@orion-agents/orion-code 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +75 -3
- package/README.zh-CN.md +79 -4
- package/dist/commands/index.d.ts.map +1 -1
- package/dist/commands/index.js +168 -54
- package/dist/commands/index.js.map +1 -1
- package/dist/commands/types.d.ts +3 -1
- package/dist/commands/types.d.ts.map +1 -1
- package/dist/commands/types.js.map +1 -1
- package/dist/framework/query.d.ts +3 -0
- package/dist/framework/query.d.ts.map +1 -1
- package/dist/framework/query.js +1 -0
- package/dist/framework/query.js.map +1 -1
- package/dist/framework/tool-scheduler.d.ts +61 -1
- package/dist/framework/tool-scheduler.d.ts.map +1 -1
- package/dist/framework/tool-scheduler.js +165 -47
- package/dist/framework/tool-scheduler.js.map +1 -1
- package/dist/framework/tool.d.ts +6 -0
- package/dist/framework/tool.d.ts.map +1 -1
- package/dist/framework/tool.js +2 -0
- package/dist/framework/tool.js.map +1 -1
- package/dist/ink-ui/screens/ReplScreen.d.ts +2 -1
- package/dist/ink-ui/screens/ReplScreen.d.ts.map +1 -1
- package/dist/ink-ui/screens/ReplScreen.js +65 -0
- package/dist/ink-ui/screens/ReplScreen.js.map +1 -1
- package/dist/print-ui/launch.d.ts +2 -1
- package/dist/print-ui/launch.d.ts.map +1 -1
- package/dist/print-ui/launch.js +7 -0
- package/dist/print-ui/launch.js.map +1 -1
- package/dist/runtime/agent-runtime-controller.d.ts +1 -0
- package/dist/runtime/agent-runtime-controller.d.ts.map +1 -1
- package/dist/runtime/agent-runtime-controller.js +24 -3
- package/dist/runtime/agent-runtime-controller.js.map +1 -1
- package/dist/runtime/agent-runtime-protocol.d.ts +13 -1
- package/dist/runtime/agent-runtime-protocol.d.ts.map +1 -1
- package/dist/runtime/agent-runtime-protocol.js +6 -0
- package/dist/runtime/agent-runtime-protocol.js.map +1 -1
- package/dist/runtime/chat-controller.d.ts +6 -0
- package/dist/runtime/chat-controller.d.ts.map +1 -1
- package/dist/runtime/chat-controller.js +13 -0
- package/dist/runtime/chat-controller.js.map +1 -1
- package/dist/runtime/goals/tools.d.ts.map +1 -1
- package/dist/runtime/goals/tools.js +14 -14
- package/dist/runtime/goals/tools.js.map +1 -1
- package/dist/runtime/goals/types.d.ts +6 -0
- package/dist/runtime/goals/types.d.ts.map +1 -1
- package/dist/runtime/goals/types.js.map +1 -1
- package/dist/runtime/turn-controller.d.ts.map +1 -1
- package/dist/runtime/turn-controller.js +3 -1
- package/dist/runtime/turn-controller.js.map +1 -1
- package/dist/runtime/ui-events.d.ts +17 -0
- package/dist/runtime/ui-events.d.ts.map +1 -1
- package/dist/runtime/ui-events.js.map +1 -1
- package/dist/services/config.d.ts.map +1 -1
- package/dist/services/config.js +2 -1
- package/dist/services/config.js.map +1 -1
- package/dist/services/global-config.d.ts +31 -0
- package/dist/services/global-config.d.ts.map +1 -1
- package/dist/services/global-config.js.map +1 -1
- package/dist/services/model-catalog.d.ts +2 -0
- package/dist/services/model-catalog.d.ts.map +1 -1
- package/dist/services/model-catalog.js +25 -15
- package/dist/services/model-catalog.js.map +1 -1
- package/dist/services/model-context.d.ts.map +1 -1
- package/dist/services/model-context.js +36 -0
- package/dist/services/model-context.js.map +1 -1
- package/dist/services/model-registry.d.ts.map +1 -1
- package/dist/services/model-registry.js +32 -0
- package/dist/services/model-registry.js.map +1 -1
- package/dist/services/tool-allowlist.d.ts +100 -0
- package/dist/services/tool-allowlist.d.ts.map +1 -0
- package/dist/services/tool-allowlist.js +250 -0
- package/dist/services/tool-allowlist.js.map +1 -0
- package/dist/terminal-ui/launch.d.ts +22 -2
- package/dist/terminal-ui/launch.d.ts.map +1 -1
- package/dist/terminal-ui/launch.js +145 -1
- package/dist/terminal-ui/launch.js.map +1 -1
- package/dist/tools/git.d.ts +4 -0
- package/dist/tools/git.d.ts.map +1 -1
- package/dist/tools/git.js +310 -3
- package/dist/tools/git.js.map +1 -1
- package/dist/tools/index.d.ts.map +1 -1
