@ravefox/space 0.2.1 → 0.4.0

package/src/lib/sandbox/seatbelt.js

@@ -1,684 +0,0 @@
-/**
- * macOS Seatbelt wrapper for public local-CLI agents.
- *
- * `sandbox-exec` is deprecated as a public API, but remains the host-native
- * kernel boundary available to local CLI wrappers on current macOS. This
- * profile starts from deny-by-default, admits only the system runtime the CLI
- * needs, and then grants explicit access to:
- *   - the selected CLI executable,
- *   - one workspace (read/write or read-only),
- *   - one isolated state directory, and
- *   - the adapter-owned transient MCP config directory (read-only).
- *
- * The static platform baseline is adapted from OpenAI Codex's Apache-2.0
- * Seatbelt policy:
- * https://github.com/openai/codex/tree/main/codex-rs/sandboxing/src
- *
- * Public seats still need outbound network access for their provider API and
- * declared MCP transports. Host confidentiality therefore comes from the
- * filesystem boundary, not a claim that all network syscalls are disabled.
- */
-
-import { spawnSync } from 'child_process';
-import { lstatSync, realpathSync } from 'fs';
-import { homedir } from 'os';
-import {
-  basename, dirname, isAbsolute, join, resolve,
-} from 'path';
-
-const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
-const DARWIN_MESSAGE = 'Seatbelt sandboxing is available only on macOS';
-
-// Keep this baseline static and auditable. Dynamic paths are appended by
-// buildSeatbeltProfile after strict absolute-path validation + SBPL escaping.
-const PLATFORM_BASELINE = String.raw`
-(version 1)
-(deny default)
-
-; Children inherit the same sandbox. Process inspection is limited to this
-; sandbox, so a model cannot inspect unrelated operator processes.
-(allow process-exec)
-(allow process-fork)
-(allow signal (target same-sandbox))
-(allow process-info* (target same-sandbox))
-
-(allow file-write-data
-  (require-all
-    (path "/dev/null")
-    (vnode-type CHARACTER-DEVICE)))
-
-; Loader + standard system resources. Node opens this one macOS OpenSSL config
-; file at startup; the macOS adapter job's Node was denied it without this rule.
-(allow file-read* file-test-existence
-  (subpath "/Library/Apple")
-  (subpath "/Library/Filesystems/NetFSPlugins")
-  (subpath "/Library/Preferences/Logging")
-  (subpath "/private/var/db/DarwinDirectory/local/recordStore.data")
-  (subpath "/private/var/db/timezone")
-  (subpath "/usr/lib")
-  (subpath "/usr/share")
-  (literal "/System/Library/OpenSSL/openssl.cnf")
-  (subpath "/Library/Preferences")
-  (subpath "/var/db")
-  (subpath "/private/var/db"))
-(allow file-read* file-test-existence
-  (subpath "/System/Volumes/Preboot/Cryptexes/OS"))
-
-(allow file-map-executable
-  (subpath "/Library/Apple/System/Library/Frameworks")
-  (subpath "/Library/Apple/System/Library/PrivateFrameworks")
-  (subpath "/Library/Apple/usr/lib")
-  (subpath "/System/Library/Extensions")
-  (subpath "/System/Library/Frameworks")
-  (subpath "/System/Library/PrivateFrameworks")
-  (subpath "/System/Library/SubFrameworks")
-  (subpath "/System/iOSSupport/System/Library/Frameworks")
-  (subpath "/System/iOSSupport/System/Library/PrivateFrameworks")
-  (subpath "/System/iOSSupport/System/Library/SubFrameworks")
-  (subpath "/usr/lib"))
-
-(allow file-read* file-test-existence
-  (subpath "/Library/Apple/System/Library/Frameworks")
-  (subpath "/Library/Apple/System/Library/PrivateFrameworks")
-  (subpath "/Library/Apple/usr/lib")
-  (subpath "/System/Library/Frameworks")
-  (subpath "/System/Library/PrivateFrameworks")
-  (subpath "/System/Library/SubFrameworks")
-  (subpath "/System/iOSSupport/System/Library/Frameworks")
-  (subpath "/System/iOSSupport/System/Library/PrivateFrameworks")
-  (subpath "/System/iOSSupport/System/Library/SubFrameworks")
-  (subpath "/usr/lib"))
-
-(allow system-mac-syscall (mac-policy-name "vnguard"))
-(allow system-mac-syscall
-  (require-all
-    (mac-policy-name "Sandbox")
-    (mac-syscall-number 67)))
-
-(allow file-read-metadata file-test-existence
-  (literal "/etc")
-  (literal "/tmp")
-  (literal "/var")
-  (literal "/private/etc/localtime")
-  (path-ancestors "/System/Volumes/Data/private"))
-(allow file-read* file-test-existence (literal "/"))
-
-(allow file-read* file-test-existence
-  (literal "/dev/autofs_nowait")
-  (literal "/dev/random")
-  (literal "/dev/urandom")
-  (literal "/private/etc/master.passwd")
-  (literal "/private/etc/passwd")
-  (literal "/private/etc/protocols")
-  (literal "/private/etc/services"))
-(allow file-read* file-test-existence file-write-data file-ioctl
-  (literal "/dev/dtracehelper"))
-(allow file-read* file-test-existence file-write-data file-ioctl
-  (literal "/dev/null")
-  (literal "/dev/zero"))
-(allow file-read-data file-test-existence file-write-data (subpath "/dev/fd"))
-
-; System configuration is readable; user-home configuration is not.
