@qduc/term2 0.9.1 → 0.9.3

package/dist/utils/shell/sandbox/sandbox-failure-classifier.js

@@ -0,0 +1,43 @@
+import { detectDeniedRead } from './denied-read-detector.js';
+function hasRuntimeAnnotation(rawStderr, annotatedStderr) {
+    return annotatedStderr !== rawStderr;
+}
+function hasProxyAllowlistBlock(stderr) {
+    return /blocked-by-allowlist/i.test(stderr) || (/\b403\s+Forbidden\b/i.test(stderr) && /allowlist/i.test(stderr));
+}
+export function classifySandboxFailure({ command, rawStderr, annotatedStderr, sandboxed, readPolicy, }) {
+    if (!sandboxed) {
+        return null;
+    }
+    const runtimeAnnotated = hasRuntimeAnnotation(rawStderr, annotatedStderr);
+    const proxyAllowlistBlocked = hasProxyAllowlistBlock(annotatedStderr) || hasProxyAllowlistBlock(rawStderr);
+    if (readPolicy === 'strict') {
+        const deniedRead = detectDeniedRead(command, annotatedStderr);
+        if (deniedRead) {
+            return {
+                type: 'denied_read',
+                confidence: runtimeAnnotated ? 'runtime_annotation' : 'stderr_pattern',
+                stderr: annotatedStderr,
+                deniedRead,
+            };
+        }
+    }
+    if (runtimeAnnotated) {
+        return {
+            type: 'blocked',
+            reason: proxyAllowlistBlocked ? 'network' : 'unknown',
+            confidence: 'runtime_annotation',
+            stderr: annotatedStderr,
+        };
+    }
+    if (proxyAllowlistBlocked) {
+        return {
+            type: 'blocked',
+            reason: 'network',
+            confidence: 'stderr_pattern',
+            stderr: annotatedStderr,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=sandbox-failure-classifier.js.map

package/dist/utils/shell/sandbox/sandbox-failure-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-failure-classifier.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-failure-classifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;AA4BlF,SAAS,oBAAoB,CAAC,SAAiB,EAAE,eAAuB;IACtE,OAAO,eAAe,KAAK,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EACP,SAAS,EACT,eAAe,EACf,SAAS,EACT,UAAU,GACoB;IAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,eAAe,CAAC,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAE3G,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;gBACtE,MAAM,EAAE,eAAe;gBACvB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrD,UAAU,EAAE,oBAAoB;YAChC,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/shell/sandbox/sandbox-network-approval.d.ts

@@ -0,0 +1,14 @@
+export type SandboxNetworkAccessRequest = {
+    host: string;
+    port?: number;
+};
+type SandboxNetworkApprovalHandler = (request: SandboxNetworkAccessRequest) => Promise<boolean>;
+type SandboxNetworkApprovalPauseController = {
+    pause: () => void | Promise<void>;
+    resume: () => void | Promise<void>;
+};
+export declare function registerSandboxNetworkApprovalHandler(handler: SandboxNetworkApprovalHandler | null): () => void;
+export declare function registerSandboxNetworkApprovalPauseController(controller: SandboxNetworkApprovalPauseController | null): () => void;
+export declare function requestSandboxNetworkApproval(request: SandboxNetworkAccessRequest): Promise<boolean>;
+export {};
+//# sourceMappingURL=sandbox-network-approval.d.ts.map

package/dist/utils/shell/sandbox/sandbox-network-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-network-approval.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-network-approval.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,6BAA6B,GAAG,CAAC,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhG,KAAK,qCAAqC,GAAG;IAC3C,KAAK,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC,CAAC;AAKF,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,GAAG,MAAM,IAAI,CAO/G;AAED,wBAAgB,6CAA6C,CAC3D,UAAU,EAAE,qCAAqC,GAAG,IAAI,GACvD,MAAM,IAAI,CAOZ;AAkBD,wBAAsB,6BAA6B,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAa1G"}

