@namzu/sandbox 2.0.1 → 2.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +58 -0
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +12 -2
- package/src/index.ts +1 -1
- package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts +0 -2
- package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts.map +0 -1
- package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js +0 -61
- package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js.map +0 -1
- package/dist/backends/docker/__tests__/hardening.test.d.ts +0 -2
- package/dist/backends/docker/__tests__/hardening.test.d.ts.map +0 -1
- package/dist/backends/docker/__tests__/hardening.test.js +0 -32
- package/dist/backends/docker/__tests__/hardening.test.js.map +0 -1
- package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts +0 -40
- package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts.map +0 -1
- package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js +0 -157
- package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts +0 -16
- package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js +0 -37
- package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/backend.test.d.ts +0 -13
- package/dist/backends/firecracker/__tests__/backend.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/backend.test.js +0 -361
- package/dist/backends/firecracker/__tests__/backend.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts +0 -19
- package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js +0 -209
- package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts +0 -2
- package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/egress-policy.test.js +0 -67
- package/dist/backends/firecracker/__tests__/egress-policy.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts +0 -21
- package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js +0 -30
- package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js.map +0 -1
- package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts +0 -39
- package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js +0 -149
- package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js.map +0 -1
- package/dist/backends/firecracker/__tests__/protocol.test.d.ts +0 -6
- package/dist/backends/firecracker/__tests__/protocol.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/protocol.test.js +0 -67
- package/dist/backends/firecracker/__tests__/protocol.test.js.map +0 -1
- package/dist/backends/firecracker/__tests__/transport.test.d.ts +0 -20
- package/dist/backends/firecracker/__tests__/transport.test.d.ts.map +0 -1
- package/dist/backends/firecracker/__tests__/transport.test.js +0 -457
- package/dist/backends/firecracker/__tests__/transport.test.js.map +0 -1
- package/dist/egress/__tests__/allowlist.test.d.ts +0 -2
- package/dist/egress/__tests__/allowlist.test.d.ts.map +0 -1
- package/dist/egress/__tests__/allowlist.test.js +0 -85
- package/dist/egress/__tests__/allowlist.test.js.map +0 -1
- package/dist/egress/__tests__/proxy.test.d.ts +0 -2
- package/dist/egress/__tests__/proxy.test.d.ts.map +0 -1
- package/dist/egress/__tests__/proxy.test.js +0 -177
- package/dist/egress/__tests__/proxy.test.js.map +0 -1
- package/dist/index.test.d.ts +0 -28
- package/dist/index.test.d.ts.map +0 -1
- package/dist/index.test.js +0 -649
- package/dist/index.test.js.map +0 -1
- package/src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts +0 -69
- package/src/backends/docker/__tests__/hardening.test.ts +0 -43
- package/src/backends/docker/__tests__/leaf-permissions.smoke.test.ts +0 -169
- package/src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts +0 -48
- package/src/backends/firecracker/__tests__/backend.test.ts +0 -429
- package/src/backends/firecracker/__tests__/control-plane-mtls.test.ts +0 -261
- package/src/backends/firecracker/__tests__/egress-policy.test.ts +0 -91
- package/src/backends/firecracker/__tests__/fixtures/ipc-path.ts +0 -31
- package/src/backends/firecracker/__tests__/fixtures/mtls-pki.ts +0 -166
- package/src/backends/firecracker/__tests__/protocol.test.ts +0 -75
- package/src/backends/firecracker/__tests__/transport.test.ts +0 -534
- package/src/egress/__tests__/allowlist.test.ts +0 -103
- package/src/egress/__tests__/proxy.test.ts +0 -212
- package/src/index.test.ts +0 -709
