@qduc/term2 0.7.3 → 0.9.0

package/dist/utils/shell/sandbox/denied-read-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denied-read-stores.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/denied-read-stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAc7B;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAC1B,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,sBAAsB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,MAAM,CAAC,OAAe,EAAE,IAAoB;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,kBAAkB,CAAC,aAAqB,EAAE,IAAoB;QAC5D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,aAAqB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACjC,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IAElD,GAAG,CAAC,OAAe,EAAE,QAA2B;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AACpC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAOvD;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IAC9B,cAAc,CAAS;IACvB,IAAI,CAAmB;IACvB,GAAG,CAAY;IAExB,YAAY,aAAqB,EAAE,MAAkB,EAAE,GAAqB;QAC1E,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,kEAAkE,EAAE;gBAClF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,KAAe;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,OAAO,GAA0B,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5F,CAAC;IAED,UAAU,CAAC,KAAe;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAEnE,IAAI,qBAAqB,GAAwC,IAAI,CAAC;AACtE,IAAI,yBAAyB,GAAkB,IAAI,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAAqB;IAC5D,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,KAAK,aAAa,EAAE,CAAC;QAC1E,qBAAqB,GAAG,IAAI,4BAA4B,CAAC,aAAa,CAAC,CAAC;QACxE,yBAAyB,GAAG,aAAa,CAAC;IAC5C,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC;IACjD,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,sBAAsB,CAAC,KAAK,EAAE,CAAC;IAC/B,qBAAqB,GAAG,IAAI,CAAC;IAC7B,yBAAyB,GAAG,IAAI,CAAC;AACnC,CAAC"}

package/dist/utils/shell/sandbox/sandbox-env.d.ts

@@ -0,0 +1,3 @@
+export declare function isSecretKey(key: string): boolean;
+export declare function createSandboxEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=sandbox-env.d.ts.map

package/dist/utils/shell/sandbox/sandbox-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-env.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-env.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAanG"}

package/dist/utils/shell/sandbox/sandbox-env.js

@@ -0,0 +1,31 @@
+const ALLOWED_EXACT_KEYS = new Set(['PATH', 'SHELL', 'TMPDIR', 'TEMP', 'TMP', 'TERM', 'HOME']);
+function isAllowedKey(key) {
+    return ALLOWED_EXACT_KEYS.has(key) || key === 'LANG' || key.startsWith('LC_');
+}
+export function isSecretKey(key) {
+    return (/(^|_)API_KEY$/.test(key) ||
+        /(^|_)TOKEN$/.test(key) ||
+        /(^|_)SECRET$/.test(key) ||
+        key.startsWith('AWS_') ||
+        key.startsWith('GOOGLE_') ||
+        key.startsWith('GCP_') ||
+        key.startsWith('AZURE_') ||
+        key.startsWith('OPENAI_') ||
+        key.startsWith('ANTHROPIC_') ||
+        key === 'GITHUB_TOKEN' ||
+        key === 'SSH_AUTH_SOCK' ||
+        key === 'SSH_AGENT_PID');
+}
+export function createSandboxEnvironment(source = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(source)) {
+        // Layer-1a backstop: redundant while the allowlist stays tiny; do not remove.
+        // It is the last line of defense inside Layer 1 if a secret-shaped key is ever allowlisted.
+        if (value === undefined || isSecretKey(key) || !isAllowedKey(key)) {
+            continue;
+        }
+        env[key] = value;
+    }
+    return env;
+}
+//# sourceMappingURL=sandbox-env.js.map

package/dist/utils/shell/sandbox/sandbox-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-env.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-env.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/F,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACtB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACtB,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,eAAe;QACvB,GAAG,KAAK,eAAe,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAA4B,OAAO,CAAC,GAAG;IAC9E,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,8EAA8E;QAC9E,4FAA4F;QAC5F,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.d.ts

