@poetic-ai/poetic 1.42.0

package/dist/chunk-PCAGC5MR.js

@@ -0,0 +1,1763 @@
+import {
+  formatSandboxCapabilityFailure,
+  getAllProviderWritePathSpecs,
+  getProviderAuthorityWriteDenyPathSpecs,
+  getRequiredWritePathsForProvider,
+  isAllowedRuntimeWritePath,
+  probeProviderSandboxCapability,
+  resolveWritePathSpec
+} from "./chunk-5WCQRDRB.js";
+import {
+  resolveAllowAwsCredentialRead
+} from "./chunk-5WRLK5KW.js";
+import {
+  execGitSync
+} from "./chunk-KNDYMVWN.js";
+import {
+  authorizeLinuxHostClassWrites,
+  hasContainerOsSignal,
+  resolveLinuxHostClass
+} from "./chunk-RWREC3KJ.js";
+import {
+  ProviderExecutionError
+} from "./chunk-LUVKFFWR.js";
+import {
+  isDebugMode
+} from "./chunk-EJGCZGUF.js";
+import {
+  POETIC_SANDBOX_BOUNDARY_POLICY,
+  POETIC_SANDBOX_CONTAINER_ATTESTED,
+  POETIC_SANDBOX_PROVENANCE,
+  readEnv,
+  readRawEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/core/sandbox/index.ts
+import fs4 from "fs";
+import os4 from "os";
+
+// src/telemetry/sandbox-decision-log.ts
+var SANDBOX_DECISION_EVENT = "sandbox_decision";
+var SANDBOX_CAPABILITY_DENIED_EVENT = "sandbox_capability_denied";
+function buildSandboxDecisionEvent(entry, options = {}) {
+  const denial = options.denial ?? false;
+  const event = {
+    event: denial ? SANDBOX_CAPABILITY_DENIED_EVENT : SANDBOX_DECISION_EVENT,
+    providerName: entry.providerName,
+    sandboxed: entry.sandboxed,
+    platform: entry.platform
+  };
+  if (entry.providerId !== void 0) event.providerId = entry.providerId;
+  if (entry.reason !== void 0) event.reason = entry.reason;
+  if (entry.provenance !== void 0) event.provenance = entry.provenance;
+  if (entry.boundaryProof !== void 0) event.boundaryProof = entry.boundaryProof;
+  if (entry.policyProof !== void 0) event.policyProof = entry.policyProof;
+  if (denial && entry.deniedPaths && entry.deniedPaths.length > 0) {
+    event.deniedPaths = entry.deniedPaths;
+  }
+  return event;
+}
+var cachedLogger = null;
+var loaderStarted = false;
+var PENDING_QUEUE_MAX = 32;
+var pendingEvents = [];
+var droppedPendingCount = 0;
+function enqueuePending(payload) {
+  pendingEvents.push(payload);
+  while (pendingEvents.length > PENDING_QUEUE_MAX) {
+    pendingEvents.shift();
+    droppedPendingCount += 1;
+  }
+}
+function flushPending() {
+  if (!cachedLogger || pendingEvents.length === 0) return;
+  const queued = pendingEvents.splice(0, pendingEvents.length);
+  for (const payload of queued) {
+    try {
+      cachedLogger.logCustomEvent(payload);
+    } catch {
+    }
+  }
+  if (droppedPendingCount > 0) {
+    try {
+      cachedLogger.logCustomEvent({
+        event: "sandbox_decision_queue_overflow",
+        dropped: droppedPendingCount
+      });
+    } catch {
+    }
+    droppedPendingCount = 0;
+  }
+}
+function ensureLoggerLoading() {
+  if (cachedLogger || loaderStarted) return;
+  loaderStarted = true;
+  void import("./get-telemetry-logger-DPVWWIYY.js").then(({ getTelemetryLogger }) => {
+    try {
+      cachedLogger = getTelemetryLogger();
+      flushPending();
+    } catch {
+      pendingEvents.length = 0;
+      droppedPendingCount = 0;
+    }
+  }).catch(() => {
+    pendingEvents.length = 0;
+    droppedPendingCount = 0;
+  });
+}
+function recordSandboxDecision(entry) {
+  try {
+    const denial = Boolean(entry.deniedPaths && entry.deniedPaths.length > 0);
+    const payload = buildSandboxDecisionEvent(entry, { denial });
+    if (!cachedLogger) {
+      enqueuePending(payload);
+      ensureLoggerLoading();
+      return;
+    }
+    cachedLogger.logCustomEvent(payload);
+  } catch {
+  }
+}
+
+// src/core/sandbox/platform.ts
+import { execFileSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+var cachedSupport = null;
+var loggedUnavailable = false;
+var cachedRestrictiveSupport = null;
+var loggedRestrictiveUnavailable = false;
+var cachedKernelSandboxActive = null;
+var cachedNestedSandboxReinitDenied = null;
+var loggedLinuxHostClassNote = false;
+function findSandboxExecOnPath() {
+  const envPath = process.env.PATH ?? "";
+  if (!envPath) return null;
+  for (const entry of envPath.split(path.delimiter)) {
+    if (!entry) continue;
+    const candidate = path.join(entry, "sandbox-exec");
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveSandboxExecPath() {
+  try {
+    fs.accessSync("/usr/bin/sandbox-exec", fs.constants.X_OK);
+    return "/usr/bin/sandbox-exec";
+  } catch {
+  }
+  return findSandboxExecOnPath();
+}
+function parseExecErrorOutput(error) {
+  if (!error || typeof error !== "object") return "";
+  const record = error;
+  const stderr = typeof record.stderr === "string" ? record.stderr : Buffer.isBuffer(record.stderr) ? record.stderr.toString("utf8") : "";
+  const stdout = typeof record.stdout === "string" ? record.stdout : Buffer.isBuffer(record.stdout) ? record.stdout.toString("utf8") : "";
+  const message = typeof record.message === "string" ? record.message : "";
+  return `${stderr}
+${stdout}
+${message}`.toLowerCase();
+}
+function isSandboxSupported() {
+  if (cachedSupport !== null) return cachedSupport;
+  if (os.platform() !== "darwin") {
+    cachedSupport = false;
+    return cachedSupport;
+  }
+  cachedSupport = resolveSandboxExecPath() !== null;
+  return cachedSupport;
+}
+function isSandboxEnforcementSupported() {
+  if (cachedRestrictiveSupport !== null) return cachedRestrictiveSupport;
+  if (!isSandboxSupported()) {
+    cachedRestrictiveSupport = false;
+    return cachedRestrictiveSupport;
+  }
+  if (os.platform() !== "darwin") {
+    cachedRestrictiveSupport = false;
+    return cachedRestrictiveSupport;
+  }
+  const sandboxExec = resolveSandboxExecPath();
+  if (!sandboxExec) {
+    cachedRestrictiveSupport = false;
+    return cachedRestrictiveSupport;
+  }
+  const probeProfile = "(version 1) (deny default) (allow process*) (allow file-read*)";
+  try {
+    execFileSync(sandboxExec, ["-p", probeProfile, "/usr/bin/true"], {
+      stdio: "ignore",
+      timeout: 1500
+    });
+    cachedRestrictiveSupport = true;
+  } catch {
+    cachedRestrictiveSupport = false;
+  }
+  return cachedRestrictiveSupport;
+}
+function isKernelSandboxActive() {
+  if (cachedKernelSandboxActive !== null) return cachedKernelSandboxActive;
+  if (os.platform() !== "darwin") {
+    cachedKernelSandboxActive = false;
+    return cachedKernelSandboxActive;
+  }
+  try {
+    fs.accessSync("/usr/bin/python3", fs.constants.X_OK);
+  } catch {
+    cachedKernelSandboxActive = false;
+    return cachedKernelSandboxActive;
+  }
+  const probeScript = [
+    "import ctypes, os, sys",
+    "lib = ctypes.CDLL('/usr/lib/libSystem.B.dylib')",
+    "sandbox_check = lib.sandbox_check",
+    "sandbox_check.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int]",
+    "sandbox_check.restype = ctypes.c_int",
+    "rc = sandbox_check(os.getpid(), None, 0)",
+    "sys.stdout.write(str(rc))"
+  ].join("; ");
+  try {
+    const output = execFileSync("/usr/bin/python3", ["-c", probeScript], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1500
+    }).toString().trim();
+    cachedKernelSandboxActive = output === "1";
+  } catch {
+    cachedKernelSandboxActive = false;
+  }
+  return cachedKernelSandboxActive;
+}
+function isNestedSandboxReinitDenied() {
+  if (cachedNestedSandboxReinitDenied !== null) return cachedNestedSandboxReinitDenied;
+  if (os.platform() !== "darwin") {
+    cachedNestedSandboxReinitDenied = false;
+    return cachedNestedSandboxReinitDenied;
+  }
+  const sandboxExec = resolveSandboxExecPath();
+  if (!sandboxExec) {
+    cachedNestedSandboxReinitDenied = false;
+    return cachedNestedSandboxReinitDenied;
+  }
+  try {
+    execFileSync(sandboxExec, ["-p", "(version 1) (allow default)", "/usr/bin/true"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 1500
+    });
+    cachedNestedSandboxReinitDenied = false;
+  } catch (error) {
+    const message = parseExecErrorOutput(error);
+    const status = typeof error === "object" && error !== null && "status" in error ? Number(error.status) : void 0;
+    cachedNestedSandboxReinitDenied = status === 71 && (message.includes("sandbox_apply") || message.includes("operation not permitted") || isKernelSandboxActive());
+  }
+  return cachedNestedSandboxReinitDenied;
+}
+function logSandboxUnavailable() {
+  if (loggedUnavailable) return;
+  const explicitlyDisabled = process.env.POETIC_SANDBOX_ENABLED === "0";
+  if (explicitlyDisabled) return;
+  const platform = os.platform();
+  const onMacOS = platform === "darwin";
+  console.warn(
+    "[Sandbox] sandbox-exec unavailable - no self-generated boundary. " + (onMacOS ? "This is unexpected on macOS. Check if sandbox-exec is at /usr/bin/sandbox-exec." : "Sandboxing is only self-generated on macOS. Linux write-capable runs use host class (isolated or a recorded desktop ack), not a Seatbelt profile.")
