@lumenflow/core 3.1.2 → 3.2.0

package/dist/sandbox-allowlist.js

@@ -1,77 +0,0 @@
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-import fs from 'node:fs';
-import path from 'node:path';
-function normalizeAbsolutePath(targetPath) {
-    const normalized = path.resolve(targetPath);
-    if (normalized.length > 1 && normalized.endsWith(path.sep)) {
-        return normalized.slice(0, -1);
-    }
-    return normalized;
-}
-function toComparisonKey(targetPath) {
-    return process.platform === 'win32' ? targetPath.toLowerCase() : targetPath;
-}
-function findNearestExistingAncestor(targetPath) {
-    let cursor = normalizeAbsolutePath(targetPath);
-    const suffixParts = [];
-    while (!fs.existsSync(cursor)) {
-        const parent = path.dirname(cursor);
-        if (parent === cursor) {
-            break;
-        }
-        suffixParts.unshift(path.basename(cursor));
-        cursor = parent;
-    }
-    return { ancestor: cursor, suffixParts };
-}
-function resolveCanonicalPathForWrite(targetPath) {
-    const normalized = normalizeAbsolutePath(targetPath);
-    if (fs.existsSync(normalized)) {
-        return normalizeAbsolutePath(fs.realpathSync.native(normalized));
-    }
-    const { ancestor, suffixParts } = findNearestExistingAncestor(normalized);
-    const canonicalAncestor = fs.existsSync(ancestor)
-        ? normalizeAbsolutePath(fs.realpathSync.native(ancestor))
-        : normalizeAbsolutePath(ancestor);
-    return normalizeAbsolutePath(path.join(canonicalAncestor, ...suffixParts));
-}
-function resolveRoot(projectRoot, writableRoot) {
-    if (path.isAbsolute(writableRoot)) {
-        return normalizeAbsolutePath(writableRoot);
-    }
-    return normalizeAbsolutePath(path.resolve(projectRoot, writableRoot));
-}
-function isWithinRoot(candidatePath, rootPath) {
-    const candidateKey = toComparisonKey(candidatePath);
-    const rootKey = toComparisonKey(rootPath);
-    return candidateKey === rootKey || candidateKey.startsWith(`${rootKey}${path.sep}`);
-}
-export function buildSandboxAllowlist(input) {
-    const projectRoot = normalizeAbsolutePath(input.projectRoot);
-    const writableRoots = input.writableRoots.map((writableRoot) => {
-        const normalizedPath = resolveRoot(projectRoot, writableRoot);
-        return {
-            originalPath: writableRoot,
-            normalizedPath,
-            canonicalPath: resolveCanonicalPathForWrite(normalizedPath),
-        };
-    });
-    return {
-        projectRoot,
-        writableRoots,
-    };
-}
-export function isWritePathAllowed(allowlist, targetPath) {
-    const normalizedTargetPath = normalizeAbsolutePath(targetPath);
-    const canonicalTargetPath = resolveCanonicalPathForWrite(normalizedTargetPath);
-    return allowlist.writableRoots.some((entry) => {
-        const normalizedMatch = isWithinRoot(normalizedTargetPath, entry.normalizedPath);
-        const canonicalMatch = isWithinRoot(canonicalTargetPath, entry.canonicalPath);
-        // Require both checks:
-        // - normalized path guards lexical traversal tricks (../)
-        // - canonical path guards symlink escapes to outside the allowed root
-        return normalizedMatch && canonicalMatch;
-    });
-}
-//# sourceMappingURL=sandbox-allowlist.js.map

package/dist/sandbox-allowlist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-allowlist.js","sourceRoot":"","sources":["../src/sandbox-allowlist.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAkB7B,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IAIrD,IAAI,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM;QACR,CAAC;QAED,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAkB;IACtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAErD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/C,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,YAAoB;IAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,aAAqB,EAAE,QAAgB;IAC3D,MAAM,YAAY,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE1C,OAAO,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAE9D,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc;YACd,aAAa,EAAE,4BAA4B,CAAC,cAAc,CAAC;SAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAA2B,EAAE,UAAkB;IAChF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IAE/E,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,eAAe,GAAG,YAAY,CAAC,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9E,uBAAuB;QACvB,0DAA0D;QAC1D,sEAAsE;QACtE,OAAO,eAAe,IAAI,cAAc,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox-backend-linux.d.ts

