@kindgi/cli 0.1.5 → 0.1.6

package/dist/dev/sandbox/notices.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * What `kindgi dev` says about the sandbox at start, and whether it starts:
+ *
+ * - on, and this machine can: one line naming it, then each path or
+ *   socket `dev.sandbox` opens;
+ * - on, and it can't: a warning, loud and once, with why and what would
+ *   fix it; the pack service runs without;
+ * - required, and it can't: a refusal, before anything starts;
+ * - off: one line saying so.
+ *
+ * On, with more than one Kindgi configuration in the app, it refuses: the
+ * code it runs can't change the one in use, but bubblewrap can't stop it
+ * adding another by a name looked up first, which the next start would
+ * load outside the sandbox.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { KINDGI_CONFIG_FILENAMES } from '@kindgi/handler-runtime';
+import { DEV_SANDBOX_DOCS } from './detect.js';
+import { sandboxLabel } from './index.js';
+import { DEV_SANDBOX_VAR, devSandboxSettings } from './settings.js';
+export async function resolveDevSandbox(opts) {
+    const settings = devSandboxSettings(opts.config, opts.env, {
+        packDir: opts.packDir,
+        home: opts.home,
+    });
+    if (settings.kind === 'invalid')
+        return { kind: 'error', message: settings.message };
+    const { mode, source, allowRead, allowUnixSockets } = settings.value;
+    if (mode === 'off') {
+        const why = source === 'env' ? `${DEV_SANDBOX_VAR}=off` : '`dev.sandbox: false` in the config';
+        return {
+            kind: 'ok',
+            sandbox: undefined,
+            lines: [
+                `⚠ dev sandbox: off (${why}): your tools' code can read your files and keys as you can`,
+            ],
+        };
+    }
+    const availability = await opts.detect();
+    if (availability.kind === 'unavailable') {
+        if (mode === 'required') {
+            return {
+                kind: 'error',
+                message: `the dev sandbox is required (${DEV_SANDBOX_VAR}=required), and can't run here: ${availability.reason}. ${availability.fix}`,
+            };
+        }
+        return {
+            kind: 'ok',
+            sandbox: undefined,
+            lines: [
+                '⚠ Your tools run without the dev sandbox on this system: they can read your files and keys.',
+                `  Why: ${availability.reason}. ${availability.fix}`,
+                `  More: ${DEV_SANDBOX_DOCS}. To refuse to run without it: ${DEV_SANDBOX_VAR}=required; to drop this warning: ${DEV_SANDBOX_VAR}=off.`,
+            ],
+        };
+    }
+    const configs = kindgiConfigFiles(opts.packDir);
+    if (configs.length > 1) {
+        return {
+            kind: 'error',
+            message: `more than one Kindgi configuration in ${opts.packDir}: ${configs.join(', ')}. With the dev sandbox on, kindgi dev starts with one only: the code it runs can't change it, but could add another by a name looked up first. Keep the one you use and remove the others.`,
+        };
+    }
+    const sandbox = {
+        engine: availability.engine,
+        settings: settings.value,
+        home: opts.home,
+    };
+    return {
+        kind: 'ok',
+        sandbox,
+        lines: [
+            `✓ dev sandbox: ${sandboxLabel(availability.engine)}: your tools' code can't read your keys or files outside the app, write outside it, or reach Docker; it still has the network and the app's own files`,
+            ...allowRead.map((p) => `  also reads ${p} (dev.sandbox.allowRead)`),
+            ...allowUnixSockets.map((p) => `  also connects to ${p} (dev.sandbox.allowUnixSockets)`),
+        ],
+    };
+}
+/** The Kindgi configuration files in the app: `kindgi.config.*`, `kindgi.config.json`, a `pyproject.toml` with `[tool.kindgi]`. */
+export function kindgiConfigFiles(packDir) {
+    const found = [...KINDGI_CONFIG_FILENAMES, 'kindgi.config.json'].filter((name) => existsSync(join(packDir, name)));
+    const pyproject = join(packDir, 'pyproject.toml');
+    try {
+        if (/^\[tool\.kindgi[\].]/m.test(readFileSync(pyproject, 'utf8')))
+            found.push('pyproject.toml');
+    }
+    catch {
+        // No pyproject.toml.
