@letrquan/book 0.2.0 → 0.3.0

package/dist/chunk-JTPOI3KU.js

@@ -0,0 +1,826 @@
+import {
+  isOutside,
+  resolveWorkspacePath
+} from "./chunk-X66I2NQO.js";
+import {
+  createDebugLogger
+} from "./chunk-62QL5QUP.js";
+
+// src/sandbox.ts
+import {
+  accessSync,
+  closeSync,
+  constants,
+  existsSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  readlinkSync,
+  readSync,
+  realpathSync,
+  statSync
+} from "fs";
+import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "path";
+import { homedir, platform } from "os";
+
+// src/tools/glob-regex.ts
+import { posix, win32 } from "path";
+import picomatch from "picomatch";
+import { convertPathToPattern } from "tinyglobby";
+function globToRegex(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*|\*/g, ".*");
+  return new RegExp("^" + escaped + "$");
+}
+var log = createDebugLogger("tools:glob");
+var MAX_GLOB_PATTERN_LENGTH = 1e4;
+var MAX_GLOB_GROUP_DEPTH = 32;
+var MAX_GLOB_GROUPS = 256;
+function globPatternRefusal(pattern) {
+  if (pattern.length > MAX_GLOB_PATTERN_LENGTH) {
+    return `Pattern is too long: a glob pattern may be at most ${MAX_GLOB_PATTERN_LENGTH} characters (this one is ${pattern.length})`;
+  }
+  let depth = 0;
+  let deepest = 0;
+  let groups = 0;
+  for (let index = 0; index < pattern.length; index++) {
+    const char = pattern[index];
+    if (char === "\\") {
+      index++;
+      continue;
+    }
+    if (char === "(" || char === "{" || char === "[") {
+      groups++;
+      depth++;
+      if (depth > deepest) deepest = depth;
+      if (groups > MAX_GLOB_GROUPS) {
+        return `Pattern has too many groups: a glob pattern may open at most ${MAX_GLOB_GROUPS} of them (this one opens more)`;
+      }
+      if (depth > MAX_GLOB_GROUP_DEPTH) {
+        return `Pattern nests groups too deeply: a glob pattern may nest at most ${MAX_GLOB_GROUP_DEPTH} deep (this one nests ${deepest})`;
+      }
+    } else if (char === ")" || char === "}" || char === "]") {
+      depth = Math.max(0, depth - 1);
+    }
+  }
+  return null;
+}
+var logIgnoreDrop = (entry, reason) => {
+  log.warn(
+    `glob: dropping a .gitignore entry the walk cannot obey \u2014 ${reason}: ${JSON.stringify(entry)}`
+  );
+};
+function globWalkIgnore(patterns, report = logIgnoreDrop) {
+  const walkable = [];
+  for (const pattern of patterns) {
+    const refusal = globPatternRefusal(pattern);
+    if (refusal) {
+      report(pattern, `${refusal}, so the walk covers what it ignored`);
+      continue;
+    }
+    if (pattern.startsWith("!(")) {
+      report(
+        pattern,
+        "picomatch reads `!(` as an extglob, so as an ignore entry it matches everything but what it names"
+      );
+      continue;
+    }
+    const climb = climbOutOfWalk(pattern);
+    if (climb) {
+      report(
+        pattern,
+        `${climb}, so the walk would read outside the workspace and still ignore nothing`
+      );
+      continue;
+    }
+    walkable.push(...walkIgnoreEntry(pattern));
+  }
+  return walkable;
+}
+function climbOutOfWalk(entry) {
+  const spelling = entry.replace(/^!/, "").replace(/^\/+/, "");
+  const normalized = posix.normalize(spelling).split("/");
+  return normalized[0] === ".." ? "the walk reads it as a climb out of its own root" : null;
+}
+function walkIgnoreEntry(entry) {
+  const negated = entry.startsWith("!") && !entry.startsWith("!(");
+  const bang = negated ? "!" : "";
+  const body = negated ? entry.slice(1) : entry;
+  const relative2 = body.replace(/^\/+/, "").replace(/\/+$/, "");
+  const dirOnly = body.endsWith("/") && !relative2.endsWith("/**");
+  if (!body.startsWith("/")) return dirOnly ? [`${bang}${relative2}/**/*`] : [entry];
+  if (!relative2 || relative2 === ".") return [];
+  const anchored = `${bang}${relative2}`;
+  if (dirOnly) return [`${anchored}/**/*`];
+  return relative2.endsWith("/**") ? [anchored] : [anchored, `${anchored}/**`];
+}
+function globWalkPlan(pattern, cwd, platform2 = process.platform) {
+  const walked = globWalkPattern(pattern, cwd, platform2);
