@namzu/sandbox 2.0.2 → 2.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (72) hide show
  1. package/CHANGELOG.md +29 -0
  2. package/package.json +12 -2
  3. package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts +0 -2
  4. package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts.map +0 -1
  5. package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js +0 -61
  6. package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js.map +0 -1
  7. package/dist/backends/docker/__tests__/hardening.test.d.ts +0 -2
  8. package/dist/backends/docker/__tests__/hardening.test.d.ts.map +0 -1
  9. package/dist/backends/docker/__tests__/hardening.test.js +0 -32
  10. package/dist/backends/docker/__tests__/hardening.test.js.map +0 -1
  11. package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts +0 -40
  12. package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts.map +0 -1
  13. package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js +0 -157
  14. package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js.map +0 -1
  15. package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts +0 -16
  16. package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts.map +0 -1
  17. package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js +0 -37
  18. package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js.map +0 -1
  19. package/dist/backends/firecracker/__tests__/backend.test.d.ts +0 -13
  20. package/dist/backends/firecracker/__tests__/backend.test.d.ts.map +0 -1
  21. package/dist/backends/firecracker/__tests__/backend.test.js +0 -361
  22. package/dist/backends/firecracker/__tests__/backend.test.js.map +0 -1
  23. package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts +0 -19
  24. package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts.map +0 -1
  25. package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js +0 -209
  26. package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js.map +0 -1
  27. package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts +0 -2
  28. package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts.map +0 -1
  29. package/dist/backends/firecracker/__tests__/egress-policy.test.js +0 -67
  30. package/dist/backends/firecracker/__tests__/egress-policy.test.js.map +0 -1
  31. package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts +0 -21
  32. package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts.map +0 -1
  33. package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js +0 -30
  34. package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js.map +0 -1
  35. package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts +0 -39
  36. package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts.map +0 -1
  37. package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js +0 -149
  38. package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js.map +0 -1
  39. package/dist/backends/firecracker/__tests__/protocol.test.d.ts +0 -6
  40. package/dist/backends/firecracker/__tests__/protocol.test.d.ts.map +0 -1
  41. package/dist/backends/firecracker/__tests__/protocol.test.js +0 -67
  42. package/dist/backends/firecracker/__tests__/protocol.test.js.map +0 -1
  43. package/dist/backends/firecracker/__tests__/transport.test.d.ts +0 -20
  44. package/dist/backends/firecracker/__tests__/transport.test.d.ts.map +0 -1
  45. package/dist/backends/firecracker/__tests__/transport.test.js +0 -457
  46. package/dist/backends/firecracker/__tests__/transport.test.js.map +0 -1
  47. package/dist/egress/__tests__/allowlist.test.d.ts +0 -2
  48. package/dist/egress/__tests__/allowlist.test.d.ts.map +0 -1
  49. package/dist/egress/__tests__/allowlist.test.js +0 -85
  50. package/dist/egress/__tests__/allowlist.test.js.map +0 -1
  51. package/dist/egress/__tests__/proxy.test.d.ts +0 -2
  52. package/dist/egress/__tests__/proxy.test.d.ts.map +0 -1
  53. package/dist/egress/__tests__/proxy.test.js +0 -177
  54. package/dist/egress/__tests__/proxy.test.js.map +0 -1
  55. package/dist/index.test.d.ts +0 -28
  56. package/dist/index.test.d.ts.map +0 -1
  57. package/dist/index.test.js +0 -649
  58. package/dist/index.test.js.map +0 -1
  59. package/src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts +0 -69
  60. package/src/backends/docker/__tests__/hardening.test.ts +0 -43
  61. package/src/backends/docker/__tests__/leaf-permissions.smoke.test.ts +0 -169
  62. package/src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts +0 -48
  63. package/src/backends/firecracker/__tests__/backend.test.ts +0 -429
  64. package/src/backends/firecracker/__tests__/control-plane-mtls.test.ts +0 -261
  65. package/src/backends/firecracker/__tests__/egress-policy.test.ts +0 -91
  66. package/src/backends/firecracker/__tests__/fixtures/ipc-path.ts +0 -31
  67. package/src/backends/firecracker/__tests__/fixtures/mtls-pki.ts +0 -166
  68. package/src/backends/firecracker/__tests__/protocol.test.ts +0 -75
  69. package/src/backends/firecracker/__tests__/transport.test.ts +0 -534
  70. package/src/egress/__tests__/allowlist.test.ts +0 -103
  71. package/src/egress/__tests__/proxy.test.ts +0 -212
  72. package/src/index.test.ts +0 -709
