@myagentroam/node 0.9.62 → 0.9.65

package/dist/service/attachment-domain-state.js

@@ -1,2 +1,7 @@
-/* mar-release-protected */
-var _0x19952c=_0x1367;(function(_0x4655f1,_0x5967d3){var _0x3fa984=_0x1367,_0x29c96f=_0x4655f1();while(!![]){try{var _0x140e85=-parseInt(_0x3fa984(0x126))/(-0x21c2+-0x2*-0x10b5+0x1*0x59)+parseInt(_0x3fa984(0x12d))/(-0x1b4d*-0x1+0x5*0x59+-0x2*0xe84)+-parseInt(_0x3fa984(0x122))/(0x3*0xb35+0x10*0x40+-0x259c*0x1)+parseInt(_0x3fa984(0x123))/(0x8f5*0x2+-0x437*0x7+0xb9b)+-parseInt(_0x3fa984(0x129))/(-0x34e+0x118f+-0x1*0xe3c)*(-parseInt(_0x3fa984(0x12c))/(0x10be+-0x1*-0x222f+0x53*-0x9d))+-parseInt(_0x3fa984(0x12e))/(0x5d*-0x17+-0x331*-0x2+0x200)*(parseInt(_0x3fa984(0x125))/(0x1*-0x26ef+-0x1bd0+-0x42c7*-0x1))+parseInt(_0x3fa984(0x12f))/(-0x224a+0x2207+0x4c);if(_0x140e85===_0x5967d3)break;else _0x29c96f['push'](_0x29c96f['shift']());}catch(_0x36ff43){_0x29c96f['push'](_0x29c96f['shift']());}}}(_0x5565,-0x53367+0x8078e+0x409e5));function _0x1367(_0x510224,_0x31cf23){_0x510224=_0x510224-(-0x6d*0x53+0x1fd3+0x4a6);var _0x5bbf93=_0x5565();var _0x68879b=_0x5bbf93[_0x510224];if(_0x1367['iplQOw']===undefined){var _0x40dadd=function(_0x2400e4){var _0x58b941='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x34928c='',_0x32f11a='';for(var _0x3800a4=-0x16*0x4a+-0x52+0x6ae,_0x5a215b,_0x448dd6,_0x4ce908=0x324*0x5+-0xe5c+-0x158;_0x448dd6=_0x2400e4['charAt'](_0x4ce908++);~_0x448dd6&&(_0x5a215b=_0x3800a4%(-0x1c57+-0x173*0x7+-0x4*-0x9a0)?_0x5a215b*(0x13a*-0x17+0xf6b+0xd0b)+_0x448dd6:_0x448dd6,_0x3800a4++%(-0x2*-0xb7e+0x1939+0x49*-0xa9))?_0x34928c+=String['fromCharCode'](0xeed+0x1425+-0x2213&_0x5a215b>>(-(0x1c8d+0xe25+-0xaac*0x4)*_0x3800a4&0x1b59+0x21f0+-0x3d43*0x1)):-0x12ad+-0x15fc+-0x1*-0x28a9){_0x448dd6=_0x58b941['indexOf'](_0x448dd6);}for(var _0x1bbd4=-0x1cf5+-0xe9a+0x2b8f,_0x458dcc=_0x34928c['length'];_0x1bbd4<_0x458dcc;_0x1bbd4++){_0x32f11a+='%'+('00'+_0x34928c['charCodeAt'](_0x1bbd4)['toString'](0x1*0xa75+0x3*-0x7a2+0xc81))['slice'](-(0xec5+-0x1*0x112f+-0x9b*-0x4));}return decodeURIComponent(_0x32f11a);};_0x1367['ouaGuS']=_0x40dadd,_0x1367['NIdgqV']={},_0x1367['iplQOw']=!![];}var _0x4687fc=_0x5bbf93[-0x21c2+-0x2*-0x10b5+0x1*0x58];_0x1367['UCIYvR']!==_0x4687fc&&(_0x1367['NIdgqV']={},_0x1367['UCIYvR']=_0x4687fc);var _0x4c8a4c=_0x1367['NIdgqV'][_0x510224];return _0x4c8a4c===undefined?(_0x68879b=_0x1367['ouaGuS'](_0x68879b),_0x1367['NIdgqV'][_0x510224]=_0x68879b):_0x68879b=_0x4c8a4c,_0x68879b;}function _0x5565(){var _0x2bd8f9=['BMf0AxzLsgLZDg9YEuLTywDLvgLTzxjZ','BMf0AxzLsgLZDg9YEuLTywDLCW','mJmYnZiWv2zNwgzU','CNvUrgLYzwn0B3jPzxm','CNvUsw1Hz2vZ','otzSyMPcEgC','nZiZnJeWuvL1C1jj','n3f4EhnhAW','mtGWntC5nM9ZwNDAzq','otKYndC1sK5IA2Hu','mJe4mJKWoeP5AfLNuW','CNvUrMLSzurPCMvJDg9YAwvZ','mZqYmdi5nLbhuuPKsG','nJq0ndu4s0zsDM9q'];_0x5565=function(){return _0x2bd8f9;};return _0x5565();}export class AttachmentDomainState{[_0x19952c(0x12a)]=new Map();[_0x19952c(0x124)]=new Map();[_0x19952c(0x12b)]=new Map();[_0x19952c(0x128)]=new Map();[_0x19952c(0x127)]=new Map();}
+export class AttachmentDomainState {
+    runDirectories = new Map();
+    runFileDirectories = new Map();
+    runImages = new Map();
+    nativeHistoryImages = new Map();
+    nativeHistoryImageTimers = new Map();
+}

package/dist/service/bubblewrap-sandbox-executor.js

@@ -1,2 +1,543 @@
-/* mar-release-protected */
-const _0x1cdd99=_0x2d75;(function(_0x531559,_0x3d4125){const _0x1f88fe=_0x2d75,_0x4bdc5b=_0x531559();while(!![]){try{const _0x3891d0=parseInt(_0x1f88fe(0x284))/(-0x20bb+0xef1+0x11cb)*(-parseInt(_0x1f88fe(0x20c))/(0x42*0x39+-0x4f2*-0x4+-0x2278))+parseInt(_0x1f88fe(0x204))/(-0x20b0+0x36*0x4f+-0x1009*-0x1)+parseInt(_0x1f88fe(0x293))/(0x21b1+0x1333+-0x8*0x69c)+parseInt(_0x1f88fe(0x21a))/(-0x1*-0xd57+-0x17*0x2a+-0x98c)+parseInt(_0x1f88fe(0x278))/(0x3*0x487+0x3af+-0x113e)+parseInt(_0x1f88fe(0x239))/(-0x24ca+-0x26*-0xdf+-0x13d*-0x3)+-parseInt(_0x1f88fe(0x27b))/(0xc*0x29b+-0x183*0x4+-0x3e*0x68);if(_0x3891d0===_0x3d4125)break;else _0x4bdc5b['push'](_0x4bdc5b['shift']());}catch(_0x398324){_0x4bdc5b['push'](_0x4bdc5b['shift']());}}}(_0x2131,-0x3b*0x3802+-0x77537*0x1+0x4*0x74e65));import{execFile,spawn}from'node:child_process';import{closeSync,existsSync,lstatSync,openSync,readlinkSync,rmSync}from'node:fs';import{lstat,mkdir,mkdtemp,realpath,rm,writeFile}from'node:fs/promises';import{tmpdir}from'node:os';import{isAbsolute,join,posix,relative,resolve,sep}from'node:path';import{promisify}from'node:util';function _0x2d75(_0x144258,_0x4cfff8){_0x144258=_0x144258-(0x587+0xcc8+-0x1067);const _0x567d0e=_0x2131();let _0x50ec67=_0x567d0e[_0x144258];if(_0x2d75['EFTcYD']===undefined){var _0x5161a0=function(_0x3485fb){const _0x2d9d8a='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ca24c='',_0x1c4ca7='';for(let _0x784323=0xdf7+-0x2b*0xa5+0xdc0,_0x41e54a,_0x2e6369,_0x1c3c09=0x1ab+-0x9e7+0x2*0x41e;_0x2e6369=_0x3485fb['charAt'](_0x1c3c09++);~_0x2e6369&&(_0x41e54a=_0x784323%(0x2465+0x10fd+-0x355e)?_0x41e54a*(0x86f+-0x1*-0xd0d+-0x153c)+_0x2e6369:_0x2e6369,_0x784323++%(0xad*0xd+0x1ebc*-0x1+-0x15f7*-0x1))?_0x2ca24c+=String['fromCharCode'](0x397*0x5+-0x12*-0x23+-0x136a&_0x41e54a>>(-(-0x9db+-0x224+-0x7*-0x1b7)*_0x784323&-0xdc9*0x2+0x1f*0xa3+-0x7db*-0x1)):-0x2*-0xc6f+0x19a8+-0x3286){_0x2e6369=_0x2d9d8a['indexOf'](_0x2e6369);}for(let _0x106af9=-0x80*-0x26+-0x26*0xde+0x26*0x5e,_0xb50d3c=_0x2ca24c['length'];_0x106af9<_0xb50d3c;_0x106af9++){_0x1c4ca7+='%'+('00'+_0x2ca24c['charCodeAt'](_0x106af9)['toString'](-0x11c*-0x1b+0x807+-0x11*0x23b))['slice'](-(0x2047*0x1+0x1f49+-0x3f8e));}return decodeURIComponent(_0x1c4ca7);};_0x2d75['RMWAcP']=_0x5161a0,_0x2d75['mEAOKz']={},_0x2d75['EFTcYD']=!![];}const _0x2ed867=_0x567d0e[0x1*-0xf57+0x2*-0x833+0x1fbd];_0x2d75['qxuAXr']!