@mono-agent/sandbox 0.1.0

package/README.md

@@ -0,0 +1,113 @@
+# @mono-agent/sandbox
+
+## Category
+
+Category: `runtime`
+
+## Responsibility
+
+Fail-closed sandbox policy normalization and native process wrapping for runtime-owned command execution.
+
+## Install / Usage
+
+```bash
+pnpm --filter @mono-agent/sandbox run build
+```
+
+The drop-in path for hosts is one policy object handed to the runtime — every
+built-in tool (Bash, Read/Write/Edit, Glob/Grep, WebFetch/WebSearch) and stdio
+MCP startup then enforces it without per-call wiring:
+
+```ts
+import { failClosedSandboxPolicy } from "@mono-agent/sandbox";
+
+const runtime = createMonoRuntime({
+  workspace,
+  sandboxPolicy: failClosedSandboxPolicy({ root: workspace }),
+});
+```
+
+The same policy can be built from `MONO_AGENT_SANDBOX_*` env vars via
+`@mono-agent/config`. For direct command preparation:
+
+```ts
+import {
+  failClosedSandboxPolicy,
+  prepareSandboxedCommand,
+} from "@mono-agent/sandbox";
+
+const policy = failClosedSandboxPolicy({ root: process.cwd() });
+const prepared = await prepareSandboxedCommand({
+  policy,
+  command: {
+    command: "/bin/bash",
+    args: ["-lc", "pnpm test"],
+    cwd: process.cwd(),
+  },
+});
+```
+
+By default the package prepares commands for a native `srt` sandbox and fails
+closed when the sandbox engine is unavailable. An unsafe host-process fallback
+requires both `fallback: "unsafe-host-process"` and
+`unsafeAllowHostProcess: true`.
+
+## Policy Semantics
+
+- `readableRoots` / `writableRoots` default to `[root]`; everything outside is
+  denied, the user's home directory is always added to the native deny-read
+  list unless a readable root covers it, and `~/.ssh` is always denied.
+- `denyWrite` defaults to `DEFAULT_DENY_WRITE` (`.env`, `.env.*`,
+  `.git/config`, `.git/hooks/**`) and is enforced by the native engine.
+- `network` is `none` by default. `allowlist` entries match exact hosts, or
+  subdomains with a `*.` prefix. `localhost` covers loopback addresses
+  including bracketed IPv6 (`[::1]`).
+- `mergeSandboxPolicies(configured, request)` is monotonic: a request-scoped
+  policy can only tighten roots, network access, and the fallback — never
+  weaken or disable the configured policy. The runtime applies this merge
+  itself, so per-call options cannot bypass a host-configured policy.
+- Engine availability (`srt --version`) is probed once per process, and srt
+  settings files are content-addressed under `tempRoot` and reused across
+  commands run under the same policy.
+
+## Public API
+
+- `createSandboxPolicy` / `failClosedSandboxPolicy`
+- `mergeSandboxPolicies`
+- `sandboxRequired`
+- `sandboxPolicyToRuntimeOptions`
+- `createSrtSandboxEngine`
+- `prepareSandboxedCommand`
+- `srtSettingsForPolicy`
+- `networkPolicyAllowsUrl`
+- `SANDBOX_MODES`, `SANDBOX_NETWORK_MODES`, `SANDBOX_FALLBACKS`, `DEFAULT_DENY_WRITE`
+
+## Enforcement Scope
+
+The native engine wraps runtime-owned process execution: Bash commands and
+stdio MCP server startup. File tools (Read/Write/Edit/Glob/Grep) are enforced
+in-process by path checks that include symlink-target containment. WebFetch
+and WebSearch are enforced in-process by the network policy, including every
+redirect hop. Provider CLI bridges (Claude Code CLI/SDK, Codex app) run their
+own tool loops and are not wrapped by this policy yet — pair them with the
+provider's own sandboxing when that matters.
+
+## Dependency Boundary
+
+`@mono-agent/sandbox` is a runtime package. Beyond the shared
+`@mono-agent/agent-contracts` error base it must stay independent of model
+providers, host config, harness execution, communication adapters, and UI
+packages so runtimes can share the same policy object without importing host
+composition code.
