@openclaw/mxc-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@microsoft/mxc-sdk/dist/generated/wire.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=wire.js.map

package/node_modules/@microsoft/mxc-sdk/dist/generated/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/generated/wire.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC"}

package/node_modules/@microsoft/mxc-sdk/dist/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAwF,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,EAAE,MAWtB,CAAC;AAIL,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,IAAI,CAKrC;AAID;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASjF;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,GAC3B;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAiD5C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,mBAAwB,GAChC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA6D5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CA6BpB"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAwF,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,EAAE,MAWtB,CAAC;AAIL,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,IAAI,CAKrC;AAID;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASjF;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,GAC3B;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAiD5C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,mBAAwB,GAChC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAkF5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CA6BpB"}

package/node_modules/@microsoft/mxc-sdk/dist/helper.js

@@ -212,7 +212,25 @@ export function resolveExecutableAndArgs(config, options = {}) {
                 `Available methods: ${platformSupport.availableMethods.join(', ')}`);
         }
     }
-    return resolveBinaryAndCommonArgs(JSON.stringify(config), options);
+    // `network.proxy.builtinTestServer` is testing-only, deliberately-permissive
+    // scaffolding that the native binary gates behind `--allow-testing-features`.
+    // Mirror that fail-closed posture at the SDK boundary: the caller must opt in
+    // explicitly via `allowTestingFeatures` (a distinct axis from `experimental`).
+    // Forwarding the flag automatically whenever the policy used the feature would
+    // make the gate meaningless — requesting the dangerous feature would silently
+    // enable the gate that is supposed to guard it.
+    const proxy = config.network?.proxy;
+    const usesBuiltinTestServer = proxy?.builtinTestServer === true;
+    if (usesBuiltinTestServer && !options.allowTestingFeatures) {
+        throw new Error("network.proxy.builtinTestServer is a testing-only feature. Set " +
+            "'allowTestingFeatures: true' in SandboxSpawnOptions to enable it. For " +
+            "production, point network.proxy at a real HTTP proxy via 'localhost' or 'url'.");
+    }
+    const resolved = resolveBinaryAndCommonArgs(JSON.stringify(config), options);
+    if (usesBuiltinTestServer) {
+        resolved.args.push('--allow-testing-features');
+    }
+    return resolved;
 }
 /**
  * Sets up logging and resolves the executable path + args.

package/node_modules/@microsoft/mxc-sdk/dist/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAuC,gBAAgB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEjH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE;IACrC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,OAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAiB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;AACL,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC1B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,SAAiB;IACvE,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CACH,sBAAsB,MAAM,yBAAyB,SAAS,aAAa;YAC3E,gFAAgF;YAChF,kCAAkC,CACrC,CAAC;IACN,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uCAAuC;IACnD,uBAAuB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,MAAM,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,0EAA0E;YAC1E,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAChB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,OAA4B;IAE5B,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,cAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,UAA+B,EAAE;IAEjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,6DAA6D;IAC7D,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,MAAM,oBAAoB,GAAG,cAAc;QACzC,CAAC,CAAC,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,cAAc,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;QAC9D,yBAAyB,CAAC,cAAc,EAAE,oBAA0C,CAAC,CAAC;IACxF,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CACb,IAAI,cAAc,4FAA4F,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,CAAC,CAAC,oBAAoB;QAC1C,oBAA0C,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,oBAAoB,KAAK,SAAS,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED,wCAAwC;IACxC,IAAI,oBAAoB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACvD,wEAAwE;QACxE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,QAAQ,GAAI,gBAAsC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAC3D,oBAA0C,CAC3C,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,wBAAwB,cAAc,uCAAuC;gBAC7E,sBAAsB