@phuetz/code-buddy 1.6.1 → 2.1.0

package/dist/security/bash-allowlist/allowlist-store.js

@@ -15,6 +15,15 @@ import { logger } from '../../utils/logger.js';
 // ============================================================================
 // Allowlist Store
 // ============================================================================
+/** Fresh nested state: never share the default patterns/stats across stores. */
+function createDefaultConfig() {
+    return {
+        ...DEFAULT_ALLOWLIST_CONFIG,
+        patterns: [],
+        defaults: { ...DEFAULT_ALLOWLIST_CONFIG.defaults },
+        stats: { ...DEFAULT_ALLOWLIST_CONFIG.stats },
+    };
+}
 /**
  * Store for bash command approval patterns
  */
@@ -25,7 +34,7 @@ export class AllowlistStore extends EventEmitter {
     constructor(configDir) {
         super();
         this.configPath = this.getConfigPath(configDir);
-        this.config = { ...DEFAULT_ALLOWLIST_CONFIG };
+        this.config = createDefaultConfig();
     }
     /**
      * Initialize the store (load config, add defaults)
@@ -57,7 +66,8 @@ export class AllowlistStore extends EventEmitter {
             throw new Error(`Invalid pattern: ${validation.error}`);
         }
         // Check for duplicate
-        const existing = this.findPatternByValue(pattern, type);
+        const scopedCwd = options?.cwd ? this.canonicalizeCwd(options.cwd) : undefined;
+        const existing = this.findPatternByValue(pattern, type, scopedCwd);
         if (existing) {
             // Update existing pattern
             existing.decision = decision;
@@ -79,6 +89,7 @@ export class AllowlistStore extends EventEmitter {
             enabled: true,
             tags: options?.tags,
             source: options?.source || 'user',
+            cwd: scopedCwd,
         };
         this.config.patterns.push(newPattern);
         this.saveConfig();
@@ -124,7 +135,10 @@ export class AllowlistStore extends EventEmitter {
                 throw new Error(`Invalid pattern: ${validation.error}`);
             }
         }
-        Object.assign(pattern, updates);
+        Object.assign(pattern, {
+            ...updates,
+            ...(updates.cwd ? { cwd: this.canonicalizeCwd(updates.cwd) } : {}),
+        });
         this.saveConfig();
         return pattern;
     }
@@ -137,8 +151,11 @@ export class AllowlistStore extends EventEmitter {
     /**
      * Find pattern by value and type
      */
-    findPatternByValue(pattern, type) {
-        return this.config.patterns.find(p => p.pattern === pattern && p.type === type);
+    findPatternByValue(pattern, type, cwd) {
+        const scopedCwd = cwd ? this.canonicalizeCwd(cwd) : undefined;
+        return this.config.patterns.find(p => p.pattern === pattern
+            && p.type === type
+            && p.cwd === scopedCwd);
     }
     /**
      * Get all patterns
@@ -176,13 +193,15 @@ export class AllowlistStore extends EventEmitter {
     /**
      * Check a command against stored patterns
      */
-    checkCommand(command) {
+    checkCommand(command, cwd = process.cwd()) {
         // Update stats
         this.config.stats.totalChecks++;
         // Clean expired patterns first
         this.cleanExpiredPatterns();
         // Find best matching pattern
-        const match = findBestMatch(command, this.config.patterns);
+        const canonicalCwd = this.canonicalizeCwd(cwd);
+        const applicablePatterns = this.config.patterns.filter(pattern => !pattern.cwd || pattern.cwd === canonicalCwd);
+        const match = findBestMatch(command, applicablePatterns);
         if (match) {
             // Update pattern usage
             match.useCount++;
@@ -220,6 +239,7 @@ export class AllowlistStore extends EventEmitter {
             description: options.description || `Auto-approved: ${command}`,
             source: 'user',
             tags: ['auto-created'],
+            cwd: options.cwd || process.cwd(),
         });
     }
     // ============================================================================
@@ -280,14 +300,18 @@ export class AllowlistStore extends EventEmitter {
                 }
                 else {
                     // Convert date strings back to Date objects
+                    const defaults = createDefaultConfig();
                     this.config = {
-                        ...DEFAULT_ALLOWLIST_CONFIG,
+                        ...defaults,
                         ...loaded,
+                        defaults: { ...defaults.defaults, ...loaded.defaults },
+                        stats: { ...defaults.stats, ...loaded.stats },
                         patterns: loaded.patterns.map(p => ({
                             ...p,
                             createdAt: new Date(p.createdAt),
                             lastUsedAt: p.lastUsedAt ? new Date(p.lastUsedAt) : undefined,
                             expiresAt: p.expiresAt ? new Date(p.expiresAt) : undefined,
+                            cwd: p.cwd ? this.canonicalizeCwd(p.cwd) : undefined,
                         })),
                     };
                 }
@@ -302,27 +326,38 @@ export class AllowlistStore extends EventEmitter {
      * Save configuration to file
      */
     saveConfig() {
+        const tempPath = `${this.configPath}.tmp-${process.pid}-${randomUUID()}`;
         try {
             const dir = path.dirname(this.configPath);
             if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true });
+                fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
             }
-            fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+            fs.writeFileSync(tempPath, `${JSON.stringify(this.config, null, 2)}\n`, { encoding: 'utf-8', flag: 'wx', mode: 0o600 });
+            fs.renameSync(tempPath, this.configPath);
             this.emit('config:saved', this.config);
         }
         catch (error) {
             logger.error('Failed to save allowlist config', error);
         }
+        finally {
+            try {
+                fs.rmSync(tempPath, { force: true });
+            }
+            catch {
+                // Best-effort cleanup after a failed write or rename.
+            }
+        }
     }
     /**
      * Migrate old config format
      */
     migrateConfig(old) {
         // Currently only version 1, so just use defaults
+        const defaults = createDefaultConfig();
         this.config = {
-            ...DEFAULT_ALLOWLIST_CONFIG,
+            ...defaults,
             patterns: old.patterns || [],
-            stats: old.stats || DEFAULT_ALLOWLIST_CONFIG.stats,
+            stats: old.stats ? { ...old.stats } : defaults.stats,
         };
         this.saveConfig();
     }
@@ -385,6 +420,10 @@ export class AllowlistStore extends EventEmitter {
             this.saveConfig();
         }
     }
+    /** Match ExecPolicy's stable project boundary without requiring the path to exist. */
+    canonicalizeCwd(cwd) {
+        return path.resolve(cwd);
+    }
     // ============================================================================
     // Import/Export
     // ============================================================================
@@ -434,6 +473,7 @@ export class AllowlistStore extends EventEmitter {
                     source: 'import',
                     createdAt: new Date(),
                     useCount: 0,
+                    cwd: pattern.cwd ? this.canonicalizeCwd(pattern.cwd) : undefined,
                 });
                 imported++;
             }