+
+## What This Package Does Not Own
+
+It does not implement prompt policy, user approval, provider credentials, memory, or adapter-specific allowlists. It also does not make an unavailable native sandbox safe by default; the default policy fails closed unless a caller explicitly opts into unsafe host execution.
+
+## Verification
+
+```bash
+pnpm --filter @mono-agent/sandbox run build
+pnpm --filter @mono-agent/sandbox run typecheck
+pnpm --filter @mono-agent/sandbox run test
+```

package/dist/index.d.ts

@@ -0,0 +1,107 @@
+import { CodedError } from "@mono-agent/agent-contracts";
+export declare const SANDBOX_MODES: readonly ["native", "off"];
+export type SandboxMode = (typeof SANDBOX_MODES)[number];
+export declare const SANDBOX_NETWORK_MODES: readonly ["none", "localhost", "allowlist", "all"];
+export type SandboxNetworkMode = (typeof SANDBOX_NETWORK_MODES)[number];
+export declare const SANDBOX_FALLBACKS: readonly ["fail-closed", "unsafe-host-process"];
+export type SandboxFallback = (typeof SANDBOX_FALLBACKS)[number];
+export type SandboxEngineId = string;
+export declare const DEFAULT_DENY_WRITE: readonly [".env", ".env.*", ".git/config", ".git/hooks/**"];
+export interface SandboxNetworkPolicyInput {
+    readonly mode?: SandboxNetworkMode;
+    readonly allowlist?: readonly string[];
+}
+export interface SandboxPolicyInput {
+    readonly mode?: SandboxMode;
+    readonly engine?: SandboxEngineId;
+    readonly root?: string;
+    readonly readableRoots?: readonly string[];
+    readonly writableRoots?: readonly string[];
+    readonly denyWrite?: readonly string[];
+    readonly tempRoot?: string;
+    readonly network?: SandboxNetworkPolicyInput;
+    readonly fallback?: SandboxFallback;
+    readonly unsafeAllowHostProcess?: boolean;
+}
+export interface SandboxNetworkPolicy {
+    readonly mode: SandboxNetworkMode;
+    readonly allowlist: readonly string[];
+}
+export interface SandboxPolicy {
+    readonly mode: SandboxMode;
+    readonly engine: SandboxEngineId;
+    readonly root: string;
+    readonly readableRoots: readonly string[];
+    readonly writableRoots: readonly string[];
+    readonly denyWrite: readonly string[];
+    readonly tempRoot: string;
+    readonly network: SandboxNetworkPolicy;
+    readonly fallback: SandboxFallback;
+    readonly unsafeAllowHostProcess: boolean;
+}
+export type SandboxErrorCode = "invalid_sandbox_policy" | "sandbox_unavailable";
+export declare class SandboxPolicyError extends CodedError<SandboxErrorCode> {
+}
+export declare class SandboxUnavailableError extends SandboxPolicyError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export interface SandboxCommandSpec {
+    readonly command: string;
+    readonly args?: readonly string[];
+    readonly cwd?: string;
+    readonly env?: Record<string, string | undefined>;
+}
+export interface PreparedSandboxCommand extends SandboxCommandSpec {
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly sandboxed: boolean;
+    readonly sandboxSettingsPath?: string;
+    readonly cleanup?: () => Promise<void>;
+}
+export interface SandboxEngine {
+    readonly id: SandboxEngineId;
+    isAvailable(): Promise<boolean>;
+    prepareCommand(command: SandboxCommandSpec, policy: SandboxPolicy): Promise<PreparedSandboxCommand>;
+}
+export interface PrepareSandboxedCommandInput {
+    readonly policy?: SandboxPolicy;
+    readonly command: SandboxCommandSpec;
+    readonly engine?: SandboxEngine;
+}
+export interface SandboxPolicyRuntimeOptions {
+    readonly sandboxPolicy: SandboxPolicy;
+}
+export interface SrtNetworkSettings {
+    readonly allowedDomains: readonly string[];
+    readonly deniedDomains: readonly string[];
+    readonly allowLocalBinding: boolean;
+    readonly allowAllUnixSockets: boolean;
+}
+export interface SrtFilesystemSettings {
+    readonly denyRead: readonly string[];
+    readonly allowRead: readonly string[];
+    readonly allowWrite: readonly string[];
+    readonly denyWrite: readonly string[];
+}
+export interface SrtSettings {
+    readonly network: SrtNetworkSettings;
+    readonly filesystem: SrtFilesystemSettings;
+}
+export interface SrtSandboxEngineOptions {
+    readonly command?: string;
+}
+export declare function createSandboxPolicy(input?: SandboxPolicyInput): SandboxPolicy;
+export declare function failClosedSandboxPolicy(input?: Omit<SandboxPolicyInput, "mode" | "fallback" | "unsafeAllowHostProcess">): SandboxPolicy;
+export declare function sandboxRequired(policy: SandboxPolicy): boolean;
+export declare function sandboxPolicyToRuntimeOptions(policy: SandboxPolicy): SandboxPolicyRuntimeOptions;
+/**
+ * Monotonic merge: the result is never more permissive than `configured`.