package/dist/index.test.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAI7C,OAAO,EACN,qBAAqB,EACrB,wBAAwB,EACxB,aAAa,GACb,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACN,qCAAqC,EACrC,iCAAiC,EAEjC,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,YAAY,CAAA;AAEnB,oEAAoE;AACpE,SAAS,WAAW,CAAC,YAA6C,EAAE;IACnE,OAAO;QACN,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAC/D,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,MAAM,cAAc,GAAG;IACtB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,qBAAqB;CACnB,CAAA;AAEV,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE;YAC5D,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,4EAA4E;QAC5E,mEAAmE;QACnE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE;YAC5D,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,CAAC;YACJ,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAW,CAAC,CAAA;YACpE,MAAM,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAA;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,iCAAiC,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC9F,MAAM,GAAG,GAAG,EAA4B,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC;YACrB,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,GAAG;SACX,CAAC,CACF,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAC9D,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAClE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAClE,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE;gBACpF,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EAAE;aAClF;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACtE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC/E,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACpE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5D,uBAAuB;YACvB,sBAAsB;SACtB,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,WAAW;aAC1B;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,UAAU;aACzB;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;oBAC7C,aAAa,EAAE,oBAAoB;iBACnC;aACD;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;QACxC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAE,QAA+C,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,EAA4B,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;QAC/E,IAAI,CAAC;YACJ,aAAa,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAClE;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QACpD,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACzD,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC/D,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC5D,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAC5D;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;YACzD,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACnE,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aACtE;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAChE;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,CAAE,GAA6C,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClF,gCAAgC,CAChC,CAAA;QACF,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAA2B;YACtC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,OAAO;aACtB;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,OAAO;aACtB;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAA2B;YACtC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,eAAe;aAC9B;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC3C,sDAAsD;iBACtD;aACD;SACD,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,GAAG,GAAG;YACX,kBAAkB;YAClB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAChE;SACoC,CAAA;QACtC,IAAI,CAAC;YACJ,aAAa,CAAC,GAAG,CAAC,CAAA;YAClB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,0EAA0E;YAC1E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC;YACrD,+CAA+C;YAC/C,gCAAgC;SAChC,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC5B,+CAA+C;YAC/C,gCAAgC;SAChC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAA;QACrE,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,eAAe,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,qCAAqC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;QACzE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACzC,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAsD,CAAA;QACxE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACzE,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpC,kEAAkE;QAClE,kDAAkD;QAClD,MAAM,CAAC,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACnE,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1E,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9D,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvD,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,+CAA+C;IAC/C,+DAA+D;IAC/D,mEAAmE;IACnE,wDAAwD;IACxD,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACtE,2BAA2B;QAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACvF,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACtB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;YACnB,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC;YACtC,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;SAC9B,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC9C,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,4DAA4D;YAC5D,wDAAwD;YACxD,0CAA0C;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,+CAA+C;IAC/C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAE/B;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CACvB;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAC5C;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,iEAAiE;QACjE,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAA;QACxB,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,KAAK,GAAY,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAChC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACX,CAAC;gBAAC,CAAiC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAU,CAAA;QAC5C,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,4CAA4C;QAC5C,IAAI,MAAM,GAAuC,GAAG,CAAA;QACpD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,MAAM,EAAE,CAAC;YACf,KAAK,EAAE,CAAA;YACP,MAAM,GAAG,MAAM,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtB,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACzF,8DAA8D;QAC9D,+DAA+D;QAC/D,oBAAoB;QACpB,MAAM,GAAG,GAAsC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAC/D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAA;QACf,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,0DAA0D;QAC1D,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,2BAA2B;QAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,8CAA8C;IAC9C,gEAAgE;IAChE,+DAA+D;IAC/D,4DAA4D;IAC5D,6DAA6D;IAC7D,iEAAiE;IACjE,4DAA4D;IAC5D,iBAAiB;IACjB,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACtF,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,6BAA6B;aAC5C;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBAC/C,aAAa,EAAE,eAAe;iBAC9B;gBACD;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBAC/C,aAAa,EAAE,eAAe;iBAC9B;aACD;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YACpB,UAAU;YACV,gCAAgC;YAChC,UAAU;YACV,gCAAgC;YAChC,UAAU;YACV,sCAAsC;YACtC,UAAU;YACV,yBAAyB;YACzB,UAAU;YACV,yBAAyB;YACzB,UAAU;YACV,2BAA2B;SAC3B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;SACD,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,wBAAwB,CAAC;YACpC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACrF,2DAA2D;IAC3D,8DAA8D;IAC9D,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,yCAAyC;IACzC,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,QAAQ,GAAG;YAChB,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE,6BAA6B;YAC1C,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,4BAA4B;SACzC,CAAA;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACvD,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACvD,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAC3D,aAAa,EAAE,6BAA6B;aAC5C;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACtD,aAAa,EAAE,eAAe;iBAC9B;gBACD;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACtD,aAAa,EAAE,eAAe;iBAC9B;aACD;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAC3D,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,8DAA8D;QAC9D,2DAA2D;QAC3D,gEAAgE;QAChE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}
|
|
@@ -1,69 +0,0 @@
|
|
|
1
|
-
import { describe, expect, it } from 'vitest'
|
|
2
|
-
|
|
3
|
-
import type { SandboxBackendOptions } from '../../../index.js'
|
|
4
|
-
import { assertEnforceable } from '../index.js'
|
|
5
|
-
|
|
6
|
-
/**
|
|
7
|
-
* The claim API rejects every property override that is not a config map,
|
|
8
|
-
* so a memory cap, a process cap, environment variables and an egress
|
|
9
|
-
* policy have nowhere to ride through on this backend. They were accepted
|
|
10
|
-
* and dropped: a host that asked for `deny-all` and 512 MB got full
|
|
11
|
-
* outbound network and no cap, with no error and no warning — from the same
|
|
12
|
-
* call shape that IS enforced on the sibling container backend.
|
|
13
|
-
*
|
|
14
|
-
* Switching backends therefore removed the blast-radius controls silently,
|
|
15
|
-
* which is the worst way to lose them. namzu already holds the norm for
|
|
16
|
-
* this next door: a policy accepted and quietly ignored is worse than one
|
|
17
|
-
* that is refused.
|
|
18
|
-
*/
|
|
19
|
-
|
|
20
|
-
const opts = (extra: Partial<SandboxBackendOptions> = {}): SandboxBackendOptions => ({
|
|
21
|
-
workingDirectory: '/w',
|
|
22
|
-
...extra,
|
|
23
|
-
})
|
|
24
|
-
|
|
25
|
-
describe('controls this backend cannot apply', () => {
|
|
26
|
-
it.each([
|
|
27
|
-
['an egress policy', { egress: { kind: 'deny-all' } as const }],
|
|
28
|
-
['a memory limit', { memoryLimitMb: 512 }],
|
|
29
|
-
['a process limit', { maxProcesses: 32 }],
|
|
30
|
-
['environment variables', { env: { SECRET: 'x' } }],
|
|
31
|
-
])('refuses %s', (_name, extra) => {
|
|
32
|
-
expect(() => assertEnforceable(opts(extra))).toThrow(/cannot enforce per-sandbox/)
|
|
33
|
-
})
|
|
34
|
-
|
|
35
|
-
it('names every field it cannot honour, not just the first', () => {
|
|
36
|
-
try {
|
|
37
|
-
assertEnforceable(opts({ egress: { kind: 'deny-all' }, memoryLimitMb: 512, maxProcesses: 8 }))
|
|
38
|
-
expect.unreachable()
|
|
39
|
-
} catch (err) {
|
|
40
|
-
const message = (err as Error).message
|
|
41
|
-
// A host fixing one and hitting the next on the following run
|
|
42
|
-
// learns the shape one failure at a time.
|
|
43
|
-
expect(message).toContain('egress')
|
|
44
|
-
expect(message).toContain('memory')
|
|
45
|
-
expect(message).toContain('process')
|
|
46
|
-
}
|
|
47
|
-
})
|
|
48
|
-
|
|
49
|
-
it('says where the limits do belong', () => {
|
|
50
|
-
// Refusing without saying what to do instead is a dead end; these
|
|
51
|
-
// are a property of the pooled profile.
