@machina.ai/cell-cli 1.16.0-rc2 → 1.19.4-rc1

package/dist/src/utils/sandbox.test.js

@@ -0,0 +1,302 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { spawn, exec, execSync } from 'node:child_process';
+import os from 'node:os';
+import fs from 'node:fs';
+import { start_sandbox } from './sandbox.js';
+import { FatalSandboxError } from '@google/gemini-cli-core';
+import { EventEmitter } from 'node:events';
+vi.mock('../config/settings.js', () => ({
+    USER_SETTINGS_DIR: '/home/user/.cell-cli',
+}));
+vi.mock('node:child_process');
+vi.mock('node:os');
+vi.mock('node:fs');
+vi.mock('node:util', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        promisify: (fn) => {
+            if (fn === exec) {
+                return async (cmd) => {
+                    if (cmd === 'id -u' || cmd === 'id -g') {
+                        return { stdout: '1000', stderr: '' };
+                    }
+                    if (cmd.includes('curl')) {
+                        return { stdout: '', stderr: '' };
+                    }
+                    if (cmd.includes('getconf DARWIN_USER_CACHE_DIR')) {
+                        return { stdout: '/tmp/cache', stderr: '' };
+                    }
+                    if (cmd.includes('ps -a --format')) {
+                        return { stdout: 'existing-container', stderr: '' };
+                    }
+                    return { stdout: '', stderr: '' };
+                };
+            }
+            return actual.promisify(fn);
+        },
+    };
+});
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        debugLogger: {
+            log: vi.fn(),
+            debug: vi.fn(),
+            warn: vi.fn(),
+        },
+        coreEvents: {
+            emitFeedback: vi.fn(),
+        },
+        FatalSandboxError: class extends Error {
+            constructor(message) {
+                super(message);
+                this.name = 'FatalSandboxError';
+            }
+        },
+        CELL_DIR: '.cell-cli',
+        USER_SETTINGS_DIR: '/home/user/.cell-cli',
+    };
+});
+describe('sandbox', () => {
+    const originalEnv = process.env;
+    const originalArgv = process.argv;
+    let mockProcessIn;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        process.env = { ...originalEnv };
+        process.argv = [...originalArgv];
+        mockProcessIn = {
+            pause: vi.fn(),
+            resume: vi.fn(),
+            isTTY: true,
+        };
+        Object.defineProperty(process, 'stdin', {
+            value: mockProcessIn,
+            writable: true,
+        });
+        vi.mocked(os.platform).mockReturnValue('linux');
+        vi.mocked(os.homedir).mockReturnValue('/home/user');
+        vi.mocked(os.tmpdir).mockReturnValue('/tmp');
+        vi.mocked(fs.existsSync).mockReturnValue(true);
+        vi.mocked(fs.realpathSync).mockImplementation((p) => p);
+        vi.mocked(execSync).mockReturnValue(Buffer.from(''));
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+        process.argv = originalArgv;
+    });
+    describe('start_sandbox', () => {
+        it('should handle macOS seatbelt (sandbox-exec)', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            const config = {
+                command: 'sandbox-exec',
+                image: 'some-image',
+            };
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.stdout = new EventEmitter();
+            mockSpawnProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockReturnValue(mockSpawnProcess);
+            const promise = start_sandbox(config, [], undefined, ['arg1']);
+            setTimeout(() => {
+                mockSpawnProcess.emit('close', 0);
+            }, 10);
+            await expect(promise).resolves.toBe(0);
+            expect(spawn).toHaveBeenCalledWith('sandbox-exec', expect.arrayContaining([
+                '-f',
+                expect.stringContaining('sandbox-macos-permissive-open.sb'),
+            ]), expect.objectContaining({ stdio: 'inherit' }));
+        });
+        it('should throw FatalSandboxError if seatbelt profile is missing', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            vi.mocked(fs.existsSync).mockReturnValue(false);
+            const config = {
+                command: 'sandbox-exec',
+                image: 'some-image',
+            };
+            await expect(start_sandbox(config)).rejects.toThrow(FatalSandboxError);
+        });
+        it('should handle Docker execution', async () => {
+            const config = {
+                command: 'docker',
+                image: 'gemini-cli-sandbox',
+            };
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce((_cmd, args) => {
+                if (args && args[0] === 'images') {
+                    setTimeout(() => {
+                        mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                        mockImageCheckProcess.emit('close', 0);
+                    }, 1);
+                    return mockImageCheckProcess;
+                }
+                return new EventEmitter(); // fallback
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce((cmd, args) => {
