@kenkaiiii/ggcoder 5.30.3 → 5.32.0

package/dist/core/sandbox.js

@@ -0,0 +1,254 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { log } from "./logger.js";
+import { getAppPaths } from "../config.js";
+import { DEFAULT_ALLOWED_DOMAINS } from "./sandbox-domains.js";
+/**
+ * Environment applied only to sandboxed commands.
+ *
+ * The sandbox permanently protects `.git/hooks`, and git's only reason to write
+ * there is copying inert `*.sample` templates during `init`/`clone` — which
+ * fails the whole command. Pointing git at an empty template directory removes
+ * that write, so cloning works with hook protection fully intact.
+ */
+export const SANDBOX_ENV_PATCH = {
+    GIT_TEMPLATE_DIR: "",
+};
+const SANDBOX_CONFIG_DIR = path.join(os.homedir(), ".gg", "sandbox-configs");
+const PROBE_TIMEOUT_MS = 20_000;
+let warnedUnsupported = false;
+function sensitiveReadPaths(home) {
+    return [
+        path.join(home, ".ssh"),
+        path.join(home, ".aws"),
+        path.join(home, ".gnupg"),
+        path.join(home, ".kube"),
+        path.join(home, ".config", "gcloud"),
+        path.join(home, ".azure"),
+        path.join(home, ".gg", "auth.json"),
+    ];
+}
+/**
+ * Package-manager caches that live outside the workspace.
+ *
+ * `npm install`, `cargo build`, `go mod download` and friends all write to a
+ * shared cache in $HOME; without these the sandbox looks like it "breaks npm".
+ * Everything here is regenerable build state — no credentials, which stay
+ * unreadable via {@link sensitiveReadPaths}.
+ */
+function toolCacheDirs(home) {
+    return [
+        path.join(home, ".npm"),
+        path.join(home, ".cache"),
+        path.join(home, "Library", "Caches"),
+        path.join(home, ".pnpm-store"),
+        path.join(home, ".yarn"),
+        path.join(home, ".bun"),
+        path.join(home, ".deno"),
+        path.join(home, ".cargo"),
+        path.join(home, ".rustup"),
+        path.join(home, "go", "pkg", "mod"),
+        path.join(home, ".m2"),
+        path.join(home, ".gradle"),
+        path.join(home, ".gem"),
+        path.join(home, ".bundle"),
+        path.join(home, ".nuget"),
+        path.join(home, ".composer"),
+        path.join(home, ".local", "share", "virtualenvs"),
+    ];
+}
+/**
+ * A path plus its symlink-resolved twin.
+ *
+ * macOS resolves /tmp to /private/tmp and /var/folders to /private/var/folders.
+ * The sandbox matches on the real path, so listing only the symlink silently
+ * denies every write to the system temp directory.
+ */
+function withRealPath(target) {
+    try {
+        const real = realpathSync(target);
+        return real === target ? [target] : [target, real];
+    }
+    catch {
+        return [target];
+    }
+}
+/** Pure policy builder, exported so the security boundary is regression-tested. */
+export function buildSandboxSettings(cwd, policy, platform = process.platform) {
+    const workspace = path.resolve(cwd);
+    const temp = path.resolve(os.tmpdir());
+    const home = os.homedir();
+    const allowedDomains = [
+        ...new Set([...(policy.strictDomains ? [] : DEFAULT_ALLOWED_DOMAINS), ...policy.allowedDomains]
+            .map((host) => host.trim())
+            .filter(Boolean)),
+    ].sort();
+    // Mirror resolveWriteGuard's roots. The sandbox must never be stricter than
+    // the write guard the user already controls, or bash silently loses
+    // multi-root workspaces and the documented outside-workspace opt-out.
+    const writeRoots = [
+        ...new Set([
+            workspace,
+            ...(policy.additionalRoots ?? []).map((root) => path.resolve(root)),
+            temp,
+            // The conventional scratch dir, distinct from os.tmpdir() on macOS.
+            ...(platform === "win32" ? [] : ["/tmp"]),
+            path.resolve(getAppPaths().agentDir),
+            ...toolCacheDirs(home),
+            ...(policy.allowOutsideWorkspaceWrites ? [home] : []),
+        ].flatMap(withRealPath)),
+    ];
+    return {
+        network: {
+            allowedDomains,
+            deniedDomains: [],
+            strictAllowlist: true,
+            allowUnixSockets: [],
+            // Dev servers, preview servers and the screenshot tool all bind a local
+            // port. Loopback never leaves the machine, so blocking it costs core
+            // workflows without buying containment.
+            allowLocalBinding: true,
+        },
+        ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+        filesystem: {
+            denyRead: sensitiveReadPaths(home),
+            // SRT adds its platform-required temporary paths; these are the only
+            // product-owned write roots supplied by GG Coder.
+            allowWrite: platform === "win32" ? writeRoots : [...writeRoots, "/dev/null"],
+            // `.git/hooks` is a mandatory sandbox protection with no opt-out, which
+            // is worth keeping: it stops a command installing a hook that later runs
+            // unsandboxed. `git clone`/`git init` only write there to copy inert
+            // `.sample` files, which SANDBOX_ENV_PATCH turns off.
+            //
+            // `.git/config` must be writable or `git init`, `git remote add` and
+            // `git clone` all fail outright.
+            allowGitConfig: true,
+            // Resolve the workspace first: on macOS the sandbox matches real paths, so
+            // a deny rule built from the symlinked path (/var/... vs /private/var/...)
+            // silently never matches.
+            denyWrite: withRealPath(workspace).flatMap((root) => [
+                path.join(root, ".env"),
+                path.join(root, ".env.local"),
+            ]),
+        },
+    };
+}
+function resolveSandboxCli() {
+    const packageEntry = import.meta.resolve("@anthropic-ai/sandbox-runtime");
+    return path.join(path.dirname(fileURLToPath(packageEntry)), "cli.js");
+}
+/**
+ * Does this machine actually support OS sandboxing? SRT reports missing
+ * bubblewrap/socat or an unprovisioned Windows sandbox user only when it
+ * initializes, so probe once per process with a trivial command instead of
+ * reimplementing its per-platform dependency matrix.
+ */
+let supportProbe = null;
+export function resetSandboxSupportProbeForTests() {
+    supportProbe = null;
+    warnedUnsupported = false;
+}
+function probeSandboxSupport(settingsPath) {