package/dist/utils/shell/sandbox/sandbox-network-approval.js

@@ -0,0 +1,50 @@
+let activeHandler = null;
+let activePauseController = null;
+export function registerSandboxNetworkApprovalHandler(handler) {
+    activeHandler = handler;
+    return () => {
+        if (activeHandler === handler) {
+            activeHandler = null;
+        }
+    };
+}
+export function registerSandboxNetworkApprovalPauseController(controller) {
+    activePauseController = controller;
+    return () => {
+        if (activePauseController === controller) {
+            activePauseController = null;
+        }
+    };
+}
+async function pauseActiveSandboxedCommand() {
+    try {
+        await activePauseController?.pause();
+    }
+    catch {
+        // Approval must still be shown even if process suspension is unavailable.
+    }
+}
+async function resumeActiveSandboxedCommand() {
+    try {
+        await activePauseController?.resume();
+    }
+    catch {
+        // Ignore resume errors; the shell execution path still owns process cleanup.
+    }
+}
+export async function requestSandboxNetworkApproval(request) {
+    if (!activeHandler) {
+        return false;
+    }
+    await pauseActiveSandboxedCommand();
+    try {
+        return await activeHandler(request);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await resumeActiveSandboxedCommand();
+    }
+}
+//# sourceMappingURL=sandbox-network-approval.js.map

package/dist/utils/shell/sandbox/sandbox-network-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-network-approval.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-network-approval.ts"],"names":[],"mappings":"AAYA,IAAI,aAAa,GAAyC,IAAI,CAAC;AAC/D,IAAI,qBAAqB,GAAiD,IAAI,CAAC;AAE/E,MAAM,UAAU,qCAAqC,CAAC,OAA6C;IACjG,aAAa,GAAG,OAAO,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC9B,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6CAA6C,CAC3D,UAAwD;IAExD,qBAAqB,GAAG,UAAU,CAAC;IACnC,OAAO,GAAG,EAAE;QACV,IAAI,qBAAqB,KAAK,UAAU,EAAE,CAAC;YACzC,qBAAqB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B;IACxC,IAAI,CAAC;QACH,MAAM,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC;QACH,MAAM,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,OAAoC;IACtF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,2BAA2B,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,4BAA4B,EAAE,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/utils/shell/sandbox/sandbox-network-diagnostic.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Diagnostic tool to verify network configuration independence from read policy.
+ * Run this to ensure configuration is correct before debugging runtime behavior.
+ */
+export declare function diagnoseSandboxNetworkConfig(): boolean;
+//# sourceMappingURL=sandbox-network-diagnostic.d.ts.map

package/dist/utils/shell/sandbox/sandbox-network-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-network-diagnostic.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-network-diagnostic.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,4BAA4B,YAsE3C"}