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAI7C,OAAO,EACN,qBAAqB,EACrB,wBAAwB,EACxB,aAAa,GACb,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACN,qCAAqC,EACrC,iCAAiC,EAEjC,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,YAAY,CAAA;AAEnB,oEAAoE;AACpE,SAAS,WAAW,CAAC,YAA6C,EAAE;IACnE,OAAO;QACN,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAC/D,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,MAAM,cAAc,GAAG;IACtB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,qBAAqB;CACnB,CAAA;AAEV,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE;YAC5D,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,4EAA4E;QAC5E,mEAAmE;QACnE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE;YAC5D,MAAM,EAAE,WAAW,EAAE;SACrB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,CAAC;YACJ,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAW,CAAC,CAAA;YACpE,MAAM,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAA;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,iCAAiC,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC9F,MAAM,GAAG,GAAG,EAA4B,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC;YACrB,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,GAAG;SACX,CAAC,CACF,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAC9D,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAClE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAClE,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE;gBACpF,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EAAE;aAClF;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACtE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC/E,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACpE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5D,uBAAuB;YACvB,sBAAsB;SACtB,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,WAAW;aAC1B;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,UAAU;aACzB;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;oBAC7C,aAAa,EAAE,oBAAoB;iBACnC;aACD;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;QACxC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAE,QAA+C,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,EAA4B,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;QAC/E,IAAI,CAAC;YACJ,aAAa,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAClE;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QACpD,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACzD,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC/D,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC5D,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAC5D;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;YACzD,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACnE,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aACtE;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAA2B;YACtC,GAAG,WAAW,EAAE;YAChB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAChE;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,CAAE,GAA6C,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClF,gCAAgC,CAChC,CAAA;QACF,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAA2B;YACtC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,OAAO;aACtB;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,OAAO;aACtB;SACD,CAAA;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAA2B;YACtC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC3C,aAAa,EAAE,eAAe;aAC9B;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC3C,sDAAsD;iBACtD;aACD;SACD,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,GAAG,GAAG;YACX,kBAAkB;YAClB,MAAM,EAAE;gBACP,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;aAChE;SACoC,CAAA;QACtC,IAAI,CAAC;YACJ,aAAa,CAAC,GAAG,CAAC,CAAA;YAClB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,qCAAqC,CAAC,CAAA;YACjE,MAAM,OAAO,GAAI,GAA6C,CAAC,OAAO,CAAA;YACtE,0EAA0E;YAC1E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC;YACrD,+CAA+C;YAC/C,gCAAgC;SAChC,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC5B,+CAA+C;YAC/C,gCAAgC;SAChC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAA;QACrE,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,GAAG,GAAG,IAAI,qCAAqC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,eAAe,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,qCAAqC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;QACzE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACzC,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAsD,CAAA;QACxE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACzE,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpC,kEAAkE;QAClE,kDAAkD;QAClD,MAAM,CAAC,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACnE,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1E,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9D,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvD,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,+CAA+C;IAC/C,+DAA+D;IAC/D,mEAAmE;IACnE,wDAAwD;IACxD,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACtE,2BAA2B;QAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACvF,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACtB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;YACnB,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC;YACtC,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;SAC9B,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC9C,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,4DAA4D;YAC5D,wDAAwD;YACxD,0CAA0C;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,+CAA+C;IAC/C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAE/B;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CACvB;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAC5C;QAAC,CAAiC,CAAC,KAAK,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,iEAAiE;QACjE,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAA;QACxB,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,KAAK,GAAY,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAChC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACX,CAAC;gBAAC,CAAiC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAU,CAAA;QAC5C,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,4CAA4C;QAC5C,IAAI,MAAM,GAAuC,GAAG,CAAA;QACpD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,MAAM,EAAE,CAAC;YACf,KAAK,EAAE,CAAA;YACP,MAAM,GAAG,MAAM,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtB,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACzF,8DAA8D;QAC9D,+DAA+D;QAC/D,oBAAoB;QACpB,MAAM,GAAG,GAAsC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAC/D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAA;QACf,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACtC,0DAA0D;QAC1D,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,2BAA2B;QAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,8CAA8C;IAC9C,gEAAgE;IAChE,+DAA+D;IAC/D,4DAA4D;IAC5D,6DAA6D;IAC7D,iEAAiE;IACjE,4DAA4D;IAC5D,iBAAiB;IACjB,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACtF,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,6BAA6B;aAC5C;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBAC/C,aAAa,EAAE,eAAe;iBAC9B;gBACD;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBAC/C,aAAa,EAAE,eAAe;iBAC9B;aACD;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YACpB,UAAU;YACV,gCAAgC;YAChC,UAAU;YACV,gCAAgC;YAChC,UAAU;YACV,sCAAsC;YACtC,UAAU;YACV,yBAAyB;YACzB,UAAU;YACV,yBAAyB;YACzB,UAAU;YACV,2BAA2B;SAC3B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;SACD,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,wBAAwB,CAAC;YACpC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAC7C,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC9C,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACrF,2DAA2D;IAC3D,8DAA8D;IAC9D,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,yCAAyC;IACzC,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,QAAQ,GAAG;YAChB,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE,6BAA6B;YAC1C,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,4BAA4B;SACzC,CAAA;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC;YAClC,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACvD,aAAa,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACvD,aAAa,EAAE,wBAAwB;aACvC;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAC3D,aAAa,EAAE,6BAA6B;aAC5C;YACD,MAAM,EAAE;gBACP;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACtD,aAAa,EAAE,eAAe;iBAC9B;gBACD;oBACC,EAAE,EAAE,GAAG;oBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACtD,aAAa,EAAE,eAAe;iBAC9B;aACD;YACD,WAAW,EAAE;gBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAC3D,aAAa,EAAE,kBAAkB;aACjC;SACD,CAAC,CAAA;QAEF,8DAA8D;QAC9D,2DAA2D;QAC3D,gEAAgE;QAChE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}
@@ -1,69 +0,0 @@
1
- import { describe, expect, it } from 'vitest'
2
-
3
- import type { SandboxBackendOptions } from '../../../index.js'
4
- import { assertEnforceable } from '../index.js'
5
-
6
- /**
7
- * The claim API rejects every property override that is not a config map,
8
- * so a memory cap, a process cap, environment variables and an egress
9
- * policy have nowhere to ride through on this backend. They were accepted
10
- * and dropped: a host that asked for `deny-all` and 512 MB got full
11
- * outbound network and no cap, with no error and no warning — from the same
12
- * call shape that IS enforced on the sibling container backend.
13
- *
14
- * Switching backends therefore removed the blast-radius controls silently,
15
- * which is the worst way to lose them. namzu already holds the norm for
16
- * this next door: a policy accepted and quietly ignored is worse than one
17
- * that is refused.
18
- */
19
-
20
- const opts = (extra: Partial<SandboxBackendOptions> = {}): SandboxBackendOptions => ({
21
- workingDirectory: '/w',
22
- ...extra,
23
- })
24
-
25
- describe('controls this backend cannot apply', () => {
26
- it.each([
27
- ['an egress policy', { egress: { kind: 'deny-all' } as const }],
28
- ['a memory limit', { memoryLimitMb: 512 }],
29
- ['a process limit', { maxProcesses: 32 }],
30
- ['environment variables', { env: { SECRET: 'x' } }],
31
- ])('refuses %s', (_name, extra) => {
32
- expect(() => assertEnforceable(opts(extra))).toThrow(/cannot enforce per-sandbox/)
33
- })
34
-
35
- it('names every field it cannot honour, not just the first', () => {
36
- try {
37
- assertEnforceable(opts({ egress: { kind: 'deny-all' }, memoryLimitMb: 512, maxProcesses: 8 }))
38
- expect.unreachable()
39
- } catch (err) {
40
- const message = (err as Error).message
41
- // A host fixing one and hitting the next on the following run
42
- // learns the shape one failure at a time.
