\0\n\r]/.test(dockerConfiguration.host) ||
+        typeof record.user !== 'string' ||
+        !/^\d+:\d+$/.test(record.user) ||
+        record.entrypoint !== '/bin/sh' ||
+        record.capDropAll !== true ||
+        record.noNewPrivileges !== true ||
+        record.logDriver !== 'none' ||
+        record.proxyEnvironment !== 'neutralized-empty' ||
+        typeof record.probedAt !== 'string' ||
+        typeof record.expiresAt !== 'string') {
+        return false;
+    }
+    const probedAt = Date.parse(record.probedAt);
+    const expiresAt = Date.parse(record.expiresAt);
+    if (!Number.isFinite(probedAt) || !Number.isFinite(expiresAt) || expiresAt <= probedAt) {
+        return false;
+    }
+    const limits = record.resourceLimits;
+    const tmpfs = record.tmpfs;
+    return (isRecord(tmpfs) &&
+        tmpfs.path === '/tmp' &&
+        hasPositiveIntegerLimit(tmpfs.sizeBytes) &&
+        tmpfs.mode === 0o1777 &&
+        tmpfs.exec === false &&
+        tmpfs.nosuid === true &&
+        tmpfs.nodev === true &&
+        hasPositiveIntegerLimit(record.memorySwapMiB) &&
+        hasPositiveIntegerLimit(record.shmSizeMiB) &&
+        record.healthcheckDisabled === true &&
+        record.privateNamespaces === true &&
+        record.privileged === false &&
+        record.devicesNone === true &&
+        isRecord(limits) &&
+        hasPositiveIntegerLimit(limits.timeoutMs) &&
+        hasPositiveIntegerLimit(limits.memoryMiB) &&
+        hasPositiveLimit(limits.cpus) &&
+        hasPositiveIntegerLimit(limits.pids));
+}
+export function isContainedExecutionAttestationFresh(attestation, now = Date.now()) {
+    // A contained proof must have been observed already; no clock skew is accepted.
+    return (validateContainedExecutionAttestation(attestation) &&
+        Date.parse(attestation.probedAt) <= now &&
+        Date.parse(attestation.expiresAt) > now);
+}
+export function isAttestationCurrent(attestation, now = Date.now()) {
     const expires = Date.parse(attestation.expiresAt);
     if (!Number.isFinite(expires)) {
         return false;
@@ -52,6 +153,12 @@ export function isAttestationFresh(attestation, now = Date.now()) {
     if (expires <= now) {
         return false;
     }
+    return true;
+}
+export function isAttestationFresh(attestation, now = Date.now()) {
+    if (!isAttestationCurrent(attestation, now)) {
+        return false;
+    }
     if (attestation.driver === 'host-integration') {
         return true;
     }

package/dist/core/capability/boundary-session.d.ts

@@ -1,4 +1,5 @@
 import type { BelayConfigV4 } from '../config.js';
+import { type ContainedDockerDependencies } from '../contained-execution/docker.js';
 import type { BoundaryAttestation, BoundaryDriverId } from './attestation.js';
 import { type BoundaryDriver } from './boundary-driver.js';
 import { dockerNetworkArgs } from './boundary-egress.js';
@@ -15,6 +16,7 @@ export interface ResolvedBoundaryDriverContext {
     attestationPath: string;
     attestation: BoundaryAttestation | null;
     attestationFresh: boolean;
+    containedExecutionFresh?: boolean;
 }
 export declare function boundaryAttestationPath(repoRoot: string, config: BelayConfigV4): string;
 export declare function loadBoundaryAttestation(filePath: string, expectedRepoRoot?: string, controlPlaneDir?: string): Promise<BoundaryAttestation | null>;
@@ -38,6 +40,7 @@ export declare function startBoundarySession(params: {
     config: BelayConfigV4;
     driverId?: BoundaryDriverId;
     egressProxyRunning?: boolean;
+    containedDockerDependencies?: ContainedDockerDependencies;
 }): Promise<{
     attestation: BoundaryAttestation;
     attestationPath: string;
@@ -45,10 +48,12 @@ export declare function startBoundarySession(params: {
 export declare function boundarySessionStatus(params: {
     repoRoot: string;
     config: BelayConfigV4;
+    now?: number;
 }): Promise<{
     attestationPath: string;
     attestation: BoundaryAttestation | null;
     fresh: boolean;
+    containedExecutionFresh?: boolean;
 }>;
 export declare function runBoundaryAgentCommand(params: {
     repoRoot: string;