+    }
+    return found;
+}
+//# sourceMappingURL=notices.js.map

package/dist/dev/sandbox/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../../src/dev/sandbox/notices.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,OAAO,EAAE,gBAAgB,EAA4B,MAAM,aAAa,CAAC;AACzE,OAAO,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAMvC;IACC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IACrE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,eAAe,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC;QAC/F,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE;gBACL,uBAAuB,GAAG,6DAA6D;aACxF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACzC,IAAI,YAAY,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACxC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,gCAAgC,eAAe,mCAAmC,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE;aACtI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE;gBACL,6FAA6F;gBAC7F,UAAU,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE;gBACpD,WAAW,gBAAgB,kCAAkC,eAAe,oCAAoC,eAAe,OAAO;aACvI;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,yCAAyC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SAClR,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO;QACP,KAAK,EAAE;YACL,kBAAkB,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,uJAAuJ;YAC1M,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;YACpE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;SACzF;KACF,CAAC;AACJ,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,uBAAuB,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/E,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAChC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/dev/sandbox/policy.d.ts

@@ -0,0 +1,80 @@
+import { type PackCode } from '../pack-code.js';
+import type { DevSandboxSettings } from './settings.js';
+export interface SandboxPolicy {
+    /** The app (the pack root), real path. */
+    readonly app: string;
+    /** The home folder, real path. */
+    readonly home: string;
+    /** Real paths the service reads, outside the app. */
+    readonly readRoots: readonly string[];
+    /** Roots left out because they hold the home folder. */
+    readonly skipped: readonly string[];
+    /** UNIX sockets it may connect to (`dev.sandbox.allowUnixSockets`). */
+    readonly allowUnixSockets: readonly string[];
+    /** Its own temp folder, real path (its `TMPDIR` on macOS). */
+    readonly tmpDir: string;
+    /** Folders inside the app's closed `.kindgi` it may write (the indexer's output). */
+    readonly writable: readonly string[];
+    /**
+     * The app's Kindgi configuration files, by every name `kindgi dev` looks
+     * for, whether or not they exist: never written from inside.
+     */
+    readonly readOnly: readonly string[];
+    /**
+     * Symbolic links a path it runs from resolves through, outside the app
+     * and the read roots (a uv-managed Python's `cpython-3.11-…` link to its
+     * `cpython-3.11.16-…` folder, in the home folder): opened one by one
+     * (macOS), or made again inside (Linux).
+     */
+    readonly links: readonly {
+        readonly path: string;
+        readonly target: string;
+    }[];
+}
+/** Every name `kindgi dev` reads a pack's configuration from, at the app's root. */
+export declare const CONFIG_FILE_NAMES: readonly string[];
+export interface SandboxPolicyOptions {
+    readonly packDir: string;
+    readonly home: string;
+    readonly code: PackCode;
+    readonly settings: DevSandboxSettings;
+    readonly tmpDir: string;
+    /** The pack service's environment, for asking the Python interpreter. */
+    readonly env: Readonly<Record<string, string>>;
+    /** Node: the binary and the entrypoint (the pack service's, or the indexer's). */
+    readonly node: {
+        readonly execPath: string;
+        readonly entry: string;
+    };
+    /** Folders inside the app's `.kindgi` it may write. */
+    readonly writable?: readonly string[];
+    /** Test seam: what the Python interpreter says about itself. */
+    readonly queryPython?: (python: readonly string[], cwd: string, env: Readonly<Record<string, string>>) => Promise<PythonPaths>;
+}
+export interface PythonPaths {
+    readonly path: readonly string[];
+    readonly prefix: string;
+    readonly basePrefix: string;
+    readonly executable: string;
+}
+export declare function sandboxPolicy(opts: SandboxPolicyOptions): Promise<SandboxPolicy>;
+/**
+ * The symbolic links met while resolving `path`, in order: each one's own
+ * path (its folder resolved) and its target as written.
+ */
+export declare function symlinksOf(path: string): {
+    readonly path: string;
+    readonly target: string;
+}[];
+/**
+ * The real folders of the packages that dependencies of `starts` link to
+ * outside `covered` (a checkout's workspace packages, `link:` ones), and
+ * theirs in turn: each package's own folder, never a parent. A link into
+ * a covered folder (a `node_modules`) isn't followed: it's open already.
