@miniidealab/openlogos 0.9.31 → 0.10.3

package/dist/lib/sandbox.js

@@ -0,0 +1,246 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readlinkSync, rmSync } from 'node:fs';
+import { dirname, join, normalize, relative, resolve } from 'node:path';
+import { execSync } from 'node:child_process';
+const DEFAULT_SANDBOX_ROOT = '/private/tmp';
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    return value;
+}
+function commandExitCode(error) {
+    if (error && typeof error === 'object' && 'status' in error) {
+        const status = error.status;
+        return typeof status === 'number' ? status : undefined;
+    }
+    return undefined;
+}
+function commandErrorMessage(error) {
+    if (error instanceof Error && error.message)
+        return error.message.slice(0, 500);
+    if (error !== undefined && error !== null)
+        return String(error).slice(0, 500);
+    return undefined;
+}
+function normalizeRelPath(path) {
+    return normalize(path).replaceAll('\\', '/').replace(/^\.\/+/, '').replace(/^\/+/, '');
+}
+function normalizeAllowedWriteSet(paths) {
+    const set = new Set();
+    for (const item of paths) {
+        const normalized = normalizeRelPath(item);
+        if (normalized)
+            set.add(normalized);
+    }
+    return set;
+}
+function listFileSnapshots(root) {
+    const snapshots = new Map();
+    if (!existsSync(root))
+        return snapshots;
+    const walk = (dir) => {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            const rel = normalizeRelPath(relative(root, fullPath));
+            if (!rel)
+                continue;
+            const stats = lstatSync(fullPath);
+            if (stats.isDirectory()) {
+                walk(fullPath);
+                continue;
+            }
+            if (stats.isSymbolicLink()) {
+                snapshots.set(rel, `l:${readlinkSync(fullPath)}`);
+                continue;
+            }
+            snapshots.set(rel, `f:${stats.size}:${Math.floor(stats.mtimeMs)}`);
+        }
+    };
+    walk(root);
+    return snapshots;
+}
+function collectChangedPaths(before, after) {
+    const changed = new Set();
+    for (const [path, signature] of before.entries()) {
+        const next = after.get(path);
+        if (next === undefined || next !== signature)
+            changed.add(path);
+    }
+    for (const path of after.keys()) {
+        if (!before.has(path))
+            changed.add(path);
+    }
+    return Array.from(changed).sort();
+}
+function isPathAllowed(path, allowed) {
+    if (allowed.has(path))
+        return true;
+    for (const allow of allowed) {
+        if (!allow)
+            continue;
+        if (path.startsWith(`${allow}/`))
+            return true;
+    }
+    return false;
+}
+function copyBackAllowedFiles(sandboxRoot, workspaceRoot, changedPaths, allowedPaths) {
+    for (const relPath of changedPaths) {
+        if (!isPathAllowed(relPath, allowedPaths))
+            continue;
+        const src = join(sandboxRoot, relPath);
+        const dest = join(workspaceRoot, relPath);
+        if (!existsSync(src))
+            continue;
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(src, dest, { recursive: true, force: true });
+    }
+}
+function executeCommand(cwd, command, format) {
+    const start = Date.now();
+    try {
+        execSync(command, { cwd, stdio: format === 'json' ? 'pipe' : 'inherit' });
+        return {
+            status: 'pass',
+            exit_code: 0,
+            duration_ms: Date.now() - start,
+        };
+    }
+    catch (error) {
+        return {
+            status: 'fail',
+            exit_code: commandExitCode(error),
+            duration_ms: Date.now() - start,
+            error: commandErrorMessage(error),
+        };
+    }
+}
+function makeUnsupportedSandboxResult(format, root, command, config, error) {