- package/dist/tools/index.js +56 -7
- package/dist/tools/index.js.map +1 -1
- package/dist/tools/sandbox.d.ts +139 -0
- package/dist/tools/sandbox.d.ts.map +1 -0
- package/dist/tools/sandbox.js +485 -0
- package/dist/tools/sandbox.js.map +1 -0
- package/dist/tools/web.d.ts.map +1 -1
- package/dist/tools/web.js +113 -42
- package/dist/tools/web.js.map +1 -1
- package/dist/tui-ui/launch.d.ts.map +1 -1
- package/dist/tui-ui/launch.js +46 -8
- package/dist/tui-ui/launch.js.map +1 -1
- package/dist/tui-ui/layout.d.ts.map +1 -1
- package/dist/tui-ui/layout.js +62 -0
- package/dist/tui-ui/layout.js.map +1 -1
- package/dist/tui-ui/runner.d.ts +6 -0
- package/dist/tui-ui/runner.d.ts.map +1 -1
- package/dist/tui-ui/runner.js +81 -1
- package/dist/tui-ui/runner.js.map +1 -1
- package/dist/tui-ui/state.d.ts +19 -1
- package/dist/tui-ui/state.d.ts.map +1 -1
- package/dist/tui-ui/state.js +35 -7
- package/dist/tui-ui/state.js.map +1 -1
- package/dist/tui-ui/terminal-image.d.ts +3 -13
- package/dist/tui-ui/terminal-image.d.ts.map +1 -1
- package/dist/tui-ui/terminal-image.js +5 -160
- package/dist/tui-ui/terminal-image.js.map +1 -1
- package/dist/utils/mask.d.ts +28 -0
- package/dist/utils/mask.d.ts.map +1 -0
- package/dist/utils/mask.js +54 -0
- package/dist/utils/mask.js.map +1 -0
- package/package.json +2 -1
|
@@ -0,0 +1,485 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Orion Code - OS-level sandbox planning for shell command execution.
|
|
4
|
+
*
|
|
5
|
+
* Contract (v0.1.3-2 §1.2 / P1-B / P1-E)
|
|
6
|
+
* ======================================
|
|
7
|
+
*
|
|
8
|
+
* Why this module exists
|
|
9
|
+
* ----------------------
|
|
10
|
+
* `bash_security.wrapForSandbox()` built a *shell string* (`docker exec ... sh -c
|
|
11
|
+
* '<cmd>'`). That is unsafe to claim as isolation: every layer re-parses the
|
|
12
|
+
* command, so quoting bugs become escapes. This module instead produces an
|
|
13
|
+
* **argv array** that is handed straight to `spawn()`, so the user command is a
|
|
14
|
+
* single opaque argument that no intermediate shell re-parses.
|
|
15
|
+
*
|
|
16
|
+
* Profiles (what the user asks for) vs backends (how we deliver it)
|
|
17
|
+
* ----------------------------------------------------------------
|
|
18
|
+
* profile none -> run exactly as before (no wrapper at all)
|
|
19
|
+
* profile read-only -> no filesystem writes anywhere, no network
|
|
20
|
+
* profile workspace-write -> writes confined to the workspace roots + temp,
|
|
21
|
+
* no network unless explicitly allowed
|
|
22
|
+
*
|
|
23
|
+
* backend seatbelt -> macOS `sandbox-exec` with a generated SBPL policy
|
|
24
|
+
* backend bubblewrap -> Linux `bwrap` with read-only binds
|
|
25
|
+
* backend docker -> `docker run --rm` into a configured image
|
|
26
|
+
*
|
|
27
|
+
* Availability must be PROBED, never inferred
|
|
28
|
+
* -------------------------------------------
|
|
29
|
+
* `which sandbox-exec` succeeding proves nothing: when Orion itself runs inside
|
|
30
|
+
* an application sandbox, every nested `sandbox_apply` fails with
|
|
31
|
+
* `Operation not permitted` (exit 71) even for a trivial `(allow default)`
|
|
32
|
+
* policy. Likewise `docker` on PATH says nothing about the daemon. So each
|
|
33
|
+
* backend is validated with a real, cheap execution probe whose result is
|
|
34
|
+
* cached for the process lifetime.
|
|
35
|
+
*
|
|
36
|
+
* Fail closed
|
|
37
|
+
* -----------
|
|
38
|
+
* If a profile other than `none` is requested and no backend passes its probe,
|
|
39
|
+
* {@link planSandboxedCommand} returns a failure. Callers must refuse to run the
|
|
40
|
+
* command. Falling back to an unsandboxed execution would turn a security
|
|
41
|
+
* setting into a silent no-op, which is the exact failure mode this module
|
|
42
|
+
* exists to prevent. An unrecognised profile value (e.g. written by a newer
|
|
43
|
+
* Orion) is also a failure rather than a downgrade to `none`.