+    supportProbe ??= new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(process.execPath, [resolveSandboxCli(), "--settings", settingsPath, "-c", "exit 0"], {
+                stdio: ["ignore", "ignore", "pipe"],
+            });
+        }
+        catch (error) {
+            resolve({ supported: false, reason: error.message });
+            return;
+        }
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-500);
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+            resolve({ supported: false, reason: "sandbox probe timed out" });
+        }, PROBE_TIMEOUT_MS);
+        timer.unref?.();
+        child.once("error", (error) => {
+            clearTimeout(timer);
+            resolve({ supported: false, reason: error.message });
+        });
+        child.once("exit", (code) => {
+            clearTimeout(timer);
+            resolve({
+                supported: code === 0,
+                reason: code === 0 ? "ok" : stderr.trim() || `sandbox probe exited with code ${code}`,
+            });
+        });
+    });
+    return supportProbe;
+}
+async function writeStableSettings(settings) {
+    const json = `${JSON.stringify(settings, null, 2)}\n`;
+    const digest = createHash("sha256").update(json).digest("hex").slice(0, 20);
+    const settingsPath = path.join(SANDBOX_CONFIG_DIR, `${digest}.json`);
+    await fs.mkdir(SANDBOX_CONFIG_DIR, { recursive: true, mode: 0o700 });
+    try {
+        await fs.writeFile(settingsPath, json, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    return settingsPath;
+}
+/**
+ * Known limitations when `sandboxMode` is enabled (upstream, not fixable here):
+ *
+ * - **Linux pipes/redirections**: `echo hi | grep hi` fails with "Permission
+ *   denied" on /proc/self/fd/3 because bash's pipe setup clobbers the fd the
+ *   seccomp filter arrives on (sandbox-runtime#261).
+ * - **git over SSH**: `git@host:` remotes fail the SOCKS handshake on macOS —
+ *   the injected ProxyCommand uses `nc`, which cannot authenticate. HTTPS
+ *   remotes work. `~/.ssh` is also unreadable by design.
+ * - **`git config --global`**: `~/.gitconfig` is a mandatory upstream write
+ *   protection with no opt-out. Repo-local `git config` works.
+ * - **Corporate TLS interception / private registries**: need the CA and
+ *   registry host configured explicitly.
+ * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
+ *   degrades to no isolation (sandbox-runtime#428, #429).
+ *
+ * These are why the default is `off`; revisit when fixed upstream.
+ */
+/**
+ * Wrap an already-resolved shell with Anthropic's cross-platform OS sandbox.
+ * Initialization and dependency failures remain visible and fail closed: the
+ * original command is never spawned outside the sandbox as an implicit fallback.
+ */
+export async function prepareSandboxLaunch(shell, cwd, policy) {
+    if (policy.mode === "off")
+        return { ...shell, sandboxed: false };
+    const settingsPath = await writeStableSettings(buildSandboxSettings(cwd, policy));
+    const support = await probeSandboxSupport(settingsPath);
+    if (!support.supported) {
+        if (policy.mode === "workspace") {
+            throw new Error(`${support.reason}. Install the OS sandbox prerequisites ` +
+                `(Linux: bubblewrap + socat; Windows: run \`srt windows-install\`), ` +
+                `or set sandboxMode to "auto" to run without OS isolation.`);
+        }
+        if (!warnedUnsupported) {
+            warnedUnsupported = true;
+            log("WARN", "sandbox", "OS sandbox unavailable; commands run unisolated", {
+                reason: support.reason,
+            });
+        }
+        return { ...shell, sandboxed: false };
+    }
+    return {
+        file: process.execPath,
+        args: [resolveSandboxCli(), "--settings", settingsPath, "--", shell.file, ...shell.args],
+        isCmdFallback: shell.isCmdFallback,
+        sandboxed: true,
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/core/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AA+B/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,gBAAgB,EAAE,EAAE;CACrB,CAAC;AA6BF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAqB,EACrB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;aACjF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB;KACF,CAAC,IAAI,EAAE,CAAC;IACT,4EAA4E;IAC5E,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CACR;YACE,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI;YACJ,oEAAoE;YACpE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpC,GAAG,aAAa,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,OAAO,CAAC,YAAY,CAAC,CACxB;KACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,aAAa,EAAE,EAAE;YACjB,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,EAAE;YACpB,wEAAwE;YACxE,qEAAqE;YACrE,wCAAwC;YACxC,iBAAiB,EAAE,IAAI;SACxB;QACD,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,qEAAqE;YACrE,kDAAkD;YAClD,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,WAAW,CAAC;YAC5E,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,sDAAsD;YACtD,EAAE;YACF,qEAAqE;YACrE,iCAAiC;YACjC,cAAc,EAAE,IAAI;YACpB,2EAA2E;YAC3E,2EAA2E;YAC3E,0BAA0B;YAC1B,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;aAC9B,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAA2D,IAAI,CAAC;AAEhF,MAAM,UAAU,gCAAgC;IAC9C,YAAY,GAAG,IAAI,CAAC;IACpB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAoB;IAEpB,YAAY,KAAK,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CACX,OAAO,CAAC,QAAQ,EAChB,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,EACjE;gBACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;aACpC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACnE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,SAAS,EAAE,IAAI,KAAK,CAAC;gBACrB,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,IAAI,EAAE;aACtF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAyB;IAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,GAAW,EACX,MAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,yCAAyC;gBACxD,qEAAqE;gBACrE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,iDAAiD,EAAE;gBACxE,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,IAAI,EAAE,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;QACxF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/core/sandbox.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox.test.d.ts.map

