@prestyj/cli 5.9.0 → 5.11.0

package/dist/core/sandbox-domains.js

@@ -0,0 +1,76 @@
+/**
+ * Default network allowlist for the OS command sandbox.
+ *
+ * The sandbox is allowlist-only (a bare `*` is rejected), so shipping it on by
+ * default is only viable if ordinary development still works untouched. These
+ * are the hosts mainstream toolchains actually contact for dependency
+ * resolution, source checkout and registry auth — nothing that reads user data.
+ *
+ * Deliberately excluded: arbitrary app/API hosts, telemetry endpoints and
+ * URL shorteners. A project that needs one adds it once in Settings, which is
+ * the moment the boundary earns its keep.
+ */
+export const DEFAULT_ALLOWED_DOMAINS = [
+    // ── Source hosting (git clone/fetch/push over HTTPS) ──
+    "github.com",
+    "*.github.com",
+    "*.githubusercontent.com",
+    "gitlab.com",
+    "*.gitlab.com",
+    "bitbucket.org",
+    "*.bitbucket.org",
+    "codeberg.org",
+    // ── JavaScript ──
+    "registry.npmjs.org",
+    "*.npmjs.org",
+    "registry.yarnpkg.com",
+    "*.yarnpkg.com",
+    "jsr.io",
+    "deno.land",
+    "*.deno.land",
+    "unpkg.com",
+    "cdn.jsdelivr.net",
+    "*.jsdelivr.net",
+    "cdnjs.cloudflare.com",
+    // ── Python ──
+    "pypi.org",
+    "*.pypi.org",
+    "files.pythonhosted.org",
+    "*.pythonhosted.org",
+    // ── Go (module proxy + checksum database) ──
+    "proxy.golang.org",
+    "sum.golang.org",
+    "*.golang.org",
+    "storage.googleapis.com",
+    // ── Rust ──
+    "crates.io",
+    "*.crates.io",
+    "static.rust-lang.org",
+    "*.rust-lang.org",
+    // ── Ruby ──
+    "rubygems.org",
+    "*.rubygems.org",
+    // ── JVM ──
+    "repo1.maven.org",
+    "*.maven.org",
+    "repo.maven.apache.org",
+    "plugins.gradle.org",
+    "*.gradle.org",
+    // ── PHP ──
+    "packagist.org",
+    "*.packagist.org",
+    // ── .NET ──
+    "api.nuget.org",
+    "*.nuget.org",
+    // ── Containers ──
+    "docker.io",
+    "*.docker.io",
+    "*.docker.com",
+    "ghcr.io",
+    "quay.io",
+    "registry.k8s.io",
+    // ── macOS/Linux toolchain installers ──
+    "formulae.brew.sh",
+    "*.brew.sh",
+];
+//# sourceMappingURL=sandbox-domains.js.map

package/dist/core/sandbox-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-domains.js","sourceRoot":"","sources":["../../src/core/sandbox-domains.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,yDAAyD;IACzD,YAAY;IACZ,cAAc;IACd,yBAAyB;IACzB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,cAAc;IAEd,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,sBAAsB;IACtB,eAAe;IACf,QAAQ;IACR,WAAW;IACX,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,gBAAgB;IAChB,sBAAsB;IAEtB,eAAe;IACf,UAAU;IACV,YAAY;IACZ,wBAAwB;IACxB,oBAAoB;IAEpB,8CAA8C;IAC9C,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IAExB,aAAa;IACb,WAAW;IACX,aAAa;IACb,sBAAsB;IACtB,iBAAiB;IAEjB,aAAa;IACb,cAAc;IACd,gBAAgB;IAEhB,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;IAEd,YAAY;IACZ,eAAe;IACf,iBAAiB;IAEjB,aAAa;IACb,eAAe;IACf,aAAa;IAEb,mBAAmB;IACnB,WAAW;IACX,aAAa;IACb,cAAc;IACd,SAAS;IACT,SAAS;IACT,iBAAiB;IAEjB,yCAAyC;IACzC,kBAAkB;IAClB,WAAW;CACZ,CAAC"}