package/dist/utils/shell/sandbox/sandbox-network-diagnostic.js

@@ -0,0 +1,71 @@
+import { createSandboxRuntimeConfig } from './sandbox-policy.js';
+/**
+ * Diagnostic tool to verify network configuration independence from read policy.
+ * Run this to ensure configuration is correct before debugging runtime behavior.
+ */
+export function diagnoseSandboxNetworkConfig() {
+    const scenarios = [
+        { name: 'Default', options: {} },
+        { name: 'Standard read, no network', options: { readPolicy: 'standard' } },
+        { name: 'Standard read, with network', options: { readPolicy: 'standard', allowNetworking: true } },
+        { name: 'Strict read, no network', options: { readPolicy: 'strict' } },
+        { name: 'Strict read, with network', options: { readPolicy: 'strict', allowNetworking: true } },
+    ];
+    console.log('═══════════════════════════════════════════════════════════════');
+    console.log('SANDBOX NETWORK CONFIGURATION DIAGNOSTIC');
+    console.log('═══════════════════════════════════════════════════════════════\n');
+    for (const scenario of scenarios) {
+        const config = createSandboxRuntimeConfig(scenario.options);
+        const network = config.network;
+        console.log(`📋 ${scenario.name}`);
+        console.log(`   Options: ${JSON.stringify(scenario.options)}`);
+        console.log(`   Network Config:`);
+        console.log(`     • deniedDomains:     ${JSON.stringify(network.deniedDomains)}`);
+        console.log(`     • strictAllowlist:   ${network.strictAllowlist}`);
+        console.log(`     • allowLocalBinding: ${network.allowLocalBinding}`);
+        console.log(`     • allowedDomains:   ${network.allowedDomains.length} entries`);
+        // Verify independence
+        const networkIsOpen = network.deniedDomains.length === 0 && !network.strictAllowlist;
+        console.log(`     ➜ Network is: ${networkIsOpen ? '✅ OPEN' : '🔒 RESTRICTED'}\n`);
+    }
+    // Specific check for the reported issue
+    console.log('═══════════════════════════════════════════════════════════════');
+    console.log('SPECIFIC CHECK: Strict Read Policy + Allow Networking');
+    console.log('═══════════════════════════════════════════════════════════════\n');
+    const config = createSandboxRuntimeConfig({ readPolicy: 'strict', allowNetworking: true });
+    const issues = [];
+    if (config.network.deniedDomains.length > 0) {
+        issues.push(`❌ deniedDomains is not empty: ${JSON.stringify(config.network.deniedDomains)}`);
+    }
+    else {
+        console.log('✅ deniedDomains is empty (all domains allowed)');
+    }
+    if (config.network.strictAllowlist !== false) {
+        issues.push(`❌ strictAllowlist is not false: ${config.network.strictAllowlist}`);
+    }
+    else {
+        console.log('✅ strictAllowlist is false (not restricted to allowlist)');
+    }
+    if (config.network.allowLocalBinding !== true) {
+        issues.push(`❌ allowLocalBinding is not true: ${config.network.allowLocalBinding}`);
+    }
+    else {
+        console.log('✅ allowLocalBinding is true (local binding allowed)');
+    }
+    if (issues.length > 0) {
+        console.log('\n⚠️  ISSUES FOUND:');
+        issues.forEach(issue => console.log(`   ${issue}`));
+        return false;
+    }
+    console.log('\n✅ All checks passed! Network connectivity should be available.');
+    console.log('\nIf network still fails:');
+    console.log('  1. Check if approval handler is registered in the UI');
+    console.log('  2. Verify the sandbox runtime version supports this config');
+    console.log('  3. Check provider traffic logs for network request details');
+    console.log('  4. Try running without strict read policy to isolate the issue');
+    return true;
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    diagnoseSandboxNetworkConfig();
+}
+//# sourceMappingURL=sandbox-network-diagnostic.js.map

package/dist/utils/shell/sandbox/sandbox-network-diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-network-diagnostic.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-network-diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,SAAS,GAAG;QAChB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,UAAmB,EAAE,EAAE;QACnF,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,UAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE;QAC5G,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAiB,EAAE,EAAE;QAC/E,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAiB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE;KACzG,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IAEjF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,cAAc,CAAC,MAAM,UAAU,CAAC,CAAC;QAEjF,sBAAsB;QACtB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,sBAAsB,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,wCAAwC;IACxC,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,0BAA0B,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAEhF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,4BAA4B,EAAE,CAAC;AACjC,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.d.ts

@@ -31,6 +31,7 @@ export interface ShellSandboxRunner {
 export interface CreateSandboxRuntimeConfigOptions {
     readPolicy?: SandboxReadPolicy;
     allowReadExtra?: string[];
+    allowNetworking?: boolean;
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     onProtectedFiltered?: (filtered: readonly string[]) => void;

package/dist/utils/shell/sandbox/sandbox-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-policy.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAI1E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,mBAAmB,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1D;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAoFD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,iCAAsC,GAAG,oBAAoB,CA6GhH;AAED,eAAO,MAAM,0BAA0B,+IACqG,CAAC"}
+{"version":3,"file":"sandbox-policy.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAI1E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,mBAAmB,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1D;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAsWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,iCAAsC,GAAG,oBAAoB,CA8GhH;AAED,eAAO,MAAM,0BAA0B,+IACqG,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.js