package/dist/core/sandbox.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.d.ts","sourceRoot":"","sources":["../../src/core/sandbox.test.ts"],"names":[],"mappings":""}

package/dist/core/sandbox.test.js

@@ -0,0 +1,157 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { getAppPaths } from "../config.js";
+import { DEFAULT_SETTINGS } from "./settings-manager.js";
+import { buildSandboxSettings, prepareSandboxLaunch, resetSandboxSupportProbeForTests, } from "./sandbox.js";
+describe("buildSandboxSettings", () => {
+    it("limits writes to the workspace and temp directory, and enforces an allowlist", () => {
+        // A real directory, so symlinked temp roots (macOS /var → /private/var) are
+        // exercised rather than silently skipped.
+        const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "gg-sandbox-workspace-"));
+        const settings = buildSandboxSettings(cwd, { mode: "workspace", allowedDomains: [] }, "darwin");
+        expect(settings.filesystem.allowWrite).toEqual(expect.arrayContaining([
+            fs.realpathSync(path.resolve(cwd)),
+            fs.realpathSync(path.resolve(os.tmpdir())),
+            getAppPaths().agentDir,
+        ]));
+        expect(settings.filesystem.allowWrite).not.toContain(os.homedir());
+        // The sandbox matches real paths, so a deny rule must cover the resolved
+        // workspace or it silently never fires (macOS /var → /private/var).
+        expect(settings.filesystem.denyWrite).toEqual(expect.arrayContaining([path.join(fs.realpathSync(path.resolve(cwd)), ".env")]));
+        expect(settings.filesystem.denyRead).toEqual(expect.arrayContaining([
+            path.join(os.homedir(), ".ssh"),
+            path.join(os.homedir(), ".gg", "auth.json"),
+        ]));
+        expect(settings.network).toMatchObject({
+            strictAllowlist: true,
+            allowUnixSockets: [],
+            // Dev servers and the screenshot tool bind loopback; blocking it would
+            // break core workflows without containing anything.
+            allowLocalBinding: true,
+        });
+        // Egress is an allowlist, never open: an unknown host stays unreachable.
+        expect(settings.network.allowedDomains).not.toContain("api.example.com");
+    });
+    it("keeps bash writable in the same roots the write guard already allows", () => {
+        const cwd = path.join(os.tmpdir(), "gg-sandbox-workspace");
+        const extraRoot = path.join(os.tmpdir(), "gg-sandbox-second-root");
+        const settings = buildSandboxSettings(cwd, { mode: "workspace", allowedDomains: [], additionalRoots: [extraRoot] }, "darwin");
+        // Multi-root sessions and ~/.gg must not silently lose bash writes.
+        expect(settings.filesystem.allowWrite).toEqual(expect.arrayContaining([path.resolve(cwd), path.resolve(extraRoot), getAppPaths().agentDir]));
+        expect(settings.filesystem.allowWrite).not.toContain(os.homedir());
+    });
+    it("honors the outside-workspace opt-out instead of contradicting the user", () => {
+        const settings = buildSandboxSettings(path.join(os.tmpdir(), "gg-sandbox-workspace"), { mode: "workspace", allowedDomains: [], allowOutsideWorkspaceWrites: true }, "darwin");
+        expect(settings.filesystem.allowWrite).toContain(os.homedir());
+        // Consenting to write outside the workspace is not consent to leak secrets.
+        expect(settings.filesystem.denyRead).toContain(path.join(os.homedir(), ".ssh"));
+    });
+    it("normalizes and de-duplicates explicit network domains deterministically", () => {
+        const settings = buildSandboxSettings("/workspace", {
+            mode: "workspace",
+            allowedDomains: [" registry.npmjs.org ", "github.com", "github.com", ""],
+            strictDomains: true,
+        });
+        expect(settings.network.allowedDomains).toEqual(["github.com", "registry.npmjs.org"]);
+    });
+});
+describe("sandbox defaults", () => {
+    it("stays opt-in while upstream breaks core workflows", () => {
+        // Verified upstream breakage: Linux pipes/redirections fail under seccomp,
+        // macOS git-over-SSH fails the SOCKS handshake, and `git config --global`
+        // is refused. Turning this on by default would break `git push` and piped
+        // commands right after an update. Revisit when those are fixed upstream.
+        expect(DEFAULT_SETTINGS.sandboxMode).toBe("off");
+    });
+    it("reaches mainstream toolchains out of the box, so the default is invisible", () => {