@@ -0,0 +1,41 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+export type SandboxReadPolicy = 'standard' | 'strict';
+export type ShellSandboxMode = 'default' | 'unsandboxed';
+export type SandboxAvailability = {
+    type: 'available';
+} | {
+    type: 'disabled';
+} | {
+    type: 'unsupported_platform';
+    reason: string;
+} | {
+    type: 'missing_dependency';
+    reason: string;
+} | {
+    type: 'initialization_failed';
+    reason: string;
+};
+export interface ShellSandboxRunner {
+    availability(): Promise<SandboxAvailability>;
+    wrap(command: string, options: {
+        cwd: string;
+        config?: SandboxRuntimeConfig;
+        signal?: AbortSignal;
+    }): Promise<{
+        command: string;
+        diagnostics?: string[];
+    }>;
+    cleanupAfterCommand?(): void | Promise<void>;
+    annotateFailure(command: string, stderr: string): string;
+}
+export interface CreateSandboxRuntimeConfigOptions {
+    readPolicy?: SandboxReadPolicy;
+    allowReadExtra?: string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    onProtectedFiltered?: (filtered: readonly string[]) => void;
+}
+export declare function isPathProtected(target: string, home: string): boolean;
+export declare function createSandboxRuntimeConfig(options?: CreateSandboxRuntimeConfigOptions): SandboxRuntimeConfig;
+export declare const SANDBOX_ESCAPE_INSTRUCTION = "Sandbox blocked this command. To request a one-shot escape, call shell again with sandbox=\"unsandboxed\"; user approval will be required.";
+//# sourceMappingURL=sandbox-policy.d.ts.map

package/dist/utils/shell/sandbox/sandbox-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAI1E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,mBAAmB,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1D;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAoFD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,iCAAsC,GAAG,oBAAoB,CA6GhH;AAED,eAAO,MAAM,0BAA0B,+IACqG,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.js

