@marifold/core 0.60.0

package/dist/agent/RunWorkspace.js

@@ -0,0 +1,328 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUN_WORKSPACE_RETENTION_MS = exports.MAX_RUN_INSPECTION_TEXT_BYTES = exports.MAX_RUN_INPUT_BYTES = void 0;
+exports.createRunWorkspace = createRunWorkspace;
+exports.stageRunFiles = stageRunFiles;
+exports.stageRunImages = stageRunImages;
+exports.resolveToolPath = resolveToolPath;
+exports.isInsideAnyRoot = isInsideAnyRoot;
+exports.isOutsideUserHome = isOutsideUserHome;
+exports.isSensitiveHostPath = isSensitiveHostPath;
+exports.isProtectedSystemWrite = isProtectedSystemWrite;
+exports.isInside = isInside;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const MarifoldError_1 = require("../errors/MarifoldError");
+const WorkspacePaths_1 = require("../workspace/WorkspacePaths");
+exports.MAX_RUN_INPUT_BYTES = 16 * 1024 * 1024;
+exports.MAX_RUN_INSPECTION_TEXT_BYTES = 256 * 1024;
+exports.RUN_WORKSPACE_RETENTION_MS = 24 * 60 * 60 * 1000;
+function createRunWorkspace(options) {
+    const id = safeRunId(options.id);
+    const runsDir = options.runsDir ?? path.join((0, WorkspacePaths_1.marifoldHome)(), 'runs');
+    fs.mkdirSync(runsDir, { recursive: true, mode: 0o700 });
+    pruneRunWorkspaces(runsDir);
+    const rootDir = path.join(runsDir, id);
+    const homeDir = path.join(rootDir, 'home');
+    const workDir = path.join(rootDir, 'work');
+    const inputDir = path.join(rootDir, 'input');
+    const outputDir = path.join(rootDir, 'output');
+    const tempDir = path.join(rootDir, 'tmp');
+    const cacheDir = path.join(rootDir, 'cache');
+    const venvDir = path.join(workDir, '.venv');
+    for (const dir of [rootDir, homeDir, workDir, inputDir, outputDir, tempDir, cacheDir]) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const userHome = canonicalExistingPath(options.userHome ?? os.homedir());
+    const requestedCwd = canonicalExistingPath(options.cwd ?? process.cwd());
+    // Never turn a broad/sensitive root into an implicit read-write capability.
+    // A service launched from $HOME should work in the run scratch directory,
+    // not silently grant the model the whole account.
+    const appHome = options.runsDir ? path.dirname(canonicalExistingPath(options.runsDir)) : canonicalExistingPath((0, WorkspacePaths_1.marifoldHome)());
+    const cwd = isUnsafeBroadRoot(requestedCwd, userHome, appHome)
+        ? canonicalExistingPath(workDir)
+        : requestedCwd;
+    const trusted = uniqueExistingDirectories(options.trustedFolders ?? [])
+        .filter(folder => !isUnsafeBroadRoot(folder, userHome, appHome));
+    const readOnlyRoots = uniqueExistingDirectories(options.readOnlyFolders ?? [])
+        .filter(folder => isInside(folder, userHome))
+        .filter(folder => !isUnsafeBroadReadRoot(folder, userHome, appHome));
+    const runWriteRoots = [homeDir, workDir, outputDir, tempDir, cacheDir].map(canonicalExistingPath);
+    const writeRoots = uniquePaths([cwd, ...trusted, ...runWriteRoots]);
+    const readRoots = uniquePaths([...writeRoots, canonicalExistingPath(inputDir), ...readOnlyRoots]);
+    const externalRoots = writeRoots.filter(root => !isInside(root, userHome));
+    const workspace = {
+        id,
+        rootDir: canonicalExistingPath(rootDir),
+        homeDir: canonicalExistingPath(homeDir),
+        workDir: canonicalExistingPath(workDir),
+        inputDir: canonicalExistingPath(inputDir),
+        outputDir: canonicalExistingPath(outputDir),
+        tempDir: canonicalExistingPath(tempDir),
+        cacheDir: canonicalExistingPath(cacheDir),
+        venvDir: path.join(canonicalExistingPath(workDir), '.venv'),
+        cwd,
+        userHome,
+        readOnlyRoots,
+        readRoots,
+        writeRoots,
+        externalRoots,
+        files: [],
+        attachments: [],
+    };
+    workspace.files = stageRunFiles(workspace, options.files ?? []);
+    workspace.attachments.push(...workspace.files);
+    stageRunImages(workspace, options.images ?? []);
+    return workspace;
+}
+function stageRunFiles(workspace, files) {
+    let total = workspace.attachments.reduce((sum, attachment) => sum + attachment.size, 0);
+    const used = new Set(workspace.attachments.map(attachment => attachment.name.toLowerCase()));
+    return files.map((file, index) => {