package/dist/security/bash-allowlist/approval-flow.d.ts

@@ -40,7 +40,7 @@ export declare class ApprovalFlowManager extends EventEmitter {
      * @param command Command to check
      * @returns Check result
      */
-    quickCheck(command: string): AllowlistCheckResult;
+    quickCheck(command: string, cwd?: string): AllowlistCheckResult;
     /**
      * Prompt the user for approval
      */

package/dist/security/bash-allowlist/approval-flow.js

@@ -46,8 +46,9 @@ export class ApprovalFlowManager extends EventEmitter {
      */
     async checkAndApprove(command, options) {
         await this.initialize();
+        const cwd = options?.cwd || process.cwd();
         // First check stored patterns
-        const checkResult = this.store.checkCommand(command);
+        const checkResult = this.store.checkCommand(command, cwd);
         if (checkResult.matched) {
             const approved = checkResult.decision === 'allow';
             this.emit(approved ? 'check:allowed' : 'check:denied', {
@@ -63,7 +64,7 @@ export class ApprovalFlowManager extends EventEmitter {
         }
         // No pattern match - need to prompt
         if (checkResult.decision === 'prompt') {
-            const promptResult = await this.promptUser(command, options);
+            const promptResult = await this.promptUser(command, { ...options, cwd });
             if (promptResult.timedOut) {
                 return {
                     approved: false,
@@ -79,6 +80,7 @@ export class ApprovalFlowManager extends EventEmitter {
                     pattern: promptResult.pattern,
                     patternType: promptResult.patternType,
                     description: promptResult.description,
+                    cwd,
                 });
             }
             return {
@@ -98,7 +100,7 @@ export class ApprovalFlowManager extends EventEmitter {
      * @param command Command to check
      * @returns Check result
      */
-    quickCheck(command) {
+    quickCheck(command, cwd = process.cwd()) {
         if (!this.store.isInitialized()) {
             // Store not initialized - return prompt
             return {
@@ -107,7 +109,7 @@ export class ApprovalFlowManager extends EventEmitter {
                 reason: 'Allowlist not initialized',
             };
         }
-        const result = this.store.checkCommand(command);
+        const result = this.store.checkCommand(command, cwd);
         return {
             matched: result.matched,
             pattern: result.pattern,
@@ -127,7 +129,7 @@ export class ApprovalFlowManager extends EventEmitter {
         // you would extend the confirmation service UI to show pattern options.
         const promptOptions = {
             command,
-            cwd: process.cwd(),
+            cwd: options?.cwd || process.cwd(),
             timeout: options?.timeout || config.defaults.timeout,
             showAlwaysAllow: options?.showAlwaysAllow ?? config.defaults.showAlwaysAllow,
             showAlwaysDeny: options?.showAlwaysDeny ?? config.defaults.showAlwaysDeny,
@@ -138,7 +140,7 @@ export class ApprovalFlowManager extends EventEmitter {
             operation: 'Execute bash command',
             filename: command,
             showVSCodeOpen: false,
-            content: this.formatPromptContent(command, suggestion),
+            content: this.formatPromptContent(command, suggestion, promptOptions.cwd),
         }, 'bash');
         // Map confirmation result to approval result
         if (!result.confirmed) {
@@ -163,10 +165,10 @@ export class ApprovalFlowManager extends EventEmitter {
     /**
      * Format content for the approval prompt