+  const refusal = globPatternRefusal(walked);
+  return {
+    pattern: walked,
+    refusal,
+    scopes: refusal ? null : confinedDirectoriesOfPattern(walked, cwd, platform2)
+  };
+}
+function pathsOf(platform2) {
+  return platform2 === "win32" ? win32 : posix;
+}
+function walkPath(value) {
+  return value.replaceAll("\\", "/");
+}
+function relativePatternOf(platformPaths, walkCwd, body) {
+  const absolute = platformPaths.resolve(platformPaths.parse(walkCwd).root || "/", body);
+  return walkPath(platformPaths.relative(walkCwd, absolute));
+}
+function globWalkPattern(pattern, cwd, platform2 = process.platform) {
+  const platformPaths = pathsOf(platform2);
+  const spelled = posixPattern(pattern, platform2);
+  const body = spelled.endsWith("/") ? spelled.slice(0, -1) : spelled;
+  const relative2 = platformPaths.isAbsolute(body.replace(ESCAPING_BACKSLASHES, "")) ? relativePatternOf(platformPaths, walkCwdOf(cwd, platformPaths), body) : "";
+  if (relative2) return relative2;
+  const base = staticBaseOfPattern(body);
+  if (!base || !body.startsWith(base)) return body;
+  return `${convertPathToPattern(base)}${body.slice(base.length)}`;
+}
+function posixPattern(pattern, platform2) {
+  return platform2 === "win32" ? pattern.replaceAll("\\", "/") : pattern;
+}
+function walkCwdOf(cwd, platformPaths) {
+  return walkPath(platformPaths.resolve(cwd));
+}
+var PARENT_DIRECTORY = /^(\/?\.\.)+/;
+var ESCAPING_BACKSLASHES = /\\(?=[()[\]{}!*+?@|])/g;
+var DRIVE_RELATIVE_PATH = /^[A-Za-z]:$/;
+function ensureNonDriveRelativePath(path) {
+  return path.replace(DRIVE_RELATIVE_PATH, (match) => `${match}/`);
+}
+function scopePath(platformPaths, cwd, ...segments) {
+  return ensureNonDriveRelativePath(
+    walkPath(platformPaths.normalize(platformPaths.join(cwd, ...segments)))
+  );
+}
+function splitPatternParts(pattern) {
+  const parts = picomatch.scan(pattern, { parts: true }).parts;
+  return parts?.length ? parts : [pattern];
+}
+function isDynamicPart(part) {
+  const scan = picomatch.scan(part);
+  return scan.isGlob || scan.negated;
+}
+var MAX_LEADING_ALTERNATIVES = 64;
+function leadingPartsOfParts(parts, popTrailingGlobstar) {
+  const leading = [];
+  for (let index = 0; index < parts.length; index++) {
+    const part = parts[index];
+    if (popTrailingGlobstar && part === "**" && !parts[index + 1]) {
+      leading.pop();
+      break;
+    }
+    if (index === parts.length - 1 || isDynamicPart(part)) break;
+    leading.push(part);
+  }
+  return leading;
+}
+function staticBaseOfPattern(pattern) {
+  const leadingParts = leadingPartsOfParts(splitPatternParts(pattern), false);
+  return leadingParts.length ? posix.join(...leadingParts) : "";
+}
+function holds(platformPaths, root, path) {
+  const relativePath = walkPath(platformPaths.relative(root, path));
+  return relativePath === "" || !relativePath.startsWith("../") && relativePath !== ".." && !platformPaths.isAbsolute(relativePath);
+}
+function confinedDirectoriesOfPattern(pattern, cwd, platform2) {
+  const platformPaths = pathsOf(platform2);
+  const walkCwd = walkCwdOf(cwd, platformPaths);
+  const body = pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
+  const normalized = platformPaths.isAbsolute(body.replace(ESCAPING_BACKSLASHES, "")) ? relativePatternOf(platformPaths, walkCwd, body) : walkPath(platformPaths.normalize(body));
+  const parts = splitPatternParts(normalized);
+  const parentDirectory = PARENT_DIRECTORY.exec(normalized)?.[0];
+  const climb = leadingClimbOfParts(parts);
+  const cwdParts = walkCwd.split("/");
+  const walkedClimb = ((parentDirectory?.length ?? 0) + 1) / 3;
+  let cancelled = 0;
+  while (Number.isInteger(walkedClimb) && cancelled < walkedClimb && parts[cancelled + walkedClimb] !== void 0 && parts[cancelled + walkedClimb] === cwdParts[cwdParts.length + cancelled - walkedClimb]) {
+    cancelled++;
+  }
+  const potentialRoot = scopePath(
+    platformPaths,
+    walkCwd,
+    parentDirectory?.slice(cancelled * 3) ?? ""
+  );