+        const bytes = decodeBase64(file.data, `files[${index}].data`);
+        total += bytes.length;
+        if (total > exports.MAX_RUN_INPUT_BYTES) {
+            throw MarifoldError_1.MarifoldError.agentRunInvalid(`Run attachments exceed ${exports.MAX_RUN_INPUT_BYTES / (1024 * 1024)} MiB.`);
+        }
+        if (file.inspectionText && Buffer.byteLength(file.inspectionText, 'utf8') > exports.MAX_RUN_INSPECTION_TEXT_BYTES) {
+            throw MarifoldError_1.MarifoldError.agentRunInvalid(`files[${index}].inspectionText exceeds ${exports.MAX_RUN_INSPECTION_TEXT_BYTES / 1024} KiB.`);
+        }
+        const name = uniqueFileName(safeFileName(file.name, index), used);
+        const target = path.join(workspace.inputDir, name);
+        fs.writeFileSync(target, bytes, { mode: 0o400 });
+        return {
+            id: `attachment-${workspace.attachments.length + index + 1}`,
+            name,
+            mediaType: file.mediaType || 'application/octet-stream',
+            path: target,
+            size: bytes.length,
+            ...(file.inspectionText ? { inspectionText: file.inspectionText } : {}),
+        };
+    });
+}
+/** Stage local/embedded images into the same read-only attachment area used by
+ * files. This lets an agent inspect an image only when needed instead of
+ * sending it on every stateless model iteration. */
+function stageRunImages(workspace, images) {
+    const used = new Set(workspace.attachments.map(attachment => attachment.name.toLowerCase()));
+    let total = workspace.attachments.reduce((sum, attachment) => sum + attachment.size, 0);
+    const staged = images.map((image, index) => {
+        const id = `attachment-${workspace.attachments.length + index + 1}`;
+        const mediaType = image.mediaType || 'image/jpeg';
+        const extension = imageExtension(mediaType);
+        const name = uniqueFileName(`image-${index + 1}.${extension}`, used);
+        if (image.url) {
+            return { id, name, mediaType, size: 0, image: { url: image.url, mediaType } };
+        }
+        let bytes;
+        try {
+            bytes = image.path ? fs.readFileSync(image.path) : decodeBase64(image.data ?? '', `images[${index}].data`);
+        }
+        catch (error) {
+            if (error instanceof MarifoldError_1.MarifoldError)
+                throw error;
+            throw MarifoldError_1.MarifoldError.agentRunInvalid(`Could not stage image #${index + 1}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        total += bytes.length;
+        if (total > exports.MAX_RUN_INPUT_BYTES) {
+            throw MarifoldError_1.MarifoldError.agentRunInvalid(`Run attachments exceed ${exports.MAX_RUN_INPUT_BYTES / (1024 * 1024)} MiB.`);
+        }
+        const target = path.join(workspace.inputDir, name);
+        fs.writeFileSync(target, bytes, { mode: 0o400 });
+        return {
+            id,
+            name,
+            mediaType,
+            path: target,
+            size: bytes.length,
+            image: { path: target, mediaType },
+        };
+    });
+    workspace.attachments.push(...staged);
+    return staged;
+}
+function resolveToolPath(input, workspace, cwd) {
+    if (input === '~' && workspace)
+        return workspace.userHome;
+    if (input.startsWith('~/') && workspace)
+        return path.join(workspace.userHome, input.slice(2));
+    if (input === '~')
+        return os.homedir();
+    if (input.startsWith('~/'))
+        return path.join(os.homedir(), input.slice(2));
+    return path.resolve(cwd, input);
+}
+function isInsideAnyRoot(target, roots) {
+    const resolved = canonicalPath(target);
+    return roots.some(root => isInside(resolved, root));
+}
+function isOutsideUserHome(target, workspace) {
+    return !isInside(canonicalPath(target), workspace.userHome);
+}
+function isSensitiveHostPath(target, workspace) {
+    const resolved = canonicalPath(target);
+    if (isInside(resolved, workspace.rootDir))
+        return false;
+    const sensitive = [
+        path.join(workspace.userHome, '.ssh'),
+        path.join(workspace.userHome, '.gnupg'),
+        path.join(workspace.userHome, '.marifold'),
+        path.join(workspace.userHome, 'Library', 'Keychains'),
+    ];
+    return sensitive.some(root => isInside(resolved, root));
+}
+function isProtectedSystemWrite(target, workspace) {