|
|
52
|
-
expect(() => assertEnforceable(opts({ memoryLimitMb: 512 }))).toThrow(/container group profile/)
|
|
53
|
-
})
|
|
54
|
-
})
|
|
55
|
-
|
|
56
|
-
describe('what it does allow through', () => {
|
|
57
|
-
it('accepts a request that asks for nothing it cannot apply', () => {
|
|
58
|
-
expect(() => assertEnforceable(opts())).not.toThrow()
|
|
59
|
-
})
|
|
60
|
-
|
|
61
|
-
it('accepts a timeout, which is applied by the caller not the pool', () => {
|
|
62
|
-
expect(() => assertEnforceable(opts({ timeoutMs: 30_000 }))).not.toThrow()
|
|
63
|
-
})
|
|
64
|
-
|
|
65
|
-
it('treats an empty env bag as asking for nothing', () => {
|
|
66
|
-
// A host spreading an empty object should not be refused for it.
|
|
67
|
-
expect(() => assertEnforceable(opts({ env: {} }))).not.toThrow()
|
|
68
|
-
})
|
|
69
|
-
})
|
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
import { describe, expect, it } from 'vitest'
|
|
2
|
-
|
|
3
|
-
import { resolveNetwork } from '../index.js'
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* `EgressPolicy` was accepted by the type, threaded through the options,
|
|
7
|
-
* and silently ignored by this backend. That is worse than not supporting
|
|
8
|
-
* it: a host that set `deny-all` believed the container had no network,
|
|
9
|
-
* and it had whatever `config.network` said.
|
|
10
|
-
*/
|
|
11
|
-
|
|
12
|
-
describe('resolveNetwork', () => {
|
|
13
|
-
it('leaves the configured network alone when no policy is supplied', () => {
|
|
14
|
-
expect(resolveNetwork('bridge', undefined)).toBe('bridge')
|
|
15
|
-
})
|
|
16
|
-
|
|
17
|
-
it('enforces deny-all natively', () => {
|
|
18
|
-
// Docker can actually do this one, so there is no excuse for
|
|
19
|
-
// accepting the policy and ignoring it.
|
|
20
|
-
expect(resolveNetwork('bridge', { kind: 'deny-all' })).toBe('none')
|
|
21
|
-
})
|
|
22
|
-
|
|
23
|
-
it('allow-all keeps the configured network', () => {
|
|
24
|
-
expect(resolveNetwork('my-bridge', { kind: 'allow-all' })).toBe('my-bridge')
|
|
25
|
-
})
|
|
26
|
-
|
|
27
|
-
it('REFUSES a host allowlist rather than silently granting full access', () => {
|
|
28
|
-
// This backend has no proxy to filter through. Downgrading a
|
|
29
|
-
// restrictive policy to "allow everything" is the failure mode that
|
|
30
|
-
// makes a security control worse than useless.
|
|
31
|
-
expect(() =>
|
|
32
|
-
resolveNetwork('bridge', { kind: 'static', allowedHosts: ['example.com'] }),
|
|
33
|
-
).toThrow(/cannot enforce an egress policy/)
|
|
34
|
-
|
|
35
|
-
expect(() => resolveNetwork('bridge', { kind: 'resolver', resolve: async () => [] })).toThrow(
|
|
36
|
-
/cannot enforce an egress policy/,
|
|
37
|
-
)
|
|
38
|
-
})
|
|
39
|
-
|
|
40
|
-
it('names what it can do, so the failure is actionable', () => {
|
|
41
|
-
expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: [] })).toThrow(/deny-all/)
|
|
42
|
-
})
|
|
43
|
-
})
|
|
@@ -1,169 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Docker smoke test — leaf-mount permission semantics.
|
|
3
|
-
*
|
|
4
|
-
* Concern raised in review: the Dockerfile pre-creates only the parent
|
|
5
|
-
* dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
|
|
6
|
-
* The runtime claim is that:
|
|
7
|
-
*
|
|
8
|
-
* 1. When `outputs` IS bound, uid 1001 (the worker user) can write
|
|
9
|
-
* into it.
|
|
10
|
-
* 2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
|
|
11
|
-
* the path simply does not exist — `stat` returns ENOENT, NOT
|
|
12
|
-
* a writable empty dir.