+  const climbedOutOfCwd = potentialRoot[0] !== "." && walkCwd.length > potentialRoot.length;
+  const searchesFrom = climbedOutOfCwd ? potentialRoot : scopePath(platformPaths, walkCwd, ...leadingPartsOfParts(parts, true));
+  if (!parentDirectory) {
+    return confinedRunsWithin(platformPaths, searchesFrom, leadingRunsOfParts(parts), walkCwd);
+  }
+  if (cancelled > 0) {
+    return [searchesFrom];
+  }
+  if (!Number.isInteger(walkedClimb)) {
+    return [searchesFrom];
+  }
+  const hops = new Array(walkedClimb).fill("..");
+  return confinedRunsWithin(
+    platformPaths,
+    searchesFrom,
+    leadingRunsOfParts(parts.slice(climb)).map((run) => [...hops, ...run]),
+    walkCwd
+  );
+}
+function leadingClimbOfParts(parts) {
+  let climb = 0;
+  while (parts[climb] === "..") climb++;
+  return climb;
+}
+function leadingRunsOfParts(parts) {
+  let runs = [[]];
+  for (let index = 0; index < parts.length - 1; index++) {
+    const part = parts[index];
+    const alternatives = alternativesOfGroup(part);
+    if (alternatives) {
+      if (runs.length * alternatives.length > MAX_LEADING_ALTERNATIVES) break;
+      runs = runs.flatMap((run) => alternatives.map((alternative) => [...run, alternative]));
+      continue;
+    }
+    if (isDynamicPart(part)) break;
+    for (const run of runs) run.push(part);
+  }
+  return runs;
+}
+function alternativesOfGroup(part) {
+  if (part.length < 5 || !part.startsWith("{") || !part.endsWith("}")) return null;
+  const body = part.slice(1, -1);
+  if (!body.includes(",") || /\.\./.test(body)) return null;
+  const alternatives = [];
+  let nested = 0;
+  let current = "";
+  for (const char of body) {
+    if (char === "{" || char === "(" || char === "[") nested++;
+    else if (char === "}" || char === ")" || char === "]") nested--;
+    if (char === "," && nested === 0) {
+      alternatives.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  alternatives.push(current);
+  const named = alternatives.filter(
+    (alternative) => !alternative.includes("/") && !isDynamicPart(alternative)
+  );
+  return named.length ? named : null;
+}
+function confinedRunsWithin(platformPaths, root, runs, walkCwd) {
+  const held = [
+    ...new Set(
+      runs.map((run) => scopePath(platformPaths, walkCwd, ...run)).filter((directory) => holds(platformPaths, root, directory))
+    )
+  ];
+  return held.length ? held : [root];
+}
+
+// src/sandbox.ts
+function isExecutableFile(path) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function detectBwrap() {
+  const candidates = [
+    ...(process.env.PATH ?? "").split(delimiter).filter(Boolean).map((dir) => join(dir, "bwrap")),
+    "/usr/local/bin/bwrap",
+    "/opt/homebrew/bin/bwrap",
+    "/usr/bin/bwrap"
+  ];
+  return candidates.find(isExecutableFile) ?? null;
+}
+function matchesExcludedCommand(command, patterns = []) {
+  return patterns.some((pattern) => globToRegex(pattern).test(command));
+}
+function sandboxBackendAvailable() {
+  return platform() !== "win32" && detectBwrap() !== null;
+}
+function sandboxCoverage(command, settings, backendAvailable = sandboxBackendAvailable) {
+  if (!settings.enabled) return { sandboxed: false, reason: "disabled" };
+  if (matchesExcludedCommand(command, settings.excludedCommands))
+    return { sandboxed: false, reason: "excluded" };
+  if (!backendAvailable()) return { sandboxed: false, reason: "unavailable" };
+  return { sandboxed: true };
+}
+var SKIP_REASON_DETAIL = {
+  disabled: "sandboxing is turned off (sandbox.enabled is false)",
+  excluded: "the command matches a sandbox.excludedCommands pattern, which runs it unsandboxed",
+  unavailable: "the bubblewrap (bwrap) sandbox backend is unavailable on this platform or is not installed"
+};
+var SKIP_REASON_REMEDY = {
+  disabled: "Set sandbox.enabled to true",
+  excluded: "Remove the matching pattern from sandbox.excludedCommands",
+  unavailable: "Install bubblewrap (bwrap)"
+};
+var SANDBOX_SETTINGS_LOCATION = "in ~/.book/settings.json, or with a --settings file";
+function unsandboxedRefusalMessage(reason) {