-(allow file-read* (subpath "/etc"))
-(allow file-read* (subpath "/private/etc"))
-(allow file-read* file-test-existence
-  (literal "/System/Library/CoreServices")
-  (literal "/System/Library/CoreServices/.SystemVersionPlatform.plist")
-  (literal "/System/Library/CoreServices/SystemVersion.plist"))
-(allow file-read-metadata file-test-existence
-  (literal "/Library")
-  (literal "/Library/Application Support")
-  (literal "/System/Library")
-  (literal "/System/Cryptexes")
-  (literal "/System/Cryptexes/App")
-  (literal "/System/Cryptexes/OS"))
-(allow file-read-metadata (subpath "/var"))
-(allow file-read-metadata (subpath "/private/var"))
-
-; The wrapper and declared MCP launchers may execute children. Claude
-; bootstraps stdio MCP servers through /bin/sh, whose interpreter is /bin/bash
-; on current macOS. An executable-level shell deny would therefore disable
-; declared MCP capability too. Each adapter denies its built-in shell tool in
-; its own config; any declared child inherits this Seatbelt profile.
-
-(allow file-read-data file-read-metadata (subpath "/bin"))
-(allow file-read-data file-read-metadata (subpath "/sbin"))
-(allow file-read-data file-read-metadata (subpath "/usr/bin"))
-(allow file-read-data file-read-metadata (subpath "/usr/sbin"))
-(allow file-read-data file-read-metadata (subpath "/usr/libexec"))
-(allow file-read* file-test-existence (subpath "/opt/homebrew/bin"))
-(allow file-read* file-test-existence file-map-executable
-  (subpath "/opt/homebrew/Cellar"))
-(allow file-read* file-test-existence
-  (subpath "/opt/homebrew/etc/openssl@3"))
-; openssl@3/cert.pem resolves to this Homebrew CA bundle. Seatbelt checks the
-; target path, so the openssl@3 directory grant alone does not admit TLS roots.
-(allow file-read* file-test-existence
-  (literal "/opt/homebrew/etc/ca-certificates/cert.pem"))
-(allow file-read* (subpath "/opt/homebrew/lib"))
-(allow file-read* file-test-existence file-map-executable
-  (subpath "/opt/homebrew/opt"))
-(allow file-read* file-test-existence (subpath "/usr/local/bin"))
-(allow file-read* (subpath "/usr/local/lib"))
-
-; Standard device handles and PTY support.
-(allow pseudo-tty)
-(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
-(allow file-read* file-write*
-  (require-all
-    (regex #"^/dev/ttys[0-9]+")
-    (extension "com.apple.sandbox.pty")))
-(allow file-ioctl (regex #"^/dev/ttys[0-9]+"))
-(allow file-read* (regex "^/dev/fd/(0|1|2)$"))
-(allow file-write* (regex "^/dev/fd/(1|2)$"))
-(allow file-read* file-write* (literal "/dev/tty"))
-(allow file-read-metadata (literal "/dev"))
-(allow file-read-metadata (regex "^/dev/.*$"))
-(allow file-read-metadata (literal "/dev/stdin"))
-(allow file-read-metadata (literal "/dev/stdout"))
-(allow file-read-metadata (literal "/dev/stderr"))
-
-; Runtime queries used by native binaries and Node/Bun.