+ * A request-scoped policy can only tighten roots, network access, and the
+ * fallback; it can never re-enable host execution or widen filesystem access.
+ */
+export declare function mergeSandboxPolicies(configured: SandboxPolicy | undefined, request: SandboxPolicy | undefined): SandboxPolicy | undefined;
+export declare function createSrtSandboxEngine(options?: SrtSandboxEngineOptions): SandboxEngine;
+export declare function prepareSandboxedCommand(input: PrepareSandboxedCommandInput): Promise<PreparedSandboxCommand>;
+export declare function srtSettingsForPolicy(policy: SandboxPolicy): SrtSettings;
+export declare function networkPolicyAllowsUrl(policy: SandboxPolicy | undefined, url: string): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,eAAO,MAAM,aAAa,4BAA6B,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,oDAAqD,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB,iDAAkD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,eAAO,MAAM,kBAAkB,6DAA8D,CAAC;AAE9F,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,MAAM,gBAAgB,GACxB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,kBAAmB,SAAQ,UAAU,CAAC,gBAAgB,CAAC;CAAG;AAEvE,qBAAa,uBAAwB,SAAQ,kBAAkB;gBACjD,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGnE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;IAC7B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACrG;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,kBAAuB,GAAG,aAAa,CA+BjF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,UAAU,GAAG,wBAAwB,CAAM,GAAG,aAAa,CAQ3I;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE9D;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,aAAa,GAAG,2BAA2B,CAEhG;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GAAG,SAAS,EACrC,OAAO,EAAE,aAAa,GAAG,SAAS,GACjC,aAAa,GAAG,SAAS,CAwB3B;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B,GAAG,aAAa,CAyB3F;AAgBD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuBlH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAevE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAsB9F"}

package/dist/index.js

@@ -0,0 +1,378 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { promisify } from "node:util";
+import { CodedError } from "@mono-agent/agent-contracts";
+const execFileAsync = promisify(execFile);
+export const SANDBOX_MODES = ["native", "off"];
+export const SANDBOX_NETWORK_MODES = ["none", "localhost", "allowlist", "all"];
+export const SANDBOX_FALLBACKS = ["fail-closed", "unsafe-host-process"];
+export const DEFAULT_DENY_WRITE = [".env", ".env.*", ".git/config", ".git/hooks/**"];
+export class SandboxPolicyError extends CodedError {
+}
+export class SandboxUnavailableError extends SandboxPolicyError {
+    constructor(message, details = {}) {
+        super("sandbox_unavailable", message, details);
+    }
+}
+export function createSandboxPolicy(input = {}) {
+    const mode = input.mode ?? "native";
+    const root = normalizePath(input.root ?? process.cwd(), "root");
+    const fallback = input.fallback ?? "fail-closed";
+    const unsafeAllowHostProcess = input.unsafeAllowHostProcess === true;
+    if (fallback === "unsafe-host-process" && !unsafeAllowHostProcess) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", "unsafe-host-process fallback requires unsafeAllowHostProcess: true.", { field: "unsafeAllowHostProcess" });
+    }
+    const readableRoots = normalizePathList(input.readableRoots ?? [root], root, "readableRoots");
+    const writableRoots = normalizePathList(input.writableRoots ?? [root], root, "writableRoots");
+    const denyWrite = normalizeStringList(input.denyWrite ?? DEFAULT_DENY_WRITE, "denyWrite");
+    const tempRoot = normalizePath(input.tempRoot ?? resolve(root, ".mono-agent", "tmp"), "tempRoot");
+    const network = normalizeNetworkPolicy(input.network);
+    return {
+        mode,
+        engine: normalizeNonEmptyString(input.engine ?? "srt", "engine"),
+        root,
+        readableRoots,
+        writableRoots,
+        denyWrite,
+        tempRoot,
+        network,
+        fallback,
+        unsafeAllowHostProcess,
+    };
+}
+export function failClosedSandboxPolicy(input = {}) {
+    return createSandboxPolicy({
+        ...input,
+        mode: "native",
+        fallback: "fail-closed",
+        unsafeAllowHostProcess: false,
+        network: input.network ?? { mode: "none" },
+    });
+}
+export function sandboxRequired(policy) {
+    return policy.mode !== "off" && policy.fallback === "fail-closed";
+}
+export function sandboxPolicyToRuntimeOptions(policy) {