+    const message = commandErrorMessage(error) ?? 'sandbox initialization failed';
+    const diagnostics = [`无法启用沙箱：${message}`];
+    if (config.mode === 'always') {
+        return {
+            command: {
+                status: 'fail',
+                error: `sandbox_mode=always requires isolation, but setup failed: ${message}`,
+            },
+            sandbox: {
+                mode: config.mode,
+                root: config.root,
+                isolated: false,
+                workspace_write_denied: config.denyWorkspaceWrite,
+                status: 'fail',
+                diagnostics,
+                suggestions: ['检查 sandbox_root 是否可写，或修复当前运行环境的隔离能力。'],
+            },
+        };
+    }
+    const plain = executeCommand(root, command, format);
+    return {
+        command: plain,
+        sandbox: {
+            mode: config.mode,
+            root: config.root,
+            isolated: false,
+            workspace_write_denied: config.denyWorkspaceWrite,
+            status: 'warn',
+            diagnostics,
+            suggestions: ['当前按兼容模式执行。若需强制隔离，请将 sandbox_mode 设为 always。'],
+        },
+    };
+}
+export function normalizeSandboxConfig(raw) {
+    const record = asRecord(raw) ?? {};
+    const modeRaw = typeof record.sandbox_mode === 'string' ? record.sandbox_mode : 'off';
+    const mode = modeRaw === 'auto' || modeRaw === 'always' ? modeRaw : 'off';
+    const root = typeof record.sandbox_root === 'string' && record.sandbox_root.trim().length > 0
+        ? record.sandbox_root
+        : DEFAULT_SANDBOX_ROOT;
+    const denyWorkspaceWrite = typeof record.sandbox_deny_workspace_write === 'boolean'
+        ? record.sandbox_deny_workspace_write
+        : true;
+    return { mode, root, denyWorkspaceWrite };
+}
+export function buildInitialSandboxData(config) {
+    return {
+        mode: config.mode,
+        root: config.root,
+        isolated: false,
+        workspace_write_denied: config.denyWorkspaceWrite,
+        status: 'skipped',
+        diagnostics: [],
+        suggestions: [],
+    };
+}
+export function runSandboxedCommand(options) {
+    const { root, command, format, sandbox, allowedWritePaths } = options;
+    const normalizedRoot = resolve(root);
+    if (sandbox.mode === 'off') {
+        return {
+            command: executeCommand(normalizedRoot, command, format),
+            sandbox: {
+                ...buildInitialSandboxData(sandbox),
+            },
+        };
+    }
+    let sandboxBase = sandbox.root;
+    if (!sandboxBase || sandboxBase.trim().length === 0) {
+        sandboxBase = DEFAULT_SANDBOX_ROOT;
+    }
+    let sandboxDir = '';
+    let sandboxProjectRoot = '';
+    try {
+        mkdirSync(sandboxBase, { recursive: true });
+        sandboxDir = mkdtempSync(join(sandboxBase, 'openlogos-cli-sandbox-'));
+        sandboxProjectRoot = join(sandboxDir, 'workspace');
+        cpSync(normalizedRoot, sandboxProjectRoot, { recursive: true });
+    }
+    catch (error) {
+        if (sandboxDir && existsSync(sandboxDir)) {
+            rmSync(sandboxDir, { recursive: true, force: true });
+        }
+        return makeUnsupportedSandboxResult(format, normalizedRoot, command, sandbox, error);
+    }
+    const baseline = listFileSnapshots(sandboxProjectRoot);
+    const commandResult = executeCommand(sandboxProjectRoot, command, format);
+    const afterRun = listFileSnapshots(sandboxProjectRoot);
+    const changedPaths = collectChangedPaths(baseline, afterRun);
+    const allowedSet = normalizeAllowedWriteSet(allowedWritePaths);
+    const unauthorizedWrites = sandbox.denyWorkspaceWrite
+        ? changedPaths.filter(path => !isPathAllowed(path, allowedSet))
+        : [];
+    copyBackAllowedFiles(sandboxProjectRoot, normalizedRoot, changedPaths, allowedSet);
+    const sandboxData = {