+    const resolved = canonicalPath(target);
+    if (isInsideAnyRoot(resolved, workspace.writeRoots))
+        return false;
+    const roots = process.platform === 'win32'
+        ? [process.env.SystemRoot, process.env.ProgramFiles, process.env['ProgramFiles(x86)']].filter((value) => Boolean(value))
+        : ['/System', '/usr', '/bin', '/sbin', '/Library', '/Applications', '/opt', '/private/etc', '/private/var/db'];
+    return roots.some(root => isInside(resolved, canonicalPath(root)));
+}
+function isInside(target, root) {
+    const relative = path.relative(canonicalPath(root), canonicalPath(target));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function canonicalExistingPath(value) {
+    const resolved = path.resolve(value);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+function canonicalPath(value) {
+    const resolved = path.resolve(value);
+    const suffix = [];
+    let cursor = resolved;
+    while (!fs.existsSync(cursor)) {
+        const parent = path.dirname(cursor);
+        if (parent === cursor)
+            return resolved;
+        suffix.unshift(path.basename(cursor));
+        cursor = parent;
+    }
+    return path.join(fs.realpathSync(cursor), ...suffix);
+}
+function uniqueExistingDirectories(values) {
+    return uniquePaths(values.flatMap(value => {
+        const resolved = canonicalExistingPath(value);
+        try {
+            return fs.statSync(resolved).isDirectory() ? [resolved] : [];
+        }
+        catch {
+            return [];
+        }
+    }));
+}
+function uniquePaths(values) {
+    return [...new Set(values.map(canonicalExistingPath))];
+}
+function isUnsafeBroadRoot(target, userHome, appHome) {
+    const resolved = canonicalExistingPath(target);
+    return resolved === path.parse(resolved).root
+        || resolved === userHome
+        || resolved === appHome
+        || isInside(appHome, resolved)
+        || isInside(resolved, appHome);
+}
+function isUnsafeBroadReadRoot(target, userHome, appHome) {
+    const resolved = canonicalExistingPath(target);
+    return resolved === path.parse(resolved).root
+        || resolved === userHome
+        || resolved === appHome
+        || isInside(appHome, resolved);
+}
+function safeRunId(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+        throw MarifoldError_1.MarifoldError.agentRunInvalid(`Invalid execution id '${value}'.`);
+    }
+    return value;
+}
+function safeFileName(value, index) {
+    const base = path.basename(value).replace(/[\u0000-\u001f\u007f]/g, '').trim();
+    return base && base !== '.' && base !== '..' ? base : `attachment-${index + 1}`;
+}
+function uniqueFileName(value, used) {
+    let candidate = value;
+    const ext = path.extname(value);
+    const stem = value.slice(0, value.length - ext.length);
+    let number = 2;
+    while (used.has(candidate.toLowerCase())) {
+        candidate = `${stem}-${number}${ext}`;
+        number += 1;
+    }
+    used.add(candidate.toLowerCase());
+    return candidate;
+}
+function imageExtension(mediaType) {
+    if (mediaType === 'image/png')
+        return 'png';
+    if (mediaType === 'image/webp')
+        return 'webp';
+    if (mediaType === 'image/gif')
+        return 'gif';
+    return 'jpg';
+}
+function decodeBase64(value, label) {
+    if (!value || !/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length % 4 === 1) {
+        throw MarifoldError_1.MarifoldError.agentRunInvalid(`${label} must be non-empty base64.`);
+    }
+    const bytes = Buffer.from(value, 'base64');
+    if (bytes.length === 0)
+        throw MarifoldError_1.MarifoldError.agentRunInvalid(`${label} must be non-empty base64.`);
+    return bytes;
+}
+function pruneRunWorkspaces(runsDir) {
+    const cutoff = Date.now() - exports.RUN_WORKSPACE_RETENTION_MS;
+    for (const entry of fs.readdirSync(runsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !/^(run|task|tool)_[A-Za-z0-9_-]+$/.test(entry.name))
+            continue;
+        const target = path.join(runsDir, entry.name);
+        try {
+            if (fs.statSync(target).mtimeMs < cutoff)
+                fs.rmSync(target, { recursive: true, force: true });
+        }
+        catch {
+            // Cleanup is best-effort; inability to prune an old run must not block a
+            // new one.