@@ -1,6 +0,0 @@
-import { type SandboxBackend } from './sandbox-profile.js';
-export interface LinuxSandboxBackendOptions {
-    commandExists?: (binary: string) => boolean;
-}
-export declare function createLinuxSandboxBackend(options?: LinuxSandboxBackendOptions): SandboxBackend;
-//# sourceMappingURL=sandbox-backend-linux.d.ts.map

package/dist/sandbox-backend-linux.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-linux.d.ts","sourceRoot":"","sources":["../src/sandbox-backend-linux.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAsDD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,cAAc,CAkBhB"}

package/dist/sandbox-backend-linux.js

@@ -1,67 +0,0 @@
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-import { spawnSync } from 'node:child_process';
-import { SANDBOX_BACKEND_IDS, } from './sandbox-profile.js';
-const LINUX_SANDBOX_BINARY = 'bwrap';
-function defaultCommandExists(binary) {
-    const probe = spawnSync(binary, ['--help'], { stdio: 'ignore' });
-    return !probe.error;
-}
-function buildUnavailablePlan(request) {
-    if (request.allowUnsandboxedFallback) {
-        return {
-            backendId: SANDBOX_BACKEND_IDS.LINUX,
-            enforced: false,
-            failClosed: false,
-            warning: 'Running unsandboxed because bwrap is unavailable and fallback was explicitly enabled.',
-        };
-    }
-    return {
-        backendId: SANDBOX_BACKEND_IDS.LINUX,
-        enforced: false,
-        failClosed: true,
-        reason: 'Linux sandbox backend unavailable: required binary "bwrap" was not found.',
-    };
-}
-function buildInvocation(request) {
-    const writableBinds = request.profile.allowlist.writableRoots.flatMap((entry) => [
-        '--bind',
-        entry.normalizedPath,
-        entry.normalizedPath,
-    ]);
-    return {
-        command: LINUX_SANDBOX_BINARY,
-        args: [
-            '--die-with-parent',
-            '--new-session',
-            '--ro-bind',
-            '/',
-            '/',
-            ...writableBinds,
-            '--proc',
-            '/proc',
-            '--dev',
-            '/dev',
-            '--',
-            ...request.command,
-        ],
-    };
-}
-export function createLinuxSandboxBackend(options = {}) {
-    const commandExists = options.commandExists || defaultCommandExists;
-    return {
-        id: SANDBOX_BACKEND_IDS.LINUX,
-        resolveExecution(request) {
-            if (!commandExists(LINUX_SANDBOX_BINARY)) {
-                return buildUnavailablePlan(request);
-            }
-            return {
-                backendId: SANDBOX_BACKEND_IDS.LINUX,
-                enforced: true,
-                failClosed: false,
-                invocation: buildInvocation(request),
-            };
-        },
-    };
-}
-//# sourceMappingURL=sandbox-backend-linux.js.map

package/dist/sandbox-backend-linux.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-linux.js","sourceRoot":"","sources":["../src/sandbox-backend-linux.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgC;IAC5D,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;YACpC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,uFAAuF;SAC1F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;QACpC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,2EAA2E;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/E,QAAQ;QACR,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,cAAc;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE;YACJ,mBAAmB;YACnB,eAAe;YACf,WAAW;YACX,GAAG;YACH,GAAG;YACH,GAAG,aAAa;YAChB,QAAQ;YACR,OAAO;YACP,OAAO;YACP,MAAM;YACN,IAAI;YACJ,GAAG,OAAO,CAAC,OAAO;SACnB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAEpE,OAAO;QACL,EAAE,EAAE,mBAAmB,CAAC,KAAK;QAC7B,gBAAgB,CAAC,OAAgC;YAC/C,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACzC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;gBACpC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC;aACrC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox-backend-macos.d.ts