==_0x2ed867&&(_0x2d75['mEAOKz']={},_0x2d75['qxuAXr']=_0x2ed867);const _0x4b411f=_0x2d75['mEAOKz'][_0x144258];return _0x4b411f===undefined?(_0x50ec67=_0x2d75['RMWAcP'](_0x50ec67),_0x2d75['mEAOKz'][_0x144258]=_0x50ec67):_0x50ec67=_0x4b411f,_0x50ec67;}import{MarAgentError}from'@myagentroam/agent';const execFileAsync=promisify(execFile),DEFAULT_BUBBLEWRAP_PATH=_0x1cdd99(0x250),SANDBOX_POLICY_VERSION=-0x2562+0x1ab+0x23b8,SANDBOX_PATH=_0x1cdd99(0x262),CURSOR_SAFE_ID=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u,SANDBOX_CPU_SECONDS=0x1*0x247d+0x5e4+-0x2935,SANDBOX_PROCESS_LIMIT=-0x1*0xcdd+-0x1*-0x86f+0x4ae,SANDBOX_OPEN_FILE_LIMIT=0xad*0xd+0x1ebc*-0x1+-0x497*-0x5,SANDBOX_FILE_SIZE_BYTES=(0x397*0x5+-0x12*-0x23+-0x1069)*(-0x9db+-0x224+-0x23*-0x75)*(-0xdc9*0x2+0x1f*0xa3+-0xe9*-0xd),SAFE_ENVIRONMENT_NAME=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u,GENERATED_IMAGES_SANDBOX_ROOT=_0x1cdd99(0x223),READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES=[_0x1cdd99(0x23a),_0x1cdd99(0x222)],FORBIDDEN_ENVIRONMENT_NAMES=new Set([_0x1cdd99(0x1f1),_0x1cdd99(0x1ff),_0x1cdd99(0x29b),_0x1cdd99(0x23d),_0x1cdd99(0x26b),_0x1cdd99(0x282),_0x1cdd99(0x2a6),_0x1cdd99(0x235),_0x1cdd99(0x1f4),_0x1cdd99(0x295),_0x1cdd99(0x242)]),RESERVED_SANDBOX_ROOTS=[_0x1cdd99(0x207),_0x1cdd99(0x261),_0x1cdd99(0x22e),_0x1cdd99(0x256),_0x1cdd99(0x225),_0x1cdd99(0x27c),_0x1cdd99(0x246),_0x1cdd99(0x26a),...READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES,_0x1cdd99(0x1ef),_0x1cdd99(0x1fd),_0x1cdd99(0x289)];export class BubblewrapSandboxExecutor{[_0x1cdd99(0x1eb)];#bubblewrapPath;constructor(_0x5e625c){const _0x9dacda=_0x1cdd99;this[_0x9dacda(0x1eb)]=_0x5e625c,this.#bubblewrapPath=_0x5e625c[_0x9dacda(0x29d)]??DEFAULT_BUBBLEWRAP_PATH;}async[_0x1cdd99(0x25c)](_0x1c32ec){const _0x3ace83=_0x1cdd99;_0x1c32ec[_0x3ace83(0x299)]?.[_0x3ace83(0x281)]();if(process[_0x3ace83(0x258)]!==_0x3ace83(0x27d))throw unavailable();if(this[_0x3ace83(0x1eb)][_0x3ace83(0x24b)]!==undefined)sandboxCompatibilityPath(this[_0x3ace83(0x1eb)][_0x3ace83(0x24b)]);if(this[_0x3ace83(0x1eb)][_0x3ace83(0x20e)]!==SANDBOX_POLICY_VERSION||![_0x3ace83(0x290),_0x3ace83(0x287)][_0x3ace83(0x238)](this[_0x3ace83(0x1eb)][_0x3ace83(0x233)]))throw policyInvalid();if(this[_0x3ace83(0x1eb)][_0x3ace83(0x25a)]===undefined!==(this[_0x3ace83(0x1eb)][_0x3ace83(0x24f)]===undefined))throw policyInvalid();if(this[_0x3ace83(0x1eb)][_0x3ace83(0x24f)]!==undefined)generatedImagesSandboxPath(this[_0x3ace83(0x1eb)][_0x3ace83(0x24f)]);await validateBackend(this.#bubblewrapPath);const _0x249ad0=await this.#mounts(),_0x2ef8a6=await sandboxPath(_0x1c32ec[_0x3ace83(0x25f)],_0x249ad0),_0x5c1051=sandboxCommand(_0x1c32ec,_0x249ad0),_0x5f53bf=await mkdtemp(join(tmpdir(),_0x3ace83(0x2a9))),_0x5059ad=join(_0x5f53bf,_0x3ace83(0x270)),_0x3ffaf1=join(_0x5f53bf,_0x3ace83(0x1f3));try{const _0x24cea8=this.#arguments(_0x249ad0,_0x2ef8a6,_0x1c32ec);await Promise[_0x3ace83(0x23b)]([writeFile(_0x5059ad,_0x24cea8[_0x3ace83(0x255)]('\x00')+'\x00',{'mode':0x180,'flag':'wx'}),writeFile(_0x3ffaf1,seccompFilter(process[_0x3ace83(0x20b)]),{'mode':0x180,'flag':'wx'})]);}catch(_0x42725a){await rm(_0x5f53bf,{'recursive':!![],'force':!![]})[_0x3ace83(0x236)](()=>undefined);throw _0x42725a instanceof MarAgentError?_0x42725a:policyInvalid(_0x42725a);}let _0x18fc61,_0x39f681;try{_0x18fc61=openSync(_0x5059ad,'r'),_0x39f681=openSync(_0x3ffaf1,'r'),rmSync(_0x5f53bf,{'recursive':!![],'force':!![]}),_0x1c32ec[_0x3ace83(0x299)]?.[_0x3ace83(0x281)]();try{const _0x587458=spawn(this.#bubblewrapPath,[_0x3ace83(0x213),'3','--',..._0x5c1051],{'cwd':'/','shell':![],'stdio':[_0x3ace83(0x2a2),_0x3ace83(0x2a2),_0x3ace83(0x2a2),_0x18fc61,_0x39f681],'windowsHide':!![],'detached':_0x1c32ec[_0x3ace83(0x244)],'env':{'PATH':_0x3ace83(0x229),'LANG':_0x3ace83(0x285),'LC_ALL':_0x3ace83(0x285)}});return _0x587458;}catch(_0x2408f7){throw unavailable(_0x2408f7);}}finally{if(_0x18fc61!==undefined)closeSync(_0x18fc61);if(_0x39f681!==undefined)closeSync(_0x39f681);rmSync(_0x5f53bf,{'recursive':!![],'force':!![]});}}async #mounts(){const _0xef3e6e=_0x1cdd99,_0x363c7b=[[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x22b)],_0xef3e6e(0x207),![]],[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x228)],_0xef3e6e(0x1f9),!![]],[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x2a0)],_0xef3e6e(0x283),!![]],[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x277)],_0xef3e6e(0x22c),!![]]];if(this[_0xef3e6e(0x1eb)][_0xef3e6e(0x25a)]!==undefined&&this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24f)]!==undefined)_0x363c7b[_0xef3e6e(0x211)](-0x2*-0xc6f+0x19a8+-0x3285,-0x80*-0x26+-0x26*0xde+0x26*0x5e,[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x25a)],this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24f)],![]]);if(this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24b)]!==undefined)_0x363c7b[_0xef3e6e(0x211)](-0x11c*-0x1b+0x807+-0x2*0x12fd,0x2047*0x1+0x1f49+-0x3f90,[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x22b)],this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24b)],![]],[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x228)],posix[_0xef3e6e(0x255)](this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24b)],_0xef3e6e(0x201)),!![]],[this[_0xef3e6e(0x1eb)][_0xef3e6e(0x2a0)],posix[_0xef3e6e(0x255)](this[_0xef3e6e(0x1eb)][_0xef3e6e(0x24b)],_0xef3e6e(0x28b)),!![]]);const _0x394dcd=[];for(const [_0x1eb571,_0x411adc,_0x5c2bdb]of _0x363c7b){_0x394dcd[_0xef3e6e(0x1ec)]({'source':await secureDirectory(_0x1eb571),'destination':_0x411adc,'writable':_0x5c2bdb});}for(const [_0x4734a9,_0x22ccc4]of _0x394dcd[_0xef3e6e(0x251)]()){for(const _0x3569fa of _0x394dcd[_0xef3e6e(0x23e)](_0x4734a9+(0x1*-0xf57+0x2*-0x833+0x1fbe))){if(_0x22ccc4[_0xef3e6e(0x1f2)]===_0x3569fa[_0xef3e6e(0x1f2)]){if(_0x22ccc4[_0xef3e6e(0x214)]!