@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-5WCQRDRB.js

@@ -0,0 +1,588 @@
+import {
+  getContainedHomeSiblingRuntimeRoot
+} from "./chunk-UUH2RVKS.js";
+
+// src/core/sandbox/provider-manifests.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+var sub = (homeRelative, note) => ({
+  kind: "subpath",
+  homeRelative,
+  note
+});
+var lit = (homeRelative, note) => ({
+  kind: "literal",
+  homeRelative,
+  note
+});
+var rgx = (homeRelative, note) => ({
+  kind: "regex",
+  homeRelative,
+  note
+});
+var absoluteSubpath = (absolutePath, note) => ({
+  kind: "subpath",
+  homeRelative: absolutePath,
+  absolutePath,
+  note
+});
+var rejectedRuntimeDir = (absolutePath, note) => ({
+  kind: "subpath",
+  homeRelative: absolutePath,
+  absolutePath,
+  note,
+  rejected: true
+});
+var POETIC_SHARED_WRITE_PATHS = [
+  // `.poetic` covers the default config/data/state roots (~/.poetic/{config,data,state})
+  // as well as the runtime dirs that always lived there. The two XDG entries remain
+  // for installs that explicitly set XDG_STATE_HOME / XDG_DATA_HOME.
+  sub(".poetic", "Poetic home (config/data/state and runtime dirs)"),
+  sub(".local/state/poetic", "Poetic XDG state (legacy/explicit XDG_STATE_HOME)"),
+  sub(".local/share/poetic", "Poetic XDG data (legacy/explicit XDG_DATA_HOME)")
+];
+var COMMON_TOOLCHAIN_WRITE_PATHS = [
+  sub(".cache", "XDG cache"),
+  sub("Library/Caches", "macOS user caches"),
+  sub(".npm"),
+  sub(".bun"),
+  sub(".m2"),
+  sub(".gradle")
+];
+var PROVIDER_MANIFESTS = {
+  "project-verification": {
+    providerId: "project-verification",
+    requiredWritePaths: [
+      ...COMMON_TOOLCHAIN_WRITE_PATHS,
+      sub(".cargo/registry"),
+      sub(".cargo/git"),
+      sub(".nuget/packages"),
+      sub(".pub-cache"),
+      sub(".gem"),
+      sub("Library/pnpm/store"),
+      sub(".local/share/pnpm/store"),
+      sub("go/pkg/mod")
+    ]
+  },
+  claude: {
+    providerId: "claude",
+    requiredWritePaths: [
+      sub(".claude", "Claude CLI state"),
+      lit(".claude.json", "Claude CLI root config"),
+      // Claude writes a lock dir + atomic temp files next to ~/.claude.json;
+      // blocking these forces non-atomic writes that can corrupt the config.
+      sub(".claude.json.lock", "Claude CLI atomic-write lock"),
+      rgx("\\.claude\\.json\\.tmp\\.[^/]+$", "Claude CLI atomic-write temp")
+    ],
+    // Claude needs its state root writable for auth/session/runtime state, but
+    // these locations alter policy or supply hook code to later invocations.
+    // Re-deny only those authority-bearing surfaces rather than the whole root.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "settings.json" },
+      { kind: "literal", relativePath: "settings.local.json" },
+      { kind: "subpath", relativePath: "hooks" },
+      { kind: "subpath", relativePath: "plugins" }
+    ]
+  },
+  codex: {
+    providerId: "codex",
+    requiredWritePaths: [sub(".codex", "Codex CLI state (CODEX_HOME)")],
+    // config.toml / profile sidecars steer later invocations (model_provider,
+    // approvals). auth.json stays writable — it is required Codex state, not a
+    // deferred-execution policy surface.
+    persistentAuthorityWriteDenyPaths: [{ kind: "literal", relativePath: "config.toml" }]
+  },
+  copilot: {
+    providerId: "copilot",
+    requiredWritePaths: [
+      sub(".copilot", "Copilot CLI state"),
+      sub("Library/Application Support/github-copilot", "Copilot macOS state"),
+      sub("Library/Application Support/GitHub Copilot", "Copilot macOS state"),
+      sub(".config/gh", "gh CLI auth used by Copilot")
+    ]
+  },
+  cursor: {
+    providerId: "cursor",
+    requiredWritePaths: [sub(".cursor", "Cursor CLI state")],
+    // User-level MCP config is loaded by later Cursor turns (`--approve-mcps`
+    // and project `.cursor/mcp.json` are the documented MCP surfaces).
