@lumenflow/packs-software-delivery 4.24.0 → 5.0.0

package/dist/src/runtime/work-classifier.js

@@ -0,0 +1,427 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Signal-Based Work Classifier
+ *
+ * WU-1899: Determines work domain (ui/backend/docs/infra/mixed) from
+ * multiple weighted signals: code_paths patterns (weight 1.0), lane hints
+ * (0.6), type (0.3), description keywords (0.2).
+ *
+ * Returns abstract capability tags (not client skill names) for
+ * vendor-agnostic design. Configurable via methodology.work_classification
+ * in workspace.yaml with sensible built-in defaults.
+ *
+ * @module work-classifier
+ */
+import { minimatch } from 'minimatch';
+// ─── Constants ───────────────────────────────────────────────────────
+/**
+ * Work domain enum-style constants
+ */
+export const WORK_DOMAINS = {
+    UI: 'ui',
+    BACKEND: 'backend',
+    DOCS: 'docs',
+    INFRA: 'infra',
+    MIXED: 'mixed',
+};
+/**
+ * Classifier-produced methodology hints consumed by prompt guidance builders.
+ */
+export const TEST_METHODOLOGY_HINTS = {
+    SMOKE_TEST: 'smoke-test',
+    STRUCTURED_CONTENT: 'structured-content',
+};
+/**
+ * Signal weights for each source type.
+ * Confidence = max(matched_signal_weights), not sum.
+ */
+export const SIGNAL_WEIGHTS = {
+    CODE_PATHS: 1.0,
+    LANE: 0.6,
+    TYPE: 0.3,
+    DESCRIPTION: 0.2,
+};
+/**
+ * Confidence threshold: domain only assigned when max signal weight >= this.
+ */
+const CONFIDENCE_THRESHOLD = 0.3;
+/**
+ * Smoke-test hint threshold: testMethodologyHint only assigned when
+ * UI confidence >= this value.
+ */
+const SMOKE_TEST_THRESHOLD = 0.5;
+/**
+ * Structured-content patterns used to detect non-code work.
+ *
+ * When all code_paths match these patterns, classifier emits
+ * testMethodologyHint: 'structured-content' to avoid forcing TDD
+ * for content/config-only changes.
+ */
+const STRUCTURED_CONTENT_CODE_PATH_PATTERNS = Object.freeze([
+    '**/*.yaml',
+    '**/*.yml',
+    '**/*.json',
+    '**/*.md',
+    '**/*.mdx',
+]);
+// ─── Default Patterns ────────────────────────────────────────────────
+/**
+ * Built-in default UI code path patterns (minimatch glob patterns).
+ * CSS/SCSS/LESS, components/pages directories, app page/layout files,
+ * module CSS, styled components.
+ */
+export const DEFAULT_UI_CODE_PATH_PATTERNS = Object.freeze([
+    // Stylesheets
+    '**/*.css',
+    '**/*.scss',
+    '**/*.less',
+    '**/*.module.css',
+    '**/*.module.scss',
+    // Styled components
+    '**/*.styled.ts',
+    '**/*.styled.tsx',
+    '**/*.styled.js',
+    '**/*.styled.jsx',
+    // Component / page directories
+    '**/components/**',
+    '**/pages/**',
+]);
+/**
+ * Built-in default UI lane hints.
+ * Matched against the lane parent (part before the colon).
+ */
+export const DEFAULT_UI_LANE_HINTS = Object.freeze([
+    'Experience',
+    'Frontend',
+    'UI',
+    'Design',
+]);
+/**
+ * Built-in docs code path patterns.
+ */
+const DEFAULT_DOCS_CODE_PATH_PATTERNS = Object.freeze([
+    'docs/**',
+    '**/*.md',
+    '**/*.mdx',
+    'README*',
+    'CHANGELOG*',
+]);
+/**
+ * Built-in docs lane hints.
+ */
+const DEFAULT_DOCS_LANE_HINTS = Object.freeze([
+    'Content',
+    'Documentation',
+    'Docs',
+]);
+/**
+ * Built-in infra code path patterns.
+ */
+const DEFAULT_INFRA_CODE_PATH_PATTERNS = Object.freeze([
+    '.github/**',
+    'Dockerfile*',
+    'docker-compose*',
+    '**/terraform/**',