43
- expect(message).toContain('egress')
44
- expect(message).toContain('memory')
45
- expect(message).toContain('process')
46
- }
47
- })
48
-
49
- it('says where the limits do belong', () => {
50
- // Refusing without saying what to do instead is a dead end; these
51
- // are a property of the pooled profile.
52
- expect(() => assertEnforceable(opts({ memoryLimitMb: 512 }))).toThrow(/container group profile/)
53
- })
54
- })
55
-
56
- describe('what it does allow through', () => {
57
- it('accepts a request that asks for nothing it cannot apply', () => {
58
- expect(() => assertEnforceable(opts())).not.toThrow()
59
- })
60
-
61
- it('accepts a timeout, which is applied by the caller not the pool', () => {
62
- expect(() => assertEnforceable(opts({ timeoutMs: 30_000 }))).not.toThrow()
63
- })
64
-
65
- it('treats an empty env bag as asking for nothing', () => {
66
- // A host spreading an empty object should not be refused for it.
67
- expect(() => assertEnforceable(opts({ env: {} }))).not.toThrow()
68
- })
69
- })
@@ -1,43 +0,0 @@
1
- import { describe, expect, it } from 'vitest'
2
-
3
- import { resolveNetwork } from '../index.js'
4
-
5
- /**
6
- * `EgressPolicy` was accepted by the type, threaded through the options,
7
- * and silently ignored by this backend. That is worse than not supporting
8
- * it: a host that set `deny-all` believed the container had no network,
9
- * and it had whatever `config.network` said.
10
- */
11
-
12
- describe('resolveNetwork', () => {
13
- it('leaves the configured network alone when no policy is supplied', () => {
14
- expect(resolveNetwork('bridge', undefined)).toBe('bridge')
15
- })
16
-
17
- it('enforces deny-all natively', () => {
18
- // Docker can actually do this one, so there is no excuse for
19
- // accepting the policy and ignoring it.
20
- expect(resolveNetwork('bridge', { kind: 'deny-all' })).toBe('none')
21
- })
22
-
23
- it('allow-all keeps the configured network', () => {
24
- expect(resolveNetwork('my-bridge', { kind: 'allow-all' })).toBe('my-bridge')
25
- })
26
-
27
- it('REFUSES a host allowlist rather than silently granting full access', () => {
28
- // This backend has no proxy to filter through. Downgrading a
29
- // restrictive policy to "allow everything" is the failure mode that
30
- // makes a security control worse than useless.
31
- expect(() =>
32
- resolveNetwork('bridge', { kind: 'static', allowedHosts: ['example.com'] }),
33
- ).toThrow(/cannot enforce an egress policy/)
34
-
35
- expect(() => resolveNetwork('bridge', { kind: 'resolver', resolve: async () => [] })).toThrow(
36
- /cannot enforce an egress policy/,
37
- )
38
- })
39
-
40
- it('names what it can do, so the failure is actionable', () => {
41
- expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: [] })).toThrow(/deny-all/)
42
- })
43
- })
@@ -1,169 +0,0 @@
1
- /**
2
- * Docker smoke test — leaf-mount permission semantics.
3
- *
4
- * Concern raised in review: the Dockerfile pre-creates only the parent
5
- * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
6
- * The runtime claim is that:
7
- *
8
- * 1. When `outputs` IS bound, uid 1001 (the worker user) can write
9
- * into it.
10
- * 2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
11
- * the path simply does not exist — `stat` returns ENOENT, NOT
12
- * a writable empty dir.
13
- *
14
- * Both of those are kernel-level mount-namespace properties, not
15
- * unit-testable. This file exercises them against a real docker
16
- * daemon. Run via:
17
- *
18
- * pnpm --filter @namzu/sandbox test:smoke
19
- * # or, from the monorepo root:
20
- * pnpm sandbox:smoke
21
- *
22
- * Excluded from the default `pnpm test` run by `vitest.config.ts`.
23
- *
24
- * Pre-requisites:
25
- * - `docker` CLI on PATH.