+        }
+    }
+}
+//# sourceMappingURL=RunWorkspace.js.map

package/dist/agent/RunWorkspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunWorkspace.js","sourceRoot":"","sources":["../../src/agent/RunWorkspace.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAY,EAAE,+BAAW;AACzB,MAAY,EAAE,+BAAW;AACzB,MAAY,IAAI,iCAAa;AAE7B,2DAAwD;AACxD,gEAA2D;AAE9C,QAAA,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,QAAA,6BAA6B,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3C,QAAA,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkF9D,4BAAmC,OAAkC;IACnE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAA,6BAAY,GAAE,EAAE,MAAM,CAAC,CAAC;IACrE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtF,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAA,6BAAY,GAAE,CAAC,CAAC;IAC/H,MAAM,GAAG,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC;QAC5D,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SACpE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;SAC3E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,GAAG,UAAU,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAiB;QAC9B,EAAE;QACF,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC;QACzC,SAAS,EAAE,qBAAqB,CAAC,SAAS,CAAC;QAC3C,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3D,GAAG;QACH,QAAQ;QACR,aAAa;QACb,SAAS;QACT,UAAU;QACV,aAAa;QACb,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,EAAE;KAChB,CAAC;IACF,SAAS,CAAC,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAChE,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uBAA8B,SAAuB,EAAE,KAAqB;IAC1E,IAAI,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC;QAC9D,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,QAAA,mBAAmB,EAAE,CAAC;YAChC,MAAM,6BAAa,CAAC,eAAe,CACjC,0BAA0B,QAAA,mBAAmB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAA,6BAA6B,EAAE,CAAC;YAC1G,MAAM,6BAAa,CAAC,eAAe,CACjC,SAAS,KAAK,4BAA4B,QAAA,6BAA6B,GAAG,IAAI,OAAO,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,cAAc,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE;YAC5D,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,0BAA0B;YACvD,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM;YAClB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;oDAEoD;AACpD,wBAA+B,SAAuB,EAAE,MAAoB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAuB,EAAE;QAC9D,MAAM,EAAE,GAAG,cAAc,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC;QAClD,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,6BAAa,CAAC,eAAe,CACjC,0BAA0B,KAAK,GAAG,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,QAAA,mBAAmB,EAAE,CAAC;YAChC,MAAM,6BAAa,CAAC,eAAe,CACjC,0BAA0B,QAAA,mBAAmB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO;YACL,EAAE;YACF,IAAI;YACJ,SAAS;YACT,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yBAAgC,KAAa,EAAE,SAAmC,EAAE,GAAW;IAC7F,IAAI,KAAK,KAAK,GAAG,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,yBAAgC,MAAc,EAAE,KAAe;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,2BAAkC,MAAc,EAAE,SAAuB;IACvE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,6BAAoC,MAAc,EAAE,SAAuB;IACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;KACtD,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,gCAAuC,MAAc,EAAE,SAAuB;IAC5E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACxC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAC3F,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAC3C;QACD,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,kBAAyB,MAAc,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IACjD,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI;WACxC,QAAQ,KAAK,QAAQ;WACrB,QAAQ,KAAK,OAAO;WACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;WAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAe;IAC9E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI;WACxC,QAAQ,KAAK,QAAQ;WACrB,QAAQ,KAAK,OAAO;WACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,6BAAa,CAAC,eAAe,CAAC,yBAAyB,KAAK,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAiB;IACtD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,6BAAa,CAAC,eAAe,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,6BAAa,CAAC,eAAe,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAA,0BAA0B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,GAAG,MAAM;gBAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,WAAW;QACb,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/agent/ScopedProcess.d.ts

@@ -0,0 +1,35 @@
+import { ToolExecutionResult } from './ToolRegistry';
+import { RunWorkspace } from './RunWorkspace';
+export interface ScopedProcessOptions {
+    executable: string;
+    args: string[];
+    workspace: RunWorkspace;
+    cwd?: string;
+    readRoots?: string[];
+    writeRoots?: string[];
+    network?: boolean;
+    timeoutMs?: number;
+    outputLimit: number;
+    signal?: AbortSignal;
+    successSummary: string;
+    failureSummary: string;
+}
+/**
+ * Run a process inside the platform isolation backend. There is deliberately
+ * no unrestricted fallback: a missing backend fails closed rather than
+ * turning an "always allow" shell grant into host access.
+ */
+export declare function runScopedProcess(options: ScopedProcessOptions): Promise<ToolExecutionResult>;
+export declare function findExecutable(name: string): string | undefined;
+export declare function ensurePythonEnvironment(workspace: RunWorkspace, outputLimit: number, signal?: AbortSignal): Promise<ToolExecutionResult | undefined>;
+export declare function pythonInVenv(workspace: RunWorkspace): string;
+/**
+ * Seatbelt profile: leave the platform runtime readable, but hide user data
+ * roots and make the whole host read-only except the explicit run capabilities.
+ * Specific root allows override the broader home/Volumes denies.
+ */
+export declare function macSandboxProfile(workspace: RunWorkspace, executable: string, network: boolean, capabilities?: {
+    readRoots?: string[];
+    writeRoots?: string[];
+}): string;
+//# sourceMappingURL=ScopedProcess.d.ts.map

package/dist/agent/ScopedProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopedProcess.d.ts","sourceRoot":"","sources":["../../src/agent/ScopedProcess.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAY,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKxD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,YAAY,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4ClG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAa/D;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,YAAY,EACvB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAwB1C;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,CAI5D;AAoBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,YAAY,EACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACjE,MAAM,CA4CR"}

package/dist/agent/ScopedProcess.js

@@ -0,0 +1,280 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScopedProcess = runScopedProcess;
+exports.findExecutable = findExecutable;
+exports.ensurePythonEnvironment = ensurePythonEnvironment;
+exports.pythonInVenv = pythonInVenv;
+exports.macSandboxProfile = macSandboxProfile;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ToolRegistry_1 = require("./ToolRegistry");
+const RunWorkspace_1 = require("./RunWorkspace");
+const DEFAULT_TIMEOUT_MS = 60_000;
+const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+/**
+ * Run a process inside the platform isolation backend. There is deliberately
+ * no unrestricted fallback: a missing backend fails closed rather than
+ * turning an "always allow" shell grant into host access.