@@ -0,0 +1,217 @@
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
+import { isSecretKey } from './sandbox-env.js';
+// Paths the sandbox must never allow writing to, regardless of where term2
+// was launched from. Two classes:
+//   - EXACT: only when cwd (resolved) is exactly the path
+//   - SUBTREE: when cwd (resolved) is the path or any descendant
+// Both Linux and macOS paths are listed; the runtime drops non-existent paths
+// per platform. This list is hardcoded on purpose: it is the floor of what
+// "do not destroy the user's system" means, and giving users a setting to
+// weaken it would defeat the point. See docs/sandbox-filesystem-read-hardening.md.
+const EXACT_PROTECTED_WRITE_PATHS = [
+    '$HOME', // resolved via os.homedir() at use time
+    '/root',
+    '/var',
+    '/private/var',
+    '/mnt',
+    '/media',
+    '/srv',
+    '/opt',
+];
+const SUBTREE_PROTECTED_WRITE_PATHS = [
+    '/etc',
+    '/private/etc',
+    '/boot',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib64',
+    '/proc',
+    '/sys',
+    '/dev',
+    '/Library',
+    '/System',
+    '/System/Library',
+];
+// Common dev locations are intentionally NOT protected:
+//   /usr/local, /opt/homebrew, /tmp, /private/tmp
+// These host Homebrew, local builds, temp worktrees, and cache dirs.
+// Blocking them would break normal development workflows.
+//
+// Writable carve-outs that sit *inside* a SUBTREE-protected path. Without
+// this, the `/usr` subtree guard below would remove `/usr/local` (and
+// descendants like `/usr/local/src`) from allowWrite, contradicting the
+// documented exception above. Checked before subtree protection.
+const WRITABLE_SUBTREE_EXCEPTIONS = ['/usr/local'];
+function expandHomePath(filePath, home) {
+    if (filePath === '~') {
+        return home;
+    }
+    if (filePath.startsWith('~/')) {
+        return path.join(home, filePath.slice(2));
+    }
+    return filePath;
+}
+function resolveCurrentRuntimeRoot(home) {
+    try {
+        const realExecPath = fs.realpathSync(process.execPath);
+        if (!realExecPath.startsWith(`${home}${path.sep}`)) {
+            return undefined;
+        }
+        return path.dirname(path.dirname(realExecPath));
+    }
+    catch {
+        return undefined;
+    }
+}
+// Normalize $HOME the same way workspaceRoot is (realpathSync) so the exact
+// home guard still fires when os.homedir() is a symlink path and the launch
+// cwd is $HOME: workspaceRoot becomes the real path while a bare
+// path.resolve(home) would stay the symlink path. Best-effort: fall back to
+// path.resolve when the home directory cannot be resolved.
+function resolveHomePath(home) {
+    try {
+        return fs.realpathSync(home);
+    }
+    catch {
+        return path.resolve(home);
+    }
+}
+export function isPathProtected(target, home) {
+    const resolved = path.resolve(target);
+    const resolvedHome = resolveHomePath(home);
+    for (const protectedPath of EXACT_PROTECTED_WRITE_PATHS) {
+        if (resolved === path.resolve(protectedPath === '$HOME' ? resolvedHome : protectedPath)) {
+            return true;
+        }
+    }
+    // Writable carve-outs inside a subtree-protected path take precedence over
+    // subtree protection so documented exceptions (e.g. /usr/local) stay writable.
+    for (const exceptionPath of WRITABLE_SUBTREE_EXCEPTIONS) {
+        const resolvedException = path.resolve(exceptionPath);
+        if (resolved === resolvedException || resolved.startsWith(resolvedException + path.sep)) {
+            return false;
+        }
+    }
+    for (const protectedPath of SUBTREE_PROTECTED_WRITE_PATHS) {
+        const resolvedProtected = path.resolve(protectedPath);
+        if (resolved === resolvedProtected)
+            return true;
+        if (resolved.startsWith(resolvedProtected + path.sep))
+            return true;
+    }
+    return false;
+}
+export function createSandboxRuntimeConfig(options = {}) {
+    const home = os.homedir();
+    const readPolicy = options.readPolicy ?? 'standard';
+    const workspaceRoot = fs.realpathSync(options.cwd ?? process.cwd());
+    const tmpDir = SANDBOX_TEMP_DIR;
+    const appCacheDir = path.join(home, '.cache', 'term2-nodejs');
+    const rtkConfigDir = path.join(home, '.config', 'rtk');
+    const rtkDataDir = path.join(home, '.local', 'share', 'rtk');
+    const safeHomeReadPaths = [
+        path.join(home, '.gitconfig'),
+        path.join(home, '.config', 'git'),
+        path.join(home, '.npm'),
+        path.join(home, 'Library', 'pnpm'),
+        path.join(home, '.local', 'share', 'pnpm'),
+        path.join(home, '.pnpm-store'),
+        resolveCurrentRuntimeRoot(home),
+    ].filter((filePath) => Boolean(filePath));
+    const credentialFiles = [
+        path.join(home, '.ssh'),
+        path.join(home, '.aws'),
+        path.join(home, '.azure'),
+        path.join(home, '.config', 'gcloud'),
+        path.join(home, '.docker'),
+        path.join(home, '.netrc'),
+        path.join(home, '.git-credentials'),
+        path.join(home, '.bash_history'),
+        path.join(home, '.zsh_history'),
+        path.join(home, '.npmrc'),
+        path.join(home, '.pypirc'),
+        path.join(home, '.kube'),
+        path.join(home, '.gnupg'),
+        path.join(home, '.config', 'gh'),
+        path.join(home, '.gem'),
+        path.join(home, '.gemrc'),
+        path.join(home, '.config', 'hub'),
+        path.join(home, '.docker', 'config.json'),
+    ];
+    const defaultCredentialEnvVars = [
+        'AWS_ACCESS_KEY_ID',
+        'AWS_SECRET_ACCESS_KEY',
+        'AWS_SESSION_TOKEN',
+        'GOOGLE_APPLICATION_CREDENTIALS',
+        'GITHUB_TOKEN',
+        'OPENAI_API_KEY',
+        'ANTHROPIC_API_KEY',
+        'SSH_AUTH_SOCK',
+        'SSH_AGENT_PID',
+    ];
+    // Env protection layering (see docs/sandbox-filesystem-read-hardening.md §5):
+    // Layer 1 (authoritative): createSandboxEnvironment() in sandbox-env.ts drops every env
+    //   key not on a tiny allowlist of known-safe values (PATH, SHELL, TMPDIR, locale, …).
+    //   Secrets never reach the child because they are not allowlisted, not because we named them.
+    // Layer 2 (defense-in-depth): credentials.envVars below unsets the same keys at the sandbox
+    //   runtime level (bwrap --unsetenv / Seatbelt -u). It is intentionally small and
+    //   auto-populated from the live env via isSecretKey so it stays exhaustive without hardcoding.
+    //   It earns its keep only if Layer 1 ever regresses; do not treat it as the primary gate.
+    const presentSecretEnvVars = Object.keys(options.env ?? process.env).filter(isSecretKey);
+    const credentialEnvVars = Array.from(new Set([...defaultCredentialEnvVars, ...presentSecretEnvVars]));
+    const allowReadExtra = (options.allowReadExtra ?? []).map((filePath) => expandHomePath(filePath, home));
+    const denyRead = readPolicy === 'strict' ? [home, '/etc', '/var', '/root', '/private/var'] : credentialFiles;
+    const allowRead = readPolicy === 'strict'
+        ? [
+            workspaceRoot,
+            tmpDir,
+            appCacheDir,
+            rtkConfigDir,
+            rtkDataDir,
+            ...safeHomeReadPaths,
+            ...allowReadExtra,
+            '/usr',
+            '/bin',
+            '/sbin',
+            '/lib',
+            '/lib64',
+            '/opt',
+            '/Library',
+            '/System/Library',
+            '/usr/local',
+            '/opt/homebrew',
+        ]
+        : undefined;
+    const rawAllowWrite = [workspaceRoot, tmpDir];
+    const protectedFiltered = rawAllowWrite.filter((p) => isPathProtected(p, home));
+    const allowWrite = rawAllowWrite.filter((p) => !isPathProtected(p, home));
+    if (protectedFiltered.length > 0) {
+        options.onProtectedFiltered?.(protectedFiltered);
+    }
+    return {
+        network: {
+            allowedDomains: [],
+            deniedDomains: ['*'],
+            strictAllowlist: true,
+            allowLocalBinding: false,
+        },
+        filesystem: {
+            denyRead,
+            ...(allowRead ? { allowRead } : {}),
+            allowWrite,
+            denyWrite: [],
+            allowGitConfig: true,
+        },
+        credentials: {
+            files: credentialFiles.map((filePath) => ({ path: filePath, mode: 'deny' })),
+            envVars: credentialEnvVars.map((name) => ({ name, mode: 'deny' })),
+        },
+    };
+}
+export const SANDBOX_ESCAPE_INSTRUCTION = 'Sandbox blocked this command. To request a one-shot escape, call shell again with sandbox="unsandboxed"; user approval will be required.';
+//# sourceMappingURL=sandbox-policy.js.map