+  const remedy = reason === "unavailable" ? "Install bubblewrap (bwrap) to enable sandboxing." : `${SKIP_REASON_REMEDY[reason]} ${SANDBOX_SETTINGS_LOCATION}, or set sandbox.allowUnsandboxedCommands to true there to allow this command to run unsandboxed.`;
+  return [
+    "Refused to run this command outside the sandbox:",
+    `${SKIP_REASON_DETAIL[reason]}.`,
+    "sandbox.allowUnsandboxedCommands is false, so unsandboxed commands are not permitted.",
+    remedy
+  ].join(" ");
+}
+function sandboxPolicySummary(settings, state) {
+  return {
+    unsandboxedCommands: settings.allowUnsandboxedCommands ? "allowed (sandbox.allowUnsandboxedCommands=true)" : "refused (sandbox.allowUnsandboxedCommands=false)",
+    autoAllowBash: !settings.autoAllowBashIfSandboxed ? "off \u2014 every Bash call goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=false)" : !state.sandboxActive ? "inert \u2014 no command is sandboxed here, so nothing is auto-allowed (sandbox.autoAllowBashIfSandboxed=true)" : state.adjudicationConfigured ? "inert \u2014 permissions.deny/ask rules are configured, so every Bash call still goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=true)" : "on for genuinely sandboxed commands (sandbox.autoAllowBashIfSandboxed=true)"
+  };
+}
+var MAX_CONTROL_FILE_BYTES = 4096;
+var MAX_GIT_CONFIG_BYTES = 1024 * 1024;
+var MAX_WALK_DEPTH = 8;
+function entryKind(path) {
+  try {
+    const stats = lstatSync(path);
+    if (stats.isSymbolicLink()) return "symlink";
+    if (stats.isDirectory()) return "directory";
+    if (stats.isFile()) return "file";
+    return "other";
+  } catch {
+    return null;
+  }
+}
+var realSandboxHost = {
+  path: { resolve, join, relative, isAbsolute, sep, dirname },
+  exists: existsSync,
+  // A path that vanished between the probe and the spawn is absent as far as the
+  // mount list is concerned. `statSync` throws for it, and a throw here would
+  // abort the whole bwrap invocation over a race, not a protection failure.
+  isDirectory: (path) => {
+    try {
+      return statSync(path).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  readFile: (path, maxBytes = MAX_CONTROL_FILE_BYTES) => {
+    if (entryKind(path) !== "file") return null;
+    let fd;
+    try {
+      fd = openSync(path, "r");
+      const buffer = Buffer.alloc(maxBytes);
+      const bytes = readSync(fd, buffer, 0, maxBytes, 0);
+      return buffer.subarray(0, bytes).toString("utf-8");
+    } catch {
+      return null;
+    } finally {
+      if (fd !== void 0) {
+        try {
+          closeSync(fd);
+        } catch {
+        }
+      }
+    }
+  },
+  fileSize: (path) => {
+    if (entryKind(path) !== "file") return null;
+    try {
+      return statSync(path).size;
+    } catch {
+      return null;
+    }
+  },
+  readDir: (path) => {
+    try {
+      return readdirSync(path);
+    } catch {
+      return [];
+    }
+  },
+  entryKind,
+  linkTarget: (path) => {
+    try {
+      return readlinkSync(path);
+    } catch {
+      return null;
+    }
+  },
+  realpath: (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return null;
+    }
+  },
+  homedir
+};
+function expandPath(path, host) {
+  if (path === "~") return host.homedir();
+  if (path.startsWith("~/")) return host.path.join(host.homedir(), path.slice(2));
+  return host.path.resolve(path);
+}
+function bindIfPresent(args, flag, path, host) {
+  const target = expandPath(path, host);
+  if (host.exists(target)) args.push(flag, target, target);
+}
+function unbindablePaths(settings, host = realSandboxHost) {
+  return [
+    ...settings.filesystem.allowWrite,
+    ...settings.filesystem.denyWrite,
+    ...settings.filesystem.denyRead
+  ].filter((path) => !host.exists(expandPath(path, host)));
+}
+function hasDomainPolicy(settings) {
+  return settings.network.allowedDomains.length > 0 || settings.network.deniedDomains.length > 0;
+}
+function canonicalPath(path, host) {
+  const absolute = host.path.resolve(path);
+  let existing = absolute;
+  for (; ; ) {