+    return { sandboxPolicy: policy };
+}
+/**
+ * Monotonic merge: the result is never more permissive than `configured`.
+ * A request-scoped policy can only tighten roots, network access, and the
+ * fallback; it can never re-enable host execution or widen filesystem access.
+ */
+export function mergeSandboxPolicies(configured, request) {
+    if (configured === undefined) {
+        return request;
+    }
+    if (request === undefined) {
+        return configured;
+    }
+    if (configured.mode === "off") {
+        return request.mode === "native" ? request : configured;
+    }
+    if (request.mode === "off") {
+        return configured;
+    }
+    return {
+        ...configured,
+        readableRoots: intersectRoots(configured.readableRoots, request.readableRoots),
+        writableRoots: intersectRoots(configured.writableRoots, request.writableRoots),
+        denyWrite: [...new Set([...(configured.denyWrite ?? []), ...(request.denyWrite ?? [])])],
+        network: mergeNetworkPolicies(configured.network, request.network),
+        fallback: configured.fallback === "fail-closed" || request.fallback === "fail-closed"
+            ? "fail-closed"
+            : configured.fallback,
+        unsafeAllowHostProcess: configured.unsafeAllowHostProcess && request.unsafeAllowHostProcess,
+    };
+}
+export function createSrtSandboxEngine(options = {}) {
+    const command = options.command ?? "srt";
+    // Availability cannot change mid-session in a way we can act on, and the
+    // probe spawns a process — resolve it once per engine instance.
+    let availability = null;
+    return {
+        id: "srt",
+        isAvailable() {
+            availability ??= execFileAsync(command, ["--version"], { timeout: 5_000 })
+                .then(() => true, () => false);
+            return availability;
+        },
+        async prepareCommand(spec, policy) {
+            const cwd = resolve(spec.cwd ?? policy.root);
+            const settingsPath = await writeSrtSettingsFile(policy);
+            return {
+                ...spec,
+                command,
+                args: ["--settings", settingsPath, spec.command, ...(spec.args ?? [])],
+                cwd,
+                sandboxed: true,
+                sandboxSettingsPath: settingsPath,
+            };
+        },
+    };
+}
+const defaultEngines = new Map();
+function resolveDefaultEngine(policy) {
+    if (policy.engine !== "srt") {
+        return undefined;
+    }
+    let engine = defaultEngines.get(policy.engine);
+    if (engine === undefined) {
+        engine = createSrtSandboxEngine();
+        defaultEngines.set(policy.engine, engine);
+    }
+    return engine;
+}
+export async function prepareSandboxedCommand(input) {
+    const policy = input.policy;
+    const command = normalizeCommandSpec(input.command, policy?.root);
+    if (policy == null || policy.mode === "off") {
+        return { ...command, sandboxed: false };
+    }
+    const engine = input.engine ?? resolveDefaultEngine(policy);
+    if (engine === undefined || !(await engine.isAvailable())) {
+        if (policy.fallback === "unsafe-host-process" && policy.unsafeAllowHostProcess) {
+            return { ...command, sandboxed: false };
+        }
+        throw new SandboxUnavailableError(engine === undefined
+            ? `No sandbox engine is registered for "${policy.engine}" and policy is fail-closed.`
+            : "Sandbox engine is unavailable and policy is fail-closed.", {
+            engine: engine?.id ?? policy.engine,
+            command: command.command,
+        });
+    }
+    return engine.prepareCommand(command, policy);
+}
+export function srtSettingsForPolicy(policy) {
+    return {
+        network: {
+            allowedDomains: domainsForNetworkPolicy(policy.network),
+            deniedDomains: [],
+            allowLocalBinding: policy.network.mode === "localhost",
+            allowAllUnixSockets: false,
+        },
+        filesystem: {
+            denyRead: denyReadRootsForPolicy(policy),
+            allowRead: [...policy.readableRoots],
+            allowWrite: [...policy.writableRoots],
+            denyWrite: [...(policy.denyWrite ?? DEFAULT_DENY_WRITE)],
+        },
+    };
+}
+export function networkPolicyAllowsUrl(policy, url) {
+    if (policy == null || policy.mode === "off") {
+        return true;
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    // URL.hostname keeps IPv6 hosts bracketed ("[::1]"); match on the bare host.