+    '**/k8s/**',
+    '**/kubernetes/**',
+    'infrastructure/**',
+]);
+/**
+ * Built-in infra lane hints.
+ */
+const DEFAULT_INFRA_LANE_HINTS = Object.freeze([
+    'Operations',
+    'Infrastructure',
+    'DevOps',
+    'Platform',
+]);
+/**
+ * UI-related description keywords (case-insensitive).
+ */
+const UI_DESCRIPTION_KEYWORDS = Object.freeze([
+    'css',
+    'scss',
+    'less',
+    'stylesheet',
+    'component',
+    'layout',
+    'responsive',
+    'ui',
+    'frontend',
+    'styled',
+    'animation',
+    'theme',
+]);
+/**
+ * Docs-related description keywords (case-insensitive).
+ */
+const DOCS_DESCRIPTION_KEYWORDS = Object.freeze([
+    'documentation',
+    'readme',
+    'changelog',
+    'docs',
+    'guide',
+    'tutorial',
+]);
+/**
+ * Infra-related description keywords (case-insensitive).
+ */
+const INFRA_DESCRIPTION_KEYWORDS = Object.freeze([
+    'docker',
+    'kubernetes',
+    'terraform',
+    'ci/cd',
+    'pipeline',
+    'deploy',
+    'infrastructure',
+]);
+function createDomainSignals(domain) {
+    return { domain, maxWeight: 0, signals: [] };
+}
+function addSignal(ds, signal) {
+    ds.signals.push(signal);
+    if (signal.weight > ds.maxWeight) {
+        ds.maxWeight = signal.weight;
+    }
+}
+/**
+ * Check if any code_paths match a set of glob patterns.
+ */
+function matchCodePaths(codePaths, patterns) {
+    for (const path of codePaths) {
+        for (const pattern of patterns) {
+            if (minimatch(path, pattern)) {
+                return pattern;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Check whether all code_paths are structured content (yaml/json/markdown).
+ */
+function isStructuredContentOnly(codePaths) {
+    return (codePaths.length > 0 &&
+        codePaths.every((path) => STRUCTURED_CONTENT_CODE_PATH_PATTERNS.some((pattern) => minimatch(path, pattern, { nocase: true }))));
+}
+/**
+ * Check if the lane parent matches any hints (case-insensitive).
+ */
+function matchLaneHint(lane, hints) {
+    const parts = lane.split(':');
+    const laneParent = (parts[0] ?? '').trim().toLowerCase();
+    const laneSublane = parts.length > 1 ? (parts[1] ?? '').trim().toLowerCase() : '';
+    for (const hint of hints) {
+        const hintLower = hint.toLowerCase();
+        if (laneParent === hintLower || laneSublane === hintLower) {
+            return hint;
+        }
+    }
+    return undefined;
+}
+/**
+ * Check if description contains any keywords (case-insensitive, word boundary).
+ */
+function matchDescriptionKeywords(description, keywords) {
+    const descLower = description.toLowerCase();
+    for (const keyword of keywords) {
+        if (descLower.includes(keyword.toLowerCase())) {
+            return keyword;
+        }
+    }
+    return undefined;
+}
+/**
+ * Domain-to-capabilities data map (OCP-compliant).
+ * Add new domains by extending the record, no switch modification needed.
+ */
+const DOMAIN_CAPABILITIES = {
+    [WORK_DOMAINS.UI]: ['ui-design-awareness', 'component-reuse-check'],
+    [WORK_DOMAINS.DOCS]: ['documentation-structure', 'link-validation'],
+    [WORK_DOMAINS.INFRA]: ['infrastructure-review', 'security-check'],
+    [WORK_DOMAINS.MIXED]: ['cross-domain-awareness'],
+    [WORK_DOMAINS.BACKEND]: [],
+};
+/**
+ * Map work domain to capabilities (abstract, vendor-agnostic).
+ */
+function getCapabilities(domain) {
+    return DOMAIN_CAPABILITIES[domain] ?? [];
+}