|
|
13
|
-
*
|
|
14
|
-
* Both of those are kernel-level mount-namespace properties, not
|
|
15
|
-
* unit-testable. This file exercises them against a real docker
|
|
16
|
-
* daemon. Run via:
|
|
17
|
-
*
|
|
18
|
-
* pnpm --filter @namzu/sandbox test:smoke
|
|
19
|
-
* # or, from the monorepo root:
|
|
20
|
-
* pnpm sandbox:smoke
|
|
21
|
-
*
|
|
22
|
-
* Excluded from the default `pnpm test` run by `vitest.config.ts`.
|
|
23
|
-
*
|
|
24
|
-
* Pre-requisites:
|
|
25
|
-
* - `docker` CLI on PATH.
|
|
26
|
-
* - A pre-built reference image. By default this test looks for
|
|
27
|
-
* `namzu-sandbox-worker:smoke`. Override with the
|
|
28
|
-
* `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
|
|
29
|
-
* `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
|
|
30
|
-
* - A host-side scratch directory the test creates and tears down.
|
|
31
|
-
*
|
|
32
|
-
* On a developer machine without docker the test self-skips with a
|
|
33
|
-
* clear message. On CI (`process.env.CI === 'true'`) the same
|
|
34
|
-
* pre-conditions FAIL FAST instead of skipping, so a CI
|
|
35
|
-
* misconfiguration cannot silently mask a regression — see the
|
|
36
|
-
* `.github/workflows/sandbox-smoke.yml` workflow which is meant to
|
|
37
|
-
* always run with docker available.
|
|
38
|
-
*/
|
|
39
|
-
|
|
40
|
-
import { spawnSync } from 'node:child_process'
|
|
41
|
-
import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
|
|
42
|
-
import { tmpdir } from 'node:os'
|
|
43
|
-
import { join } from 'node:path'
|
|
44
|
-
|
|
45
|
-
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
|
46
|
-
|
|
47
|
-
import { createSandboxProvider } from '../../../index.js'
|
|
48
|
-
|
|
49
|
-
const IMAGE = process.env.NAMZU_SANDBOX_SMOKE_IMAGE ?? 'namzu-sandbox-worker:smoke'
|
|
50
|
-
const IS_CI = process.env.CI === 'true'
|
|
51
|
-
|
|
52
|
-
function dockerAvailable(): boolean {
|
|
53
|
-
const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
|
|
54
|
-
stdio: 'ignore',
|
|
55
|
-
})
|
|
56
|
-
return probe.status === 0
|
|
57
|
-
}
|
|
58
|
-
|
|
59
|
-
function imagePresent(image: string): boolean {
|
|
60
|
-
const probe = spawnSync('docker', ['image', 'inspect', image], { stdio: 'ignore' })
|
|
61
|
-
return probe.status === 0
|
|
62
|
-
}
|
|
63
|
-
|
|
64
|
-
const skipReason = !dockerAvailable()
|
|
65
|
-
? 'docker daemon not reachable — skipping smoke test'
|
|
66
|
-
: !imagePresent(IMAGE)
|
|
67
|
-
? `image ${IMAGE} not present — build it with \`docker build -t ${IMAGE} -f packages/sandbox/worker/Dockerfile packages/sandbox\` and re-run`
|
|
68
|
-
: null
|
|
69
|
-
|
|
70
|
-
// CI fail-fast: the smoke workflow is meant to always have docker +
|
|
71
|
-
// the reference image. Skipping silently in that environment would
|
|
72
|
-
// let a regression land without the test even attempting to run.
|
|
73
|
-
// Locally (no `CI=true`) skipping with a hint is the right behaviour
|
|
74
|
-
// for a developer who hasn't built the image yet.