+                if (cmd === 'docker' && args && args[0] === 'run') {
+                    return mockSpawnProcess;
+                }
+                return new EventEmitter();
+            });
+            const promise = start_sandbox(config, [], undefined, ['arg1']);
+            await expect(promise).resolves.toBe(0);
+            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['run', '-i', '--rm', '--init']), expect.objectContaining({ stdio: 'inherit' }));
+        });
+        it('should pull image if missing', async () => {
+            const config = {
+                command: 'docker',
+                image: 'missing-image',
+            };
+            const mockImageCheckProcess1 = new EventEmitter();
+            mockImageCheckProcess1.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess1.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess1;
+            });
+            const mockPullProcess = new EventEmitter();
+            mockPullProcess.stdout = new EventEmitter();
+            mockPullProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockPullProcess.emit('close', 0);
+                }, 1);
+                return mockPullProcess;
+            });
+            // 3. Image check succeeds
+            const mockImageCheckProcess2 = new EventEmitter();
+            mockImageCheckProcess2.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess2.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess2.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess2;
+            });
+            // 4. Docker run
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            const promise = start_sandbox(config, [], undefined, ['arg1']);
+            await expect(promise).resolves.toBe(0);
+            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['pull', 'missing-image']), expect.any(Object));
+        });
+        it('should throw if image pull fails', async () => {
+            const config = {
+                command: 'docker',
+                image: 'missing-image',
+            };
+            const mockImageCheckProcess1 = new EventEmitter();
+            mockImageCheckProcess1.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess1.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess1;
+            });
+            const mockPullProcess = new EventEmitter();
+            mockPullProcess.stdout = new EventEmitter();
+            mockPullProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockPullProcess.emit('close', 1);
+                }, 1);
+                return mockPullProcess;
+            });
+            await expect(start_sandbox(config)).rejects.toThrow(FatalSandboxError);
+        });
+        it('should mount volumes correctly', async () => {
+            const config = {
+                command: 'docker',
+                image: 'gemini-cli-sandbox',
+            };
+            process.env['SANDBOX_MOUNTS'] = '/host/path:/container/path:ro';
+            vi.mocked(fs.existsSync).mockReturnValue(true); // For mount path check
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await start_sandbox(config);
+            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining([
+                '--volume',
+                '/host/path:/container/path:ro',
+                '--volume',
+                expect.stringContaining('/home/user/.cell-cli'),
+            ]), expect.any(Object));
+        });
+        it('should handle user creation on Linux if needed', async () => {
+            const config = {
+                command: 'docker',
+                image: 'gemini-cli-sandbox',
+            };
+            process.env['SANDBOX_SET_UID_GID'] = 'true';
+            vi.mocked(os.platform).mockReturnValue('linux');
+            vi.mocked(execSync).mockImplementation((cmd) => {
+                if (cmd === 'id -u')
+                    return Buffer.from('1000');
+                if (cmd === 'id -g')
+                    return Buffer.from('1000');
+                return Buffer.from('');
+            });
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await start_sandbox(config);
+            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['--user', 'root', '--env', 'HOME=/home/user']), expect.any(Object));
+            // Check that the entrypoint command includes useradd/groupadd
+            const args = vi.mocked(spawn).mock.calls[1][1];
+            const entrypointCmd = args[args.length - 1];
+            expect(entrypointCmd).toContain('groupadd');
+            expect(entrypointCmd).toContain('useradd');
+            expect(entrypointCmd).toContain('su -p gemini');
+        });
+    });
+});
+//# sourceMappingURL=sandbox.test.js.map

