@kodax-ai/kodax 0.7.83 → 0.7.85

package/dist/chunks/chunk-CDWYKVZC.js

@@ -0,0 +1,482 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{k as Re}from"./chunk-ZVOXWLT6.js";import{Ia as U,Wa as ze,Ya as Ye,_a as oe,fb as ke,ib as Ae,t as E}from"./chunk-3E4OSFP2.js";import{a as i}from"./chunk-ONUPGMER.js";import{spawn as ir,spawnSync as Be}from"node:child_process";import{createHash as Fe,randomUUID as F}from"node:crypto";import{once as Ze}from"node:events";import{constants as $r,lstatSync as Tr,readdirSync as ar,realpathSync as me,statSync as he,writeSync as jt}from"node:fs";import{copyFile as cr,lstat as Cr,mkdir as W,readFile as z,realpath as ie,rename as Pr,rm as j,stat as we,writeFile as Y}from"node:fs/promises";import{createRequire as _r}from"node:module";import{createServer as Wr}from"node:net";import Z from"node:os";import o from"node:path";import Or from"node:readline";import{fileURLToPath as Qe,pathToFileURL as dr}from"node:url";import{DEFAULT_WINDOWS_PROXY_PORT_RANGE as Nr,SandboxManager as Ee,getSrtWinPath as Dr,getWindowsSandboxUserStatus as je,grantWindowsAcl as Lr,installWindowsSandbox as Ir,resolveSrtWin as Br,revokeWindowsAcl as lr}from"@anthropic-ai/sandbox-runtime";var V="0.0.65";function Fr(){let e=process.platform==="win32"?"windows-restricted-user":process.platform==="darwin"?"macos-seatbelt":process.platform==="linux"?"linux-bubblewrap":"unsupported";return{version:1,asrtVersion:V,platform:process.platform,backend:e,genericCommandExecution:!0,controls:["filesystem","network","environment","timeout","output"],ordinaryCallsTriggerSetup:!1,setupMayElevate:process.platform==="win32",unavailableBehavior:"structured-no-execution",permissionFallback:"normal-permission-policy"}}i(Fr,"sandboxRuntimeCapability");var Me=1048576,qe=12e4,Ke=_r(import.meta.url),ur=process.env.KODAX_BUNDLED==="true"?void 0:dr(Ke.resolve("@anthropic-ai/sandbox-runtime")).href,jr=new Set([".ssh",".aws",".azure",".gnupg",".kodax",".agents",".codex",".claude",".gemini",".direnv",".terraform.d"]),Mr=new Set([".env",".envrc",".pgpass",".npmrc",".pypirc","credentials","id_rsa","id_ed25519"]),qr=[".ssh",".aws",".azure",".gnupg",".kube",".docker",".kodax",".agents",".codex",".claude",".gemini",".direnv",".terraform.d",o.join(".cargo","credentials.toml"),o.join(".config","gcloud"),o.join(".config","gh"),o.join(".config","openai"),o.join(".config","anthropic"),".gitconfig",o.join(".config","git","config"),".terraformrc",o.join(".config","pypoetry","auth.toml"),".condarc",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",o.join(".config","fish","config.fish"),o.join(".config","fish","fish_variables"),".bash_history",".zsh_history",o.join(".m2","settings.xml"),o.join(".m2","settings-security.xml"),o.join(".gradle","gradle.properties"),o.join(".nuget","NuGet","NuGet.Config"),o.join(".pip","pip.conf"),o.join(".config","pip","pip.conf"),o.join(".cache","huggingface","token"),o.join(".huggingface","token"),o.join(".config","rclone","rclone.conf"),o.join(".local","share","keyrings"),o.join("Library","Keychains"),o.join("AppData","Roaming","Microsoft","Protect"),o.join("AppData","Roaming","Microsoft","Credentials"),o.join("AppData","Roaming","Microsoft","Vault"),o.join("AppData","Local","Microsoft","Credentials"),o.join("AppData","Local","Microsoft","Protect"),o.join("AppData","Local","Microsoft","Vault"),".password-store",".env",".envrc",".pgpass",".env.local",".env.development",".env.production",".env.test",".env.staging",".npmrc",".pypirc",".netrc",".git-credentials","credentials","credentials.json","application_default_credentials.json","id_rsa","id_dsa","id_ecdsa","id_ed25519"],Kr=["runtime","mcp-tokens","mcp-clients","integrations","sandbox-runtime","processes","learned","config.json","auth.json","trusted-project-rules.json",".env",".envrc",".pgpass",".npmrc",".pypirc",".netrc",".git-credentials","credentials","credentials.json","application_default_credentials.json"],Xr=String.raw`
+$ErrorActionPreference = 'Stop'
+$payload = [Console]::In.ReadToEnd() | ConvertFrom-Json
+$mutex = [System.Threading.Mutex]::new($false, 'Local\KodaXAsrtAclGuard-v1')
+$held = $false
+$missing = [System.Collections.Generic.List[string]]::new()
+function Test-KodaXAsrtAclRule($acl, $sidValue, $rights, $inheritance) {
+  foreach ($rule in $acl.Access) {
+    try {
+      $ruleSid = $rule.IdentityReference.Translate(
+        [System.Security.Principal.SecurityIdentifier]
+      ).Value
+    } catch {
+      continue
+    }
+    if (
+      $ruleSid -eq $sidValue -and
+      $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny -and
+      -not $rule.IsInherited -and
+      $rule.InheritanceFlags -eq $inheritance -and
+      $rule.PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None -and
+      (([int]$rule.FileSystemRights -band [int]$rights) -eq [int]$rights)
+    ) {
+      return $true
+    }
+  }
+  return $false
+}
+function Test-KodaXParentDeleteChildSafe($acl, $tokenSidValues) {
+  foreach ($rule in $acl.Access) {
+    try {
+      $ruleSid = $rule.IdentityReference.Translate(
+        [System.Security.Principal.SecurityIdentifier]
+      ).Value
+    } catch {
+      continue
+    }
+    if (
+      $tokenSidValues -contains $ruleSid -and
+      $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny -and
+      ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -eq 0 -and
+      (([int]$rule.FileSystemRights -band [int][System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) -ne 0)
+    ) {
+      return $true
+    }
+  }
+  foreach ($rule in $acl.Access) {
+    try {
+      $ruleSid = $rule.IdentityReference.Translate(
+        [System.Security.Principal.SecurityIdentifier]
+      ).Value
+    } catch {
+      continue
+    }
+    if (
+      $tokenSidValues -contains $ruleSid -and
+      $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and
+      ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -eq 0 -and
+      (([int]$rule.FileSystemRights -band [int][System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) -ne 0)
+    ) {
+      return $false
+    }
+  }
+  return $true
+}
+function Test-KodaXAsrtAclRuleReadsData($acl, $sidValue) {
+  foreach ($rule in $acl.Access) {
+    try {
+      $ruleSid = $rule.IdentityReference.Translate(
+        [System.Security.Principal.SecurityIdentifier]
+      ).Value
+    } catch {
+      continue
+    }
+    if (
+      $ruleSid -eq $sidValue -and
+      $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny -and
+      -not $rule.IsInherited -and
+      $rule.PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None -and
+      (([int]$rule.FileSystemRights -band ([int][System.Security.AccessControl.FileSystemRights]::ReadAndExecute -bor [int][System.Security.AccessControl.FileSystemRights]::Synchronize)) -ne 0)
+    ) {
+      return $true
+    }
+  }
+  return $false
+}
+function Add-KodaXAsrtAclRule($target, $sid, $rights, $inheritance, $ruleText) {
+  $acl = Get-Acl -LiteralPath $target
+  if (Test-KodaXAsrtAclRule $acl $sid.Value $rights $inheritance) {
+    return
+  }
+  $principal = '*' + $sid.Value
+  & "$env:SystemRoot\System32\icacls.exe" $target '/deny' "$($principal):$ruleText" | Out-Null
+  if ($LASTEXITCODE -ne 0) {
+    throw "icacls failed to install a KodaX sandbox guard on $target."
+  }
+}
+function Add-KodaXAsrtWriteAclRule($target, $sid, $rights, $inheritance) {
+  $acl = Get-Acl -LiteralPath $target
+  if (Test-KodaXAsrtAclRule $acl $sid.Value $rights $inheritance) {
+    return
+  }
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $sid,
+    $rights,
+    $inheritance,
+    [System.Security.AccessControl.PropagationFlags]::None,
+    [System.Security.AccessControl.AccessControlType]::Deny
+  )
+  [void]$acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $target -AclObject $acl
+}
+try {
+  try {
+    $held = $mutex.WaitOne(10000)
+  } catch [System.Threading.AbandonedMutexException] {
+    $held = $true
+  }
+  if (-not $held) {
+    throw 'Timed out waiting for the KodaX ASRT ACL guard mutex.'