+        mode: sandbox.mode,
+        root: sandboxDir,
+        isolated: true,
+        workspace_write_denied: sandbox.denyWorkspaceWrite,
+        status: 'pass',
+        diagnostics: [],
+        suggestions: [],
+    };
+    if (unauthorizedWrites.length > 0) {
+        const preview = unauthorizedWrites.slice(0, 5).join(', ');
+        sandboxData.diagnostics.push(`检测到非白名单写入：${preview}${unauthorizedWrites.length > 5 ? ' ...' : ''}`);
+        if (sandbox.mode === 'always') {
+            sandboxData.status = 'fail';
+            sandboxData.suggestions.push('仅允许写入结果文件白名单；请调整测试脚本输出目录。');
+            commandResult.status = 'fail';
+            if (!commandResult.error) {
+                commandResult.error = 'sandbox_mode=always blocked non-whitelist writes';
+            }
+        }
+        else {
+            sandboxData.status = 'warn';
+            sandboxData.suggestions.push('当前按兼容策略继续。若需强制阻断，请将 sandbox_mode 设为 always。');
+        }
+    }
+    if (commandResult.status === 'fail' && sandboxData.status === 'pass') {
+        sandboxData.diagnostics.push('命令在沙箱内执行失败，请检查 pre-run / smoke 命令输出。');
+    }
+    if (sandboxData.status === 'warn' && sandboxData.suggestions.length === 0) {
+        sandboxData.suggestions.push('如需严格隔离，请将 sandbox_mode 设为 always。');
+    }
+    rmSync(sandboxDir, { recursive: true, force: true });
+    return { command: commandResult, sandbox: sandboxData };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/lib/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/lib/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AA0C9C,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAe;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA2B,EAAE,KAA0B;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAoB;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAmB,EACnB,aAAqB,EACrB,YAAsB,EACtB,YAAyB;IAEzB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;YAAE,SAAS;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,MAAoB;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO;YACL,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC;YACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;SAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAoB,EACpB,IAAY,EACZ,OAAe,EACf,MAA+B,EAC/B,KAAc;IAEd,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,+BAA+B,CAAC;IAC9E,MAAM,WAAW,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,6DAA6D,OAAO,EAAE;aAC9E;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,sBAAsB,EAAE,MAAM,CAAC,kBAAkB;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,WAAW,EAAE,CAAC,sCAAsC,CAAC;aACtD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,KAAK;YACf,sBAAsB,EAAE,MAAM,CAAC,kBAAkB;YACjD,MAAM,EAAE,MAAM;YACd,WAAW;YACX,WAAW,EAAE,CAAC,6CAA6C,CAAC;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,MAAM,IAAI,GAAgB,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACvF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC3F,CAAC,CAAC,MAAM,CAAC,YAAY;QACrB,CAAC,CAAC,oBAAoB,CAAC;IACzB,MAAM,kBAAkB,GAAG,OAAO,MAAM,CAAC,4BAA4B,KAAK,SAAS;QACjF,CAAC,CAAC,MAAM,CAAC,4BAA4B;QACrC,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,KAAK;QACf,sBAAsB,EAAE,MAAM,CAAC,kBAAkB;QACjD,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;YACxD,OAAO,EAAE;gBACP,GAAG,uBAAuB,CAAC,OAAO,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAC/B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,WAAW,GAAG,oBAAoB,CAAC;IACrC,CAAC;IAED,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACtE,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,4BAA4B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB;QACnD,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC,CAAC,EAAE,CAAC;IAEP,oBAAoB,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAEnF,MAAM,WAAW,GAAgB;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI;QACd,sBAAsB,EAAE,OAAO,CAAC,kBAAkB;QAClD,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,OAAO,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;YAC5B,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1D,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC;YAC9B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;gBACzB,aAAa,CAAC,KAAK,GAAG,kDAAkD,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;YAC5B,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACrE,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC1D,CAAC"}