package/dist/core/sandbox-feedback.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Turn raw OS-sandbox denials into guidance the model can act on.
+ *
+ * A blocked command otherwise surfaces as inscrutable tool noise ("CONNECT
+ * tunnel failed, response 403", "Operation not permitted"), which the model
+ * tends to retry verbatim. Naming the boundary and the one-step fix is what
+ * turns a dead end into a recoverable turn.
+ */
+export interface SandboxDenialNote {
+    kind: "network" | "filesystem";
+    note: string;
+}
+/**
+ * Inspect finished command output for a sandbox denial.
+ *
+ * @param output   Combined stdout/stderr as returned to the model.
+ * @param sandboxed Whether this command actually ran isolated.
+ */
+export declare function describeSandboxDenial(output: string, sandboxed: boolean): SandboxDenialNote | null;
+/** Append the denial note to command output when one applies. */
+export declare function annotateSandboxDenial(output: string, sandboxed: boolean): string;
+//# sourceMappingURL=sandbox-feedback.d.ts.map

package/dist/core/sandbox-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-feedback.d.ts","sourceRoot":"","sources":["../../src/core/sandbox-feedback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2BH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,GACjB,iBAAiB,GAAG,IAAI,CA6B1B;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAGhF"}

package/dist/core/sandbox-feedback.js

@@ -0,0 +1,69 @@
+/**
+ * Turn raw OS-sandbox denials into guidance the model can act on.
+ *
+ * A blocked command otherwise surfaces as inscrutable tool noise ("CONNECT
+ * tunnel failed, response 403", "Operation not permitted"), which the model
+ * tends to retry verbatim. Naming the boundary and the one-step fix is what
+ * turns a dead end into a recoverable turn.
+ */
+/** SRT's proxy rejection, plus how common clients report it. */
+const NETWORK_DENIAL = [
+    "blocked-by-allowlist",
+    "Connection blocked by network allowlist",
+    "CONNECT tunnel failed, response 403",
+];
+const FILESYSTEM_DENIAL = ["Operation not permitted", "operation not permitted", "EPERM"];
+/** Hosts the command tried to reach, best-effort, for a precise suggestion. */
+function extractHosts(output) {
+    const hosts = new Set();
+    const patterns = [
+        /(?:CONNECT|to)\s+([a-z0-9.-]+\.[a-z]{2,})(?::\d+)?/gi,
+        /https?:\/\/([a-z0-9.-]+\.[a-z]{2,})/gi,
+    ];
+    for (const pattern of patterns) {
+        for (const match of output.matchAll(pattern)) {
+            const host = match[1]?.toLowerCase();
+            if (host && !host.endsWith(".local"))
+                hosts.add(host);
+        }
+    }
+    return [...hosts].slice(0, 3);
+}
+/**
+ * Inspect finished command output for a sandbox denial.
+ *
+ * @param output   Combined stdout/stderr as returned to the model.
+ * @param sandboxed Whether this command actually ran isolated.
+ */
+export function describeSandboxDenial(output, sandboxed) {
+    if (!sandboxed || !output)
+        return null;
+    if (NETWORK_DENIAL.some((marker) => output.includes(marker))) {
+        const hosts = extractHosts(output);
+        const target = hosts.length > 0 ? hosts.join(", ") : "that host";
+        return {
+            kind: "network",
+            note: `\n\n[Sandbox] Network blocked: ${target} is not an approved destination. ` +
+                `Common package registries and git hosts are approved already, so double-check the ` +
+                `address first. If the user genuinely needs it, ask them to add it under ` +
+                `Settings → Command safety → Approved sites (or turn command safety off).`,
+        };
+    }
+    if (FILESYSTEM_DENIAL.some((marker) => output.includes(marker))) {
+        return {
+            kind: "filesystem",
+            note: `\n\n[Sandbox] Write blocked: that path is either outside this project or a ` +
+                `protected file (.env). Prefer a path inside the project, or use the write ` +
+                `tool if the user asked for that exact file. If they genuinely need shell ` +
+                `writes elsewhere, ask them to enable Settings → Command safety → Allow ` +
+                `changes outside the project.`,
+        };
+    }
+    return null;
+}
+/** Append the denial note to command output when one applies. */
+export function annotateSandboxDenial(output, sandboxed) {
+    const denial = describeSandboxDenial(output, sandboxed);
+    return denial ? `${output}${denial.note}` : output;
+}
+//# sourceMappingURL=sandbox-feedback.js.map