|
|
44
|
+
*
|
|
45
|
+
* Configuration ownership (P1-E)
|
|
46
|
+
* ------------------------------
|
|
47
|
+
* GlobalConfig.sandbox user-wide default
|
|
48
|
+
* ProjectConfig.sandbox per-project override, shallow-merged on top
|
|
49
|
+
*
|
|
50
|
+
* Default is `{ profile: 'none' }`, so configs written before this module
|
|
51
|
+
* existed keep their exact previous behaviour. Nothing here is secret, so no
|
|
52
|
+
* redaction is required; rolling back is "delete the `sandbox` key", and an
|
|
53
|
+
* older Orion simply ignores the unknown field.
|
|
54
|
+
*
|
|
55
|
+
* Known limitations (recorded, not hidden)
|
|
56
|
+
* ----------------------------------------
|
|
57
|
+
* - seatbelt cannot be applied from inside another sandbox (see above);
|
|
58
|
+
* - `docker` runs the command in a *different* process tree, so Orion's
|
|
59
|
+
* process-group SIGTERM/SIGKILL only reaches the client. `--rm` bounds the
|
|
60
|
+
* leak, but abort semantics are weaker than the in-process backends;
|
|
61
|
+
* - none of the backends attempt to constrain CPU/memory.
|
|
62
|
+
*/
|
|
63
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
64
|
+
if (k2 === undefined) k2 = k;
|
|
65
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
66
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
67
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
68
|
+
}
|
|
69
|
+
Object.defineProperty(o, k2, desc);
|
|
70
|
+
}) : (function(o, m, k, k2) {
|
|
71
|
+
if (k2 === undefined) k2 = k;
|
|
72
|
+
o[k2] = m[k];
|
|
73
|
+
}));
|
|
74
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
75
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
76
|
+
}) : function(o, v) {
|
|
77
|
+
o["default"] = v;
|
|
78
|
+
});
|
|
79
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
80
|
+
var ownKeys = function(o) {
|
|
81
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
82
|
+
var ar = [];
|
|
83
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
84
|
+
return ar;
|
|
85
|
+
};
|
|
86
|
+
return ownKeys(o);
|
|
87
|
+
};
|
|
88
|
+
return function (mod) {
|
|
89
|
+
if (mod && mod.__esModule) return mod;
|
|
90
|
+
var result = {};
|
|
91
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
92
|
+
__setModuleDefault(result, mod);
|
|
93
|
+
return result;
|
|
94
|
+
};
|
|
95
|
+
})();
|
|
96
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
97
|
+
exports.SANDBOX_BACKENDS = exports.SANDBOX_PROFILES = void 0;
|
|
98
|
+
exports.mergeSandboxConfig = mergeSandboxConfig;
|
|
99
|
+
exports.resolveSandboxSettings = resolveSandboxSettings;
|
|
100
|
+
exports.resetSandboxCapabilityCache = resetSandboxCapabilityCache;
|
|
101
|
+
exports.detectSandboxCapabilities = detectSandboxCapabilities;
|
|
102
|
+
exports.formatSandboxCapabilities = formatSandboxCapabilities;
|
|
103
|
+
exports.buildSeatbeltPolicy = buildSeatbeltPolicy;
|
|
104
|
+
exports.planSandboxedCommand = planSandboxedCommand;
|
|
105
|
+
exports.describeSandboxPlan = describeSandboxPlan;
|
|
106
|
+
const child_process_1 = require("child_process");
|
|
107
|
+
const fs = __importStar(require("fs"));
|
|
108
|
+
const os = __importStar(require("os"));
|
|
109
|
+
const path = __importStar(require("path"));
|
|
110
|
+
const global_config_1 = require("../services/global-config");
|
|
111
|
+
exports.SANDBOX_PROFILES = [
|
|
112
|
+
'none',
|
|
113
|
+
'read-only',
|
|
114
|
+
'workspace-write',
|
|
115
|
+
];
|
|
116
|
+
exports.SANDBOX_BACKENDS = ['seatbelt', 'bubblewrap', 'docker'];
|
|
117
|
+
// ============================================================================
|
|
118
|
+
// Settings resolution
|
|
119
|
+
// ============================================================================
|
|
120
|
+
/** Shell used inside every backend. Kept explicit so policies can reference it. */
|
|
121
|
+
const INNER_SHELL = '/bin/sh';
|
|
122
|
+
function isSandboxProfile(value) {
|
|
123
|
+
return typeof value === 'string' && exports.SANDBOX_PROFILES.includes(value);
|
|
124
|
+
}
|
|
125
|
+
function sanitizeRoots(roots) {
|
|
126
|
+
if (!Array.isArray(roots))
|
|
127
|
+
return undefined;
|
|
128
|
+
const out = roots.filter((r) => typeof r === 'string' && r.trim().length > 0);
|
|
129
|
+
return out.length > 0 ? out : undefined;
|
|
130
|
+
}
|
|
131
|
+
/**
|
|
132
|
+
* Merge global and project sandbox settings.
|
|
133
|
+
* Project keys win individually; absent keys inherit the global value.