==_0x3569fa[_0xef3e6e(0x214)])throw policyInvalid();continue;}if(within(_0x22ccc4[_0xef3e6e(0x1f2)],_0x3569fa[_0xef3e6e(0x1f2)])||within(_0x3569fa[_0xef3e6e(0x1f2)],_0x22ccc4[_0xef3e6e(0x1f2)]))throw policyInvalid();}}const _0x1c7553=[..._0x394dcd][_0xef3e6e(0x297)](compareMountDestinations);return await prepareNestedMountDestinations(_0x1c7553),_0x1c7553;}#arguments(_0x37e178,_0x2ac659,_0x1a4241){const _0x506d43=_0x1cdd99,_0x46a38f=[_0x506d43(0x25b),_0x506d43(0x28f),...this[_0x506d43(0x1eb)][_0x506d43(0x233)]===_0x506d43(0x287)?[]:[_0x506d43(0x28e)],_0x506d43(0x254),_0x506d43(0x24c),_0x506d43(0x294),_0x506d43(0x1fa),_0x506d43(0x27e),_0x506d43(0x275),_0x506d43(0x245),_0x506d43(0x291),_0x506d43(0x296),_0x506d43(0x249),_0x506d43(0x243),_0x506d43(0x2a1),_0x506d43(0x1f1),SANDBOX_PATH,_0x506d43(0x2a1),_0x506d43(0x1ff),_0x506d43(0x261),_0x506d43(0x2a1),_0x506d43(0x20d),_0x506d43(0x285),_0x506d43(0x2a1),_0x506d43(0x286),_0x506d43(0x285),_0x506d43(0x2a1),_0x506d43(0x29b),_0x506d43(0x22c),_0x506d43(0x234),'/',...runtimeMountArguments(),...sandboxDirectoryArguments(_0x37e178),_0x506d43(0x206),_0x506d43(0x1ef),_0x506d43(0x260),_0x506d43(0x1fd),_0x506d43(0x234),_0x506d43(0x289)];for(const _0x410b87 of _0x37e178)_0x46a38f[_0x506d43(0x1ec)](_0x410b87[_0x506d43(0x214)]?_0x506d43(0x1fe):_0x506d43(0x1ee),_0x410b87[_0x506d43(0x1f2)],_0x410b87[_0x506d43(0x216)]);if(_0x1a4241[_0x506d43(0x1f6)]!==undefined){if(!CURSOR_SAFE_ID[_0x506d43(0x224)](_0x1a4241[_0x506d43(0x1f6)][_0x506d43(0x2a3)])||!CURSOR_SAFE_ID[_0x506d43(0x224)](_0x1a4241[_0x506d43(0x1f6)][_0x506d43(0x264)]))throw policyInvalid();_0x46a38f[_0x506d43(0x1ec)](_0x506d43(0x2a1),_0x506d43(0x215),_0x1a4241[_0x506d43(0x1f6)][_0x506d43(0x2a3)],_0x506d43(0x2a1),_0x506d43(0x271),_0x1a4241[_0x506d43(0x1f6)][_0x506d43(0x264)]);}for(const [_0x26bfed,_0x2ad45e]of explicitEnvironment(_0x1a4241))_0x46a38f[_0x506d43(0x1ec)](_0x506d43(0x2a1),_0x26bfed,_0x2ad45e);return _0x46a38f[_0x506d43(0x1ec)](_0x506d43(0x276),'4',_0x506d43(0x21f),_0x2ac659),_0x46a38f;}}export async function probeBubblewrapSandbox(_0x550f87=DEFAULT_BUBBLEWRAP_PATH){const _0x509375=_0x1cdd99;if(process[_0x509375(0x258)]!==_0x509375(0x27d))throw unavailable();const _0x2446fe=await execFileAsync(_0x550f87,[_0x509375(0x203)],{'timeout':0x1388,'windowsHide':!![]})[_0x509375(0x236)](_0x552899=>{throw unavailable(_0x552899);}),_0x457104=/^bubblewrap\s+([0-9]+(?:\.[0-9]+){1,3})\s*$/u[_0x509375(0x200)](_0x2446fe[_0x509375(0x220)])?.[0x20b*-0xb+-0x1*-0x1804+0x1*-0x18a];if(_0x457104===undefined)throw unavailable();const _0x28c19b=await mkdtemp(join(tmpdir(),_0x509375(0x217))),_0x503aba=Object[_0x509375(0x29c)]([_0x509375(0x218),_0x509375(0x201),_0x509375(0x28b),_0x509375(0x1e9)][_0x509375(0x263)](_0x1c6912=>[_0x1c6912,join(_0x28c19b,_0x1c6912)]));try{await Promise[_0x509375(0x23b)](Object[_0x509375(0x1f0)](_0x503aba)[_0x509375(0x263)](_0x28473d=>mkdir(_0x28473d,{'mode':0x1c0}))),await Promise[_0x509375(0x23b)]([_0x509375(0x201),_0x509375(0x28b)][_0x509375(0x263)](_0x5c0dee=>mkdir(join(_0x503aba[_0x509375(0x218)],_0x5c0dee),{'recursive':!![],'mode':0x1c0})));const _0x4bd447=new BubblewrapSandboxExecutor({'bubblewrapPath':_0x550f87,'policyVersion':SANDBOX_POLICY_VERSION,'workspaceDirectory':_0x503aba[_0x509375(0x218)],'sourceWorkspacePath':_0x509375(0x29f),'inboxDirectory':_0x503aba[_0x509375(0x201)],'outputDirectory':_0x503aba[_0x509375(0x28b)],'temporaryDirectory':_0x503aba[_0x509375(0x1e9)],'networkMode':_0x509375(0x290)}),_0x12b0ed=await _0x4bd447[_0x509375(0x25c)]({'command':_0x509375(0x268),'cwd':_0x503aba[_0x509375(0x218)],'shell':![],'environment':{},'detached':!![],'owner':{'sessionId':_0x509375(0x26d),'executionId':_0x509375(0x26d)}}),_0x263050=await waitForProbe(_0x12b0ed);if(_0x263050[_0x509375(0x219)]!==-0x1b3+-0x281+-0x1*-0x434)throw unavailable(new Error(_0x263050[_0x509375(0x298)]));return{'version':_0x457104};}finally{await rm(_0x28c19b,{'recursive':!![],'force':!![]})[_0x509375(0x236)](()=>undefined);}}async function waitForProbe(_0x1b57b6){const _0x1e44a4=_0x1cdd99,_0x55d50b=[];let _0x574f40=-0xff0+-0x3a9*0x7+0x298f;return _0x1b57b6[_0x1e44a4(0x298)]['on'](_0x1e44a4(0x1f8),_0x57afc0=>{const _0x446be5=_0x1e44a4;if(_0x574f40>=0x2353*-0x1+0x21*0x184+0x114f)return;const _0x18615c=0x28e8+-0x2718+0x1e30-_0x574f40;_0x55d50b[_0x446be5(0x1ec)](_0x57afc0[_0x446be5(0x24d)](0x22d*0x8+0x2*0xe5a+-0x2e1c,_0x18615c)),_0x574f40+=Math[_0x446be5(0x23f)](_0x57afc0[_0x446be5(0x265)],_0x18615c);}),_0x1b57b6[_0x1e44a4(0x29e)][_0x1e44a4(0x269)](),await new Promise((_0x5527bd,_0x383ef0)=>{const _0x348f35=_0x1e44a4,_0x21cc0b=setTimeout(()=>{const _0x27d684=_0x2d75;_0x1b57b6[_0x27d684(0x273)](_0x27d684(0x248)),_0x383ef0(unavailable(new Error(_0x27d684(0x28c))));},-0x263b+-0x469+-0x2b4*-0x17);_0x21cc0b[_0x348f35(0x212)](),_0x1b57b6[_0x348f35(0x252)](_0x348f35(0x226),_0x1f6822=>{clearTimeout(_0x21cc0b),_0x383ef0(unavailable(_0x1f6822));}),_0x1b57b6[_0x348f35(0x252)](_0x348f35(0x1fc),_0x385b0d=>{const _0x170291=_0x348f35;clearTimeout(_0x21cc0b),_0x5527bd({'code':_0x385b0d,'stderr':Buffer[_0x170291(0x253)](_0x55d50b)[_0x170291(0x29a)](_0x170291(0x267))});});});}async function validateBackend(_0x25fa24){const _0x5dc0d5=_0x1cdd99;try{const _0x1a1c1f=await lstat(_0x25fa24);if(!_0x1a1c1f[_0x5dc0d5(0x23c)]()||_0x1a1c1f[_0x5dc0d5(0x240)]()||(_0x1a1c1f[_0x5dc0d5(0x25e)]&-0x4f4+0x992+-0x455)===0x10*-0x13f+-0x21d*0x1+0x160d)throw unavailable();}catch(_0x5d2312){if(_0x5d2312 instanceof MarAgentError)throw _0x5d2312;throw unavailable(_0x5d2312);}}async function secureDirectory(_0x29c885){const _0x134fc2=_0x1cdd99;if(!isAbsolute(_0x29c885))throw policyInvalid();try{const _0x2ec115=await lstat(_0x29c885);if(!