@@ -3,6 +3,250 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
 import { isSecretKey } from './sandbox-env.js';
+const copilotAllowlist = [
+    // GitHub public URLs
+    'https://github.com/login/*',
+    'https://github.com/copilot/*',
+    'https://api.github.com/user',
+    'https://api.github.com/copilot_internal/*',
+    'https://collector.github.com/*',
+    'https://copilot-telemetry.githubusercontent.com/telemetry',
+    'https://default.exp-tas.com',
+    'https://copilot-proxy.githubusercontent.com',
+    'https://origin-tracker.githubusercontent.com',
+    'https://*.githubcopilot.com/*',
+    'https://*.individual.githubcopilot.com',
+    'https://*.business.githubcopilot.com',
+    'https://*.enterprise.githubcopilot.com',
+    'https://copilot-reports.github.com',
+    'https://copilot-reports-*.b01.azurefd.net',
+    'https://usagereports*.blob.core.windows.net',
+    // Copilot voice features
+    'https://ai.azure.com',
+    'https://api.catalog.azureml.ms',
+    'https://*.api.azureml.ms',
+    'https://amlwlrt4*.blob.core.windows.net',
+    // Container Registries: Docker
+    '172.18.0.1',
+    'ghcr.io',
+    'registry.hub.docker.com',
+    '*.docker.io',
+    '*.docker.com',
+    'production.cloudflare.docker.com',
+    'auth.docker.io',
+    'quay.io',
+    'mcr.microsoft.com',
+    'gcr.io',
+    'public.ecr.aws',
+    // GitHub: Content & API
+    '*.githubusercontent.com',
+    'raw.githubusercontent.com',
+    'objects.githubusercontent.com',
+    'lfs.github.com',
+    'github-cloud.githubusercontent.com',
+    'github-cloud.s3.amazonaws.com',
+    'codeload.github.com',
+    'scanning-api.github.com',
+    'api.mcp.github.com',
+    'uploads.github.com/copilot/chat/attachments/',
+    // GitHub: Actions Artifact Storage
+    'productionresultssa0.blob.core.windows.net',
+    'productionresultssa1.blob.core.windows.net',
+    'productionresultssa2.blob.core.windows.net',
+    'productionresultssa3.blob.core.windows.net',
+    'productionresultssa4.blob.core.windows.net',
+    'productionresultssa5.blob.core.windows.net',
+    'productionresultssa6.blob.core.windows.net',
+    'productionresultssa7.blob.core.windows.net',
+    'productionresultssa8.blob.core.windows.net',
+    'productionresultssa9.blob.core.windows.net',
+    'productionresultssa10.blob.core.windows.net',
+    'productionresultssa11.blob.core.windows.net',
+    'productionresultssa12.blob.core.windows.net',
+    'productionresultssa13.blob.core.windows.net',
+    'productionresultssa14.blob.core.windows.net',
+    'productionresultssa15.blob.core.windows.net',
+    'productionresultssa16.blob.core.windows.net',
+    'productionresultssa17.blob.core.windows.net',
+    'productionresultssa18.blob.core.windows.net',
+    'productionresultssa19.blob.core.windows.net',
+    // C# / .NET
+    'nuget.org',
+    'dist.nuget.org',
+    'api.nuget.org',
+    'nuget.pkg.github.com',
+    'dotnet.microsoft.com',
+    'pkgs.dev.azure.com',
+    'builds.dotnet.microsoft.com',
+    'dotnetcli.blob.core.windows.net',
+    'nugetregistryv2prod.blob.core.windows.net',
+    'azuresearch-usnc.nuget.org',
+    'azuresearch-ussc.nuget.org',
+    'dc.services.visualstudio.com',
+    'dot.net',
+    'download.visualstudio.microsoft.com',
+    'dotnetcli.azureedge.net',
+    'ci.dot.net',
+    'www.microsoft.com',
+    'oneocsp.microsoft.com',
+    'www.microsoft.com/pkiops/crl/',
+    // Dart
+    'pub.dev',
+    'pub.dartlang.org',
+    'storage.googleapis.com/pub-packages/',
+    'storage.googleapis.com/dart-archive/',
+    // Go
+    'go.dev',
+    'golang.org',
+    'proxy.golang.org',
+    'sum.golang.org',
+    'pkg.go.dev',
+    'goproxy.io',
+    'storage.googleapis.com/proxy-golang-org-prod/',
+    // Haskell
+    'haskell.org',
+    '*.hackage.haskell.org',
+    'get-ghcup.haskell.org',
+    'downloads.haskell.org',
+    // Java
+    'www.java.com',
+    'jdk.java.net',
+    'api.adoptium.net',
+    'adoptium.net',
+    'search.maven.org',
+    'maven.apache.org',
+    'repo.maven.apache.org',
+    'repo1.maven.org',
+    'maven.pkg.github.com',