+// ─── Public API ──────────────────────────────────────────────────────
+/**
+ * Classify work domain from multiple weighted signals.
+ *
+ * Signal weights:
+ * - code_paths patterns: 1.0
+ * - lane hints: 0.6
+ * - WU type: 0.3
+ * - description keywords: 0.2
+ *
+ * Confidence = max(matched signal weights for winning domain).
+ * Domain only assigned when confidence >= 0.3.
+ *
+ * @param doc - WU document (code_paths, lane, type, description)
+ * @param config - Optional config to extend default patterns
+ * @returns WorkClassification with domain, confidence, signals, capabilities, testMethodologyHint
+ */
+export function classifyWork(doc, config) {
+    const codePaths = doc.code_paths ?? [];
+    const lane = doc.lane ?? '';
+    const type = doc.type ?? '';
+    const description = doc.description ?? '';
+    const structuredContentOnly = isStructuredContentOnly(codePaths);
+    // Merge config patterns with defaults (config extends, not replaces)
+    const uiCodePathPatterns = [
+        ...DEFAULT_UI_CODE_PATH_PATTERNS,
+        ...(config?.ui?.code_path_patterns ?? []),
+    ];
+    const uiLaneHints = [...DEFAULT_UI_LANE_HINTS, ...(config?.ui?.lane_hints ?? [])];
+    // Collect signals per domain
+    const ui = createDomainSignals(WORK_DOMAINS.UI);
+    const docs = createDomainSignals(WORK_DOMAINS.DOCS);
+    const infra = createDomainSignals(WORK_DOMAINS.INFRA);
+    // ── Signal 1: code_paths (weight 1.0) ──
+    if (codePaths.length > 0) {
+        const uiMatch = matchCodePaths(codePaths, uiCodePathPatterns);
+        if (uiMatch) {
+            addSignal(ui, {
+                source: 'code_paths',
+                domain: WORK_DOMAINS.UI,
+                weight: SIGNAL_WEIGHTS.CODE_PATHS,
+                match: uiMatch,
+            });
+        }
+        const docsMatch = matchCodePaths(codePaths, DEFAULT_DOCS_CODE_PATH_PATTERNS);
+        if (docsMatch) {
+            addSignal(docs, {
+                source: 'code_paths',
+                domain: WORK_DOMAINS.DOCS,
+                weight: SIGNAL_WEIGHTS.CODE_PATHS,
+                match: docsMatch,
+            });
+        }
+        const infraMatch = matchCodePaths(codePaths, DEFAULT_INFRA_CODE_PATH_PATTERNS);
+        if (infraMatch) {
+            addSignal(infra, {
+                source: 'code_paths',
+                domain: WORK_DOMAINS.INFRA,
+                weight: SIGNAL_WEIGHTS.CODE_PATHS,
+                match: infraMatch,
+            });
+        }
+    }
+    // ── Signal 2: lane hints (weight 0.6) ──
+    if (lane) {
+        const uiLaneMatch = matchLaneHint(lane, uiLaneHints);
+        if (uiLaneMatch) {
+            addSignal(ui, {
+                source: 'lane',
+                domain: WORK_DOMAINS.UI,
+                weight: SIGNAL_WEIGHTS.LANE,
+                match: uiLaneMatch,
+            });
+        }
+        const docsLaneMatch = matchLaneHint(lane, DEFAULT_DOCS_LANE_HINTS);
+        if (docsLaneMatch) {
+            addSignal(docs, {
+                source: 'lane',
+                domain: WORK_DOMAINS.DOCS,
+                weight: SIGNAL_WEIGHTS.LANE,
+                match: docsLaneMatch,
+            });
+        }
+        const infraLaneMatch = matchLaneHint(lane, DEFAULT_INFRA_LANE_HINTS);
+        if (infraLaneMatch) {
+            addSignal(infra, {
+                source: 'lane',
+                domain: WORK_DOMAINS.INFRA,
+                weight: SIGNAL_WEIGHTS.LANE,