-(allow sysctl-read
-  (sysctl-name "hw.activecpu")
-  (sysctl-name "hw.busfrequency_compat")
-  (sysctl-name "hw.byteorder")
-  (sysctl-name "hw.cacheconfig")
-  (sysctl-name "hw.cachelinesize_compat")
-  (sysctl-name "hw.cpufamily")
-  (sysctl-name "hw.cpufrequency")
-  (sysctl-name "hw.cpufrequency_compat")
-  (sysctl-name "hw.cputype")
-  (sysctl-name "hw.ephemeral_storage")
-  (sysctl-name "hw.l1dcachesize_compat")
-  (sysctl-name "hw.l1icachesize_compat")
-  (sysctl-name "hw.l2cachesize_compat")
-  (sysctl-name "hw.l3cachesize_compat")
-  (sysctl-name "hw.logicalcpu")
-  (sysctl-name "hw.logicalcpu_max")
-  (sysctl-name "hw.machine")
-  (sysctl-name "hw.memsize")
-  (sysctl-name "hw.model")
-  (sysctl-name "hw.ncpu")
-  (sysctl-name "hw.packages")
-  (sysctl-name "hw.pagesize")
-  (sysctl-name "hw.pagesize_compat")
-  (sysctl-name "hw.physicalcpu")
-  (sysctl-name "hw.physicalcpu_max")
-  (sysctl-name "hw.tbfrequency_compat")
-  (sysctl-name "hw.vectorunit")
-  (sysctl-name-prefix "hw.optional.arm.")
-  (sysctl-name-prefix "hw.optional.armv8_")
-  (sysctl-name-prefix "hw.perflevel")
-  (sysctl-name "kern.argmax")
-  (sysctl-name "kern.bootargs")
-  (sysctl-name "kern.hostname")
-  (sysctl-name "kern.iossupportversion")
-  (sysctl-name "kern.maxfilesperproc")
-  (sysctl-name "kern.maxproc")
-  (sysctl-name "kern.osproductversion")
-  (sysctl-name "kern.osrelease")
-  (sysctl-name "kern.ostype")
-  (sysctl-name "kern.osvariant_status")
-  (sysctl-name "kern.osversion")
-  (sysctl-name "kern.secure_kernel")
-  (sysctl-name "kern.usrstack64")
-  (sysctl-name "kern.version")
-  (sysctl-name "machdep.cpu.brand_string")
-  (sysctl-name "security.mac.lockdown_mode_state")
-  (sysctl-name "sysctl.proc_cputype")
-  (sysctl-name "vm.loadavg")
-  (sysctl-name-prefix "kern.proc.pgrp.")
-  (sysctl-name-prefix "kern.proc.pid.")
-  (sysctl-name-prefix "net.routetable."))
-(allow sysctl-write (sysctl-name "kern.grade_cputype"))
-
-(allow iokit-open (iokit-registry-entry-class "RootDomainUserClient"))
-(allow ipc-posix-sem)
-(allow ipc-posix-shm-read-data ipc-posix-shm-write-create ipc-posix-shm-write-data
-  (ipc-posix-name "com.apple.AppleDatabaseChanged"))
-(allow ipc-posix-shm-read-data
-  ipc-posix-shm-write-create
-  ipc-posix-shm-write-unlink
-  (ipc-posix-name-regex #"^/__KMP_REGISTERED_LIB_[0-9]+$"))
-(allow ipc-posix-shm-read* (ipc-posix-name-prefix "apple.cfprefs."))