package/dist/lib/verify-config.d.ts

@@ -1,5 +1,9 @@
+import { type NormalizedSandboxConfig } from './sandbox.js';
 export declare const DEFAULT_VERIFY_RESULT_PATH = "logos/resources/verify/test-results.jsonl";
 export declare const DEFAULT_VERIFY_MERGE_STRATEGY = "last-write-wins";
+export declare const DEFAULT_SANDBOX_MODE = "auto";
+export declare const DEFAULT_SANDBOX_ROOT = "/private/tmp";
+export declare const DEFAULT_SANDBOX_DENY_WORKSPACE_WRITE = true;
 export interface VerifyConfig {
     result_path?: string;
     pre_run_command?: string;
@@ -9,6 +13,9 @@ export interface VerifyConfig {
     regression_result_path?: string;
     incremental_result_path?: string;
     merge_results?: string;
+    sandbox_mode?: 'off' | 'auto' | 'always';
+    sandbox_root?: string;
+    sandbox_deny_workspace_write?: boolean;
 }
 export interface NormalizedVerifyConfig {
     resultPath: string;
@@ -18,6 +25,7 @@ export interface NormalizedVerifyConfig {
     regressionResultPath?: string;
     incrementalResultPath?: string;
     mergeStrategy: 'last-write-wins';
+    sandbox: NormalizedSandboxConfig;
 }
 export interface VerifyPreRunBackfillResult {
     status: 'exists' | 'added' | 'todo';

package/dist/lib/verify-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-config.d.ts","sourceRoot":"","sources":["../../src/lib/verify-config.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,0BAA0B,8CAA8C,CAAC;AACtF,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,iBAAiB,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAsCD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwBpE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,sBAAsB,CAgBhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAGrE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAGjE;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,0BAA0B,CAkBpH"}
+{"version":3,"file":"verify-config.d.ts","sourceRoot":"","sources":["../../src/lib/verify-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEpF,eAAO,MAAM,0BAA0B,8CAA8C,CAAC;AACtF,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAC/D,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AACnD,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,iBAAiB,CAAC;IACjC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAsCD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwBpE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,sBAAsB,CAiBhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAGrE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAGjE;AAmBD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,0BAA0B,CA2BpH"}

package/dist/lib/verify-config.js

@@ -1,7 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { normalizeSandboxConfig } from './sandbox.js';
 export const DEFAULT_VERIFY_RESULT_PATH = 'logos/resources/verify/test-results.jsonl';
 export const DEFAULT_VERIFY_MERGE_STRATEGY = 'last-write-wins';
+export const DEFAULT_SANDBOX_MODE = 'auto';
+export const DEFAULT_SANDBOX_ROOT = '/private/tmp';
+export const DEFAULT_SANDBOX_DENY_WORKSPACE_WRITE = true;
 function readJsonFile(path) {
     try {
         return JSON.parse(readFileSync(path, 'utf-8'));
@@ -74,6 +78,7 @@ export function normalizeVerifyConfig(rawVerify) {
         regressionResultPath: typeof verify.regression_result_path === 'string' ? verify.regression_result_path : undefined,