+  }
+  $sid = [System.Security.Principal.SecurityIdentifier]::new([string]$payload.sid)
+  $tokenSidValues = @($payload.tokenSids | ForEach-Object { [string]$_ })
+  foreach ($entry in $payload.paths) {
+    $target = [System.IO.Path]::GetFullPath([string]$entry.path)
+    if (-not (Test-Path -LiteralPath $target)) {
+      throw "ACL guard target disappeared before it could be protected: $target"
+    }
+    $inheritance = if ([bool]$entry.directory) {
+      [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+        [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+    } else {
+      [System.Security.AccessControl.InheritanceFlags]::None
+    }
+    $writeRights = [System.Security.AccessControl.FileSystemRights]::Write -bor
+      [System.Security.AccessControl.FileSystemRights]::Delete -bor
+      [System.Security.AccessControl.FileSystemRights]::ChangePermissions -bor
+      [System.Security.AccessControl.FileSystemRights]::TakeOwnership
+    if ([bool]$entry.directory) {
+      $writeRights = $writeRights -bor [System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles
+    }
+    $targetRights = if ([string]$entry.mode -eq 'write') {
+      $writeRights
+    } else {
+      [System.Security.AccessControl.FileSystemRights]::FullControl
+    }
+    $parent = [System.IO.Path]::GetDirectoryName($target)
+    $targetAcl = Get-Acl -LiteralPath $target
+    $targetReady = Test-KodaXAsrtAclRule $targetAcl $sid.Value $targetRights $inheritance
+    $targetTooBroad = [string]$entry.mode -eq 'write' -and (Test-KodaXAsrtAclRuleReadsData $targetAcl $sid.Value)
+    if ($targetTooBroad) {
+      $targetReady = $false
+    }
+    $parentReady = -not $parent -or $parent -eq $target -or -not (Test-Path -LiteralPath $parent)
+    if (-not $parentReady) {
+      $parentAcl = Get-Acl -LiteralPath $parent
+      $parentReady = (Test-KodaXAsrtAclRule $parentAcl $sid.Value ([System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) ([System.Security.AccessControl.InheritanceFlags]::None)) -or (Test-KodaXParentDeleteChildSafe $parentAcl $tokenSidValues)
+    }
+    if (-not [bool]$payload.install) {
+      if (-not $targetReady -or -not $parentReady) {
+        [void]$missing.Add($target)
+      }
+      continue
+    }
+    if ($targetTooBroad) {
+      $principal = '*' + $sid.Value
+      & "$env:SystemRoot\System32\icacls.exe" $target '/remove:d' $principal | Out-Null
+      if ($LASTEXITCODE -ne 0) {
+        throw "icacls failed to remove an obsolete KodaX sandbox guard from $target."
+      }
+    }
+    if (-not $targetReady) {
+      if ([string]$entry.mode -eq 'write') {
+        Add-KodaXAsrtWriteAclRule $target $sid $targetRights $inheritance
+      } else {
+        $targetRule = if ([bool]$entry.directory) { '(OI)(CI)(F)' } else { '(F)' }
+        Add-KodaXAsrtAclRule $target $sid $targetRights $inheritance $targetRule
+      }
+    }
+    if (-not $parentReady) {
+      Add-KodaXAsrtAclRule $parent $sid ([System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) ([System.Security.AccessControl.InheritanceFlags]::None) '(DC)'
+    }
+  }
+  [Console]::Out.Write((@{ missing = @($missing) } | ConvertTo-Json -Compress))
+} finally {
+  if ($held) {
+    [void]$mutex.ReleaseMutex()
+  }
+  $mutex.Dispose()
+}
+`,_e=new Set,pr=new Set,er=JSON.stringify(Ye),$e=JSON.stringify(ze),Gr=String.raw`
+const { spawn } = require('node:child_process');
+const { writeSync } = require('node:fs');
+const input = JSON.parse(Buffer.from(process.argv[2], 'base64').toString('utf8'));
+const child = spawn(input.command, input.args, {
+  cwd: input.cwd,
+  env: process.env,
+  shell: false,
+  stdio: ['inherit', 'inherit', 'pipe'],
+  windowsHide: true,
+});
+const stop = (signal) => child.kill(signal);
+process.once('SIGINT', () => stop('SIGINT'));
+process.once('SIGTERM', () => stop('SIGTERM'));
+child.once('spawn', () => {
+  writeSync(2, input.targetStartedMarker);
+  child.stderr.pipe(process.stderr);
+});
+child.once('error', (error) => {
+  process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n');
+  process.exitCode = 1;
+});
+child.once('exit', (code, signal) => {
+  process.exitCode = signal ? 1 : code ?? 1;
+});
+`,Hr="eval(Buffer.from(process.argv[1],'base64').toString('utf8'))",Ur=JSON.stringify(Hr),Jr=Buffer.from(Gr,"utf8").toString("base64"),Vr=JSON.stringify(Jr),fr=String.raw`
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { readFile, rm, writeFile } from 'node:fs/promises';
+let SandboxManager;
+const request = JSON.parse(await readFile(process.argv[2], 'utf8'));
+await rm(process.argv[2], { force: true });
+const targetStartedMarker = request.targetStartedMarker
+  ?? '\u0000KODAX_ASRT_TARGET_STARTED:' + randomUUID() + '\u0000\n';
+const endpoints = new Set(request.endpoints.map((item) => item.host.toLowerCase() + ':' + item.port));
+const callback = request.allowAllNetwork === true
+  ? async () => true
+  : request.endpoints.length === 0
+    ? undefined
+    : async ({ host, port }) => endpoints.has(host.toLowerCase() + ':' + port);
+const withWindowsChildEnvironment = (argv, environment) => {
+  const separator = argv.lastIndexOf('--');
+  if (separator < 0) throw new Error('ASRT Windows wrapper omitted its child separator.');
+  const controlled = new Set();
+  for (let index = 0; index < separator - 1; index += 1) {
+    if (argv[index] !== '--env') continue;
+    const name = argv[index + 1].split('=', 1)[0];
+    if (name) controlled.add(name.toLowerCase());
+  }
+  const injected = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (value === undefined) continue;
+    if (!name || name.includes('=') || name.includes('\0') || value.includes('\0')) {
+      throw new Error('Invalid environment entry for ASRT Windows child.');
+    }
+    const normalized = name.toLowerCase();
+    if (controlled.has(normalized) && normalized !== 'path' && normalized !== 'pathext') continue;
+    injected.push('--env', name + '=' + value);
+  }
+  const result = [...argv.slice(0, separator), ...injected, ...argv.slice(separator)];
+  const estimate = result.reduce((size, value) => size + value.length + 3, 0);
+  if (estimate > 30000) throw new Error('ASRT Windows child environment exceeds the CreateProcess command-line limit.');
+  return result;
+};
+const writeObservation = async (observation) => {
+  if (typeof request.observationFile !== 'string') return;
+  await writeFile(request.observationFile, JSON.stringify(observation), { mode: 0o600 });
+};
+const waitForTarget = (target, observation) => {
+  const marker = Buffer.from(targetStartedMarker, 'utf8');
+  let pending = Buffer.alloc(0);
+  let diagnostic = Buffer.alloc(0);
+  let processError;
+  let targetStarted = false;
+  let observationWrite = Promise.resolve();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      void observationWrite.then(() => resolve(result), reject);
+    };
+    target.stderr.on('data', (chunk) => {
+      if (targetStarted) {
+        process.stderr.write(chunk);
+        return;
+      }
+      pending = Buffer.concat([pending, Buffer.from(chunk)]);
+      const markerOffset = pending.indexOf(marker);
+      if (markerOffset >= 0) {
+        targetStarted = true;
+        const suffix = pending.subarray(markerOffset + marker.length);
+        pending = Buffer.alloc(0);
+        diagnostic = Buffer.alloc(0);
+        observationWrite = writeObservation(observation).catch(() => undefined);