-(allow ipc-posix-shm-read*
-  (ipc-posix-name "apple.shm.notification_center"))
-(allow mach-lookup
-  (global-name "com.apple.PowerManagement.control")
-  (global-name "com.apple.analyticsd")
-  (global-name "com.apple.analyticsd.messagetracer")
-  (global-name "com.apple.appsleep")
-  (global-name "com.apple.bsd.dirhelper")
-  (global-name "com.apple.cfprefsd.agent")
-  (global-name "com.apple.cfprefsd.daemon")
-  (global-name "com.apple.diagnosticd")
-  (global-name "com.apple.FSEvents")
-  (global-name "com.apple.logd")
-  (global-name "com.apple.logd.events")
-  (global-name "com.apple.runningboard")
-  (global-name "com.apple.secinitd")
-  (global-name "com.apple.system.DirectoryService.libinfo_v1")
-  (global-name "com.apple.system.logger")
-  (global-name "com.apple.system.notification_center")
-  (global-name "com.apple.system.opendirectoryd.libinfo")
-  (global-name "com.apple.system.opendirectoryd.membership")
-  (global-name "com.apple.trustd")
-  (global-name "com.apple.trustd.agent")
-  (global-name "com.apple.xpc.activity.unmanaged")
-  (local-name "com.apple.cfprefsd.agent"))
-; cfprefsd serves a sandboxed client a preference domain only when this
-; profile admits user-preference-read for that domain (or file-read-data on
-; its plist, which HOME never gets). An unfiltered rule hands a confined agent
-; every app's domain in ~/Library/Preferences. Admit only the global domain
-; (.GlobalPreferences: locale, languages, units). It is the one domain a
-; sandboxed tool was measured requesting: /usr/bin/security, which Claude
-; runs to read its Keychain credential. Node, OpenCode and Qwen request none.
-; Apple's App Sandbox grants every app this same domain.
-(allow user-preference-read
-  (preference-domain "kCFPreferencesAnyApplication"))
-`;
-
-// Open network, the tail of the default baseline. A `network: 'loopback'`
-// profile leaves it out: no outbound except the loopback ports it lists, and
-// none of the Security framework services the keychain is reached through.
-const OPEN_NETWORK = String.raw`
-; The selected provider and declared MCP transports need outbound network. The model's
-; WebSearch/WebFetch/Bash tools are denied independently in the adapter argv.
-(allow network-outbound)
-(allow system-socket
-  (require-all
-    (socket-domain AF_SYSTEM)
-    (socket-protocol 2)))
-(allow mach-lookup
-  (global-name "com.apple.SecurityServer")
-  (global-name "com.apple.SystemConfiguration.configd")
-  (global-name "com.apple.networkd")
-  (global-name "com.apple.ocspd")
-  (global-name "com.apple.securityd")
-  (global-name "com.apple.securityd.xpc"))
-`;
-
-// The static paths the baseline lets a jail READ (file-read* or file-read-data),
-// as `subpaths` (whole trees) and `literals` (one file or directory entry).
-// Read from PLATFORM_BASELINE itself, so a caller keeping a secret out of the
-// jail (a public seat's provider key file) checks what the profile actually
-// admits rather than a copy that drifts. Metadata-only grants are not reads;
-// regex grants cover /dev only and are left out. Dynamic per-turn paths
-// (workspace, state, executables, read-only directories) are the caller's.
-const READ_OPERATIONS = ['file-read*', 'file-read-data'];
-export const parseSeatbeltReadRoots = (profile) => {
-  const subpaths = new Set();
-  const literals = new Set();
-  const text = profile.replace(/;[^\n]*/g, '');
-  let at = text.indexOf('(allow ');
-  while (at !== -1) {
-    // The rule's balanced s-expression; parentheses inside a string don't count.
-    let depth = 0;
-    let end = at;
-    let inString = false;
-    for (; end < text.length; end += 1) {
-      const ch = text[end];
-      if (inString) { if (ch === '\\') end += 1; else if (ch === '"') inString = false; continue; }
-      if (ch === '"') inString = true;
-      else if (ch === '(') depth += 1;
-      else if (ch === ')') { depth -= 1; if (depth === 0) break; }
-    }
-    const rule = text.slice(at, end + 1);
-    const operations = rule.slice('(allow '.length).split('(')[0].trim().split(/\s+/);
-    if (operations.some((op) => READ_OPERATIONS.includes(op))) {
-      for (const match of rule.matchAll(/\((subpath|literal) "([^"]+)"\)/g)) {
-        (match[1] === 'subpath' ? subpaths : literals).add(match[2]);
-      }
-      // Fail closed: a read filter this cannot turn into a root would be a
-      // readable path the key-file check never sees. Regex grants are known
-      // to cover /dev only, and are held to that.