      */
-    formatPromptContent(command, suggestion) {
+    formatPromptContent(command, suggestion, cwd) {
         return [
             `Command: ${command}`,
-            `Working directory: ${process.cwd()}`,
+            `Working directory: ${cwd}`,
             '',
             `Suggested pattern: ${suggestion.pattern}`,
             `Pattern type: ${suggestion.type}`,

package/dist/security/bash-allowlist/deny-guard.d.ts

@@ -0,0 +1,14 @@
+export interface DenyRuleVerdict {
+    denied: boolean;
+    /** The matched pattern text (for the refusal message). */
+    pattern?: string;
+    /** The pattern's human description, when set. */
+    description?: string;
+}
+/** Test hook: drop the mtime cache so the next check re-reads the store. */
+export declare function resetDenyGuardCache(): void;
+/**
+ * Check a command against the user's deny rules. Called from the shared
+ * command validator — must stay synchronous and cheap.
+ */
+export declare function checkUserDenyRules(command: string, cwd?: string): DenyRuleVerdict;

package/dist/security/bash-allowlist/deny-guard.js

@@ -0,0 +1,61 @@
+/**
+ * User deny-rule guard for bash commands (Hermes-parity: user-defined deny
+ * rules block commands EVEN under YOLO).
+ *
+ * The allowlist store (`~/.codebuddy/exec-approvals.json`, managed via
+ * `/allowlist deny <pattern>`) existed but was consulted nowhere on the real
+ * execution path — deny patterns blocked nothing. This guard is the missing
+ * consumer: a synchronous check wired into the SHARED command validator
+ * (`src/tools/bash/command-validator.ts`), which both the buffered and the
+ * streaming bash paths run unconditionally — YOLO skips confirmations, never
+ * validation, so a user deny rule is a hard stop in every mode.
+ *
+ * Sync + fail-open by design: a missing/corrupt store must never break bash
+ * (it only disables the extra guard); the file is re-read when its mtime
+ * changes so `/allowlist deny` edits apply without a restart.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { matchApprovalPattern } from './pattern-matcher.js';
+let cache = null;
+function storePath() {
+    return path.join(process.env.CODEBUDDY_HOME ?? path.join(os.homedir(), '.codebuddy'), 'exec-approvals.json');
+}
+function loadDenyPatterns() {
+    try {
+        const file = storePath();
+        const stat = fs.statSync(file);
+        if (cache && cache.mtimeMs === stat.mtimeMs)
+            return cache.patterns;
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const patterns = (parsed.patterns ?? []).filter((p) => p.enabled && p.decision === 'deny');
+        cache = { mtimeMs: stat.mtimeMs, patterns };
+        return patterns;
+    }
+    catch {
+        // No store / unreadable / invalid JSON → no user deny rules.
+        return [];
+    }
+}
+/** Test hook: drop the mtime cache so the next check re-reads the store. */
+export function resetDenyGuardCache() {
+    cache = null;
+}
+/**
+ * Check a command against the user's deny rules. Called from the shared
+ * command validator — must stay synchronous and cheap.
+ */
+export function checkUserDenyRules(command, cwd = process.cwd()) {
+    const patterns = loadDenyPatterns();
+    const canonicalCwd = path.resolve(cwd);
+    for (const pattern of patterns) {
+        if (pattern.cwd && path.resolve(pattern.cwd) !== canonicalCwd)
+            continue;
+        if (matchApprovalPattern(command, pattern)) {
+            return { denied: true, pattern: pattern.pattern, description: pattern.description };
+        }
+    }
+    return { denied: false };
+}
+//# sourceMappingURL=deny-guard.js.map