26
- * - A pre-built reference image. By default this test looks for
27
- * `namzu-sandbox-worker:smoke`. Override with the
28
- * `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
29
- * `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
30
- * - A host-side scratch directory the test creates and tears down.
31
- *
32
- * On a developer machine without docker the test self-skips with a
33
- * clear message. On CI (`process.env.CI === 'true'`) the same
34
- * pre-conditions FAIL FAST instead of skipping, so a CI
35
- * misconfiguration cannot silently mask a regression — see the
36
- * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
37
- * always run with docker available.
38
- */
39
-
40
- import { spawnSync } from 'node:child_process'
41
- import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
42
- import { tmpdir } from 'node:os'
43
- import { join } from 'node:path'
44
-
45
- import { afterAll, beforeAll, describe, expect, it } from 'vitest'
46
-
47
- import { createSandboxProvider } from '../../../index.js'
48
-
49
- const IMAGE = process.env.NAMZU_SANDBOX_SMOKE_IMAGE ?? 'namzu-sandbox-worker:smoke'
50
- const IS_CI = process.env.CI === 'true'
51
-
52
- function dockerAvailable(): boolean {
53
- const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
54
- stdio: 'ignore',
55
- })
56
- return probe.status === 0
57
- }
58
-
59
- function imagePresent(image: string): boolean {
60
- const probe = spawnSync('docker', ['image', 'inspect', image], { stdio: 'ignore' })
61
- return probe.status === 0
62
- }
63
-
64
- const skipReason = !dockerAvailable()
65
- ? 'docker daemon not reachable — skipping smoke test'
66
- : !imagePresent(IMAGE)
67
- ? `image ${IMAGE} not present — build it with \`docker build -t ${IMAGE} -f packages/sandbox/worker/Dockerfile packages/sandbox\` and re-run`
68
- : null
69
-
70
- // CI fail-fast: the smoke workflow is meant to always have docker +
71
- // the reference image. Skipping silently in that environment would
72
- // let a regression land without the test even attempting to run.
73
- // Locally (no `CI=true`) skipping with a hint is the right behaviour
74
- // for a developer who hasn't built the image yet.
75
- if (IS_CI && skipReason) {
76
- throw new Error(
77
- `smoke test pre-condition not satisfied on CI: ${skipReason}. Configure the workflow to install docker and build the reference image before running.`,
78
- )
79
- }
80
-
81
- describe.skipIf(skipReason !== null)('docker smoke — leaf permissions', () => {
82
- let outputsHost: string
83
-
84
- beforeAll(() => {
85
- outputsHost = mkdtempSync(join(tmpdir(), 'namzu-sandbox-smoke-out-'))
86
- })
87
-
88
- afterAll(() => {
89
- if (outputsHost) {
90
- rmSync(outputsHost, { recursive: true, force: true })
91
- }
92
- })
93
-
94
- it('uid 1001 can write to the outputs bind, and the host sees the file', async () => {
95
- const provider = createSandboxProvider({
96
- backend: { tier: 'container', image: IMAGE },
97
- layout: {
98
- outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
99
- },
100
- })
101
- const sandbox = await provider.create()
102
- try {
103
- const result = await sandbox.exec('sh', [
104
- '-c',
105
- 'id -u && echo "smoke" > /mnt/user-data/outputs/hello.txt',
106
- ])
107
- expect(result.exitCode).toBe(0)
108
- expect(result.stdout.trim()).toBe('1001')
109
- // Host-side read confirms the bind round-trips.
110
- const hostContent = readFileSync(join(outputsHost, 'hello.txt'), 'utf8')
111
- expect(hostContent.trim()).toBe('smoke')
112
- } finally {
113
- await sandbox.destroy()
114
- }
115
- }, 60_000)
116
-
117
- it('unbound leaves do not exist — uploads/transcripts/tool_results are ENOENT, not empty', async () => {
118
- const provider = createSandboxProvider({
119
- backend: { tier: 'container', image: IMAGE },
120
- layout: {
121
- outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
122
- // Intentionally leave uploads / toolResults / transcripts
123
- // unbound. The Dockerfile pre-creates only the parents
124
- // (`/mnt/user-data`, `/mnt/skills`); leaves should not
125
- // exist and `stat` should fail.