package/dist/core/sandbox-feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-feedback.js","sourceRoot":"","sources":["../../src/core/sandbox-feedback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,gEAAgE;AAChE,MAAM,cAAc,GAAG;IACrB,sBAAsB;IACtB,yCAAyC;IACzC,qCAAqC;CACtC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAE1F,+EAA+E;AAC/E,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG;QACf,sDAAsD;QACtD,uCAAuC;KACxC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,SAAkB;IAElB,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EACF,kCAAkC,MAAM,mCAAmC;gBAC3E,oFAAoF;gBACpF,0EAA0E;gBAC1E,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EACF,6EAA6E;gBAC7E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,yEAAyE;gBACzE,8BAA8B;SACjC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAkB;IACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC"}

package/dist/core/sandbox-feedback.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox-feedback.test.d.ts.map

package/dist/core/sandbox-feedback.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-feedback.test.d.ts","sourceRoot":"","sources":["../../src/core/sandbox-feedback.test.ts"],"names":[],"mappings":""}

package/dist/core/sandbox-feedback.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { annotateSandboxDenial, describeSandboxDenial } from "./sandbox-feedback.js";
+describe("describeSandboxDenial", () => {
+    it("names the blocked host and the one place a user can approve it", () => {
+        const output = "Exit code: 0\ncurl: (56) CONNECT tunnel failed, response 403\nCONNECT api.example.com:443";
+        const denial = describeSandboxDenial(output, true);
+        expect(denial?.kind).toBe("network");
+        expect(denial?.note).toContain("api.example.com");
+        expect(denial?.note).toContain("Approved sites");
+        // The model must not be told to silently give up or disable protection first.
+        expect(denial?.note).toContain("ask them");
+    });
+    it("points a blocked write back inside the project", () => {
+        const output = "touch: /Users/x/secret: Operation not permitted";
+        const denial = describeSandboxDenial(output, true);
+        expect(denial?.kind).toBe("filesystem");
+        expect(denial?.note).toContain("outside this project");
+    });
+    it("stays silent for ordinary failures and for unsandboxed commands", () => {
+        expect(describeSandboxDenial("Exit code: 1\nnpm ERR! missing script: buil", true)).toBeNull();
+        // Same text, but the command never ran isolated — the sandbox cannot be the cause.
+        expect(describeSandboxDenial("Operation not permitted", false)).toBeNull();
+    });
+    it("annotates output without discarding the original text", () => {
+        const output = "Exit code: 0\nConnection blocked by network allowlist";
+        const annotated = annotateSandboxDenial(output, true);
+        expect(annotated.startsWith(output)).toBe(true);
+        expect(annotated).toContain("[Sandbox]");
+        expect(annotateSandboxDenial(output, false)).toBe(output);
+    });
+});
+//# sourceMappingURL=sandbox-feedback.test.js.map

package/dist/core/sandbox-feedback.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-feedback.test.js","sourceRoot":"","sources":["../../src/core/sandbox-feedback.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAErF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GACV,2FAA2F,CAAC;QAE9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACjD,8EAA8E;QAC9E,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,iDAAiD,CAAC;QAEjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,qBAAqB,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9F,mFAAmF;QACnF,MAAM,CAAC,qBAAqB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,uDAAuD,CAAC;QAEvE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEtD,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/sandbox.d.ts