+        if (suffix.length > 0) process.stderr.write(suffix);
+        return;
+      }
+      const retained = Math.max(0, marker.length - 1);
+      if (pending.length > retained) {
+        diagnostic = Buffer.concat([
+          diagnostic,
+          pending.subarray(0, pending.length - retained),
+        ]).subarray(-65536);
+        pending = pending.subarray(pending.length - retained);
+      }
+    });
+    target.once('error', (error) => {
+      processError = error instanceof Error ? error.message : String(error);
+    });
+    target.once('close', (exitCode, signal) => {
+      const preTarget = Buffer.concat([diagnostic, pending]).toString('utf8').trim();
+      finish({
+        exitCode: signal ? 1 : exitCode ?? 1,
+        targetStarted,
+        diagnostic: preTarget || processError || undefined,
+      });
+    });
+  });
+};
+let child;
+let targetStarted = false;
+let normalFallbackAttempted = false;
+const runDirect = async () => {
+  const internalElectronNode = request.command === process.execPath && process.versions.electron !== undefined;
+  const directArgs = internalElectronNode
+    ? ['--import', ${er}, ...request.args]
+    : request.args;
+  const directEnv = internalElectronNode
+    ? { ...request.env, [${$e}]: '1' }
+    : request.env;
+  child = spawn(request.command, directArgs, {
+    cwd: request.cwd,
+    env: directEnv,
+    shell: false,
+    stdio: 'inherit',
+    windowsHide: true,
+  });
+  return await new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('exit', (exitCode, signal) => resolve(signal ? 1 : exitCode ?? 1));
+  });
+};
+try {
+  if (request.wrappedInvocation) {
+    const wrapped = request.wrappedInvocation;
+    child = spawn(wrapped.executable, wrapped.args, {
+      cwd: request.cwd,
+      env: wrapped.env,
+      shell: wrapped.shell,
+      stdio: ['inherit', 'inherit', 'pipe'],
+      windowsHide: true,
+    });
+    const result = await waitForTarget(child, {
+      version: 1,
+      state: 'applied',
+      backend: request.observationBackend ?? 'unsupported',
+      policyId: 'kodax-workspace-shell-v1',
+    });
+    targetStarted = result.targetStarted;
+    if (request.fallbackToNormalExecution === true && !targetStarted) {
+      await writeObservation({
+        version: 1,
+        state: 'fallback',
+        reason: 'backend_failed',
+        execution: 'normal_permission_policy',
+      }).catch(() => undefined);
+      normalFallbackAttempted = true;
+      process.exitCode = await runDirect();
+    } else {
+      if (!targetStarted && result.diagnostic) {
+        process.stderr.write(result.diagnostic + '\n');
+      }
+      process.exitCode = result.exitCode;
+    }
+  } else {
+  ({ SandboxManager } = await import(process.argv[1]));
+  const bootstrap = request.bootstrapCommand ?? 'node';
+  const bootstrapIsAbsolute = /^(?:[A-Za-z]:[\\/]|\\\\)/.test(bootstrap);
+  const bootstrapIsElectronNode = bootstrap === process.execPath
+    && process.versions.electron !== undefined;
+  const config = process.platform === 'win32' && bootstrapIsAbsolute
+    ? {
+        ...request.config,
+        filesystem: {
+          ...request.config.filesystem,
+          allowRead: [...new Set([...request.config.filesystem.allowRead, bootstrap])],
+        },
+      }
+    : request.config;
+  await SandboxManager.initialize(config, callback);
+  const quote = (value) => process.platform === 'win32'
+    ? '"' + value.replaceAll('"', '""') + '"'
+    : "'" + value.replaceAll("'", "'\"'\"'") + "'";
+  const internalElectronNode = request.command === process.execPath && process.versions.electron !== undefined;
+  const childArgs = internalElectronNode
+    ? ['--import', ${er}, ...request.args]
+    : request.args;
+  const command = [
+    quote(bootstrap),
+    '-e',
+    quote(${Ur}),
+    ${Vr},
+    Buffer.from(JSON.stringify({
+      command: request.command,
+      args: childArgs,
+      cwd: request.cwd,
+      targetStartedMarker,
+    }), 'utf8').toString('base64'),
+  ].join(' ');
+  if (process.platform === 'win32') {
+    const wrapped = await SandboxManager.wrapWithSandboxArgv(command, 'cmd', undefined, undefined, request.cwd);
+    const requestedEnv = internalElectronNode || bootstrapIsElectronNode
+      ? { ...request.env, [${$e}]: '1' }
+      : request.env;
+    const childArgv = withWindowsChildEnvironment(wrapped.argv, requestedEnv);
+    child = spawn(childArgv[0], childArgv.slice(1), {
+      cwd: request.cwd,
+      env: wrapped.env,
+      shell: false,
+      stdio: ['inherit', 'inherit', 'pipe'],
+      windowsHide: true,
+    });
+  } else {
+    const wrapped = await SandboxManager.wrapWithSandbox(command);
+    const childEnv = internalElectronNode || bootstrapIsElectronNode
+      ? { ...request.env, [${$e}]: '1' }
+      : request.env;
+    child = spawn(wrapped, {
+      cwd: request.cwd,
+      env: childEnv,
+      shell: true,
+      stdio: ['inherit', 'inherit', 'pipe'],
+    });
+  }
+  const stop = () => child?.kill('SIGTERM');
+  process.once('SIGINT', stop);
+  process.once('SIGTERM', stop);
+  const result = await waitForTarget(child, {
+    version: 1,
+    state: 'applied',
+    backend: request.observationBackend ?? 'unsupported',
+    policyId: 'kodax-workspace-shell-v1',
+  });
+  targetStarted = result.targetStarted;
+  try { SandboxManager.cleanupAfterCommand(); } catch {}
+  await SandboxManager.reset().catch(() => undefined);
+  if (request.fallbackToNormalExecution === true && !targetStarted) {
+    await writeObservation({
+      version: 1,
+      state: 'fallback',
+      reason: 'backend_failed',
+      execution: 'normal_permission_policy',
+    }).catch(() => undefined);
+    normalFallbackAttempted = true;
+    process.exitCode = await runDirect();
+  } else {
+    if (!targetStarted && result.diagnostic) {
+      process.stderr.write(result.diagnostic + '\n');
+    }
+    process.exitCode = result.exitCode;
+  }
+  }
+} catch (error) {
+  await SandboxManager?.reset().catch(() => undefined);
+  if (
+    request.fallbackToNormalExecution === true
+    && !targetStarted
+    && !normalFallbackAttempted
+  ) {
+    try {
+      await writeObservation({
+        version: 1,
+        state: 'fallback',
+        reason: 'backend_failed',
+        execution: 'normal_permission_policy',
+      }).catch(() => undefined);
+      normalFallbackAttempted = true;
+      process.exitCode = await runDirect();
+    } catch (fallbackError) {
+      process.stderr.write((fallbackError instanceof Error ? fallbackError.message : String(fallbackError)) + '\n');
+      process.exitCode = 1;
+    }
+  } else {
+    process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n');
+    process.exitCode = 1;
+  }
+}