+  );
+  loggedUnavailable = true;
+}
+function logLinuxHostClassNote(note) {
+  if (loggedLinuxHostClassNote) return;
+  if (!note) return;
+  console.warn(note);
+  loggedLinuxHostClassNote = true;
+}
+function logSandboxEnforcementUnavailable() {
+  if (loggedRestrictiveUnavailable) return;
+  const explicitlyDisabled = process.env.POETIC_SANDBOX_ENABLED === "0";
+  if (explicitlyDisabled) return;
+  console.warn(
+    "[Sandbox] sandbox-exec is present but restrictive deny-default profile probing failed. Readonly agentic execution will be blocked (reason=sandbox_unavailable)."
+  );
+  loggedRestrictiveUnavailable = true;
+}
+
+// src/core/sandbox/profile-cache.ts
+import crypto from "crypto";
+import fs3 from "fs";
+import path5 from "path";
+
+// src/core/sandbox/profile-generator.ts
+import fs2 from "fs";
+import os3 from "os";
+import path4 from "path";
+
+// src/core/ci/local-ci-publication-mac.ts
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+import {
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import path2 from "path";
+var LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR = ".local/poetic-secrets";
+var LOCAL_CI_PUBLICATION_MAC_KEY_FILENAME = "local-ci-publication.key";
+var PUBLICATION_MAC_VERSION = "v1";
+var PUBLICATION_MAC_KEY_BYTES = 32;
+var cachedKey;
+var secretsRootOverride;
+function publicationGenerationIdentity(repository, sha) {
+  return `${repository}\0${sha.toLowerCase()}`;
+}
+function getLocalCiPublicationGenerationPath(repository, sha) {
+  const identity = createHash("sha256").update(publicationGenerationIdentity(repository, sha)).digest("hex").slice(0, 32);
+  return path2.join(getLocalCiPublicationSecretsRoot(), "generations", `${identity}.gen`);
+}
+function getLocalCiPublicationSecretsRoot() {
+  return secretsRootOverride ?? path2.join(homedir(), LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR);
+}
+function getLocalCiPublicationMacKeyPath() {
+  return path2.join(getLocalCiPublicationSecretsRoot(), LOCAL_CI_PUBLICATION_MAC_KEY_FILENAME);
+}
+function isNodeErrorCode(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function publicationMacMaterial(obligation) {
+  return [
+    PUBLICATION_MAC_VERSION,
+    obligation.repository,
+    obligation.sha.toLowerCase(),
+    obligation.context,
+    obligation.state,
+    obligation.description,
+    obligation.targetStatus ?? "",
+    obligation.generation ?? ""
+  ].join("\0");
+}
+function mintPublicationGeneration() {
+  return randomUUID();
+}
+function getLocalCiPublicationGenerationJournalDir(repository, sha) {
+  const identity = createHash("sha256").update(publicationGenerationIdentity(repository, sha)).digest("hex").slice(0, 32);
+  return path2.join(getLocalCiPublicationSecretsRoot(), "generations", identity);
+}
+function getLocalCiPublicationGenerationJournalPath(repository, sha, attemptId) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(attemptId)) {
+    throw new Error("Local CI publication generation journal attemptId must be a UUID.");
+  }
+  return path2.join(
+    getLocalCiPublicationGenerationJournalDir(repository, sha),
+    `${attemptId}.journal`
+  );
+}
+function writeAtomicFile(filePath, contents) {
+  mkdirSync(path2.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  writeFileSync(temporary, contents, { encoding: "utf8", mode: 384 });
+  try {
+    renameSync(temporary, filePath);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+function unlinkIfExists(filePath) {
+  try {
+    unlinkSync(filePath);
+  } catch (error) {
+    if (!isNodeErrorCode(error, "ENOENT")) throw error;
+  }
+}
+function buildPublicationGenerationJournal(record, attemptId) {
+  const obligation = record.outstandingRemoteStatusPublication;
+  if (obligation?.generation) {
+    return {
+      op: "activate",
+      repository: record.repository,
+      sha: record.sha,
+      attemptId,
+      generation: obligation.generation
+    };
+  }
+  return { op: "retire", repository: record.repository, sha: record.sha, attemptId };
+}
+function parsePublicationGenerationJournal(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const parsed = raw;
+  if (parsed.op !== "activate" && parsed.op !== "retire") return void 0;
+  if (parsed.op === "activate" && !parsed.generation) return void 0;
+  if (!parsed.attemptId) return void 0;
+  return parsed;
+}
+function readPublicationGenerationJournal(repository, sha, attemptId) {
+  try {
+    return parsePublicationGenerationJournal(
+      JSON.parse(
+        readFileSync(getLocalCiPublicationGenerationJournalPath(repository, sha, attemptId), "utf8")
+      )
+    );
+  } catch (error) {
+    if (isNodeErrorCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+}
+function listPublicationGenerationJournals(repository, sha) {
+  try {
+    const entries = readdirSync(getLocalCiPublicationGenerationJournalDir(repository, sha));
+    const journals = [];
+    for (const entry of entries) {
+      if (!entry.endsWith(".journal")) continue;
+      const attemptId = entry.slice(0, -".journal".length);
+      const journal = readPublicationGenerationJournal(repository, sha, attemptId);
+      if (journal) journals.push(journal);
+    }
+    return journals;
+  } catch (error) {
+    if (isNodeErrorCode(error, "ENOENT")) return [];
+    throw error;
+  }
+}
+function applyPublicationGenerationJournal(journal) {
+  if (journal.op === "activate" && journal.generation) {
+    writeAtomicFile(
+      getLocalCiPublicationGenerationPath(journal.repository, journal.sha),
+      `${journal.generation}
+`
+    );
+    return;
+  }
+  unlinkIfExists(getLocalCiPublicationGenerationPath(journal.repository, journal.sha));
+}
+function clearPublicationGenerationJournal(repository, sha, attemptId) {
+  unlinkIfExists(getLocalCiPublicationGenerationJournalPath(repository, sha, attemptId));
+}
+function beginHostPublicationGenerationJournal(record) {
+  const attemptId = randomUUID();
+  const journal = buildPublicationGenerationJournal(record, attemptId);
+  writeAtomicFile(
+    getLocalCiPublicationGenerationJournalPath(record.repository, record.sha, attemptId),
+    `${JSON.stringify(journal)}
+`
+  );
+  return attemptId;
+}
+function abandonHostPublicationGenerationJournal(record, attemptId) {
+  clearPublicationGenerationJournal(record.repository, record.sha, attemptId);
+}
+function recoverHostPublicationGeneration(record) {
+  const journals = listPublicationGenerationJournals(record.repository, record.sha);
+  const generation = record.outstandingRemoteStatusPublication?.generation;
+  const journal = generation ? journals.find((entry) => entry.op === "activate" && entry.generation === generation) : journals.find((entry) => entry.op === "retire");
+  if (!journal) return;
+  applyPublicationGenerationJournal(journal);
+  clearPublicationGenerationJournal(record.repository, record.sha, journal.attemptId);
+}
+function syncHostPublicationGeneration(record, attemptId) {
+  const journal = readPublicationGenerationJournal(record.repository, record.sha, attemptId) ?? buildPublicationGenerationJournal(record, attemptId);
+  applyPublicationGenerationJournal(journal);
+  clearPublicationGenerationJournal(record.repository, record.sha, attemptId);
+}
+function readHostPublicationGeneration(repository, sha) {
+  try {
+    const raw = readFileSync(getLocalCiPublicationGenerationPath(repository, sha), "utf8").trim();
+    return raw.length > 0 ? raw : void 0;
+  } catch (error) {
+    if (isNodeErrorCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+}
+function computePublicationMac(obligation, key) {
+  return createHmac("sha256", key).update(publicationMacMaterial(obligation)).digest("hex");
+}
+function loadLocalCiPublicationMacKey() {
+  if (cachedKey) return cachedKey;
+  const keyPath = getLocalCiPublicationMacKeyPath();
+  try {
+    const raw = readFileSync(keyPath);
+    if (raw.length >= PUBLICATION_MAC_KEY_BYTES) {
+      cachedKey = Buffer.from(raw.subarray(0, PUBLICATION_MAC_KEY_BYTES));
+      return cachedKey;
+    }
+  } catch (error) {
+    if (!isNodeErrorCode(error, "ENOENT")) {
+      throw error;
+    }
+  }
+  mkdirSync(path2.dirname(keyPath), { recursive: true, mode: 448 });
+  const generated = randomBytes(PUBLICATION_MAC_KEY_BYTES);
+  try {
+    writeFileSync(keyPath, generated, { mode: 384, flag: "wx" });
+    cachedKey = generated;
+    return cachedKey;
+  } catch (error) {
+    if (!isNodeErrorCode(error, "EEXIST")) {
+      throw error;
+    }
+    const raw = readFileSync(keyPath);
+    if (raw.length < PUBLICATION_MAC_KEY_BYTES) {
+      throw new Error(`Local CI publication MAC key at ${keyPath} is truncated.`);
+    }
+    cachedKey = Buffer.from(raw.subarray(0, PUBLICATION_MAC_KEY_BYTES));
+    return cachedKey;
+  }
+}
+function attachOutstandingStatusPublicationMac(obligation) {
+  const generation = mintPublicationGeneration();
+  const unsigned = {