+        const { network } = buildSandboxSettings("/workspace", {
+            mode: "auto",
+            allowedDomains: [],
+        });
+        // If any of these were missing, `npm install` / `pip install` / `git clone`
+        // would fail for every user the moment the sandbox shipped on.
+        for (const host of [
+            "github.com",
+            "registry.npmjs.org",
+            "pypi.org",
+            "files.pythonhosted.org",
+            "proxy.golang.org",
+            "crates.io",
+            "rubygems.org",
+        ]) {
+            expect(network.allowedDomains).toContain(host);
+        }
+    });
+    it("rejects patterns the sandbox itself refuses, so a bad entry cannot brick startup", () => {
+        const { network } = buildSandboxSettings("/workspace", {
+            mode: "auto",
+            allowedDomains: [],
+        });
+        for (const domain of network.allowedDomains) {
+            expect(domain).not.toBe("*");
+            // sandbox-runtime rejects overly broad wildcards like "*.com".
+            expect(domain).not.toMatch(/^\*\.[a-z]+$/);
+            expect(domain).not.toMatch(/[:/]/);
+        }
+    });
+    it("adds user hosts to the defaults, and honors an explicit takeover", () => {
+        const merged = buildSandboxSettings("/workspace", {
+            mode: "auto",
+            allowedDomains: ["internal.example.com"],
+        });
+        expect(merged.network.allowedDomains).toContain("internal.example.com");
+        expect(merged.network.allowedDomains).toContain("github.com");
+        const strict = buildSandboxSettings("/workspace", {
+            mode: "auto",
+            allowedDomains: ["internal.example.com"],
+            strictDomains: true,
+        });
+        expect(strict.network.allowedDomains).toEqual(["internal.example.com"]);
+    });
+});
+describe("prepareSandboxLaunch", () => {
+    const shell = { file: "bash", args: ["-c", "echo ok"], isCmdFallback: false };
+    beforeEach(() => resetSandboxSupportProbeForTests());
+    afterEach(() => {
+        vi.unstubAllEnvs();
+        resetSandboxSupportProbeForTests();
+    });
+    it("preserves the original shell only for explicit sandbox opt-out", async () => {
+        await expect(prepareSandboxLaunch(shell, "/workspace", { mode: "off", allowedDomains: [] })).resolves.toEqual({ ...shell, sandboxed: false });
+    });
+    it("wraps the command where isolation is available, and honors the mode contract where it is not", async () => {
+        // Whether an OS sandbox is usable is a property of the host, not of this
+        // code: CI Linux has no bwrap/socat and CI Windows has no provisioned
+        // sandbox user. `auto` never throws, so it reports which branch applies.
+        const probe = await prepareSandboxLaunch(shell, os.tmpdir(), {
+            mode: "auto",
+            allowedDomains: [],
+        });
+        if (!probe.sandboxed) {
+            // Unsupported host: `auto` degrades and `workspace` fails closed.
+            expect(probe).toEqual({ ...shell, sandboxed: false });
+            await expect(prepareSandboxLaunch(shell, os.tmpdir(), { mode: "workspace", allowedDomains: [] })).rejects.toThrow(/Install the OS sandbox prerequisites/);
+            return;
+        }
+        const launch = await prepareSandboxLaunch(shell, os.tmpdir(), {
+            mode: "workspace",
+            allowedDomains: [],
+        });
+        expect(launch.sandboxed).toBe(true);
+        expect(launch.file).toBe(process.execPath);
+        expect(launch.args).toEqual(expect.arrayContaining(["--settings", "--", "bash", "-c", "echo ok"]));
+    });
+    it("degrades instead of breaking every command when prerequisites are missing", async () => {
+        // An unusable interpreter makes the probe child exit non-zero, standing in
+        // for bwrap-less Linux or an unprovisioned Windows sandbox user.
+        vi.spyOn(process, "execPath", "get").mockReturnValue("/nonexistent/gg-node");
+        await expect(prepareSandboxLaunch(shell, os.tmpdir(), { mode: "auto", allowedDomains: [] })).resolves.toEqual({ ...shell, sandboxed: false });
+    });
+    it("fails closed in strict workspace mode with actionable install guidance", async () => {
+        vi.spyOn(process, "execPath", "get").mockReturnValue("/nonexistent/gg-node");
+        await expect(prepareSandboxLaunch(shell, os.tmpdir(), { mode: "workspace", allowedDomains: [] })).rejects.toThrow(/bubblewrap \+ socat|windows-install/);
+    });
+});
+//# sourceMappingURL=sandbox.test.js.map