package/dist/security/bash-allowlist/types.d.ts

@@ -41,6 +41,11 @@ export interface ApprovalPattern {
     tags?: string[];
     /** Source of this pattern (user, system, plugin) */
     source: PatternSource;
+    /**
+     * Optional project boundary for an approval learned from a prompt.
+     * Missing means global, preserving legacy and explicitly managed patterns.
+     */
+    cwd?: string;
 }
 /**
  * Where the pattern came from

package/dist/security/bash-parser.d.ts

@@ -10,6 +10,19 @@
  * This is critical for security: `rm -rf / && echo safe` should
  * detect the `rm -rf /` component, not just see "echo safe".
  */
+import { type PowerShellParserOptions } from './powershell-parser.js';
+/**
+ * Start loading the OPTIONAL tree-sitter grammars, at most once.
+ *
+ * Deliberately NOT started while this module is being evaluated: merely
+ * importing the security layer must never pull a native `.node` addon into a
+ * process that parses no shell command (`buddy dev plan` parses none). Such an
+ * import is a floating promise detached from the running command, and on
+ * Windows a delay-loaded DLL that cannot be resolved raises an SEH exception
+ * (`0xC06D007F`) no `try/catch` can intercept: the whole process dies, and the
+ * exit code replaces that of a command which had otherwise succeeded.
+ */
+export declare function preloadBashGrammars(): void;
 export interface ParsedCommand {
     /** The base command name (e.g., 'rm', 'git', 'npm') */
     command: string;
@@ -28,12 +41,31 @@ export interface ParseResult {
     usedTreeSitter: boolean;
     /** Any parsing warnings */
     warnings: string[];
+    /** Whether the selected shell parser found output/input redirection. */
+    hasRedirection?: boolean;
+}
+export type ShellKind = 'posix' | 'powershell' | 'cmd' | 'unknown';
+export interface ShellParseOptions {
+    /** Resolved shell executable/name when the command itself is not wrapped. */
+    shell?: string;
+    powershell?: PowerShellParserOptions;
 }
+/**
+ * Remove recognized shell wrappers recursively so an inner command cannot hide
+ * behind bash/sh/zsh -c, cmd /c, powershell -Command or pwsh -Command.
+ */
+export declare function stripShellWrapper(input: string): string;
 /**
  * Parse a bash command string into individual commands.
  * Uses tree-sitter if available, falls back to state-machine parser.
  */
 export declare function parseBashCommand(input: string): ParseResult;
+/**
+ * Parse with the grammar of the resolved or wrapped shell. PowerShell never
+ * falls back to the POSIX parser: if its native parser is unavailable or
+ * uncertain, the returned warnings require the caller to refuse execution.
+ */
+export declare function parseShellCommand(input: string, options?: ShellParseOptions): ParseResult;
 /**
  * Extract just the command names from a bash string (convenience).
  */