+                match: infraLaneMatch,
+            });
+        }
+    }
+    // ── Signal 3: WU type (weight 0.3) ──
+    if (type === 'documentation') {
+        addSignal(docs, {
+            source: 'type',
+            domain: WORK_DOMAINS.DOCS,
+            weight: SIGNAL_WEIGHTS.TYPE,
+            match: 'documentation',
+        });
+    }
+    // ── Signal 4: description keywords (weight 0.2) ──
+    if (description) {
+        const uiKeywordMatch = matchDescriptionKeywords(description, UI_DESCRIPTION_KEYWORDS);
+        if (uiKeywordMatch) {
+            addSignal(ui, {
+                source: 'description',
+                domain: WORK_DOMAINS.UI,
+                weight: SIGNAL_WEIGHTS.DESCRIPTION,
+                match: uiKeywordMatch,
+            });
+        }
+        const docsKeywordMatch = matchDescriptionKeywords(description, DOCS_DESCRIPTION_KEYWORDS);
+        if (docsKeywordMatch) {
+            addSignal(docs, {
+                source: 'description',
+                domain: WORK_DOMAINS.DOCS,
+                weight: SIGNAL_WEIGHTS.DESCRIPTION,
+                match: docsKeywordMatch,
+            });
+        }
+        const infraKeywordMatch = matchDescriptionKeywords(description, INFRA_DESCRIPTION_KEYWORDS);
+        if (infraKeywordMatch) {
+            addSignal(infra, {
+                source: 'description',
+                domain: WORK_DOMAINS.INFRA,
+                weight: SIGNAL_WEIGHTS.DESCRIPTION,
+                match: infraKeywordMatch,
+            });
+        }
+    }
+    // ── Determine winning domain ──
+    const candidates = [ui, docs, infra].filter((d) => d.maxWeight >= CONFIDENCE_THRESHOLD);
+    // Check for mixed: multiple domains with strong code_paths signals
+    const strongCodePathDomains = [ui, docs, infra].filter((d) => d.signals.some((s) => s.source === 'code_paths'));
+    if (strongCodePathDomains.length > 1) {
+        // Multiple code_paths domains detected - classify as mixed
+        const allSignals = strongCodePathDomains.flatMap((d) => d.signals);
+        return {
+            domain: WORK_DOMAINS.MIXED,
+            confidence: Math.max(...strongCodePathDomains.map((d) => d.maxWeight)),
+            signals: allSignals,
+            capabilities: getCapabilities(WORK_DOMAINS.MIXED),
+            testMethodologyHint: undefined,
+        };
+    }
+    if (candidates.length === 0) {
+        // No signals above threshold - default to backend
+        return {
+            domain: WORK_DOMAINS.BACKEND,
+            confidence: 0,
+            signals: [],
+            capabilities: [],
+            testMethodologyHint: structuredContentOnly
+                ? TEST_METHODOLOGY_HINTS.STRUCTURED_CONTENT
+                : undefined,
+        };
+    }
+    // Pick the domain with highest max weight
+    candidates.sort((a, b) => b.maxWeight - a.maxWeight);
+    const winner = candidates[0];
+    const testMethodologyHint = winner.domain === WORK_DOMAINS.UI && winner.maxWeight >= SMOKE_TEST_THRESHOLD
+        ? TEST_METHODOLOGY_HINTS.SMOKE_TEST
+        : structuredContentOnly
+            ? TEST_METHODOLOGY_HINTS.STRUCTURED_CONTENT
+            : undefined;
+    return {
+        domain: winner.domain,
+        confidence: winner.maxWeight,
+        signals: winner.signals,
+        capabilities: getCapabilities(winner.domain),
+        testMethodologyHint,
+    };
+}
+//# sourceMappingURL=work-classifier.js.map