package/dist/src/utils/sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAsB,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,iBAAiB,EAAE,sBAAsB;CAC1C,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAC9B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnB,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnB,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8B,CAAC;IAClE,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,CAAC,EAAmC,EAAE,EAAE;YACjD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,KAAK,EAAE,GAAW,EAAE,EAAE;oBAC3B,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;wBACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACzB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACpC,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;wBAClD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBAC9C,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACnC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACtD,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBACpC,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1D,MAAM,MAAM,GACV,MAAM,cAAc,EAA4C,CAAC;IACnE,OAAO;QACL,GAAG,MAAM;QACT,WAAW,EAAE;YACX,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;YACZ,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;YACd,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;SACd;QACD,UAAU,EAAE;YACV,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;SACtB;QACD,iBAAiB,EAAE,KAAM,SAAQ,KAAK;YACpC,YAAY,OAAe;gBACzB,KAAK,CAAC,OAAO,CAAC,CAAC;gBACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;YAClC,CAAC;SACF;QACD,QAAQ,EAAE,WAAW;QACrB,iBAAiB,EAAE,sBAAsB;KAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,aAIH,CAAC;IAEF,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,aAAa,GAAG;YACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;YACd,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE;YACtC,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACpD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAW,CAAC,CAAC;QAClE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC1B,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,cAAc;gBACvB,KAAK,EAAE,YAAY;aACpB,CAAC;YAMF,MAAM,gBAAgB,GAAG,IAAI,YAAY,EAAiB,CAAC;YAC3D,gBAAgB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC7C,gBAAgB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC7C,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAC9B,gBAAuD,CACxD,CAAC;YAEF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAE/D,UAAU,CAAC,GAAG,EAAE;gBACd,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEP,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,cAAc,EACd,MAAM,CAAC,eAAe,CAAC;gBACrB,IAAI;gBACJ,MAAM,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;aAC5D,CAAC,EACF,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,cAAc;gBACvB,KAAK,EAAE,YAAY;aACpB,CAAC;YAEF,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,oBAAoB;aAC5B,CAAC;YAMF,MAAM,qBAAqB,GAAG,IAAI,YAAY,EAA2B,CAAC;YAC1E,qBAAqB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBACrD,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjC,UAAU,CAAC,GAAG,EAAE;wBACd,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;wBACnE,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACzC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACN,OAAO,qBAA4D,CAAC;gBACtE,CAAC;gBACD,OAAO,IAAI,YAAY,EAAyC,CAAC,CAAC,WAAW;YAC/E,CAAC,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,IAAI,YAAY,EAExC,CAAC;YACF,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7D,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtB,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,gBAAgB,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBAClD,OAAO,gBAAgB,CAAC;gBAC1B,CAAC;gBACD,OAAO,IAAI,YAAY,EAAyC,CAAC;YACnE,CAAC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAE/D,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,QAAQ,EACR,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,EACvD,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,eAAe;aACvB,CAAC;YAMF,MAAM,sBAAsB,GAC1B,IAAI,YAAY,EAA2B,CAAC;YAC9C,sBAAsB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YACnD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1C,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,sBAA6D,CAAC;YACvE,CAAC,CAAC,CAAC;YAOH,MAAM,eAAe,GAAG,IAAI,YAAY,EAAiC,CAAC;YAC1E,eAAe,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC5C,eAAe,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC5C,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,eAAsD,CAAC;YAChE,CAAC,CAAC,CAAC;YAEH,0BAA0B;YAC1B,MAAM,sBAAsB,GAC1B,IAAI,YAAY,EAA2B,CAAC;YAC9C,sBAAsB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YACnD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;oBACpE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1C,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,sBAA6D,CAAC;YACvE,CAAC,CAAC,CAAC;YAEH,gBAAgB;YAChB,MAAM,gBAAgB,GAAG,IAAI,YAAY,EAExC,CAAC;YACF,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7D,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtB,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,gBAAgB,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAE/D,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,QAAQ,EACR,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,eAAe;aACvB,CAAC;YAMF,MAAM,sBAAsB,GAC1B,IAAI,YAAY,EAA2B,CAAC;YAC9C,sBAAsB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YACnD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1C,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,sBAA6D,CAAC;YACvE,CAAC,CAAC,CAAC;YAOH