+    repository: obligation.repository,
+    sha: obligation.sha,
+    context: obligation.context,
+    state: obligation.state,
+    description: obligation.description,
+    generation,
+    ...obligation.targetStatus !== void 0 ? { targetStatus: obligation.targetStatus } : {}
+  };
+  const mac = computePublicationMac(unsigned, loadLocalCiPublicationMacKey());
+  return { ...obligation, ...unsigned, generation, mac };
+}
+function outstandingStatusPublicationMacIsValid(obligation) {
+  if (!obligation.mac || !/^[a-f0-9]{64}$/i.test(obligation.mac)) {
+    return false;
+  }
+  if (!obligation.generation) {
+    return false;
+  }
+  let hostGeneration;
+  try {
+    hostGeneration = readHostPublicationGeneration(obligation.repository, obligation.sha);
+  } catch {
+    return false;
+  }
+  if (!hostGeneration || hostGeneration !== obligation.generation) {
+    return false;
+  }
+  let key;
+  try {
+    key = loadLocalCiPublicationMacKey();
+  } catch {
+    return false;
+  }
+  const expected = computePublicationMac(obligation, key);
+  const actual = Buffer.from(obligation.mac, "hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  if (actual.length !== expectedBuf.length) return false;
+  return timingSafeEqual(actual, expectedBuf);
+}
+
+// src/core/sandbox/profile-storage.ts
+import os2 from "os";
+import path3 from "path";
+function getSandboxProfileStorageDirectory() {
+  return path3.join(os2.homedir(), "Library", "Application Support", "Poetic", "sandbox-profiles");
+}
+
+// src/core/sandbox/profile-generator.ts
+var CREDENTIAL_DENY_SPECS = [
+  { kind: "subpath", homeRelative: ".ssh" },
+  { kind: "subpath", homeRelative: ".azure" },
+  { kind: "subpath", homeRelative: ".gnupg" },
+  { kind: "subpath", homeRelative: ".kube" },
+  { kind: "subpath", homeRelative: ".docker/config.json" },
+  { kind: "literal", homeRelative: ".npmrc" },
+  { kind: "literal", homeRelative: ".git-credentials" },
+  { kind: "subpath", homeRelative: ".op" },
+  { kind: "subpath", homeRelative: ".config/op" },
+  { kind: "literal", homeRelative: ".netrc" },
+  { kind: "literal", homeRelative: ".pypirc" },
+  { kind: "subpath", homeRelative: ".gem/credentials" },
+  { kind: "literal", homeRelative: ".cargo/credentials" },
+  { kind: "literal", homeRelative: ".cargo/credentials.toml" },
+  { kind: "subpath", homeRelative: ".config/heroku" },
+  { kind: "subpath", homeRelative: ".terraform.d" },
+  { kind: "literal", homeRelative: ".vault-token" },
+  { kind: "subpath", homeRelative: ".config/stripe" },
+  { kind: "subpath", homeRelative: ".cloudflare" },
+  { kind: "subpath", homeRelative: ".wrangler" },
+  { kind: "literal", homeRelative: ".pulumi/credentials.json" },
+  { kind: "subpath", homeRelative: ".config/vercel" },
+  { kind: "subpath", homeRelative: ".config/netlify" },
+  // Local CI publication MAC key. Outside the sandbox-writable `.poetic`
+  // tree; denied for read+write so a confined agent cannot mint a valid
+  // success publication.
+  { kind: "subpath", homeRelative: LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR }
+];
+var AWS_CREDENTIAL_DENY_SPECS = [
+  { kind: "subpath", homeRelative: ".aws" },
+  { kind: "literal", homeRelative: ".aws/credentials" }
+];
+function getCredentialDenySpecs(allowAwsCredentialRead = false) {
+  return allowAwsCredentialRead ? CREDENTIAL_DENY_SPECS : [...CREDENTIAL_DENY_SPECS, ...AWS_CREDENTIAL_DENY_SPECS];
+}
+var TOOLCHAIN_CREDENTIAL_DENY_SPECS = [
+  { kind: "literal", homeRelative: ".m2/settings.xml" },
+  { kind: "literal", homeRelative: ".m2/settings-security.xml" },
+  { kind: "literal", homeRelative: ".gradle/gradle.properties" },
+  // Gradle init scripts auto-execute as the user on the next build (deferred
+  // exec). ~/.gradle is write-granted via COMMON_TOOLCHAIN_WRITE_PATHS, so these
+  // must be re-denied post-allow to block planted init scripts.
+  { kind: "subpath", homeRelative: ".gradle/init.d" },
+  { kind: "literal", homeRelative: ".gradle/init.gradle" },
+  { kind: "literal", homeRelative: ".gradle/init.gradle.kts" }
+];
+var PROVIDER_TOKEN_WRITE_DENY_SPECS = [
+  { kind: "literal", homeRelative: ".config/gh/hosts.yml" },
+  { kind: "literal", homeRelative: ".gemini/oauth_creds.json" },
+  { kind: "literal", homeRelative: ".config/gcloud/application_default_credentials.json" },
+  // gcloud stores live OAuth/access tokens in SQLite stores under the recursively
+  // write-granted ~/.config/gcloud tree, not just the ADC json. credentials.db and
+  // access_tokens.db are the actual token stores gcloud reads/refreshes. Deny WRITES
+  // to them (reads stay allowed) so a confined agent cannot overwrite/forge tokens.
+  // Note: denying writes may interfere with in-sandbox gcloud token refresh, which
+  // is the same posture already chosen for .config/gh/hosts.yml and .gemini tokens.
+  { kind: "literal", homeRelative: ".config/gcloud/credentials.db" },
+  { kind: "literal", homeRelative: ".config/gcloud/access_tokens.db" },
+  // Codex stores browser-login tokens in auth.json under the recursively
+  // write-granted ~/.codex (CODEX_HOME) tree. Re-deny writes (reads stay
+  // allowed) so a confined agent cannot overwrite/forge the login secret.
+  // Isolated/custom CODEX_HOME is re-denied separately via absolute paths
+  // (see renderCodexAuthJsonRedenyEntries) so every granted state root is covered.
+  { kind: "literal", homeRelative: ".codex/auth.json" }
+];
+var CLIENT_SIDE_GIT_HOOK_NAMES = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "post-rewrite",
+  "post-index-change",
+  "pre-auto-gc"
+];
+function renderWritePathDirectives(home, specs) {
+  return specs.map((spec) => `
+  (${spec.kind} "${escapeSeatbeltString(`${home}/${spec.homeRelative}`)}")`).join("");
+}
+function escapeSeatbeltString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+function regexEscapeString(value) {
+  return value.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
+function renderProviderStateWriteEntries(home, env, providerId) {
+  const specs = providerId ? getRequiredWritePathsForProvider(providerId, { env }) : getAllProviderWritePathSpecs({ env });
+  return specs.flatMap((spec) => {
+    if (spec.rejected) return [];
+    if (spec.kind === "regex") {
+      const anchoredPrefix = `^${regexEscapeString(home)}/`;
+      return [`
+  (regex "${escapeSeatbeltString(anchoredPrefix)}${spec.homeRelative}")`];
+    }
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) return [];
+    switch (spec.kind) {
+      case "literal":
+        return [`
+  (literal "${escapeSeatbeltString(resolved)}")`];
+      default:
+        return [`
+  (subpath "${escapeSeatbeltString(resolved)}")`];
+    }
+  }).join("");
+}
+function renderProviderStateWriteEntriesWithinWorkingDir(home, resolvedWorkingDir, env, providerId) {
+  const specs = providerId ? getRequiredWritePathsForProvider(providerId, { env }) : getAllProviderWritePathSpecs({ env });
+  const workingDirVariants = getMacosTempRootSymlinkVariants(resolvedWorkingDir);
+  const entries = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    if (spec.rejected || spec.kind === "regex") continue;
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) continue;
+    for (const candidate of getMacosTempRootSymlinkVariants(resolved)) {
+      const contained = workingDirVariants.some(
+        (workingDirVariant) => candidate !== workingDirVariant && isPathUnder(candidate, workingDirVariant)
+      );
+      if (!contained) continue;
+      const directive = spec.kind === "literal" ? "literal" : "subpath";
+      entries.add(`
+  (${directive} "${escapeSeatbeltString(candidate)}")`);
+    }
+  }
+  return [...entries].join("");
+}
+function renderCredentialWriteDenyEntries(realHome, envHome, allowAwsCredentialRead = false) {
+  return `${renderWritePathDirectives(realHome, getCredentialDenySpecs(allowAwsCredentialRead))}${renderWritePathDirectives(
+    realHome,
+    TOOLCHAIN_CREDENTIAL_DENY_SPECS
+  )}${renderWritePathDirectives(envHome, PROVIDER_TOKEN_WRITE_DENY_SPECS)}`;
+}
+function renderCodexAuthJsonRedenyEntries(home, env) {
+  const authPaths = /* @__PURE__ */ new Set();
+  authPaths.add(path4.join(home, ".codex", "auth.json"));
+  const specs = getRequiredWritePathsForProvider("codex", {
+    env: env ?? { HOME: home },
+    includeSharedPaths: false
+  });
+  for (const spec of specs) {
+    if (spec.rejected) continue;
+    const resolved = resolveWritePathSpec(spec, home);
+    if (!resolved) continue;
+    authPaths.add(path4.join(resolved, "auth.json"));
+  }
+  return [...authPaths].flatMap((authPath) => getMacosTempRootSymlinkVariants(authPath)).map((authPath) => `
+  (literal "${escapeSeatbeltString(authPath)}")`).join("");
+}
+function renderCredentialRedenyEntries(realHome, envHome, env, allowAwsCredentialRead = false) {
+  return `
+  ;; Credential directories/files must be re-denied after the write allow block.