+`,J,le=0,zr=3e4,se,ge,X;function ye(e){return e instanceof Error?e.message:String(e)}i(ye,"errorText");function We(e,...r){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&r.includes(e.code)}i(We,"isFileSystemError");async function rr(e){try{return await z(e)}catch(r){if(We(r,"ENOENT"))return;throw r}}i(rr,"readFileIfPresent");async function Yr(e,r){let t=await rr(r);if(t?.equals(e))return;if(t!==void 0)throw new Error(`Prepared Windows sandbox runner failed integrity verification: ${r}.`);let n=`${r}.${process.pid}.${F()}.tmp`;try{await Y(n,e,{flag:"wx",mode:448});try{await Pr(n,r)}catch(s){if(!(await rr(r))?.equals(e))throw s}}finally{await j(n,{force:!0})}}i(Yr,"installWindowsRunnerCopy");async function Oe(){if(se===void 0){let e=(async()=>{let r=await z(Dr()),t=Fe("sha256").update(r).digest("hex").slice(0,16),n=o.join(o.resolve(U()),"sandbox-runtime","runner",V,process.arch,t),s=o.join(n,"srt-win.exe");await W(n,{recursive:!0,mode:448}),await Yr(r,s);let a={path:s,directory:n,srtWin:Br({path:s})};return ge=a,a})();se=e,e.catch(()=>{se===e&&(se=void 0,ge=void 0)})}return se}i(Oe,"prepareWindowsSandboxRunner");function be(){if(process.platform!=="win32")throw new Error("A prepared Windows sandbox runner was requested on a non-Windows platform.");if(ge===void 0)throw new Error("Windows sandbox runner is not prepared; run the sandbox readiness check first.");return ge}i(be,"requirePreparedWindowsRunner");function Te(){X!==void 0&&(lr({sandboxUserSid:X.sandboxUserSid,holderPid:process.pid,srtWin:X.runner.srtWin}),X=void 0)}i(Te,"releasePreparedWindowsRunnerGrant");function Zr(e,r){if(!(X?.runner.path===e.path&&X.sandboxUserSid===r)){process.removeListener("exit",Te),Te();try{Lr({read:[e.directory,e.path],write:[],sandboxUserSid:r,holderPid:process.pid,srtWin:e.srtWin})}catch(t){try{lr({sandboxUserSid:r,holderPid:process.pid,srtWin:e.srtWin})}catch(n){throw new AggregateError([t,n],"Windows sandbox runner ACL grant failed and its partial grant could not be revoked.")}throw t}X={runner:e,sandboxUserSid:r},process.once("exit",Te)}}i(Zr,"retainPreparedWindowsRunnerGrant");async function Qr(){let[e,r]=Nr;for(let t=0;t<5;t+=1){let n=Wr();n.listen(0,"127.0.0.1"),await Ze(n,"listening");let s=n.address();if(typeof s=="object"&&s!==null&&(s.port<e||s.port>r))return{server:n,target:`127.0.0.1:${s.port}`};let a=Ze(n,"close");n.close(),await a}throw new Error(`[wfp_probe_bind_failed] Could not bind a loopback listener outside the Windows sandbox proxy range [${e},${r}].`)}i(Qr,"bindWindowsWfpProbe");function tr(e){return/0x80070005|access (?:is )?denied|拒绝访问/i.test(e)?"runner_launch_access_denied":/seclogon|secondary logon/i.test(e)?"secondary_logon_unavailable":"wfp_probe_failed"}i(tr,"windowsRunnerFailureCode");function et(e){return We(e,"ETIMEDOUT")?"wfp_probe_timeout":We(e,"EACCES","EPERM")?"runner_launch_access_denied":"runner_spawn_failed"}i(et,"windowsRunnerSpawnFailureCode");async function rt(e){let{server:r,target:t}=await Qr();try{let n=Be(e.srtWin.exe,[...e.srtWin.prependArgs,"wfp","verify","--target",t],{cwd:e.directory,encoding:"utf8",timeout:3e4,windowsHide:!0}),s=(n.stderr??"").trim();if(n.error)throw new Error(`[${et(n.error)}] Windows sandbox runner failed to start: ${n.error.message}`);let a;try{a=JSON.parse((n.stdout??"").trim())}catch{let d=n.status===null?"wfp_probe_timeout":tr(s);throw new Error(`[${d}] Windows sandbox WFP probe exited ${String(n.status)}${n.signal?` (signal ${n.signal})`:""} with unparseable output; stderr: ${s||"(empty)"}.`)}if(n.status===3)throw new Error(`[wfp_fence_inactive] Direct outbound access to ${String(a.target??t)} succeeded. Run "kodax sandbox setup" to reinstall the Windows network policy.`);if(n.status!==0||a.egress_probe!=="blocked")throw new Error(`[${tr(s)}] Windows sandbox WFP probe to ${String(a.target??t)} was ${String(a.egress_probe)} (exit ${String(n.status)}): ${s||"(empty stderr)"}.`)}finally{r.close()}}i(rt,"verifyPreparedWindowsWfp");function mr(e){let r=[];return e.provisioned||r.push("Windows sandbox account does not exist."),e.sid||r.push("Windows sandbox account SID is unavailable."),(!e.groupExists||!e.groupSid)&&r.push("Windows sandbox local group is unavailable."),e.inBuiltinUsers||r.push("Windows sandbox account is not in the built-in Users group."),e.inSandboxGroup||r.push("Windows sandbox account is not in the sandbox-runtime-users group."),e.hiddenFromLogon||r.push("Windows sandbox account is not hidden from interactive logon."),e.credPresent||r.push("Windows sandbox account credential is unavailable."),r}i(mr,"windowsSandboxAccountDiagnostics");function tt(e){let r=JSON.parse(e);if(typeof r!="object"||r===null)return;let t=r;if(t.version===1&&(t.state==="applied"&&t.policyId==="kodax-workspace-shell-v1"&&(t.backend==="windows-restricted-user"||t.backend==="macos-seatbelt"||t.backend==="linux-bubblewrap"||t.backend==="unsupported")||t.state==="fallback"&&t.reason==="backend_failed"&&t.execution==="normal_permission_policy"))return t}i(tt,"parseBrokerObservation");function ve(){return process.env.KODAX_A2A_NODE??(process.env.KODAX_BUNDLED==="true"?"node":process.execPath)}i(ve,"sandboxJavaScriptCommand");async function B(e={}){if(e.refresh||J===void 0||Date.now()>=le){let r=nt();J=r,le=Number.POSITIVE_INFINITY,r.then(t=>{J===r&&(le=t.ready?Number.POSITIVE_INFINITY:Date.now()+zr)},()=>{J===r&&(J=void 0,le=0)})}return J}i(B,"doctorSandboxRuntime");async function nt(){let e=[];Ee.isSupportedPlatform()||e.push(`Unsupported platform: ${process.platform}.`);let r=Ee.checkDependencies();e.push(...r.warnings,...r.errors);let t=r.errors.length>0;if(process.env.KODAX_BUNDLED!=="true")try{let d=JSON.parse(await z(Ke.resolve("@anthropic-ai/sandbox-runtime/package.json"),"utf8"));d.version!==V&&(t=!0,e.push(`ASRT package version mismatch: expected ${V}, found ${String(d.version)}.`))}catch(d){t=!0,e.push(`ASRT package provenance check failed: ${ye(d)}`)}let n=ve(),s=oe({args:["--version"],env:Q(),isElectron:n===process.execPath&&process.versions.electron!==void 0}),a=Be(n,s.args,{env:s.env,shell:!1,encoding:"utf8",windowsHide:!0,timeout:5e3});if(a.status!==0){t=!0;let d=a.error?.message??(a.stderr.trim()||n);e.push(`JavaScript Skill interpreter is unavailable: ${d}.`)}if(process.platform==="win32")try{let d=await Oe(),c=je({srtWin:d.srtWin}),u=mr(c);if(u.length>0||!c.sid)t=!0,e.push(...u);else{Zr(d,c.sid);let l=vr(Se(),c.sid,c.groupSid,!1,"read");l.length>0&&(t=!0,e.push(`[acl_guards_missing] ${l.length} persistent Windows sandbox ACL guard(s) are missing. Run "kodax sandbox setup" once to install them outside the startup path.`)),await rt(d)}}catch(d){t=!0,e.push(ye(d))}return{ready:Ee.isSupportedPlatform()&&!t,platform:process.platform,version:V,diagnostics:e,setupRequired:t}}i(nt,"inspectSandboxRuntime");async function ot(){if(process.platform!=="win32")return B({refresh:!0});let e=await B({refresh:!0});if(e.ready)return e;let r=!1;try{let n=await Oe(),s=je({srtWin:n.srtWin});r=mr(s).length===0&&s.sid!==void 0}catch{r=!1}if(r){De(Se(),"read");let n=await B({refresh:!0});if(n.ready)return n}if(Ir().cancelled)throw new Error("Sandbox setup was cancelled.");return await Oe(),De(Se(),"read"),B({refresh:!0})}i(ot,"setupSandboxRuntime");function ue(e){return e.ready?[`KodaX sandbox is active (${e.platform}, ASRT ${e.version}).`]:e.platform==="win32"?['Run "kodax sandbox setup". Windows will show a UAC prompt for the one-time sandbox account and network policy setup.',"The terminal itself does not need to be started as Administrator; approve the UAC prompt when it appears."]:e.platform==="darwin"?['KodaX uses macOS Seatbelt through sandbox-exec. Install the missing dependency, then rerun "kodax sandbox doctor".',"Homebrew: brew install ripgrep"]:e.platform==="linux"?['KodaX uses bubblewrap on Linux. Install bubblewrap, socat, and ripgrep, then rerun "kodax sandbox doctor".',"Debian/Ubuntu: sudo apt install bubblewrap socat ripgrep","Fedora/RHEL: sudo dnf install bubblewrap socat ripgrep","Arch Linux: sudo pacman -S bubblewrap socat ripgrep"]:[`KodaX sandbox is not supported on ${e.platform}.