package/dist/utils/shell/sandbox/sandbox-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAmC/C,2EAA2E;AAC3E,kCAAkC;AAClC,0DAA0D;AAC1D,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,mFAAmF;AACnF,MAAM,2BAA2B,GAAG;IAClC,OAAO,EAAE,wCAAwC;IACjD,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;CACE,CAAC;AAEX,MAAM,6BAA6B,GAAG;IACpC,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,iBAAiB;CACT,CAAC;AAEX,wDAAwD;AACxD,kDAAkD;AAClD,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,CAAC,YAAY,CAAU,CAAC;AAE5D,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,4EAA4E;AAC5E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,6BAA6B,EAAE,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA6C,EAAE;IACxF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;KAC1C,CAAC;IACF,MAAM,wBAAwB,GAAG;QAC/B,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;QACnB,gCAAgC;QAChC,cAAc;QACd,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,eAAe;KAChB,CAAC;IACF,8EAA8E;IAC9E,wFAAwF;IACxF,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,kFAAkF;IAClF,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7G,MAAM,SAAS,GACb,UAAU,KAAK,QAAQ;QACrB,CAAC,CAAC;YACE,aAAa;YACb,MAAM;YACN,WAAW;YACX,YAAY;YACZ,UAAU;YACV,GAAG,iBAAiB;YACpB,GAAG,cAAc;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,QAAQ;YACR,MAAM;YACN,UAAU;YACV,iBAAiB;YACjB,YAAY;YACZ,eAAe;SAChB;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,KAAK;SACzB;QACD,UAAU,EAAE;YACV,QAAQ;YACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,UAAU;YACV,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,IAAI;SACrB;QACD,WAAW,EAAE;YACX,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GACrC,0IAA0I,CAAC"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.d.ts