|
|
134
|
+
*/
|
|
135
|
+
function mergeSandboxConfig(global, project) {
|
|
136
|
+
return {
|
|
137
|
+
profile: project?.profile ?? global?.profile,
|
|
138
|
+
backend: project?.backend ?? global?.backend,
|
|
139
|
+
allowNetwork: project?.allowNetwork ?? global?.allowNetwork,
|
|
140
|
+
writableRoots: sanitizeRoots(project?.writableRoots) ?? sanitizeRoots(global?.writableRoots),
|
|
141
|
+
image: project?.image ?? global?.image,
|
|
142
|
+
};
|
|
143
|
+
}
|
|
144
|
+
/** Read the effective settings for a project path. Never throws. */
|
|
145
|
+
function resolveSandboxSettings(projectPath) {
|
|
146
|
+
let global;
|
|
147
|
+
let project;
|
|
148
|
+
try {
|
|
149
|
+
global = (0, global_config_1.loadGlobalConfig)().sandbox;
|
|
150
|
+
}
|
|
151
|
+
catch {
|
|
152
|
+
global = undefined;
|
|
153
|
+
}
|
|
154
|
+
try {
|
|
155
|
+
project = (0, global_config_1.getProjectConfig)(projectPath).sandbox;
|
|
156
|
+
}
|
|
157
|
+
catch {
|
|
158
|
+
project = undefined;
|
|
159
|
+
}
|
|
160
|
+
return mergeSandboxConfig(global, project);
|
|
161
|
+
}
|
|
162
|
+
// ============================================================================
|
|
163
|
+
// Capability probing
|
|
164
|
+
// ============================================================================
|
|
165
|
+
let capabilityCache;
|
|
166
|
+
/** Drop the cached probe result. Test-only; capabilities do not change at runtime. */
|
|
167
|
+
function resetSandboxCapabilityCache() {
|
|
168
|
+
capabilityCache = undefined;
|
|
169
|
+
}
|
|
170
|
+
function probe(file, args, timeoutMs = 5000) {
|
|
171
|
+
try {
|
|
172
|
+
const res = (0, child_process_1.spawnSync)(file, args, { timeout: timeoutMs, encoding: 'utf8' });
|
|
173
|
+
if (res.error)
|
|
174
|
+
return { ok: false, detail: res.error.message };
|
|
175
|
+
if (res.status !== 0) {
|
|
176
|
+
const stderr = (res.stderr || '').trim().split('\n')[0];
|
|
177
|
+
return { ok: false, detail: stderr || `exit ${res.status}` };
|
|
178
|
+
}
|
|
179
|
+
return { ok: true, detail: (res.stdout || '').trim().split('\n')[0] || undefined };
|
|
180
|
+
}
|
|
181
|
+
catch (err) {
|
|
182
|
+
return { ok: false, detail: err instanceof Error ? err.message : String(err) };
|
|
183
|
+
}
|
|
184
|
+
}
|
|
185
|
+
function probeSeatbelt(platform) {
|
|
186
|
+
if (platform !== 'darwin') {
|
|
187
|
+
return { backend: 'seatbelt', available: false, reason: 'seatbelt requires macOS' };
|
|
188
|
+
}
|
|
189
|
+
// A trivial policy is enough: if `sandbox_apply` is refused (e.g. Orion is
|
|
190
|
+
// itself running inside an app sandbox) it fails here too.
|
|
191
|
+
const res = probe('/usr/bin/sandbox-exec', [
|
|
192
|
+
'-p',
|
|
193
|
+
'(version 1)(allow default)',
|
|
194
|
+
'/usr/bin/true',
|
|
195
|
+
]);
|
|
196
|
+
if (!res.ok) {
|
|
197
|
+
return {
|
|
198
|
+
backend: 'seatbelt',
|
|
199
|
+
available: false,
|
|
200
|
+
reason: `sandbox-exec probe failed: ${res.detail ?? 'unknown error'}`,
|
|
201
|
+
};
|
|
202
|
+
}
|
|
203
|
+
return { backend: 'seatbelt', available: true, detail: '/usr/bin/sandbox-exec' };
|
|
204
|
+
}
|
|
205
|
+
function probeBubblewrap(platform) {
|
|
206
|
+
if (platform !== 'linux') {
|
|
207
|
+
return { backend: 'bubblewrap', available: false, reason: 'bubblewrap requires Linux' };
|
|
208
|
+
}
|
|
209
|
+
const res = probe('bwrap', ['--version']);
|
|
210
|
+
if (!res.ok) {
|
|
211
|
+
return {
|
|
212
|
+
backend: 'bubblewrap',
|
|
213
|
+
available: false,
|
|
214
|
+
reason: `bwrap unavailable: ${res.detail ?? 'not found'}`,
|
|
215
|
+
};
|
|
216
|
+
}
|
|
217
|
+
return { backend: 'bubblewrap', available: true, detail: res.detail };
|
|
218
|
+
}
|
|
219
|
+
function probeDocker() {
|
|
220
|
+
// `docker` on PATH says nothing about the daemon, so query the daemon.