package/dist/src/runtime/work-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-classifier.js","sourceRoot":"","sources":["../../../src/runtime/work-classifier.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,wEAAwE;AAExE;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,EAAE,IAAI;IACR,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACN,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU,EAAE,YAAY;IACxB,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,GAAG;CACR,CAAC;AAEX;;GAEG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;GAGG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,qCAAqC,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7E,WAAW;IACX,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,cAAc;IACd,UAAU;IACV,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,+BAA+B;IAC/B,kBAAkB;IAClB,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,YAAY;IACZ,UAAU;IACV,IAAI;IACJ,QAAQ;CACT,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,+BAA+B,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,SAAS;IACT,SAAS;IACT,UAAU;IACV,SAAS;IACT,YAAY;CACb,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/D,SAAS;IACT,eAAe;IACf,MAAM;CACP,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,gCAAgC,GAAsB,MAAM,CAAC,MAAM,CAAC;IACxE,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAChE,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/D,KAAK;IACL,MAAM;IACN,MAAM;IACN,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,QAAQ;IACR,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,yBAAyB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,eAAe;IACf,QAAQ;IACR,WAAW;IACX,MAAM;IACN,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,0BAA0B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,OAAO;IACP,UAAU;IACV,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC;AA0DH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,EAAiB,EAAE,MAAkB;IACtD,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,SAAmB,EAAE,QAA2B;IACtE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC7B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,SAAmB;IAClD,OAAO,CACL,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,qCAAqC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACrD,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC3C,CACF,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAElF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAC/B,WAAmB,EACnB,QAA2B;IAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAiC;IACxD,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;IACnE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;IACnE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;IACjE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC;IAChD,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE;CAC3B,CAAC;AAEF;;GAEG;AACH,SAAS,eAAe,CAAC,MAAkB;IACzC,OAAO,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,GAKC,EACD,MAAiC;IAEjC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC1C,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAEjE,qEAAqE;IACrE,MAAM,kBAAkB,GAAG;QACzB,GAAG,6BAA6B;QAChC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,kBAAkB,IAAI,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAElF,6BAA6B;IAC7B,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEtD,0CAA0C;IAE1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,EAAE,EAAE;gBACZ,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,YAAY,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc,CAAC,UAAU;gBACjC,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;QAC7E,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,EAAE;gBACd,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,YAAY,CAAC,IAAI;gBACzB,MAAM,EAAE,cAAc,CAAC,UAAU;gBACjC,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAC/E,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,CAAC,KAAK,EAAE;gBACf,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,YAAY,CAAC,KAAK;gBAC1B,MAAM,EAAE,cAAc,CAAC,UAAU;gBACjC,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAE1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,EAAE,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,YAAY,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc,CAAC,IAAI;gBAC3B,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,SAAS,CAAC,IAAI,EAAE;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,YAAY,CAAC,IAAI;gBACzB,MAAM,EAAE,cAAc,CAAC,IAAI;gBAC3B,KAAK,EAAE,aAAa;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACrE,IAAI,cAAc,EAAE,CAAC;YACnB,SAAS,CAAC,KAAK,EAAE;gBACf,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,YAAY,CAAC,KAAK;gBAC1B,MAAM,EAAE,cAAc,CAAC,IAAI;gBAC3B,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uCAAuC;IAEvC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,EAAE;YACd,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,CAAC,IAAI;YACzB,MAAM,EAAE,cAAc,CAAC,IAAI;YAC3B,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IAEpD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,cAAc,GAAG,wBAAwB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACtF,IAAI,cAAc,EAAE,CAAC;YACnB,SAAS,CAAC,EAAE,EAAE;gBACZ,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,YAAY,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc,CAAC,WAAW;gBAClC,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC1F,IAAI,gBAAgB,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,EAAE;gBACd,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,YAAY,CAAC,IAAI;gBACzB,MAAM,EAAE,cAAc,CAAC,WAAW;gBAClC,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;QAC5F,IAAI,iBAAiB,EAAE,CAAC;YACtB,SAAS,CAAC,KAAK,EAAE;gBACf,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,YAAY,CAAC,KAAK;gBAC1B,MAAM,EAAE,cAAc,CAAC,WAAW;gBAClC,KAAK,EAAE,iBAAiB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IAEjC,MAAM,UAAU,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAC;IAExF,mEAAmE;IACnE,MAAM,qBAAqB,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CACjD,CAAC;IAEF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,2DAA2D;QAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,KAAK;YAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtE,OAAO,EAAE,UAAU;YACnB,YAAY,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC;YACjD,mBAAmB,EAAE,SAAS;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,kDAAkD;QAClD,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,EAAE;YAChB,mBAAmB,EAAE,qBAAqB;gBACxC,CAAC,CAAC,sBAAsB,CAAC,kBAAkB;gBAC3C,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAkB,CAAC;IAE9C,MAAM,mBAAmB,GACvB,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,oBAAoB;QAC3E,CAAC,CAAC,sBAAsB,CAAC,UAAU;QACnC,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,sBAAsB,CAAC,kBAAkB;YAC3C,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/src/sandbox/index.d.ts