+    const real = host.realpath(existing);
+    if (real !== null) return host.path.resolve(real, host.path.relative(existing, absolute));
+    const parent = host.path.dirname(existing);
+    if (parent === existing) return absolute;
+    existing = parent;
+  }
+}
+function insideWorkspace(candidate, workspaceRoot, host) {
+  return !isOutside(canonicalPath(workspaceRoot, host), canonicalPath(candidate, host), host.path);
+}
+function workspaceGitDirs(workspaceRoot, host) {
+  const root = host.path.resolve(workspaceRoot);
+  const found = [];
+  const add = (candidate, workTree) => {
+    const dir = host.path.resolve(candidate);
+    if (found.some((entry) => entry.dir === dir)) return;
+    if (!host.isDirectory(dir) || !insideWorkspace(dir, root, host)) return;
+    found.push({ dir, workTree: host.path.resolve(workTree) });
+  };
+  const dotGit = host.path.join(root, ".git");
+  if (!host.exists(dotGit)) return found;
+  if (host.isDirectory(dotGit)) {
+    add(dotGit, root);
+  } else {
+    const target = /^gitdir:\s*(.+)$/m.exec(host.readFile(dotGit) ?? "")?.[1]?.trim();
+    if (!target) return found;
+    add(host.path.isAbsolute(target) ? target : host.path.join(root, target), root);
+  }
+  for (let index = 0; index < found.length; index++) {
+    const { dir, workTree } = found[index];
+    const common = host.readFile(host.path.join(dir, "commondir"))?.trim();
+    if (common) add(host.path.isAbsolute(common) ? common : host.path.join(dir, common), workTree);
+    for (const name of host.readDir(host.path.join(dir, "worktrees"))) {
+      const linked = host.path.join(dir, "worktrees", name);
+      const workTreeGitdir = host.readFile(host.path.join(linked, "gitdir"))?.trim();
+      add(linked, workTreeGitdir ? host.path.dirname(workTreeGitdir) : root);
+    }
+    const addModules = (modulesRoot, prefix, depth) => {
+      for (const name of host.readDir(modulesRoot)) {
+        const moduleDir = host.path.join(modulesRoot, name);
+        const workTreePath = prefix ? `${prefix}/${name}` : name;
+        const isGitDir = ["HEAD", "config"].some(
+          (file) => host.exists(host.path.join(moduleDir, file))
+        );
+        if (isGitDir) add(moduleDir, host.path.join(root, workTreePath));
+        else if (depth < MAX_WALK_DEPTH) addModules(moduleDir, workTreePath, depth + 1);
+      }
+    };
+    addModules(host.path.join(dir, "modules"), "", 0);
+  }
+  for (const { workTree } of [...found]) {
+    if (!insideWorkspace(workTree, root, host)) continue;
+    const pointer = host.path.join(workTree, ".git");
+    if (host.isDirectory(pointer)) continue;
+    const target = /^gitdir:\s*(.+)$/m.exec(host.readFile(pointer) ?? "")?.[1]?.trim();
+    if (!target) continue;
+    add(host.path.isAbsolute(target) ? target : host.path.join(workTree, target), workTree);
+  }
+  return found;
+}
+function parseConfigValue(raw) {
+  const text = raw.trim();
+  if (!text.startsWith('"')) {
+    let quoted = false;
+    for (let index = 0; index < text.length; index += 1) {
+      const character = text[index];
+      if (character === '"') quoted = !quoted;
+      else if (!quoted && (character === ";" || character === "#"))
+        return text.slice(0, index).trim();
+    }
+    return text;
+  }
+  let value = "";
+  for (let index = 1; index < text.length; index += 1) {
+    const character = text[index];
+    if (character === '"') break;
+    if (character !== "\\") {
+      value += character;
+      continue;
+    }
+    const escaped = text[index + 1];
+    index += 1;
+    value += escaped === "n" ? "\n" : escaped === "t" ? "	" : escaped === "b" ? "\b" : escaped ?? "";
+  }
+  return value;
+}
+function configSectionName(line) {
+  const header = /^\[\s*([A-Za-z0-9.-]+)(\s[^\]]*)?\]$/.exec(line.trim());
+  if (!header || header[2]) return void 0;
+  return header[1].toLowerCase();
+}
+function readCoreHooksPaths(configText) {
+  const found = [];
+  let inCore = false;
+  for (const line of configText.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inCore = configSectionName(trimmed) === "core";