+ */
+export declare function linkedPackages(starts: readonly string[], covered: readonly string[]): string[];
+/** The classpath in a JVM pack's `@argfile` (`-cp "<entries>"`), each entry's real path. */
+export declare function classpathEntries(argsFile: string): Promise<string[]>;
+/** Ask the pack's interpreter where it reads from. */
+export declare function queryPythonReal(python: readonly string[], cwd: string, env: Readonly<Record<string, string>>): Promise<PythonPaths>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/dev/sandbox/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/policy.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,KAAK,QAAQ,EAA+B,MAAM,iBAAiB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/E;AAED,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAClC,OAAO,CAAC,WAAW,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAuBtF;AAKD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CA+B7F;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB9F;AAgJD,4FAA4F;AAC5F,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAS1E;AAKD,sDAAsD;AACtD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,CAkCtB"}

package/dist/dev/sandbox/policy.js

@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * What the sandboxed pack service may read, worked out at every start
+ * from what that start runs:
+ *
+ * - the app (the pack root), read and write;
+ * - every `node_modules` from the app up to `/` (a workspace's hoisted
+ *   dependencies);
+ * - the runtime: Node's install and the pack service's own package; the
+ *   Python interpreter's `sys.path`, prefix and base prefix (a venv, a
+ *   uv-managed Python under `~/.local/share/uv`); the JDK and every
+ *   classpath entry (jars in `~/.m2/repository`, coursier's cache);
+ * - `dev.sandbox.allowRead`;
+ * - a linked package's own folder: where a dependency's link points
+ *   outside all of the above (a checkout's workspace packages, `link:`
+ *   ones), and theirs in turn.
+ *
+ * A root that is `/`, the home folder, or a folder holding the home
+ * folder is left out (`skipped`): it would open everything the sandbox
+ * closes.
+ *
+ * The app's Kindgi configuration (`kindgi.config.*`, `pyproject.toml`) is
+ * read-only inside: `kindgi dev` itself loads it, and it says how wide the
+ * sandbox is.
+ */
+import { execFile } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync, readlinkSync, realpathSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { delimiter, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';
+import { isJvmPackCode, javaArgsFile } from '../pack-code.js';
+/** Every name `kindgi dev` reads a pack's configuration from, at the app's root. */
+export const CONFIG_FILE_NAMES = [
+    'kindgi.config.ts',
+    'kindgi.config.mts',
+    'kindgi.config.cts',
+    'kindgi.config.js',
+    'kindgi.config.mjs',
+    'kindgi.config.cjs',
+    'kindgi.config.json',
+    'pyproject.toml',
+];
+export async function sandboxPolicy(opts) {
+    const app = real(opts.packDir);
+    const home = real(opts.home);
+    const runtime = await runtimeRoots(opts);
+    const base = [...nodeModulesUpFrom(app), ...runtime.roots, ...opts.settings.allowRead];
+    const linked = linkedPackages([app, ...runtime.packages], [app, ...base.map(real)]);
+    const { readRoots, skipped } = partitionRoots([...base, ...linked], app, home);
+    const inside = (p) => [app, ...readRoots].some((r) => p === r || p.startsWith(r + sep));
+    const links = new Map();
+    for (const path of [...runtime.paths, ...base]) {
+        for (const link of symlinksOf(path))
+            if (!inside(link.path))
+                links.set(link.path, link.target);
+    }
+    return {
+        app,
+        home,
+        readRoots,
+        skipped,
+        allowUnixSockets: opts.settings.allowUnixSockets,
+        tmpDir: opts.tmpDir,
+        writable: (opts.writable ?? []).map(real),
+        readOnly: CONFIG_FILE_NAMES.map((name) => join(app, name)),
+        links: [...links].map(([path, target]) => ({ path, target })),
+    };
+}
+/** How many links one path's resolution follows, at most (a loop stops there). */
+const MAX_HOPS = 40;
+/**
+ * The symbolic links met while resolving `path`, in order: each one's own
+ * path (its folder resolved) and its target as written.
+ */
+export function symlinksOf(path) {
+    if (!isAbsolute(path))
+        return [];
+    const found = [];
+    let pending = path.split(sep).filter((c) => c !== '');
+    let at = parse(path).root;
+    let hops = 0;
+    while (pending.length > 0 && hops < MAX_HOPS) {
+        const name = pending.shift();
+        if (name === '.')