package/dist/security/bash-parser.js

@@ -11,25 +11,124 @@
  * detect the `rm -rf /` component, not just see "echo safe".
  */
 import { logger } from '../utils/logger.js';
-// Cache tree-sitter modules loaded via async import at module init time.
+import { parsePowerShellCommand, } from './powershell-parser.js';
+// Cache tree-sitter modules loaded via async import on first parse.
 // parseBashCommand is sync, so we pre-load and cache these optional deps.
 let _treeSitterParser = null;
 let _treeSitterBash = null;
 let _treeSitterLoaded = false;
-// Kick off async import immediately; result is cached for sync use.
-(async () => {
-    try {
-        const parserMod = await import('tree-sitter');
-        const bashMod = await import('tree-sitter-bash');
-        _treeSitterParser = parserMod.default ?? parserMod;
-        _treeSitterBash = bashMod.default ?? bashMod;
-        _treeSitterLoaded = true;
+let _treeSitterPreload = null;
+let _treeSitterWarned = false;
+/**
+ * Start loading the OPTIONAL tree-sitter grammars, at most once.
+ *
+ * Deliberately NOT started while this module is being evaluated: merely
+ * importing the security layer must never pull a native `.node` addon into a
+ * process that parses no shell command (`buddy dev plan` parses none). Such an
+ * import is a floating promise detached from the running command, and on
+ * Windows a delay-loaded DLL that cannot be resolved raises an SEH exception
+ * (`0xC06D007F`) no `try/catch` can intercept: the whole process dies, and the
+ * exit code replaces that of a command which had otherwise succeeded.
+ */
+export function preloadBashGrammars() {
+    if (_treeSitterPreload)
+        return;
+    _treeSitterPreload = (async () => {
+        try {
+            const parserMod = await import('tree-sitter');
+            const bashMod = await import('tree-sitter-bash');
+            _treeSitterParser = parserMod.default ?? parserMod;
+            _treeSitterBash = bashMod.default ?? bashMod;
+            _treeSitterLoaded = true;
+        }
+        catch (error) {
+            // tree-sitter not installed or unloadable — the fallback parser is used.
+            _treeSitterLoaded = false;
+            if (!_treeSitterWarned) {
+                _treeSitterWarned = true;
+                logger.warn('tree-sitter unavailable; bash parsing falls back to the state-machine parser', { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    })();
+}
+function stripMatchingOuterQuotes(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 2)
+        return trimmed;
+    const first = trimmed[0];
+    const last = trimmed.at(-1);
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function shellKind(executable) {
+    if (!executable)
+        return 'unknown';
+    const unquoted = executable.trim().replace(/^(['"])(.*)\1$/, '$2');
+    const parts = unquoted.split(/[\\/]/).filter(Boolean);
+    const base = (parts.at(-1) ?? unquoted).replace(/\.exe$/i, '').toLowerCase();
+    if (base === 'powershell' || base === 'pwsh')
+        return 'powershell';
+    if (base === 'cmd')
+        return 'cmd';
+    if (base === 'bash' || base === 'sh' || base === 'zsh')
+        return 'posix';
+    return 'unknown';
+}
+function unwrapShellOnce(input) {
+    const match = input.trim().match(/^(?:"([^"]+)"|'([^']+)'|(\S+))(?:\s+([\s\S]+))$/);
+    if (!match)
+        return null;
+    const executable = match[1] ?? match[2] ?? match[3];
+    const rest = match[4];
+    if (executable === undefined || rest === undefined)
+        return null;
+    const kind = shellKind(executable);
+    let payload;
+    if (kind === 'posix') {
+        payload = rest.match(/^-[a-z]*c\s+([\s\S]+)$/i)?.[1];
+    }
+    else if (kind === 'cmd') {
+        payload = rest.match(/^(?:(?:\/[dqs])\s+)*\/c\s+([\s\S]+)$/i)?.[1];
     }
-    catch {
-        // tree-sitter not installed — fallback parser will be used
-        _treeSitterLoaded = false;
+    else if (kind === 'powershell') {
+        const commandFlag = /(?:^|\s)-(?:command|c)(?=\s|$)\s*/i.exec(rest);
+        if (commandFlag) {
+            payload = rest.slice(commandFlag.index + commandFlag[0].length);
+        }
+    }
+    if (payload === undefined || !payload.trim())
+        return null;
+    return {
+        command: stripMatchingOuterQuotes(payload),
+        executable: executable.replace(/^(['"])(.*)\1$/, '$2'),
+        shell: kind,
+    };
+}
+function unwrapShellCommand(input, explicitShell) {
+    let command = input.trim();
+    let executable = explicitShell;
+    let selectedShell = shellKind(explicitShell);
+    for (let depth = 0; depth < 10; depth++) {
+        const wrapper = unwrapShellOnce(command);
+        if (!wrapper)
+            break;
+        command = wrapper.command;
+        executable = wrapper.executable;
+        selectedShell = wrapper.shell;
     }
-})();
+    return { command, executable, shell: selectedShell };
+}
+/**
+ * Remove recognized shell wrappers recursively so an inner command cannot hide
+ * behind bash/sh/zsh -c, cmd /c, powershell -Command or pwsh -Command.
+ */
+export function stripShellWrapper(input) {
+    if (typeof input !== 'string')
+        return '';
+    return unwrapShellCommand(input).command;
+}
 /**
  * Parse bash commands using a state-machine approach.
  * Handles quotes, escapes, pipelines, chains, subshells.
@@ -255,7 +354,8 @@ export function parseBashCommand(input) {
     if (!input || !input.trim()) {
         return { commands: [], usedTreeSitter: false, warnings: [] };
     }
-    // Try tree-sitter first (optional dependency, pre-loaded at module init)
+    // Try tree-sitter first (optional dependency, loaded from the first parse on)
+    preloadBashGrammars();
     if (_treeSitterLoaded && _treeSitterParser && _treeSitterBash) {
         try {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -274,6 +374,21 @@ export function parseBashCommand(input) {
     }
     return fallbackParse(input);
 }
+/**
+ * Parse with the grammar of the resolved or wrapped shell. PowerShell never
+ * falls back to the POSIX parser: if its native parser is unavailable or
+ * uncertain, the returned warnings require the caller to refuse execution.
+ */
+export function parseShellCommand(input, options = {}) {
+    const resolved = unwrapShellCommand(input, options.shell);
+    if (resolved.shell === 'powershell') {
+        return parsePowerShellCommand(resolved.command, {
+            ...options.powershell,
+            executable: options.powershell?.executable ?? resolved.executable,
+        });
+    }
+    return parseBashCommand(resolved.command);
+}
 /**
  * Extract commands from a tree-sitter AST node.
  */