-      for (const filter of rule.matchAll(/\((path|prefix|regex|home-subpath|home-literal|home-prefix)\s+(#?"[^"]*")/g)) {
-        if (filter[1] !== 'regex' || !/^#?"\^\/dev\//.test(filter[2])) {
-          throw new Error(`seatbeltSystemReadRoots: a read rule uses a filter it cannot check: (${filter[1]} ${filter[2]})`);
-        }
-      }
-    }
-    at = text.indexOf('(allow ', end + 1);
-  }
-  return Object.freeze({
-    subpaths: Object.freeze([...subpaths]),
-    literals: Object.freeze([...literals]),
-  });
-};
-let systemReadRoots = null;
-export const seatbeltSystemReadRoots = () => {
-  if (!systemReadRoots) systemReadRoots = parseSeatbeltReadRoots(PLATFORM_BASELINE);
-  return systemReadRoots;
-};
-
-// Both network modes. On macOS, c-ares (node's dns.Resolver and dns.resolve*)
-// reads the resolver list from configd's DNSConfiguration service while the
-// Resolver is constructed. Denied, that lookup does not always fail: at
-// times it blocks the main thread forever. dsh builds a Resolver as it loads,
-// so confined turns ran to their 900 s timeout without sending a request
-// Admitted, resolution fails fast, because mDNSResponder and port 53
-// stay unreachable in a loopback profile. The service returns configuration
-// and opens no channel out.
-const RESOLVER_CONFIG = String.raw`
-(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration"))
-`;
-
-const escapeSbplString = (value) => String(value)
-  .replaceAll('\\', '\\\\')
-  .replaceAll('"', '\\"')
-  .replaceAll('\n', '\\n')
-  .replaceAll('\r', '\\r');
-
-const literal = (path) => `(literal "${escapeSbplString(path)}")`;
-const subpath = (path) => `(subpath "${escapeSbplString(path)}")`;
-// Every .env and .env.* file under the workspace, at any depth, and everything
-// inside a directory of that name: a real project keeps one beside each
-// package, not only at its root (TASK-294). An SBPL regex literal takes no
-// escapes, so a path it cannot hold is refused.
-const regexUnder = (workspace, tail) => {
-  if (/["\r\n]/.test(workspace)) {
-    throw new Error('Seatbelt workspacePath must not contain a quote or a line break');
-  }
-  const pattern = workspace.replace(/[\\^$.|?*+()[\]{}]/g, '\\$&');
-  return `(regex #"^${pattern}/(.*/)?${tail}")`;
-};
-const envFilesUnder = (workspace) => regexUnder(workspace, '\\.env([./].*)?$');
-// Every .npmrc and .yarnrc* (.yarnrc, .yarnrc.yml) under the workspace, at any
-// depth, and everything inside a directory of that name: they hold registry
-// tokens. Opt-in, since a seat that installs packages reads its project's.
-const registryConfigUnder = (workspace) => regexUnder(workspace, '(\\.npmrc|\\.yarnrc[^/]*)(/.*)?$');
-
-const assertAbsolutePath = (path, label) => {
-  if (!path || !isAbsolute(path)) {
-    throw new Error(`Seatbelt ${label} must be an absolute path`);
-  }
-};
-
-const realpathOrSelf = (path) => {
-  try {
-    return realpathSync(path);
-  } catch {
-    return path;
-  }
-};
-
-const isSymlink = (path) => {
-  try {
-    return lstatSync(path).isSymbolicLink();
-  } catch {
-    return false;
-  }
-};
-
-// A folder this profile lets the jail write is one the jail can also replace:
-// a write rule on a folder covers the folder's own name, so a process from an
-// earlier turn can move it aside and leave a link there. The profile grants
-// the folder's resolved path, so a link at that name would carry the next
-// turn's write grant to wherever it points. Each such folder must therefore
-// resolve to itself: its realpath must be its parent's realpath plus its own
-// name. A folder that does not exist yet has nothing to resolve and is
-// granted by name, as before.
-//
-// Returns the path to grant. It is the same realpath the check compared, read
-// once, so the grant and the check cannot disagree. Seatbelt matches the
-// resolved path of each access, not the name used, so a link planted after
-// this read leads outside the granted path and is denied there: a swap after
-// the check breaks that turn's own writes, it does not widen them. That is why
-// the check is not repeated just before spawn. The time-of-check gap that
-// remains is inside this function, between the two realpath reads, and a
-// swap there is caught by the comparison or yields a grant on the real
-// folder.
-const pinnedRealpath = (given, label) => {
-  // Normalized first, so a trailing `.`, `..` or slash cannot make the name
-  // compared differ from the folder the jail is granted.