,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,OAA4B;IAE5B,IAAI,MAA8B,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE;QACrC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,kFAAkF;QAClF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAuC,gBAAgB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEjH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE;IACrC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,OAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAiB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;AACL,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC1B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,SAAiB;IACvE,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CACH,sBAAsB,MAAM,yBAAyB,SAAS,aAAa;YAC3E,gFAAgF;YAChF,kCAAkC,CACrC,CAAC;IACN,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uCAAuC;IACnD,uBAAuB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,MAAM,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,0EAA0E;YAC1E,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAChB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,OAA4B;IAE5B,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,cAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,UAA+B,EAAE;IAEjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,6DAA6D;IAC7D,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,MAAM,oBAAoB,GAAG,cAAc;QACzC,CAAC,CAAC,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,cAAc,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;QAC9D,yBAAyB,CAAC,cAAc,EAAE,oBAA0C,CAAC,CAAC;IACxF,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CACb,IAAI,cAAc,4FAA4F,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,CAAC,CAAC,oBAAoB;QAC1C,oBAA0C,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,oBAAoB,KAAK,SAAS,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED,wCAAwC;IACxC,IAAI,oBAAoB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACvD,wEAAwE;QACxE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,QAAQ,GAAI,gBAAsC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAC3D,oBAA0C,CAC3C,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,wBAAwB,cAAc,uCAAuC;gBAC7E,sBAAsB,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAoD,CAAC;IACnF,MAAM,qBAAqB,GAAG,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAChE,IAAI,qBAAqB,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE;YACjE,wEAAwE;YACxE,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,OAA4B;IAE5B,IAAI,MAA8B,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE;QACrC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,kFAAkF;QAClF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/index.d.ts

@@ -2,6 +2,15 @@
  * MXC SDK - TypeScript SDK for Microsoft eXecution Containers
  *
  * This package provides a Node.js interface for spawning sandboxed containers.
+ * For direct Windows ProcessContainer configs, set
+ * `processContainer.learningMode: true` to enable deny-and-record learning
+ * mode. Learning-mode capability names are reserved and must not be supplied
+ * directly in `processContainer.capabilities`.
+ *
+ * Schema `0.8.0-alpha` policies may use directional
+ * `network.egress` / `network.ingress`, `runtimeConfig.networkProxy`, and
+ * `processContainer.network.allowedProxyPeer` through `createConfigFromPolicy`.
+ * These fields cannot be mixed with legacy network fields.
  *
  * @example
  * ```typescript
@@ -9,7 +18,7 @@
  *
  * if (getPlatformSupport().isSupported) {
  *   const policy: SandboxPolicy = {
- *     version: '0.4.0-alpha',
+ *     version: '0.6.0-alpha',
  *     network: { allowOutbound: true },
  *   };
  *
@@ -21,11 +30,11 @@
  *
  * @packageDocumentation
  */
-export { SandboxPolicy, SandboxingMethod, IsolationTier, ContainmentType, ContainmentTypes, ContainmentBackend, ExperimentalBackends, ContainerConfig, PlatformSupport, UiCapabilitySupport, } from './types.js';
+export { SandboxPolicy, SandboxingMethod, IsolationTier, ContainmentType, ContainmentTypes, ContainmentBackend, ExperimentalBackends, ContainerConfig, ProcessContainerConfig, NetworkAction, NetworkProtocol, NetworkPeerConfig, NetworkPortConfig, NetworkRuleConfig, NetworkEgressConfig, NetworkIngressConfig, RuntimeConfig, PlatformSupport, UiCapabilitySupport, } from './types.js';
 export { getPlatformSupport, } from './platform.js';
 export { createConfigFromPolicy, spawnSandbox, spawnSandboxAsync, spawnSandboxFromConfig, buildSandboxPayload, SandboxSpawnOptions, } from './sandbox.js';
 export { getAvailableToolsPolicy, getUserProfilePolicy, getTemporaryFilesPolicy, FilesystemPolicyResult, ToolsPolicyOptions, } from './policy.js';
-export { ErrorCode, MxcError, mxcErrorFromCode, } from './errors.js';
-export { Phase, StateAwareContainmentBackend, SandboxId, IsolationSessionUserConfig, IsolationSessionProvisionConfig, IsolationSessionStartConfig, IsolationSessionExecConfig, IsolationSessionStopConfig, IsolationSessionDeprovisionConfig, IsolationSessionProvisionMetadata, ConfigsForBackend, ProvisionConfigFor, StartConfigFor, ExecConfigFor, StopConfigFor, DeprovisionConfigFor, StateAwareMetadata, ProvisionMetadataFor, StartMetadataFor, StopMetadataFor, DeprovisionMetadataFor, ProvisionResult, StartResult, StopResult, DeprovisionResult, ExecResult, } from './state-aware-types.js';
+export { ErrorCode, MxcError, MxcErrorFields, mxcErrorFromCode, } from './errors.js';
+export { Phase, StateAwareContainmentBackend, SandboxId, IsolationSessionProvisionConfig, IsolationSessionStartConfig, IsolationSessionExecConfig, IsolationSessionStopConfig, IsolationSessionDeprovisionConfig, IsolationSessionProvisionMetadata, WindowsSandboxProvisionConfig, WindowsSandboxStartConfig, WindowsSandboxExecConfig, WindowsSandboxStopConfig, WindowsSandboxDeprovisionConfig, WslcProvisionConfig, WslcStartConfig, WslcExecConfig, WslcStopConfig, WslcDeprovisionConfig, ConfigsForBackend, ProvisionConfigFor, StartConfigFor, ExecConfigFor, StopConfigFor, DeprovisionConfigFor, StateAwareMetadata, ProvisionMetadataFor, StartMetadataFor, StopMetadataFor, DeprovisionMetadataFor, ProvisionResult, StartResult, StopResult, DeprovisionResult, ExecResult, } from './state-aware-types.js';
 export { provisionSandbox, startSandbox, execInSandbox, execInSandboxAsync, stopSandbox, deprovisionSandbox, } from './state-aware.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,SAAS,EACT,0BAA0B,EAC1B,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,iCAAiC,EACjC,iCAAiC,EACjC,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,UAAU,GACX,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAUrB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,SAAS,EACT,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,iCAAiC,EACjC,iCAAiC,EACjC,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,+BAA+B,EAC/B,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,UAAU,GACX,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/index.js

@@ -4,6 +4,15 @@
  * MXC SDK - TypeScript SDK for Microsoft eXecution Containers
  *
  * This package provides a Node.js interface for spawning sandboxed containers.
+ * For direct Windows ProcessContainer configs, set
+ * `processContainer.learningMode: true` to enable deny-and-record learning
+ * mode. Learning-mode capability names are reserved and must not be supplied
+ * directly in `processContainer.capabilities`.
+ *
+ * Schema `0.8.0-alpha` policies may use directional
+ * `network.egress` / `network.ingress`, `runtimeConfig.networkProxy`, and
+ * `processContainer.network.allowedProxyPeer` through `createConfigFromPolicy`.
+ * These fields cannot be mixed with legacy network fields.
  *
  * @example
  * ```typescript
@@ -11,7 +20,7 @@
  *
  * if (getPlatformSupport().isSupported) {
  *   const policy: SandboxPolicy = {
- *     version: '0.4.0-alpha',
+ *     version: '0.6.0-alpha',
  *     network: { allowOutbound: true },
  *   };
  *
@@ -31,10 +40,15 @@ export { getPlatformSupport, } from './platform.js';
 export { createConfigFromPolicy, spawnSandbox, spawnSandboxAsync, spawnSandboxFromConfig, buildSandboxPayload, } from './sandbox.js';
 // Export policy discovery functions
 export { getAvailableToolsPolicy, getUserProfilePolicy, getTemporaryFilesPolicy, } from './policy.js';
-// Export typed wire-format errors
+// Export typed wire-format errors.
+//
+// `WireError` and `mxcErrorFromEnvelope` are deliberately NOT re-exported:
+// they exist so the SDK's own envelope-parsing sites share one widening
+// point, and keeping them module-internal leaves the wire-parsing internals
+// free to change. `MxcErrorFields` *is* exported because it is the parameter
+// type of a public `MxcError` constructor overload — hiding the name would
+// leave the type usable via an object literal but impossible to name.
 export { MxcError, mxcErrorFromCode, } from './errors.js';
-// Export state-aware lifecycle types
-export { IsolationSessionUserConfig, } from './state-aware-types.js';
 // Export state-aware lifecycle functions
 export { provisionSandbox, startSandbox, execInSandbox, execInSandboxAsync, stopSandbox, deprovisionSandbox, } from './state-aware.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@microsoft/mxc-sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAe;AACf,OAAO,EAKL,gBAAgB,EAEhB,oBAAoB,GAIrB,MAAM,YAAY,CAAC;AAEpB,sCAAsC;AACtC,OAAO,EACL,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,cAAc,CAAC;AAEtB,oCAAoC;AACpC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,GAGxB,MAAM,aAAa,CAAC;AAErB,kCAAkC;AAClC,OAAO,EAEL,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,qCAAqC;AACrC,OAAO,EAIL,0BAA0B,GAuB3B,MAAM,wBAAwB,CAAC;AAEhC,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,eAAe;AACf,OAAO,EAKL,gBAAgB,EAEhB,oBAAoB,GAarB,MAAM,YAAY,CAAC;AAEpB,sCAAsC;AACtC,OAAO,EACL,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,cAAc,CAAC;AAEtB,oCAAoC;AACpC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,GAGxB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,sEAAsE;AACtE,OAAO,EAEL,QAAQ,EAER,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAyCrB,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/platform.d.ts

@@ -1,14 +1,4 @@
 import { PlatformSupport } from './types.js';
-/**
- * Result of querying the host's Windows build number, or `null` when the
- * registry values are missing or unparseable.