@@ -1,6 +0,0 @@
-import { type SandboxBackend } from './sandbox-profile.js';
-export interface MacosSandboxBackendOptions {
-    commandExists?: (binary: string) => boolean;
-}
-export declare function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend;
-//# sourceMappingURL=sandbox-backend-macos.d.ts.map

package/dist/sandbox-backend-macos.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-macos.d.ts","sourceRoot":"","sources":["../src/sandbox-backend-macos.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAyDD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,cAAc,CAkBhB"}

package/dist/sandbox-backend-macos.js

@@ -1,66 +0,0 @@
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-import { spawnSync } from 'node:child_process';
-import { SANDBOX_BACKEND_IDS, } from './sandbox-profile.js';
-const MACOS_SANDBOX_BINARY = 'sandbox-exec';
-function defaultCommandExists(binary) {
-    const probe = spawnSync(binary, ['-h'], { stdio: 'ignore' });
-    return !probe.error;
-}
-function escapePolicyPath(targetPath) {
-    return targetPath.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-}
-function buildPolicy(profile) {
-    const writableRules = profile.allowlist.writableRoots.map((entry) => `(allow file-write* (subpath "${escapePolicyPath(entry.normalizedPath)}"))`);
-    return [
-        '(version 1)',
-        '(deny default)',
-        '(allow process*)',
-        '(allow file-read*)',
-        '(allow sysctl-read)',
-        '(allow mach-lookup)',
-        '(allow network*)',
-        '(allow signal)',
-        ...writableRules,
-    ].join(' ');
-}
-function buildUnavailablePlan(request) {
-    if (request.allowUnsandboxedFallback) {
-        return {
-            backendId: SANDBOX_BACKEND_IDS.MACOS,
-            enforced: false,
-            failClosed: false,
-            warning: 'Running unsandboxed because sandbox-exec is unavailable and fallback was explicitly enabled.',
-        };
-    }
-    return {
-        backendId: SANDBOX_BACKEND_IDS.MACOS,
-        enforced: false,
-        failClosed: true,
-        reason: 'macOS sandbox backend unavailable: required binary "sandbox-exec" was not found.',
-    };
-}
-function buildInvocation(request) {
-    return {
-        command: MACOS_SANDBOX_BINARY,
-        args: ['-p', buildPolicy(request.profile), ...request.command],
-    };
-}
-export function createMacosSandboxBackend(options = {}) {
-    const commandExists = options.commandExists || defaultCommandExists;
-    return {
-        id: SANDBOX_BACKEND_IDS.MACOS,
-        resolveExecution(request) {
-            if (!commandExists(MACOS_SANDBOX_BINARY)) {
-                return buildUnavailablePlan(request);
-            }
-            return {
-                backendId: SANDBOX_BACKEND_IDS.MACOS,
-                enforced: true,
-                failClosed: false,
-                invocation: buildInvocation(request),
-            };
-        },
-    };
-}
-//# sourceMappingURL=sandbox-backend-macos.js.map

package/dist/sandbox-backend-macos.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-macos.js","sourceRoot":"","sources":["../src/sandbox-backend-macos.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,OAA2C;IAC9D,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CACvF,CAAC;IAEF,OAAO;QACL,aAAa;QACb,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,kBAAkB;QAClB,gBAAgB;QAChB,GAAG,aAAa;KACjB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgC;IAC5D,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;YACpC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,8FAA8F;SACjG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;QACpC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,kFAAkF;KAC3F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAEpE,OAAO;QACL,EAAE,EAAE,mBAAmB,CAAC,KAAK;QAC7B,gBAAgB,CAAC,OAAgC;YAC/C,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACzC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;gBACpC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC;aACrC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox-backend-windows.d.ts