+      continue;
+    }
+    if (!inCore) continue;
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) continue;
+    if (trimmed.slice(0, separator).trim().toLowerCase() !== "hookspath") continue;
+    const value = parseConfigValue(trimmed.slice(separator + 1));
+    if (value && !found.includes(value)) found.push(value);
+  }
+  return found;
+}
+function readGitConfigIncludes(configText) {
+  const found = [];
+  let include = false;
+  for (const line of configText.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      include = configSectionName(trimmed) === "include" || /^\[includeif\b/i.test(trimmed);
+      continue;
+    }
+    if (!include) continue;
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) continue;
+    if (trimmed.slice(0, separator).trim().toLowerCase() !== "path") continue;
+    const value = parseConfigValue(trimmed.slice(separator + 1));
+    if (value) found.push(value);
+  }
+  return found;
+}
+function describeControlPathRefusal(refusal) {
+  if (refusal.reason === "oversized-git-config") {
+    return `Refused to run this command in the sandbox: ${refusal.path} is larger than the ${MAX_GIT_CONFIG_BYTES / 1024 / 1024} MiB read limit for a git config file, so the core.hooksPath it may declare cannot be found and the hooks directory it names cannot be made read-only. Trim the config, or run this command without the sandbox.`;
+  }
+  return `Refused to run this command in the sandbox: ${refusal.path} is a symlink, and the sandbox cannot protect a symlinked control path. The link itself sits in the writable workspace, so a command could remove it, put a directory or file in its place, and write the settings, hooks or repository config the host then reads through it. Replace the symlink with the file or directory it names, or run this command without the sandbox.`;
+}
+function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
+  const root = host.path.resolve(workspaceRoot);
+  const result = { pinnedDirectories: [], mounts: [], refusals: [] };
+  const seen = /* @__PURE__ */ new Set();
+  const target = (path, kind) => {
+    const resolved = host.path.resolve(path);
+    if (seen.has(resolved)) return null;
+    const describe = (present) => {
+      seen.add(resolved);
+      return { path: resolved, kind, present };
+    };
+    const first = host.entryKind(resolved);
+    if (first === "symlink") {
+      if (!result.refusals.some((entry) => entry.path === resolved)) {
+        result.refusals.push({ path: resolved, reason: "symlinked-control-path" });
+      }
+      return null;
+    }
+    if (first === null) {
+      return kind === "directory" ? describe(false) : null;
+    }
+    if (first === "directory") {
+      return kind === "hidden-file" ? null : describe(true);
+    }
+    return first === "file" ? describe(true) : null;
+  };
+  const addDirectory = (path) => {
+    const mount = target(path, "directory");
+    if (mount) result.mounts.push(mount);
+  };
+  const addFile = (path) => {
+    const mount = target(path, "file");
+    if (mount) result.mounts.push(mount);
+  };
+  const addMaskedFile = (path) => {
+    const mount = target(path, "hidden-file");
+    if (mount) result.mounts.push(mount);
+  };
+  addDirectory(host.path.join(root, ".book"));
+  addMaskedFile(host.path.join(root, ".book", "settings.local.json"));
+  addFile(host.path.join(root, ".bookrc.json"));
+  const dotGit = host.path.join(root, ".git");
+  if (host.entryKind(dotGit) === "directory") {
+    result.pinnedDirectories.push(dotGit);
+  } else {
+    addFile(dotGit);
+  }
+  const configsRead = /* @__PURE__ */ new Set();
+  const readConfig = (file, workTree, depth) => {
+    const at = host.path.resolve(file);
+    if (configsRead.has(at)) return;
+    configsRead.add(at);
+    const size = host.fileSize(at);
+    if (size !== null && size > MAX_GIT_CONFIG_BYTES) {
+      result.refusals.push({ path: at, reason: "oversized-git-config" });
+      return;
+    }
+    const text = host.readFile(at, MAX_GIT_CONFIG_BYTES);