`]}i(ue,"sandboxSetupGuidance");async function tn(e={}){let r=await B({refresh:!0});if(r.ready)return{status:"ready",attempted:!1,doctor:r,guidance:ue(r)};if(r.platform!=="win32"||e.allowElevation===!1)return{status:"unavailable",attempted:!1,doctor:r,guidance:ue(r)};try{let t=await ot();return{status:t.ready?"ready":"unavailable",attempted:!0,doctor:t,guidance:ue(t)}}catch(t){let n=await B({refresh:!0}),s=ye(t);return{status:/cancelled/i.test(s)?"cancelled":"unavailable",attempted:!0,doctor:n,guidance:ue(n),error:s}}}i(tn,"prepareSandboxRuntimeForSetup");function M(e,r){let t=e.replaceAll("\\","/").replace(/^\.\//,"");if(!t||o.posix.isAbsolute(t)||t.split("/").includes(".."))throw new Error(`${r} must be a safe relative path.`);return t}i(M,"canonicalRelative");function _(e,r){let t=o.relative(e,r);return t===""||!t.startsWith("..")&&!o.isAbsolute(t)}i(_,"isInside");function wr(e){let r=e.split(o.sep).map(t=>t.toLowerCase());return r.some(t=>jr.has(t))||r.some(t=>Mr.has(t)||t.startsWith(".env."))}i(wr,"isSensitiveRelative");async function st(e,r){await W(r,{recursive:!0,mode:448});let t=[...(e.scripts??[]).map(n=>({folder:"scripts",file:n})),...(e.references??[]).map(n=>({folder:"references",file:n})),...(e.assets??[]).map(n=>({folder:"assets",file:n})),...(e.templates??[]).map(n=>({folder:"templates",file:n})),...(e.resources??[]).map(n=>({folder:"resources",file:n}))];await Y(o.join(r,"SKILL.md"),await z(e.skillFilePath),{mode:384});for(let{folder:n,file:s}of t){let a=M(s.relativePath,`Skill ${e.name} support file`),d=o.join(r,n,...a.split("/"));await W(o.dirname(d),{recursive:!0,mode:448}),await Y(d,await z(s.path),{mode:384})}}i(st,"copySkillSnapshot");async function it(e,r){let t=new Map;for(let[n,s]of Object.entries(e.admissions)){let a=await e.registry.loadFull(n),d=new Map((a.scripts??[]).map(u=>[`scripts/${M(u.relativePath,`Skill ${n} script`)}`,u])),c=o.join(r,n.replace(/[^A-Za-z0-9._-]/g,"_"));await st(a,c);for(let u of s){let l=M(u,`toolPolicy.skillScripts.${n}`);if(!d.has(l))throw new Error(`Skill "${n}" has no script "${l}".`);t.set(`${n}\0${l}`,{skill:n,relativePath:l,snapshotPath:o.join(c,...l.split("/"))})}}return t}i(it,"snapshotAdmissions");function at(e){return e.mode==="deny"?[]:e.origins.map(r=>{let t=new URL(r);return{host:t.hostname.toLowerCase(),port:t.port?Number(t.port):t.protocol==="https:"?443:80}})}i(at,"networkEndpoints");function Q(){let e=["PATH","Path","PATHEXT","SystemRoot","COMSPEC","TEMP","TMP","HOME","USERPROFILE","LOCALAPPDATA","LANG"],r={NO_COLOR:"1"};for(let t of e)process.env[t]!==void 0&&(r[t]=process.env[t]);for(let[t,n]of Object.entries(process.env))t.startsWith("LC_")&&n!==void 0&&(r[t]=n);return r}i(Q,"sanitizedEnvironment");function ct(e){let r=o.extname(e).toLowerCase();if([".js",".mjs",".cjs"].includes(r))return{command:process.env.KODAX_A2A_NODE??(process.env.KODAX_BUNDLED==="true"?"node":process.execPath),args:[e]};if(r===".py")return{command:process.env.KODAX_A2A_PYTHON??(process.platform==="win32"?"python.exe":"python3"),args:[e]};if(r===".ps1")return{command:process.env.KODAX_A2A_POWERSHELL??(process.platform==="win32"?o.join(process.env.SystemRoot??"C:\\Windows","System32","WindowsPowerShell","v1.0","powershell.exe"):"pwsh"),args:["-NoProfile","-NonInteractive","-File",e]};if(r===".sh"&&process.platform!=="win32")return{command:"/bin/sh",args:[e]};if([".cmd",".bat"].includes(r)&&process.platform==="win32")return{command:process.env.COMSPEC??o.join(process.env.SystemRoot??"C:\\Windows","System32","cmd.exe"),args:["/d","/s","/c",e]};throw new Error(`Unsupported admitted Skill script type: ${r||"<none>"}.`)}i(ct,"interpreterFor");var nr=250,dt=1500;async function lt(e,r,t=qe,n=Me){let s=[],a=[],d=0,c,u=i(()=>{},"rejectStopped"),l,p=new Promise((y,k)=>{u=k}),w=i(y=>{if(c!==void 0)return;c=y;let k=!1,v=i(()=>{k||(k=!0,l!==void 0&&clearTimeout(l),u(y))},"finish");l=setTimeout(()=>{try{e.kill("SIGKILL")}finally{v()}},dt),Ae(e,{forceMs:nr,taskkillMs:nr}).then(v,v)},"requestStop"),m=i((y,k)=>{d+=k.byteLength,d>n?w(new Error(`Sandboxed command output exceeded ${n} bytes.`)):y.push(k)},"append");e.stdout?.on("data",y=>{m(s,y)}),e.stderr?.on("data",y=>{m(a,y)});let S=setTimeout(()=>{w(new Error(`Sandboxed command exceeded its ${t} ms timeout.`))},t),g=i(()=>{let y=r?.reason;w(y instanceof Error?y:new Error("Sandboxed command was cancelled."))},"abort");r?.addEventListener("abort",g,{once:!0}),r?.aborted&&g();try{let y=new Promise((v,A)=>{e.once("error",A),e.once("close",q=>v(q??1))}),k=await Promise.race([y,p]);if(c!==void 0)throw c;return{exitCode:k,stdout:Buffer.concat(s).toString("utf8"),stderr:Buffer.concat(a).toString("utf8")}}finally{clearTimeout(S),l!==void 0&&clearTimeout(l),r?.removeEventListener("abort",g)}}i(lt,"collectProcess");async function gr(e,r,t=qe,n=Me){let s=process.platform==="win32"?await Ue():Z.tmpdir(),a=o.join(s,`kodax-asrt-${process.pid}-${F()}.json`),d=process.platform==="win32"?He(e.config):{...e.config,filesystem:{...e.config.filesystem,denyRead:[...e.config.filesystem.denyRead,a]}},c={...e,bootstrapCommand:e.bootstrapCommand??ve(),config:d};await Y(a,JSON.stringify(c),{mode:384});try{let u=process.env.KODAX_BUNDLED==="true"?["__asrt-broker",a]:["--input-type=module","-e",fr,ur,a],l=oe({args:u,env:Q(),isElectron:process.versions.electron!==void 0}),p=ir(process.execPath,l.args,{cwd:process.platform==="win32"?be().directory:void 0,env:l.env,shell:!1,stdio:["ignore","pipe","pipe"],windowsHide:!0,detached:process.platform!=="win32"});return ke(p),await lt(p,r,t,n)}finally{await j(a,{force:!0})}}i(gr,"runBrokerResult");async function ut(e,r){let t=await gr(e,r);if(t.exitCode!==0){let n=t.stderr.trim()||t.stdout.trim();throw new Error(`Sandboxed Skill script failed (${t.exitCode}): ${n}`)}return t.stdout}i(ut,"runBroker");async function pt(e,r){let t=await ie(e),n=o.resolve(e,M(r,"Skill script input")),s=await ie(n);if(!_(t,s)||wr(o.relative(t,s)))throw new Error("Skill script input is outside the permitted workspace surface.");if(!(await we(s)).isFile())throw new Error("Skill script inputs must be files.");return s}i(pt,"workspaceSource");async function ft(e,r){let t=await ie(e),n=o.resolve(e,M(r,"Skill script output target"));if(!_(o.resolve(e),n)||wr(o.relative(o.resolve(e),n)))throw new Error("Skill script output target is outside the permitted workspace surface.");if(await W(o.dirname(n),{recursive:!0}),!_(t,await ie(o.dirname(n))))throw new Error("Skill script output target escapes through a symlink.");try{throw await we(n),new Error("Skill script output target already exists.")}catch(s){if(s.code!=="ENOENT")throw s}return n}i(ft,"workspaceTarget");async function mt(e,r,t,n){if(t.inputs.length>0&&n==="none")throw new Error("Skill script inputs require workspace read access.");for(let s of t.inputs){let a=await pt(e,s.path),d=M(s.as??o.basename(a),"Skill script staged input"),c=o.resolve(r,"inputs",...d.split("/"));if(!_(o.join(r,"inputs"),c))throw new Error("Skill script staged input escapes staging.");await W(o.dirname(c),{recursive:!0,mode:448}),await cr(a,c)}}i(mt,"stageInputFiles");async function wt(e,r,t,n,s){if(t.outputs.length>0&&n!=="write")throw new Error("Skill script outputs require workspace write access.");let a=[];for(let d of t.outputs){let c=M(d.path,"Skill script staged output"),u=o.resolve(r,"outputs",...c.split("/")),l=await ie(u);if(!_(o.join(r,"outputs"),l)||(await Cr(u)).isSymbolicLink()||!(await we(u)).isFile())throw new Error(`Skill script did not produce output "${c}".