@@ -1,6 +0,0 @@
-import { type SandboxBackend } from './sandbox-profile.js';
-export interface WindowsSandboxBackendOptions {
-    commandExists?: (binary: string) => boolean;
-}
-export declare function createWindowsSandboxBackend(_options?: WindowsSandboxBackendOptions): SandboxBackend;
-//# sourceMappingURL=sandbox-backend-windows.d.ts.map

package/dist/sandbox-backend-windows.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-windows.d.ts","sourceRoot":"","sources":["../src/sandbox-backend-windows.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAyBD,wBAAgB,2BAA2B,CACzC,QAAQ,GAAE,4BAAiC,GAC1C,cAAc,CAOhB"}

package/dist/sandbox-backend-windows.js

@@ -1,30 +0,0 @@
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-import { SANDBOX_BACKEND_IDS, } from './sandbox-profile.js';
-const WINDOWS_ENFORCEMENT_UNAVAILABLE_REASON = 'Windows sandbox backend unavailable: write enforcement is not yet available on Windows.';
-const WINDOWS_ENFORCEMENT_UNAVAILABLE_WARNING = 'Running unsandboxed because write enforcement is not yet available on Windows and fallback was explicitly enabled.';
-function buildNotImplementedPlan(request) {
-    if (request.allowUnsandboxedFallback) {
-        return {
-            backendId: SANDBOX_BACKEND_IDS.WINDOWS,
-            enforced: false,
-            failClosed: false,
-            warning: WINDOWS_ENFORCEMENT_UNAVAILABLE_WARNING,
-        };
-    }
-    return {
-        backendId: SANDBOX_BACKEND_IDS.WINDOWS,
-        enforced: false,
-        failClosed: true,
-        reason: WINDOWS_ENFORCEMENT_UNAVAILABLE_REASON,
-    };
-}
-export function createWindowsSandboxBackend(_options = {}) {
-    return {
-        id: SANDBOX_BACKEND_IDS.WINDOWS,
-        resolveExecution(request) {
-            return buildNotImplementedPlan(request);
-        },
-    };
-}
-//# sourceMappingURL=sandbox-backend-windows.js.map

package/dist/sandbox-backend-windows.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-backend-windows.js","sourceRoot":"","sources":["../src/sandbox-backend-windows.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EACL,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,sCAAsC,GAC1C,yFAAyF,CAAC;AAC5F,MAAM,uCAAuC,GAC3C,oHAAoH,CAAC;AAEvH,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,mBAAmB,CAAC,OAAO;YACtC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,uCAAuC;SACjD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,mBAAmB,CAAC,OAAO;QACtC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,sCAAsC;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAAyC,EAAE;IAE3C,OAAO;QACL,EAAE,EAAE,mBAAmB,CAAC,OAAO;QAC/B,gBAAgB,CAAC,OAAgC;YAC/C,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox-profile.d.ts