package/dist/core/sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.js","sourceRoot":"","sources":["../../src/core/sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gCAAgC,GACjC,MAAM,cAAc,CAAC;AAEtB,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,4EAA4E;QAC5E,0CAA0C;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEhG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,CAC5C,MAAM,CAAC,eAAe,CAAC;YACrB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,WAAW,EAAE,CAAC,QAAQ;SACvB,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,CAC3C,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAChF,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC1C,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC;SAC5C,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YACrC,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,EAAE;YACpB,uEAAuE;YACvE,oDAAoD;YACpD,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,yEAAyE;QACzE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,oBAAoB,CACnC,GAAG,EACH,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,EACvE,QAAQ,CACT,CAAC;QAEF,oEAAoE;QACpE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,CAC5C,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAC7F,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,EAC9C,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAC5E,QAAQ,CACT,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,4EAA4E;QAC5E,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE;YAClD,IAAI,EAAE,WAAW;YACjB,cAAc,EAAE,CAAC,sBAAsB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC;YACxE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,YAAY,EAAE;YACrD,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,+DAA+D;QAC/D,KAAK,MAAM,IAAI,IAAI;YACjB,YAAY;YACZ,oBAAoB;YACpB,UAAU;YACV,wBAAwB;YACxB,kBAAkB;YAClB,WAAW;YACX,cAAc;SACf,EAAE,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,YAAY,EAAE;YACrD,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,+DAA+D;YAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE;YAChD,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,CAAC,sBAAsB,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE;YAChD,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,CAAC,sBAAsB,CAAC;YACxC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAE9E,UAAU,CAAC,GAAG,EAAE,CAAC,gCAAgC,EAAE,CAAC,CAAC;IACrD,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gCAAgC,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,CACV,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAC/E,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3D,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,kEAAkE;YAClE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,CACV,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5D,IAAI,EAAE,WAAW;YACjB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CACzB,MAAM,CAAC,eAAe,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;QAE7E,MAAM,MAAM,CACV,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAC/E,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;QAE7E,MAAM,MAAM,CACV,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/settings-manager.d.ts