|
|
221
|
+
const res = probe('docker', ['info', '--format', '{{.ServerVersion}}'], 8000);
|
|
222
|
+
if (!res.ok) {
|
|
223
|
+
return {
|
|
224
|
+
backend: 'docker',
|
|
225
|
+
available: false,
|
|
226
|
+
reason: `docker daemon unreachable: ${res.detail ?? 'not found'}`,
|
|
227
|
+
};
|
|
228
|
+
}
|
|
229
|
+
return { backend: 'docker', available: true, detail: `server ${res.detail ?? 'unknown'}` };
|
|
230
|
+
}
|
|
231
|
+
/** Probe every backend once and cache the matrix for this process. */
|
|
232
|
+
function detectSandboxCapabilities(force = false) {
|
|
233
|
+
if (capabilityCache && !force)
|
|
234
|
+
return capabilityCache;
|
|
235
|
+
const platform = process.platform;
|
|
236
|
+
const backends = [probeSeatbelt(platform), probeBubblewrap(platform), probeDocker()];
|
|
237
|
+
capabilityCache = {
|
|
238
|
+
platform,
|
|
239
|
+
backends,
|
|
240
|
+
preferred: backends.find(b => b.available)?.backend,
|
|
241
|
+
};
|
|
242
|
+
return capabilityCache;
|
|
243
|
+
}
|
|
244
|
+
/** Render the capability matrix for `/config` and diagnostics. */
|
|
245
|
+
function formatSandboxCapabilities(caps) {
|
|
246
|
+
return caps.backends.map(b => b.available
|
|
247
|
+
? `${b.backend}: available${b.detail ? ` (${b.detail})` : ''}`
|
|
248
|
+
: `${b.backend}: unavailable${b.reason ? ` (${b.reason})` : ''}`);
|
|
249
|
+
}
|
|
250
|
+
// ============================================================================
|
|
251
|
+
// Policy generation
|
|
252
|
+
// ============================================================================
|
|
253
|
+
/** Resolve symlinks so a policy cannot be sidestepped via an aliased path. */
|
|
254
|
+
function realpathOrSelf(p) {
|
|
255
|
+
try {
|
|
256
|
+
return fs.realpathSync(p);
|
|
257
|
+
}
|
|
258
|
+
catch {
|
|
259
|
+
return path.resolve(p);
|
|
260
|
+
}
|
|
261
|
+
}
|
|
262
|
+
function uniquePaths(paths) {
|
|
263
|
+
const seen = new Set();
|
|
264
|
+
const out = [];
|
|
265
|
+
for (const p of paths) {
|
|
266
|
+
if (!p)
|
|
267
|
+
continue;
|
|
268
|
+
const resolved = realpathOrSelf(p);
|
|
269
|
+
if (seen.has(resolved))
|
|
270
|
+
continue;
|
|
271
|
+
seen.add(resolved);
|
|
272
|
+
out.push(resolved);
|
|
273
|
+
}
|
|
274
|
+
return out;
|
|
275
|
+
}
|
|
276
|
+
/** Escape a path for an SBPL string literal. */
|
|
277
|
+
function sbplString(value) {
|
|
278
|
+
return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
|
|
279
|
+
}
|
|
280
|
+
/**
|
|
281
|
+
* Build the seatbelt policy.
|
|
282
|
+
*
|
|
283
|
+
* Uses `(allow default)` plus targeted denies rather than `(deny default)` plus
|
|
284
|
+
* an allow-list: a deny-by-default policy has to enumerate every syscall a
|
|
285
|
+
* developer toolchain needs, and each omission looks like a mysterious crash
|
|
286
|
+
* rather than a security decision.
|
|
287
|
+
*/
|
|
288
|
+
function buildSeatbeltPolicy(writableRoots, allowNetwork) {
|
|
289
|
+
const lines = ['(version 1)', '(allow default)', '(deny file-write*)'];
|
|
290
|
+
for (const root of writableRoots) {
|
|
291
|
+
lines.push(`(allow file-write* (subpath ${sbplString(root)}))`);
|
|
292
|
+
}
|
|
293
|
+
// Writing to the standard character devices is not a filesystem escape and is
|
|
294
|
+
// required for ordinary shell redirection to keep working.
|
|
295
|
+
lines.push('(allow file-write-data (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (literal "/dev/tty") (literal "/dev/dtracehelper"))');
|
|
296
|
+
lines.push(allowNetwork ? '(allow network*)' : '(deny network*)');
|
|
297
|
+
return lines.join('\n');
|
|
298
|
+
}
|
|
299
|
+
// ============================================================================
|
|
300
|
+
// Planning
|
|
301
|
+
// ============================================================================
|
|
302
|
+
/**
|
|
303
|
+
* Extra requirements a backend has beyond "the probe passed".
|
|
304
|
+
* Returns the blocking reason, or undefined when the backend is usable as-is.