+            continue;
+        if (name === '..') {
+            at = dirname(at);
+            continue;
+        }
+        const next = join(at, name);
+        let target;
+        try {
+            if (lstatSync(next).isSymbolicLink())
+                target = readlinkSync(next);
+        }
+        catch {
+            return found;
+        }
+        if (target === undefined) {
+            at = next;
+            continue;
+        }
+        hops += 1;
+        found.push({ path: next, target });
+        const rest = target.split(sep).filter((c) => c !== '');
+        if (isAbsolute(target))
+            at = parse(target).root;
+        pending = [...rest, ...pending];
+    }
+    return found;
+}
+/** How many linked packages the search follows, at most. */
+const MAX_LINKED = 500;
+/**
+ * The real folders of the packages that dependencies of `starts` link to
+ * outside `covered` (a checkout's workspace packages, `link:` ones), and
+ * theirs in turn: each package's own folder, never a parent. A link into
+ * a covered folder (a `node_modules`) isn't followed: it's open already.
+ */
+export function linkedPackages(starts, covered) {
+    const isCovered = (p) => covered.some((c) => p === c || p.startsWith(c + sep));
+    const found = new Set();
+    const queue = [...starts];
+    const seen = new Set();
+    while (queue.length > 0 && found.size < MAX_LINKED) {
+        const dir = queue.shift();
+        if (seen.has(dir))
+            continue;
+        seen.add(dir);
+        for (const name of dependencyNames(dir)) {
+            const link = join(dir, 'node_modules', ...name.split('/'));
+            let isLink = false;
+            try {
+                isLink = lstatSync(link).isSymbolicLink();
+            }
+            catch {
+                continue;
+            }
+            if (!isLink)
+                continue;
+            const target = real(link);
+            if (isCovered(target) || !existsSync(join(target, 'package.json')))
+                continue;
+            found.add(target);
+            queue.push(target);
+        }
+    }
+    return [...found];
+}
+/** The names a package depends on at run time (`dependencies`, `optionalDependencies`). */
+function dependencyNames(dir) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+        return [
+            ...Object.keys(manifest.dependencies ?? {}),
+            ...Object.keys(manifest.optionalDependencies ?? {}),
+        ];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * What the pack's runtime reads: Node's install, the Python interpreter's
+ * paths, the JDK and the classpath; and, for Node, the package whose
+ * entrypoint runs (whose links are followed).
+ */
+async function runtimeRoots(opts) {
+    const { code } = opts;
+    if (code.language === 'node') {
+        const node = nodeRoots(opts.node.execPath, opts.node.entry);
+        return { ...node, paths: [opts.node.execPath, opts.node.entry] };
+    }
+    if (code.language === 'python') {
+        const query = opts.queryPython ?? queryPythonReal;
+        const py = await query(code.python, opts.packDir, opts.env);
+        const program = code.python[0];
+        return {
+            roots: [...py.path, py.prefix, py.basePrefix, dirname(dirname(real(py.executable)))],
+            packages: [],
+            paths: [
+                py.executable,
+                ...(program !== undefined && isAbsolute(program) ? [program] : []),
+                ...(program !== undefined && !isAbsolute(program) && program.includes(sep)
+                    ? [resolve(opts.packDir, program)]
+                    : []),
+                ...py.path,
+                py.prefix,
+                py.basePrefix,
+            ],
+        };
+    }
+    if (isJvmPackCode(code)) {
+        const jdk = jdkRoot(code.javaHome, code.java, opts.env.PATH);
+        const classpath = await classpathEntries(javaArgsFile(code));
+        return {
+            roots: [jdk, ...classpath],
+            packages: [],
+            paths: [...(code.javaHome !== undefined ? [code.javaHome] : []), code.java, ...classpath],
+        };
+    }
+    return { roots: [], packages: [], paths: [] };
+}
+/**
+ * The candidates that exist, as real paths: outside the app (it's open
+ * anyway), and not holding the home folder (those are `skipped`).