@@ -44,6 +44,11 @@ declare const SettingsSchema: z.ZodObject<{
         allowlist: "allowlist";
     }>>;
     networkAllow: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    sandboxMode: z.ZodDefault<z.ZodEnum<{
+        off: "off";
+        auto: "auto";
+        workspace: "workspace";
+    }>>;
     deferredMcpTools: z.ZodDefault<z.ZodBoolean>;
     mcpModernProtocol: z.ZodDefault<z.ZodBoolean>;
     subagentMaxPerModel: z.ZodOptional<z.ZodNumber>;

package/dist/core/settings-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-manager.d.ts","sourceRoot":"","sources":["../../src/core/settings-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkElB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,gBAAgB,EAAE,QAiB9B,CAAC;AAIF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;gBAEX,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;IAazB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,GAAG,CAAC,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IAI5C,GAAG,CAAC,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E,MAAM,IAAI,QAAQ;CAGnB"}
+{"version":3,"file":"settings-manager.d.ts","sourceRoot":"","sources":["../../src/core/settings-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqFlB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,gBAAgB,EAAE,QAkB9B,CAAC;AAIF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;gBAEX,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;IAazB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,GAAG,CAAC,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IAI5C,GAAG,CAAC,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E,MAAM,IAAI,QAAQ;CAGnB"}

package/dist/core/settings-manager.js

@@ -50,6 +50,25 @@ const SettingsSchema = z.object({
     /** Hosts allowed when networkMode is "allowlist". A leading `*.` wildcard
      *  matches subdomains (`*.github.com`). */
     networkAllow: z.array(z.string()).default([]),
+    /**
+     * OS-enforced command isolation for bash (filesystem + network), via
+     * sandbox-runtime. `auto` isolates wherever the platform supports it and
+     * degrades with a warning where it does not; `workspace` additionally fails
+     * closed on hosts that cannot isolate.
+     *
+     * Opt-in, and deliberately so. Verified day-one breakage in the upstream
+     * sandbox that we cannot fix from here:
+     *   • Linux: pipes and redirections fail under seccomp — `echo hi | grep hi`
+     *     returns "Permission denied" on /proc/self/fd/3 (upstream #261).
+     *   • macOS: git over SSH fails the SOCKS handshake, because the ProxyCommand
+     *     uses `nc`, which cannot do SOCKS5 auth (upstream sandbox-utils.ts).
+     *   • `git config --global` is refused: ~/.gitconfig is a mandatory upstream
+     *     write protection with no opt-out.
+     *   • Corporate TLS interception and private registries need extra config.
+     * Enabling it by default would break `git push` and piped commands for a
+     * large share of users immediately after an update, with no obvious cause.
+     */
+    sandboxMode: z.enum(["auto", "workspace", "off"]).default("off"),
     /** Defer MCP tool schemas out of the prompt until discovered via tool_search.
      *  Cuts ~8k tokens/cache-miss turn with two MCP servers (bench/RESULTS.md). */
     deferredMcpTools: z.boolean().default(true),
@@ -82,6 +101,7 @@ export const DEFAULT_SETTINGS = {
     allowOutsideWorkspaceWrites: false,
     networkMode: "off",
     networkAllow: [],
+    sandboxMode: "off",
     deferredMcpTools: true,
     mcpModernProtocol: false,
     sessionRetentionDays: 30,