`);let p=await ft(e,d.target);if(s!==void 0&&yr(e,!0)+(await we(u)).size>s)throw new Error("Skill script outputs would exceed the remote workspace byte quota.");await cr(u,p,$r.COPYFILE_EXCL),a.push(o.relative(e,p))}return a}i(wt,"promoteOutputs");function yr(e,r=!1){let t=0;for(let n of ar(e,{withFileTypes:!0})){if(r&&n.name===".kodax-a2a-script"||n.isSymbolicLink())continue;let s=o.join(e,n.name);n.isDirectory()?t+=yr(s):n.isFile()&&(t+=he(s).size)}return t}i(yr,"directorySize");function Xe(e){if(process.platform!=="win32")return e;let r=be();return{...e,windows:{...e.windows,srtWin:{path:r.path}},filesystem:{...e.filesystem,allowRead:[...new Set([...e.filesystem.allowRead,r.directory])],denyWrite:process.platform==="win32"?e.filesystem.denyWrite:[...new Set([...e.filesystem.denyWrite??[],r.directory])]}}}i(Xe,"withPreparedWindowsRunner");function gt(e,r,t,n){let s=Z.homedir(),a=process.platform==="win32"?Se():[s],d=o.isAbsolute(n)?[n]:[];return Xe({network:{allowedDomains:[],deniedDomains:[],strictAllowlist:t.length===0,allowUnixSockets:[],allowAllUnixSockets:!1,allowLocalBinding:!1},filesystem:{denyRead:a,allowRead:[e,r,process.execPath,...d],allowWrite:[e],denyWrite:a}})}i(gt,"sandboxConfig");function yt(){let e=[Z.tmpdir(),process.env.TEMP,process.env.TMP,process.env.TMPDIR,...process.platform==="win32"?[]:["/tmp","/var/tmp"]];return[...new Set(e.filter(r=>typeof r=="string"&&o.isAbsolute(r)).map(r=>o.resolve(r)))]}i(yt,"canonicalTempDirectories");function Sr(e){return[o.join(e,".git","config"),o.join(e,".git","hooks")].filter(t=>{try{return he(t),!0}catch{return!1}})}i(Sr,"existingWorkspaceDenyWrites");function hr(e,r,t){let n=qr.map(a=>o.resolve(e,a)).filter(a=>o.relative(a,r)!==""),s=process.platform==="win32"?[o.resolve(r)]:[o.resolve(t),...Kr.map(a=>o.resolve(r,a))];return[...new Set([...s,...n])]}i(hr,"workspaceShellSensitiveReadDenies");function Ge(e){let r=[...new Set(e.map(n=>o.resolve(n)))].filter(n=>he(n,{throwIfNoEntry:!1})!==void 0).sort((n,s)=>n.length-s.length),t=[];for(let n of r)t.some(s=>_(s,n))||t.push(n);return t}i(Ge,"existingMinimalWindowsAclGuardRoots");function br(e){return o.resolve(e).toLowerCase()}i(br,"windowsAclGuardKey");function Ne(e,r){let t=br(e),n=r==="read"?_e:new Set([..._e,...pr]);for(let s of n)if(t===s||t.startsWith(s.endsWith(o.sep)?s:`${s}${o.sep}`))return!0;return!1}i(Ne,"windowsAclGuardCovers");function Se(){let e=o.resolve(Z.homedir()),r=o.resolve(U());return Ge(hr(e,r,o.join(r,"sandbox-runtime")))}i(Se,"windowsPersistentAclGuardRoots");function vr(e,r,t,n,s){let a=Ge(e);if(a.length===0)return[];let d=JSON.stringify({sid:r,tokenSids:[r,t,"S-1-1-0","S-1-5-11","S-1-5-32-545"].filter(p=>p!==void 0),install:n,paths:a.map(p=>({path:p,directory:he(p).isDirectory(),mode:s}))}),c=o.join(process.env.SystemRoot??"C:\\Windows","System32","WindowsPowerShell","v1.0","powershell.exe"),u=Be(c,["-NoProfile","-NonInteractive","-EncodedCommand",Buffer.from(Xr,"utf16le").toString("base64")],{input:d,encoding:"utf8",timeout:n&&s==="read"?15*6e4:n?15e3:5e3,windowsHide:!0});if(u.error||u.status!==0){let p=(u.error?.message||u.stderr||u.stdout||"no diagnostics").trim().slice(-4096);throw new Error(`Windows sandbox ACL guard failed: ${p}`)}let l;try{let p=JSON.parse(u.stdout.trim());l=Array.isArray(p.missing)?p.missing.filter(w=>typeof w=="string"):[]}catch(p){throw new Error(`Windows sandbox ACL guard returned invalid output: ${ye(p)}`)}if(l.length===0){let p=s==="read"?_e:pr;for(let w of a)p.add(br(w))}return l}i(vr,"runWindowsAclGuard");function De(e,r){if(process.platform!=="win32"||e.length===0)return;let t=e.filter(d=>!Ne(d,r));if(t.length===0)return;let n=be(),s=je({srtWin:n.srtWin});if(!s.sid)throw new Error("Windows sandbox account SID is unavailable for ACL guards.");if(vr(t,s.sid,s.groupSid,!0,r).length>0)throw new Error("Windows sandbox ACL guards were not installed completely.")}i(De,"installWindowsAclGuards");function He(e){return process.platform!=="win32"?e:{...e,filesystem:{...e.filesystem,denyRead:e.filesystem.denyRead.filter(r=>!Ne(r,"read")),denyWrite:e.filesystem.denyWrite?.filter(r=>!Ne(r,"write"))}}}i(He,"withoutWindowsAsrtDenyPropagation");function St(e,r){let t;try{t=me.native(r)}catch{return[]}let n=[];for(let s of e){let a;try{a=me.native(s)}catch{continue}if(!_(a,t))n.push(s);else if(a!==t){let d=o.relative(a,t).split(o.sep),c=a;try{for(let u of d){for(let l of ar(c,{withFileTypes:!0}))l.name!==u&&n.push(o.join(c,l.name));c=o.join(c,u)}}catch{}}}return process.platform!=="win32"&&n.push(r),[...new Set(n)]}i(St,"workspaceShellWriteRoots");function ht(e){let r=process.platform==="win32"?o.resolve(e).toLowerCase():o.resolve(e);return o.join(Z.tmpdir(),"kodax-sandbox",Fe("sha256").update(r).digest("hex").slice(0,16))}i(ht,"workspaceShellTempRoot");function bt(e){return o.join(ht(e),`${process.pid}-${F()}`)}i(bt,"createWorkspaceShellTempDirectory");function vt(e){return process.platform==="win32"?e===void 0?[]:[e]:yt()}i(vt,"workspaceShellTempWriteRoots");function xt(e,r,t){try{let n=me.native(r),s=o.resolve(r),a=o.resolve(e);if(!_(s,a)||a===s)return;for(;a!==s;)try{let d=me.native(a);if(d===n||!_(n,d))return;let c=o.relative(n,d).split(o.sep)[0]?.toLowerCase();return c==="sandbox-runtime"||t&&["runtime","processes","learned"].includes(c??"")?void 0:d}catch(d){if(!t||d.code!=="ENOENT")return;try{Tr(a);return}catch(u){if(u.code!=="ENOENT")return}let c=o.dirname(a);if(c===a)return;a=c}return}catch{return}}i(xt,"windowsAgentHomeAccessRoot");function xr(e,r){if(!r)return{read:[],write:[]};let t=i((n,s)=>[...new Set(n.flatMap(a=>{let d=xt(a,e,s);return d?[d]:[]}))],"roots");return{read:t(r.read,!1),write:t(r.write,!0),...r.ephemeral===!0?{ephemeral:!0}:{}}}i(xr,"windowsAgentHomeAccessRoots");function kr(e,r,t){let n=o.resolve(U()),s=o.join(n,"sandbox-runtime"),a=o.resolve(Z.homedir()),d=hr(a,n,s),c=process.platform==="win32"?Ge(d):d.filter(m=>m!==n),u=(process.env.PATH??process.env.Path??"").split(o.delimiter).map(m=>m.replace(/^"|"$/g,"")).filter(m=>o.isAbsolute(m)).map(m=>o.resolve(m)).filter(m=>{let S=o.relative(a,m);return S!==""&&!S.startsWith("..")&&!o.isAbsolute(S)&&!c.some(g=>_(g,m))}),l=ve(),p=process.platform==="win32"?xr(n,t):{read:[],write:[]},w=St([e,...vt(r),...p.write],n);return Xe({network:{allowedDomains:[],deniedDomains:[],strictAllowlist:!1,allowUnixSockets:[],allowAllUnixSockets:!1,allowLocalBinding:!1},filesystem:{denyRead:c,allowRead:[...new Set([...u,...p.read,...o.isAbsolute(l)?[l]:[]])],allowWrite:w,denyWrite:[s,o.join(n,"runtime"),o.join(n,"processes"),o.join(n,"learned"),...Sr(e)]}})}i(kr,"workspaceShellSandboxConfig");function kt(e,r,t){let n=kr(e,r,t);return process.platform!=="win32"?n:Ar(n)}i(kt,"workspaceShellSessionSandboxConfig");function Ar(e){let r=e.filesystem.allowWrite;return{...e,filesystem:{...e.filesystem,denyRead:e.filesystem.denyRead,denyWrite:e.filesystem.denyWrite.filter(t=>r.some(n=>_(n,t)))}}}i(Ar,"boundedWindowsWorkspaceDenies");function At(e,r,t){let n=kr(e,r,t);return process.platform==="win32"?Ar(n):n}i(At,"workspaceShellCommandSandboxConfig");function pe(e,r){return[...new Set((e??[]).map(t=>o.resolve(r,t)))]}i(pe,"normalizedSandboxPaths");function Rt(e){return e.mode!=="allowlist"?[]:e.origins.map(r=>{let t=new URL(r);if(t.protocol!=="http:"&&t.protocol!=="https:"||t.username||t.password||t.pathname!