-  const path = resolve(given);
-  let stat;
-  try {
-    stat = lstatSync(path);
-  } catch {
-    return path;
-  }
-  const refuse = () => new Error(
-    `refusing a confined turn: its writable ${label} ${path} is a symbolic link or resolves `
-    + 'somewhere other than its own name. A confined turn may write only to a real folder at '
-    + 'the path it was given. Remove the link (the agent recreates its own folders) or point the '
-    + 'agent at a real folder, and run the turn again.',
-  );
-  if (stat.isSymbolicLink()) throw refuse();
-  let resolved;
-  let resolvedParent;
-  try {
-    resolved = realpathSync(path);
-    resolvedParent = realpathSync(dirname(path));
-  } catch {
-    throw refuse();
-  }
-  if (resolved !== join(resolvedParent, basename(path))) throw refuse();
-  return resolved;
-};
-
-export const detectSeatbelt = () => {
-  if (process.platform !== 'darwin') {
-    return { available: false, error: DARWIN_MESSAGE };
-  }
-  try {
-    const result = spawnSync(
-      SANDBOX_EXEC,
-      ['-p', '(version 1)(allow default)', '/usr/bin/true'],
-      { encoding: 'utf8' },
-    );
-    if (result.error || result.status !== 0) {
-      return {
-        available: false,
-        error: `sandbox-exec preflight failed: ${result.error?.message || result.stderr?.trim() || `exit ${result.status}`}`,
-      };
-    }
-    return { available: true, path: SANDBOX_EXEC };
-  } catch (err) {
-    return { available: false, error: `sandbox-exec detection failed: ${err.message}` };
-  }
-};
-
-export const buildSeatbeltProfile = ({
-  workspacePath,
-  workspaceAccess = 'write',
-  executablePath,
-  statePath,
-  mcpConfigDir = null,
-  executablePaths = [],
-  readOnlyPaths = [],
-  readOnlyDirectories = [],
-  loopbackNetworkPorts = [],
-  allowClaudeRuntimeAccess = false,
-  // 'open' (the default) or 'loopback': only the listed loopback ports.
-  network = 'open',
-  // Names directly inside a writable workspace that stay read-only. A
-  // workspace seat granted write keeps its project's .git read-only, so every
-  // change it makes is one `git status` shows the person (TASK-294).
-  readOnlyWorkspaceEntries = [],
-  // Whose process information a jailed process may read: 'same-sandbox' (the
-  // baseline) or 'self'. 'self' stops a child from inspecting its jailed parent
-  // (lsof/proc_pidinfo: open files, cwd), which matters when that parent holds
-  // a seat credential in memory, as a public pi does. Signals are not narrowed:
-  // a parent must still stop the children it started.
-  processInfo = 'same-sandbox',
-  // Pin a writable workspace to its own name (see pinnedRealpath). Set it for
-  // a public seat. Its workspace is usually the scratch folder the CLI made;
-  // when it is an `environment.workspace.path` the operator gave and that path
-  // is a link, the pin refuses the turn (fail-closed) rather than follow it.
-  // Other seats work in a folder the operator chose, which may be a link on
-  // purpose, and leave this unset.
-  pinWorkspace = false,
-  // The realpath the workspace must still resolve to (F200): a workspace
-  // seat's folder as recorded on its first turn (workspace-pin.js). The grant
-  // is refused, not moved, when the folder now resolves elsewhere.
-  expectedWorkspaceRealpath = null,
-  // Folders no rule here may let the jail write, however a grant above is
-  // shaped: a workspace seat's own record of its folder (F200).
-  denyWritePaths = [],
-  // Deny .npmrc and .yarnrc* under the workspace, as .env files are: for a
-  // process that only reads the workspace and installs nothing, such as a
-  // public Codex seat's git tool.