@@ -1,53 +0,0 @@
-import { type SandboxAllowlist } from './sandbox-allowlist.js';
-export declare const SANDBOX_BACKEND_IDS: {
-    readonly LINUX: "linux";
-    readonly MACOS: "macos";
-    readonly WINDOWS: "windows";
-    readonly UNSUPPORTED: "unsupported";
-};
-export type SandboxBackendId = (typeof SANDBOX_BACKEND_IDS)[keyof typeof SANDBOX_BACKEND_IDS];
-export interface SandboxProfile {
-    projectRoot: string;
-    worktreePath: string;
-    wuId: string;
-    wuYamlPath: string;
-    statePath: string;
-    tempPath: string;
-    allowlist: SandboxAllowlist;
-}
-export interface BuildSandboxProfileInput {
-    projectRoot: string;
-    worktreePath: string;
-    wuId: string;
-    tempPath?: string;
-    extraWritableRoots?: string[];
-}
-export interface SandboxBackendResolution {
-    id: SandboxBackendId;
-    platform: NodeJS.Platform | string;
-    supported: boolean;
-}
-export interface SandboxInvocation {
-    command: string;
-    args: string[];
-}
-export interface SandboxExecutionRequest {
-    profile: SandboxProfile;
-    command: string[];
-    allowUnsandboxedFallback: boolean;
-}
-export interface SandboxExecutionPlan {
-    backendId: SandboxBackendId;
-    enforced: boolean;
-    failClosed: boolean;
-    invocation?: SandboxInvocation;
-    reason?: string;
-    warning?: string;
-}
-export interface SandboxBackend {
-    id: SandboxBackendId;
-    resolveExecution: (request: SandboxExecutionRequest) => SandboxExecutionPlan;
-}
-export declare function buildSandboxProfile(input: BuildSandboxProfileInput): SandboxProfile;
-export declare function resolveSandboxBackendForPlatform(platform?: NodeJS.Platform | string): SandboxBackendResolution;
-//# sourceMappingURL=sandbox-profile.d.ts.map

package/dist/sandbox-profile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-profile.d.ts","sourceRoot":"","sources":["../src/sandbox-profile.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAGhC,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE9F,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,gBAAgB,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,gBAAgB,CAAC;IACrB,gBAAgB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,oBAAoB,CAAC;CAC9E;AAmBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,cAAc,CAkCnF;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GACpD,wBAAwB,CAc1B"}

package/dist/sandbox-profile.js

@@ -1,64 +0,0 @@
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-import os from 'node:os';
-import path from 'node:path';
-import { buildSandboxAllowlist, } from './sandbox-allowlist.js';
-import { DIRECTORIES, LUMENFLOW_PATHS } from './wu-constants.js';
-export const SANDBOX_BACKEND_IDS = {
-    LINUX: 'linux',
-    MACOS: 'macos',
-    WINDOWS: 'windows',
-    UNSUPPORTED: 'unsupported',
-};
-function resolveWorktreePath(projectRoot, worktreePath) {
-    if (path.isAbsolute(worktreePath)) {
-        return path.resolve(worktreePath);
-    }
-    return path.resolve(projectRoot, worktreePath);
-}
-function buildDefaultWritableRoots(profile) {
-    return [profile.worktreePath, profile.statePath, profile.wuYamlPath, profile.tempPath];
-}
-export function buildSandboxProfile(input) {
-    const projectRoot = path.resolve(input.projectRoot);
-    const worktreePath = resolveWorktreePath(projectRoot, input.worktreePath);
-    const wuYamlPath = path.resolve(projectRoot, DIRECTORIES.WU_DIR, `${input.wuId}.yaml`);
-    const statePath = path.resolve(projectRoot, LUMENFLOW_PATHS.STATE_DIR);
-    const tempPath = path.resolve(input.tempPath || os.tmpdir());
-    const writableRoots = buildDefaultWritableRoots({
-        worktreePath,
-        statePath,
-        wuYamlPath,
-        tempPath,
-    });
-    if (input.extraWritableRoots && input.extraWritableRoots.length > 0) {
-        writableRoots.push(...input.extraWritableRoots);
-    }
-    const allowlistInput = {
-        projectRoot,
-        writableRoots,
-    };
-    const allowlist = buildSandboxAllowlist(allowlistInput);
-    return {
-        projectRoot,
-        worktreePath,
-        wuId: input.wuId,
-        wuYamlPath,
-        statePath,
-        tempPath,
-        allowlist,
-    };
-}
-export function resolveSandboxBackendForPlatform(platform = process.platform) {
-    if (platform === 'linux') {
-        return { id: SANDBOX_BACKEND_IDS.LINUX, platform, supported: true };
-    }
-    if (platform === 'darwin') {
-        return { id: SANDBOX_BACKEND_IDS.MACOS, platform, supported: true };
-    }
-    if (platform === 'win32') {
-        return { id: SANDBOX_BACKEND_IDS.WINDOWS, platform, supported: true };
-    }
-    return { id: SANDBOX_BACKEND_IDS.UNSUPPORTED, platform, supported: false };
-}
-//# sourceMappingURL=sandbox-profile.js.map