+    if (text === null) return;
+    addFile(at);
+    for (const hooksPath of readCoreHooksPaths(text)) {
+      const directory = host.path.isAbsolute(hooksPath) ? hooksPath : host.path.join(workTree, hooksPath);
+      if (insideWorkspace(directory, root, host)) addDirectory(directory);
+    }
+    if (depth >= MAX_WALK_DEPTH) return;
+    for (const included of readGitConfigIncludes(text)) {
+      const target2 = included.startsWith("~/") ? host.path.join(host.homedir(), included.slice(2)) : host.path.join(host.path.dirname(at), included);
+      readConfig(target2, workTree, depth + 1);
+    }
+  };
+  for (const gitDir of workspaceGitDirs(root, host)) {
+    addDirectory(host.path.join(gitDir.dir, "hooks"));
+    for (const name of ["config", "config.worktree", "commondir", "gitdir"]) {
+      addFile(host.path.join(gitDir.dir, name));
+    }
+    const workTreePointer = host.path.join(gitDir.workTree, ".git");
+    if (host.entryKind(workTreePointer) === "file") addFile(workTreePointer);
+    for (const name of ["config", "config.worktree"]) {
+      readConfig(host.path.join(gitDir.dir, name), gitDir.workTree, 0);
+    }
+  }
+  return result;
+}
+function mountProtected(args, mount, host) {
+  const target = host.path.resolve(mount.path);
+  if (mount.kind === "hidden-file") {
+    if (mount.present) args.push("--ro-bind", "/dev/null", target);
+    return;
+  }
+  if (mount.kind === "file") {
+    if (mount.present) args.push("--ro-bind", target, target);
+    return;
+  }
+  if (mount.present) {
+    args.push("--ro-bind", target, target);
+    return;
+  }
+  args.push("--tmpfs", target, "--remount-ro", target);
+}
+function buildSandboxExecution(bwrapPath, command, workspaceRoot, settings, host = realSandboxHost) {
+  const args = [];
+  args.push("--unshare-pid", "--unshare-ipc", "--unshare-uts", "--die-with-parent");
+  args.push("--proc", "/proc");
+  args.push("--dev", "/dev");
+  for (const dir of ["/usr", "/lib", "/lib64", "/bin", "/sbin", "/etc", "/opt"]) {
+    bindIfPresent(args, "--ro-bind", dir, host);
+  }
+  args.push("--tmpfs", "/tmp");
+  bindIfPresent(args, "--bind", workspaceRoot, host);
+  const protectedPaths = protectedWorkspacePaths(workspaceRoot, host);
+  const isProtectedArea = (path) => {
+    const canonical = canonicalPath(expandPath(path, host), host);
+    return protectedPaths.mounts.some(
+      (mount) => !isOutside(canonicalPath(mount.path, host), canonical, host.path)
+    );
+  };
+  for (const dir of protectedPaths.pinnedDirectories) {
+    args.push("--bind", host.path.resolve(dir), host.path.resolve(dir));
+  }
+  for (const path of settings.filesystem.allowWrite) {
+    if (isProtectedArea(path)) continue;
+    bindIfPresent(args, "--bind", path, host);
+  }
+  for (const mount of protectedPaths.mounts) mountProtected(args, mount, host);
+  for (const path of settings.filesystem.allowWrite) {
+    if (!isProtectedArea(path)) continue;
+    bindIfPresent(args, "--bind", path, host);
+  }
+  for (const mount of protectedPaths.mounts) {
+    if (mount.kind === "hidden-file") mountProtected(args, mount, host);
+  }
+  for (const path of settings.filesystem.denyWrite) bindIfPresent(args, "--ro-bind", path, host);
+  for (const path of settings.filesystem.denyRead) {
+    const target = expandPath(path, host);
+    if (!host.exists(target)) continue;
+    if (host.isDirectory(target)) args.push("--tmpfs", target);
+    else args.push("--ro-bind", "/dev/null", target);
+  }
+  args.push(hasDomainPolicy(settings) ? "--unshare-net" : "--share-net");
+  args.push("--cap-drop", "ALL");
+  args.push("--", "/bin/bash", "-c", command);
+  return { file: bwrapPath, args };
+}
+function decideSandboxExecution(ctx, command, workdir) {
+  const unsandboxed = (reason) => ctx.sandbox && !ctx.sandbox.allowUnsandboxedCommands ? { sandboxed: false, reason, error: unsandboxedRefusalMessage(reason) } : { sandboxed: false, reason };
+  if (!ctx.sandbox?.enabled) return unsandboxed("disabled");