package/dist/security/compute-confinement.d.ts

@@ -0,0 +1,4 @@
+export declare function confineComputeInvocation(command: string, args: string[], root: string): {
+    command: string;
+    args: string[];
+};

package/dist/security/compute-confinement.js

@@ -0,0 +1,89 @@
+/** Kernel-enforced compute sandbox. Fail closed if the required Linux facilities are absent. */
+import { realpathSync } from 'node:fs';
+// Bootstrap is trusted, runs before user code, and applies restrictions inherited across exec.
+// Landlock restricts file content access; seccomp denies networking and cross-process access.
+const BOOTSTRAP = String.raw `
+import ctypes, errno, os, platform, resource, sys
+libc = ctypes.CDLL(None, use_errno=True)
+def check(value):
+    if value < 0: raise OSError(ctypes.get_errno(), 'compute confinement unavailable')
+    return value
+arch = platform.machine()
+if arch not in ('x86_64', 'aarch64'): raise RuntimeError('unsupported compute sandbox architecture')
+abi = check(libc.syscall(444, 0, 0, 1))
+if abi < 3: raise RuntimeError('compute sandbox requires Landlock ABI 3 or newer')
+root, executable = sys.argv[1:3]
+class Rules(ctypes.Structure):
+    _fields_ = [('access', ctypes.c_uint64)]
+class PathRule(ctypes.Structure):
+    _pack_ = 1
+    _fields_ = [('access', ctypes.c_uint64), ('fd', ctypes.c_int32)]
+rights = (1 << 15) - 1
+rules = Rules(rights)
+fd = check(libc.syscall(444, ctypes.byref(rules), ctypes.sizeof(rules), 0))
+def allow(p, access):
+    if not os.path.exists(p): return
+    p = os.path.realpath(p)
+    if not os.path.isdir(p): access &= (1 | 2 | 4 | (1 << 14))
+    handle = os.open(p, os.O_PATH | os.O_CLOEXEC)
+    try:
+        rule = PathRule(access, handle)
+        check(libc.syscall(445, fd, 1, ctypes.byref(rule), 0))
+    finally: os.close(handle)
+# Runtime libraries are readable, never writable or executable as programs.
+for p in ('/usr/lib', '/usr/lib64', '/usr/local/lib', '/usr/share/nodejs', '/usr/share/zoneinfo', '/lib', '/lib64', '/etc/ld.so.cache', '/dev/null', '/dev/urandom'):
+    allow(p, 4 | 8)
+allow(root, rights & ~(1 | (1 << 6) | (1 << 9) | (1 << 10) | (1 << 11) | (1 << 12)))
+allow(executable, 1 | 4)
+allow('/lib64/ld-linux-x86-64.so.2' if arch == 'x86_64' else '/lib/ld-linux-aarch64.so.1', 1 | 4)
+# Drop inherited capabilities as well (the host may itself run as root).
+class CapHeader(ctypes.Structure):
+    _fields_ = [('version',ctypes.c_uint32),('pid',ctypes.c_int)]
+class CapData(ctypes.Structure):
+    _fields_ = [('effective',ctypes.c_uint32),('permitted',ctypes.c_uint32),('inheritable',ctypes.c_uint32)]
+cap_header, cap_data = CapHeader(0x20080522, 0), (CapData * 2)()
+check(libc.capset(ctypes.byref(cap_header), ctypes.byref(cap_data)))
+check(libc.prctl(38, 1, 0, 0, 0)) # PR_SET_NO_NEW_PRIVS