package/dist/core/settings-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-manager.js","sourceRoot":"","sources":["../../src/core/settings-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,8DAA8D;AAE9D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5D,eAAe,EAAE,CAAC;SACf,IAAI,CAAC;QACJ,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,UAAU;QACV,SAAS;QACT,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,KAAK;KACN,CAAC;SACD,OAAO,CAAC,WAAW,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,KAAK,EAAE,CAAC;SACL,IAAI,CAAC;QACJ,MAAM;QACN,MAAM;QACN,OAAO;QACP,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;KACnB,CAAC;SACD,OAAO,CAAC,MAAM,CAAC;IAClB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,yDAAyD;IACzD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC;kFAC8E;IAC9E,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD;;;sEAGkE;IAClE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD;+CAC2C;IAC3C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C;mFAC+E;IAC/E,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C;;;kFAG8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;6EACyE;IACzE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;oFAEgF;IAChF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CACrE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,WAAW;IAC5B,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,KAAK;IACtB,KAAK,EAAE,MAAM;IACb,cAAc,EAAE,IAAI;IACpB,kBAAkB,EAAE,IAAI;IACxB,cAAc,EAAE,IAAI;IACpB,2BAA2B,EAAE,KAAK;IAClC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,EAAE;IAChB,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,KAAK;IACxB,oBAAoB,EAAE,EAAE;IACxB,YAAY,EAAE,WAAW;CAC1B,CAAC;AAEF,8DAA8D;AAE9D,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAa,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAS;IACjB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,uDAAuD;YACvD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAA2B,GAAM;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAA2B,GAAM,EAAE,KAAkB;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"settings-manager.js","sourceRoot":"","sources":["../../src/core/settings-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,8DAA8D;AAE9D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5D,eAAe,EAAE,CAAC;SACf,IAAI,CAAC;QACJ,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,UAAU;QACV,SAAS;QACT,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,KAAK;KACN,CAAC;SACD,OAAO,CAAC,WAAW,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,KAAK,EAAE,CAAC;SACL,IAAI,CAAC;QACJ,MAAM;QACN,MAAM;QACN,OAAO;QACP,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;KACnB,CAAC;SACD,OAAO,CAAC,MAAM,CAAC;IAClB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,yDAAyD;IACzD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC;kFAC8E;IAC9E,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD;;;sEAGkE;IAClE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD;+CAC2C;IAC3C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChE;mFAC+E;IAC/E,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C;;;kFAG8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;6EACyE;IACzE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;oFAEgF;IAChF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CACrE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,WAAW;IAC5B,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,KAAK;IACtB,KAAK,EAAE,MAAM;IACb,cAAc,EAAE,IAAI;IACpB,kBAAkB,EAAE,IAAI;IACxB,cAAc,EAAE,IAAI;IACpB,2BAA2B,EAAE,KAAK;IAClC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,EAAE;IAChB,WAAW,EAAE,KAAK;IAClB,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,KAAK;IACxB,oBAAoB,EAAE,EAAE;IACxB,YAAY,EAAE,WAAW;CAC1B,CAAC;AAEF,8DAA8D;AAE9D,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAa,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAS;IACjB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,uDAAuD;YACvD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAA2B,GAAM;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAA2B,GAAM,EAAE,KAAkB;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/core/verification-evidence.d.ts

@@ -0,0 +1,17 @@
+import type { Message } from "@kenkaiiii/gg-ai";
+export interface VerificationCommandClassification {
+    accepted: boolean;
+    /** False for ordinary shell work that was never plausibly a verification attempt. */
+    candidate: boolean;
+    reason: string;
+}
+export interface VerificationEvidence {
+    command: string;
+    status: "passed" | "failed" | "rejected";
+    reason: string;
+}
+/** Fail-closed semantic classifier: every shell segment must be a bounded check. */
+export declare function classifyVerificationCommand(command: string): VerificationCommandClassification;
+/** Extract harness-owned evidence from completed bash calls in a transcript. */
+export declare function collectVerificationEvidence(messages: readonly Message[]): VerificationEvidence[];
+//# sourceMappingURL=verification-evidence.d.ts.map

package/dist/core/verification-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-evidence.d.ts","sourceRoot":"","sources":["../../src/core/verification-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,OAAO,EAAc,MAAM,kBAAkB,CAAC;AAGzE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAkND,oFAAoF;AACpF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,iCAAiC,CAwB9F;AAUD,gFAAgF;AAChF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAiDhG"}