@@ -0,0 +1,91 @@
+import type { ShellResolution } from "./shell.js";
+export interface SandboxPolicy {
+    /**
+     * `workspace` always isolates and fails closed. `auto` isolates wherever the
+     * OS supports it and degrades with a warning where the prerequisites are
+     * absent, because SRT needs bubblewrap/socat on Linux and an elevated
+     * `windows-install` on Windows — enforcing there would break every command.
+     */
+    mode: "auto" | "workspace" | "off";
+    /**
+     * Extra hosts reachable while sandboxed, on top of
+     * {@link DEFAULT_ALLOWED_DOMAINS} unless {@link strictDomains} is set.
+     */
+    allowedDomains: string[];
+    /**
+     * Use only {@link allowedDomains}, dropping the built-in developer defaults.
+     * Set when the user has explicitly taken over network policy.
+     */
+    strictDomains?: boolean;
+    /** Extra workspace roots (multi-root sessions), mirroring the write guard. */
+    additionalRoots?: string[];
+    /** The user consented to writes outside the workspace; do not contradict them. */
+    allowOutsideWorkspaceWrites?: boolean;
+}
+export interface SandboxLaunch extends ShellResolution {
+    sandboxed: boolean;
+}
+/**
+ * Environment applied only to sandboxed commands.
+ *
+ * The sandbox permanently protects `.git/hooks`, and git's only reason to write
+ * there is copying inert `*.sample` templates during `init`/`clone` — which
+ * fails the whole command. Pointing git at an empty template directory removes
+ * that write, so cloning works with hook protection fully intact.
+ */
+export declare const SANDBOX_ENV_PATCH: Readonly<Record<string, string>>;
+interface SandboxSettings {
+    network: {
+        allowedDomains: string[];
+        deniedDomains: string[];
+        strictAllowlist: boolean;
+        allowUnixSockets: string[];
+        allowLocalBinding: boolean;
+    };
+    /**
+     * macOS only: let sandboxed processes reach `com.apple.trustd.agent`.
+     *
+     * Without it, every client that verifies certificates through Security
+     * framework fails — pip (truststore) and Go-based CLIs like gh, terraform
+     * and kubectl. We do not terminate TLS, so certificates are still validated
+     * against the real upstream and the domain allowlist still applies; this only
+     * restores certificate checking itself.
+     */
+    enableWeakerNetworkIsolation?: boolean;
+    filesystem: {
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+        /** Git cannot initialise or clone a repository without writing its config. */
+        allowGitConfig: boolean;
+    };
+}
+/** Pure policy builder, exported so the security boundary is regression-tested. */
+export declare function buildSandboxSettings(cwd: string, policy: SandboxPolicy, platform?: NodeJS.Platform): SandboxSettings;
+export declare function resetSandboxSupportProbeForTests(): void;
+/**
+ * Known limitations when `sandboxMode` is enabled (upstream, not fixable here):
+ *
+ * - **Linux pipes/redirections**: `echo hi | grep hi` fails with "Permission
+ *   denied" on /proc/self/fd/3 because bash's pipe setup clobbers the fd the
+ *   seccomp filter arrives on (sandbox-runtime#261).
+ * - **git over SSH**: `git@host:` remotes fail the SOCKS handshake on macOS —
+ *   the injected ProxyCommand uses `nc`, which cannot authenticate. HTTPS
+ *   remotes work. `~/.ssh` is also unreadable by design.
+ * - **`git config --global`**: `~/.gitconfig` is a mandatory upstream write
+ *   protection with no opt-out. Repo-local `git config` works.
+ * - **Corporate TLS interception / private registries**: need the CA and
+ *   registry host configured explicitly.
+ * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
+ *   degrades to no isolation (sandbox-runtime#428, #429).
+ *
+ * These are why the default is `off`; revisit when fixed upstream.
+ */
+/**
+ * Wrap an already-resolved shell with Anthropic's cross-platform OS sandbox.
+ * Initialization and dependency failures remain visible and fail closed: the
+ * original command is never spawned outside the sandbox as an implicit fallback.
+ */
+export declare function prepareSandboxLaunch(shell: ShellResolution, cwd: string, policy: SandboxPolicy): Promise<SandboxLaunch>;
+export {};
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/core/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,KAAK,CAAC;IACnC;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kFAAkF;IAClF,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D,CAAC;AAEF,UAAU,eAAe;IACvB,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;;;;OAQG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,8EAA8E;QAC9E,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAgED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,eAAe,CA+DjB;AAeD,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAwDD;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CA4BxB"}