+    const host = stripIpv6Brackets(parsed.hostname.toLowerCase());
+    if (policy.network.mode === "all") {
+        return true;
+    }
+    if (policy.network.mode === "none") {
+        return false;
+    }
+    if (policy.network.mode === "localhost") {
+        return isLocalhost(host);
+    }
+    return policy.network.allowlist.some((domain) => domainMatches(host, domain));
+}
+function normalizeCommandSpec(spec, fallbackCwd) {
+    const command = normalizeNonEmptyString(spec.command, "command");
+    const cwd = resolve(spec.cwd ?? fallbackCwd ?? process.cwd());
+    return {
+        command,
+        args: normalizeArgs(spec.args ?? []),
+        cwd,
+        ...(spec.env === undefined ? {} : { env: { ...spec.env } }),
+        sandboxed: false,
+    };
+}
+// argv entries may legitimately be empty (e.g. `--prefix ""`) and whitespace is
+// significant, so unlike policy fields they are only type-checked.
+function normalizeArgs(values) {
+    if (!Array.isArray(values)) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", "args must be an array.", { field: "args" });
+    }
+    return values.map((value, index) => {
+        if (typeof value !== "string") {
+            throw new SandboxPolicyError("invalid_sandbox_policy", `args[${index}] must be a string.`, { field: `args[${index}]` });
+        }
+        return value;
+    });
+}
+function normalizeNetworkPolicy(input) {
+    const mode = input?.mode ?? "none";
+    if (!SANDBOX_NETWORK_MODES.includes(mode)) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", "Invalid sandbox network mode.", { mode });
+    }
+    const allowlist = normalizeStringList(input?.allowlist ?? [], "network.allowlist")
+        .map((domain) => domain.toLowerCase());
+    if (mode === "allowlist" && allowlist.length === 0) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", "allowlist network mode requires at least one domain.", {
+            field: "network.allowlist",
+        });
+    }
+    return {
+        mode,
+        allowlist: mode === "allowlist" ? allowlist : [],
+    };
+}
+/**
+ * Intersection semantics: the merged policy allows a host only if both
+ * policies allow it. Incomparable modes (localhost vs allowlist) reduce to the
+ * allowlist entries that are loopback hosts; an empty intersection is "none",
+ * never an invalid empty allowlist.