|
|
75
|
-
if (IS_CI && skipReason) {
|
|
76
|
-
throw new Error(
|
|
77
|
-
`smoke test pre-condition not satisfied on CI: ${skipReason}. Configure the workflow to install docker and build the reference image before running.`,
|
|
78
|
-
)
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
describe.skipIf(skipReason !== null)('docker smoke — leaf permissions', () => {
|
|
82
|
-
let outputsHost: string
|
|
83
|
-
|
|
84
|
-
beforeAll(() => {
|
|
85
|
-
outputsHost = mkdtempSync(join(tmpdir(), 'namzu-sandbox-smoke-out-'))
|
|
86
|
-
})
|
|
87
|
-
|
|
88
|
-
afterAll(() => {
|
|
89
|
-
if (outputsHost) {
|
|
90
|
-
rmSync(outputsHost, { recursive: true, force: true })
|
|
91
|
-
}
|
|
92
|
-
})
|
|
93
|
-
|
|
94
|
-
it('uid 1001 can write to the outputs bind, and the host sees the file', async () => {
|
|
95
|
-
const provider = createSandboxProvider({
|
|
96
|
-
backend: { tier: 'container', image: IMAGE },
|
|
97
|
-
layout: {
|
|
98
|
-
outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
|
|
99
|
-
},
|
|
100
|
-
})
|
|
101
|
-
const sandbox = await provider.create()
|
|
102
|
-
try {
|
|
103
|
-
const result = await sandbox.exec('sh', [
|
|
104
|
-
'-c',
|
|
105
|
-
'id -u && echo "smoke" > /mnt/user-data/outputs/hello.txt',
|
|
106
|
-
])
|
|
107
|
-
expect(result.exitCode).toBe(0)
|
|
108
|
-
expect(result.stdout.trim()).toBe('1001')
|
|
109
|
-
// Host-side read confirms the bind round-trips.
|
|
110
|
-
const hostContent = readFileSync(join(outputsHost, 'hello.txt'), 'utf8')
|
|
111
|
-
expect(hostContent.trim()).toBe('smoke')
|
|
112
|
-
} finally {
|
|
113
|
-
await sandbox.destroy()
|
|
114
|
-
}
|
|
115
|
-
}, 60_000)
|
|
116
|
-
|
|
117
|
-
it('unbound leaves do not exist — uploads/transcripts/tool_results are ENOENT, not empty', async () => {
|
|
118
|
-
const provider = createSandboxProvider({
|
|
119
|
-
backend: { tier: 'container', image: IMAGE },
|
|
120
|
-
layout: {
|
|
121
|
-
outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
|
|
122
|
-
// Intentionally leave uploads / toolResults / transcripts
|
|
123
|
-
// unbound. The Dockerfile pre-creates only the parents
|
|
124
|
-
// (`/mnt/user-data`, `/mnt/skills`); leaves should not
|
|
125
|
-
// exist and `stat` should fail.
|
|
126
|
-
},
|
|
127
|
-
})
|
|
128
|
-
const sandbox = await provider.create()
|
|
129
|
-
try {
|
|
130
|
-
for (const leafPath of [
|
|
131
|
-
'/mnt/user-data/uploads',
|
|
132
|
-
'/mnt/user-data/tool_results',
|
|
133
|
-
'/mnt/transcripts',
|
|
134
|
-
]) {
|
|
135
|
-
const result = await sandbox.exec('sh', ['-c', `stat ${leafPath} 2>&1; echo --rc=$?`])
|
|
136
|
-
// `stat` returns non-zero on ENOENT; the rc line carries
|
|
137
|
-
// the failure. Either is the contract; we accept either
|
|
138
|
-
// "No such file" or "cannot stat" wording across distros.
|
|
139
|
-
expect(result.stdout).toMatch(/--rc=[1-9]/)
|
|
140
|
-
expect(result.stdout.toLowerCase()).toMatch(/no such file|cannot stat|does not exist/)
|
|
141
|
-
}
|
|
142
|
-
} finally {
|
|
143
|
-
await sandbox.destroy()
|
|
144
|
-
}
|
|
145
|
-
}, 60_000)
|
|
146
|
-
|
|
147
|
-
it('uid 1001 cannot mkdir into the root-owned 0555 parent /mnt/user-data', async () => {
|
|
148
|
-
const provider = createSandboxProvider({
|
|
149
|
-
backend: { tier: 'container', image: IMAGE },
|
|
150
|
-
layout: {
|
|
151
|
-
outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
|
|
152
|
-
},
|
|
153
|
-
})
|
|
154
|
-
const sandbox = await provider.create()
|
|
155
|
-
try {
|
|
156
|
-
// The model trying to "create the missing leaf dir" hits
|
|
157
|
-
// the 0555 root-owned parent and is denied — exactly what
|
|
158
|
-
// distinguishes "not bound" from "writable empty dir".