+ */
+function partitionRoots(candidates, app, home) {
+    const readRoots = new Set();
+    const skipped = new Set();
+    for (const candidate of candidates) {
+        if (candidate === '' || !isAbsolute(candidate) || !existsSync(candidate))
+            continue;
+        const root = real(candidate);
+        if (root === app || root.startsWith(app + sep))
+            continue;
+        (holds(root, home) ? skipped : readRoots).add(root);
+    }
+    return { readRoots: withoutNested([...readRoots]), skipped: [...skipped] };
+}
+/** Whether `root` is `/`, `home`, or a folder above it. */
+function holds(root, home) {
+    return root === parse(root).root || home === root || home.startsWith(root + sep);
+}
+/** Drop a root inside another (the outer one covers it). */
+function withoutNested(roots) {
+    return roots.filter((r) => !roots.some((o) => o !== r && r.startsWith(o + sep)));
+}
+function real(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+/** `<dir>/node_modules` for the app and each folder above it, where one exists. */
+function nodeModulesUpFrom(dir) {
+    const found = [];
+    let at = dir;
+    for (;;) {
+        const candidate = join(at, 'node_modules');
+        if (existsSync(candidate))
+            found.push(candidate);
+        const up = dirname(at);
+        if (up === at)
+            return found;
+        at = up;
+    }
+}
+/** Node's install, and the entrypoint's package with the `node_modules` above it. */
+function nodeRoots(execPath, entry) {
+    const entryReal = real(entry);
+    let packageRoot = dirname(entryReal);
+    while (!existsSync(join(packageRoot, 'package.json')) && dirname(packageRoot) !== packageRoot) {
+        packageRoot = dirname(packageRoot);
+    }
+    return {
+        roots: [dirname(dirname(real(execPath))), packageRoot, ...nodeModulesUpFrom(packageRoot)],
+        packages: [packageRoot],
+    };
+}
+/** The JDK's home: `javaHome`, else the `java` on `PATH`'s, two folders up from its real path. */
+function jdkRoot(javaHome, java, path) {
+    if (javaHome !== undefined)
+        return real(javaHome);
+    const binary = isAbsolute(java)
+        ? java
+        : (path ?? '')
+            .split(delimiter)
+            .map((d) => join(d, java))
+            .find((p) => existsSync(p));
+    return binary === undefined ? '' : dirname(dirname(real(binary)));
+}
+/** The classpath in a JVM pack's `@argfile` (`-cp "<entries>"`), each entry's real path. */
+export async function classpathEntries(argsFile) {
+    const text = await readFile(argsFile, 'utf8').catch(() => '');
+    const match = /-cp\s+"((?:[^"\\]|\\.)*)"/.exec(text);
+    if (match?.[1] === undefined)
+        return [];
+    const value = match[1].replace(/\\(.)/g, '$1');
+    return value
+        .split(delimiter)
+        .filter((e) => e !== '')
+        .map((e) => (e.endsWith(`${sep}*`) ? e.slice(0, -2) : e));
+}
+const PYTHON_PATHS = 'import json, sys; print(json.dumps({"path": sys.path, "prefix": sys.prefix, "base": sys.base_prefix, "exe": sys.executable}))';
+/** Ask the pack's interpreter where it reads from. */
+export function queryPythonReal(python, cwd, env) {
+    const [program, ...args] = python;
+    return new Promise((resolvePaths, reject) => {
+        execFile(program ?? 'python3', [...args, '-c', PYTHON_PATHS], { cwd, env, timeout: 30_000, maxBuffer: 1024 * 1024 }, (err, stdout) => {
+            if (err !== null) {
+                reject(new Error(`could not ask the pack's Python where it reads from: ${err.message}`));
+                return;
+            }
+            try {
+                const line = stdout.trim().split('\n').pop() ?? '';
+                const parsed = JSON.parse(line);
+                resolvePaths({
+                    path: parsed.path,
+                    prefix: parsed.prefix,
+                    basePrefix: parsed.base,
+                    executable: parsed.exe,
+                });
+            }
+            catch (cause) {
+                reject(new Error(`the pack's Python answered something else: ${cause.message}`));
+            }
+        });
+    });
+}
+//# sourceMappingURL=policy.js.map