@@ -0,0 +1,6 @@
+export * from './sandbox-allowlist.js';
+export * from './sandbox-profile.js';
+export * from './sandbox-backend-linux.js';
+export * from './sandbox-backend-macos.js';
+export * from './sandbox-backend-windows.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sandbox/index.ts"],"names":[],"mappings":"AAKA,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC"}

package/dist/src/sandbox/index.js

@@ -0,0 +1,10 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+// Barrel for pack-local sandbox modules. Populated by Layer 4 of INIT-058.
+// WU-2678: moved sandbox-profile, sandbox-allowlist, sandbox-backend-{linux,macos,windows} from @lumenflow/core.
+export * from './sandbox-allowlist.js';
+export * from './sandbox-profile.js';
+export * from './sandbox-backend-linux.js';
+export * from './sandbox-backend-macos.js';
+export * from './sandbox-backend-windows.js';
+//# sourceMappingURL=index.js.map

package/dist/src/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,2EAA2E;AAC3E,iHAAiH;AACjH,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC"}

package/dist/src/sandbox/sandbox-allowlist.d.ts

@@ -0,0 +1,16 @@
+export interface SandboxAllowlistEntry {
+    originalPath: string;
+    normalizedPath: string;
+    canonicalPath: string;
+}
+export interface SandboxAllowlist {
+    projectRoot: string;
+    writableRoots: SandboxAllowlistEntry[];
+}
+export interface BuildSandboxAllowlistInput {
+    projectRoot: string;
+    writableRoots: string[];
+}
+export declare function buildSandboxAllowlist(input: BuildSandboxAllowlistInput): SandboxAllowlist;
+export declare function isWritePathAllowed(allowlist: SandboxAllowlist, targetPath: string): boolean;
+//# sourceMappingURL=sandbox-allowlist.d.ts.map

package/dist/src/sandbox/sandbox-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-allowlist.d.ts","sourceRoot":"","sources":["../../../src/sandbox/sandbox-allowlist.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,qBAAqB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAkED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,gBAAgB,CAgBzF;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAa3F"}