+    'maven-central.storage-download.googleapis.com',
+    'maven.google.com',
+    'maven.oracle.com',
+    'jcenter.bintray.com',
+    'oss.sonatype.org',
+    'repo.spring.io',
+    'gradle.org',
+    'services.gradle.org',
+    'plugins.gradle.org',
+    'plugins-artifacts.gradle.org',
+    'repo.grails.org',
+    'download.eclipse.org',
+    'download.oracle.com',
+    // Node.js / JavaScript
+    'npmjs.org',
+    'npmjs.com',
+    'registry.npmjs.com',
+    'registry.npmjs.org',
+    'skimdb.npmjs.com',
+    'npm.pkg.github.com',
+    'api.npms.io',
+    'nodejs.org',
+    'yarnpkg.com',
+    'registry.yarnpkg.com',
+    'repo.yarnpkg.com',
+    'deb.nodesource.com',
+    'get.pnpm.io',
+    'bun.sh',
+    'deno.land',
+    'registry.bower.io',
+    'binaries.prisma.sh',
+    // Perl
+    'cpan.org',
+    'www.cpan.org',
+    'metacpan.org',
+    'cpan.metacpan.org',
+    // PHP
+    'repo.packagist.org',
+    'packagist.org',
+    'getcomposer.org',
+    // Python
+    'pypi.python.org',
+    'pypi.org',
+    'pip.pypa.io',
+    '*.pythonhosted.org',
+    'files.pythonhosted.org',
+    'bootstrap.pypa.io',
+    'conda.binstar.org',
+    'conda.anaconda.org',
+    'binstar.org',
+    'anaconda.org',
+    'download.pytorch.org',
+    'repo.continuum.io',
+    'repo.anaconda.com',
+    // Ruby
+    'rubygems.org',
+    'api.rubygems.org',
+    'rubygems.pkg.github.com',
+    'bundler.rubygems.org',
+    'gems.rubyforge.org',
+    'gems.rubyonrails.org',
+    'index.rubygems.org',
+    'cache.ruby-lang.org',
+    '*.rvm.io',
+    // Rust
+    'crates.io',
+    'index.crates.io',
+    'static.crates.io',
+    'sh.rustup.rs',
+    'static.rust-lang.org',
+    // Swift
+    'download.swift.org',
+    'swift.org',
+    'cocoapods.org',
+    'cdn.cocoapods.org',
+    // HashiCorp
+    'releases.hashicorp.com',
+    'apt.releases.hashicorp.com',
+    'yum.releases.hashicorp.com',
+    'registry.terraform.io',
+    // JSON Schema
+    'json-schema.org',
+    'json.schemastore.org',
+    // Playwright
+    'playwright.download.prss.microsoft.com',
+    'cdn.playwright.dev',
+    'playwright.azureedge.net',
+    'playwright-akamai.azureedge.net',
+    'playwright-verizon.azureedge.net',
+    'storage.googleapis.com/chrome-for-testing-public',
+    // Ubuntu
+    'archive.ubuntu.com',
+    'security.ubuntu.com',
+    'ppa.launchpad.net',
+    'keyserver.ubuntu.com',
+    'azure.archive.ubuntu.com',
+    'api.snapcraft.io',
+    // Debian
+    'deb.debian.org',
+    'security.debian.org',
+    'keyring.debian.org',
+    'packages.debian.org',
+    'debian.map.fastlydns.net',
+    'apt.llvm.org',
+    // Fedora
+    'dl.fedoraproject.org',
+    'mirrors.fedoraproject.org',
+    'download.fedoraproject.org',
+    // CentOS
+    'mirror.centos.org',
+    'vault.centos.org',
+    // Alpine
+    'dl-cdn.alpinelinux.org',
+    'pkg.alpinelinux.org',
+    // Arch
+    'mirror.archlinux.org',
+    'archlinux.org',
+    // SUSE
+    'download.opensuse.org',
+    // Red Hat
+    'cdn.redhat.com',
+    // Common Package Sources
+    'packagecloud.io',
+    'packages.cloud.google.com',
+    'packages.microsoft.com',
+    // Other
+    'dl.k8s.io',
+    'pkgs.k8s.io',
+];
 // Paths the sandbox must never allow writing to, regardless of where term2
 // was launched from. Two classes:
 //   - EXACT: only when cwd (resolved) is exactly the path
@@ -193,12 +437,13 @@ export function createSandboxRuntimeConfig(options = {}) {
     if (protectedFiltered.length > 0) {
         options.onProtectedFiltered?.(protectedFiltered);
     }
+    const allowNetworking = options.allowNetworking ?? false;
     return {
         network: {
-            allowedDomains: [],
-            deniedDomains: ['*'],
-            strictAllowlist: true,
-            allowLocalBinding: false,
+            allowedDomains: copilotAllowlist,
+            deniedDomains: allowNetworking ? [] : ['*'],
+            strictAllowlist: allowNetworking ? false : true,
+            allowLocalBinding: allowNetworking,
         },
         filesystem: {
             denyRead,