,MAAM,eAAe,GAAG,IAAI,YAAY,EAAiC,CAAC;YAC1E,eAAe,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC5C,eAAe,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC5C,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,eAAsD,CAAC;YAChE,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,oBAAoB;aAC5B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,+BAA+B,CAAC;YAChE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;YAMvE,MAAM,qBAAqB,GAAG,IAAI,YAAY,EAA2B,CAAC;YAC1E,qBAAqB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;oBACnE,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,qBAA4D,CAAC;YACtE,CAAC,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,IAAI,YAAY,EAExC,CAAC;YACF,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7D,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtB,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,gBAAgB,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YAE5B,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,QAAQ,EACR,MAAM,CAAC,eAAe,CAAC;gBACrB,UAAU;gBACV,+BAA+B;gBAC/B,UAAU;gBACV,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;aAChD,CAAC,EACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,oBAAoB;aAC5B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC;YAC5C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7C,IAAI,GAAG,KAAK,OAAO;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,OAAO;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YAMH,MAAM,qBAAqB,GAAG,IAAI,YAAY,EAA2B,CAAC;YAC1E,qBAAqB,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,EAAE;oBACd,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;oBACnE,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,qBAA4D,CAAC;YACtE,CAAC,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,IAAI,YAAY,EAExC,CAAC;YACF,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7D,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtB,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,gBAAgB,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YAE5B,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,QAAQ,EACR,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;YACF,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAa,CAAC;YAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/utils/sandboxUtils.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare const LOCAL_DEV_SANDBOX_IMAGE_NAME = "gemini-cli-sandbox";
+export declare const SANDBOX_NETWORK_NAME = "gemini-cli-sandbox";
+export declare const SANDBOX_PROXY_NAME = "gemini-cli-sandbox-proxy";
+export declare const BUILTIN_SEATBELT_PROFILES: string[];
+export declare function getContainerPath(hostPath: string): string;
+export declare function shouldUseCurrentUserInSandbox(): Promise<boolean>;
+export declare function parseImageName(image: string): string;
+export declare function ports(): string[];
+export declare function entrypoint(workdir: string, cliArgs: string[]): string[];

package/dist/src/utils/sandboxUtils.js

@@ -0,0 +1,120 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import os from 'node:os';
+import fs from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { quote } from 'shell-quote';
+import { debugLogger, CELL_DIR } from '@google/gemini-cli-core';
+export const LOCAL_DEV_SANDBOX_IMAGE_NAME = 'gemini-cli-sandbox';
+export const SANDBOX_NETWORK_NAME = 'gemini-cli-sandbox';
+export const SANDBOX_PROXY_NAME = 'gemini-cli-sandbox-proxy';
+export const BUILTIN_SEATBELT_PROFILES = [
+    'permissive-open',
+    'permissive-closed',
+    'permissive-proxied',
+    'restrictive-open',
+    'restrictive-closed',
+    'restrictive-proxied',
+];
+export function getContainerPath(hostPath) {
+    if (os.platform() !== 'win32') {
+        return hostPath;
+    }
+    const withForwardSlashes = hostPath.replace(/\\/g, '/');
+    const match = withForwardSlashes.match(/^([A-Z]):\/(.*)/i);
+    if (match) {
+        return `/${match[1].toLowerCase()}/${match[2]}`;
+    }
+    return withForwardSlashes;
+}
+export async function shouldUseCurrentUserInSandbox() {
+    const envVar = process.env['SANDBOX_SET_UID_GID']?.toLowerCase().trim();
+    if (envVar === '1' || envVar === 'true') {
+        return true;
+    }
+    if (envVar === '0' || envVar === 'false') {
+        return false;
+    }
+    // If environment variable is not explicitly set, check for Debian/Ubuntu Linux
+    if (os.platform() === 'linux') {
+        try {
+            const osReleaseContent = await readFile('/etc/os-release', 'utf8');
+            if (osReleaseContent.includes('ID=debian') ||
+                osReleaseContent.includes('ID=ubuntu') ||
+                osReleaseContent.match(/^ID_LIKE=.*debian.*/m) || // Covers derivatives
+                osReleaseContent.match(/^ID_LIKE=.*ubuntu.*/m) // Covers derivatives
+            ) {
+                debugLogger.log('Defaulting to use current user UID/GID for Debian/Ubuntu-based Linux.');
+                return true;
+            }
+        }
+        catch (_err) {
+            // Silently ignore if /etc/os-release is not found or unreadable.
+            // The default (false) will be applied in this case.