+    // cli-config.json remains writable (auth/session).
+    persistentAuthorityWriteDenyPaths: [{ kind: "literal", relativePath: "mcp.json" }]
+  },
+  gemini: {
+    providerId: "gemini",
+    requiredWritePaths: [
+      sub(".gemini", "Gemini CLI state"),
+      sub(".gcloud", "gcloud auth cache"),
+      sub(".config/gcloud", "gcloud auth config"),
+      // Gemini CLI 0.53.1 stores an interactively-entered API key in the macOS
+      // Keychain (service "gemini-cli-api-key"). Security.framework updates
+      // lock/session state and the keychain db during an ordinary LOOKUP, so
+      // reading a secret requires WRITE access here — a read grant is not
+      // sufficient. Established by bisection: granting only login.keychain-db,
+      // that file plus the session UUID dir, or plus a .fl* lock regex all fail,
+      // and granting the directory then re-denying the db also fails.
+      //
+      // Declared per-provider (not in the shared write block) so only providers
+      // that actually need the keychain receive it, and so the inherited-sandbox
+      // capability probe checks it — an outer sandbox that denies this path now
+      // fails closed as sandbox_capability_denied instead of launching Gemini
+      // with its internal protections bypassed and failing at credential access.
+      sub("Library/Keychains", "macOS Keychain state for Gemini CLI API-key lookup")
+    ]
+  },
+  grok: {
+    providerId: "grok",
+    requiredWritePaths: [sub(".grok", "Grok CLI session/auth state")],
+    // Unmatched tools inherit always-approve / ask rules from config.toml.
+    persistentAuthorityWriteDenyPaths: [{ kind: "literal", relativePath: "config.toml" }]
+  },
+  kiro: {
+    providerId: "kiro",
+    requiredWritePaths: [sub(".kiro", "Kiro CLI state"), sub(".config/kiro", "Kiro CLI config")]
+  },
+  antigravity: {
+    providerId: "antigravity",
+    // Antigravity (`agy`) is built on the Gemini stack and writes across the
+    // whole ~/.gemini tree at runtime: OAuth token (~/.gemini/oauth_creds.json),
+    // auto-created project config (~/.gemini/config/projects/*.json), and CLI
+    // state (~/.gemini/antigravity-cli/). Granting the subtree mirrors the
+    // gemini manifest; scoping to subdirs caused `operation not permitted` on
+    // the project-config write and a hard exit 2 under the seatbelt.
+    requiredWritePaths: [sub(".gemini", "Antigravity/Gemini CLI state, OAuth, and project config")]
+  },
+  opencode: {
+    providerId: "opencode",
+    requiredWritePaths: [sub(".config/opencode", "OpenCode CLI state")],
+    // Isolated runs already treat these as user config (commands / agents)
+    // that would otherwise leak into later invocations.
+    persistentAuthorityWriteDenyPaths: [
+      { kind: "literal", relativePath: "opencode/opencode.json" },
+      { kind: "literal", relativePath: "opencode/config.json" },
+      { kind: "subpath", relativePath: "opencode/agent" }
+    ]
+  },
+  pi: {
+    providerId: "pi",
+    // Pi writes auth.json, models.json, the model store, and a security event
+    // log under ~/.pi/agent. Poetic passes --no-session so session files are not
+    // created, but the agent dir itself is still written at startup: without
+    // this grant Pi dies with EPERM on mkdir before the model is reached.