-  denyRegistryConfig = false,
-}) => {
-  for (const [path, label] of [
-    [workspacePath, 'workspacePath'],
-    [executablePath, 'executablePath'],
-    [statePath, 'statePath'],
-  ]) {
-    assertAbsolutePath(path, label);
-  }
-  if (mcpConfigDir) assertAbsolutePath(mcpConfigDir, 'mcpConfigDir');
-  for (const path of denyWritePaths) assertAbsolutePath(path, 'denyWritePaths entry');
-  for (const path of readOnlyPaths) assertAbsolutePath(path, 'readOnlyPaths entry');
-  for (const path of readOnlyDirectories) assertAbsolutePath(path, 'readOnlyDirectories entry');
-  for (const port of loopbackNetworkPorts) {
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      throw new Error('Seatbelt loopbackNetworkPorts entries must be valid TCP ports');
-    }
-  }
-  if (!['same-sandbox', 'self'].includes(processInfo)) {
-    throw new Error('Seatbelt processInfo must be same-sandbox or self');
-  }
-  if (!['open', 'loopback'].includes(network)) {
-    throw new Error('Seatbelt network must be open or loopback');
-  }
-  if (!['read', 'write'].includes(workspaceAccess)) {
-    throw new Error('Seatbelt workspaceAccess must be read or write');
-  }
-  for (const entry of readOnlyWorkspaceEntries) {
-    if (typeof entry !== 'string' || !entry || entry.includes('/') || entry === '.' || entry === '..') {
-      throw new Error('Seatbelt readOnlyWorkspaceEntries entries must be names inside the workspace');
-    }
-  }
-
-  // Two folders here get a write grant: the state folder, and the workspace
-  // when it is writable. The state folder is always pinned (see
-  // pinnedRealpath): the CLI creates it for every seat, so it is never a link
-  // on purpose. The writable workspace is pinned only when the caller asks
-  // (pinWorkspace), which is a public seat. Its workspace is usually a
-  // scratch folder the CLI creates; a public seat given an
-  // `environment.workspace.path` that is a link is refused (fail-closed).
-  // Any other seat's workspace is a folder the operator chose, and a link
-  // there may be the operator's own, which the profile cannot tell from one a
-  // seat left; it keeps the link-following grant on its target, as before. A
-  // read-only workspace also follows links. The other write rules in this
-  // profile name fixed device paths (/dev/null, /dev/zero, /dev/dtracehelper,
-  // /dev/fd, /dev/ptmx, /dev/ttys*, /dev/tty), which no seat can replace.
-  //
-  // The turn reaper is best-effort; this pin is the boundary.
-  const resolvedWorkspace = workspaceAccess === 'write' && pinWorkspace
-    ? pinnedRealpath(workspacePath, 'workspace')
-    : realpathOrSelf(workspacePath);
-  if (expectedWorkspaceRealpath && resolvedWorkspace !== expectedWorkspaceRealpath) {
-    throw new Error(
-      `refusing a workspace turn: ${workspacePath} now resolves to ${resolvedWorkspace}, `
-      + `not ${expectedWorkspaceRealpath} as it did when the turn was checked. The folder was `
-      + 'replaced during the turn\'s preparation; run the turn again.',
-    );
-  }
-  const resolvedExecutable = realpathOrSelf(executablePath);
-  const resolvedState = pinnedRealpath(statePath, 'state folder');
-  const resolvedMcpConfig = mcpConfigDir ? realpathOrSelf(mcpConfigDir) : null;
-  const resolvedReadOnlyPaths = [...new Set(readOnlyPaths.map(realpathOrSelf))];
-  const resolvedReadOnlyDirectories = [...new Set(readOnlyDirectories.map(realpathOrSelf))];
-  const executables = [...new Set(
-    [resolvedExecutable, process.execPath, ...executablePaths]
-      .filter(Boolean)
-      .map(realpathOrSelf),
-  )];
-  for (const executable of executables) {
-    assertAbsolutePath(executable, 'executable path');
-  }
-
-  const workspaceRule = workspaceAccess === 'write'
-    ? `(allow file-read* file-test-existence file-write* ${subpath(resolvedWorkspace)})`
-    : `(allow file-read* file-test-existence ${subpath(resolvedWorkspace)})`;
-  const executableRules = executables.map((executable) => [
-    `(allow file-read* file-test-existence file-map-executable ${literal(executable)})`,
-    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(executable)}"))`,
-  ].join('\n')).join('\n');
-  const executableSymlinkRules = isSymlink(executablePath) ? [
-    `(allow file-read* file-test-existence ${literal(executablePath)})`,
-    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(executablePath)}"))`,
-  ].join('\n') : '';
-  const mcpRule = resolvedMcpConfig
-    ? `(allow file-read* file-test-existence ${subpath(resolvedMcpConfig)})`
-    : '';
-  const readOnlyRules = resolvedReadOnlyPaths.map((path) => (
-    `(allow file-read* file-test-existence ${literal(path)})`
-  )).concat(resolvedReadOnlyDirectories.map((path) => [
-    `(allow file-read* file-test-existence ${subpath(path)})`,
-    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(path)}"))`,
-  ].join('\n'))).join('\n');
-  // A symlinked entry is held at both its name and its target, so the write
-  // cannot land through whichever path the link resolves to.