|
|
305
|
+
*/
|
|
306
|
+
function missingRequirement(backend, settings) {
|
|
307
|
+
if (backend === 'docker' && !settings.image?.trim()) {
|
|
308
|
+
return 'the docker sandbox backend requires `sandbox.image` to be configured';
|
|
309
|
+
}
|
|
310
|
+
return undefined;
|
|
311
|
+
}
|
|
312
|
+
function selectBackend(settings, caps) {
|
|
313
|
+
const requested = settings.backend;
|
|
314
|
+
if (requested && requested !== 'auto') {
|
|
315
|
+
const status = caps.backends.find(b => b.backend === requested);
|
|
316
|
+
if (!status) {
|
|
317
|
+
return { reason: `unknown sandbox backend "${requested}"` };
|
|
318
|
+
}
|
|
319
|
+
if (!status.available) {
|
|
320
|
+
return { reason: status.reason ?? `sandbox backend "${requested}" is unavailable` };
|
|
321
|
+
}
|
|
322
|
+
// An explicit choice reports its own configuration gap verbatim.
|
|
323
|
+
const missing = missingRequirement(requested, settings);
|
|
324
|
+
return missing ? { reason: missing } : { backend: requested };
|
|
325
|
+
}
|
|
326
|
+
// Auto-selection must skip backends that are installed but not yet usable,
|
|
327
|
+
// otherwise a host with an idle Docker daemon would report "image missing"
|
|
328
|
+
// and hide the real reason the preferred backend was unavailable.
|
|
329
|
+
for (const status of caps.backends) {
|
|
330
|
+
if (!status.available)
|
|
331
|
+
continue;
|
|
332
|
+
if (!missingRequirement(status.backend, settings))
|
|
333
|
+
return { backend: status.backend };
|
|
334
|
+
}
|
|
335
|
+
const detail = caps.backends
|
|
336
|
+
.map(b => {
|
|
337
|
+
if (!b.available)
|
|
338
|
+
return `${b.backend} (${b.reason ?? 'unavailable'})`;
|
|
339
|
+
return `${b.backend} (${missingRequirement(b.backend, settings)})`;
|
|
340
|
+
})
|
|
341
|
+
.join('; ');
|
|
342
|
+
return { reason: `no sandbox backend is available on ${caps.platform}: ${detail}` };
|
|
343
|
+
}
|
|
344
|
+
function plainPlan(command) {
|
|
345
|
+
return {
|
|
346
|
+
ok: true,
|
|
347
|
+
profile: 'none',
|
|
348
|
+
backend: 'none',
|
|
349
|
+
file: 'sh',
|
|
350
|
+
args: ['-c', command],
|
|
351
|
+
network: 'allowed',
|
|
352
|
+
writableRoots: [],
|
|
353
|
+
};
|
|
354
|
+
}
|
|
355
|
+
/**
|
|
356
|
+
* Turn a shell command into a spawnable argv under the configured profile.
|
|
357
|
+
*
|
|
358
|
+
* The returned `args` always end with the untouched user command as one
|
|
359
|
+
* element, so no intermediate shell re-parses it.
|
|
360
|
+
*/
|
|
361
|
+
function planSandboxedCommand(command, options) {
|
|
362
|
+
const settings = options.settings ?? {};
|
|
363
|
+
const rawProfile = settings.profile ?? 'none';
|
|
364
|
+
if (!isSandboxProfile(rawProfile)) {
|
|
365
|
+
// Do not silently downgrade: an unknown value most likely comes from a
|
|
366
|
+
// newer Orion that meant something stricter than `none`.
|
|
367
|
+
return {
|
|
368
|
+
ok: false,
|
|
369
|
+
profile: String(rawProfile),
|
|
370
|
+
reason: `unknown sandbox profile "${String(rawProfile)}"; expected one of ${exports.SANDBOX_PROFILES.join(', ')}`,
|
|
371
|
+
capabilities: options.capabilities ?? detectSandboxCapabilities(),
|
|
372
|
+
};
|
|
373
|
+
}
|
|
374
|
+
if (rawProfile === 'none')
|
|
375
|
+
return plainPlan(command);
|
|
376
|
+
const caps = options.capabilities ?? detectSandboxCapabilities();
|
|
377
|
+
const selected = selectBackend(settings, caps);
|
|
378
|
+
if (!selected.backend) {
|
|
379
|
+
return {
|
|
380
|
+
ok: false,
|
|
381
|
+
profile: rawProfile,
|
|
382
|
+
reason: selected.reason ?? 'no sandbox backend available',
|
|
383
|
+
capabilities: caps,
|
|
384
|
+
};
|
|
385
|
+
}
|
|
386
|
+
const allowNetwork = settings.allowNetwork === true;
|
|
387
|
+
const writableRoots = rawProfile === 'workspace-write'
|
|
388
|
+
? uniquePaths([options.cwd, os.tmpdir(), ...(settings.writableRoots ?? [])])
|
|
389
|
+
: [];
|
|
390
|
+
if (selected.backend === 'seatbelt') {
|
|
391
|
+
const policy = buildSeatbeltPolicy(writableRoots, allowNetwork);
|
|
392
|
+
return {
|
|
393
|
+
ok: true,
|
|
394
|
+
profile: rawProfile,
|
|
395
|
+
backend: 'seatbelt',
|
|
396
|
+
file: '/usr/bin/sandbox-exec',
|
|
397
|
+
args: ['-p', policy, INNER_SHELL, '-c', command],
|
|
398
|
+
network: allowNetwork ? 'allowed' : 'blocked',
|
|
399
|
+
writableRoots,
|
|
400
|
+
policy,
|
|
401
|
+
};
|
|
402
|
+
}
|
|
403
|
+
if (selected.backend === 'bubblewrap') {
|
|
404
|
+
const args = ['--die-with-parent', '--proc', '/proc', '--dev', '/dev'];
|
|
405
|
+
if (!allowNetwork)
|
|
406
|
+
args.push('--unshare-net');
|
|
407
|
+
for (const ro of ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc', '/opt']) {
|
|
408
|
+
if (fs.existsSync(ro))
|
|
409
|
+
args.push('--ro-bind', ro, ro);
|
|
410
|
+
}
|
|
411
|
+
// Read-only view of the workspace, upgraded to read-write only when the
|
|
412
|
+
// profile asks for it.