+            debugLogger.warn('Warning: Could not read /etc/os-release to auto-detect Debian/Ubuntu for UID/GID default.');
+        }
+    }
+    return false; // Default to false if no other condition is met
+}
+export function parseImageName(image) {
+    const [fullName, tag] = image.split(':');
+    const name = fullName.split('/').at(-1) ?? 'unknown-image';
+    return tag ? `${name}-${tag}` : name;
+}
+export function ports() {
+    return (process.env['SANDBOX_PORTS'] ?? '')
+        .split(',')
+        .filter((p) => p.trim())
+        .map((p) => p.trim());
+}
+export function entrypoint(workdir, cliArgs) {
+    const isWindows = os.platform() === 'win32';
+    const containerWorkdir = getContainerPath(workdir);
+    const shellCmds = [];
+    const pathSeparator = isWindows ? ';' : ':';
+    let pathSuffix = '';
+    if (process.env['PATH']) {
+        const paths = process.env['PATH'].split(pathSeparator);
+        for (const p of paths) {
+            const containerPath = getContainerPath(p);
+            if (containerPath.toLowerCase().startsWith(containerWorkdir.toLowerCase())) {
+                pathSuffix += `:${containerPath}`;
+            }
+        }
+    }
+    if (pathSuffix) {
+        shellCmds.push(`export PATH="$PATH${pathSuffix}";`);
+    }
+    let pythonPathSuffix = '';
+    if (process.env['PYTHONPATH']) {
+        const paths = process.env['PYTHONPATH'].split(pathSeparator);
+        for (const p of paths) {
+            const containerPath = getContainerPath(p);
+            if (containerPath.toLowerCase().startsWith(containerWorkdir.toLowerCase())) {
+                pythonPathSuffix += `:${containerPath}`;
+            }
+        }
+    }
+    if (pythonPathSuffix) {
+        shellCmds.push(`export PYTHONPATH="$PYTHONPATH${pythonPathSuffix}";`);
+    }
+    const projectSandboxBashrc = `${CELL_DIR}/sandbox.bashrc`;
+    if (fs.existsSync(projectSandboxBashrc)) {
+        shellCmds.push(`source ${getContainerPath(projectSandboxBashrc)};`);
+    }
+    ports().forEach((p) => shellCmds.push(`socat TCP4-LISTEN:${p},bind=$(hostname -i),fork,reuseaddr TCP4:127.0.0.1:${p} 2> /dev/null &`));
+    const quotedCliArgs = cliArgs.slice(2).map((arg) => quote([arg]));
+    const cliCmd = process.env['NODE_ENV'] === 'development'
+        ? process.env['DEBUG']
+            ? 'npm run debug --'
+            : 'npm rebuild && npm run start --'
+        : process.env['DEBUG']
+            ? `node --inspect-brk=0.0.0.0:${process.env['DEBUG_PORT'] || '9229'} $(which gemini)`
+            : 'gemini';
+    const args = [...shellCmds, cliCmd, ...quotedCliArgs];
+    return ['bash', '-c', args.join(' ')];
+}
+//# sourceMappingURL=sandboxUtils.js.map

package/dist/src/utils/sandboxUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxUtils.js","sourceRoot":"","sources":["../../../src/utils/sandboxUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAExE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACnE,IACE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtC,gBAAgB,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,qBAAqB;gBACvE,gBAAgB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,qBAAqB;cACpE,CAAC;gBACD,WAAW,CAAC,GAAG,CACb,uEAAuE,CACxE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,iEAAiE;YACjE,oDAAoD;YACpD,WAAW,CAAC,IAAI,CACd,2FAA2F,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IAC3D,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;SACxC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAiB;IAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5C,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,UAAU,IAAI,IAAI,aAAa,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,gBAAgB,IAAI,IAAI,aAAa,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,iCAAiC,gBAAgB,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,oBAAoB,GAAG,GAAG,QAAQ,iBAAiB,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,UAAU,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,SAAS,CAAC,IAAI,CACZ,qBAAqB,CAAC,sDAAsD,CAAC,iBAAiB,CAC/F,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;QACvC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,iCAAiC;QACrC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,8BAA8B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,kBAAkB;YACrF,CAAC,CAAC,QAAQ,CAAC;IAEjB,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/utils/sandboxUtils.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/utils/sandboxUtils.test.js

@@ -0,0 +1,119 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import os from 'node:os';
+import fs from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { getContainerPath, parseImageName, ports, entrypoint, shouldUseCurrentUserInSandbox, } from './sandboxUtils.js';
+vi.mock('node:os');
+vi.mock('node:fs');
+vi.mock('node:fs/promises');
+vi.mock('@google/gemini-cli-core', () => ({
+    debugLogger: {
+        log: vi.fn(),
+        warn: vi.fn(),
+    },
+    CELL_DIR: '.cell-cli',
+}));
+describe('sandboxUtils', () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        process.env = { ...originalEnv };
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    describe('getContainerPath', () => {
+        it('should return same path on non-Windows', () => {
+            vi.mocked(os.platform).mockReturnValue('linux');