package/dist/core/capability/boundary-session.js

@@ -2,11 +2,34 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { egressStatus } from '../../services/egress-service.js';
 import { configuredControlPlaneDir } from '../config.js';
-import { isAttestationFresh } from './attestation.js';
+import { probeContainedDockerForSession, } from '../contained-execution/docker.js';
+import { isAttestationFresh, isContainedExecutionAttestationFresh } from './attestation.js';
 import { readSignedAttestationFile, signBoundaryAttestation, verifySignedBoundaryAttestation, } from './boundary-attestation-sign.js';
 import { getDefaultBoundaryDriver } from './boundary-driver.js';
 import { dockerNetworkArgs, isEgressProxyActive, resolveBoundaryEgressProxyEnv, } from './boundary-egress.js';
 import { runWithBoundaryRunnable, } from './boundary-run.js';
+function containedExecutionFresh(attestation, config, now = Date.now()) {
+    if (attestation?.driver !== 'container' || !attestation.containedExecution)
+        return undefined;
+    const current = config.sandbox.containedExecution;
+    const capability = attestation.containedExecution;
+    const configCompatible = Boolean(current?.enabled &&
+        current.image === capability.imageReference &&
+        current.dockerExecutable === capability.dockerConfiguration.executable &&
+        current.dockerHost === capability.dockerConfiguration.host &&
+        current.timeoutMs === capability.resourceLimits.timeoutMs &&
+        current.memoryMiB === capability.resourceLimits.memoryMiB &&
+        current.cpus === capability.resourceLimits.cpus &&
+        current.pids === capability.resourceLimits.pids);
+    const probedAt = Date.parse(attestation.probedAt);
+    const expiresAt = Date.parse(attestation.expiresAt);
+    return (Number.isFinite(probedAt) &&
+        Number.isFinite(expiresAt) &&
+        probedAt <= now &&
+        expiresAt > now &&
+        configCompatible &&
+        isContainedExecutionAttestationFresh(capability, now));
+}
 export function boundaryAttestationPath(repoRoot, config) {
     const rel = config.capability?.attestationRelPath ?? '.belay/attestation.json';
     return path.isAbsolute(rel) ? rel : path.join(repoRoot, rel);
@@ -92,6 +115,7 @@ export async function resolveBoundaryDriverContext(params) {
         attestationPath,
         attestation,
         attestationFresh: attestation ? isAttestationFresh(attestation) : false,
+        containedExecutionFresh: containedExecutionFresh(attestation, params.config),
     };
 }
 export async function runWithBoundaryDriver(params) {
@@ -104,6 +128,18 @@ export async function runWithBoundaryDriver(params) {
     });
 }
 export async function startBoundarySession(params) {
+    const contained = params.config.sandbox.containedExecution;
+    if (contained?.enabled === true) {
+        const attestation = await probeContainedDockerForSession({
+            repoRoot: params.repoRoot,
+            controlPlaneDir: configuredControlPlaneDir(params.config),
+            config: contained,
+            dependencies: params.containedDockerDependencies,
+        });
+        const attestationPath = boundaryAttestationPath(params.repoRoot, params.config);
+        await saveBoundaryAttestation(attestationPath, attestation, params.repoRoot, configuredControlPlaneDir(params.config));
+        return { attestation, attestationPath };
+    }
     const resolved = await resolveBoundaryDriverContext(params);
     const attestation = await resolved.driver.probe();
     if (resolved.driver.prepare) {
@@ -120,6 +156,7 @@ export async function boundarySessionStatus(params) {
         attestationPath,
         attestation,
         fresh: attestation ? isAttestationFresh(attestation) : false,
+        containedExecutionFresh: containedExecutionFresh(attestation, params.config, params.now),
     };
 }
 export async function runBoundaryAgentCommand(params) {