+ */
+function mergeNetworkPolicies(configured, request) {
+    if (request === undefined) {
+        return configured;
+    }
+    if (configured.mode === "none" || request.mode === "none") {
+        return { mode: "none", allowlist: [] };
+    }
+    if (configured.mode === "all") {
+        return { mode: request.mode, allowlist: [...request.allowlist] };
+    }
+    if (request.mode === "all") {
+        return { mode: configured.mode, allowlist: [...configured.allowlist] };
+    }
+    if (configured.mode === "localhost" && request.mode === "localhost") {
+        return { mode: "localhost", allowlist: [] };
+    }
+    if (configured.mode === "allowlist" && request.mode === "allowlist") {
+        const requestDomains = new Set(request.allowlist);
+        const allowlist = configured.allowlist.filter((domain) => requestDomains.has(domain)).sort();
+        return allowlist.length === 0 ? { mode: "none", allowlist: [] } : { mode: "allowlist", allowlist };
+    }
+    const loopbackEntries = (configured.mode === "allowlist" ? configured.allowlist : request.allowlist)
+        .filter((domain) => isLocalhost(domain))
+        .sort();
+    return loopbackEntries.length === 0
+        ? { mode: "none", allowlist: [] }
+        : { mode: "allowlist", allowlist: loopbackEntries };
+}
+function intersectRoots(configured, request) {
+    const out = new Set();
+    for (const configuredRoot of configured) {
+        for (const requestRoot of request) {
+            if (pathContains(configuredRoot, requestRoot)) {
+                out.add(requestRoot);
+            }
+            else if (pathContains(requestRoot, configuredRoot)) {
+                out.add(configuredRoot);
+            }
+        }
+    }
+    return removeCoveredRoots([...out].sort());
+}
+function domainsForNetworkPolicy(policy) {
+    if (policy.mode === "all") {
+        return ["*"];
+    }
+    if (policy.mode === "localhost") {
+        return ["localhost", "127.0.0.1", "::1"];
+    }
+    if (policy.mode === "allowlist") {
+        return [...policy.allowlist];
+    }
+    return [];
+}
+function denyReadRootsForPolicy(policy) {
+    const roots = new Set();
+    const home = homedir();
+    // Secrets live under the home directory; deny it unless the policy
+    // explicitly grants it. More-specific allowRead roots inside home still win.
+    const homeReadable = policy.readableRoots.some((root) => pathContains(root, home));
+    if (!homeReadable) {
+        roots.add(home);
+    }
+    for (const readableRoot of policy.readableRoots) {
+        if (readableRoot === home || readableRoot.startsWith(`${home}/`)) {
+            roots.add(dirname(home));
+        }
+        if (readableRoot.startsWith("/Users/")) {
+            roots.add("/Users");
+        }
+        if (readableRoot.startsWith("/home/")) {
+            roots.add("/home");
+        }
+    }
+    roots.add(resolve(home, ".ssh"));
+    return removeCoveredRoots([...roots].sort());
+}
+// srt settings are a pure function of the policy, so the file is
+// content-addressed and shared across every command run under that policy.
+async function writeSrtSettingsFile(policy) {
+    const content = `${JSON.stringify(srtSettingsForPolicy(policy), null, 2)}\n`;
+    const digest = createHash("sha256").update(content).digest("hex").slice(0, 16);
+    const settingsPath = resolve(policy.tempRoot, `srt-settings-${digest}.json`);
+    if (existsSync(settingsPath)) {
+        return settingsPath;
+    }
+    await mkdir(policy.tempRoot, { recursive: true });
+    const stagingPath = `${settingsPath}.${process.pid}.${randomUUID()}.tmp`;
+    await writeFile(stagingPath, content, "utf8");
+    await rename(stagingPath, settingsPath);
+    return settingsPath;
+}
+function normalizePath(value, field) {
+    return resolve(normalizeNonEmptyString(value, field));
+}
+function normalizePathList(values, root, field) {
+    const paths = normalizeStringList(values, field).map((value) => resolve(root, value));
+    return [...new Set(paths)];
+}
+function normalizeStringList(values, field) {
+    if (!Array.isArray(values)) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", `${field} must be an array.`, { field });
+    }
+    return values.map((value, index) => normalizeNonEmptyString(value, `${field}[${index}]`));
+}
+function normalizeNonEmptyString(value, field) {
+    if (typeof value !== "string") {
+        throw new SandboxPolicyError("invalid_sandbox_policy", `${field} must be a string.`, { field });
+    }
+    const normalized = value.trim();
+    if (normalized.length === 0) {
+        throw new SandboxPolicyError("invalid_sandbox_policy", `${field} must not be empty.`, { field });
+    }
+    return normalized;
+}
+function stripIpv6Brackets(host) {
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isLocalhost(host) {
+    return host === "localhost" || host === "::1" || host === "127.0.0.1" || host.startsWith("127.");
+}
+function domainMatches(host, pattern) {
+    if (pattern.startsWith("*.")) {
+        const suffix = pattern.slice(1);
+        return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === pattern;
+}
+function pathContains(root, target) {
+    return target === root || target.startsWith(root === "/" ? "/" : `${root}/`);
+}
+function removeCoveredRoots(paths) {
+    const out = [];
+    for (const path of paths) {
+        if (out.some((root) => pathContains(root, path))) {
+            continue;
+        }
+        out.push(path);