+  if (matchesExcludedCommand(command, ctx.sandbox.excludedCommands)) return unsandboxed("excluded");
+  if (!resolveWorkspacePath(ctx.workspaceRoot, workdir)) {
+    return {
+      sandboxed: false,
+      error: `workdir is outside the sandboxed workspace: ${workdir}. Add it to sandbox.filesystem.allowWrite, or run without the sandbox.`
+    };
+  }
+  let sandbox;
+  try {
+    sandbox = ctx.runtime ? ctx.runtime.sandbox(ctx.sandbox) : createSandbox(ctx.sandbox);
+  } catch (error) {
+    return { sandboxed: false, error: error instanceof Error ? error.message : String(error) };
+  }
+  if (sandbox) {
+    const refusal = protectedWorkspacePaths(ctx.workspaceRoot).refusals[0];
+    if (refusal) return { sandboxed: false, error: describeControlPathRefusal(refusal) };
+  }
+  const exec = sandbox?.wrap(command, ctx.workspaceRoot);
+  if (exec) return { sandboxed: true, exec };
+  if (ctx.sandbox.failIfUnavailable) {
+    return { sandboxed: false, error: "Sandbox unavailable and failIfUnavailable is set" };
+  }
+  return unsandboxed("unavailable");
+}
+function withGitConfigReadOnlyNotice(text, output, sandboxed, command = "") {
+  if (!sandboxed || !/could not (?:write|lock) config file/.test(output)) return text;
+  if (writesAGlobalConfig(command)) return text;
+  return `${text}
+Note: .git/config is read-only inside the sandbox, so git cannot update repository configuration there. Run this command outside the sandbox.`;
+}
+function writesAGlobalConfig(command) {
+  return /^\s*(?:\S+\s+)*git\s+config\b[^|;&]*\s--(?:global|system)\b/.test(command);
+}
+function createSandbox(settings) {
+  if (!settings.enabled) return null;
+  const os = platform();
+  if (os === "win32") {
+    if (settings.failIfUnavailable) {
+      throw new Error(
+        "Bash sandbox is not available on Windows. Disable sandbox.enabled or set failIfUnavailable to false."
+      );
+    }
+    console.warn("\u26A0  Bash sandbox is not available on Windows. Commands will run unsandboxed.");
+    return null;
+  }
+  const bwrap = detectBwrap();
+  if (!bwrap) {
+    if (settings.failIfUnavailable) {
+      throw new Error(
+        "bubblewrap (bwrap) not found. Install it to enable bash sandboxing, or set failIfUnavailable to false."
+      );
+    }
+    console.warn(
+      "\u26A0  bubblewrap (bwrap) not found \u2014 install it for bash sandboxing. Commands will run unsandboxed."
+    );
+    return null;
+  }
+  if (hasDomainPolicy(settings)) {
+    console.warn(
+      "\u26A0  sandbox.network domain rules cannot be enforced by bubblewrap, which has no per-domain filtering. Network access is disabled entirely for sandboxed commands."
+    );
+  }
+  const unbindable = unbindablePaths(settings);
+  if (unbindable.length > 0) {
+    console.warn(
+      `\u26A0  sandbox.filesystem rules skipped \u2014 nothing exists at: ${unbindable.join(", ")}. These paths are not protected.`
+    );
+  }
+  return {
+    wrap(command, workspaceRoot) {
+      return buildSandboxExecution(bwrap, command, workspaceRoot, settings);
+    },
+    describe() {
+      return [
+        `bubblewrap (${bwrap})`,
+        hasDomainPolicy(settings) ? "network disabled" : "host network shared",
+        `${settings.filesystem.allowWrite.length} extra writable path(s)`,
+        `${settings.filesystem.denyWrite.length} read-only path(s)`,
+        `${settings.filesystem.denyRead.length} masked path(s)`,
+        unbindable.length > 0 ? `${unbindable.length} skipped (missing)` : "all paths resolved"
+      ].join("; ");
+    }
+  };
+}
+
+export {
+  globToRegex,
+  globWalkIgnore,
+  globWalkPlan,
+  matchesExcludedCommand,
+  sandboxBackendAvailable,
+  sandboxCoverage,
+  unsandboxedRefusalMessage,
+  sandboxPolicySummary,
+  realSandboxHost,
+  unbindablePaths,
+  hasDomainPolicy,
+  readCoreHooksPaths,
+  readGitConfigIncludes,
+  describeControlPathRefusal,
+  protectedWorkspacePaths,
+  buildSandboxExecution,
+  decideSandboxExecution,
+  withGitConfigReadOnlyNotice,
+  createSandbox
+};
+//# sourceMappingURL=chunk-JTPOI3KU.js.map