package/dist/dev/sandbox/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/dev/sandbox/policy.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEtF,OAAO,EAAiB,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAgC7E,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;CACjB,CAAC;AA6BF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACL,GAAG;QACH,IAAI;QACJ,SAAS;QACT,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1D,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAY,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,EAAE,GAAG,IAAI,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,4DAA4D;AAC5D,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,EAAE,OAA0B;IAClF,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAAE,SAAS;YAC7E,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAG1E,CAAC;QACF,OAAO;YACL,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YAC3C,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAA0B;IAMpD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpF,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE;gBACL,EAAE,CAAC,UAAU;gBACb,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACxE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,EAAE,CAAC,IAAI;gBACV,EAAE,CAAC,MAAM;gBACT,EAAE,CAAC,UAAU;aACd;SACF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO;YACL,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1B,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC;SAC1F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,UAA6B,EAC7B,GAAW,EACX,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,SAAS;QACzD,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,4DAA4D;AAC5D,SAAS,aAAa,CAAC,KAAwB;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,EAAE,GAAG,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAChB,QAAgB,EAChB,KAAa;IAEb,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;QAC9F,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACzF,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY,EAAE,IAAwB;IACnF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;aACT,KAAK,CAAC,SAAS,CAAC;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,KAAK;SACT,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,YAAY,GAChB,+HAA+H,CAAC;AAElI,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAC7B,MAAyB,EACzB,GAAW,EACX,GAAqC;IAErC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,QAAQ,CACN,OAAO,IAAI,SAAS,EACpB,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EAC7B,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EACrD,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK7B,CAAC;gBACF,YAAY,CAAC;oBACX,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,GAAG;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CACJ,IAAI,KAAK,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CACpF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/dev/sandbox/seatbelt.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxPolicy } from './policy.js';
+export declare function seatbeltProfile(policy: SandboxPolicy): string;
+//# sourceMappingURL=seatbelt.d.ts.map

package/dist/dev/sandbox/seatbelt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbelt.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/seatbelt.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmBjD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAqF7D"}

package/dist/dev/sandbox/seatbelt.js

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The pack service's Seatbelt profile on macOS (`sandbox-exec -f`).
+ * Seatbelt applies the last rule that matches, so the order is the
+ * policy:
+ *
+ * 1. allow by default (processes, the network, the system), but no
+ *    writes anywhere: a binary it replaced (`/opt/homebrew/bin/git`, an
+ *    app in `/Applications`) would run unsandboxed later;
+ * 2. close the home folder and the shared temp folders (keys, cloud
+ *    credentials, registry tokens, other projects, other tools' temp
+ *    files), then open the service's own temp folder and the `/dev`
+ *    nodes a runtime writes;
+ * 3. open what it runs: the app (read and write), the runtime and the
+ *    dependencies (read), and stat-only the folders above them (a
+ *    runtime resolves real paths through them);
+ * 4. close the secrets inside all of that again: `.env*`, `.kindgi`
+ *    (but the dev outputs it runs, and the indexer's output folder),
+ *    `.git`, `kindgi.env`, `pack.env`, `.kindgirc.json`, `.npmrc`,
+ *    `.pypirc`, `.netrc`; and keep the app's Kindgi configuration
+ *    unwritable (`kindgi dev` loads it, and it says how wide this is);
+ * 5. no UNIX sockets (the Docker socket, ssh-agent, a database's) but
+ *    DNS's (`mDNSResponder`) and `dev.sandbox.allowUnixSockets`;
+ * 6. no Apple Events, LaunchServices (`open -a Terminal <a file it
+ *    wrote>` would run it outside) or the keychain.