         incrementalResultPath: typeof verify.incremental_result_path === 'string' ? verify.incremental_result_path : undefined,
         mergeStrategy,
+        sandbox: normalizeSandboxConfig(verify),
     };
 }
 export function readVerifyConfig(root) {
@@ -84,6 +89,22 @@ export function hasVerifyPreRunConfig(rawVerify) {
     const verify = normalizeVerifyConfig(rawVerify);
     return Boolean(verify.preRunCommand || verify.regressionCommand || verify.incrementalCommand);
 }
+function backfillSandboxDefaults(target) {
+    let changed = false;
+    if (target.sandbox_mode === undefined) {
+        target.sandbox_mode = DEFAULT_SANDBOX_MODE;
+        changed = true;
+    }
+    if (target.sandbox_root === undefined) {
+        target.sandbox_root = DEFAULT_SANDBOX_ROOT;
+        changed = true;
+    }
+    if (target.sandbox_deny_workspace_write === undefined) {
+        target.sandbox_deny_workspace_write = DEFAULT_SANDBOX_DENY_WORKSPACE_WRITE;
+        changed = true;
+    }
+    return changed;
+}
 export function backfillVerifyPreRunConfig(root, config) {
     const verify = asRecord(config.verify) ?? {};
     let mutated = false;
@@ -91,7 +112,15 @@ export function backfillVerifyPreRunConfig(root, config) {
         verify.result_path = DEFAULT_VERIFY_RESULT_PATH;
         mutated = true;
     }
+    if (backfillSandboxDefaults(verify)) {
+        mutated = true;
+    }
     config.verify = verify;
+    const smoke = asRecord(config.smoke) ?? {};
+    if (backfillSandboxDefaults(smoke)) {
+        mutated = true;
+    }
+    config.smoke = smoke;
     if (hasVerifyPreRunConfig(verify)) {
         return { status: 'exists', mutated };
     }

package/dist/lib/verify-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-config.js","sourceRoot":"","sources":["../../src/lib/verify-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,0BAA0B,GAAG,2CAA2C,CAAC;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AA6B/D,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,YAAoB;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAuB;IACvD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,IAAY;IAC/D,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WAC3C,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC9B,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,UAAU,IAAI,kBAAkB,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QACpE,IAAI,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YACzI,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YAC/H,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAErD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,KAAK,6BAA6B;QAC1E,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,6BAA6B,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B;QACpG,aAAa,EAAE,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;YACvD,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7E,iBAAiB,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACxG,kBAAkB,EAAE,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QAC3G,oBAAoB,EAAE,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;QACnH,qBAAqB,EAAE,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;QACtH,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,MAA+B;IACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,WAAW,GAAG,0BAA0B,CAAC;QAChD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEvB,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEjD,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"verify-config.js","sourceRoot":"","sources":["../../src/lib/verify-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAgC,MAAM,cAAc,CAAC;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,2CAA2C,CAAC;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AACnD,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAiCzD,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,YAAoB;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAuB;IACvD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,IAAY;IAC/D,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WAC3C,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC9B,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,UAAU,IAAI,kBAAkB,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QACpE,IAAI,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YACzI,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YAC/H,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAErD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,KAAK,6BAA6B;QAC1E,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,6BAA6B,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B;QACpG,aAAa,EAAE,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;YACvD,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7E,iBAAiB,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACxG,kBAAkB,EAAE,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QAC3G,oBAAoB,EAAE,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;QACnH,qBAAqB,EAAE,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;QACtH,aAAa;QACb,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,YAAY,GAAG,oBAAoB,CAAC;QAC3C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,YAAY,GAAG,oBAAoB,CAAC;QAC3C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,CAAC,4BAA4B,GAAG,oCAAoC,CAAC;QAC3E,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,MAA+B;IACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,WAAW,GAAG,0BAA0B,CAAC;QAChD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAErB,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEjD,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miniidealab/openlogos",
-  "version": "0.9.31",
+  "version": "0.10.3",
   "description": "CLI tool for the OpenLogos software engineering methodology",
   "type": "module",
   "bin": {

package/spec/cli-json-output.md

@@ -361,6 +361,15 @@ openlogos verify --format json  # JSON 格式
     "diagnostics": [],
     "suggestions": []
   },
+  "sandbox": {
+    "mode": "auto",               // "off" | "auto" | "always"
+    "root": "/private/tmp",
+    "isolated": true,
+    "workspace_write_denied": true,
+    "status": "pass",             // "pass" | "warn" | "fail" | "skipped"
+    "diagnostics": [],
+    "suggestions": []
+  },
   "report_path": "logos/resources/verify/acceptance-report.md"
 }
 ```
@@ -403,6 +412,13 @@ openlogos verify --format json  # JSON 格式
 | `pre_run.merge_strategy` | string \| null | 否 | 两阶段合并策略，当前为 `last-write-wins` |
 | `pre_run.diagnostics` | string[] | 是 | 可展示给用户的问题诊断 |
 | `pre_run.suggestions` | string[] | 是 | 可展示给用户的修复建议 |
+| `sandbox.mode` | string | 是 | verify 沙箱模式：`"off"`、`"auto"` 或 `"always"` |
+| `sandbox.root` | string | 是 | 沙箱根目录 |
+| `sandbox.isolated` | boolean | 是 | 本次执行是否实际隔离 |
+| `sandbox.workspace_write_denied` | boolean | 是 | 是否拒绝写入仓库工作区 |
+| `sandbox.status` | string | 是 | 沙箱执行结果 |
+| `sandbox.diagnostics` | string[] | 是 | 沙箱诊断信息 |
+| `sandbox.suggestions` | string[] | 是 | 沙箱修复建议 |
 | `report_path` | string | 是 | 生成的验收报告路径 |
 
 ### 4.4 gate.reason 取值
@@ -420,6 +436,9 @@ openlogos verify --format json  # JSON 格式
 - 旧项目只配置 `verify.pre_run_command` 时，`pre_run.mode="pre_run_command"`。
 - 配置 `verify.regression_command` 或 `verify.incremental_command` 时，`pre_run.mode="two_phase"`。
 - 没有任何预跑命令时，`pre_run.mode="none"`。
+- `sandbox_mode="off"` 时，`sandbox.status="skipped"`，并保持历史兼容行为。
+- `sandbox_mode="auto"` 时，环境支持隔离则 `sandbox.status="pass"`，不支持则 `sandbox.status="warn"` 并给出降级原因。
+- `sandbox_mode="always"` 时，若无法隔离则必须失败。
 - 覆盖不足且 `pre_run.mode="none"` 时，必须输出局部测试诊断和配置建议。
 
 ---
@@ -459,6 +478,15 @@ openlogos smoke --env production --format json
   "failed_cases": [],