+  ;; macOS seatbelt uses last-match-wins, so the early read/write deny is not
+  ;; enough if a runtime provider path accidentally overlaps a credential path.${renderCredentialWriteDenyEntries(realHome, envHome, allowAwsCredentialRead)}${renderCodexAuthJsonRedenyEntries(envHome, env)}`;
+}
+function renderProviderAuthorityWriteDenyEntries(env, providerId) {
+  const entries = /* @__PURE__ */ new Set();
+  for (const spec of getProviderAuthorityWriteDenyPathSpecs(providerId, { env })) {
+    const resolved = resolveWritePathSpec(spec, env?.HOME);
+    if (!resolved) continue;
+    for (const candidate of getMacosTempRootSymlinkVariants(resolved)) {
+      entries.add(`
+  (${spec.kind} "${escapeSeatbeltString(candidate)}")`);
+    }
+  }
+  return [...entries].join("");
+}
+var MACOS_TEMP_ROOT_PREFIXES = [
+  "/tmp",
+  "/private/tmp",
+  "/var/folders",
+  "/private/var/folders"
+];
+function normalizeSeatbeltPath(candidatePath) {
+  return candidatePath.replace(/\\/g, "/");
+}
+function isPathUnder(candidate, parent) {
+  const rel = path4.relative(parent, candidate);
+  return rel === "" || !!rel && !rel.startsWith("..") && !path4.isAbsolute(rel);
+}
+function isUnderMacosTempRoot(resolvedPath) {
+  const normalized = normalizeSeatbeltPath(path4.resolve(resolvedPath));
+  return MACOS_TEMP_ROOT_PREFIXES.some(
+    (root) => normalized === root || normalized.startsWith(`${root}/`)
+  );
+}
+function getMacosTempRootSymlinkVariants(resolvedPath) {
+  const normalized = normalizeSeatbeltPath(path4.resolve(resolvedPath));
+  const variants = /* @__PURE__ */ new Set([normalized]);
+  if (normalized === "/private/tmp" || normalized.startsWith("/private/tmp/")) {
+    variants.add(normalized.replace(/^\/private\/tmp/, "/tmp"));
+  } else if (normalized === "/tmp" || normalized.startsWith("/tmp/")) {
+    variants.add(normalized.replace(/^\/tmp/, "/private/tmp"));
+  }
+  if (normalized === "/private/var/folders" || normalized.startsWith("/private/var/folders/")) {
+    variants.add(normalized.replace(/^\/private\/var\/folders/, "/var/folders"));
+  } else if (normalized === "/var/folders" || normalized.startsWith("/var/folders/")) {
+    variants.add(normalized.replace(/^\/var\/folders/, "/private/var/folders"));
+  }
+  return Array.from(variants).sort();
+}
+function renderReadOnlyTempRootedDenyEntry(resolvedWorkingDir, readOnlyWorkingDir) {
+  if (!readOnlyWorkingDir || !isUnderMacosTempRoot(resolvedWorkingDir)) {
+    return "";
+  }
+  return getMacosTempRootSymlinkVariants(resolvedWorkingDir).map((candidate) => `
+  (subpath "${candidate}")`).join("");
+}
+var GIT_AUTHORITY_READ_TIMEOUT_MS = 5e3;
+function getGitWorktreeLayout(worktreePath) {
+  try {
+    const probe = execGitSync(
+      ["rev-parse", "--path-format=absolute", "--git-common-dir", "--git-dir"],
+      {
+        cwd: worktreePath,
+        timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+        scrubGitConfigFileOverrides: true
+      }
+    );
+    const [commonDir, worktreeGitDir] = probe.exitCode === 0 ? probe.stdout.trim().split(/\r?\n/) : [];
+    if (commonDir) {
+      return { projectRoot: path4.dirname(commonDir), worktreeGitDir };
+    }
+  } catch {
+  }
+  const normalizedPath = worktreePath.replace(/\\/g, "/");
+  const tmpWorktreeMarker = "/.poetic/tmp/worktrees/";
+  const tmpIdx = normalizedPath.indexOf(tmpWorktreeMarker);
+  if (tmpIdx > 0) {
+    return { projectRoot: normalizedPath.slice(0, tmpIdx) };
+  }
+  const labWorktreeMarker = "/.poetic/labs/";
+  const labIdx = normalizedPath.indexOf(labWorktreeMarker);
+  if (labIdx > 0) {
+    const suffix = normalizedPath.slice(labIdx + labWorktreeMarker.length);
+    const segments = suffix.split("/").filter(Boolean);
+    const isLabWorktreePath = segments.length >= 5 && segments[1] === "runs" && segments[3] === "worktrees";
+    if (isLabWorktreePath) {
+      return { projectRoot: normalizedPath.slice(0, labIdx) };
+    }
+  }
+  return {};
+}
+function generateSandboxProfile(workingDir, extraWritePaths, readOnlyWorkingDir = false, env, providerId, allowGitWrites = true, allowAwsCredentialRead = false) {
+  const realHome = process.env.HOME ?? os3.homedir();
+  const home = env?.HOME ?? realHome;
+  const resolvedWorkingDir = path4.resolve(workingDir);
+  const { projectRoot, worktreeGitDir } = getGitWorktreeLayout(resolvedWorkingDir);
+  const sharedGitDir = projectRoot ? path4.join(projectRoot, ".git") : void 0;
+  const sharedGitDirEntry = sharedGitDir && !readOnlyWorkingDir && allowGitWrites ? `
+  (subpath "${escapeSeatbeltString(sharedGitDir)}")` : "";
+  const workingDirWriteEntry = readOnlyWorkingDir ? "" : `
+  (subpath "${escapeSeatbeltString(resolvedWorkingDir)}")`;
+  const gitWriteGuardDirs = Array.from(
+    new Set([sharedGitDir, path4.join(resolvedWorkingDir, ".git")].filter((d) => !!d))
+  );
+  let gitHookConfigDenyEntry = gitWriteGuardDirs.map(
+    (g) => `
+  (subpath "${escapeSeatbeltString(`${g}/hooks`)}")
+  (literal "${escapeSeatbeltString(`${g}/config`)}")`
+  ).join("");
+  if (!allowGitWrites) {
+    gitHookConfigDenyEntry += Array.from(
+      new Set(
+        [sharedGitDir, path4.join(resolvedWorkingDir, ".git")].filter(
+          (gitDir) => !!gitDir
+        )
+      )
+    ).flatMap((gitDir) => getMacosTempRootSymlinkVariants(gitDir)).map((gitDir) => `
+  (subpath "${escapeSeatbeltString(gitDir)}")`).join("");
+  }
+  let sharedGitRefDenyEntry = "";
+  let activeGitRefAllowEntry = "";
+  if (sharedGitDir && !readOnlyWorkingDir && allowGitWrites) {
+    const protectedGitPaths = [
+      path4.join(sharedGitDir, "refs"),
+      path4.join(sharedGitDir, "logs", "refs"),
+      path4.join(sharedGitDir, "packed-refs"),
+      path4.join(sharedGitDir, "packed-refs.lock")
+    ];
+    sharedGitRefDenyEntry = protectedGitPaths.flatMap((protectedPath) => getMacosTempRootSymlinkVariants(protectedPath)).map((protectedPath) => `
+  (subpath "${escapeSeatbeltString(protectedPath)}")`).join("");
+    try {
+      const head = execGitSync(["symbolic-ref", "--quiet", "HEAD"], {
+        cwd: resolvedWorkingDir,
+        timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+        scrubGitConfigFileOverrides: true
+      });
+      const activeRef = head.exitCode === 0 ? head.stdout.trim() : "";
+      if (activeRef && /^refs\/heads\/[A-Za-z0-9._/-]+$/.test(activeRef) && !activeRef.includes("..")) {
+        const refPath = path4.join(sharedGitDir, activeRef);
+        const logPath = path4.join(sharedGitDir, "logs", activeRef);
+        activeGitRefAllowEntry = [refPath, `${refPath}.lock`, logPath, `${logPath}.lock`].flatMap((activePath) => getMacosTempRootSymlinkVariants(activePath)).map((activePath) => `
+  (literal "${escapeSeatbeltString(activePath)}")`).join("");
+      }
+    } catch {
+    }
+  }
+  const worktreeGitfile = path4.join(resolvedWorkingDir, ".git");
+  if (sharedGitDir) {
+    try {
+      const stat = fs2.lstatSync(worktreeGitfile);
+      const match = stat.isFile() ? /^gitdir:\s*(.+)\s*$/i.exec(fs2.readFileSync(worktreeGitfile, "utf8").trim()) : null;
+      if (match?.[1]) {
+        const declaredGitDir = path4.resolve(resolvedWorkingDir, match[1]);
+        const actualGitDir = worktreeGitDir;
+        if (!actualGitDir) throw new Error("Git did not report a worktree git directory");
+        const realDeclaredGitDir = fs2.realpathSync(declaredGitDir);
+        const realActualGitDir = fs2.realpathSync(actualGitDir);
+        const realSharedGitDir = fs2.realpathSync(sharedGitDir);
+        if (realDeclaredGitDir === realActualGitDir && isPathUnder(realActualGitDir, path4.join(realSharedGitDir, "worktrees"))) {