package/dist/sandbox-profile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-profile.js","sourceRoot":"","sources":["../src/sandbox-profile.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;CAClB,CAAC;AAqDX,SAAS,mBAAmB,CAAC,WAAmB,EAAE,YAAoB;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,yBAAyB,CAAC,OAKlC;IACC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7D,MAAM,aAAa,GAAG,yBAAyB,CAAC;QAC9C,YAAY;QACZ,SAAS;QACT,UAAU;QACV,QAAQ;KACT,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAA+B;QACjD,WAAW;QACX,aAAa;KACd,CAAC;IAEF,MAAM,SAAS,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAExD,OAAO;QACL,WAAW;QACX,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU;QACV,SAAS;QACT,QAAQ;QACR,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,WAAqC,OAAO,CAAC,QAAQ;IAErD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC"}

package/dist/schemas/arg-validators.d.ts

@@ -1,58 +0,0 @@
-/**
- * @file arg-validators.ts
- * @description CLI argument validators using shared schemas (WU-1431)
- *
- * These validators use the shared Zod schemas to validate CLI arguments.
- * They handle:
- * - CLI-only alias mapping (codePath -> code_paths, manualTest -> test_paths_manual)
- * - Conditional validation (skip_gates requires reason)
- * - Normalized output for consistent downstream processing
- */
-import { type WuCreateInput, type WuClaimInput, type WuStatusInput, type WuDoneInput, type GatesInput } from './command-schemas.js';
-/**
- * Validation result with normalized data
- */
-export interface ValidationResult<T> {
-    valid: boolean;
-    errors: string[];
-    warnings: string[];
-    normalized: T;
-}
-/**
- * Validate wu:create arguments
- *
- * @param args - Raw CLI arguments
- * @returns Validation result with normalized WuCreateInput
- */
-export declare function validateWuCreateArgs(args: Record<string, unknown>): ValidationResult<WuCreateInput>;
-/**
- * Validate wu:claim arguments
- *
- * @param args - Raw CLI arguments
- * @returns Validation result with normalized WuClaimInput
- */
-export declare function validateWuClaimArgs(args: Record<string, unknown>): ValidationResult<WuClaimInput>;
-/**
- * Validate wu:status arguments
- *
- * @param args - Raw CLI arguments
- * @returns Validation result with normalized WuStatusInput
- */
-export declare function validateWuStatusArgs(args: Record<string, unknown>): ValidationResult<WuStatusInput>;
-/**
- * Validate wu:done arguments
- *
- * Includes additional validation: skip_gates requires reason
- *
- * @param args - Raw CLI arguments
- * @returns Validation result with normalized WuDoneInput
- */
-export declare function validateWuDoneArgs(args: Record<string, unknown>): ValidationResult<WuDoneInput>;
-/**
- * Validate gates arguments
- *
- * @param args - Raw CLI arguments
- * @returns Validation result with normalized GatesInput
- */
-export declare function validateGatesArgs(args: Record<string, unknown>): ValidationResult<GatesInput>;
-//# sourceMappingURL=arg-validators.d.ts.map

package/dist/schemas/arg-validators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"arg-validators.d.ts","sourceRoot":"","sources":["../../src/schemas/arg-validators.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAO9B;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,CAAC;CACf;AA+ED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB,CAAC,aAAa,CAAC,CAmBjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAkBjG;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB,CAAC,aAAa,CAAC,CAkBjC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAwB/F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAkB7F"}