@securecode-ai/mcp 0.5.5 → 0.5.7

package/dist/utils/verificationSandbox.js

@@ -0,0 +1,656 @@
+"use strict";
+/**
+ * Verification sandbox — the real security boundary for LLM-generated tests.
+ *
+ * Phase 2 of the agent scan pipeline takes an LLM-generated test script and
+ * executes it on the user's machine. The previous implementation ran the
+ * script via `execFileSync` with the full `process.env` spread and only a
+ * decorative blocklist (`checkTestSafety`) in front. Prompt-injected code
+ * in the scanned source could ride into the verify-generate prompt and
+ * produce a test script that exfiltrated secrets, hit the network, or
+ * spawned processes — `checkTestSafety` missed `fetch`, `http`, `https`,
+ * `fs`, `dns`, `eval`, `new Function`, dynamic imports, and `process.env`
+ * access.
+ *
+ * This module replaces that with a real isolation boundary. Pluggable
+ * backends provide kernel-enforced isolation:
+ *
+ *   - DockerSandbox: `docker run --network=none --cpus=1
+ *     --memory=256m --pids-limit=64 --user 1000:1000 -v <workspace>:/workspace:ro`
+ *     — network disabled at the kernel level, workspace read-only, temp
+ *     dir as tmpfs, no host env, non-root user. Works for any Node/Python
+ *     test script unchanged.
+ *   - DenoSandbox: `deno run --allow-read=<workspace> --allow-write=<tmp>
+ *     --allow-env=NODE_ENV --no-prompt --no-remote` — real permission
+ *     model, no network, no arbitrary fs, no arbitrary env. Only works
+ *     for test scripts that don't use `require()` (Deno is ESM-only by
+ *     default); the verify-generate prompt must be told to emit
+ *     Deno-compatible code when Deno is the backend.
+ *
+ * If neither backend is available, `detectSandbox()` returns null and the
+ * caller MUST return INCONCLUSIVE. Never fall back to unrestricted
+ * `execFileSync` — that is the bug this module exists to fix.
+ *
+ * `checkTestSafety()` remains as defense-in-depth (it can reject scripts
+ * before we pay for a container start), but it is NOT the security
+ * boundary. The sandbox is.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__UnsafeHostSandboxForTests = void 0;
+exports.parseVerdictCommandMode = parseVerdictCommandMode;
+exports.pickImageForCommand = pickImageForCommand;
+exports.pickImageForRunner = pickImageForRunner;
+exports.runnerInvocation = runnerInvocation;
+exports.detectSandbox = detectSandbox;
+exports._resetSandboxCacheForTests = _resetSandboxCacheForTests;
+exports._setSandboxForTests = _setSandboxForTests;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+// ── Verdict parsing (shared by backends) ─────────────────────────────────────
+const PASS_PATTERN = /^PASS:\s*(.+)$/m;
+const FAIL_PATTERN = /^FAIL:\s*(.+)$/m;
+function parseVerdict(output, exitCode, timedOut) {
+    if (timedOut)
+        return 'timeout';
+    if (PASS_PATTERN.test(output))
+        return 'pass';
+    if (FAIL_PATTERN.test(output))
+        return 'fail';
+    if (exitCode === 0)
+        return 'error'; // ran but didn't print a marker
+    return 'error';
+}
+/**
+ * Command-mode verdict: no PASS:/FAIL: markers. Exit code 0 = pass, nonzero = fail.
+ * This is the standard semantics for `npm test`, `pytest`, etc.
+ */
+function parseVerdictCommandMode(exitCode, timedOut) {
+    if (timedOut)
+        return 'timeout';
+    return exitCode === 0 ? 'pass' : 'fail';
+}
+/**
+ * Pick the Docker image for a command-mode executable. Returns null if no
+ * suitable image is configured — the caller returns sandbox-unavailable.