+          gitHookConfigDenyEntry += getMacosTempRootSymlinkVariants(worktreeGitfile).map((gitfile) => `
+  (literal "${escapeSeatbeltString(gitfile)}")`).join("");
+        }
+      }
+    } catch {
+    }
+  }
+  const profileStorageDenyEntry = `
+  (subpath "${escapeSeatbeltString(
+    getSandboxProfileStorageDirectory()
+  )}")`;
+  const isAllowedExtraWritePath = (resolved) => resolved === resolvedWorkingDir || !!sharedGitDir && (resolved === sharedGitDir || isPathUnder(resolved, sharedGitDir)) || isPathUnder(resolved, resolvedWorkingDir) || isUnderMacosTempRoot(resolved) || isAllowedRuntimeWritePath(resolved, env);
+  const droppedExtraWritePaths = [];
+  const grantedExtraWritePaths = (extraWritePaths || []).map((p) => path4.resolve(p)).filter((p) => p && p !== resolvedWorkingDir && p !== sharedGitDir).filter((p) => {
+    if (isAllowedExtraWritePath(p)) return true;
+    droppedExtraWritePaths.push(p);
+    return false;
+  }).sort();
+  const isUnderBroadWriteRoot = (candidate) => isUnderMacosTempRoot(candidate) || !!sharedGitDir && (candidate === sharedGitDir || isPathUnder(candidate, sharedGitDir)) || grantedExtraWritePaths.some((root) => candidate === root || isPathUnder(candidate, root));
+  try {
+    const hooksPathProbe = execGitSync(["config", "--get", "core.hooksPath"], {
+      cwd: resolvedWorkingDir,
+      timeoutMs: GIT_AUTHORITY_READ_TIMEOUT_MS,
+      scrubGitConfigFileOverrides: true
+    });
+    const hooksPathRaw = hooksPathProbe.exitCode === 0 ? hooksPathProbe.stdout.trim() : "";
+    if (hooksPathRaw) {
+      const absHooksPath = path4.isAbsolute(hooksPathRaw) ? path4.resolve(hooksPathRaw) : path4.resolve(resolvedWorkingDir, hooksPathRaw);
+      const rel = path4.relative(resolvedWorkingDir, absHooksPath);
+      if (rel === "") {
+        if (!readOnlyWorkingDir) {
+          for (const hookName of CLIENT_SIDE_GIT_HOOK_NAMES) {
+            gitHookConfigDenyEntry += `
+  (literal "${escapeSeatbeltString(
+              path4.join(resolvedWorkingDir, hookName)
+            )}")`;
+          }
+        }
+      } else {
+        const strictlyInside = !rel.startsWith("..") && !path4.isAbsolute(rel);
+        if (strictlyInside) {
+          if (!readOnlyWorkingDir) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(absHooksPath)}")`;
+            try {
+              const realHooksPath = fs2.realpathSync(absHooksPath);
+              if (realHooksPath !== absHooksPath) {
+                gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(realHooksPath)}")`;
+              }
+            } catch {
+            }
+          }
+        } else {
+          let realHooksPath;
+          try {
+            realHooksPath = fs2.realpathSync(absHooksPath);
+          } catch {
+          }
+          if (isUnderBroadWriteRoot(absHooksPath)) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(absHooksPath)}")`;
+          }
+          if (realHooksPath && realHooksPath !== absHooksPath && isUnderBroadWriteRoot(realHooksPath)) {
+            gitHookConfigDenyEntry += `
+  (subpath "${escapeSeatbeltString(realHooksPath)}")`;
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  const extraWritePathsEntry = grantedExtraWritePaths.map((p) => `
+  (subpath "${escapeSeatbeltString(p)}")`).join("");
+  if (droppedExtraWritePaths.length > 0 && isDebugMode()) {
+    process.stderr.write(
+      `[sandbox] dropped out-of-allowed-root extraWritePaths: ${droppedExtraWritePaths.join(", ")}
+`
+    );
+  }
+  const readOnlyTempRootedDenyEntry = renderReadOnlyTempRootedDenyEntry(
+    resolvedWorkingDir,
+    readOnlyWorkingDir
+  );
+  const readOnlyProviderStateReallowEntry = readOnlyTempRootedDenyEntry ? renderProviderStateWriteEntriesWithinWorkingDir(home, resolvedWorkingDir, env, providerId) : "";
+  const providerAuthorityWriteDenyEntry = renderProviderAuthorityWriteDenyEntries(env, providerId);
+  return `(version 1)
+(deny default)
+
+;; ============================================
+;; FILESYSTEM READ ACCESS (BROAD)
+;; ============================================
+;; Allow reading most of the filesystem - the security
+;; boundary is on WRITE access, not read access.
+;; This matches Claude Code's default behavior.
+(allow file-read* (subpath "/"))
+
+;; ============================================
+;; EXPLICIT DENY - SENSITIVE DIRECTORIES
+;; ============================================
+;; Protect credentials, keys, and secrets from read/write
+;; These are blocked even with broad filesystem read access
+(deny file-read* file-write*
+${renderWritePathDirectives(realHome, getCredentialDenySpecs(allowAwsCredentialRead))}
+)
+
+;; ============================================
+;; EXPLICIT DENY - TOOLCHAIN CREDENTIAL WRITES
+;; ============================================
+;; Allow build caches, but prevent tampering with common local credential files.
+;; Safe for ordinary target builds against public package registries, and reduces
+;; the risk of an AI process modifying user credential configuration.
+(deny file-write*
+${renderWritePathDirectives(realHome, TOOLCHAIN_CREDENTIAL_DENY_SPECS)}
+)
+
+;; ============================================
+;; AI CLI PROVIDER CREDENTIALS (ALLOWED)
+;; ============================================
+;; These directories are needed for AI CLI tools to authenticate.
+;; Read access is allowed by removing them from the deny list. Some CLIs also
+;; require small, scoped write access for token caches (e.g. AWS SSO), which is
+;; granted below under FILESYSTEM WRITE ACCESS.
+;; - ~/.aws: Bedrock backends only (allowAwsCredentialRead);
+;;   missing attestation fails closed and denies ~/.aws)
+;; - ~/.config/gh: GitHub Copilot CLI
+;; - ~/.gcloud, ~/.config/gcloud: Gemini CLI
+;; - ~/.config/opencode: OpenCode CLI state
+
+;; ============================================
+;; FILESYSTEM WRITE ACCESS (RESTRICTED)
+;; ============================================
+;; This is the main security boundary - writes are
+;; restricted to worktree, temp dirs, caches, and
+;; CLI tool state directories.
+  (allow file-write*${workingDirWriteEntry}${sharedGitDirEntry}
+  ;; macOS temp directories - allow both symlinked and canonical paths
+  ;; /var/folders is a symlink to /private/var/folders, but sandbox-exec
+  ;; doesn't resolve symlinks when checking paths, so we need both
+  (subpath "/var/folders")
+  (subpath "/private/var/folders")
+  (subpath "/private/tmp")
+  (subpath "/tmp")
+  ;; Credential/token caches required by some provider auth flows. These are not
+  ;; declared in provider manifests (they live under the otherwise-denied ~/.aws
+  ;; tree and are scoped to the cache subdirs only).
+  (subpath "${escapeSeatbeltString(`${home}/.aws/cli/cache`)}")
+  (subpath "${escapeSeatbeltString(`${home}/.aws/sso/cache`)}")
+  ;; NOTE: macOS Keychain write access is NOT granted here. Providers that store
+  ;; credentials in the system keychain declare ~/Library/Keychains in their own
+  ;; manifest (provider-manifests.ts) so the grant is provider-scoped and is
+  ;; covered by the inherited-sandbox capability probe. Reading a keychain secret
+  ;; genuinely requires WRITE access (Security.framework updates lock/session
+  ;; state and the db during a lookup), so a keychain-backed provider that also
+  ;; hits a GUI authorization prompt on first read has TWO independent gates:
+  ;; this profile and the keychain item's own per-item ACL, which no sandbox
+  ;; profile can satisfy. An unattended run blocks on that prompt until a human
+  ;; chooses "Always Allow"; a provider that stalls unattended after working
+  ;; interactively is the ACL gate, not this profile.