@@ -0,0 +1,18 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import { type SandboxAvailability, type ShellSandboxRunner } from './sandbox-policy.js';
+export declare class AnthropicShellSandboxRunner implements ShellSandboxRunner {
+    #private;
+    availability(): Promise<SandboxAvailability>;
+    wrap(command: string, options: {
+        cwd: string;
+        config?: SandboxRuntimeConfig;
+        signal?: AbortSignal;
+    }): Promise<{
+        command: string;
+        diagnostics?: string[];
+    }>;
+    cleanupAfterCommand(): void;
+    annotateFailure(command: string, stderr: string): string;
+}
+export declare function getDefaultShellSandboxRunner(): ShellSandboxRunner;
+//# sourceMappingURL=shell-sandbox-runner.d.ts.map

package/dist/utils/shell/sandbox/shell-sandbox-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox-runner.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAA8B,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,qBAAa,2BAA4B,YAAW,kBAAkB;;IAI9D,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAiB5C,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOvD,mBAAmB,IAAI,IAAI;IAI3B,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;CAwBzD;AAID,wBAAgB,4BAA4B,IAAI,kBAAkB,CAGjE"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.js

@@ -0,0 +1,58 @@
+import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
+import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
+import { createSandboxRuntimeConfig } from './sandbox-policy.js';
+export class AnthropicShellSandboxRunner {
+    #initializedForKey;
+    #initializationFailure;
+    async availability() {
+        if (!SandboxManager.isSupportedPlatform()) {
+            return { type: 'unsupported_platform', reason: 'Sandbox runtime does not support this platform.' };
+        }
+        const dependencyCheck = SandboxManager.checkDependencies();
+        if (dependencyCheck.errors.length > 0) {
+            return { type: 'missing_dependency', reason: dependencyCheck.errors.join('; ') };
+        }
+        if (this.#initializationFailure) {
+            return this.#initializationFailure;
+        }
+        return { type: 'available' };
+    }
+    async wrap(command, options) {
+        await this.#initialize(options.cwd, options.config);
+        const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
+        const diagnostics = SandboxManager.getLinuxGlobPatternWarnings?.() ?? [];
+        return { command: wrapped, diagnostics };
+    }
+    cleanupAfterCommand() {
+        SandboxManager.cleanupAfterCommand();
+    }
+    annotateFailure(command, stderr) {
+        return SandboxManager.annotateStderrWithSandboxFailures(command, stderr);
+    }
+    async #initialize(cwd, config = createSandboxRuntimeConfig({ cwd })) {
+        const initializationKey = JSON.stringify({ cwd, config });
+        if (this.#initializedForKey === initializationKey) {
+            return;
+        }
+        try {
+            if (this.#initializedForKey) {
+                await SandboxManager.reset();
+            }
+            process.env.CLAUDE_CODE_TMPDIR = SANDBOX_TEMP_DIR;
+            await SandboxManager.initialize(config);
+            this.#initializedForKey = initializationKey;
+            this.#initializationFailure = undefined;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            this.#initializationFailure = { type: 'initialization_failed', reason };
+            throw error;
+        }
+    }
+}
+let defaultRunner;
+export function getDefaultShellSandboxRunner() {
+    defaultRunner ??= new AnthropicShellSandboxRunner();
+    return defaultRunner;
+}
+//# sourceMappingURL=shell-sandbox-runner.js.map

package/dist/utils/shell/sandbox/shell-sandbox-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox-runner.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAqD,MAAM,qBAAqB,CAAC;AAEpH,MAAM,OAAO,2BAA2B;IACtC,kBAAkB,CAAqB;IACvC,sBAAsB,CAAkC;IAExD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAIC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,cAAc,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,mBAAmB;QACjB,cAAc,CAAC,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,MAAc;QAC7C,OAAO,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,SAA+B,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC;QAC/F,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,gBAAgB,CAAC;YAClD,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;YAC5C,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,sBAAsB,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,IAAI,aAAsD,CAAC;AAE3D,MAAM,UAAU,4BAA4B;IAC1C,aAAa,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACpD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/utils/shell/shell-output.d.ts