package/dist/core/capability/index.d.ts

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, CONTAINED_EXECUTION_ATTESTATION_VERSION, type ContainedExecutionAttestation, type ContainedExecutionResourceLimits, isAttestationFresh, isContainedExecutionAttestationFresh, validateContainedExecutionAttestation, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, type CapabilityGrantV1, isGrantScopeTooBroad, } from './grant.js';

package/dist/core/capability/index.js

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, CONTAINED_EXECUTION_ATTESTATION_VERSION, isAttestationFresh, isContainedExecutionAttestationFresh, validateContainedExecutionAttestation, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, isGrantScopeTooBroad, } from './grant.js';

package/dist/core/config.d.ts

@@ -146,6 +146,20 @@ export interface BelaySandboxConfig {
     enabled: boolean;
     runtime: SandboxRuntime;
     denyNetworkByDefault: boolean;
+    /** Optional in source config for backwards compatibility; normalization always supplies it. */
+    containedExecution?: BelayContainedExecutionConfig;
+}
+export interface BelayContainedExecutionConfig {
+    enabled: boolean;
+    image: string | null;
+    /** Required when enabled; optional in source objects for disabled backwards compatibility. */
+    dockerExecutable?: string | null;
+    /** Required when enabled; only local absolute unix:// endpoints are accepted. */
+    dockerHost?: string | null;
+    timeoutMs: number;
+    memoryMiB: number;
+    cpus: number;
+    pids: number;
 }
 export interface BelayClassifierConfig {
     strictChains: boolean;
@@ -225,7 +239,9 @@ export declare const DEFAULT_REDACTION_V3: BelayRedactionConfig;
 export declare const DEFAULT_CONTROL_PLANE_ISOLATION_V3: BelayControlPlaneIsolationConfig;
 export declare const LEGACY_CONTROL_PLANE_V3: BelayControlPlaneConfig;
 export declare const DEFAULT_CONTROL_PLANE_V3: BelayControlPlaneConfig;
+export declare const DEFAULT_CONTAINED_EXECUTION: BelayContainedExecutionConfig;
 export declare const DEFAULT_SANDBOX_V3: BelaySandboxConfig;
+export declare function normalizeContainedExecutionConfig(raw: Partial<BelayContainedExecutionConfig> | undefined): BelayContainedExecutionConfig;
 export declare const DEFAULT_NOTIFICATIONS_V3: BelayNotificationsConfig;
 export declare const DEFAULT_APPROVAL_SIGNING_V3: BelayApprovalSigningConfig;
 export declare const DEFAULT_APPROVAL_CONFIG: BelayApprovalConfig;
@@ -276,6 +292,8 @@ export declare function normalizeConfigV2(config: BelayConfigV2): BelayConfigV2;
 export declare function normalizeConfig(config: BelayConfigV4): BelayConfigV4;
 export declare function normalizeConfig(config: BelayConfigV2): BelayConfigV2;
 export declare function isFreshConfigInput(loaded: unknown): boolean;
+export declare function hasForbiddenShellOverrideLists(config: BelayConfigV4): boolean;
+export declare function stripForbiddenShellOverrideLists(config: BelayConfigV4): BelayConfigV4;
 export declare function mergeConfig(existing: unknown, defaults?: BelayConfigV4): BelayConfigV4;
 export declare function scrubOptionsFromConfig(config: BelayConfigV4): ScrubOptions;
 export declare function classifierOptionsFromConfig(config: BelayConfigV4): ClassifierOptions;