+  ;; Provider state/config/cache and Poetic runtime paths, derived from the
+  ;; filesystem manifests (provider-manifests.ts) so the granted allowlist stays
+  ;; in lockstep with the sandbox capability probe.${renderProviderStateWriteEntries(home, env, providerId)}
+  (subpath "/dev")${extraWritePathsEntry}
+)
+
+${readOnlyTempRootedDenyEntry ? `;; ============================================
+;; READ-ONLY WORKING DIR (TEMP-ROOTED DENY)
+;; ============================================
+;; When readOnlyWorkingDir omits the working-dir write entry, macOS temp-root
+;; allows still grant writes under /tmp and /var/folders. Re-deny the resolved
+;; working dir (and symlink variants) after those allows so last-match-wins
+;; restores read-only enforcement for temp-rooted repos.
+(deny file-write*${readOnlyTempRootedDenyEntry}
+)
+
+` : ""}${readOnlyProviderStateReallowEntry ? `;; ============================================
+;; PROVIDER RUNTIME STATE INSIDE READ-ONLY WORKTREE (ALLOW)
+;; ============================================
+;; Re-open only manifest-declared provider runtime state beneath the worktree.
+;; Credential files are re-denied by the following block.
+(allow file-write*${readOnlyProviderStateReallowEntry}
+)
+
+` : ""};; ============================================
+;; CREDENTIAL WRITE SURFACES (DENY)
+;; ============================================
+;; Re-deny credential writes after the provider write allow block so
+;; environment-derived paths cannot reopen sensitive locations under
+;; last-match-wins seatbelt semantics. Includes Codex auth.json under the
+;; default ~/.codex root and any granted isolated/custom CODEX_HOME.
+(deny file-write*${renderCredentialRedenyEntries(realHome, home, env, allowAwsCredentialRead)}
+)
+
+${providerAuthorityWriteDenyEntry ? `;; ============================================
+;; PROVIDER SETTINGS AND HOOK SURFACES (DENY)
+;; ============================================
+;; Provider runtime state remains writable for auth and session operation, but
+;; settings and hook storage can change policy or execute outside this run.
+;; Re-deny those manifest-declared persistent authority surfaces post-allow.
+(deny file-write*${providerAuthorityWriteDenyEntry}
+)
+
+` : ""};; ============================================
+;; GIT EXECUTABLE/AUTHORITY SURFACES (DENY)
+;; ============================================
+;; Block writes to git hooks and config even though the surrounding .git is
+;; writable for normal worktree operations. This closes deferred host code
+;; execution (planted hooks / core.hooksPath) without breaking commits.
+;; Placed AFTER the write-allow block so it wins under last-match-wins.
+(deny file-write*${gitHookConfigDenyEntry}${profileStorageDenyEntry}
+)
+
+${sharedGitRefDenyEntry ? `;; Shared Git refs are global across linked worktrees. Deny all ref writes, then
+;; reopen only this worktree's active branch ref and reflog for normal commits.
+(deny file-write*${sharedGitRefDenyEntry}
+)` : ""}
+${activeGitRefAllowEntry ? `(allow file-write*${activeGitRefAllowEntry}
+)` : ""}
+
+;; ============================================
+;; IPC & MACH (FOR CLI AUTH + SUBPROCESSES)
+;; ============================================
+(allow mach*)
+(allow ipc*)
+
+;; ============================================
+;; NETWORK (OUTBOUND + LOCAL SERVER)
+;; ============================================
+(allow network-outbound)
+;; Some CLIs (notably OpenCode) start a local loopback server even for one-shot
+;; commands (e.g. "opencode run"). Allow inbound connections but restrict binds
+;; to loopback interfaces only.
+(allow network-inbound)
+(allow network-bind (local ip "localhost:*"))
+
+;; ============================================
+;; PROCESS EXECUTION
+;; ============================================
+(allow process-exec*)
+(allow process-fork)
+(allow signal)
+(allow sysctl-read)
+`;
+}
+
+// src/core/sandbox/profile-cache.ts
+var profileCache = /* @__PURE__ */ new Map();
+function getProfileBaseDir() {
+  return getSandboxProfileStorageDirectory();
+}
+function getProfileCacheKey(profile) {
+  return crypto.createHash("sha256").update(profile).digest("hex");
+}
+function isExpectedProfile(profilePath, profile) {
+  try {
+    const stat = fs3.lstatSync(profilePath);
+    return stat.isFile() && !stat.isSymbolicLink() && (stat.mode & 511) === 384 && fs3.readFileSync(profilePath, "utf8") === profile;
+  } catch {
+    return false;
+  }
+}
+function ensurePrivateStorageDirectory(baseDir) {
+  fs3.mkdirSync(baseDir, { recursive: true, mode: 448 });
+  const stat = fs3.lstatSync(baseDir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Sandbox profile storage is not a private directory: ${baseDir}`);
+  }
+  if ((stat.mode & 511) !== 448) {
+    fs3.chmodSync(baseDir, 448);
+  }
+}
+function writeProfileAtomically(profilePath, profile) {
+  const temporaryPath = `${profilePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs3.writeFileSync(temporaryPath, profile, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs3.renameSync(temporaryPath, profilePath);
+    fs3.chmodSync(profilePath, 384);
+  } finally {
+    try {
+      fs3.rmSync(temporaryPath, { force: true });
+    } catch {
+    }
+  }
+}
+function getOrCreateProfile(workingDir, extraWritePaths, readOnlyWorkingDir = false, env, providerId, allowGitWrites = true, allowAwsCredentialRead = false) {
+  const profile = generateSandboxProfile(
+    workingDir,
+    extraWritePaths,
+    readOnlyWorkingDir,
+    env,
+    providerId,
+    allowGitWrites,
+    allowAwsCredentialRead
+  );
+  const cacheKey = getProfileCacheKey(profile);
+  const baseDir = getProfileBaseDir();
+  ensurePrivateStorageDirectory(baseDir);
+  const profilePath = path5.join(baseDir, `${cacheKey}.sb`);
+  const cached = profileCache.get(cacheKey);
+  if (cached === profilePath && isExpectedProfile(cached, profile)) {
+    return cached;
+  }
+  if (!isExpectedProfile(profilePath, profile)) {
+    writeProfileAtomically(profilePath, profile);
+  }
+  profileCache.set(cacheKey, profilePath);
+  return profilePath;
+}
+function registerGlobalCleanup() {
+}
+
+// src/core/sandbox/index.ts
+var sandboxTelemetryLog = [];
+function isTestRuntime() {
+  return Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID);
+}
+function isBooleanTrueEnv(value) {
+  if (value === void 0) return false;
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+function isContainerAttestedByEnv(env) {
+  const source = env ?? process.env;
+  const attestedClaim = env ? isBooleanTrueEnv(source[POETIC_SANDBOX_CONTAINER_ATTESTED.name]) : readEnv(POETIC_SANDBOX_CONTAINER_ATTESTED).value === true;
+  const provenanceClaim = env ? source[POETIC_SANDBOX_PROVENANCE.name] === "container" : readRawEnv(POETIC_SANDBOX_PROVENANCE) === "container";
+  if (!attestedClaim && !provenanceClaim) return false;
+  return hasContainerOsSignal();
+}
+function isLinuxHostClassProvenance(provenance) {
+  return provenance === "linux_isolated" || provenance === "linux_acknowledged" || provenance === "linux_desktop_unacked";
+}
+function isLinuxWriteProvenance(provenance) {
+  return provenance === "linux_isolated" || provenance === "linux_acknowledged";
+}
+function normalizeProviderName(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function hasExplicitSandboxOptOut(providerName, providerId) {
+  if (!isImplicitTestRuntimeSandboxDisable()) {
+    return !isSandboxEnabled(providerName, providerId);
+  }
+  return isProviderSandboxOptOut(providerName, providerId);
+}
+function isSandboxEnabledForProvider(providerName, providerId) {
+  return isSandboxEnabled(providerName, providerId);
+}
+function willSandboxBeActive(providerName, providerId, options) {
+  const enabled = isSandboxEnabled(providerName, providerId);
+  if (!enabled) return false;
+  if (isSandboxSupported() && !(isKernelSandboxActive() && isNestedSandboxReinitDenied())) {
+    return true;
+  }
+  const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+  if (isLinuxHostClassProvenance(attestation.provenance)) {
+    return false;
+  }
+  return isSandboxBoundaryAccepted(attestation, resolveEnvSandboxBoundaryPolicy());
+}
+function isSandboxEnforcementOperational(providerName, providerId) {
+  if (!willSandboxBeActive(providerName, providerId)) return false;
+  return isSandboxEnforcementSupported();
+}
+function isSelfGeneratedSeatbeltOperational(providerName, providerId) {
+  if (!isSandboxEnabled(providerName, providerId)) return false;
+  if (!isSandboxSupported()) return false;
+  return isSandboxEnforcementSupported();
+}
+function requireActiveSandboxBoundary(providerName, reason, providerId, options) {
+  const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+  const effectivePolicy = resolveEnvSandboxBoundaryPolicy();
+  const accepted = isSandboxBoundaryAccepted(attestation, effectivePolicy);
+  if (accepted) {
+    return attestation;
+  }
+  if (os4.platform() === "linux") {