+ */
+async function runScopedProcess(options) {
+    const invocation = sandboxInvocation(options);
+    if (!invocation) {
+        return {
+            content: [
+                `No supported process sandbox is available on ${process.platform}.`,
+                'Marifold did not run the command on the unrestricted host.',
+                'macOS requires /usr/bin/sandbox-exec; other platforms currently require a future sandbox adapter.',
+            ].join(' '),
+            summary: options.failureSummary,
+            isError: true,
+        };
+    }
+    const env = scopedEnvironment(options.workspace);
+    return new Promise(resolve => {
+        const child = (0, child_process_1.execFile)(invocation.executable, invocation.args, {
+            cwd: options.cwd ?? options.workspace.cwd,
+            env,
+            timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            maxBuffer: MAX_BUFFER_BYTES,
+        }, (error, stdout, stderr) => {
+            const parts = [];
+            if (stdout)
+                parts.push(stdout);
+            if (stderr)
+                parts.push(`[stderr]\n${stderr}`);
+            if (error) {
+                const reason = error.killed
+                    ? `Command timed out after ${(options.timeoutMs ?? DEFAULT_TIMEOUT_MS) / 1000}s.`
+                    : `Command exited with ${error.code ?? 'an error'}.`;
+                parts.push(reason);
+                resolve({
+                    content: (0, ToolRegistry_1.capToolOutput)(parts.join('\n'), options.outputLimit),
+                    summary: options.failureSummary,
+                    isError: true,
+                });
+                return;
+            }
+            resolve({
+                content: (0, ToolRegistry_1.capToolOutput)(parts.join('\n') || '(no output)', options.outputLimit),
+                summary: options.successSummary,
+            });
+        });
+        options.signal?.addEventListener('abort', () => child.kill(), { once: true });
+    });
+}
+function findExecutable(name) {
+    const pathValue = process.env.PATH ?? '';
+    for (const directory of pathValue.split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return fs.realpathSync(candidate);
+        }
+        catch {
+            // Keep searching.
+        }
+    }
+    return undefined;
+}
+async function ensurePythonEnvironment(workspace, outputLimit, signal) {
+    const python = pythonInVenv(workspace);
+    if (fs.existsSync(python))
+        return undefined;
+    const uv = findExecutable(process.platform === 'win32' ? 'uv.exe' : 'uv');
+    if (!uv) {
+        return {
+            content: 'uv is required to create Marifold’s isolated Python environment, but it was not found on PATH.',
+            summary: 'could not create isolated Python environment',
+            isError: true,
+        };
+    }
+    const result = await runScopedProcess({
+        executable: uv,
+        args: ['venv', workspace.venvDir],
+        workspace,
+        cwd: workspace.workDir,
+        network: false,
+        timeoutMs: 120_000,
+        outputLimit,
+        signal,
+        successSummary: 'created isolated Python environment',
+        failureSummary: 'could not create isolated Python environment',
+    });
+    return result.isError ? result : undefined;
+}
+function pythonInVenv(workspace) {
+    return process.platform === 'win32'
+        ? path.join(workspace.venvDir, 'Scripts', 'python.exe')
+        : path.join(workspace.venvDir, 'bin', 'python');
+}
+function sandboxInvocation(options) {
+    if (process.platform === 'darwin' && fs.existsSync('/usr/bin/sandbox-exec')) {
+        return {
+            executable: '/usr/bin/sandbox-exec',
+            args: [
+                '-p',
+                macSandboxProfile(options.workspace, options.executable, options.network === true, {
+                    readRoots: options.readRoots,
+                    writeRoots: options.writeRoots,
+                }),
+                options.executable,
+                ...options.args,
+            ],
+        };
+    }
+    return undefined;
+}
+/**
+ * Seatbelt profile: leave the platform runtime readable, but hide user data
+ * roots and make the whole host read-only except the explicit run capabilities.
+ * Specific root allows override the broader home/Volumes denies.
+ */
+function macSandboxProfile(workspace, executable, network, capabilities = {}) {
+    const executablePath = canonicalExisting(executable);
+    const readRoots = uniqueCanonical([
+        ...(capabilities.readRoots ?? workspace.readRoots),
+        ...pathDirectories(workspace, capabilities.readRoots === undefined),
+    ]);
+    const writeRoots = uniqueCanonical(capabilities.writeRoots ?? workspace.writeRoots);
+    const ancestorAllows = readRoots.map(root => `(allow file-read-metadata (path-ancestors ${schemeString(root)}))`);
+    const readAllows = readRoots.map(root => `(allow file-read* (subpath ${schemeString(root)}))`);
+    const writeAllows = writeRoots.map(root => `(allow file-write* (subpath ${schemeString(root)}))`);
+    return [
+        '(version 1)',
+        '(allow default)',
+        ...(network ? [] : ['(deny network*)']),
+        // Keep subprocesses functional, but do not let an approved shell control
+        // unrelated host processes or automate desktop applications.