package/dist/core/sandbox.js

@@ -0,0 +1,254 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { log } from "./logger.js";
+import { getAppPaths } from "../config.js";
+import { DEFAULT_ALLOWED_DOMAINS } from "./sandbox-domains.js";
+/**
+ * Environment applied only to sandboxed commands.
+ *
+ * The sandbox permanently protects `.git/hooks`, and git's only reason to write
+ * there is copying inert `*.sample` templates during `init`/`clone` — which
+ * fails the whole command. Pointing git at an empty template directory removes
+ * that write, so cloning works with hook protection fully intact.
+ */
+export const SANDBOX_ENV_PATCH = {
+    GIT_TEMPLATE_DIR: "",
+};
+const SANDBOX_CONFIG_DIR = path.join(os.homedir(), ".ezcoder", "sandbox-configs");
+const PROBE_TIMEOUT_MS = 20_000;
+let warnedUnsupported = false;
+function sensitiveReadPaths(home) {
+    return [
+        path.join(home, ".ssh"),
+        path.join(home, ".aws"),
+        path.join(home, ".gnupg"),
+        path.join(home, ".kube"),
+        path.join(home, ".config", "gcloud"),
+        path.join(home, ".azure"),
+        path.join(home, ".ezcoder", "auth.json"),
+    ];
+}
+/**
+ * Package-manager caches that live outside the workspace.
+ *
+ * `npm install`, `cargo build`, `go mod download` and friends all write to a
+ * shared cache in $HOME; without these the sandbox looks like it "breaks npm".
+ * Everything here is regenerable build state — no credentials, which stay
+ * unreadable via {@link sensitiveReadPaths}.
+ */
+function toolCacheDirs(home) {
+    return [
+        path.join(home, ".npm"),
+        path.join(home, ".cache"),
+        path.join(home, "Library", "Caches"),
+        path.join(home, ".pnpm-store"),
+        path.join(home, ".yarn"),
+        path.join(home, ".bun"),
+        path.join(home, ".deno"),
+        path.join(home, ".cargo"),
+        path.join(home, ".rustup"),
+        path.join(home, "go", "pkg", "mod"),
+        path.join(home, ".m2"),
+        path.join(home, ".gradle"),
+        path.join(home, ".gem"),
+        path.join(home, ".bundle"),
+        path.join(home, ".nuget"),
+        path.join(home, ".composer"),
+        path.join(home, ".local", "share", "virtualenvs"),
+    ];
+}
+/**
+ * A path plus its symlink-resolved twin.
+ *
+ * macOS resolves /tmp to /private/tmp and /var/folders to /private/var/folders.
+ * The sandbox matches on the real path, so listing only the symlink silently
+ * denies every write to the system temp directory.
+ */
+function withRealPath(target) {
+    try {
+        const real = realpathSync(target);
+        return real === target ? [target] : [target, real];
+    }
+    catch {
+        return [target];
+    }
+}
+/** Pure policy builder, exported so the security boundary is regression-tested. */
+export function buildSandboxSettings(cwd, policy, platform = process.platform) {
+    const workspace = path.resolve(cwd);
+    const temp = path.resolve(os.tmpdir());
+    const home = os.homedir();
+    const allowedDomains = [
+        ...new Set([...(policy.strictDomains ? [] : DEFAULT_ALLOWED_DOMAINS), ...policy.allowedDomains]
+            .map((host) => host.trim())
+            .filter(Boolean)),
+    ].sort();
+    // Mirror resolveWriteGuard's roots. The sandbox must never be stricter than
+    // the write guard the user already controls, or bash silently loses
+    // multi-root workspaces and the documented outside-workspace opt-out.
+    const writeRoots = [
+        ...new Set([
+            workspace,
+            ...(policy.additionalRoots ?? []).map((root) => path.resolve(root)),
+            temp,
+            // The conventional scratch dir, distinct from os.tmpdir() on macOS.
+            ...(platform === "win32" ? [] : ["/tmp"]),
+            path.resolve(getAppPaths().agentDir),
+            ...toolCacheDirs(home),
+            ...(policy.allowOutsideWorkspaceWrites ? [home] : []),
+        ].flatMap(withRealPath)),
+    ];
+    return {
+        network: {
+            allowedDomains,
+            deniedDomains: [],
+            strictAllowlist: true,
+            allowUnixSockets: [],
+            // Dev servers, preview servers and the screenshot tool all bind a local
+            // port. Loopback never leaves the machine, so blocking it costs core