+    const authorized = authorizeLinuxHostClassWrites(options);
+    if (authorized.status === "allowed") {
+      return {
+        provenance: authorized.provenance,
+        evidence: attestation.evidence
+      };
+    }
+  }
+  throw new ProviderExecutionError(
+    `[${providerName}] ${reason} requires an active sandbox boundary, but none is available (provenance=${attestation.provenance}) [reason=sandbox_boundary_required]`,
+    { retryable: false, reason: "sandbox_boundary_required" }
+  );
+}
+function provenanceProvesPolicyByConstruction(attestation) {
+  return attestation.provenance === "seatbelt_self";
+}
+function provenanceSkipsCapabilityProbe(attestation) {
+  return attestation.provenance === "seatbelt_self" || attestation.provenance === "linux_isolated" || attestation.provenance === "linux_acknowledged";
+}
+function policyProofForAcceptedBoundary(attestation, providerId, env) {
+  if (isLinuxWriteProvenance(attestation.provenance)) {
+    return "linux_host_class";
+  }
+  if (provenanceProvesPolicyByConstruction(attestation)) {
+    return "wrap_applied";
+  }
+  const capability = probeProviderSandboxCapability(providerId, {
+    env,
+    includeSharedPaths: false
+  });
+  return capability.capable ? "capability_probe" : void 0;
+}
+function boundaryProofForProvenance(provenance) {
+  switch (provenance) {
+    case "seatbelt_self":
+      return void 0;
+    case "container":
+      return "container";
+    case "inherited_outer":
+      return "inherited_outer";
+    case "linux_isolated":
+      return "linux_isolated";
+    case "linux_acknowledged":
+      return "linux_acknowledged";
+    default:
+      return void 0;
+  }
+}
+function requireActivePolicyBoundary(providerName, reason, providerId, options = {}) {
+  const attestation = requireActiveSandboxBoundary(providerName, reason, providerId, options);
+  if (provenanceSkipsCapabilityProbe(attestation)) {
+    return { attestation, kind: "policy" };
+  }
+  const capability = probeProviderSandboxCapability(providerId ?? providerName.toLowerCase(), {
+    env: options.env,
+    includeSharedPaths: false
+  });
+  if (capability.capable) {
+    return { attestation, kind: "policy", capability };
+  }
+  recordSandboxDecision({
+    providerName,
+    providerId: providerId ?? providerName.toLowerCase(),
+    sandboxed: false,
+    reason: "sandbox_capability_denied",
+    provenance: attestation.provenance,
+    deniedPaths: capability.missing.map((entry) => entry.path),
+    platform: os4.platform()
+  });
+  throw new ProviderExecutionError(
+    `[${providerName}] ${reason}: ${formatSandboxCapabilityFailure(capability)} [reason=sandbox_capability_denied]`,
+    { retryable: false, reason: "sandbox_capability_denied" }
+  );
+}
+function shouldBypassProviderInternalSandbox(providerName, reason, providerId, options = {}) {
+  requireActivePolicyBoundary(providerName, reason, providerId, options);
+  return true;
+}
+function detectSandboxBoundaryAttestation(providerName, providerId, options) {
+  const seatbeltSelfOperational = isSelfGeneratedSeatbeltOperational(providerName, providerId);
+  const sandboxRuntimeEnv = process.env.SANDBOX_RUNTIME === "1";
+  const kernelSandboxActive = isKernelSandboxActive();
+  const nestedSandboxReinitDenied = isNestedSandboxReinitDenied();
+  const containerAttested = isContainerAttestedByEnv(options?.env);
+  const evidence = {
+    seatbeltSelfOperational,
+    sandboxRuntimeEnv,
+    kernelSandboxActive,
+    nestedSandboxReinitDenied,
+    containerAttested
+  };
+  if (seatbeltSelfOperational) {
+    return { provenance: "seatbelt_self", evidence };
+  }
+  const linuxResolution = os4.platform() === "linux" ? resolveLinuxHostClass(options) : null;
+  const forcedDesktop = linuxResolution?.source === "env_desktop" || linuxResolution?.evidence.envHostClass === "desktop";
+  if (containerAttested && !forcedDesktop) {
+    return { provenance: "container", evidence };
+  }
+  if (linuxResolution?.hostClass === "isolated" && linuxResolution.source !== "container_attested") {
+    logLinuxHostClassNote(linuxResolution.note);
+    return { provenance: "linux_isolated", evidence };
+  }
+  const inheritedOuterAttested = kernelSandboxActive && (sandboxRuntimeEnv || nestedSandboxReinitDenied);
+  if (inheritedOuterAttested) {
+    return { provenance: "inherited_outer", evidence };
+  }
+  if (linuxResolution?.hostClass === "desktop-acked") {
+    logLinuxHostClassNote(linuxResolution.note);
+    return { provenance: "linux_acknowledged", evidence };
+  }
+  if (linuxResolution?.hostClass === "desktop-unacked") {
+    return { provenance: "linux_desktop_unacked", evidence };
+  }
+  return { provenance: "none", evidence };
+}
+function resolveSandboxBoundaryPolicy(raw) {
+  return raw === "strict" ? "strict" : "attested_outer_ok";
+}
+function resolveEnvSandboxBoundaryPolicy() {
+  return resolveSandboxBoundaryPolicy(readRawEnv(POETIC_SANDBOX_BOUNDARY_POLICY));
+}
+function isAttestedInheritedOuterBoundary(attestation) {
+  return attestation.provenance === "inherited_outer" && attestation.evidence.kernelSandboxActive && attestation.evidence.nestedSandboxReinitDenied;
+}
+function isSandboxBoundaryAccepted(attestation, policy) {
+  if (attestation.provenance === "seatbelt_self" || attestation.provenance === "container") {
+    return true;
+  }
+  if (isLinuxWriteProvenance(attestation.provenance)) {
+    return os4.platform() === "linux";
+  }
+  if (policy === "attested_outer_ok" && isAttestedInheritedOuterBoundary(attestation)) {
+    return true;
+  }
+  return false;
+}
+function warnSandboxEnforcementUnavailable() {
+  logSandboxEnforcementUnavailable();
+}
+function isImplicitTestRuntimeSandboxDisable() {
+  return isTestRuntime() && process.env.POETIC_SANDBOX_ENABLED === void 0;
+}
+function isSandboxEnabled(providerName, providerId) {
+  if (isImplicitTestRuntimeSandboxDisable()) {
+    return false;
+  }
+  return !isProviderSandboxOptOut(providerName, providerId);
+}
+function isProviderSandboxOptOut(providerName, providerId) {
+  const globalDisabled = process.env.POETIC_SANDBOX_ENABLED === "0";
+  if (globalDisabled) return true;
+  const normalizedName = normalizeProviderName(providerName);
+  const nameOverride = process.env[`POETIC_SANDBOX_${normalizedName}_ENABLED`];
+  if (nameOverride === "0") return true;
+  if (providerId) {
+    const normalizedId = normalizeProviderName(providerId);
+    const idOverride = process.env[`POETIC_SANDBOX_${normalizedId}_ENABLED`];
+    if (idOverride === "0") return true;
+  }
+  return false;
+}
+function validateCustomSandboxProfile(profilePath) {
+  let contents;
+  try {
+    const stat = fs4.statSync(profilePath);
+    if (!stat.isFile()) {
+      throw new ProviderExecutionError(
+        `[Sandbox] POETIC_SANDBOX_PROFILE_PATH is not a regular file: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+        { retryable: false, reason: "invalid_custom_sandbox_profile" }
+      );
+    }
+    contents = fs4.readFileSync(profilePath, "utf8");
+  } catch (error) {
+    if (error instanceof ProviderExecutionError) throw error;
+    throw new ProviderExecutionError(
+      `[Sandbox] POETIC_SANDBOX_PROFILE_PATH could not be read: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+  const policy = contents.replace(/;.*$/gm, "");
+  const hasDenyDefault = /\(\s*deny\s+default\s*\)/.test(policy);
+  const hasAllowDefault = /\(\s*allow\s+default\s*\)/.test(policy);
+  if (hasAllowDefault) {
+    throw new ProviderExecutionError(
+      `[Sandbox] Custom sandbox profile contains (allow default), which grants an unrestricted sandbox: ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+  if (!hasDenyDefault) {
+    throw new ProviderExecutionError(
+      `[Sandbox] Custom sandbox profile must contain (deny default): ${profilePath} [reason=invalid_custom_sandbox_profile]`,
+      { retryable: false, reason: "invalid_custom_sandbox_profile" }
+    );
+  }
+}
+function unwrappedAcceptedBoundaryResult(attestation, config, platform) {
+  const boundaryProof = boundaryProofForProvenance(attestation.provenance);
+  if (boundaryProof === void 0) {
+    return void 0;
+  }
+  const policyProof = policyProofForAcceptedBoundary(
+    attestation,
+    config.providerId ?? config.providerName.toLowerCase(),
+    config.env
+  );
+  const linuxHostClass = isLinuxWriteProvenance(attestation.provenance);
+  logSandboxTelemetry(
+    {
+      providerName: config.providerName,
+      sandboxed: !linuxHostClass,
+      reason: attestation.provenance,
+      platform,
+      workingDir: config.workingDir
+    },
+    {
+      provenance: attestation.provenance,
+      boundaryProof,
+      policyProof,
+      providerId: config.providerId ?? config.providerName.toLowerCase()
+    }
+  );
+  return {
+    command: config.command,
+    args: config.args,
+    // Host class is write permission, not confinement. Gate 3 checks proofs.