@@ -0,0 +1,17 @@
+export interface FormatShellExecutionOutputParams {
+    command: string;
+    cwd: string;
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    timedOut: boolean;
+    maxOutputLength?: number;
+    durationMs?: number;
+}
+export interface FormatShellExecutionOutputResult {
+    text: string;
+    truncated: boolean;
+    artifactPath?: string;
+}
+export declare function formatShellExecutionOutput({ command, cwd, stdout, stderr, exitCode, timedOut, maxOutputLength, durationMs, }: FormatShellExecutionOutputParams): Promise<FormatShellExecutionOutputResult>;
+//# sourceMappingURL=shell-output.d.ts.map

package/dist/utils/shell/shell-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-output.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyCD,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,UAAU,GACX,EAAE,gCAAgC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA0B9E"}

package/dist/utils/shell/shell-output.js

@@ -0,0 +1,55 @@
+import { mkdtemp, writeFile } from 'fs/promises';
+import { randomBytes } from 'crypto';
+import os from 'os';
+import path from 'path';
+import { trimOutput } from '../output/output-trim.js';
+const TRUNCATED_NOTE_PREFIX = 'Full output saved to';
+let shellOutputTempDirPromise;
+function buildArtifactContents(params) {
+    const statusLine = params.timedOut ? 'timeout' : `exit ${params.exitCode ?? 'null'}`;
+    return [
+        `Command: ${params.command}`,
+        `Working directory: ${params.cwd}`,
+        `Status: ${statusLine}`,
+        typeof params.durationMs === 'number' ? `Runtime: ${params.durationMs}ms` : undefined,
+        `Timed out: ${params.timedOut ? 'yes' : 'no'}`,
+        '',
+        'STDOUT:',
+        params.stdout || '(empty)',
+        '',
+        'STDERR:',
+        params.stderr || '(empty)',
+        '',
+    ].join('\n');
+}
+async function saveShellOutputArtifact(contents) {
+    shellOutputTempDirPromise ??= mkdtemp(path.join(os.tmpdir(), 'term2-shell-output-'));
+    const tempDir = await shellOutputTempDirPromise;
+    const suffix = randomBytes(3).toString('hex');
+    const artifactPath = path.join(tempDir, `output-${suffix}.txt`);
+    await writeFile(artifactPath, contents, 'utf8');
+    return artifactPath;
+}
+export async function formatShellExecutionOutput({ command, cwd, stdout, stderr, exitCode, timedOut, maxOutputLength, durationMs, }) {
+    const stdoutTrimmedOutput = trimOutput(stdout, undefined, maxOutputLength);
+    const stderrTrimmedOutput = trimOutput(stderr, undefined, maxOutputLength);
+    const stdoutTrimmed = stdoutTrimmedOutput.trimEnd();
+    const stderrTrimmed = stderrTrimmedOutput.trimEnd();
+    const stdoutTruncated = stdoutTrimmedOutput !== stdout;
+    const stderrTruncated = stderrTrimmedOutput !== stderr;
+    const combinedOutput = [stdoutTrimmed, stderrTrimmed].filter(Boolean).join('\n').trimEnd();
+    const statusLine = timedOut ? 'timeout' : `exit ${exitCode ?? 'null'}`;
+    const runtimeLine = typeof durationMs === 'number' ? `Runtime: ${durationMs}ms` : '';
+    const emptyOutputNote = combinedOutput === '' && !timedOut && exitCode === 0 ? '(No output)' : '';
+    let artifactPath;
+    if (stdoutTruncated || stderrTruncated) {
+        artifactPath = await saveShellOutputArtifact(buildArtifactContents({ command, cwd, stdout, stderr, exitCode, timedOut, durationMs }));
+    }
+    const truncationNote = artifactPath ? `${TRUNCATED_NOTE_PREFIX} \`${artifactPath}\`` : '';
+    return {
+        text: [statusLine, runtimeLine, combinedOutput, emptyOutputNote, truncationNote].filter(Boolean).join('\n'),
+        truncated: Boolean(artifactPath),
+        artifactPath,
+    };
+}
+//# sourceMappingURL=shell-output.js.map