_0x2ec115[_0x134fc2(0x21d)]()||_0x2ec115[_0x134fc2(0x240)]())throw policyInvalid();const _0x407d2a=await realpath(_0x29c885);if(_0x407d2a!==resolve(_0x29c885))throw policyInvalid();return _0x407d2a;}catch(_0x22850b){if(_0x22850b instanceof MarAgentError)throw _0x22850b;throw policyInvalid(_0x22850b);}}async function sandboxPath(_0x3983f2,_0x1d5cc6){const _0x4d946a=_0x1cdd99,_0x314a7a=await secureDirectory(_0x3983f2),_0x54dc48=[..._0x1d5cc6][_0x4d946a(0x297)]((_0x9b87ca,_0x164d96)=>_0x164d96[_0x4d946a(0x1f2)][_0x4d946a(0x265)]-_0x9b87ca[_0x4d946a(0x1f2)][_0x4d946a(0x265)])[_0x4d946a(0x274)](_0x4c52cf=>_0x314a7a===_0x4c52cf[_0x4d946a(0x1f2)]||within(_0x4c52cf[_0x4d946a(0x1f2)],_0x314a7a));if(_0x54dc48===undefined)throw policyInvalid();const _0x25f6d1=relative(_0x54dc48[_0x4d946a(0x1f2)],_0x314a7a)[_0x4d946a(0x28a)](sep)[_0x4d946a(0x227)](Boolean);return _0x25f6d1[_0x4d946a(0x265)]===-0xb63+-0x1*-0x10a8+0x13*-0x47?_0x54dc48[_0x4d946a(0x216)]:posix[_0x4d946a(0x255)](_0x54dc48[_0x4d946a(0x216)],..._0x25f6d1);}function sandboxCommand(_0x48fcb8,_0x4aabf3){const _0x316077=_0x1cdd99,_0x5039dd=_0x48fcb8[_0x316077(0x292)]===undefined||_0x48fcb8[_0x316077(0x292)]===![]?[sandboxExecutable(_0x48fcb8[_0x316077(0x2a5)],_0x4aabf3),..._0x48fcb8[_0x316077(0x2a7)]??[]]:[sandboxExecutable(typeof _0x48fcb8[_0x316077(0x292)]===_0x316077(0x230)?_0x48fcb8[_0x316077(0x292)]:_0x316077(0x27f),_0x4aabf3),'-c',_0x48fcb8[_0x316077(0x2a5)],..._0x48fcb8[_0x316077(0x2a7)]??[]];return[_0x316077(0x221),_0x316077(0x1f5)+SANDBOX_CPU_SECONDS+':'+SANDBOX_CPU_SECONDS,_0x316077(0x24e)+SANDBOX_PROCESS_LIMIT+':'+SANDBOX_PROCESS_LIMIT,_0x316077(0x210)+SANDBOX_OPEN_FILE_LIMIT+':'+SANDBOX_OPEN_FILE_LIMIT,_0x316077(0x20f)+SANDBOX_FILE_SIZE_BYTES+':'+SANDBOX_FILE_SIZE_BYTES,'--',..._0x5039dd];}function sandboxExecutable(_0x5dd367,_0x27c1d1){const _0x6b4589=_0x1cdd99;if(!isAbsolute(_0x5dd367))return _0x5dd367;const _0x19227a=resolve(_0x5dd367),_0x57d319=resolve(process[_0x6b4589(0x28d)],'..','..');if(_0x57d319!==_0x6b4589(0x256)&&(_0x19227a===_0x57d319||within(_0x57d319,_0x19227a))){const _0x252b84=relative(_0x57d319,_0x19227a)[_0x6b4589(0x28a)](sep)[_0x6b4589(0x227)](Boolean);return _0x252b84[_0x6b4589(0x265)]===0x7b4+-0x121d+-0x5*-0x215?_0x6b4589(0x22f):posix[_0x6b4589(0x255)](_0x6b4589(0x22f),..._0x252b84);}const _0x1d69bf=[..._0x27c1d1][_0x6b4589(0x297)]((_0x4d61ba,_0x3b6fbc)=>_0x3b6fbc[_0x6b4589(0x1f2)][_0x6b4589(0x265)]-_0x4d61ba[_0x6b4589(0x1f2)][_0x6b4589(0x265)])[_0x6b4589(0x274)](_0x27e1d3=>_0x19227a===_0x27e1d3[_0x6b4589(0x1f2)]||within(_0x27e1d3[_0x6b4589(0x1f2)],_0x19227a));if(_0x1d69bf!==undefined){const _0xa78366=relative(_0x1d69bf[_0x6b4589(0x1f2)],_0x19227a)[_0x6b4589(0x28a)](sep)[_0x6b4589(0x227)](Boolean);return _0xa78366[_0x6b4589(0x265)]===-0x14cb*0x1+-0x1a37+0x2f02?_0x1d69bf[_0x6b4589(0x216)]:posix[_0x6b4589(0x255)](_0x1d69bf[_0x6b4589(0x216)],..._0xa78366);}if([_0x6b4589(0x256),_0x6b4589(0x225),_0x6b4589(0x27c),_0x6b4589(0x246),_0x6b4589(0x26a)][_0x6b4589(0x22d)](_0x3cc3ce=>_0x19227a===_0x3cc3ce||within(_0x3cc3ce,_0x19227a)))return _0x19227a;throw policyInvalid();}function explicitEnvironment(_0x28a8f1){const _0x4b2d5f=_0x1cdd99,_0x577556=[],_0x365b8a=new Set();for(const _0x4ce2f3 of _0x28a8f1[_0x4b2d5f(0x2a8)]??[]){if(_0x365b8a[_0x4b2d5f(0x259)](_0x4ce2f3))continue;_0x365b8a[_0x4b2d5f(0x257)](_0x4ce2f3);if(!SAFE_ENVIRONMENT_NAME[_0x4b2d5f(0x224)](_0x4ce2f3)||FORBIDDEN_ENVIRONMENT_NAMES[_0x4b2d5f(0x259)](_0x4ce2f3))throw policyInvalid();const _0x1354f0=_0x28a8f1[_0x4b2d5f(0x202)][_0x4ce2f3];if(typeof _0x1354f0!==_0x4b2d5f(0x230)||_0x1354f0[_0x4b2d5f(0x238)]('\x00')||Buffer[_0x4b2d5f(0x24a)](_0x1354f0)>0xf*-0x403+0x5ed6+0x5d57)throw policyInvalid();_0x577556[_0x4b2d5f(0x1ec)]([_0x4ce2f3,_0x1354f0]);}return _0x577556;}function sandboxCompatibilityPath(_0x48580d){const _0x1d8950=_0x1cdd99;if(!isAbsolute(_0x48580d)||_0x48580d[_0x1d8950(0x238)]('\x00')||_0x48580d==='/'||_0x48580d===_0x1d8950(0x22c)||resolve(_0x48580d)!==_0x48580d||RESERVED_SANDBOX_ROOTS[_0x1d8950(0x22d)](_0x3cb787=>_0x48580d===_0x3cb787||within(_0x3cb787,_0x48580d)||within(_0x48580d,_0x3cb787)))throw policyInvalid();return _0x48580d;}function generatedImagesSandboxPath(_0x5c5ead){const _0x3bc328=_0x1cdd99,_0x5b88ec=relative(GENERATED_IMAGES_SANDBOX_ROOT,_0x5c5ead)[_0x3bc328(0x28a)](sep)[_0x3bc328(0x227)](Boolean);if(!isAbsolute(_0x5c5ead)||_0x5c5ead[_0x3bc328(0x238)]('\x00')||resolve(_0x5c5ead)!==_0x5c5ead||!within(GENERATED_IMAGES_SANDBOX_ROOT,_0x5c5ead)||_0x5b88ec[_0x3bc328(0x265)]!==-0x19*-0x10d+0x1368+-0x1b1*0x1b||!safePathSegment(_0x5b88ec[-0x2*0x465+0x11*0x7f+0x1*0x5b])||_0x5b88ec[0xb1c+0x1c29+-0x4*0x9d1]!==_0x3bc328(0x288))throw policyInvalid();return _0x5c5ead;}function safePathSegment(_0x776fab){const _0x4c5e0c=_0x1cdd99;return _0x776fab[_0x4c5e0c(0x265)]>-0x9aa+-0x1a65+0x240f&&_0x776fab[_0x4c5e0c(0x265)]<=0xaea+0x11*-0x14e+0xc43&&_0x776fab!=='.'&&_0x776fab!=='..'&&!_0x776fab[_0x4c5e0c(0x238)]('/')&&!_0x776fab[_0x4c5e0c(0x238)]('\x5c');}function compareMountDestinations(_0x3f871e,_0x32a563){const _0x822748=_0x1cdd99,_0x1bff46=_0x3f871e[_0x822748(0x216)][_0x822748(0x28a)]('/')[_0x822748(0x227)](Boolean)[_0x822748(0x265)]-_0x32a563[_0x822748(0x216)][_0x822748(0x28a)]('/')[_0x822748(0x227)](Boolean)[_0x822748(0x265)];return _0x1bff46===-0x15d8+-0x3*0xa5d+0x34ef?