- */
-type WindowsBuild = {
-    major: number;
-    minor: number;
-} | null;
-/** @internal Test-only: override the Windows build lookup. */
-export declare function _setWindowsBuildQuery(fn: (() => WindowsBuild) | null): void;
 /**
  * Get platform support information.
  *
@@ -31,6 +21,66 @@ export declare function _resetPlatformSupportCache(): void;
 type ProbeRunner = () => string;
 /** @internal Test-only: override the probe runner. */
 export declare function _setProbeRunner(runner: ProbeRunner | null): void;
+/** Outcome of the Bubblewrap probe: available, or unavailable with a reason. */
+type BubblewrapProbe = {
+    available: true;
+} | {
+    available: false;
+    reason: string;
+};
+/**
+ * Raw result of running `bwrap --version`, normalized across the ways the call
+ * can fail. Mirrors the cases the Rust `probe_bwrap` distinguishes.
+ */
+type BwrapVersionResult = {
+    kind: 'output';
+    stdout: string;
+} | {
+    kind: 'notFound';
+} | {
+    kind: 'failed';
+    status: number | null;
+    detail: string;
+};
+/** @internal Test-only: override the `bwrap --version` runner. */
+export declare function _setBwrapVersionRunner(fn: (() => BwrapVersionResult) | null): void;
+/**
+ * Parse the version out of a `bwrap --version` line such as
+ * `"bubblewrap 0.11.2"`.
+ *
+ * Anchored on the `bubblewrap` package name, which is what makes unrecognized
+ * output fail closed: without it any numeric token in arbitrary output (say
+ * `"some other tool 999"`) would be read as a version and clear the
+ * minimum-version gate.
+ *
+ * Lenient about what *surrounds* each number so distro-patched version strings
+ * (`0.4.1-1`, a bare `0.6`) still resolve: the version token is split on `.`
+ * and each of the (up to three) components contributes its leading digits.
+ * Debian's `+really` marker is honored rather than ignored — see below.
+ *
+ * Strict about components that are *present but not numeric*: only a component
+ * that is genuinely absent defaults to `0`, so `"0.6.invalid"` is rejected
+ * rather than silently read as `0.6.0`.
+ *
+ * @internal Exported for unit tests.
+ * @returns `[major, minor, patch]`, or `null` when the version cannot be determined.
+ */
+export declare function _parseBwrapVersion(output: string): [number, number, number] | null;
+/**
+ * Check whether Bubblewrap (bwrap) is installed *and* new enough.
+ *
+ * Presence on PATH is not sufficient: a `bwrap` older than
+ * {@link MIN_BWRAP_VERSION} would reject flags the backend always emits and
+ * fail at spawn time with an opaque "unknown option" error. Unparsable output
+ * fails closed — without a version we cannot assert the required flags exist.
+ *
+ * Mirrors `probe_bwrap` in
+ * `src/backends/bubblewrap/common/src/bwrap_version.rs`, including the
+ * distinction between a missing binary and a present-but-broken one.
+ *
+ * @internal Exported for unit tests.