+    requiredWritePaths: [sub(".pi", "Pi agent auth, model catalog, and event log")]
+  }
+};
+function getKnownSandboxProviderIds() {
+  return Object.keys(PROVIDER_MANIFESTS).sort();
+}
+function getProviderFilesystemManifest(providerId) {
+  if (!providerId) return void 0;
+  return PROVIDER_MANIFESTS[providerId.toLowerCase()];
+}
+function getRequiredWritePathsForProvider(providerId, options = {}) {
+  const manifest = getProviderFilesystemManifest(providerId);
+  const providerPaths = resolveRuntimeProviderWritePaths(providerId, manifest, options.env);
+  return [
+    ...providerPaths,
+    ...options.includeSharedPaths === false ? [] : resolveRuntimeSharedWritePaths(options.env)
+  ];
+}
+function getProviderAuthorityWriteDenyPathSpecs(providerId, options = {}) {
+  const manifests = providerId ? [getProviderFilesystemManifest(providerId)].filter(
+    (manifest) => !!manifest
+  ) : Object.values(PROVIDER_MANIFESTS);
+  const seen = /* @__PURE__ */ new Set();
+  const results = [];
+  for (const manifest of manifests) {
+    const denyPaths = manifest.persistentAuthorityWriteDenyPaths;
+    if (!denyPaths?.length) continue;
+    const runtimeRoots = resolveRuntimeProviderWritePaths(
+      manifest.providerId,
+      manifest,
+      options.env
+    );
+    const roots = providerId ? runtimeRoots : [...manifest.requiredWritePaths, ...runtimeRoots];
+    for (const rootSpec of roots) {
+      if (rootSpec.rejected || rootSpec.kind !== "subpath") continue;
+      const isOpencode = manifest.providerId === "opencode";
+      const isOpencodeRuntimeRoot = rootSpec.note?.includes("OpenCode XDG_") === true;
+      if (isOpencodeRuntimeRoot && !rootSpec.note?.includes("XDG_CONFIG_HOME")) continue;
+      const root = resolveWritePathSpec(rootSpec, options.env?.HOME);
+      if (!root) continue;
+      for (const denyPath of denyPaths) {
+        const relativePath = isOpencode && !isOpencodeRuntimeRoot ? denyPath.relativePath.replace(/^opencode\//, "") : denyPath.relativePath;
+        const absolutePath = path.join(root, relativePath);
+        const key = `${denyPath.kind}:${absolutePath}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        results.push({
+          kind: denyPath.kind,
+          homeRelative: absolutePath,
+          absolutePath,
+          note: `${manifest.providerId} persistent authority surface`
+        });
+      }
+    }
+  }
+  return results;
+}
+function isPathWithin(candidate, parent) {
+  const relative = path.relative(parent, candidate);
+  return relative === "" || !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function allowedRuntimeConfigRoots(env = process.env) {
+  const roots = /* @__PURE__ */ new Set();
+  const home = env?.HOME ?? process.env.HOME ?? os.homedir();
+  if (home) {
+    const resolvedHome = path.resolve(home);
+    roots.add(path.join(resolvedHome, ".config", "poetic"));
+    roots.add(path.join(resolvedHome, ".poetic"));
+    roots.add(path.join(resolvedHome, ".local", "share", "poetic"));
+    roots.add(path.join(resolvedHome, ".local", "state", "poetic"));
+    roots.add(path.join(resolvedHome, ".claude"));
+    roots.add(path.join(resolvedHome, ".codex"));
+    roots.add(path.join(resolvedHome, ".pi"));
+  }
+  const containedRuntimeRoot = getContainedHomeSiblingRuntimeRoot(env);
+  if (containedRuntimeRoot) {
+    roots.add(containedRuntimeRoot);
+  }
+  roots.add(path.join(path.resolve(process.cwd()), ".poetic"));
+  for (const tmpRoot of [
+    os.tmpdir(),
+    "/tmp",
+    "/private/tmp",
+    "/var/folders",
+    "/private/var/folders"
+  ]) {
+    if (tmpRoot) roots.add(path.resolve(tmpRoot));
+  }
+  return [...roots];
+}
+function resolveExistingPathPrefix(candidate) {
+  const segments = [];
+  let current = candidate;
+  while (!fs.existsSync(current)) {
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return path.resolve(candidate);
+    }
+    segments.unshift(path.basename(current));