126
- },
127
- })
128
- const sandbox = await provider.create()
129
- try {
130
- for (const leafPath of [
131
- '/mnt/user-data/uploads',
132
- '/mnt/user-data/tool_results',
133
- '/mnt/transcripts',
134
- ]) {
135
- const result = await sandbox.exec('sh', ['-c', `stat ${leafPath} 2>&1; echo --rc=$?`])
136
- // `stat` returns non-zero on ENOENT; the rc line carries
137
- // the failure. Either is the contract; we accept either
138
- // "No such file" or "cannot stat" wording across distros.
139
- expect(result.stdout).toMatch(/--rc=[1-9]/)
140
- expect(result.stdout.toLowerCase()).toMatch(/no such file|cannot stat|does not exist/)
141
- }
142
- } finally {
143
- await sandbox.destroy()
144
- }
145
- }, 60_000)
146
-
147
- it('uid 1001 cannot mkdir into the root-owned 0555 parent /mnt/user-data', async () => {
148
- const provider = createSandboxProvider({
149
- backend: { tier: 'container', image: IMAGE },
150
- layout: {
151
- outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
152
- },
153
- })
154
- const sandbox = await provider.create()
155
- try {
156
- // The model trying to "create the missing leaf dir" hits
157
- // the 0555 root-owned parent and is denied — exactly what
158
- // distinguishes "not bound" from "writable empty dir".
159
- const result = await sandbox.exec('sh', [
160
- '-c',
161
- 'mkdir /mnt/user-data/fake 2>&1; echo --rc=$?',
162
- ])
163
- expect(result.stdout).toMatch(/--rc=[1-9]/)
164
- expect(result.stdout.toLowerCase()).toMatch(/permission denied/)
165
- } finally {
166
- await sandbox.destroy()
167
- }
168
- }, 60_000)
169
- })
@@ -1,48 +0,0 @@
1
- /**
2
- * `resolveTimeoutMs` is the guest agent's only guard against a
3
- * caller-requested `timeoutMs` that has no schema ceiling upstream (it
4
- * traces back to the bash tool's model-authored `timeout` argument — see
5
- * `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
6
- * be refused (the sibling `worker/server.js` answers `invalid_timeout` on
7
- * response), not silently shortened — a caller that asked for more and got
8
- * less without being told would believe its process was protected for the
9
- * duration it actually asked for.
10
- *
11
- * Pure-function test, no socket/process involved, so it runs on every
12
- * platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
13
- * `/bin/sh` and skip on Windows).
14
- */
15
-
16
- import { createRequire } from 'node:module'
17
-
18
- import { describe, expect, it } from 'vitest'
19
-
20
- const require_ = createRequire(import.meta.url)
21
-
22
- interface AgentModule {
23
- resolveTimeoutMs(rawTimeoutMs: unknown): number
24
- }
25
-
26
- const agent = require_('../../../../agent/agent.cjs') as AgentModule
27
-
28
- describe('agent.cjs resolveTimeoutMs', () => {
29
- it('passes through a caller value within the cap', () => {
30
- expect(agent.resolveTimeoutMs(10_000)).toBe(10_000)
31
- })
32
-
33
- it('falls back to the default for an omitted value', () => {
34
- expect(agent.resolveTimeoutMs(undefined)).toBe(5 * 60 * 1000)
35
- })
36
-
37
- it('refuses a request far above the cap instead of honoring or silently shortening it', () => {
38
- expect(() => agent.resolveTimeoutMs(Number.MAX_SAFE_INTEGER)).toThrow(/timeoutMs/)
39
- expect(() => agent.resolveTimeoutMs(10 ** 12)).toThrow(/timeoutMs/)
40
- })
41
-
42
- it('refuses a non-finite or non-positive value', () => {
43
- expect(() => agent.resolveTimeoutMs(0)).toThrow(/timeoutMs/)
44
- expect(() => agent.resolveTimeoutMs(-1)).toThrow(/timeoutMs/)
45
- expect(() => agent.resolveTimeoutMs(Number.NaN)).toThrow(/timeoutMs/)
46
- expect(() => agent.resolveTimeoutMs(Number.POSITIVE_INFINITY)).toThrow(/timeoutMs/)
47
- })
48
- })