|
|
413
|
+
const workspace = realpathOrSelf(options.cwd);
|
|
414
|
+
args.push(writableRoots.length > 0 ? '--bind' : '--ro-bind', workspace, workspace);
|
|
415
|
+
for (const root of writableRoots) {
|
|
416
|
+
if (root === workspace)
|
|
417
|
+
continue;
|
|
418
|
+
args.push('--bind', root, root);
|
|
419
|
+
}
|
|
420
|
+
args.push('--chdir', workspace, INNER_SHELL, '-c', command);
|
|
421
|
+
return {
|
|
422
|
+
ok: true,
|
|
423
|
+
profile: rawProfile,
|
|
424
|
+
backend: 'bubblewrap',
|
|
425
|
+
file: 'bwrap',
|
|
426
|
+
args,
|
|
427
|
+
network: allowNetwork ? 'allowed' : 'blocked',
|
|
428
|
+
writableRoots,
|
|
429
|
+
};
|
|
430
|
+
}
|
|
431
|
+
// docker
|
|
432
|
+
const image = settings.image?.trim();
|
|
433
|
+
if (!image) {
|
|
434
|
+
return {
|
|
435
|
+
ok: false,
|
|
436
|
+
profile: rawProfile,
|
|
437
|
+
reason: 'the docker sandbox backend requires `sandbox.image` to be configured',
|
|
438
|
+
capabilities: caps,
|
|
439
|
+
};
|
|
440
|
+
}
|
|
441
|
+
// Docker runs in a separate VM (Docker Desktop on macOS). The host path we
|
|
442
|
+
// pass to `-v` must be in the form Docker Desktop actually shares; resolving
|
|
443
|
+
// symlinks (e.g. macOS `/var` -> `/private/var`) points at a path Docker
|
|
444
|
+
// Desktop does not map, so the bind mount silently creates an empty
|
|
445
|
+
// directory and writes land somewhere the caller cannot see. We therefore
|
|
446
|
+
// mount `options.cwd` exactly as supplied. Per-directory write confinement
|
|
447
|
+
// for docker comes from `--read-only` (immutable image rootfs) plus the
|
|
448
|
+
// explicit rw bind mounts below — not from path-text matching.
|
|
449
|
+
const workspace = options.cwd;
|
|
450
|
+
const args = ['run', '--rm', '-i', '--read-only'];
|
|
451
|
+
if (!allowNetwork)
|
|
452
|
+
args.push('--network', 'none');
|
|
453
|
+
if (writableRoots.length > 0) {
|
|
454
|
+
args.push('-v', `${workspace}:${workspace}:rw`);
|
|
455
|
+
const seen = new Set([workspace]);
|
|
456
|
+
// Raw (non-realpathed) extra roots so Docker Desktop can resolve them.