-  const readOnlyWorkspaceRules = [...new Set(readOnlyWorkspaceEntries.flatMap((entry) => {
-    const entryPath = join(resolvedWorkspace, entry);
-    return [entryPath, realpathOrSelf(entryPath)];
-  }))].map((path) => `(deny file-write* ${subpath(path)})`).join('\n');
-  const loopbackNetworkRules = [...new Set(loopbackNetworkPorts)].map((port) => (
-    `(allow network-outbound (remote tcp "localhost:${port}"))`
-  )).join('\n');
-  const claudeRuntimeRules = allowClaudeRuntimeAccess ? (() => {
-    // Claude's temp root is the seat's own: the adapter sets CLAUDE_CODE_TMPDIR
-    // under statePath, which the state rule above already admits. The
-    // uid-wide /private/tmp/claude-<uid> holds every other Claude session's
-    // temp files on the machine, so it is not admitted.
-    // Claude's security helper needs the encrypted login-keychain database and
-    // this non-secret locale file: that one file, not the Keychains folder.
-    const loginKeychain = join(homedir(), 'Library', 'Keychains', 'login.keychain-db');
-    const textEncoding = join(homedir(), '.CFUserTextEncoding');
-    return [
-      `(allow file-read* file-test-existence ${literal(loginKeychain)} ${literal(textEncoding)})`,
-      `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(loginKeychain)}"))`,
-    ];
-  })() : [];
-
-  return [
-    `${PLATFORM_BASELINE}${RESOLVER_CONFIG}${network === 'open' ? OPEN_NETWORK : ''}`.trim(),
-    executableRules,
-    executableSymlinkRules,
-    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedWorkspace)}"))`,
-    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedState)}"))`,
-    workspaceRule,
-    `(allow file-read* file-test-existence file-write* ${subpath(resolvedState)})`,
-    loopbackNetworkRules,
-    mcpRule,
-    readOnlyRules,
-    // The workspace is intentionally readable, but credential-like nested
-    // paths are not. Explicit deny wins over the broad workspace allow.
-    `(deny file-read* file-write* ${subpath(join(resolvedWorkspace, '.commonly'))})`,
-    `(deny file-read* file-write* ${subpath(join(resolvedWorkspace, '.codex'))})`,
-    `(deny file-read* file-write* ${envFilesUnder(resolvedWorkspace)})`,
-    denyRegistryConfig ? `(deny file-read* file-write* ${registryConfigUnder(resolvedWorkspace)})` : '',
-    readOnlyWorkspaceRules,
-    // After every allow above, so a workspace that contained one of these
-    // folders still could not write it (later rules win).
-    [...new Set(denyWritePaths.flatMap((path) => [path, realpathOrSelf(path)]))]
-      .map((path) => `(deny file-write* ${subpath(path)})`).join('\n'),
-    ...claudeRuntimeRules,
-    // Later rules win, so this narrows the baseline's same-sandbox allow.
-    processInfo === 'self'
-      ? '(deny process-info* (target same-sandbox))\n(allow process-info* (target self))'
-      : '',
-  ].filter(Boolean).join('\n\n');
-};
-
-export const wrapArgvWithSeatbelt = (innerArgv, opts = {}) => {
-  if (process.platform !== 'darwin') {
-    throw new Error(DARWIN_MESSAGE);
-  }
-  if (!Array.isArray(innerArgv) || innerArgv.length === 0) {
-    throw new Error('wrapArgvWithSeatbelt requires a non-empty innerArgv');
-  }
-  const profile = buildSeatbeltProfile(opts);
-  return [SANDBOX_EXEC, '-p', profile, ...innerArgv];
-};
-
-export const publicClaudeStateRoot = (agentKey) => (
-  join(homedir(), '.commonly', 'claude-homes', agentKey)
-);
-
-export const SEATBELT_DARWIN_MESSAGE = DARWIN_MESSAGE;