package/dist/src/sandbox/sandbox-allowlist.js

@@ -0,0 +1,77 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+import fs from 'node:fs';
+import path from 'node:path';
+function normalizeAbsolutePath(targetPath) {
+    const normalized = path.resolve(targetPath);
+    if (normalized.length > 1 && normalized.endsWith(path.sep)) {
+        return normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function toComparisonKey(targetPath) {
+    return process.platform === 'win32' ? targetPath.toLowerCase() : targetPath;
+}
+function findNearestExistingAncestor(targetPath) {
+    let cursor = normalizeAbsolutePath(targetPath);
+    const suffixParts = [];
+    while (!fs.existsSync(cursor)) {
+        const parent = path.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        suffixParts.unshift(path.basename(cursor));
+        cursor = parent;
+    }
+    return { ancestor: cursor, suffixParts };
+}
+function resolveCanonicalPathForWrite(targetPath) {
+    const normalized = normalizeAbsolutePath(targetPath);
+    if (fs.existsSync(normalized)) {
+        return normalizeAbsolutePath(fs.realpathSync.native(normalized));
+    }
+    const { ancestor, suffixParts } = findNearestExistingAncestor(normalized);
+    const canonicalAncestor = fs.existsSync(ancestor)
+        ? normalizeAbsolutePath(fs.realpathSync.native(ancestor))
+        : normalizeAbsolutePath(ancestor);
+    return normalizeAbsolutePath(path.join(canonicalAncestor, ...suffixParts));
+}
+function resolveRoot(projectRoot, writableRoot) {
+    if (path.isAbsolute(writableRoot)) {
+        return normalizeAbsolutePath(writableRoot);
+    }
+    return normalizeAbsolutePath(path.resolve(projectRoot, writableRoot));
+}
+function isWithinRoot(candidatePath, rootPath) {
+    const candidateKey = toComparisonKey(candidatePath);
+    const rootKey = toComparisonKey(rootPath);
+    return candidateKey === rootKey || candidateKey.startsWith(`${rootKey}${path.sep}`);
+}
+export function buildSandboxAllowlist(input) {
+    const projectRoot = normalizeAbsolutePath(input.projectRoot);
+    const writableRoots = input.writableRoots.map((writableRoot) => {
+        const normalizedPath = resolveRoot(projectRoot, writableRoot);
+        return {
+            originalPath: writableRoot,
+            normalizedPath,
+            canonicalPath: resolveCanonicalPathForWrite(normalizedPath),
+        };
+    });
+    return {
+        projectRoot,
+        writableRoots,
+    };
+}
+export function isWritePathAllowed(allowlist, targetPath) {
+    const normalizedTargetPath = normalizeAbsolutePath(targetPath);
+    const canonicalTargetPath = resolveCanonicalPathForWrite(normalizedTargetPath);
+    return allowlist.writableRoots.some((entry) => {
+        const normalizedMatch = isWithinRoot(normalizedTargetPath, entry.normalizedPath);
+        const canonicalMatch = isWithinRoot(canonicalTargetPath, entry.canonicalPath);
+        // Require both checks:
+        // - normalized path guards lexical traversal tricks (../)
+        // - canonical path guards symlink escapes to outside the allowed root
+        return normalizedMatch && canonicalMatch;
+    });
+}
+//# sourceMappingURL=sandbox-allowlist.js.map

package/dist/src/sandbox/sandbox-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-allowlist.js","sourceRoot":"","sources":["../../../src/sandbox/sandbox-allowlist.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAkB7B,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IAIrD,IAAI,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM;QACR,CAAC;QAED,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAkB;IACtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAErD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/C,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,YAAoB;IAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,aAAqB,EAAE,QAAgB;IAC3D,MAAM,YAAY,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE1C,OAAO,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAE9D,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc;YACd,aAAa,EAAE,4BAA4B,CAAC,cAAc,CAAC;SAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAA2B,EAAE,UAAkB;IAChF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IAE/E,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,eAAe,GAAG,YAAY,CAAC,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9E,uBAAuB;QACvB,0DAA0D;QAC1D,sEAAsE;QACtE,OAAO,eAAe,IAAI,cAAc,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/sandbox/sandbox-backend-linux.d.ts