+    current = parent;
+  }
+  try {
+    const realPrefix = fs.realpathSync(current);
+    return path.join(realPrefix, ...segments);
+  } catch {
+    return void 0;
+  }
+}
+function expandLeadingTilde(rawValue) {
+  if (rawValue === void 0) return void 0;
+  const trimmed = rawValue.trim();
+  if (!trimmed) return trimmed;
+  if (trimmed !== "~" && !trimmed.startsWith("~/")) return trimmed;
+  const home = process.env.HOME ?? os.homedir();
+  if (!home) return trimmed;
+  return trimmed === "~" ? home : path.join(home, trimmed.slice(2));
+}
+function resolveAllowedRuntimeConfigDir(rawValue, env) {
+  const trimmed = rawValue?.trim();
+  if (!trimmed) return void 0;
+  const resolved = resolveExistingPathPrefix(path.resolve(trimmed));
+  if (!resolved) return void 0;
+  return isAllowedRuntimeWritePath(resolved, env) ? resolved : void 0;
+}
+function isAllowedRuntimeWritePath(absolutePath, env = process.env) {
+  if (!absolutePath || !path.isAbsolute(absolutePath)) return false;
+  const resolved = resolveExistingPathPrefix(path.resolve(absolutePath));
+  if (!resolved) return false;
+  return allowedRuntimeConfigRoots(env).some((root) => {
+    const resolvedRoot = resolveExistingPathPrefix(root);
+    return resolvedRoot ? isPathWithin(resolved, resolvedRoot) : false;
+  });
+}
+function resolveRuntimeProviderWritePaths(providerId, manifest, env) {
+  const normalized = providerId?.toLowerCase();
+  const basePaths = manifest?.requiredWritePaths ?? [];
+  if (normalized === "claude") {
+    const configDir = resolveAllowedRuntimeConfigDir(env?.CLAUDE_CONFIG_DIR, env);
+    if (configDir) {
+      return [absoluteSubpath(configDir, "Claude CLI config dir (CLAUDE_CONFIG_DIR)")];
+    }
+    return basePaths;
+  }
+  if (normalized === "cursor") {
+    const configDir = resolveAllowedRuntimeConfigDir(
+      env?.CURSOR_CONFIG_DIR ?? env?.POETIC_CURSOR_CONFIG_DIR,
+      env
+    );
+    if (configDir) {
+      return [absoluteSubpath(configDir, "Cursor CLI config dir (CURSOR_CONFIG_DIR)")];
+    }
+    return basePaths;
+  }
+  if (normalized === "codex") {
+    const rawCodexHome = expandLeadingTilde(env?.CODEX_HOME);
+    if (rawCodexHome) {
+      const configDir = resolveAllowedRuntimeConfigDir(rawCodexHome, env);
+      return [
+        configDir ? absoluteSubpath(configDir, "Codex CLI state (CODEX_HOME)") : rejectedRuntimeDir(
+          path.resolve(rawCodexHome),
+          "Codex CLI state (CODEX_HOME, rejected: outside allowed roots)"
+        )
+      ];
+    }
+    return basePaths;
+  }
+  if (normalized === "opencode") {
+    const xdgDirs = [
+      { value: env?.XDG_DATA_HOME, note: "OpenCode XDG_DATA_HOME (isolated)" },
+      { value: env?.XDG_CONFIG_HOME, note: "OpenCode XDG_CONFIG_HOME (isolated)" },
+      { value: env?.XDG_STATE_HOME, note: "OpenCode XDG_STATE_HOME (isolated)" },
+      { value: env?.XDG_CACHE_HOME, note: "OpenCode XDG_CACHE_HOME (isolated)" }
+    ];
+    const anyPresent = xdgDirs.some((d) => d.value?.trim());
+    if (!anyPresent) {
+      return basePaths;
+    }
+    const resolvedSpecs = [];
+    for (const { value, note } of xdgDirs) {
+      const trimmed = value?.trim();
+      if (!trimmed) continue;
+      const resolved = resolveAllowedRuntimeConfigDir(trimmed, env);
+      resolvedSpecs.push(
+        resolved ? absoluteSubpath(resolved, note) : rejectedRuntimeDir(path.resolve(trimmed), `${note} (rejected: outside allowed roots)`)
+      );
+    }
+    return resolvedSpecs.length > 0 ? resolvedSpecs : basePaths;
+  }
+  if (normalized === "pi") {
+    const rawAgentDir = expandLeadingTilde(env?.PI_CODING_AGENT_DIR);
+    if (rawAgentDir) {
+      const configDir = resolveAllowedRuntimeConfigDir(rawAgentDir, env);
+      return [
+        configDir ? absoluteSubpath(configDir, "Pi agent dir (PI_CODING_AGENT_DIR)") : rejectedRuntimeDir(
+          path.resolve(rawAgentDir),