+ */
+function pickImageForCommand(executable) {
+    if (executable === 'npm' || executable === 'npx') {
+        return { image: process.env.SECURECODE_SANDBOX_IMAGE || 'node:20-alpine' };
+    }
+    if (executable === 'pnpm') {
+        const img = process.env.SECURECODE_SANDBOX_PNPM_IMAGE;
+        return img
+            ? { image: img }
+            : { image: null, reason: 'pnpm is not available in the default sandbox image. Set SECURECODE_SANDBOX_PNPM_IMAGE to a pnpm-enabled image to enable pnpm test execution.' };
+    }
+    if (executable === 'yarn') {
+        const img = process.env.SECURECODE_SANDBOX_YARN_IMAGE;
+        return img
+            ? { image: img }
+            : { image: null, reason: 'yarn is not available in the default sandbox image. Set SECURECODE_SANDBOX_YARN_IMAGE to a yarn-enabled image to enable yarn test execution.' };
+    }
+    if (executable === 'bun') {
+        const img = process.env.SECURECODE_SANDBOX_BUN_IMAGE;
+        return img
+            ? { image: img }
+            : { image: null, reason: 'bun is not available in the default sandbox image. Set SECURECODE_SANDBOX_BUN_IMAGE to a bun-enabled image to enable bun test execution.' };
+    }
+    if (executable === 'pytest') {
+        return { image: process.env.SECURECODE_SANDBOX_PY_IMAGE || 'python:3.11-slim' };
+    }
+    return { image: null, reason: `No sandbox image configured for executable: ${executable}` };
+}
+// ── Probe caching ───────────────────────────────────────────────────────────
+const probeCache = new Map();
+function probe(bin, args = ['--version']) {
+    const key = `${bin} ${args.join(' ')}`;
+    if (probeCache.has(key))
+        return probeCache.get(key);
+    let ok = false;
+    try {
+        const r = (0, child_process_1.spawnSync)(bin, args, {
+            stdio: 'ignore',
+            shell: false,
+            timeout: 4000,
+        });
+        ok = r.status === 0;
+    }
+    catch {
+        ok = false;
+    }
+    probeCache.set(key, ok);
+    return ok;
+}
+// ── Helpers ─────────────────────────────────────────────────────────────────
+function fileExtFor(runner) {
+    if (runner === 'python' || runner === 'python3')
+        return '.py';
+    if (runner === 'deno')
+        return '.ts';
+    if (runner === 'tsx' || runner === 'bun' || runner === 'node' || runner === 'pnpm-tsx' || runner === 'yarn-tsx') {
+        return '.test.ts';
+    }
+    return '.test.js';
+}
+function isPythonRunner(runner) {
+    return runner === 'python' || runner === 'python3';
+}
+/**
+ * Pick the Docker image for a script-mode runner. Returns null if no suitable
+ * image is configured — the caller returns sandbox-unavailable so the user
+ * gets a clear "install X / set ENV to enable" message rather than a crash.
+ */
+function pickImageForRunner(runner) {
+    if (isPythonRunner(runner)) {
+        return { image: process.env.SECURECODE_SANDBOX_PY_IMAGE || 'python:3.11-slim' };
+    }
+    switch (runner) {
+        case 'node':
+        case 'tsx':
+        case 'pnpm-tsx':
+        case 'yarn-tsx':
+            // node:20-alpine has `node` + `npx`; tsx runs via `npx tsx` (offline
+            // if already cached, otherwise fails safely — network is disabled).
+            return { image: process.env.SECURECODE_SANDBOX_IMAGE || 'node:20-alpine' };
+        case 'deno': {
+            const img = process.env.SECURECODE_SANDBOX_DENO_IMAGE;
+            return img
+                ? { image: img }
+                : { image: null, reason: 'deno runner requires a Deno image. Set SECURECODE_SANDBOX_DENO_IMAGE (e.g. denoland/deno) to enable deno script execution.' };
+        }
+        case 'bun': {
+            const img = process.env.SECURECODE_SANDBOX_BUN_IMAGE;
+            return img
+                ? { image: img }
+                : { image: null, reason: 'bun runner requires a Bun image. Set SECURECODE_SANDBOX_BUN_IMAGE (e.g. oven/bun) to enable bun script execution.' };
+        }
+        default:
+            return { image: null, reason: `No sandbox image configured for runner: ${runner}` };
+    }
+}
+/**
+ * Build the in-container command string for a runner + script path.
+ * The path is generated by us (unique suffix), so shell quoting is not
+ * required for safety; we still quote defensively in case the workspace
+ * path contains spaces.
+ */
+function runnerInvocation(runner, scriptPath) {
+    const p = `"${scriptPath}"`;
+    switch (runner) {
+        case 'node':
+            return `node ${p}`;
+        case 'tsx':
+            // npx needs no network when the package is already in the image cache.
+            // In node:20-alpine tsx is NOT preinstalled, so this will fail safely
+            // unless SECURECODE_SANDBOX_IMAGE provides tsx. That's acceptable: a
+            // safe failure is better than silently running with `node` (which
+            // would choke on TS syntax and also mask the misconfiguration).