@@ -0,0 +1,6 @@
+import { type SandboxBackend } from './sandbox-profile.js';
+export interface LinuxSandboxBackendOptions {
+    commandExists?: (binary: string) => boolean;
+}
+export declare function createLinuxSandboxBackend(options?: LinuxSandboxBackendOptions): SandboxBackend;
+//# sourceMappingURL=sandbox-backend-linux.d.ts.map

package/dist/src/sandbox/sandbox-backend-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-backend-linux.d.ts","sourceRoot":"","sources":["../../../src/sandbox/sandbox-backend-linux.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAsDD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,cAAc,CAkBhB"}

package/dist/src/sandbox/sandbox-backend-linux.js

@@ -0,0 +1,67 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+import { spawnSync } from 'node:child_process';
+import { SANDBOX_BACKEND_IDS, } from './sandbox-profile.js';
+const LINUX_SANDBOX_BINARY = 'bwrap';
+function defaultCommandExists(binary) {
+    const probe = spawnSync(binary, ['--help'], { stdio: 'ignore' });
+    return !probe.error;
+}
+function buildUnavailablePlan(request) {
+    if (request.allowUnsandboxedFallback) {
+        return {
+            backendId: SANDBOX_BACKEND_IDS.LINUX,
+            enforced: false,
+            failClosed: false,
+            warning: 'Running unsandboxed because bwrap is unavailable and fallback was explicitly enabled.',
+        };
+    }
+    return {
+        backendId: SANDBOX_BACKEND_IDS.LINUX,
+        enforced: false,
+        failClosed: true,
+        reason: 'Linux sandbox backend unavailable: required binary "bwrap" was not found.',
+    };
+}
+function buildInvocation(request) {
+    const writableBinds = request.profile.allowlist.writableRoots.flatMap((entry) => [
+        '--bind',
+        entry.normalizedPath,
+        entry.normalizedPath,
+    ]);
+    return {
+        command: LINUX_SANDBOX_BINARY,
+        args: [
+            '--die-with-parent',
+            '--new-session',
+            '--ro-bind',
+            '/',
+            '/',
+            ...writableBinds,
+            '--proc',
+            '/proc',
+            '--dev',
+            '/dev',
+            '--',
+            ...request.command,
+        ],
+    };
+}
+export function createLinuxSandboxBackend(options = {}) {
+    const commandExists = options.commandExists || defaultCommandExists;
+    return {
+        id: SANDBOX_BACKEND_IDS.LINUX,
+        resolveExecution(request) {
+            if (!commandExists(LINUX_SANDBOX_BINARY)) {
+                return buildUnavailablePlan(request);
+            }
+            return {
+                backendId: SANDBOX_BACKEND_IDS.LINUX,
+                enforced: true,
+                failClosed: false,
+                invocation: buildInvocation(request),
+            };
+        },
+    };
+}
+//# sourceMappingURL=sandbox-backend-linux.js.map

package/dist/src/sandbox/sandbox-backend-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-backend-linux.js","sourceRoot":"","sources":["../../../src/sandbox/sandbox-backend-linux.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgC;IAC5D,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;YACpC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,uFAAuF;SAC1F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;QACpC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,2EAA2E;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/E,QAAQ;QACR,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,cAAc;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE;YACJ,mBAAmB;YACnB,eAAe;YACf,WAAW;YACX,GAAG;YACH,GAAG;YACH,GAAG,aAAa;YAChB,QAAQ;YACR,OAAO;YACP,OAAO;YACP,MAAM;YACN,IAAI;YACJ,GAAG,OAAO,CAAC,OAAO;SACnB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAEpE,OAAO;QACL,EAAE,EAAE,mBAAmB,CAAC,KAAK;QAC7B,gBAAgB,CAAC,OAAgC;YAC/C,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACzC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,mBAAmB,CAAC,KAAK;gBACpC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC;aACrC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/sandbox/sandbox-backend-macos.d.ts

@@ -0,0 +1,6 @@
+import { type SandboxBackend } from './sandbox-profile.js';
+export interface MacosSandboxBackendOptions {
+    commandExists?: (binary: string) => boolean;
+}
+export declare function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend;
+//# sourceMappingURL=sandbox-backend-macos.d.ts.map

package/dist/src/sandbox/sandbox-backend-macos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-backend-macos.d.ts","sourceRoot":"","sources":["../../../src/sandbox/sandbox-backend-macos.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAuHD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,cAAc,CAkBhB"}