+ */
+import { dirname, join, parse } from 'node:path';
+import { devBundleMapPath, devDistDir, devIndexPath, devJvmDir, devStagedIndexPath, devStagedPackIndexPath, } from '../paths.js';
+/** A path as an SBPL string literal. */
+function str(path) {
+    return `"${path.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/** Every folder above `path`, up to `/`. */
+function ancestors(path) {
+    const found = [];
+    let at = path;
+    const root = parse(path).root;
+    while (at !== root) {
+        at = dirname(at);
+        found.push(at);
+    }
+    return found;
+}
+export function seatbeltProfile(policy) {
+    const { app, home, tmpDir } = policy;
+    const roots = policy.readRoots;
+    const statOnly = [
+        ...new Set([
+            ...[app, ...roots, tmpDir, ...policy.links.map((l) => l.path)].flatMap(ancestors),
+            join(app, '.kindgi'),
+            join(app, '.kindgi', 'dev'),
+        ]),
+    ];
+    const devOutputs = [
+        `(subpath ${str(devDistDir(app))})`,
+        `(subpath ${str(devJvmDir(app, 'java'))})`,
+        `(subpath ${str(devJvmDir(app, 'scala'))})`,
+        ...[
+            devIndexPath(app),
+            devStagedIndexPath(app),
+            devStagedPackIndexPath(app),
+            devBundleMapPath(app),
+        ].map((p) => `(literal ${str(p)})`),
+    ];
+    const writable = policy.writable.map((d) => `(subpath ${str(d)})`);
+    const readOnly = policy.readOnly.map((f) => `(literal ${str(f)})`);
+    const sockets = [
+        '(path-literal "/private/var/run/mDNSResponder")',
+        ...policy.allowUnixSockets.map((p) => `(path-literal ${str(p)})`),
+    ];
+    return [
+        '; The pack service under `kindgi dev`: written by kindgi dev at every start. Do not edit.',
+        '(version 1)',
+        '(allow default)',
+        '; No writes anywhere but where opened below.',
+        '(deny file-write*)',
+        '',
+        '; Closed: the home folder and the shared temp folders.',
+        `(deny file-read* file-write* (subpath ${str(home)}) (subpath "/private/var/folders") (subpath "/private/tmp"))`,
+        "; Its own temp folder; the JVM's perf data; Darwin's per-user caches.",
+        `(allow file-read* file-write* (subpath ${str(tmpDir)}))`,
+        '(allow file-read* file-write* (regex #"^/private/var/folders/[^/]+/[^/]+/T/hsperfdata_"))',
+        '(allow file-read* (regex #"^/private/var/folders/[^/]+/[^/]+/C/"))',
+        '; The /dev nodes a runtime writes.',
+        '(allow file-write* (literal "/dev/null") (literal "/dev/zero") (literal "/dev/tty") (literal "/dev/dtracehelper") (regex #"^/dev/fd/"))',
+        '',
+        '; Open: the folders above what it runs, to look up (not to list or read).',
+        `(allow file-read-metadata ${statOnly.map((p) => `(literal ${str(p)})`).join(' ')})`,
+        '; Open: the runtime and the dependencies (read), the app (read and write).',
+        ...(roots.length > 0
+            ? [`(allow file-read* ${roots.map((r) => `(subpath ${str(r)})`).join(' ')})`]
+            : []),
+        `(allow file-read* file-write* (subpath ${str(app)}))`,
+        ...(policy.links.length > 0
+            ? [
+                '; The links what it runs resolves through (a uv-managed Python), each link only.',
+                `(allow file-read* ${policy.links.map((l) => `(literal ${str(l.path)})`).join(' ')})`,
+            ]
+            : []),
+        '',
+        '; Closed again, wherever they are: secrets.',
+        '(deny file-read* file-write*',
+        '  (regex #"/\\.env[^/]*$")',
+        '  (regex #"/(kindgi\\.env|pack\\.env|\\.kindgirc\\.json|\\.npmrc|\\.pypirc|\\.netrc)$")',
+        '  (regex #"/\\.git(/|$)")',
+        '  (regex #"/\\.kindgi(/|$)"))',
+        '; but the dev outputs the service runs.',
+        `(allow file-read* ${devOutputs.join(' ')})`,
+        ...(writable.length > 0
+            ? [
+                "; and the indexer's output folder.",
+                `(allow file-read* file-write* ${writable.join(' ')})`,
+            ]
+            : []),
+        "; Kindgi's configuration: kindgi dev loads it, and it says how wide this sandbox is.",
+        `(deny file-write* ${readOnly.join(' ')})`,
+        '',
+        "; No UNIX sockets (the Docker socket, ssh-agent, a database's), but DNS's and the allowed ones.",
+        '(deny network-outbound (remote unix-socket))',
+        `(allow network-outbound ${sockets.map((s) => `(remote unix-socket ${s})`).join(' ')})`,
+        '',
+        '; No Apple Events, or LaunchServices (opening an app, a file with one).',
+        '(deny appleevent-send)',
+        '(deny mach-lookup (global-name "com.apple.coreservices.launchservicesd") (global-name-regex #"^com\\.apple\\.lsd\\.") (global-name "com.apple.coreservices.appleevents"))',
+        "; The keychain: securityd's file keychains, secd's (but trustd, which checks TLS certificates).",
+        '(deny mach-lookup (global-name "com.apple.SecurityServer") (global-name-regex #"^com\\.apple\\.securityd\\.") (global-name-regex #"^com\\.apple\\.security\\."))',
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=seatbelt.js.map