+            // workflows without buying containment.
+            allowLocalBinding: true,
+        },
+        ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+        filesystem: {
+            denyRead: sensitiveReadPaths(home),
+            // SRT adds its platform-required temporary paths; these are the only
+            // product-owned write roots supplied by EZ Coder.
+            allowWrite: platform === "win32" ? writeRoots : [...writeRoots, "/dev/null"],
+            // `.git/hooks` is a mandatory sandbox protection with no opt-out, which
+            // is worth keeping: it stops a command installing a hook that later runs
+            // unsandboxed. `git clone`/`git init` only write there to copy inert
+            // `.sample` files, which SANDBOX_ENV_PATCH turns off.
+            //
+            // `.git/config` must be writable or `git init`, `git remote add` and
+            // `git clone` all fail outright.
+            allowGitConfig: true,
+            // Resolve the workspace first: on macOS the sandbox matches real paths, so
+            // a deny rule built from the symlinked path (/var/... vs /private/var/...)
+            // silently never matches.
+            denyWrite: withRealPath(workspace).flatMap((root) => [
+                path.join(root, ".env"),
+                path.join(root, ".env.local"),
+            ]),
+        },
+    };
+}
+function resolveSandboxCli() {
+    const packageEntry = import.meta.resolve("@anthropic-ai/sandbox-runtime");
+    return path.join(path.dirname(fileURLToPath(packageEntry)), "cli.js");
+}
+/**
+ * Does this machine actually support OS sandboxing? SRT reports missing
+ * bubblewrap/socat or an unprovisioned Windows sandbox user only when it
+ * initializes, so probe once per process with a trivial command instead of
+ * reimplementing its per-platform dependency matrix.
+ */
+let supportProbe = null;
+export function resetSandboxSupportProbeForTests() {
+    supportProbe = null;
+    warnedUnsupported = false;
+}
+function probeSandboxSupport(settingsPath) {
+    supportProbe ??= new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(process.execPath, [resolveSandboxCli(), "--settings", settingsPath, "-c", "exit 0"], {
+                stdio: ["ignore", "ignore", "pipe"],
+            });
+        }
+        catch (error) {
+            resolve({ supported: false, reason: error.message });
+            return;
+        }
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-500);
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+            resolve({ supported: false, reason: "sandbox probe timed out" });
+        }, PROBE_TIMEOUT_MS);
+        timer.unref?.();
+        child.once("error", (error) => {
+            clearTimeout(timer);
+            resolve({ supported: false, reason: error.message });
+        });
+        child.once("exit", (code) => {
+            clearTimeout(timer);
+            resolve({
+                supported: code === 0,
+                reason: code === 0 ? "ok" : stderr.trim() || `sandbox probe exited with code ${code}`,
+            });
+        });
+    });
+    return supportProbe;
+}
+async function writeStableSettings(settings) {
+    const json = `${JSON.stringify(settings, null, 2)}\n`;
+    const digest = createHash("sha256").update(json).digest("hex").slice(0, 20);
+    const settingsPath = path.join(SANDBOX_CONFIG_DIR, `${digest}.json`);
+    await fs.mkdir(SANDBOX_CONFIG_DIR, { recursive: true, mode: 0o700 });
+    try {
+        await fs.writeFile(settingsPath, json, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    return settingsPath;
+}
+/**
+ * Known limitations when `sandboxMode` is enabled (upstream, not fixable here):
+ *
+ * - **Linux pipes/redirections**: `echo hi | grep hi` fails with "Permission
+ *   denied" on /proc/self/fd/3 because bash's pipe setup clobbers the fd the
+ *   seccomp filter arrives on (sandbox-runtime#261).
+ * - **git over SSH**: `git@host:` remotes fail the SOCKS handshake on macOS —
+ *   the injected ProxyCommand uses `nc`, which cannot authenticate. HTTPS
+ *   remotes work. `~/.ssh` is also unreadable by design.
+ * - **`git config --global`**: `~/.gitconfig` is a mandatory upstream write
+ *   protection with no opt-out. Repo-local `git config` works.