+          "Pi agent dir (PI_CODING_AGENT_DIR, rejected: outside allowed roots)"
+        )
+      ];
+    }
+    return basePaths;
+  }
+  return basePaths;
+}
+function resolveRuntimePoeticStatePath(env) {
+  const poeticHome = env.POETIC_HOME?.trim();
+  if (poeticHome) {
+    const statePath = path.join(poeticHome, "state");
+    const resolved = resolveAllowedRuntimeConfigDir(statePath, env);
+    return resolved ? absoluteSubpath(resolved, "Poetic home state dir (POETIC_HOME/state)") : rejectedRuntimeDir(
+      path.resolve(statePath),
+      "Poetic home state dir (POETIC_HOME/state, rejected: outside allowed roots)"
+    );
+  }
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome) {
+    const resolved = resolveAllowedRuntimeConfigDir(path.join(xdgStateHome, "poetic"), env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Poetic XDG state (XDG_STATE_HOME)");
+    }
+  }
+  return void 0;
+}
+function resolveRuntimeSharedWritePaths(env) {
+  if (!env) return POETIC_SHARED_WRITE_PATHS;
+  const stateDir = resolveRuntimePoeticStatePath(env);
+  const dataDir = resolveRuntimePoeticDataPath(env);
+  const configDir = resolveAllowedRuntimeConfigDir(env.POETIC_CONFIG_DIR, env);
+  if (!stateDir && !dataDir && !configDir) return POETIC_SHARED_WRITE_PATHS;
+  return [
+    stateDir ?? sub(".poetic", "Poetic home state (default ~/.poetic/state)"),
+    dataDir ?? sub(".poetic", "Poetic home data (default ~/.poetic/data)"),
+    configDir ? absoluteSubpath(configDir, "Poetic config dir (POETIC_CONFIG_DIR)") : sub(".poetic", "Poetic home config and runtime dirs")
+  ];
+}
+function resolveRuntimePoeticDataPath(env) {
+  const explicitDataDir = env.POETIC_DATA_DIR?.trim();
+  if (explicitDataDir) {
+    const resolved = resolveAllowedRuntimeConfigDir(explicitDataDir, env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Poetic data dir (POETIC_DATA_DIR)");
+    }
+  }
+  const poeticHome = env.POETIC_HOME?.trim();
+  if (poeticHome) {
+    const dataPath = path.join(poeticHome, "data");
+    const resolved = resolveAllowedRuntimeConfigDir(dataPath, env);
+    return resolved ? absoluteSubpath(resolved, "Poetic home data dir (POETIC_HOME/data)") : rejectedRuntimeDir(
+      path.resolve(dataPath),
+      "Poetic home data dir (POETIC_HOME/data, rejected: outside allowed roots)"
+    );
+  }
+  const xdgDataHome = env.XDG_DATA_HOME?.trim();
+  if (xdgDataHome) {
+    const resolved = resolveAllowedRuntimeConfigDir(path.join(xdgDataHome, "poetic"), env);
+    if (resolved) {
+      return absoluteSubpath(resolved, "Poetic XDG data (XDG_DATA_HOME)");
+    }
+  }
+  return void 0;
+}
+function getAllProviderWritePathSpecs(options = {}) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  const pushUnique = (spec) => {
+    const key = `${spec.kind}:${spec.absolutePath ?? spec.homeRelative}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    result.push(spec);
+  };
+  for (const manifest of Object.values(PROVIDER_MANIFESTS)) {
+    for (const spec of manifest.requiredWritePaths) pushUnique(spec);
+  }
+  const claudeRuntimeConfigDir = resolveAllowedRuntimeConfigDir(
+    options.env?.CLAUDE_CONFIG_DIR,
+    options.env
+  );
+  if (claudeRuntimeConfigDir) {
+    pushUnique(
+      absoluteSubpath(claudeRuntimeConfigDir, "Claude CLI config dir (CLAUDE_CONFIG_DIR)")
+    );
+  }
+  const cursorRuntimeConfigDir = resolveAllowedRuntimeConfigDir(
+    options.env?.CURSOR_CONFIG_DIR ?? options.env?.POETIC_CURSOR_CONFIG_DIR,
+    options.env
+  );
+  if (cursorRuntimeConfigDir) {
+    pushUnique(
+      absoluteSubpath(cursorRuntimeConfigDir, "Cursor CLI config dir (CURSOR_CONFIG_DIR)")
+    );
+  }
+  for (const spec of resolveRuntimeSharedWritePaths(options.env)) pushUnique(spec);
+  for (const spec of COMMON_TOOLCHAIN_WRITE_PATHS) pushUnique(spec);
+  return result;
+}
+function resolveWritePathSpec(spec, home = process.env.HOME ?? os.homedir()) {
+  if (spec.kind === "regex") return void 0;