=="/"||t.search||t.hash)throw new Error(`Sandbox network origin must be an HTTP(S) origin: ${r}`);return{host:t.hostname.toLowerCase(),port:t.port?Number(t.port):t.protocol==="https:"?443:80}})}i(Rt,"sdkSandboxEndpoints");async function nn(e){if(!e.command.trim())throw new Error("Sandbox command must not be empty.");if(e.timeoutMs!==void 0&&(!Number.isFinite(e.timeoutMs)||e.timeoutMs<=0))throw new Error("Sandbox timeoutMs must be a positive finite number.");if(e.maxOutputBytes!==void 0&&(!Number.isSafeInteger(e.maxOutputBytes)||e.maxOutputBytes<=0))throw new Error("Sandbox maxOutputBytes must be a positive safe integer.");let r=o.resolve(e.cwd),t=e.network??{mode:"deny"},n=Rt(t),s=await B();if(!s.ready)return{status:"unavailable",sandboxed:!1,doctor:s};let a={...e.inheritEnvironment===!0?process.env:Q(),...e.env},d={config:Xe({network:{allowedDomains:[],deniedDomains:[],strictAllowlist:t.mode==="deny",allowUnixSockets:[],allowAllUnixSockets:!1,allowLocalBinding:!1},filesystem:{allowRead:pe(e.filesystem.allowRead,r),allowWrite:pe(e.filesystem.allowWrite,r),denyRead:pe(e.filesystem.denyRead,r),denyWrite:pe(e.filesystem.denyWrite,r)}}),command:e.command,args:e.args??[],cwd:r,env:a,endpoints:n,allowAllNetwork:t.mode==="allow"},c=await gr(d,e.signal,e.timeoutMs??qe,e.maxOutputBytes??Me);return{status:"completed",sandboxed:!0,exitCode:c.exitCode,stdout:c.stdout,stderr:c.stderr}}i(nn,"runKodaXSandboxed");var Et=5*6e4,$t=3e4,Tt=3e4,Ce=1500,Ct=15e3,Pt=8,$=new Map,Le=!1;async function _t(){let e=[...$.values()];$.clear();for(let r of e)try{await(await r).close()}catch(t){E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox shutdown could not confirm ACL reset.",detail:t})}}i(_t,"closeCachedWorkspaceSessions");var Wt=i(()=>{Le=!1,_t()},"closeWorkspaceSessionsBeforeExit");function Ot(){Le||(Le=!0,process.once("beforeExit",Wt))}i(Ot,"registerWorkspaceSessionBeforeExit");function Rr(){let e=new Error("ASRT workspace session preparation timed out.");return e.name="TimeoutError",e}i(Rr,"workspacePreparationTimeoutError");function Ie(e,r){if(e?.aborted)throw new DOMException("Operation aborted","AbortError");if(r!==void 0&&Date.now()>=r)throw Rr()}i(Ie,"throwIfWorkspacePreparationStopped");function fe(e,r,t){return Ie(r,t),r===void 0&&t===void 0?e:new Promise((n,s)=>{let a=!1,d,c=i(l=>{a||(a=!0,d&&clearTimeout(d),r?.removeEventListener("abort",u),l())},"finish"),u=i(()=>{c(()=>s(new DOMException("Operation aborted","AbortError")))},"onAbort");r?.addEventListener("abort",u,{once:!0}),t!==void 0&&(d=setTimeout(()=>{c(()=>s(Rr()))},Math.max(0,t-Date.now())),d.unref()),e.then(l=>c(()=>n(l)),l=>c(()=>s(l)))})}i(fe,"waitForWorkspacePreparation");async function Ue(){let e=o.join(U(),"sandbox-runtime");return await W(e,{recursive:!0,mode:448}),e}i(Ue,"sandboxControlDirectory");function Nt(e){if(process.env.KODAX_BUNDLED==="true")return["__asrt-workspace-session",e];if(import.meta.url.endsWith(".ts"))return["--import",dr(Ke.resolve("tsx")).href,Qe(new URL("./sandbox-workspace-session-entry.ts",import.meta.url)),e];let r=o.dirname(Qe(import.meta.url)),t=o.basename(r)==="chunks"?o.dirname(r):r;return[o.join(t,"sandbox-workspace-session.js"),e]}i(Nt,"workspaceSessionEntryArgs");function Pe(e,r){let t=r?"ref":"unref";e[t]();for(let n of e.stdio){if(!n)continue;n[t]?.()}}i(Pe,"setWorkspaceSessionReferenced");async function Er(e,r){if(e)return r();let t=await Re();try{return await r()}finally{await t()}}i(Er,"withExclusiveFileSystemEffectFence");async function Dt(e,r,t,n){let s=process.platform==="win32"?bt(e):void 0;s!==void 0&&await W(s,{recursive:!0,mode:448});let a=await Ue();process.platform==="win32"&&De(Sr(e),"write");let d=o.join(a,`workspace-${process.pid}-${F()}.json`),c=He(kt(e,s,r));await Y(d,JSON.stringify({config:c}),{mode:384});let u=oe({args:Nt(d),env:Q(),isElectron:process.versions.electron!==void 0}),l=ir(process.execPath,u.args,{cwd:process.platform==="win32"?be().directory:void 0,env:u.env,shell:!1,stdio:["pipe","pipe","pipe","pipe"],windowsHide:!0});ke(l);let p=l.stdio[3];if(!p)throw new Error("ASRT workspace session control pipe was not created.");let w=Or.createInterface({input:p}),m=new Map,S="",g=!1,y=!1,k=!1,v=0,A=0,q,R,O,G=new Promise(f=>{l.once("exit",(h,T)=>f({code:h,signal:T}))}),C=G.then(async()=>{s!==void 0&&await j(s,{recursive:!0,force:!0})});C.catch(f=>{E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox temp cleanup failed.",detail:f})});let ee=i(async()=>{let f=await G;if(await C,f.code===0&&f.signal===null)return;let h=f.signal===null?`code ${f.code??"unknown"}`:`signal ${f.signal}`;throw new Error(`ASRT workspace session ACL reset was not confirmed (${h}): ${S.trim()||"no diagnostics"}`)},"confirmCleanReset"),H,re,xe=new Promise((f,h)=>{H=f,re=h}),te=i(()=>{k||(k=!0,n())},"evict"),K,b=i(()=>K||(K=(async()=>{try{await Ae(l,{gracefulStdinEnd:!0,gracefulMs:process.platform==="win32"?Ct:Ce,forceMs:Ce,taskkillMs:Ce})}finally{w.close(),p.destroy(),l.stdin.destroy()}})().finally(te),K),"terminate"),x=i(f=>{if(!g){g=!0,re(f);for(let h of m.values())h.reject(f);m.clear()}},"fail");l.stderr.on("data",f=>{S=(S+f.toString("utf8")).slice(-16384)}),l.stdout.on("data",f=>{S=(S+f.toString("utf8")).slice(-16384)}),w.on("line",f=>{let h;try{h=JSON.parse(f)}catch{x(new Error("ASRT workspace session returned malformed control data.")),b();return}if(h.type==="ready"){h.ok?H():re(new Error(h.error??"ASRT workspace session failed."));return}if(h.type!=="result"||!h.id){x(new Error("ASRT workspace session returned an invalid control response.")),b();return}let T=m.get(h.id);T&&(m.delete(h.id),T.resolve(h))}),l.once("error",f=>{x(f),b()}),w.once("close",()=>{y||g||(x(new Error("ASRT workspace session control pipe closed unexpectedly.")),b())}),l.once("exit",f=>{R&&clearTimeout(R),x(new Error(`ASRT workspace session exited ${f??1}: ${S.trim()||"no diagnostics"}`)),te()});let ne=setTimeout(()=>{x(new Error("ASRT workspace session initialization timed out.")),b()},$t);try{await xe.finally(()=>clearTimeout(ne))}catch(f){throw await b(),await j(d,{force:!0}),f}let ae=i(async(f,h)=>{if(g||y&&f==="wrap")throw new Error("ASRT workspace session is unavailable.");let T=`workspace_${++v}`,ce=new Promise((P,D)=>{m.set(T,{resolve:P,reject:D})}),N=setTimeout(()=>{x(new Error(`ASRT workspace session ${f} request timed out.`)),b()},Tt);N.unref();try{await new Promise((P,D)=>{l.stdin.write(`${JSON.stringify({id:T,type:f,request:h})}