|
|
159
|
-
const result = await sandbox.exec('sh', [
|
|
160
|
-
'-c',
|
|
161
|
-
'mkdir /mnt/user-data/fake 2>&1; echo --rc=$?',
|
|
162
|
-
])
|
|
163
|
-
expect(result.stdout).toMatch(/--rc=[1-9]/)
|
|
164
|
-
expect(result.stdout.toLowerCase()).toMatch(/permission denied/)
|
|
165
|
-
} finally {
|
|
166
|
-
await sandbox.destroy()
|
|
167
|
-
}
|
|
168
|
-
}, 60_000)
|
|
169
|
-
})
|
|
@@ -1,48 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* `resolveTimeoutMs` is the guest agent's only guard against a
|
|
3
|
-
* caller-requested `timeoutMs` that has no schema ceiling upstream (it
|
|
4
|
-
* traces back to the bash tool's model-authored `timeout` argument — see
|
|
5
|
-
* `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
|
|
6
|
-
* be refused (the sibling `worker/server.js` answers `invalid_timeout` on
|
|
7
|
-
* response), not silently shortened — a caller that asked for more and got
|
|
8
|
-
* less without being told would believe its process was protected for the
|
|
9
|
-
* duration it actually asked for.
|
|
10
|
-
*
|
|
11
|
-
* Pure-function test, no socket/process involved, so it runs on every
|
|
12
|
-
* platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
|
|
13
|
-
* `/bin/sh` and skip on Windows).
|
|
14
|
-
*/
|
|
15
|
-
|
|
16
|
-
import { createRequire } from 'node:module'
|
|
17
|
-
|
|
18
|
-
import { describe, expect, it } from 'vitest'
|
|
19
|
-
|
|
20
|
-
const require_ = createRequire(import.meta.url)
|
|
21
|
-
|
|
22
|
-
interface AgentModule {
|
|
23
|
-
resolveTimeoutMs(rawTimeoutMs: unknown): number
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
const agent = require_('../../../../agent/agent.cjs') as AgentModule
|
|
27
|
-
|
|
28
|
-
describe('agent.cjs resolveTimeoutMs', () => {
|
|
29
|
-
it('passes through a caller value within the cap', () => {
|
|
30
|
-
expect(agent.resolveTimeoutMs(10_000)).toBe(10_000)
|
|
31
|
-
})
|
|
32
|
-
|
|
33
|
-
it('falls back to the default for an omitted value', () => {
|
|
34
|
-
expect(agent.resolveTimeoutMs(undefined)).toBe(5 * 60 * 1000)
|
|
35
|
-
})
|
|
36
|
-
|
|
37
|
-
it('refuses a request far above the cap instead of honoring or silently shortening it', () => {
|
|
38
|
-
expect(() => agent.resolveTimeoutMs(Number.MAX_SAFE_INTEGER)).toThrow(/timeoutMs/)
|
|
39
|
-
expect(() => agent.resolveTimeoutMs(10 ** 12)).toThrow(/timeoutMs/)
|
|
40
|
-
})
|
|
41
|
-
|
|
42
|
-
it('refuses a non-finite or non-positive value', () => {
|
|
43
|
-
expect(() => agent.resolveTimeoutMs(0)).toThrow(/timeoutMs/)
|
|
44
|
-
expect(() => agent.resolveTimeoutMs(-1)).toThrow(/timeoutMs/)
|
|
45
|
-
expect(() => agent.resolveTimeoutMs(Number.NaN)).toThrow(/timeoutMs/)
|
|
46
|
-
expect(() => agent.resolveTimeoutMs(Number.POSITIVE_INFINITY)).toThrow(/timeoutMs/)
|
|
47
|
-
})
|
|
48
|
-
})
|