+    sandboxed: !linuxHostClass,
+    boundaryProof,
+    policyProof
+  };
+}
+function wrapWithSandbox(config, options) {
+  const {
+    workingDir,
+    command,
+    args,
+    providerName,
+    extraWritePaths,
+    readOnlyWorkingDir,
+    allowGitWrites,
+    requiresBoundaryForWrites,
+    providerId,
+    env
+  } = config;
+  const platform = os4.platform();
+  let reason;
+  const runningUnderVitest = isTestRuntime();
+  if (!isSandboxEnabled(providerName, providerId)) {
+    const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+    const boundaryPolicy = resolveEnvSandboxBoundaryPolicy();
+    if (isSandboxBoundaryAccepted(attestation, boundaryPolicy)) {
+      const accepted = unwrappedAcceptedBoundaryResult(attestation, config, platform);
+      if (accepted) {
+        return accepted;
+      }
+    }
+    const globalDisabled = process.env.POETIC_SANDBOX_ENABLED === "0";
+    const disabledKey = providerId ? `provider_disabled_${providerId}` : `provider_disabled_${providerName}`;
+    reason = globalDisabled ? "globally_disabled" : disabledKey;
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    if (requiresBoundaryForWrites && !readOnlyWorkingDir && !hasExplicitSandboxOptOut(providerName, providerId)) {
+      if (platform === "linux") {
+        authorizeLinuxHostClassWrites(options);
+      }
+      throw new ProviderExecutionError(
+        `[${providerName}] write-capable provider execution requires an active sandbox boundary; the sandbox is disabled only by an implicit test-runtime signal (reason=${reason}). Set POETIC_SANDBOX_ENABLED=0 explicitly to accept unconfined execution [reason=sandbox_boundary_required]`,
+        { retryable: false, reason: "sandbox_boundary_required", providerName }
+      );
+    }
+    return { command, args, sandboxed: false };
+  }
+  if (!isSandboxSupported()) {
+    const attestation = detectSandboxBoundaryAttestation(providerName, providerId, options);
+    const boundaryPolicy = resolveEnvSandboxBoundaryPolicy();
+    if (isSandboxBoundaryAccepted(attestation, boundaryPolicy)) {
+      const accepted = unwrappedAcceptedBoundaryResult(attestation, config, platform);
+      if (accepted) {
+        return accepted;
+      }
+    }
+    if (platform !== "linux") {
+      logSandboxUnavailable();
+    }
+    reason = platform === "darwin" ? "sandbox_exec_not_found" : "unsupported_platform";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    if (requiresBoundaryForWrites && !readOnlyWorkingDir) {
+      if (platform === "linux") {
+        const authorized = authorizeLinuxHostClassWrites(options);
+        if (authorized.status === "allowed") {
+          const allowedAttestation = {
+            provenance: authorized.provenance,
+            evidence: attestation.evidence
+          };
+          const accepted = unwrappedAcceptedBoundaryResult(allowedAttestation, config, platform);
+          if (accepted) {
+            return accepted;
+          }
+        }
+      }
+      throw new ProviderExecutionError(
+        `[${providerName}] write-capable provider execution requires an active sandbox boundary, but none is available on this platform (platform=${platform}, provenance=${attestation.provenance}) [reason=sandbox_boundary_required]`,
+        { retryable: false, reason: "sandbox_boundary_required", providerName }
+      );
+    }
+    return { command, args, sandboxed: false };
+  }
+  if (!readOnlyWorkingDir && !runningUnderVitest && isKernelSandboxActive() && isNestedSandboxReinitDenied()) {
+    const inheritedAttestation = {
+      provenance: "inherited_outer",
+      evidence: {
+        seatbeltSelfOperational: false,
+        sandboxRuntimeEnv: process.env.SANDBOX_RUNTIME === "1",
+        kernelSandboxActive: true,
+        nestedSandboxReinitDenied: true,
+        containerAttested: isContainerAttestedByEnv()
+      }
+    };
+    if (!isSandboxBoundaryAccepted(inheritedAttestation, resolveEnvSandboxBoundaryPolicy())) {
+      logSandboxTelemetry({
+        providerName,
+        sandboxed: false,
+        reason: "inherited_outer_rejected_by_policy",
+        platform,
+        workingDir
+      });
+      if (requiresBoundaryForWrites) {
+        throw new ProviderExecutionError(
+          `[${providerName}] write-capable provider execution requires an active sandbox boundary, but the inherited outer boundary is rejected under POETIC_SANDBOX_BOUNDARY_POLICY=strict [reason=sandbox_boundary_required]`,
+          { retryable: false, reason: "sandbox_boundary_required", providerName }
+        );
+      }
+      return { command, args, sandboxed: false };
+    }
+    reason = "inherited_outer";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: true,
+      reason,
+      platform,
+      workingDir
+    });
+    return {
+      command,
+      args,
+      sandboxed: true,
+      boundaryProof: "inherited_outer",
+      policyProof: policyProofForAcceptedBoundary(
+        inheritedAttestation,
+        providerId ?? providerName.toLowerCase(),
+        env
+      )
+    };
+  }
+  const customProfile = process.env.POETIC_SANDBOX_PROFILE_PATH;
+  let profilePath;
+  try {
+    if (customProfile) {
+      validateCustomSandboxProfile(customProfile);
+      profilePath = customProfile;
+    } else {
+      profilePath = getOrCreateProfile(
+        workingDir,
+        extraWritePaths,
+        readOnlyWorkingDir,
+        env,
+        providerId ?? providerName.toLowerCase(),
+        allowGitWrites,
+        resolveAllowAwsCredentialRead({
+          providerId: providerId ?? providerName.toLowerCase(),
+          env,
+          workingDir
+        })
+      );
+      registerGlobalCleanup();
+    }
+  } catch (error) {
+    reason = "profile_generation_failed";
+    logSandboxTelemetry({
+      providerName,
+      sandboxed: false,
+      reason,
+      platform,
+      workingDir
+    });
+    throw error;
+  }
+  const policyProof = customProfile ? void 0 : "wrap_applied";
+  logSandboxTelemetry(
+    {
+      providerName,
+      sandboxed: true,
+      platform,
+      workingDir,
+      customProfile: !!customProfile
+    },
+    {
+      provenance: "seatbelt_self",
+      boundaryProof: "wrap_applied",
+      policyProof,
+      providerId: providerId ?? providerName.toLowerCase()
+    }
+  );
+  return {
+    command: "sandbox-exec",
+    args: ["-f", profilePath, command, ...args],
+    sandboxed: true,
+    boundaryProof: "wrap_applied",
+    policyProof
+  };
+}
+function logSandboxTelemetry(entry, durable) {
+  sandboxTelemetryLog.push({
+    ...entry,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (sandboxTelemetryLog.length > 100) {
+    sandboxTelemetryLog = sandboxTelemetryLog.slice(-100);
+  }
+  recordSandboxDecision({
+    providerName: entry.providerName,
+    providerId: durable?.providerId,
+    sandboxed: entry.sandboxed,
+    reason: entry.reason,
+    provenance: durable?.provenance,
+    boundaryProof: durable?.boundaryProof,
+    policyProof: durable?.policyProof,
+    platform: entry.platform
+  });
+}
+function getSandboxTelemetry() {
+  return [...sandboxTelemetryLog];
+}
+function clearSandboxTelemetry() {
+  sandboxTelemetryLog = [];
+}
+function getSandboxStatusSummary() {
+  const byProvider = {};
+  const byReason = {};
+  let sandboxedCount = 0;
+  let unsandboxedCount = 0;
+  for (const entry of sandboxTelemetryLog) {
+    if (entry.sandboxed) {
+      sandboxedCount++;
+    } else {
+      unsandboxedCount++;
+      if (entry.reason) {
+        byReason[entry.reason] = (byReason[entry.reason] || 0) + 1;
+      }
+    }
+    if (!byProvider[entry.providerName]) {
+      byProvider[entry.providerName] = { sandboxed: 0, unsandboxed: 0 };
+    }
+    const providerStats = byProvider[entry.providerName];
+    if (entry.sandboxed) {
+      providerStats.sandboxed++;
+    } else {
+      providerStats.unsandboxed++;
+    }
+  }
+  return {
+    totalExecutions: sandboxTelemetryLog.length,
+    sandboxedCount,
+    unsandboxedCount,
+    byProvider,
+    byReason
+  };
+}
+
+export {
+  isSandboxSupported,
+  isSandboxEnforcementSupported,
+  LOCAL_CI_PUBLICATION_MAC_KEY_HOME_RELATIVE_DIR,
+  beginHostPublicationGenerationJournal,
+  abandonHostPublicationGenerationJournal,
+  recoverHostPublicationGeneration,
+  syncHostPublicationGeneration,
+  attachOutstandingStatusPublicationMac,
+  outstandingStatusPublicationMacIsValid,
+  hasExplicitSandboxOptOut,
+  isSandboxEnabledForProvider,
+  willSandboxBeActive,
+  isSandboxEnforcementOperational,
+  requireActiveSandboxBoundary,
+  requireActivePolicyBoundary,
+  shouldBypassProviderInternalSandbox,
+  detectSandboxBoundaryAttestation,
+  resolveSandboxBoundaryPolicy,
+  resolveEnvSandboxBoundaryPolicy,
+  isAttestedInheritedOuterBoundary,
+  isSandboxBoundaryAccepted,
+  warnSandboxEnforcementUnavailable,
+  wrapWithSandbox,
+  getSandboxTelemetry,
+  clearSandboxTelemetry,
+  getSandboxStatusSummary
+};
+//# sourceMappingURL=chunk-PCAGC5MR.js.map