+ * - **Corporate TLS interception / private registries**: need the CA and
+ *   registry host configured explicitly.
+ * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
+ *   degrades to no isolation (sandbox-runtime#428, #429).
+ *
+ * These are why the default is `off`; revisit when fixed upstream.
+ */
+/**
+ * Wrap an already-resolved shell with Anthropic's cross-platform OS sandbox.
+ * Initialization and dependency failures remain visible and fail closed: the
+ * original command is never spawned outside the sandbox as an implicit fallback.
+ */
+export async function prepareSandboxLaunch(shell, cwd, policy) {
+    if (policy.mode === "off")
+        return { ...shell, sandboxed: false };
+    const settingsPath = await writeStableSettings(buildSandboxSettings(cwd, policy));
+    const support = await probeSandboxSupport(settingsPath);
+    if (!support.supported) {
+        if (policy.mode === "workspace") {
+            throw new Error(`${support.reason}. Install the OS sandbox prerequisites ` +
+                `(Linux: bubblewrap + socat; Windows: run \`srt windows-install\`), ` +
+                `or set sandboxMode to "auto" to run without OS isolation.`);
+        }
+        if (!warnedUnsupported) {
+            warnedUnsupported = true;
+            log("WARN", "sandbox", "OS sandbox unavailable; commands run unisolated", {
+                reason: support.reason,
+            });
+        }
+        return { ...shell, sandboxed: false };
+    }
+    return {
+        file: process.execPath,
+        args: [resolveSandboxCli(), "--settings", settingsPath, "--", shell.file, ...shell.args],
+        isCmdFallback: shell.isCmdFallback,
+        sandboxed: true,
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/core/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AA+B/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,gBAAgB,EAAE,EAAE;CACrB,CAAC;AA6BF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAqB,EACrB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;aACjF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB;KACF,CAAC,IAAI,EAAE,CAAC;IACT,4EAA4E;IAC5E,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CACR;YACE,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI;YACJ,oEAAoE;YACpE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpC,GAAG,aAAa,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,OAAO,CAAC,YAAY,CAAC,CACxB;KACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,aAAa,EAAE,EAAE;YACjB,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,EAAE;YACpB,wEAAwE;YACxE,qEAAqE;YACrE,wCAAwC;YACxC,iBAAiB,EAAE,IAAI;SACxB;QACD,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,qEAAqE;YACrE,kDAAkD;YAClD,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,WAAW,CAAC;YAC5E,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,sDAAsD;YACtD,EAAE;YACF,qEAAqE;YACrE,iCAAiC;YACjC,cAAc,EAAE,IAAI;YACpB,2EAA2E;YAC3E,2EAA2E;YAC3E,0BAA0B;YAC1B,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;aAC9B,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAA2D,IAAI,CAAC;AAEhF,MAAM,UAAU,gCAAgC;IAC9C,YAAY,GAAG,IAAI,CAAC;IACpB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAoB;IAEpB,YAAY,KAAK,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CACX,OAAO,CAAC,QAAQ,EAChB,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,EACjE;gBACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;aACpC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACnE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,SAAS,EAAE,IAAI,KAAK,CAAC;gBACrB,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,IAAI,EAAE;aACtF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAyB;IAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,GAAW,EACX,MAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,yCAAyC;gBACxD,qEAAqE;gBACrE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,iDAAiD,EAAE;gBACxE,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,IAAI,EAAE,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;QACxF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/core/sandbox.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox.test.d.ts.map

package/dist/core/sandbox.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.d.ts","sourceRoot":"","sources":["../../src/core/sandbox.test.ts"],"names":[],"mappings":""}