package/dist/utils/shell/shell-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-output.js","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAmBtD,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AACrD,IAAI,yBAAsD,CAAC;AAE3D,SAAS,qBAAqB,CAAC,MAQ9B;IACC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;IAErF,OAAO;QACL,YAAY,MAAM,CAAC,OAAO,EAAE;QAC5B,sBAAsB,MAAM,CAAC,GAAG,EAAE;QAClC,WAAW,UAAU,EAAE;QACvB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS;QACrF,cAAc,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9C,EAAE;QACF,SAAS;QACT,MAAM,CAAC,MAAM,IAAI,SAAS;QAC1B,EAAE;QACF,SAAS;QACT,MAAM,CAAC,MAAM,IAAI,SAAS;QAC1B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IACrD,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,MAAM,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,UAAU,GACuB;IACjC,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,CAAC;IACpD,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,mBAAmB,KAAK,MAAM,CAAC;IACvD,MAAM,eAAe,GAAG,mBAAmB,KAAK,MAAM,CAAC;IACvD,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3F,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,QAAQ,IAAI,MAAM,EAAE,CAAC;IACvE,MAAM,WAAW,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,eAAe,GAAG,cAAc,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,IAAI,YAAgC,CAAC;IACrC,IAAI,eAAe,IAAI,eAAe,EAAE,CAAC;QACvC,YAAY,GAAG,MAAM,uBAAuB,CAC1C,qBAAqB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,qBAAqB,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1F,OAAO;QACL,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3G,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;QAChC,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/utils/shell/shell-output.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shell-output.test.d.ts.map

package/dist/utils/shell/shell-output.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-output.test.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.test.ts"],"names":[],"mappings":""}

package/dist/utils/shell/shell-output.test.js

@@ -0,0 +1,49 @@
+import { it, expect } from 'vitest';
+import fs from 'fs';
+import { formatShellExecutionOutput } from './shell-output.js';
+it('formatShellExecutionOutput saves the full output when truncation occurs', async () => {
+    const stdout = `${'x'.repeat(6000)}FULL-ONLY-SENTINEL${'y'.repeat(6000)}`;
+    const result = await formatShellExecutionOutput({
+        command: 'demo --long-output',
+        cwd: '/workspace',
+        stdout,
+        stderr: '',
+        exitCode: 0,
+        timedOut: false,
+        maxOutputLength: 120,
+        durationMs: 1234,
+    });
+    expect(result.truncated).toBe(true);
+    expect(result.artifactPath).toBeTruthy();
+    expect(result.text.includes('exit 0')).toBe(true);
+    expect(result.text.includes('Runtime: 1234ms')).toBe(true);
+    expect(result.text.includes('Full shell output saved to')).toBe(true);
+    expect(result.text.includes('Search that file for what you need instead of rerunning the command or changing the filter criteria with a `| grep` pipeline.')).toBe(true);
+    expect(result.text.includes('FULL-ONLY-SENTINEL')).toBe(false);
+    const artifactPath = result.artifactPath;
+    const artifactContents = fs.readFileSync(artifactPath, 'utf8');
+    expect(artifactContents.includes('Command: demo --long-output')).toBe(true);
+    expect(artifactContents.includes('Working directory: /workspace')).toBe(true);
+    expect(artifactContents.includes('Runtime: 1234ms')).toBe(true);
+    expect(artifactContents.includes('STDOUT:')).toBe(true);
+    expect(artifactContents.includes('STDERR:')).toBe(true);
+    expect(artifactContents.includes('FULL-ONLY-SENTINEL')).toBe(true);
+    // TODO: // TODO: t.teardown(() => fs.rmSync(path.dirname(artifactPath), { recursive: true, force: true })) needs manual try/finally conversion;
+});
+it('formatShellExecutionOutput leaves short output unchanged', async () => {
+    const result = await formatShellExecutionOutput({
+        command: 'printf hello',
+        cwd: '/workspace',
+        stdout: 'hello',
+        stderr: '',
+        exitCode: 0,
+        timedOut: false,
+        maxOutputLength: 1000,
+        durationMs: 42,
+    });
+    expect(result.truncated).toBe(false);
+    expect(result.artifactPath).toBe(undefined);
+    expect(result.text.includes('Full shell output saved to')).toBe(false);
+    expect(result.text).toBe('exit 0\nRuntime: 42ms\nhello');
+});
+//# sourceMappingURL=shell-output.test.js.map