+ */
+export declare function _probeBubblewrap(): BubblewrapProbe;
 /**
  * Find the wxc-exec executable
  * Searches in common locations relative to the SDK package,

package/node_modules/@microsoft/mxc-sdk/dist/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqC,eAAe,EAAuB,MAAM,YAAY,CAAC;AAkDrG;;;GAGG;AACH,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAwB5D,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,CAAC,MAAM,YAAY,CAAC,GAAG,IAAI,GAAG,IAAI,CAE3E;AAsDD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAOpD;AAID,6DAA6D;AAC7D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;GAGG;AACH,KAAK,WAAW,GAAG,MAAM,MAAM,CAAC;AAIhC,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEhE;AA4MD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAiCjD;AAmCD;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAiCjD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAgCtD"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqC,eAAe,EAAuB,MAAM,YAAY,CAAC;AAuDrG;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAOpD;AAID,6DAA6D;AAC7D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;GAGG;AACH,KAAK,WAAW,GAAG,MAAM,MAAM,CAAC;AAIhC,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEhE;AAgKD,gFAAgF;AAChF,KAAK,eAAe,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF;;;GAGG;AACH,KAAK,kBAAkB,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA6E9D,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,CAAC,MAAM,kBAAkB,CAAC,GAAG,IAAI,GAAG,IAAI,CAElF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CA4BlF;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,eAAe,CAsClD;AA2DD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAiCjD;AAmCD;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAiCjD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAgCtD"}

package/node_modules/@microsoft/mxc-sdk/dist/platform.js

@@ -3,6 +3,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { fileURLToPath } from 'node:url';
+import { diagLog } from './diagnostic.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 /**
@@ -20,75 +21,6 @@ function getSdkPackageRoot() {
         return path.join(__dirname, '..');
     }
 }
-/**
- * Query Windows Registry for a value
- * @param key - Registry key path (e.g., "HKLM\\Software\\...")
- * @param valueName - Name of the value to query
- * @returns The registry value as a string, or null if not found
- */
-function queryWindowsRegistry(key, valueName) {
-    try {
-        const command = `reg query "${key}" /v "${valueName}"`;
-        const output = execSync(command, { encoding: 'utf-8', stdio: 'pipe' });
-        // Parse output - format is:
-        // HKEY_LOCAL_MACHINE\...
-        //     ValueName    REG_SZ    Value
-        const lines = output.split('\n');
-        for (const line of lines) {
-            if (line.includes(valueName)) {
-                // Extract value after REG_SZ or REG_DWORD
-                const match = line.match(/REG_\w+\s+(.+)/);
-                if (match) {
-                    return match[1].trim();
-                }
-            }
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Default implementation that reads `CurrentBuild` / `UBR` from the
- * registry. Replaceable via {@link _setWindowsBuildQuery} in tests so we
- * can exercise the IsolationSession version gate deterministically.
- */
-function defaultWindowsBuildQuery() {
-    const registryPath = 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion';
-    const currentBuild = queryWindowsRegistry(registryPath, 'CurrentBuild');
-    const ubrValue = queryWindowsRegistry(registryPath, 'UBR');
-    if (!currentBuild || !ubrValue) {
-        return null;
-    }
-    const major = parseInt(currentBuild, 10);
-    const minor = Number(ubrValue);
-    if (isNaN(major) || isNaN(minor)) {
-        return null;
-    }
-    return { major, minor };
-}
-let windowsBuildQuery = defaultWindowsBuildQuery;
-/** @internal Test-only: override the Windows build lookup. */
-export function _setWindowsBuildQuery(fn) {
-    windowsBuildQuery = fn ?? defaultWindowsBuildQuery;
-}
-/**
- * Check whether the host supports the IsolationSession backend.
- * Requires Windows Insider Preview build 26300.8553 or later.
- *
- * No internal cache — `getPlatformSupport` memoizes the full result, and
- * registry reads are cheap relative to the rest of the probe.
- */
-function isIsoSessionSupported() {
-    const build = windowsBuildQuery();
-    if (!build) {
-        return false;
-    }
-    // Pin to the Windows Insider Preview build that introduced IsolationSession
-    // (26300.8553+). Other major builds are not yet supported.
-    return build.major === 26300 && build.minor >= 8553;
-}
 let windowsSandboxAvailableCache;
 /**
  * Check if Windows Sandbox feature is enabled via DISM.
@@ -177,11 +109,12 @@ function isUiCapabilitySupport(value) {
     return UI_CAPABILITY_FIELDS.every((field) => typeof capabilities[field] === 'boolean');
 }
 /**
- * Run the probe binary and merge its results into `support`. On any
- * failure (binary missing, timeout, malformed JSON, unknown tier), the
- * function silently leaves `support.isolationTier` and
- * `support.isolationWarnings` unset — callers see the same contract as
- * pre-Phase-5 SDKs.