+    }
+    return out;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAU,CAAC;AAGxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAU,CAAC;AAGxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAU,CAAC;AAKjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,CAAU,CAAC;AA0C9F,MAAM,OAAO,kBAAmB,SAAQ,UAA4B;CAAG;AAEvE,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IAC7D,YAAY,OAAe,EAAE,UAAmC,EAAE;QAChE,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAwDD,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;IACjD,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACrE,IAAI,QAAQ,KAAK,qBAAqB,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,qEAAqE,EACrE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,IAAI,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,uBAAuB,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,QAAQ,CAAC;QAChE,IAAI;QACJ,aAAa;QACb,aAAa;QACb,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAkF,EAAE;IAC1H,OAAO,mBAAmB,CAAC;QACzB,GAAG,KAAK;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,aAAa;QACvB,sBAAsB,EAAE,KAAK;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAqB;IACjE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAqC,EACrC,OAAkC;IAElC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,aAAa,EAAE,cAAc,CAAC,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QAC9E,aAAa,EAAE,cAAc,CAAC,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QAC9E,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,EAAE,oBAAoB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QAClE,QAAQ,EAAE,UAAU,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa;YACnF,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,UAAU,CAAC,QAAQ;QACvB,sBAAsB,EAAE,UAAU,CAAC,sBAAsB,IAAI,OAAO,CAAC,sBAAsB;KAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,yEAAyE;IACzE,gEAAgE;IAChE,IAAI,YAAY,GAA4B,IAAI,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,WAAW;YACT,YAAY,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;iBACvE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAwB,EAAE,MAAqB;YAClE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO;gBACP,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACtE,GAAG;gBACH,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,YAAY;aAClC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEjE,SAAS,oBAAoB,CAAC,MAAqB;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAClC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAmC;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,qBAAqB,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAC/E,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,wCAAwC,MAAM,CAAC,MAAM,8BAA8B;YACrF,CAAC,CAAC,0DAA0D,EAC9D;YACE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM;YACnC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC;YACvD,aAAa,EAAE,EAAE;YACjB,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YACtD,mBAAmB,EAAE,KAAK;SAC3B;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC;YACxC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;YACpC,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;YACrC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiC,EAAE,GAAW;IACnF,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB,EAAE,WAA+B;IACrF,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,OAAO;QACL,OAAO;QACP,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AACnE,SAAS,aAAa,CAAC,MAAyB;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,QAAQ,KAAK,qBAAqB,EAAE,EAAE,KAAK,EAAE,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA4C;IAC1E,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,MAAM,CAAC;IACnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,mBAAmB,CAAC;SAC/E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,sDAAsD,EAAE;YAC7G,KAAK,EAAE,mBAAmB;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,UAAgC,EAChC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;SACjG,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;SACvC,IAAI,EAAE,CAAC;IACV,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,UAA6B,EAAE,OAA0B;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,cAAc,IAAI,UAAU,EAAE,CAAC;QACxC,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,IAAI,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA4B;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqB;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,mEAAmE;IACnE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAChD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,iEAAiE;AACjE,2EAA2E;AAC3E,KAAK,UAAU,oBAAoB,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,MAAM,OAAO,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IACzE,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,OAAO,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB,EAAE,IAAY,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB,EAAE,KAAa;IACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,GAAG,KAAK,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAE,KAAa;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,GAAG,KAAK,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,GAAG,KAAK,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@mono-agent/sandbox",
+  "version": "0.1.0",
+  "description": "Fail-closed sandbox policy and native process wrapping for Mono Agent runtimes.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "private": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@mono-agent/agent-contracts": "0.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}