package/dist/utils/shell/sandbox/sandbox-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-policy.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAmC/C,2EAA2E;AAC3E,kCAAkC;AAClC,0DAA0D;AAC1D,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,mFAAmF;AACnF,MAAM,2BAA2B,GAAG;IAClC,OAAO,EAAE,wCAAwC;IACjD,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;CACE,CAAC;AAEX,MAAM,6BAA6B,GAAG;IACpC,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,iBAAiB;CACT,CAAC;AAEX,wDAAwD;AACxD,kDAAkD;AAClD,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,CAAC,YAAY,CAAU,CAAC;AAE5D,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,4EAA4E;AAC5E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,6BAA6B,EAAE,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA6C,EAAE;IACxF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;KAC1C,CAAC;IACF,MAAM,wBAAwB,GAAG;QAC/B,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;QACnB,gCAAgC;QAChC,cAAc;QACd,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,eAAe;KAChB,CAAC;IACF,8EAA8E;IAC9E,wFAAwF;IACxF,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,kFAAkF;IAClF,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7G,MAAM,SAAS,GACb,UAAU,KAAK,QAAQ;QACrB,CAAC,CAAC;YACE,aAAa;YACb,MAAM;YACN,WAAW;YACX,YAAY;YACZ,UAAU;YACV,GAAG,iBAAiB;YACpB,GAAG,cAAc;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,QAAQ;YACR,MAAM;YACN,UAAU;YACV,iBAAiB;YACjB,YAAY;YACZ,eAAe;SAChB;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,KAAK;SACzB;QACD,UAAU,EAAE;YACV,QAAQ;YACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,UAAU;YACV,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,IAAI;SACrB;QACD,WAAW,EAAE;YACX,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GACrC,0IAA0I,CAAC"}
+{"version":3,"file":"sandbox-policy.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAoC/C,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,4BAA4B;IAC5B,8BAA8B;IAC9B,6BAA6B;IAC7B,2CAA2C;IAC3C,gCAAgC;IAChC,2DAA2D;IAC3D,6BAA6B;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,+BAA+B;IAC/B,wCAAwC;IACxC,sCAAsC;IACtC,wCAAwC;IACxC,oCAAoC;IACpC,2CAA2C;IAC3C,6CAA6C;IAE7C,yBAAyB;IACzB,sBAAsB;IACtB,gCAAgC;IAChC,0BAA0B;IAC1B,yCAAyC;IAEzC,+BAA+B;IAC/B,YAAY;IACZ,SAAS;IACT,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,kCAAkC;IAClC,gBAAgB;IAChB,SAAS;IACT,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAEhB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,+BAA+B;IAC/B,gBAAgB;IAChB,oCAAoC;IACpC,+BAA+B;IAC/B,qBAAqB;IACrB,yBAAyB;IACzB,oBAAoB;IACpB,8CAA8C;IAE9C,mCAAmC;IACnC,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAE7C,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,6BAA6B;IAC7B,iCAAiC;IACjC,2CAA2C;IAC3C,4BAA4B;IAC5B,4BAA4B;IAC5B,8BAA8B;IAC9B,SAAS;IACT,qCAAqC;IACrC,yBAAyB;IACzB,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,+BAA+B;IAE/B,OAAO;IACP,SAAS;IACT,kBAAkB;IAClB,sCAAsC;IACtC,sCAAsC;IAEtC,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,+CAA+C;IAE/C,UAAU;IACV,aAAa;IACb,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IAEvB,OAAO;IACP,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;IACtB,+CAA+C;IAC/C,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;IACrB,oBAAoB;IACpB,8BAA8B;IAC9B,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IAErB,uBAAuB;IACvB,WAAW;IACX,WAAW;IACX,oBAAoB;IACpB,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,aAAa;IACb,YAAY;IACZ,aAAa;IACb,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,aAAa;IACb,QAAQ;IACR,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IAEpB,OAAO;IACP,UAAU;IACV,cAAc;IACd,cAAc;IACd,mBAAmB;IAEnB,MAAM;IACN,oBAAoB;IACpB,eAAe;IACf,iBAAiB;IAEjB,SAAS;IACT,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,oBAAoB;IACpB,wBAAwB;IACxB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,cAAc;IACd,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IAEnB,OAAO;IACP,cAAc;IACd,kBAAkB;IAClB,yBAAyB;IACzB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,UAAU;IAEV,OAAO;IACP,WAAW;IACX,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,sBAAsB;IAEtB,QAAQ;IACR,oBAAoB;IACpB,WAAW;IACX,eAAe;IACf,mBAAmB;IAEnB,YAAY;IACZ,wBAAwB;IACxB,4BAA4B;IAC5B,4BAA4B;IAC5B,uBAAuB;IAEvB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IAEtB,aAAa;IACb,wCAAwC;IACxC,oBAAoB;IACpB,0BAA0B;IAC1B,iCAAiC;IACjC,kCAAkC;IAClC,kDAAkD;IAElD,SAAS;IACT,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IACtB,0BAA0B;IAC1B,kBAAkB;IAElB,SAAS;IACT,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,0BAA0B;IAC1B,cAAc;IAEd,SAAS;IACT,sBAAsB;IACtB,2BAA2B;IAC3B,4BAA4B;IAE5B,SAAS;IACT,mBAAmB;IACnB,kBAAkB;IAElB,SAAS;IACT,wBAAwB;IACxB,qBAAqB;IAErB,OAAO;IACP,sBAAsB;IACtB,eAAe;IAEf,OAAO;IACP,uBAAuB;IAEvB,UAAU;IACV,gBAAgB;IAEhB,yBAAyB;IACzB,iBAAiB;IACjB,2BAA2B;IAC3B,wBAAwB;IAExB,QAAQ;IACR,WAAW;IACX,aAAa;CACd,CAAC;AAEF,2EAA2E;AAC3E,kCAAkC;AAClC,0DAA0D;AAC1D,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,mFAAmF;AACnF,MAAM,2BAA2B,GAAG;IAClC,OAAO,EAAE,wCAAwC;IACjD,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;CACE,CAAC;AAEX,MAAM,6BAA6B,GAAG;IACpC,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,iBAAiB;CACT,CAAC;AAEX,wDAAwD;AACxD,kDAAkD;AAClD,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,CAAC,YAAY,CAAU,CAAC;AAE5D,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,4EAA4E;AAC5E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,6BAA6B,EAAE,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAO,GAAsC,EAAE;IACxF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;KAC1C,CAAC;IACF,MAAM,wBAAwB,GAAG;QAC/B,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;QACnB,gCAAgC;QAChC,cAAc;QACd,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,eAAe;KAChB,CAAC;IACF,8EAA8E;IAC9E,wFAAwF;IACxF,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,kFAAkF;IAClF,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7G,MAAM,SAAS,GACb,UAAU,KAAK,QAAQ;QACrB,CAAC,CAAC;YACE,aAAa;YACb,MAAM;YACN,WAAW;YACX,YAAY;YACZ,UAAU;YACV,GAAG,iBAAiB;YACpB,GAAG,cAAc;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,QAAQ;YACR,MAAM;YACN,UAAU;YACV,iBAAiB;YACjB,YAAY;YACZ,eAAe;SAChB;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;IACzD,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YAC/C,iBAAiB,EAAE,eAAe;SACnC;QACD,UAAU,EAAE;YACV,QAAQ;YACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,UAAU;YACV,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,IAAI;SACrB;QACD,WAAW,EAAE;YACX,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GACrC,0IAA0I,CAAC"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-sandbox-runner.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAA8B,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,qBAAa,2BAA4B,YAAW,kBAAkB;;IAI9D,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAiB5C,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOvD,mBAAmB,IAAI,IAAI;IAI3B,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;CAwBzD;AAID,wBAAgB,4BAA4B,IAAI,kBAAkB,CAGjE"}
+{"version":3,"file":"shell-sandbox-runner.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAA8B,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGpH,qBAAa,2BAA4B,YAAW,kBAAkB;;IAI9D,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAejD;IAEK,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAKtD;IAED,mBAAmB,IAAI,IAAI,CAE1B;IAED,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;CAyBF;AAID,wBAAgB,4BAA4B,IAAI,kBAAkB,CAGjE"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.js