+ * Run the probe binary and merge its results into `support`: the isolation
+ * tier, any warnings, portable UI capabilities, and — when the probe reports
+ * the isolation-session service available — the `isolation_session` method.
+ * On any failure (binary missing, timeout, malformed JSON), the function
+ * silently leaves those fields unset, so callers see the same contract as
+ * pre-probe SDKs.
  */
 function populateIsolationFromProbe(support) {
     try {
@@ -202,6 +135,9 @@ function populateIsolationFromProbe(support) {
                 if (isUiCapabilitySupport(facts.uiCapabilities)) {
                     support.uiCapabilities = facts.uiCapabilities;
                 }
+                if (facts.isolationSessionAvailable === true) {
+                    support.availableMethods.push('isolation_session');
+                }
             }
         }
     }
@@ -233,15 +169,24 @@ function computeSupport() {
         const methods = [];
         if (isLxcAvailable())
             methods.push('lxc');
-        if (isBubblewrapAvailable())
+        const bubblewrap = _probeBubblewrap();
+        if (bubblewrap.available) {
             methods.push('bubblewrap');
+        }
+        else {
+            // Always surface why bwrap is unavailable. When LXC is present the
+            // platform is still supported, so `reason` — documented as why the
+            // platform is *not* supported — must stay unset, and the detail would
+            // otherwise be dropped with no way to diagnose the missing backend.
+            diagLog(`getPlatformSupport: bubblewrap unavailable — ${bubblewrap.reason}`);
+            if (methods.length === 0) {
+                support.reason = `Neither LXC nor Bubblewrap is available on this system (${bubblewrap.reason})`;
+            }
+        }
         if (methods.length > 0) {
             support.isSupported = true;
             support.availableMethods = methods;
         }
-        else {
-            support.reason = 'Neither LXC nor Bubblewrap is available on this system';
-        }
         return support;
     }
     if (platform !== 'win32') {
@@ -253,9 +198,6 @@ function computeSupport() {
     if (isWindowsSandboxAvailable()) {
         support.availableMethods.push('windows_sandbox');
     }
-    if (isIsoSessionSupported()) {
-        support.availableMethods.push('isolation_session');
-    }
     populateIsolationFromProbe(support);
     return support;
 }
@@ -272,16 +214,201 @@ function isLxcAvailable() {
     }
 }
 /**
- * Check if Bubblewrap (bwrap) is available on the system
+ * Minimum `bwrap` version the Bubblewrap backend supports, as
+ * `[major, minor, patch]`.
+ *
+ * This is the oldest release that has **every** flag the Rust argument builder
+ * emits. `--ro-bind-try` (deny-by-default baseline mounts) landed in bwrap
+ * 0.3.1 and `--clearenv` (minimal sandbox environment) in 0.5.0, so
+ * `--clearenv` sets the floor.
+ *
+ * Mirrors `MIN_BWRAP_VERSION` in
+ * `src/backends/bubblewrap/common/src/bwrap_version.rs` — keep both in sync.
+ */
+const MIN_BWRAP_VERSION = [0, 5, 0];
+/**
+ * Whether a `bwrap` candidate exists anywhere on `PATH`.
+ *
+ * Linux reports `ENOENT` both for a genuinely absent binary and for one that
+ * exists but cannot be executed (a missing ELF interpreter or script shebang
+ * target), so the spawn error alone cannot tell `notFound` from `failed`. A
+ * candidate on `PATH` means the package is installed and the failure is a
+ * broken install.
  */
-function isBubblewrapAvailable() {
+function bwrapExistsOnPath() {
+    const pathVar = process.env.PATH;
+    if (!pathVar)
+        return false;
+    return pathVar
+        .split(path.delimiter)
+        .some((dir) => dir !== '' && fs.existsSync(path.join(dir, 'bwrap')));
+}
+/**
+ * How long to wait for `bwrap --version` before giving up.
+ *
+ * `getPlatformSupport()` is synchronous, so without a bound a `bwrap` that
+ * hangs — a wrapper script on PATH, a binary on a stalled network mount —
+ * would block the caller indefinitely. Printing a version string is
+ * near-instant, so this is generous.