   "uncovered_cases": [],
   "skipped_cases": [],
+  "sandbox": {
+    "mode": "auto",               // "off" | "auto" | "always"
+    "root": "/private/tmp",
+    "isolated": true,
+    "workspace_write_denied": true,
+    "status": "pass",             // "pass" | "warn" | "fail" | "skipped"
+    "diagnostics": [],
+    "suggestions": []
+  },
   "report_path": "logos/resources/verify/smoke-report.md",
   "result_path": "logos/resources/verify/smoke-results.jsonl"
 }
@@ -475,11 +503,24 @@ openlogos smoke --env production --format json
 | `gate.reason` | string \| null | 是 | 失败原因，如 `failed_cases` / `incomplete_coverage` |
 | `failed_cases` | array | 是 | 失败 smoke 用例 |
 | `uncovered_cases` | array | 是 | 未覆盖 smoke 用例 ID |
+| `sandbox.mode` | string | 是 | smoke 沙箱模式：`"off"`、`"auto"` 或 `"always"` |
+| `sandbox.root` | string | 是 | 沙箱根目录 |
+| `sandbox.isolated` | boolean | 是 | 本次执行是否实际隔离 |
+| `sandbox.workspace_write_denied` | boolean | 是 | 是否拒绝写入仓库工作区 |
+| `sandbox.status` | string | 是 | 沙箱执行结果 |
+| `sandbox.diagnostics` | string[] | 是 | 沙箱诊断信息 |
+| `sandbox.suggestions` | string[] | 是 | 沙箱修复建议 |
 | `report_path` | string | 是 | smoke 报告路径 |
 | `result_path` | string | 是 | smoke 结果路径 |
 
 `openlogos smoke` 与 `openlogos verify` 共享 JSONL 结果思想，但读取的是 `smoke.result_path`，默认 `logos/resources/verify/smoke-results.jsonl`。冒烟测试用例建议存放在 `logos/resources/test/smoke/`。
 
+### 5.4 兼容规则
+
+- `smoke.command` 仍按既有语义执行。
+- `sandbox_mode` / `sandbox_root` / `sandbox_deny_workspace_write` 仅影响执行环境，不改变 smoke 门禁定义。
+- 当沙箱失败时，`smoke` 仍应写入结果报告，但 JSON 输出必须明确失败原因。
+
 ---
 
 ## 6. 错误处理

package/spec/logos.config.schema.json

@@ -79,6 +79,22 @@
           "default": "last-write-wins",
           "description": "两阶段结果合并策略。同一用例 ID 多次出现时，最后一次结果生效"
         },
+        "sandbox_mode": {
+          "type": "string",
+          "enum": ["off", "auto", "always"],
+          "default": "off",
+          "description": "verify 沙箱执行模式；auto 表示默认隔离，环境不支持时可降级并告警，always 表示必须隔离"
+        },
+        "sandbox_root": {
+          "type": "string",
+          "default": "/private/tmp",
+          "description": "verify 沙箱工作根目录。沙箱执行器应在此目录内运行命令"
+        },
+        "sandbox_deny_workspace_write": {
+          "type": "boolean",
+          "default": true,
+          "description": "是否禁止 verify 预跑命令写入仓库工作区；true 时必须阻断工作区写入"
+        },
         "test_command": {
           "type": "string",
           "description": "旧字段，保留兼容。建议使用 pre_run_command"
@@ -102,6 +118,22 @@
           "type": "string",
           "default": "logos/resources/verify/smoke-report.md",
           "description": "冒烟测试报告输出路径（相对项目根目录）"
+        },
+        "sandbox_mode": {
+          "type": "string",
+          "enum": ["off", "auto", "always"],
+          "default": "off",
+          "description": "smoke 沙箱执行模式；auto 表示默认隔离，环境不支持时可降级并告警，always 表示必须隔离"
+        },
+        "sandbox_root": {
+          "type": "string",
+          "default": "/private/tmp",
+          "description": "smoke 沙箱工作根目录。沙箱执行器应在此目录内运行命令"
+        },
+        "sandbox_deny_workspace_write": {
+          "type": "boolean",
+          "default": true,
+          "description": "是否禁止 smoke 命令写入仓库工作区；true 时必须阻断工作区写入"
         }
       }
     },
@@ -205,12 +237,18 @@
       },
       "verify": {
         "result_path": "logos/resources/verify/test-results.jsonl",
-        "pre_run_command": "npm test"
+        "pre_run_command": "npm test",
+        "sandbox_mode": "auto",
+        "sandbox_root": "/private/tmp",
+        "sandbox_deny_workspace_write": true
       },
       "smoke": {
         "command": "npm run smoke",
         "result_path": "logos/resources/verify/smoke-results.jsonl",
-        "report_path": "logos/resources/verify/smoke-report.md"
+        "report_path": "logos/resources/verify/smoke-report.md",
+        "sandbox_mode": "auto",
+        "sandbox_root": "/private/tmp",