|
|
457
|
+
for (const raw of [os.tmpdir(), ...(settings.writableRoots ?? [])]) {
|
|
458
|
+
if (!raw || seen.has(raw))
|
|
459
|
+
continue;
|
|
460
|
+
seen.add(raw);
|
|
461
|
+
args.push('-v', `${raw}:${raw}:rw`);
|
|
462
|
+
}
|
|
463
|
+
}
|
|
464
|
+
else {
|
|
465
|
+
args.push('-v', `${workspace}:${workspace}:ro`);
|
|
466
|
+
}
|
|
467
|
+
args.push('-w', workspace, image, INNER_SHELL, '-c', command);
|
|
468
|
+
return {
|
|
469
|
+
ok: true,
|
|
470
|
+
profile: rawProfile,
|
|
471
|
+
backend: 'docker',
|
|
472
|
+
file: 'docker',
|
|
473
|
+
args,
|
|
474
|
+
network: allowNetwork ? 'allowed' : 'blocked',
|
|
475
|
+
writableRoots,
|
|
476
|
+
};
|
|
477
|
+
}
|
|
478
|
+
/** One-line audit description of an active plan. */
|
|
479
|
+
function describeSandboxPlan(plan) {
|
|
480
|
+
if (plan.backend === 'none')
|
|
481
|
+
return 'sandbox: none';
|
|
482
|
+
const roots = plan.writableRoots.length > 0 ? plan.writableRoots.join(', ') : '(none)';
|
|
483
|
+
return `sandbox: ${plan.profile} via ${plan.backend}, network ${plan.network}, writable ${roots}`;
|
|
484
|
+
}
|
|
485
|
+
//# sourceMappingURL=sandbox.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/tools/sandbox.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+FH,gDAWC;AAGD,wDAcC;AASD,kEAEC;AAkED,8DAUC;AAGD,8DAMC;AAyCD,kDAYC;AA0ED,oDAwHC;AAGD,kDAIC;AAvdD,iDAA0C;AAC1C,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,6DAA+E;AAWlE,QAAA,gBAAgB,GAA8B;IACzD,MAAM;IACN,WAAW;IACX,iBAAiB;CAClB,CAAC;AAEW,QAAA,gBAAgB,GAA8B,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAkDhG,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,mFAAmF;AACnF,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,MAAiC,EACjC,OAAkC;IAElC,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO;QAC5C,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,MAAM,EAAE,YAAY;QAC3D,aAAa,EAAE,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC;QAC5F,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK;KACvC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,IAAI,MAAiC,CAAC;IACtC,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,gCAAgB,GAAE,CAAC,OAAO,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,gCAAgB,EAAC,WAAW,CAAC,CAAC,OAAO,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,IAAI,eAAgD,CAAC;AAErD,sFAAsF;AACtF,SAAgB,2BAA2B;IACzC,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,IAAI;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACtF,CAAC;IACD,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,uBAAuB,EAAE;QACzC,IAAI;QACJ,4BAA4B;QAC5B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,IAAI,eAAe,EAAE;SACtE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,QAAyB;IAChD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,sBAAsB,GAAG,CAAC,MAAM,IAAI,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,WAAW;IAClB,uEAAuE;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,IAAI,WAAW,EAAE;SAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED,sEAAsE;AACtE,SAAgB,yBAAyB,CAAC,KAAK,GAAG,KAAK;IACrD,IAAI,eAAe,IAAI,CAAC,KAAK;QAAE,OAAO,eAAe,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACrF,eAAe,GAAG;QAChB,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO;KACpD,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,kEAAkE;AAClE,SAAgB,yBAAyB,CAAC,IAAyB;IACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3B,CAAC,CAAC,SAAS;QACT,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,8EAA8E;AAC9E,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gDAAgD;AAChD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,aAAuB,EAAE,YAAqB;IAChF,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,8EAA8E;IAC9E,2DAA2D;IAC3D,KAAK,CAAC,IAAI,CACR,kJAAkJ,CACnJ,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,OAAuB,EACvB,QAAuB;IAEvB,IAAI,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,QAAuB,EACvB,IAAyB;IAEzB,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC;IAEnC,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,4BAA4B,SAAS,GAAG,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,oBAAoB,SAAS,kBAAkB,EAAE,CAAC;QACtF,CAAC;QACD,iEAAiE;QACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,SAAS;QAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE;QACP,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,aAAa,GAAG,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC;IACrE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,sCAAsC,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;QACrB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,OAAe,EACf,OAA2B;IAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC;IAE9C,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,uEAAuE;QACvE,yDAAyD;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;YAC3B,MAAM,EAAE,4BAA4B,MAAM,CAAC,UAAU,CAAC,sBAAsB,wBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzG,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAErD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,8BAA8B;YACzD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,aAAa,GACjB,UAAU,KAAK,iBAAiB;QAC9B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC;YAChD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC7C,aAAa;YACb,MAAM;SACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,GAAa,CAAC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,wEAAwE;QACxE,uBAAuB;QACvB,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,OAAO;YACb,IAAI;YACJ,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC7C,aAAa;SACd,CAAC;IACJ,CAAC;IAED,SAAS;IACT,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,sEAAsE;YAC9E,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,uEAAuE;QACvE,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC7C,aAAa;KACd,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAgB,mBAAmB,CAAC,IAAwB;IAC1D,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,OAAO,YAAY,IAAI,CAAC,OAAO,QAAQ,IAAI,CAAC,OAAO,aAAa,IAAI,CAAC,OAAO,cAAc,KAAK,EAAE,CAAC;AACpG,CAAC"}
|
package/dist/tools/web.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/tools/web.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/tools/web.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAsDlE;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA+DzE;AAoED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AA+Q5B,sDAAsD;AACtD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AA0BD,eAAO,MAAM,YAAY,EAAE,aA4GzB,CAAC;AAkCH,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,eAAO,MAAM,aAAa,EAAE,aAkI1B,CAAC;AAMH,eAAO,MAAM,SAAS,EAAE,aAAa,EAAkC,CAAC"}
|