_0x3f871e[_0x822748(0x216)][_0x822748(0x21c)](_0x32a563[_0x822748(0x216)],_0x822748(0x232)):_0x1bff46;}async function prepareNestedMountDestinations(_0x517a67){const _0x166249=_0x1cdd99;for(const [_0x597d82,_0x2e2255]of _0x517a67[_0x166249(0x251)]()){const _0x489b29=_0x517a67[_0x166249(0x23e)](0x4f*0x67+-0x307+0x1*-0x1cc2,_0x597d82)[_0x166249(0x227)](_0x257b59=>within(_0x257b59[_0x166249(0x216)],_0x2e2255[_0x166249(0x216)]))[_0x166249(0x297)]((_0x2e9afe,_0x80c158)=>_0x80c158[_0x166249(0x216)][_0x166249(0x265)]-_0x2e9afe[_0x166249(0x216)][_0x166249(0x265)])[-0x1e*0x2d+-0x1*-0x4f0+-0x56*-0x1];if(_0x489b29===undefined)continue;const _0x20e3cc=relative(_0x489b29[_0x166249(0x216)],_0x2e2255[_0x166249(0x216)])[_0x166249(0x28a)](sep)[_0x166249(0x227)](Boolean),_0x1f2a8c=join(_0x489b29[_0x166249(0x1f2)],..._0x20e3cc);if(_0x489b29[_0x166249(0x214)]){await mkdir(_0x1f2a8c,{'recursive':!![],'mode':0x1c0});continue;}try{const _0x555585=await lstat(_0x1f2a8c);if(!_0x555585[_0x166249(0x21d)]()||_0x555585[_0x166249(0x240)]()||await realpath(_0x1f2a8c)!==resolve(_0x1f2a8c))throw policyInvalid();}catch(_0x247b8b){if(_0x247b8b instanceof MarAgentError)throw _0x247b8b;throw policyInvalid(_0x247b8b);}}}function sandboxDirectoryArguments(_0x147953){const _0x5e8fe9=_0x1cdd99,_0x1f7793=new Set([_0x5e8fe9(0x26f),_0x5e8fe9(0x261)]);for(const _0x4f409c of _0x147953){const _0x59f5ad=_0x4f409c[_0x5e8fe9(0x216)][_0x5e8fe9(0x28a)]('/')[_0x5e8fe9(0x227)](Boolean);let _0x55283a='';for(const _0x59cc76 of _0x59f5ad){_0x55283a=_0x55283a+'/'+_0x59cc76,_0x1f7793[_0x5e8fe9(0x257)](_0x55283a);}}return[..._0x1f7793][_0x5e8fe9(0x297)]((_0x4766b8,_0x2dd739)=>{const _0xccad95=_0x5e8fe9,_0x13e9e6=_0x4766b8[_0xccad95(0x28a)]('/')[_0xccad95(0x227)](Boolean)[_0xccad95(0x265)]-_0x2dd739[_0xccad95(0x28a)]('/')[_0xccad95(0x227)](Boolean)[_0xccad95(0x265)];return _0x13e9e6===0x1e66+0x1106+-0x17b6*0x2?_0x4766b8[_0xccad95(0x21c)](_0x2dd739,_0xccad95(0x232)):_0x13e9e6;})[_0x5e8fe9(0x1ed)](_0x22b300=>[_0x5e8fe9(0x26e),_0x22b300]);}function _0x2131(){const _0x205369=['ufLuse9ouefusa','yxjNCW','zw52AxjVBM1LBNrlzxLZ','BwfYlw5VzguTyNDYyxaTBgf1BMnOlq','u0forejpwf9vtKfwquLmqujmrq','Dg1W','l2v0yY9OB3n0lMnVBMy','B3b0Aw9UCW','ChvZAa','zMXHDe1HCa','ls1YBY1IAw5K','l3bYB2m','DMfSDwvZ','uefusa','C291CMnL','C2vJy29TCc5ICgy','qKftsf9ftLy','ls1JChu9','B3DUzxi','l2v0yY9NCM91Ca','zgf0yq','l3DVCMTZCgfJzs9PBMjVEa','ls1KAxnHyMXLlxvZzxjUCW','D3jPDgvvsw50mZjmrq','y2XVC2u','l2rLDG','ls1IAw5K','se9nrq','zxHLyW','Aw5IB3G','zw52AxjVBM1LBNq','ls12zxjZAw9U','mtG5mJK0ourWuNLwzq','D3jPDgvvsw50oa','ls1WCM9J','l3DVCMTZCgfJzq','l2v0yY9ZC2WVy2vYDhm','qNvIyMXLD3jHCcbZyw5KyM94igLZihvUyxzHAwXHyMXLlG','yxjTnJq','yxjJAa','mMHOBefLzW','teforW','Cg9SAwn5vMvYC2LVBG','ls1MC2L6zt0','ls1UB2zPBgu9','C3bSAwnL','Dw5Yzwy','ls1HCMDZ','D3jPDgfIBgu','tufsx0fhru5ux1nfu1njt05Fsuq','zgvZDgLUyxrPB24','BwfYlw5VzguTyNDYyxaTChjVyMuT','D29YA3nWywnL','y29Kzq','nty4mZu1mgrgshHlta','yxvKAxrbCMnOAxrLy3r1CMu','Bg9JywXLq29TCgfYzq','AxneAxjLy3rVCNK','u0forejpwf9qt0Xjq1LFsu5wquXjra','ls1JAgrPCG','C3rKB3v0','l3vZCI9IAw4VChjSAw1PDa','l2v0yY9SAwjYzw9MzMLJzq','l2HVBwuVBwfYlY5TyxiVywDLBNqVC2vZC2LVBNm','DgvZDa','l2jPBG','zxjYB3i','zMLSDgvY','Aw5IB3HeAxjLy3rVCNK','l3vZCI9IAw46l2jPBG','l2v0yY9Szc5ZBY5JywnOzq','D29YA3nWywnLrgLYzwn0B3j5','l3rTCa','C29Tzq','l3j1BNrPBwu','l3j1BNrPBwuVBM9Kzq','C3rYAw5N','yMXVy2TLzfn5C2nHBgXZ','zw4Tvvm','BMv0D29YA01Vzgu','ls10BxbMCW','ufLuse9ose9nrq','y2f0y2G','u2fUzgjVEcbWB2XPy3KGAxmGAw52ywXPzc4','Aw5JBhvKzxm','nZu5otiYmwvHuhvktq','l2v0yY9MB250CW','ywXS','AxngAwXL','terFufjfte9bra','C2XPy2u','BwLU','AxntEw1IB2XPy0XPBMS','l2v0yY9SB2nHBhrPBwu','u1nix0fvveHFu09dsW','ls1JBgvHCMvUDG','zgv0ywnOzwq','ls1JyxaTzhjVCa','l2XPyG','C3rHCNrZv2L0Aa','u0Lhs0Lmta','BwfYlwHVC3rLza','yNL0zuXLBMD0Aa','C291CMnLv29YA3nWywnLugf0Aa','ls11BNnOyxjLlwLWyW','C3vIyxjYyxK','ls1UChjVyZ0','z2vUzxjHDgvKsw1Hz2vZtg9NAwnHBfbHDgG','l3vZCI9IAw4VyNDYyxa','zw50CMLLCW','B25Jzq','y29Uy2f0','ls11BNnOyxjLlxv0CW','AM9PBG','l3vZCG','ywrK','CgXHDgzVCM0','AgfZ','z2vUzxjHDgvKsw1Hz2vZrgLYzwn0B3j5','ls11BNnOyxjLlxvZzxi','C3bHD24','ls1ZEw1SAw5R','Bw9Kzq','y3DK','ls1Kzxy','l2HVBwuVBwfY','l3j1BNrPBwuVBM9Kzs9IAw46l3vZCI9SB2nHBc9ZyMLUoI91C3iVBg9JywWVyMLUoI91C3iVC2jPBJOVDxnYl2jPBJOVC2jPBJOVyMLU','BwfW','zxHLy3v0Aw9Uswq','BgvUz3rO','l2v0yY9UC3n3AxrJAc5JB25M','DxrMoa','l2jPBI90CNvL','zw5K','l2XPyJy0','terFteLcuKfswv9qqvri','ywXSB2m','C2fUzgjVEc1WCM9Izq','ls1KAxi','l2HVBwu','yxjNDw1LBNrZ','tufsx0fhru5ux0vyrunvveLptL9jra','Edy0','A2LSBa','zMLUza','ls1UzxCTC2vZC2LVBG','ls1ZzwnJB21W','DgvTCg9Yyxj5rgLYzwn0B3j5','mZq2mJi1oeX2quX1wq','l2v0yY9OB3n0CW','D3jPDgvvsw50mtzmrq','mtK2ndy4mJrlCgvHrvC','l3nIAw4','BgLUDxG','ls1KAwuTD2L0Ac1WyxjLBNq','l2jPBI9ZAa','l2v0yY9YzxnVBhyUy29UzG','DgHYB3DjzKfIB3j0zwq','tK9erv9pufrjt05t','l3DVCMTZCgfJzs9VDxrWDxq','nZK5ode3q2fywLLx','qY5vveyToa','tenFquXm','vu5srvnuuKLdveve','z2vUzxjHDgvKx2LTywDLCW','l3j1BG','C3bSAxq','B3v0Chv0','u2fUzgjVEcbWCM9Izsb0Aw1LzcbVDxqU','zxHLy1bHDgG','ls11BNnOyxjLlw5LDa','ls11BNnOyxjLlxbPza','tK9orq','quXm','C2HLBgW','mtyYmZy1nKTmv3Pwrq','ls11BNnOyxjLlwnNCM91Cc10CNK','ru5w','ls1OB3n0BMfTzq','C29YDa','C3rKzxjY','C2LNBMfS','Dg9tDhjPBMC','ve1qreLs','zNjVBuvUDhjPzxm','yNvIyMXLD3jHCfbHDgG','C3rKAw4','l2HVBwuVBwfYlxnHBMrIB3GTChjVyMuVD29YA3nWywnL','B3v0Chv0rgLYzwn0B3j5','ls1ZzxrLBNy','CgLWzq','C2vZC2LVBKLK','l2v0yY9WyxnZD2q','y29TBwfUza'];_0x2131=function(){return _0x205369;};return _0x2131();}function runtimeMountArguments(){const _0x2cdb79=_0x1cdd99,_0x15fcc7=[],_0x416078=resolve(process[_0x2cdb79(0x28d)],'..','..');if(_0x416078!