+`,L=>L?D(L):P())})}catch(P){throw m.delete(T),clearTimeout(N),x(P instanceof Error?P:new Error(String(P))),b(),P}return ce.finally(()=>clearTimeout(N))},"request"),Je=i(()=>{R&&clearTimeout(R),!(A>0||y||g)&&(R=setTimeout(()=>{Ve.close()},Et),R.unref(),Pe(l,!1))},"scheduleIdleClose"),Ve={...s===void 0?{}:{tempDirectory:s},async acquire(f,h,T){if(Ie(h,T),g||y)throw new Error("ASRT workspace session is unavailable.");R&&clearTimeout(R),Pe(l,!0),A+=1;let ce=!1,N=i(()=>{ce||(ce=!0,A-=1,A===0&&(q?.(),q=void 0),Je())},"finalize"),P=ae("wrap",f),D;try{D=await fe(P,h,T)}catch(L){throw P.then(async I=>{if(!I.ok||!I.invocation)return;let de=await ae("cleanup");if(!de.ok)throw new Error(de.error??"ASRT command cleanup failed.")}).catch(I=>{E({source:"sandbox:workspace-session",level:"warn",message:"Late workspace sandbox preparation cleanup failed.",detail:I})}).finally(N),L}try{if(!D.ok||!D.invocation)throw N(),new Error(D.error??"ASRT workspace wrapping failed.");try{Ie(h,T)}catch(I){try{await ae("cleanup")}catch(de){E({source:"sandbox:workspace-session",level:"warn",message:"Cancelled workspace sandbox preparation cleanup failed.",detail:de})}throw N(),I}let L=!1;return{invocation:D.invocation,async release(){if(!L){L=!0;try{let I=await ae("cleanup");if(!I.ok)throw new Error(I.error??"ASRT command cleanup failed.")}finally{N()}}}}}catch(L){throw N(),L}},async close(){return O||(y=!0,O=Er(t,async()=>{if(R&&clearTimeout(R),g)return ee();Pe(l,!0),A>0&&await new Promise(f=>{q=f}),g||l.stdin.end(),await ee()}),O)}};return Je(),Ve}i(Dt,"startWorkspaceSessionClientWithFence");function or(e,r,t,n){return Er(t,()=>Dt(e,r,t,n))}i(or,"startWorkspaceSessionClient");async function sr(e,r,t=!1){if(!(await B()).ready)return;Ot();let s=process.platform==="win32"?r:void 0;if(s?.ephemeral===!0)return or(e,s,t,()=>{});let a=process.platform==="win32"?e.toLowerCase():e,d=s===void 0?"workspace":Fe("sha256").update(JSON.stringify({read:[...s.read].map(l=>l.toLowerCase()).sort(),write:[...s.write].map(l=>l.toLowerCase()).sort()})).digest("hex"),c=`${a}\0${d}`,u=$.get(c);if(u&&($.delete(c),$.set(c,u)),!u){if(s!==void 0){let l=[...$.keys()].filter(p=>!p.endsWith("\0workspace"));if(l.length>=Pt){let p=l[0],w=$.get(p);if($.delete(p),w)try{await(await w).close()}catch(m){throw E({source:"sandbox:workspace-session",level:"warn",message:"Retiring an old Agent Home sandbox scope failed.",detail:m}),m}}}u=or(e,s,!1,()=>{$.get(c)===u&&$.delete(c)}),$.set(c,u),u.catch(()=>{$.get(c)===u&&$.delete(c)})}return u}i(sr,"getWorkspaceSession");function on(e){let r=o.resolve(e.workspaceRoot),t=sr(r);return t.catch(n=>{E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox warm-up failed; admitted commands remain fail-closed.",detail:n})}),{failClosed:e.failClosed===!0,processTreeContainment:e.failClosed===!0&&process.platform==="linux"?"root-exit-drains":void 0,async prepare(n){if(!n.toolCallId){n.reportObservation?.({version:1,state:"not_selected"});return}let s={id:n.toolCallId,name:"bash",input:{...n.toolInput}},a=await e.shouldSandbox(s);if(!a){n.reportObservation?.({version:1,state:"not_selected"});return}let d=typeof a=="object"?a.agentHomeAccess:void 0,c=process.platform==="win32"&&d!==void 0?xr(o.resolve(U()),d):d,u=process.platform==="win32"&&c?.ephemeral===!0,l,p,w,m=!1,S,g=i(async()=>{if(w){if(!m)throw new Error("Review-only Agent Home ACL reset is not confirmed.");S??=w(),await S}},"releaseExclusiveAfterReset"),y=i(()=>w===void 0?void 0:{bindEffectProcess:i((v,A)=>w.bindEffectProcess(v,A),"bindEffectProcess"),finishEffectProcess:i(()=>w.finishEffectProcess(),"finishEffectProcess"),release:g},"fileSystemEffectLease"),k=i(async()=>{!u||!p||(await p.close(),m=!0,await g())},"closeReviewSession");try{if(process.platform==="win32"&&c!==void 0&&await fe(t,n.signal,n.deadlineAt),u){let b=Re();try{w=await fe(b,n.signal,n.deadlineAt)}catch(x){throw b.then(ne=>ne()).catch(ne=>{E({source:"sandbox:workspace-session",level:"warn",message:"Late review-only filesystem fence cleanup failed.",detail:ne})}),x}}let v=await fe(sr(r,c,u),n.signal,n.deadlineAt);if(!v){w&&(m=!0,await g()),n.reportObservation?.({version:1,state:"fallback",reason:"not_ready",execution:"normal_permission_policy"});return}p=v;let A=n.executable??(process.platform==="win32"?process.env.COMSPEC??o.join(process.env.SystemRoot??"C:\\Windows","System32","cmd.exe"):"/bin/sh"),q=n.args??(process.platform==="win32"?["/d","/s","/c",n.command]:["-c",n.command]),R=await Ue(),O=o.join(R,`kodax-asrt-shell-${process.pid}-${F()}.json`),G=o.join(R,`kodax-asrt-observation-${process.pid}-${F()}.json`),C={...n.env};if(process.platform==="win32"){for(let x of Object.keys(C))["TEMP","TMP","TMPDIR"].includes(x.toUpperCase())&&delete C[x];let b=v.tempDirectory;if(b===void 0)throw new Error("Windows workspace sandbox temp directory is unavailable.");C.TEMP=b,C.TMP=b,C.TMPDIR=b,C.GIT_CONFIG_GLOBAL="NUL",C.GIT_CONFIG_NOSYSTEM="1"}let ee={config:He(At(r,v.tempDirectory,c)),command:A,args:q,cwd:n.cwd,env:C,endpoints:[],allowAllNetwork:!0,bootstrapCommand:ve(),fallbackToNormalExecution:e.failClosed!==!0,observationBackend:Fr().backend,observationFile:G,targetStartedMarker:`\0KODAX_ASRT_TARGET_STARTED:${F()}\0
+`},H=await v.acquire(ee,n.signal,n.deadlineAt);l=H;let re={...ee,wrappedInvocation:H.invocation},xe=process.env.KODAX_BUNDLED==="true"?["__asrt-broker",O]:["--input-type=module","-e",fr,ur,O],te=oe({args:xe,env:Q(),isElectron:process.versions.electron!==void 0});await Y(O,JSON.stringify(re),{mode:384});let K=y();return{executable:process.execPath,args:te.args,env:te.env,...K===void 0?{}:{fileSystemEffectLease:K},async cleanup(){let b;try{b=await z(G,"utf8").then(tt).catch(x=>{if(x.code!=="ENOENT")throw x})}finally{await Promise.all([j(O,{force:!0}),j(G,{force:!0})]);try{await H.release()}catch(x){E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox command cleanup failed.",detail:x})}finally{u&&await k()}}return b}}}catch(v){if(l&&await l.release().catch(A=>{E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox lease release failed.",detail:A})}),u&&p?await k().catch(A=>{E({source:"sandbox:workspace-session",level:"warn",message:"Review-only Agent Home sandbox rollback failed.",detail:A})}):w&&(m=!0,await g().catch(A=>{E({source:"sandbox:workspace-session",level:"warn",message:"Unused review-only filesystem fence cleanup failed.",detail:A})})),n.signal?.aborted||n.deadlineAt!==void 0&&Date.now()>=n.deadlineAt)throw v;E({source:"sandbox:workspace-session",level:"warn",message:"Workspace sandbox preparation failed; using normal permission fallback.",detail:v}),n.reportObservation?.({version:1,state:"fallback",reason:"prepare_failed",execution:"normal_permission_policy"});return}}}}i(on,"createAsrtShellSandbox");async function sn(e){let r=await B();if(!r.ready)throw new Error(`ASRT ${V} is not ready: ${r.diagnostics.join(" ")||"run kodax sandbox setup"}`);let t=o.join(e.snapshotRoot,F()),n=o.join(t,"skills");await W(n,{recursive:!0,mode:448});try{let s=await it(e,n),a=at(e.network),d=Promise.resolve();return{async run(c,u){let l=d,p;if(d=new Promise(w=>{p=w}),await l,u.signal?.aborted)throw p?.(),u.signal.reason??new Error("Sandboxed Skill script was cancelled.");try{if(c.args.length>64||c.args.some(g=>g.length>8192))throw new Error("Skill script arguments exceed the bounded remote contract.");if(c.inputs.length>32||c.outputs.length>32)throw new Error("Skill script file mappings exceed the bounded remote contract.");let w=M(c.script,"Skill script"),m=s.get(`${c.skill}\0${w}`);if(!m)throw new Error("Skill script is not admitted by this Runtime binding.");if([".cmd",".bat"].includes(o.extname(m.snapshotPath).toLowerCase())&&c.args.some(g=>/[&|<>^]/.test(g)))throw new Error("Batch Skill script arguments cannot contain command operators.");let S=o.join(u.workspaceRoot,".kodax-a2a-script",F());try{await W(o.join(S,"inputs"),{recursive:!0,mode:448}),await W(o.join(S,"outputs"),{recursive:!0,mode:448}),await mt(u.workspaceRoot,S,c,e.workspaceAccess);let g=ct(m.snapshotPath),y=await ut({config:gt(S,t,a,g.command),command:g.command,args:[...g.args,...c.args],cwd:S,env:Q(),endpoints:a},u.signal),k=await wt(u.workspaceRoot,S,c,e.workspaceAccess,e.workspaceByteLimit);return JSON.stringify({stdout:y.trim(),outputs:k})}finally{await j(S,{recursive:!0,force:!0})}}finally{p?.()}},async dispose(){await d,await j(t,{recursive:!0,force:!0})}}}catch(s){throw await j(t,{recursive:!0,force:!0}),s}}i(sn,"createAsrtSkillScriptRunner");export{V as a,Fr as b,B as c,ot as d,ue as e,tn as f,nn as g,on as h,sn as i};