package/dist/utils/shell/shell-output.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-output.test.js","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,YAAY;QACjB,MAAM;QACN,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE,GAAG;QACpB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAClB,+HAA+H,CAChI,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAsB,CAAC;IACnD,MAAM,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAE/D,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnE,gJAAgJ;AAClJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,YAAY;QACjB,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC"}

package/dist/utils/shell/temp-dir.d.ts

@@ -0,0 +1,2 @@
+export declare const SANDBOX_TEMP_DIR: string;
+//# sourceMappingURL=temp-dir.d.ts.map

package/dist/utils/shell/temp-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-dir.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/temp-dir.ts"],"names":[],"mappings":"AA2CA,eAAO,MAAM,gBAAgB,QAAyB,CAAC"}

package/dist/utils/shell/temp-dir.js

@@ -0,0 +1,38 @@
+import { mkdirSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, basename } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Per-user, deterministic temp directory for sandboxed shell commands.
+ *
+ * Resolves to a deterministic per-user location matching env-paths:
+ *  - macOS:   `${os.tmpdir()}/term2-nodejs`       (tmpdir is user-private)
+ *  - Linux:   `${os.tmpdir()}/${username}/term2-nodejs`
+ *  - Windows: `${os.tmpdir()}/term2-nodejs`
+ *
+ * If TMPDIR already contains the app directory suffix — e.g. because a
+ * prior session or container set TMPDIR=/tmp/qduc/term2-nodejs — uses
+ * `os.tmpdir()` directly to avoid duplication.
+ *
+ * On macOS `os.tmpdir()` may return a symlinked path; we resolve it so the
+ * sandbox allowWrite entry matches the path a child process writes through.
+ */
+const appDir = 'term2-nodejs';
+function resolveTempDir() {
+    const base = tmpdir();
+    // Avoid double-pathing: if the system tmpdir already ends with our app
+    // directory suffix, use it as-is.
+    if (base.endsWith(appDir)) {
+        return base;
+    }
+    if (process.platform === 'darwin') {
+        // macOS: os.tmpdir() is already user-private.
+        return join(base, appDir);
+    }
+    // Linux/others: add per-user isolation.
+    return join(base, basename(homedir()), appDir);
+}
+const tempPath = resolveTempDir();
+mkdirSync(tempPath, { recursive: true });
+export const SANDBOX_TEMP_DIR = realpathSync(tempPath);
+//# sourceMappingURL=temp-dir.js.map

package/dist/utils/shell/temp-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-dir.js","sourceRoot":"","sources":["../../../source/utils/shell/temp-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;IAEtB,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,8CAA8C;QAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,wCAAwC;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;AAClC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC"}

package/dist/utils/skill-discovery-paths.d.ts

@@ -0,0 +1,5 @@
+export declare const SKILL_SCOPE_DIRS: readonly [".term2", ".agents", ".claude"];
+export declare function getProjectSkillScopes(baseDir: string): string[];
+export declare function getUserSkillScopes(homeDir?: string): string[];
+export declare function getDiscoveredSkillRoots(baseDir: string, homeDir?: string): string[];
+//# sourceMappingURL=skill-discovery-paths.d.ts.map