==_0x2cdb79(0x256))_0x15fcc7[_0x2cdb79(0x1ec)](_0x2cdb79(0x26e),_0x2cdb79(0x22e),_0x2cdb79(0x26e),_0x2cdb79(0x22f),_0x2cdb79(0x1ee),_0x416078,_0x2cdb79(0x22f));for(const _0x10763b of[_0x2cdb79(0x256),_0x2cdb79(0x225),_0x2cdb79(0x27c),_0x2cdb79(0x246),_0x2cdb79(0x26a)]){if(!existsSync(_0x10763b))continue;const _0x2ca0f2=lstatSync(_0x10763b);if(_0x2ca0f2[_0x2cdb79(0x240)]())_0x15fcc7[_0x2cdb79(0x1ec)](_0x2cdb79(0x25d),readlinkSync(_0x10763b),_0x10763b);else{if(_0x2ca0f2[_0x2cdb79(0x21d)]())_0x15fcc7[_0x2cdb79(0x1ec)](_0x2cdb79(0x1ee),_0x10763b,_0x10763b);}}for(const _0x2a7f49 of READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES){if(!existsSync(_0x2a7f49)||!lstatSync(_0x2a7f49)[_0x2cdb79(0x21d)]())continue;_0x15fcc7[_0x2cdb79(0x1ec)](_0x2cdb79(0x1ee),_0x2a7f49,_0x2a7f49);}for(const _0x5dd8b2 of[_0x2cdb79(0x1ea),_0x2cdb79(0x279),_0x2cdb79(0x22a),_0x2cdb79(0x280),_0x2cdb79(0x2a4),_0x2cdb79(0x1f7),_0x2cdb79(0x266),_0x2cdb79(0x241),_0x2cdb79(0x208)]){if(existsSync(_0x5dd8b2))_0x15fcc7[_0x2cdb79(0x1ec)](_0x2cdb79(0x1ee),_0x5dd8b2,_0x5dd8b2);}return _0x15fcc7;}function seccompFilter(_0x3dfc87){const _0xbc732f=_0x1cdd99,_0x466a5d=syscallPolicy(_0x3dfc87),_0x11ec67=[[-0x60e+-0x1e4*0xc+0x2e3*0xa,-0x47*-0x4d+-0xa6f*-0x1+-0x1*0x1fca,0x5*-0x1b0+-0x2bd*-0x4+-0x17*0x1c,-0x2172+-0x1477+0x35ed],[0xa96*0x3+0x1f45*0x1+-0x3ef2,0x1*-0x19a8+0x1abf*-0x1+0x3468,-0x78c+0x11b*0x1f+-0x1*0x1ab9,_0x466a5d[_0xbc732f(0x21b)]],[0x1d87*-0x1+0x7cf*0x1+0x15be,-0x17c3+-0xd2c+0x5*0x763,-0x1f47+-0xb24+-0x2a6b*-0x1,-0x53e02*0x1fa5+-0x44cad7ae+0x16aae0cf8],[0x1eb+0x1cfe*0x1+-0x6f*0x47,-0x51*0x51+-0x2358+0x3*0x1453,-0x20b9+0x12e4+0xdd5,0x1425+-0x1*0x18cc+0x4a7]];if(_0x3dfc87===_0xbc732f(0x272))_0x11ec67[_0xbc732f(0x1ec)]([-0x1103+0xb13+-0x2*-0x322,0x15f*0x3+0xb33+0x118*-0xe,0x73d+-0x6*0x556+0x18c7,-0x69eacb04+0x2640bfa+0xa786bf0a*0x1],[0x18e6+0x3*0x643+-0x2b9a,0x395+0xdc*-0x14+0xd9c,0x46f+0x3f*-0x42+0xbcf,0x1*-0xcb3+-0x23b*0xd+0x29b2],[0x2bd*-0xe+-0xde8+0xa*0x53a,-0x1d58+0x103c+0xd1c,0x1a12+-0xc8e+0xd84*-0x1,0x7fda77b8*-0x1+-0x3*0x124b41c6+-0xe3ee92*-0x15d],[0xcc7+-0x10f*-0x19+0xd0a*-0x3,-0x2295+0x791+-0x1b04*-0x1,0xe*0x127+0x114a*0x1+-0xc*0x2c9,-0x23f*-0x8+0x1*-0x5b3+-0xc45]);for(const _0x3569ce of _0x466a5d[_0xbc732f(0x231)])_0x11ec67[_0xbc732f(0x1ec)]([0x9e*0x3e+0x1*0xb56+-0x7*0x713,0x217*0xd+-0x8a2+-0x1289,-0x3*0x6+0x25ef+-0x25dc,_0x3569ce],[-0x1ff3+-0x5cf+-0x34*-0xba,-0x1*0x1625+-0x1136+0xd*0x307,0xced*-0x3+-0x1a3*0x2+-0x5*-0x869,0x356cb+0x8774f+0x52f5*-0x15]);_0x11ec67[_0xbc732f(0x1ec)]([0x1*-0x4cd+-0x2*0x8d8+0x33*0x71,0x19b8*-0x1+-0x1*0x1bd3+0x358b,-0x1010+0x34*0x6c+0x8*-0xbc,-0x300b41*-0x18a+-0x276efc43+0x5d7caa39]);const _0x14dd5f=Buffer[_0xbc732f(0x26c)](_0x11ec67[_0xbc732f(0x265)]*(-0x1c14+0x214a+-0x52e));for(const [_0x4a76ca,[_0x33ce83,_0x515886,_0x1028b4,_0x7c613c]]of _0x11ec67[_0xbc732f(0x251)]()){const _0x526a32=_0x4a76ca*(0x16f4+-0x2250+-0x3cc*-0x3);_0x14dd5f[_0xbc732f(0x27a)](_0x33ce83,_0x526a32),_0x14dd5f[_0xbc732f(0x205)](_0x515886,_0x526a32+(0xd13*-0x1+-0x52e+0x1243)),_0x14dd5f[_0xbc732f(0x205)](_0x1028b4,_0x526a32+(-0x1267+0x150f+-0x2a5)),_0x14dd5f[_0xbc732f(0x1fb)](_0x7c613c>>>-0x145e+0x9c6+0xa98,_0x526a32+(0x1fbc+0x25c1+0x4579*-0x1));}return _0x14dd5f;}function syscallPolicy(_0x5c709e){const _0x2b21b0=_0x1cdd99;if(_0x5c709e===_0x2b21b0(0x272))return{'auditArchitecture':0xc000003e,'blockedSyscalls':[0xf63+0xf36+-0x1e34,-0x109+-0x22b6+0x245a,0x17*-0x64+-0x269*-0x10+-0x1cef,0xf22*-0x1+-0x263d+0x3605,-0x1*-0x1af+-0x3ea+0x1*0x2ea,0x915+-0x1c07+0x13a2,0x1c+0x25ef*0x1+-0x2515,0x4*-0x2f2+-0x2404+0x1*0x30c4,-0x577*-0x1+-0x301*0xb+0x1c8d,-0xbee*-0x1+0x352+-0xe46,-0x2*0x1d3+0x2*0xed5+0xc7a*-0x2,-0x15d*0x5+-0x2*-0x177+0x50d,0xd7f*0x1+-0x1f4f+0x4c0*0x4,0xcde+0x1*0x971+-0x151b,-0x1bc1+0x1a9e*-0x1+0x3798,-0x1*-0x20f6+0x2*0x1334+0x1f*-0x243,-0x71*0xf+0x137a+-0xb98,-0x217a+0x17d7+0xb4f,0x1777+-0x3f1+-0x11d9,0x1*0x13a4+-0x1*-0xd22+0x638*-0x5,0x57d+-0x1044+0xc76,0x1d*-0x132+-0x14a*-0xf+0x1104,-0x1*0x1a09+-0x217e+0x3d41]};if(_0x5c709e===_0x2b21b0(0x20a))return{'auditArchitecture':0xc00000b7,'blockedSyscalls':[-0x394*-0x3+-0x1add+0x1*0x1048,0x19fd+-0x3be+-0x1617,0x57d+0x25d2+-0x2b26,-0x2bd*-0x5+-0xa27+-0x329*0x1,-0x19df+-0x1e5*-0x13+-0x9b8,0x255+-0x67f*0x1+0x493,0x5b1+-0x10*-0x1e1+-0x2357,-0x33*0x49+0xf02+-0x2,-0x26bc+-0x260c+0x4da1,0x5*0x491+0x485*-0x1+-0x1176,0x5f*0x5b+-0x165+-0x1f85,-0xd4*-0x11+-0x5e*-0x67+0xa31*-0x5,0x1*-0xcf7+-0x1d*0xdf+0x2743*0x1,0x25*0x67+-0x16df*-0x1+-0x24b6,-0x1*0x25af+-0x21fc+0x48bc,0x437+-0x112e+0xe0f,0xd69*0x1+0x1fc0+-0x2c0f,-0x18cd+-0xf8b*-0x1+-0x2*-0x577,-0x1396+-0x13*-0x127+-0xa2,0x1c55+-0x77a+-0x132d,-0x2*0x65a+-0x655*0x1+-0x14b8*-0x1,0x1*0x20b+0x168a+-0x16e5,0x1787+-0x24ba+-0xeed*-0x1]};throw policyInvalid();}function within(_0x58e2b8,_0x35e6aa){const _0x4f90c8=_0x1cdd99,_0x3c8ecf=relative(_0x58e2b8,_0x35e6aa);return _0x3c8ecf[_0x4f90c8(0x265)]>-0x1d9e+-0x1968+0x3706&&_0x3c8ecf!=='..'&&!_0x3c8ecf[_0x4f90c8(0x247)]('..'+sep);}function unavailable(_0x599ab6){const _0x31a38d=_0x1cdd99;return new MarAgentError(_0x31a38d(0x1e8),_0x31a38d(0x209),{'cause':_0x599ab6});}function policyInvalid(_0x1b76f9){const _0x3d8a5b=_0x1cdd99;return new MarAgentError(_0x3d8a5b(0x21e),_0x3d8a5b(0x237),{'cause':_0x1b76f9});}
+import { execFile, spawn } from 'node:child_process';
+import { closeSync, existsSync, lstatSync, openSync, readlinkSync, rmSync } from 'node:fs';
+import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+import { MarAgentError } from '@myagentroam/agent';
+const execFileAsync = promisify(execFile);
+const DEFAULT_BUBBLEWRAP_PATH = '/usr/bin/bwrap';
+const SANDBOX_POLICY_VERSION = 1;
+const SANDBOX_PATH = '/runtime/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const CURSOR_SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const SANDBOX_CPU_SECONDS = 300;
+const SANDBOX_PROCESS_LIMIT = 64;
+const SANDBOX_OPEN_FILE_LIMIT = 256;
+const SANDBOX_FILE_SIZE_BYTES = 1024 * 1024 * 1024;
+const SAFE_ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+const GENERATED_IMAGES_SANDBOX_ROOT = '/home/mar/.mar/agent/sessions';
+// Fontconfig and LibreOffice resolve required host configuration through absolute /etc paths
+// and /usr symlinks. Keep this allowlist read-only and never broaden it to the full /etc tree.