+ */
+const BWRAP_VERSION_TIMEOUT_MS = 5000;
+/**
+ * Default runner for `bwrap --version`. Uses `execFileSync` rather than a
+ * shell so a missing binary surfaces as `ENOENT` instead of the shell's
+ * indistinguishable exit code 127 — that separation is what lets us report
+ * "not installed" and "installed but broken" differently.
+ *
+ * Replaceable in unit tests via {@link _setBwrapVersionRunner}.
+ */
+function defaultBwrapVersionRunner() {
     try {
-        execSync('bwrap --version', { encoding: 'utf-8', stdio: 'pipe' });
-        return true;
+        return {
+            kind: 'output',
+            stdout: execFileSync('bwrap', ['--version'], {
+                encoding: 'utf-8',
+                stdio: 'pipe',
+                timeout: BWRAP_VERSION_TIMEOUT_MS,
+            }),
+        };
+    }
+    catch (err) {
+        const e = err;
+        // `ENOENT` covers both an absent binary and a present-but-unusable one
+        // (missing ELF interpreter / shebang target), so confirm the binary is
+        // really absent before blaming the package manager.
+        if (e.code === 'ENOENT' && !bwrapExistsOnPath()) {
+            return { kind: 'notFound' };
+        }
+        // Timed out: the child was killed, so there is no meaningful exit status.
+        if (e.code === 'ETIMEDOUT' || e.killed) {
+            return {
+                kind: 'failed',
+                status: null,
+                detail: `timed out after ${BWRAP_VERSION_TIMEOUT_MS}ms`,
+            };
+        }
+        return {
+            kind: 'failed',
+            status: e.status ?? null,
+            detail: e.stderr?.toString().trim() || e.message,
+        };
     }
-    catch {
-        return false;
+}
+let bwrapVersionRunner = defaultBwrapVersionRunner;
+/** @internal Test-only: override the `bwrap --version` runner. */
+export function _setBwrapVersionRunner(fn) {
+    bwrapVersionRunner = fn ?? defaultBwrapVersionRunner;
+}
+/**
+ * Parse the version out of a `bwrap --version` line such as
+ * `"bubblewrap 0.11.2"`.
+ *
+ * Anchored on the `bubblewrap` package name, which is what makes unrecognized
+ * output fail closed: without it any numeric token in arbitrary output (say
+ * `"some other tool 999"`) would be read as a version and clear the
+ * minimum-version gate.
+ *
+ * Lenient about what *surrounds* each number so distro-patched version strings
+ * (`0.4.1-1`, a bare `0.6`) still resolve: the version token is split on `.`
+ * and each of the (up to three) components contributes its leading digits.
+ * Debian's `+really` marker is honored rather than ignored — see below.
+ *
+ * Strict about components that are *present but not numeric*: only a component
+ * that is genuinely absent defaults to `0`, so `"0.6.invalid"` is rejected
+ * rather than silently read as `0.6.0`.
+ *
+ * @internal Exported for unit tests.
+ * @returns `[major, minor, patch]`, or `null` when the version cannot be determined.
+ */
+export function _parseBwrapVersion(output) {
+    // bwrap prints its PACKAGE_STRING, "bubblewrap <version>"; that leading name
+    // has been stable since 0.1.0.
+    const tokens = output.trim().split(/\s+/);
+    if (tokens[0]?.toLowerCase() !== 'bubblewrap' || !tokens[1])
+        return null;
+    // Debian's `+really` marker means the package ships the version that FOLLOWS
+    // it, so `0.5.0+really0.4.1` is really 0.4.1 — which predates `--clearenv`
+    // and must not clear the gate.
+    const marker = tokens[1].lastIndexOf('+really');
+    const token = marker === -1 ? tokens[1] : tokens[1].slice(marker + '+really'.length);
+    const components = [];
+    // Every component must be numeric, including ones past the patch: they are
+    // not significant, but `0.5.0.invalid` is an unrecognized banner rather than
+    // 0.5.0. Validating (rather than rejecting on count) keeps a distro
+    // four-part build such as `0.6.0.1` working.
+    for (const part of token.split('.')) {
+        const digits = /^\d+/.exec(part);
+        // Present but non-numeric: fail closed rather than guessing 0.