+            return `npx --no-install tsx ${p}`;
+        case 'pnpm-tsx':
+            return `pnpm exec tsx ${p}`;
+        case 'yarn-tsx':
+            return `yarn tsx ${p}`;
+        case 'bun':
+            return `bun run ${p}`;
+        case 'deno':
+            // Deno in Docker: allow-read the workspace so the test can import
+            // project modules. No network (--no-remote isn't available in the
+            // container deno CLI the same way; we rely on --network=none at the
+            // docker level). ESM-only.
+            return `deno run --allow-read=/workspace --allow-env=NODE_ENV --no-prompt ${p}`;
+        case 'python':
+        case 'python3':
+            return `python ${p}`;
+        default:
+            // Unknown runner — fall back to node rather than exec'ing arbitrary
+            // strings. The validator upstream should have rejected this already.
+            return `node ${p}`;
+    }
+}
+function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function ensureSandboxDir(workspaceRoot) {
+    const dir = path.join(workspaceRoot, '.securecode');
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function safeUnlink(p) {
+    if (!p)
+        return;
+    try {
+        fs.unlinkSync(p);
+    }
+    catch { /* best effort */ }
+}
+// Kill a process tree, best-effort across platforms.
+function killTree(proc) {
+    try {
+        if (process.platform === 'win32') {
+            // Windows: use taskkill with /T to kill the tree.
+            if (proc.pid) {
+                (0, child_process_1.spawnSync)('taskkill', ['/pid', String(proc.pid), '/T', '/F'], { stdio: 'ignore', shell: true });
+            }
+        }
+        else {
+            proc.kill('SIGKILL');
+        }
+    }
+    catch { /* already dead */ }
+}
+// ── Docker backend ─────────────────────────────────────────────────────────
+class DockerSandbox {
+    name = 'docker';
+    get available() {
+        return probe('docker', ['info']);
+    }
+    async execute(opts) {
+        // ── Command mode: run a validated executable + args in the sandbox ──
+        if (opts.mode === 'command') {
+            return this.executeCommand(opts);
+        }
+        // ── Script mode (default): write script to temp file and run via runner ──
+        return this.executeScript(opts);
+    }
+    async executeCommand(opts) {
+        const executable = opts.executable;
+        const cmdArgs = opts.args || [];
+        if (!executable) {
+            return { verdict: 'error', output: 'Command mode requires "executable"', exitCode: -1, backend: this.name };
+        }
+        const imageInfo = pickImageForCommand(executable);
+        if (!imageInfo.image) {
+            return {
+                verdict: 'sandbox-unavailable',
+                output: imageInfo.reason || `No sandbox image for ${executable}`,
+                exitCode: -1,
+                backend: this.name,
+            };
+        }
+        const dockerArgs = [
+            'run', '--rm', '-i',
+            '--network=none',
+            '--tmpfs', '/tmp:rw,noexec,nosuid,size=128m,uid=1000,gid=1000',
+            '--cpus=1',
+            '--memory=512m',
+            '--memory-swap=512m',
+            '--pids-limit=128',
+            '--user', '1000:1000',
+            '--workdir', '/workspace',
+            '--env', 'NODE_ENV=test',
+            '--env', 'CI=1',
+            '--env', 'HOME=/tmp',
+            '--env', 'npm_config_cache=/tmp/npm-cache',
+            '-v', `${opts.workspaceRoot}:/workspace:ro`,
+            imageInfo.image,
+            executable,
+            ...cmdArgs,
+        ];
+        return await runSandboxedProcess('docker', dockerArgs, opts, this.name);
+    }
+    async executeScript(opts) {
+        const sandboxDir = ensureSandboxDir(opts.workspaceRoot);
+        const runner = opts.runner || 'node';
+        const ext = fileExtFor(runner);
+        const testFile = path.join(sandboxDir, `verify-test-${uniqueSuffix()}${ext}`);
+        const setupExt = isPythonRunner(runner) ? '.py' : ext;
+        const setupFile = opts.setupScript
+            ? path.join(sandboxDir, `verify-setup-${uniqueSuffix()}${setupExt}`)
+            : null;
+        try {
+            fs.writeFileSync(testFile, opts.script || '', 'utf8');
+            if (setupFile && opts.setupScript) {
+                fs.writeFileSync(setupFile, opts.setupScript, 'utf8');
+            }
+            const imageInfo = pickImageForRunner(runner);
+            if (!imageInfo.image) {
+                return {
+                    verdict: 'sandbox-unavailable',
+                    output: imageInfo.reason || `No sandbox image for runner: ${runner}`,
+                    exitCode: -1,
+                    backend: this.name,
+                };
+            }
+            // The test and setup files are written inside workspaceRoot/.securecode/,
+            // so they're already accessible via the workspace bind mount. We compute
+            // the in-container path from the host path — no separate bind mount needed.