@@ -1,6 +1,7 @@
 import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
 import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
 import { createSandboxRuntimeConfig } from './sandbox-policy.js';
+import { requestSandboxNetworkApproval } from './sandbox-network-approval.js';
 export class AnthropicShellSandboxRunner {
     #initializedForKey;
     #initializationFailure;
@@ -39,7 +40,10 @@ export class AnthropicShellSandboxRunner {
                 await SandboxManager.reset();
             }
             process.env.CLAUDE_CODE_TMPDIR = SANDBOX_TEMP_DIR;
-            await SandboxManager.initialize(config);
+            const sandboxAskCallback = async ({ host, port }) => {
+                return requestSandboxNetworkApproval({ host, port });
+            };
+            await SandboxManager.initialize(config, sandboxAskCallback);
             this.#initializedForKey = initializationKey;
             this.#initializationFailure = undefined;
         }

package/dist/utils/shell/sandbox/shell-sandbox-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-sandbox-runner.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAqD,MAAM,qBAAqB,CAAC;AAEpH,MAAM,OAAO,2BAA2B;IACtC,kBAAkB,CAAqB;IACvC,sBAAsB,CAAkC;IAExD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAIC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,cAAc,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,mBAAmB;QACjB,cAAc,CAAC,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,MAAc;QAC7C,OAAO,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,SAA+B,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC;QAC/F,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,gBAAgB,CAAC;YAClD,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;YAC5C,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,sBAAsB,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,IAAI,aAAsD,CAAC;AAE3D,MAAM,UAAU,4BAA4B;IAC1C,aAAa,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACpD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"shell-sandbox-runner.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAqD,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,OAAO,2BAA2B;IACtC,kBAAkB,CAAqB;IACvC,sBAAsB,CAAkC;IAExD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAIC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,cAAc,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,mBAAmB;QACjB,cAAc,CAAC,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,MAAc;QAC7C,OAAO,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,MAAM,GAAyB,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC;QAC/F,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,gBAAgB,CAAC;YAClD,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAmC,EAAoB,EAAE;gBACrG,OAAO,6BAA6B,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC,CAAC;YACF,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC5D,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;YAC5C,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,sBAAsB,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,IAAI,aAAsD,CAAC;AAE3D,MAAM,UAAU,4BAA4B;IAC1C,aAAa,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACpD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/utils/shell/shell-session.d.ts

@@ -0,0 +1,22 @@
+import type { SettingsService } from '../../services/settings/settings-service.js';
+import type { ISSHService } from '../../services/service-interfaces.js';
+export interface ShellHistoryEntry {
+    command: string;
+    output: string;
+    exitCode: number | null;
+    timedOut: boolean;
+}
+export declare function serializeShellHistory(entries: ShellHistoryEntry[]): string;
+export declare function executeFormattedShellCommand(params: {
+    command: string;
+    settingsService: Pick<SettingsService, 'get'>;
+    sshInfo?: {
+        remoteDir: string;
+    };
+    sshService?: ISSHService;
+}): Promise<{
+    text: string;
+    exitCode: number | null;
+    timedOut: boolean;
+}>;
+//# sourceMappingURL=shell-session.d.ts.map

package/dist/utils/shell/shell-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-session.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/shell-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAKxE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAgB1E;AAED,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,UAAU,CAAC,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA8BxE"}