+        if (!digits)
+            return null;
+        const value = parseInt(digits[0], 10);
+        // Mirror the Rust parser's `u32`: a larger value is not something bwrap
+        // could print, and accepting it would let this gate admit a banner the
+        // backend's gate rejects.
+        if (value > 0xffffffff)
+            return null;
+        components.push(value);
+    }
+    // Only a genuinely absent component defaults to 0, so "0.6" is 0.6.0.
+    return [components[0], components[1] ?? 0, components[2] ?? 0];
+}
+/** Compare two `[major, minor, patch]` tuples lexicographically. */
+function compareVersions(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] - b[i];
     }
+    return 0;
+}
+/**
+ * Check whether Bubblewrap (bwrap) is installed *and* new enough.
+ *
+ * Presence on PATH is not sufficient: a `bwrap` older than
+ * {@link MIN_BWRAP_VERSION} would reject flags the backend always emits and
+ * fail at spawn time with an opaque "unknown option" error. Unparsable output
+ * fails closed — without a version we cannot assert the required flags exist.
+ *
+ * Mirrors `probe_bwrap` in
+ * `src/backends/bubblewrap/common/src/bwrap_version.rs`, including the
+ * distinction between a missing binary and a present-but-broken one.
+ *
+ * @internal Exported for unit tests.
+ */
+export function _probeBubblewrap() {
+    const minVersion = MIN_BWRAP_VERSION.join('.');
+    const result = bwrapVersionRunner();
+    if (result.kind === 'notFound') {
+        return {
+            available: false,
+            reason: `Bubblewrap (bwrap) is not installed or not on PATH; version ${minVersion} or newer is required`,
+        };
+    }
+    if (result.kind === 'failed') {
+        // Present but broken: do not send the user to their package manager for a
+        // package they already have.
+        // Covers both a spawn failure and termination by a signal, neither of
+        // which yields an exit code.
+        const where = result.status === null ? 'failed without an exit status' : `exited with status ${result.status}`;
+        const detail = result.detail ? `: ${result.detail}` : '';
+        return {
+            available: false,
+            reason: `Bubblewrap (bwrap) is present but \`bwrap --version\` ${where}${detail}; version ${minVersion} or newer is required`,
+        };
+    }
+    const version = _parseBwrapVersion(result.stdout);
+    if (!version) {
+        return {
+            available: false,
+            reason: `could not determine the Bubblewrap (bwrap) version from ${JSON.stringify(result.stdout.trim())}; version ${minVersion} or newer is required`,
+        };
+    }
+    if (compareVersions(version, MIN_BWRAP_VERSION) < 0) {
+        return {
+            available: false,
+            reason: `Bubblewrap (bwrap) ${version.join('.')} is too old; version ${minVersion} or newer is required`,
+        };
+    }
+    return { available: true };
 }
 /**
  * Check if the macOS sandbox is available. `/usr/bin/sandbox-exec` is part
@@ -352,7 +479,7 @@ export function findWxcExecutable() {
     }
     const pkgRoot = getSdkPackageRoot();
     const targetTriple = getRustTargetTriple();
-    const targetDir = path.join(pkgRoot, '..', 'src', 'target');
+    const targetDir = path.join(pkgRoot, '..', '..', 'src', 'target');
     const possiblePaths = [
         // Bundled in the SDK package (e.g. when installed via npm)
         path.join(pkgRoot, 'bin', getSdkArch(), 'wxc-exec.exe'),
@@ -419,7 +546,7 @@ export function findLxcExecutable() {
     }
     const pkgRoot = getSdkPackageRoot();
     const targetTriple = getLinuxRustTargetTriple();
-    const targetDir = path.join(pkgRoot, '..', 'src', 'target');
+    const targetDir = path.join(pkgRoot, '..', '..', 'src', 'target');
     const possiblePaths = [
         // Bundled in the SDK package
         path.join(pkgRoot, 'bin', getSdkArch(), 'lxc-exec'),
@@ -454,7 +581,7 @@ export function findSeatbeltExecutable() {
         }
     }
     const targetTriple = getDarwinRustTargetTriple();
-    const targetDir = path.join(__dirname, '..', '..', 'src', 'target');
+    const targetDir = path.join(__dirname, '..', '..', '..', 'src', 'target');
     const possiblePaths = [
         // Bundled in the SDK package
         path.join(__dirname, '..', 'bin', getSdkArch(), 'mxc-exec-mac'),