+check(libc.syscall(446, fd, 0))
+os.close(fd)
+class Filter(ctypes.Structure):
+    _fields_ = [('code',ctypes.c_ushort),('jt',ctypes.c_ubyte),('jf',ctypes.c_ubyte),('k',ctypes.c_uint32)]
+class Program(ctypes.Structure):
+    _fields_ = [('len',ctypes.c_ushort),('filter',ctypes.POINTER(Filter))]
+# Check audit architecture, deny x32 ABI, then block sockets, ptrace, process_vm,
+# pidfd, io_uring, signals to other processes and namespace/mount manipulation.
+expected = 0xc000003e if arch == 'x86_64' else 0xc00000b7
+denied = ([41,42,43,44,45,46,47,49,50,53,288,101,310,311,424,425,426,434,438,62,200,234,57,58,165,166,272,308]
+          if arch == 'x86_64' else [198,203,202,206,207,211,212,200,201,199,242,117,270,271,424,425,426,434,438,129,130,131,40,39,97,268])
+ops = [Filter(0x20,0,0,4), Filter(0x15,1,0,expected), Filter(0x06,0,0,0x80000000), Filter(0x20,0,0,0)]
+if arch == 'x86_64': ops += [Filter(0x45,0,1,0x40000000), Filter(0x06,0,0,0x80000000)]
+# Deny process creation, while allowing CLONE_THREAD for interpreter worker threads.
+clone = 56 if arch == 'x86_64' else 220
+ops += [Filter(0x15,0,4,clone), Filter(0x20,0,0,16), Filter(0x45,1,0,0x10000), Filter(0x06,0,0,0x00050000 | errno.EPERM), Filter(0x06,0,0,0x7fff0000)]
+# libc retries clone() when clone3 reports ENOSYS.
+ops += [Filter(0x15,0,1,435), Filter(0x06,0,0,0x00050000 | errno.ENOSYS)]
+for nr in denied: ops += [Filter(0x15,0,1,nr),Filter(0x06,0,0,0x00050000 | errno.EPERM)]
+ops += [Filter(0x06,0,0,0x7fff0000)]
+filters = (Filter * len(ops))(*ops)
+program = Program(len(ops), filters)
+check(libc.prctl(22, 2, ctypes.byref(program), 0, 0)) # SECCOMP_MODE_FILTER
+resource.setrlimit(resource.RLIMIT_CORE, (0,0))
+resource.setrlimit(resource.RLIMIT_DATA, (536870912,536870912))
+resource.setrlimit(resource.RLIMIT_FSIZE, (2097152,2097152))
+resource.setrlimit(resource.RLIMIT_NOFILE, (128,128))
+resource.setrlimit(resource.RLIMIT_CPU, (30,30))
+os.environ['OPENSSL_CONF'] = '/dev/null'
+for key in ('TMPDIR','TMP','TEMP'): os.environ[key] = root
+os.environ.pop('NODE_PATH', None)
+os.environ.pop('NODE_OPTIONS', None)
+args = sys.argv[3:]
+if os.path.basename(executable) == 'node': args = ['--jitless', '--max-old-space-size=96'] + args
+os.execv(executable, [executable] + args)
+`;
+export function confineComputeInvocation(command, args, root) {
+    if (process.platform !== 'linux')
+        throw new Error('Compute confinement requires Linux Landlock/seccomp; refusing unrestricted execution');
+    const executable = realpathSync(command === 'python3' ? '/usr/bin/python3' : command);
+    return { command: '/usr/bin/python3', args: ['-I', '-c', BOOTSTRAP, realpathSync(root), executable, ...args] };
+}
+//# sourceMappingURL=compute-confinement.js.map