+const READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES = ['/etc/fonts', '/etc/libreoffice'];
+const FORBIDDEN_ENVIRONMENT_NAMES = new Set([
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'NODE_OPTIONS',
+    'PYTHONPATH',
+    'PYTHONHOME',
+    'BASH_ENV',
+    'ENV',
+    'SSH_AUTH_SOCK'
+]);
+const RESERVED_SANDBOX_ROOTS = [
+    '/workspace',
+    '/home/mar',
+    '/runtime',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib64',
+    ...READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES,
+    '/proc',
+    '/dev',
+    '/run'
+];
+/** Compiles one hosted-conversation process request into the fixed Linux Bubblewrap policy. */
+export class BubblewrapSandboxExecutor {
+    options;
+    #bubblewrapPath;
+    constructor(options) {
+        this.options = options;
+        this.#bubblewrapPath = options.bubblewrapPath ?? DEFAULT_BUBBLEWRAP_PATH;
+    }
+    async spawn(request) {
+        request.signal?.throwIfAborted();
+        if (process.platform !== 'linux')
+            throw unavailable();
+        if (this.options.sourceWorkspacePath !== undefined)
+            sandboxCompatibilityPath(this.options.sourceWorkspacePath);
+        if (this.options.policyVersion !== SANDBOX_POLICY_VERSION ||
+            !['NONE', 'UNRESTRICTED'].includes(this.options.networkMode))
+            throw policyInvalid();
+        if ((this.options.generatedImagesDirectory === undefined) !==
+            (this.options.generatedImagesLogicalPath === undefined))
+            throw policyInvalid();
+        if (this.options.generatedImagesLogicalPath !== undefined)
+            generatedImagesSandboxPath(this.options.generatedImagesLogicalPath);
+        await validateBackend(this.#bubblewrapPath);
+        const mounts = await this.#mounts();
+        const cwd = await sandboxPath(request.cwd, mounts);
+        const command = sandboxCommand(request, mounts);
+        const launchDirectory = await mkdtemp(join(tmpdir(), 'mar-node-bwrap-launch-'));
+        const argumentPath = join(launchDirectory, 'arguments');
+        const seccompPath = join(launchDirectory, 'seccomp.bpf');
+        try {
+            const arguments_ = this.#arguments(mounts, cwd, request);
+            await Promise.all([
+                writeFile(argumentPath, `${arguments_.join('\0')}\0`, { mode: 0o600, flag: 'wx' }),
+                writeFile(seccompPath, seccompFilter(process.arch), { mode: 0o600, flag: 'wx' })
+            ]);
+        }
+        catch (error) {
+            await rm(launchDirectory, { recursive: true, force: true }).catch(() => undefined);
+            throw error instanceof MarAgentError ? error : policyInvalid(error);
+        }
+        let argumentFd;
+        let seccompFd;
+        try {
+            argumentFd = openSync(argumentPath, 'r');
+            seccompFd = openSync(seccompPath, 'r');
+            rmSync(launchDirectory, { recursive: true, force: true });
+            request.signal?.throwIfAborted();
+            try {
+                const child = spawn(this.#bubblewrapPath, ['--args', '3', '--', ...command], {
+                    cwd: '/',
+                    shell: false,
+                    stdio: ['pipe', 'pipe', 'pipe', argumentFd, seccompFd],
+                    windowsHide: true,
+                    detached: request.detached,
+                    env: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }
+                });
+                return child;
+            }
+            catch (error) {
+                throw unavailable(error);
+            }
+        }
+        finally {
+            if (argumentFd !== undefined)
+                closeSync(argumentFd);
+            if (seccompFd !== undefined)
+                closeSync(seccompFd);
+            rmSync(launchDirectory, { recursive: true, force: true });
+        }
+    }
+    async #mounts() {
+        const definitions = [
+            [this.options.workspaceDirectory, '/workspace', false],
+            [this.options.inboxDirectory, '/workspace/inbox', true],
+            [this.options.outputDirectory, '/workspace/output', true],
+            [this.options.temporaryDirectory, '/tmp', true]
+        ];
+        if (this.options.generatedImagesDirectory !== undefined &&
+            this.options.generatedImagesLogicalPath !== undefined)
+            definitions.splice(1, 0, [
+                this.options.generatedImagesDirectory,
+                this.options.generatedImagesLogicalPath,
+                false
+            ]);
+        if (this.options.sourceWorkspacePath !== undefined)
+            definitions.splice(1, 0, [this.options.workspaceDirectory, this.options.sourceWorkspacePath, false], [this.options.inboxDirectory, posix.join(this.options.sourceWorkspacePath, 'inbox'), true], [this.options.outputDirectory, posix.join(this.options.sourceWorkspacePath, 'output'), true]);
+        const mounts = [];
+        for (const [source, destination, writable] of definitions) {
+            mounts.push({ source: await secureDirectory(source), destination, writable });
+        }
+        for (const [index, mount] of mounts.entries()) {
+            for (const other of mounts.slice(index + 1)) {
+                if (mount.source === other.source) {
+                    if (mount.writable !== other.writable)
+                        throw policyInvalid();
+                    continue;
+                }
+                if (within(mount.source, other.source) || within(other.source, mount.source))
+                    throw policyInvalid();
+            }
+        }
+        const ordered = [...mounts].sort(compareMountDestinations);
+        await prepareNestedMountDestinations(ordered);
+        return ordered;
+    }
+    #arguments(mounts, cwd, request) {
+        const args = [
+            '--unshare-user',
+            '--unshare-pid',
+            ...(this.options.networkMode === 'UNRESTRICTED' ? [] : ['--unshare-net']),
+            '--unshare-uts',
+            '--unshare-ipc',
+            '--unshare-cgroup-try',
+            '--disable-userns',
+            '--die-with-parent',
+            '--new-session',
+            '--cap-drop',
+            'ALL',
+            '--hostname',
+            'mar-hosted',
+            '--clearenv',
+            '--setenv',
+            'PATH',
+            SANDBOX_PATH,
+            '--setenv',
+            'HOME',
+            '/home/mar',
+            '--setenv',
+            'LANG',
+            'C.UTF-8',
+            '--setenv',
+            'LC_ALL',
+            'C.UTF-8',
+            '--setenv',
+            'TMPDIR',
+            '/tmp',
+            '--tmpfs',
+            '/',
+            ...runtimeMountArguments(),
+            ...sandboxDirectoryArguments(mounts),
+            '--proc',
+            '/proc',
+            '--dev',
+            '/dev',
+            '--tmpfs',
+            '/run'
+        ];
+        for (const mount of mounts)
+            args.push(mount.writable ? '--bind' : '--ro-bind', mount.source, mount.destination);
+        if (request.owner !== undefined) {
+            if (!CURSOR_SAFE_ID.test(request.owner.sessionId) ||
+                !CURSOR_SAFE_ID.test(request.owner.executionId))
+                throw policyInvalid();
+            args.push('--setenv', 'MAR_AGENT_SESSION_ID', request.owner.sessionId, '--setenv', 'MAR_AGENT_EXECUTION_ID', request.owner.executionId);
+        }
+        for (const [name, value] of explicitEnvironment(request))
+            args.push('--setenv', name, value);
+        args.push('--seccomp', '4', '--chdir', cwd);
+        return args;
+    }
+}
+export async function probeBubblewrapSandbox(bubblewrapPath = DEFAULT_BUBBLEWRAP_PATH) {
+    if (process.platform !== 'linux')
+        throw unavailable();
+    const versionOutput = await execFileAsync(bubblewrapPath, ['--version'], {
+        timeout: 5_000,
+        windowsHide: true
+    }).catch((error) => {
+        throw unavailable(error);
+    });
+    const version = /^bubblewrap\s+([0-9]+(?:\.[0-9]+){1,3})\s*$/u.exec(versionOutput.stdout)?.[1];
+    if (version === undefined)
+        throw unavailable();
+    const root = await mkdtemp(join(tmpdir(), 'mar-node-bwrap-probe-'));
+    const directories = Object.fromEntries(['workspace', 'inbox', 'output', 'tmp'].map((name) => [name, join(root, name)]));
+    try {
+        await Promise.all(Object.values(directories).map((path) => mkdir(path, { mode: 0o700 })));
+        await Promise.all(['inbox', 'output'].map((name) => mkdir(join(directories.workspace, name), { recursive: true, mode: 0o700 })));
+        const executor = new BubblewrapSandboxExecutor({
+            bubblewrapPath,
+            policyVersion: SANDBOX_POLICY_VERSION,
+            workspaceDirectory: directories.workspace,
+            sourceWorkspacePath: '/home/mar-sandbox-probe/workspace',
+            inboxDirectory: directories.inbox,
+            outputDirectory: directories.output,
+            temporaryDirectory: directories.tmp,
+            networkMode: 'NONE'
+        });
+        const child = await executor.spawn({
+            command: '/bin/true',
+            cwd: directories.workspace,
+            shell: false,
+            environment: {},
+            detached: true,
+            owner: { sessionId: 'sandbox-probe', executionId: 'sandbox-probe' }
+        });
+        const result = await waitForProbe(child);
+        if (result.code !== 0)
+            throw unavailable(new Error(result.stderr));
+        return { version };
+    }
+    finally {
+        await rm(root, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function waitForProbe(child) {
+    const chunks = [];
+    let bytes = 0;
+    child.stderr.on('data', (chunk) => {
+        if (bytes >= 8_192)
+            return;
+        const remaining = 8_192 - bytes;
+        chunks.push(chunk.subarray(0, remaining));
+        bytes += Math.min(chunk.length, remaining);
+    });
+    child.stdin.end();
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(unavailable(new Error('Sandbox probe timed out.')));