+        '(deny signal)',
+        '(allow signal (target self))',
+        '(allow signal (target same-sandbox))',
+        '(deny appleevent-send)',
+        '(deny mach-lookup'
+            + ' (global-name "com.apple.coreservices.appleevents")'
+            + ' (global-name "com.apple.LaunchServices")'
+            + ' (global-name "com.apple.lsd.modifydb")'
+            + ' (global-name "com.apple.pasteboard")'
+            + ' (global-name "com.apple.pasteboard.1")'
+            + ' (global-name "com.apple.SecurityServer")'
+            + ' (global-name "com.apple.securityd.xpc")'
+            + ' (global-name "com.apple.securityd.general")'
+            + ' (global-name "com.apple.securityd.systemkeychain"))',
+        '(deny file-write*)',
+        `(allow file-write* (literal ${schemeString('/dev/null')}))`,
+        ...writeAllows,
+        // The real account and external volumes are private unless a selected
+        // workspace/trusted root below explicitly re-opens a subtree.
+        `(deny file-read* (subpath ${schemeString(workspace.userHome)}))`,
+        `(deny file-read* (subpath ${schemeString('/Users')}))`,
+        `(deny file-read* (subpath ${schemeString('/Volumes')}))`,
+        `(allow file-read* (literal ${schemeString(executablePath)}))`,
+        ...ancestorAllows,
+        ...readAllows,
+    ].join('');
+}
+function scopedEnvironment(workspace) {
+    const venvBin = process.platform === 'win32'
+        ? path.join(workspace.venvDir, 'Scripts')
+        : path.join(workspace.venvDir, 'bin');
+    return {
+        // Preserve normal shell path semantics without exposing the account:
+        // Seatbelt still denies the broad home and re-opens only explicit roots.
+        HOME: workspace.userHome,
+        USERPROFILE: workspace.userHome,
+        TMPDIR: workspace.tempDir,
+        TMP: workspace.tempDir,
+        TEMP: workspace.tempDir,
+        XDG_CACHE_HOME: workspace.cacheDir,
+        XDG_CONFIG_HOME: path.join(workspace.homeDir, '.config'),
+        UV_CACHE_DIR: path.join(workspace.cacheDir, 'uv'),
+        UV_NO_CONFIG: '1',
+        VIRTUAL_ENV: workspace.venvDir,
+        PATH: [venvBin, process.env.PATH ?? ''].filter(Boolean).join(path.delimiter),
+        LANG: process.env.LANG ?? 'en_US.UTF-8',
+        LC_ALL: process.env.LC_ALL ?? '',
+        TERM: process.env.TERM ?? 'dumb',
+        MARIFOLD_RUN_DIR: workspace.rootDir,
+        MARIFOLD_RUN_HOME: workspace.homeDir,
+        MARIFOLD_INPUT_DIR: workspace.inputDir,
+        MARIFOLD_OUTPUT_DIR: workspace.outputDir,
+        MARIFOLD_WORK_DIR: workspace.workDir,
+        MARIFOLD_WORKSPACE: workspace.cwd,
+    };
+}
+function pathDirectories(workspace, includeUserDirectories) {
+    return (process.env.PATH ?? '')
+        .split(path.delimiter)
+        .filter(Boolean)
+        .map(canonicalExisting)
+        .filter(directory => {
+        try {
+            if (!fs.statSync(directory).isDirectory())
+                return false;
+            if (!includeUserDirectories && (0, RunWorkspace_1.isInside)(directory, workspace.userHome))
+                return false;
+            // A malformed PATH must not accidentally reopen the entire account or
+            // Marifold state after the broad home deny.
+            if (directory === workspace.userHome || (0, RunWorkspace_1.isInside)(workspace.userHome, directory))
+                return false;
+            const appHome = path.join(workspace.userHome, '.marifold');
+            if (directory === appHome || (0, RunWorkspace_1.isInside)(appHome, directory)) {
+                return (0, RunWorkspace_1.isInside)(directory, workspace.rootDir);
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function uniqueCanonical(values) {
+    return [...new Set(values.map(canonicalExisting))];
+}
+function canonicalExisting(value) {
+    try {
+        return fs.realpathSync(path.resolve(value));
+    }
+    catch {
+        return path.resolve(value);
+    }
+}
+function schemeString(value) {
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=ScopedProcess.js.map