+            expect(getContainerPath('/home/user')).toBe('/home/user');
+        });
+        it('should convert Windows path to container path', () => {
+            vi.mocked(os.platform).mockReturnValue('win32');
+            expect(getContainerPath('C:\\Users\\user')).toBe('/c/Users/user');
+        });
+        it('should handle Windows path without drive letter', () => {
+            vi.mocked(os.platform).mockReturnValue('win32');
+            expect(getContainerPath('\\Users\\user')).toBe('/Users/user');
+        });
+    });
+    describe('parseImageName', () => {
+        it('should parse image name with tag', () => {
+            expect(parseImageName('my-image:latest')).toBe('my-image-latest');
+        });
+        it('should parse image name without tag', () => {
+            expect(parseImageName('my-image')).toBe('my-image');
+        });
+        it('should handle registry path', () => {
+            expect(parseImageName('gcr.io/my-project/my-image:v1')).toBe('my-image-v1');
+        });
+    });
+    describe('ports', () => {
+        it('should return empty array if SANDBOX_PORTS is not set', () => {
+            delete process.env['SANDBOX_PORTS'];
+            expect(ports()).toEqual([]);
+        });
+        it('should parse comma-separated ports', () => {
+            process.env['SANDBOX_PORTS'] = '8080, 3000 , 9000';
+            expect(ports()).toEqual(['8080', '3000', '9000']);
+        });
+    });
+    describe('entrypoint', () => {
+        beforeEach(() => {
+            vi.mocked(os.platform).mockReturnValue('linux');
+            vi.mocked(fs.existsSync).mockReturnValue(false);
+        });
+        it('should generate default entrypoint', () => {
+            const args = entrypoint('/work', ['node', 'gemini', 'arg1']);
+            expect(args).toEqual(['bash', '-c', 'gemini arg1']);
+        });
+        it('should include PATH and PYTHONPATH if set', () => {
+            process.env['PATH'] = '/work/bin:/usr/bin';
+            process.env['PYTHONPATH'] = '/work/lib';
+            const args = entrypoint('/work', ['node', 'gemini', 'arg1']);
+            expect(args[2]).toContain('export PATH="$PATH:/work/bin"');
+            expect(args[2]).toContain('export PYTHONPATH="$PYTHONPATH:/work/lib"');
+        });
+        it('should source sandbox.bashrc if exists', () => {
+            vi.mocked(fs.existsSync).mockReturnValue(true);
+            const args = entrypoint('/work', ['node', 'gemini', 'arg1']);
+            expect(args[2]).toContain('source .cell-cli/sandbox.bashrc');
+        });
+        it('should include socat commands for ports', () => {
+            process.env['SANDBOX_PORTS'] = '8080';
+            const args = entrypoint('/work', ['node', 'gemini', 'arg1']);
+            expect(args[2]).toContain('socat TCP4-LISTEN:8080');
+        });
+        it('should use development command if NODE_ENV is development', () => {
+            process.env['NODE_ENV'] = 'development';
+            const args = entrypoint('/work', ['node', 'gemini', 'arg1']);
+            expect(args[2]).toContain('npm rebuild && npm run start --');
+        });
+    });
+    describe('shouldUseCurrentUserInSandbox', () => {
+        it('should return true if SANDBOX_SET_UID_GID is 1', async () => {
+            process.env['SANDBOX_SET_UID_GID'] = '1';
+            expect(await shouldUseCurrentUserInSandbox()).toBe(true);
+        });
+        it('should return false if SANDBOX_SET_UID_GID is 0', async () => {
+            process.env['SANDBOX_SET_UID_GID'] = '0';
+            expect(await shouldUseCurrentUserInSandbox()).toBe(false);
+        });
+        it('should return true on Debian Linux', async () => {
+            delete process.env['SANDBOX_SET_UID_GID'];
+            vi.mocked(os.platform).mockReturnValue('linux');
+            vi.mocked(readFile).mockResolvedValue('ID=debian\n');
+            expect(await shouldUseCurrentUserInSandbox()).toBe(true);
+        });
+        it('should return false on non-Linux', async () => {
+            delete process.env['SANDBOX_SET_UID_GID'];
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            expect(await shouldUseCurrentUserInSandbox()).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=sandboxUtils.test.js.map

package/dist/src/utils/sandboxUtils.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxUtils.test.js","sourceRoot":"","sources":["../../../src/utils/sandboxUtils.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,KAAK,EACL,UAAU,EACV,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnB,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5B,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,WAAW,EAAE;QACX,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;KACd;IACD,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAEhC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAC1D,aAAa,CACd,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;YACnD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;YACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC;YACzC,MAAM,CAAC,MAAM,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC;YACzC,MAAM,CAAC,MAAM,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChD,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}