+        }, 5_000);
+        timer.unref();
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(unavailable(error));
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            resolve({ code, stderr: Buffer.concat(chunks).toString('utf8') });
+        });
+    });
+}
+async function validateBackend(path) {
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink() || (metadata.mode & 0o111) === 0)
+            throw unavailable();
+    }
+    catch (error) {
+        if (error instanceof MarAgentError)
+            throw error;
+        throw unavailable(error);
+    }
+}
+async function secureDirectory(path) {
+    if (!isAbsolute(path))
+        throw policyInvalid();
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            throw policyInvalid();
+        const canonical = await realpath(path);
+        if (canonical !== resolve(path))
+            throw policyInvalid();
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof MarAgentError)
+            throw error;
+        throw policyInvalid(error);
+    }
+}
+async function sandboxPath(path, mounts) {
+    const canonical = await secureDirectory(path);
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount === undefined)
+        throw policyInvalid();
+    const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+    return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+}
+function sandboxCommand(request, mounts) {
+    const command = request.shell === undefined || request.shell === false
+        ? [sandboxExecutable(request.command, mounts), ...(request.args ?? [])]
+        : [
+            sandboxExecutable(typeof request.shell === 'string' ? request.shell : '/bin/sh', mounts),
+            '-c',
+            request.command,
+            ...(request.args ?? [])
+        ];
+    return [
+        '/usr/bin/prlimit',
+        `--cpu=${SANDBOX_CPU_SECONDS}:${SANDBOX_CPU_SECONDS}`,
+        `--nproc=${SANDBOX_PROCESS_LIMIT}:${SANDBOX_PROCESS_LIMIT}`,
+        `--nofile=${SANDBOX_OPEN_FILE_LIMIT}:${SANDBOX_OPEN_FILE_LIMIT}`,
+        `--fsize=${SANDBOX_FILE_SIZE_BYTES}:${SANDBOX_FILE_SIZE_BYTES}`,
+        '--',
+        ...command
+    ];
+}
+function sandboxExecutable(command, mounts) {
+    if (!isAbsolute(command))
+        return command;
+    const canonical = resolve(command);
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr' &&
+        (canonical === nodeRuntimeDirectory || within(nodeRuntimeDirectory, canonical))) {
+        const suffix = relative(nodeRuntimeDirectory, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? '/runtime/node' : posix.join('/runtime/node', ...suffix);
+    }
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount !== undefined) {
+        const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+    }
+    if (['/usr', '/bin', '/sbin', '/lib', '/lib64'].some((root) => canonical === root || within(root, canonical)))
+        return canonical;
+    throw policyInvalid();
+}
+function explicitEnvironment(request) {
+    const entries = [];
+    const seen = new Set();
+    for (const name of request.environmentKeys ?? []) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        if (!SAFE_ENVIRONMENT_NAME.test(name) || FORBIDDEN_ENVIRONMENT_NAMES.has(name))
+            throw policyInvalid();
+        const value = request.environment[name];
+        if (typeof value !== 'string' || value.includes('\0') || Buffer.byteLength(value) > 32_768)
+            throw policyInvalid();
+        entries.push([name, value]);
+    }
+    return entries;
+}
+function sandboxCompatibilityPath(path) {
+    if (!isAbsolute(path) ||
+        path.includes('\0') ||
+        path === '/' ||
+        path === '/tmp' ||
+        resolve(path) !== path ||
+        RESERVED_SANDBOX_ROOTS.some((root) => path === root || within(root, path) || within(path, root)))
+        throw policyInvalid();
+    return path;
+}
+function generatedImagesSandboxPath(path) {
+    const segments = relative(GENERATED_IMAGES_SANDBOX_ROOT, path).split(sep).filter(Boolean);
+    if (!isAbsolute(path) ||
+        path.includes('\0') ||
+        resolve(path) !== path ||
+        !within(GENERATED_IMAGES_SANDBOX_ROOT, path) ||
+        segments.length !== 2 ||
+        !safePathSegment(segments[0]) ||
+        segments[1] !== 'generated_images')
+        throw policyInvalid();
+    return path;
+}
+function safePathSegment(value) {
+    return (value.length > 0 &&
+        value.length <= 255 &&
+        value !== '.' &&
+        value !== '..' &&
+        !value.includes('/') &&
+        !value.includes('\\'));
+}
+function compareMountDestinations(left, right) {
+    const depth = left.destination.split('/').filter(Boolean).length -
+        right.destination.split('/').filter(Boolean).length;
+    return depth === 0 ? left.destination.localeCompare(right.destination, 'en-US') : depth;
+}
+async function prepareNestedMountDestinations(mounts) {
+    for (const [index, mount] of mounts.entries()) {
+        const parent = mounts
+            .slice(0, index)
+            .filter((candidate) => within(candidate.destination, mount.destination))
+            .sort((left, right) => right.destination.length - left.destination.length)[0];
+        if (parent === undefined)
+            continue;
+        const suffix = relative(parent.destination, mount.destination).split(sep).filter(Boolean);
+        const target = join(parent.source, ...suffix);
+        if (parent.writable) {
+            await mkdir(target, { recursive: true, mode: 0o700 });
+            continue;
+        }
+        try {
+            const metadata = await lstat(target);
+            if (!metadata.isDirectory() ||
+                metadata.isSymbolicLink() ||
+                (await realpath(target)) !== resolve(target))
+                throw policyInvalid();
+        }
+        catch (error) {
+            if (error instanceof MarAgentError)
+                throw error;
+            throw policyInvalid(error);
+        }
+    }
+}
+function sandboxDirectoryArguments(mounts) {
+    const directories = new Set(['/home', '/home/mar']);
+    for (const mount of mounts) {
+        const segments = mount.destination.split('/').filter(Boolean);
+        let current = '';
+        for (const segment of segments) {
+            current = `${current}/${segment}`;
+            directories.add(current);
+        }
+    }
+    return [...directories]
+        .sort((left, right) => {
+        const depth = left.split('/').filter(Boolean).length - right.split('/').filter(Boolean).length;
+        return depth === 0 ? left.localeCompare(right, 'en-US') : depth;
+    })
+        .flatMap((directory) => ['--dir', directory]);
+}
+function runtimeMountArguments() {
+    const args = [];
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr')
+        args.push('--dir', '/runtime', '--dir', '/runtime/node', '--ro-bind', nodeRuntimeDirectory, '/runtime/node');
+    for (const path of ['/usr', '/bin', '/sbin', '/lib', '/lib64']) {
+        if (!existsSync(path))
+            continue;
+        const metadata = lstatSync(path);
+        if (metadata.isSymbolicLink())
+            args.push('--symlink', readlinkSync(path), path);
+        else if (metadata.isDirectory())
+            args.push('--ro-bind', path, path);
+    }
+    for (const path of READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES) {
+        if (!existsSync(path) || !lstatSync(path).isDirectory())
+            continue;
+        args.push('--ro-bind', path, path);
+    }
+    for (const path of [
+        '/etc/host.conf',
+        '/etc/hosts',
+        '/etc/ld.so.cache',
+        '/etc/resolv.conf',
+        '/etc/passwd',
+        '/etc/group',
+        '/etc/nsswitch.conf',
+        '/etc/localtime',
+        '/etc/ssl/certs'
+    ]) {
+        if (existsSync(path))
+            args.push('--ro-bind', path, path);
+    }
+    return args;
+}
+function seccompFilter(architecture) {
+    const policy = syscallPolicy(architecture);
+    const filters = [
+        [0x20, 0, 0, 4],
+        [0x15, 1, 0, policy.auditArchitecture],
+        [0x06, 0, 0, 0x80000000],
+        [0x20, 0, 0, 0]
+    ];
+    if (architecture === 'x64')
+        filters.push([0x54, 0, 0, 0x40000000], [0x15, 1, 0, 0], [0x06, 0, 0, 0x80000000], [0x20, 0, 0, 0]);
+    for (const syscall of policy.blockedSyscalls)
+        filters.push([0x15, 0, 1, syscall], [0x06, 0, 0, 0x00050001]);
+    filters.push([0x06, 0, 0, 0x7fff0000]);
+    const buffer = Buffer.alloc(filters.length * 8);
+    for (const [index, [code, jumpTrue, jumpFalse, value]] of filters.entries()) {
+        const offset = index * 8;
+        buffer.writeUInt16LE(code, offset);
+        buffer.writeUInt8(jumpTrue, offset + 2);
+        buffer.writeUInt8(jumpFalse, offset + 3);
+        buffer.writeUInt32LE(value >>> 0, offset + 4);
+    }
+    return buffer;
+}
+function syscallPolicy(architecture) {
+    if (architecture === 'x64')
+        return {
+            auditArchitecture: 0xc000003e,
+            blockedSyscalls: [
+                101, 155, 165, 166, 175, 176, 246, 248, 249, 250, 272, 298, 304, 308, 313, 321, 323, 428,
+                429, 430, 431, 432, 442
+            ]
+        };
+    if (architecture === 'arm64')
+        return {
+            auditArchitecture: 0xc00000b7,
+            blockedSyscalls: [
+                39, 40, 41, 97, 104, 105, 106, 117, 217, 218, 219, 241, 265, 268, 273, 280, 282, 428, 429,
+                430, 431, 432, 442
+            ]
+        };
+    throw policyInvalid();
+}
+function within(parent, candidate) {
+    const relation = relative(parent, candidate);
+    return relation.length > 0 && relation !== '..' && !relation.startsWith(`..${sep}`);
+}
+function unavailable(cause) {
+    return new MarAgentError('SANDBOX_UNAVAILABLE', 'Bubblewrap sandbox is unavailable.', { cause });
+}
+function policyInvalid(cause) {
+    return new MarAgentError('SANDBOX_POLICY_INVALID', 'Sandbox policy is invalid.', { cause });
+}