+        "sandbox_deny_workspace_write": true
       }
     },
     {
@@ -222,7 +260,10 @@
         "incremental_command": "npm run test:changed",
         "regression_result_path": "logos/resources/verify/test-results.regression.jsonl",
         "incremental_result_path": "logos/resources/verify/test-results.incremental.jsonl",
-        "merge_results": "last-write-wins"
+        "merge_results": "last-write-wins",
+        "sandbox_mode": "auto",
+        "sandbox_root": "/private/tmp",
+        "sandbox_deny_workspace_write": true
       }
     }
   ]

package/spec/test-results.md

@@ -138,6 +138,20 @@ logos/resources/verify/test-results.jsonl
 4. 同一个用例 ID 多次出现时，最后一次结果生效。
 5. 若未配置阶段结果路径，CLI 必须用临时快照或等价机制避免第二阶段 reporter 清空第一阶段结果。
 
+### `verify.sandbox_mode` / `smoke.sandbox_mode`
+
+OpenLogos 的 JSONL reporter 仍然负责写入测试结果，但当 `verify` 或 `smoke` 开启沙箱模式时，reporter 和命令执行器的职责必须分离：
+
+- reporter 只写配置声明的结果文件；
+- CLI 负责在沙箱中执行测试命令；
+- CLI 负责回收结果文件并阻断仓库工作区的额外写入。
+
+### 新增约束
+- `verify.sandbox_mode="always"` 时，测试命令不得直接写入仓库根目录中的非白名单路径。
+- `smoke.sandbox_mode="always"` 时，`smoke.command` 不得直接写入仓库根目录中的非白名单路径。
+- 若测试脚本在沙箱内失败，CLI 必须保留失败输出，并在 JSON / 文本结果中暴露 `sandbox` 诊断。
+- 阶段化结果路径（`regression_result_path` / `incremental_result_path`）与沙箱隔离可以同时存在，二者不冲突。
+
 ### 覆盖不足诊断
 
 当项目没有配置 `pre_run_command`、`regression_command` 或 `incremental_command`，且 verify 发现覆盖不足时，CLI 必须诊断这可能是只运行了局部测试导致，并建议配置 verify 预跑命令。
@@ -153,6 +167,17 @@ logos/resources/verify/test-results.jsonl
 
 两阶段模型下，回归阶段和增量阶段可以写入不同结果文件；如果两个阶段都写入默认 `result_path`，CLI 必须在阶段之间保留快照，确保最终合并结果不会丢失第一阶段覆盖。
 
+### reporter 输出建议
+```json
+{"id":"UT-S13-01","status":"pass","duration_ms":12,"timestamp":"2026-04-10T10:00:00Z"}
+```
+
+当启用沙箱时，reporter 不需要知道沙箱实现细节，但可在错误消息中保留命令上下文，便于 CLI 汇总诊断。
+
+### 兼容性
+- 现有 reporter 仍然按原格式工作，不需要新增字段。
+- CLI 新增的沙箱执行器不得改变 `test-results.jsonl` 的基本 schema。
+
 ### 目录创建
 
 reporter 在写入前应确保 `logos/resources/verify/` 目录存在（`mkdir -p` 等效操作）。

package/spec/workflow.md

@@ -294,6 +294,62 @@ AI 面前已有完整上下文（原型 + 场景 + API + DB + 部署方案 + 测
 - Step 6 不承担“补写测试代码”的职责；其职责是对已完成的 Step 5 产物做自动化判定
 - 项目应配置 verify 预跑命令；若无法推断，必须在交付说明中明确风险与手动配置方式
 
+**verify / smoke 沙箱执行标准**：
+
+`openlogos verify` 与 `openlogos smoke` 的命令执行属于运行时安全边界，不能只依赖 prompt 约束。CLI 必须支持在 `logos.config.json` 中配置沙箱策略，并在执行前置测试命令或 `smoke.command` 时按策略处理。
+
+配置入口：
+
+```json
+{
+  "verify": {
+    "sandbox_mode": "auto",
+    "sandbox_root": "/private/tmp",
+    "sandbox_deny_workspace_write": true
+  },
+  "smoke": {
+    "sandbox_mode": "auto",
+    "sandbox_root": "/private/tmp",
+    "sandbox_deny_workspace_write": true
+  }
+}
+```
+
+沙箱模式：
+
+| 模式 | 行为 |
+|------|------|
+| `off` | 关闭沙箱，保持历史行为 |
+| `auto` | 优先使用沙箱；环境不支持时降级并输出告警 |
+| `always` | 必须使用沙箱；无法隔离或检测到工作区写入时直接失败 |
+
+verify 顺序：
+1. 读取 `verify.sandbox_*` 与预跑命令配置。
+2. 若配置 `regression_command` / `incremental_command`，按两阶段模型执行。
+3. 若只配置 `pre_run_command`，按单阶段模型执行。
+4. 若 `sandbox_mode != "off"`，所有预跑命令必须通过沙箱执行器运行。
+5. 执行结束后，仅允许回收配置声明的结果文件到 `verify.result_path`、`verify.regression_result_path` 或 `verify.incremental_result_path`。
+6. 读取结果并计算 Gate 3.5。
+7. 文本与 JSON 输出必须暴露沙箱模式、是否隔离、失败原因和修复建议。
+
+smoke 顺序：
+1. 完成提案级部署决策、`DEPLOY_DONE` 与 smoke 门禁检查。
+2. 读取 `smoke.sandbox_*` 与 `smoke.command`。
+3. 若配置 `smoke.command` 且 `sandbox_mode != "off"`，通过沙箱执行器运行。
+4. 执行结束后，仅允许回收 `smoke.result_path` 指向的结果文件。
+5. 读取 smoke 用例与结果并计算 Gate 3.8。
+6. 文本与 JSON 输出必须暴露沙箱模式、是否隔离、失败原因和修复建议。
+
+工作区写入保护：
+- 当 `sandbox_deny_workspace_write=true` 时，沙箱执行器必须阻止预跑命令或 smoke 命令写入仓库根目录中的非白名单路径。
+- 白名单仅包含配置声明的结果文件、报告文件和 CLI 显式生成的门禁标记。
+- `always` 模式下，一旦检测到非白名单写入，命令必须失败。
+- `auto` 模式下，无法启用写入保护时必须输出告警，并在 JSON `sandbox.status` 中标记为 `warn`。
+
+兼容性：
+- 未配置 `sandbox_mode` 的历史项目等价于 `off`，不得破坏既有 verify / smoke 行为。
+- `init`、`adopt`、`sync` 可以为新项目补齐推荐配置，但不得覆盖用户已有沙箱配置。
+
 **验收流程**：
 
 1. AI 在 Step 5 生成测试代码时，内嵌 OpenLogos reporter（见 [test-results.md](./test-results.md)）