+  if (spec.absolutePath) return spec.absolutePath;
+  return `${home}/${spec.homeRelative}`;
+}
+
+// src/core/sandbox/capability-probe.ts
+import fs2 from "fs";
+import path2 from "path";
+function probePathWritable(targetPath, probeSuffix) {
+  const spec = { kind: "subpath", homeRelative: targetPath };
+  let dir = targetPath;
+  let existing;
+  for (let i = 0; i < 64; i += 1) {
+    if (fs2.existsSync(dir)) {
+      existing = dir;
+      break;
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  if (!existing) {
+    return { path: targetPath, spec, writable: false, detail: "no existing ancestor directory" };
+  }
+  let probeDir = existing;
+  try {
+    if (!fs2.statSync(existing).isDirectory()) {
+      probeDir = path2.dirname(existing);
+    }
+  } catch (error) {
+    return {
+      path: targetPath,
+      spec,
+      writable: false,
+      detail: error instanceof Error ? error.message : String(error)
+    };
+  }
+  const probeEntry = path2.join(probeDir, `.poetic-cap-${probeSuffix}`);
+  try {
+    fs2.writeFileSync(probeEntry, "", { flag: "wx" });
+    return { path: targetPath, spec, writable: true };
+  } catch (error) {
+    return {
+      path: targetPath,
+      spec,
+      writable: false,
+      detail: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    try {
+      fs2.rmSync(probeEntry, { force: true });
+    } catch {
+    }
+  }
+}
+var probeCounter = 0;
+function probeProviderSandboxCapability(providerId, options = {}) {
+  const specs = getRequiredWritePathsForProvider(providerId, {
+    env: options.env,
+    includeSharedPaths: options.includeSharedPaths
+  });
+  const probed = [];
+  for (const spec of specs) {
+    if (spec.rejected) {
+      const rejectedPath = spec.absolutePath ?? resolveWritePathSpec(spec, options.home) ?? "";
+      probed.push({
+        path: rejectedPath,
+        spec,
+        writable: false,
+        detail: "explicit runtime dir outside allowed roots (rejected by sandbox policy)"
+      });
+      continue;
+    }
+    const resolved = resolveWritePathSpec(spec, options.home);
+    if (!resolved) continue;
+    probeCounter += 1;
+    const suffix = `${process.pid}-${probeCounter}`;
+    const result = probePathWritable(resolved, suffix);
+    probed.push({ ...result, spec });
+  }
+  const missing = probed.filter((r) => !r.writable);
+  return {
+    providerId,
+    capable: missing.length === 0,
+    probed,
+    missing
+  };
+}
+function formatSandboxDegradedSummary(result) {
+  const provider = result.providerId ?? "provider";
+  const paths = result.missing.map((entry) => entry.path).join(", ");
+  return paths ? `${provider}: sandbox blocked (${paths})` : `${provider}: sandbox/policy blocked`;
+}
+function formatSandboxCapabilityFailure(result, context = {}) {
+  const provider = result.providerId ?? "provider";
+  const label = context.role ? `[${provider}/${context.role}]` : `[${provider}]`;
+  const deniedPaths = result.missing.map((entry) => entry.path).join(", ");
+  const lines = result.missing.map((m) => {
+    const note = m.spec.note ? ` (${m.spec.note})` : "";
+    const detail = m.detail ? `: ${m.detail}` : "";
+    return `  - ${m.path}${note}${detail}`;
+  });
+  return [
+    `${label} sandbox/policy blocked: required state path(s) not writable under the effective sandbox.`,
+    deniedPaths ? `Denied path(s): ${deniedPaths}` : void 0,
+    "This is a sandbox/policy access issue; the provider may still be authenticated or configured.",
+    ...lines
+  ].filter((line) => Boolean(line)).join("\n");
+}
+
+export {
+  getKnownSandboxProviderIds,
+  getRequiredWritePathsForProvider,
+  getProviderAuthorityWriteDenyPathSpecs,
+  isAllowedRuntimeWritePath,
+  getAllProviderWritePathSpecs,
+  resolveWritePathSpec,
+  probeProviderSandboxCapability,
+  formatSandboxDegradedSummary,
+  formatSandboxCapabilityFailure
+};
+//# sourceMappingURL=chunk-5WCQRDRB.js.map