+            // (A separate bind mount would fail on Docker Desktop for Windows because
+            // it can't create a mountpoint inside a read-only bind mount.)
+            const toContainerPath = (hostPath) => '/workspace/' + path.relative(opts.workspaceRoot, hostPath).replace(/\\/g, '/');
+            const containerTestPath = toContainerPath(testFile);
+            const containerSetupPath = setupFile ? toContainerPath(setupFile) : '';
+            const dockerArgs = [
+                'run', '--rm', '-i',
+                '--network=none',
+                '--tmpfs', '/tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000',
+                '--cpus=1',
+                '--memory=256m',
+                '--memory-swap=256m',
+                '--pids-limit=64',
+                '--user', '1000:1000',
+                '--workdir', '/workspace',
+                '--env', 'NODE_ENV=test',
+                '--env', 'CI=1',
+                '--env', 'HOME=/tmp',
+                '--env', 'npm_config_cache=/tmp/npm-cache',
+                '-v', `${opts.workspaceRoot}:/workspace:ro`,
+            ];
+            dockerArgs.push(imageInfo.image);
+            // Build the in-container command for the requested runner.
+            const testCmd = runnerInvocation(runner, containerTestPath);
+            const fullCmd = setupFile
+                ? `${runnerInvocation(runner, containerSetupPath)} && ${testCmd}`
+                : testCmd;
+            // Use sh -c so setup && test chain correctly. The script paths are
+            // generated by us (unique suffix) so there is no injection risk; the
+            // script *content* is already accepted-risk (it runs in the sandbox).
+            dockerArgs.push('sh', '-c', fullCmd);
+            return await runSandboxedProcess('docker', dockerArgs, opts, this.name);
+        }
+        finally {
+            safeUnlink(testFile);
+            safeUnlink(setupFile);
+        }
+    }
+}
+// ── Deno backend ────────────────────────────────────────────────────────────
+//
+// Deno's permission model is a real boundary: `--allow-none` (or no --allow-*
+// flags) denies everything. We allow only:
+//   --allow-read=<workspace>,<testFile>     (read workspace to import modules)
+//   --allow-write=<tmpdir>                  (test may write a temp file)
+//   --allow-env=NODE_ENV                    (only NODE_ENV; not process.env)
+//   --no-remote                             (no network module fetches)
+//   --no-prompt                             (fail instead of prompting)
+//
+// Caveat: Deno is ESM-only by default and cannot run tests that use require().
+// The verify-generate prompt should detect Deno as the runner and emit
+// ESM-compatible code. If the test uses require(), Deno will error out —
+// which is a safe failure (no code executes).
+class DenoSandbox {
+    name = 'deno';
+    get available() {
+        return probe('deno', ['--version']);
+    }
+    async execute(opts) {
+        // Command mode: Deno can't run package-manager test commands (npm, pytest, etc.)
+        // Return sandbox-unavailable so the caller surfaces the right message.
+        if (opts.mode === 'command') {
+            return {
+                verdict: 'sandbox-unavailable',
+                output: 'Deno sandbox cannot execute command-mode tests (npm/pnpm/yarn/bun/pytest). Docker is required for existing-test execution.',
+                exitCode: -1,
+                backend: this.name,
+            };
+        }
+        if (opts.runner === 'python' || opts.runner === 'python3') {
+            // Deno can't run Python.
+            return {
+                verdict: 'blocked',
+                output: 'Deno sandbox cannot execute Python tests.',
+                exitCode: -1,
+                backend: this.name,
+            };
+        }
+        const sandboxDir = ensureSandboxDir(opts.workspaceRoot);
+        const ext = '.mts'; // Deno prefers .mts for ESM TS
+        const testFile = path.join(sandboxDir, `verify-test-${uniqueSuffix()}${ext}`);
+        const tmpDir = path.join(sandboxDir, `verify-tmp-${uniqueSuffix()}`);
+        try {
+            fs.writeFileSync(testFile, opts.script || '', 'utf8');
+            fs.mkdirSync(tmpDir, { recursive: true });
+            // Run setup first (if any) in the same sandbox.
+            if (opts.setupScript) {
+                const setupFile = path.join(sandboxDir, `verify-setup-${uniqueSuffix()}${ext}`);
+                try {
+                    fs.writeFileSync(setupFile, opts.setupScript, 'utf8');
+                    const setupResult = await runSandboxedProcess('deno', [
+                        'run',
+                        '--allow-read=' + opts.workspaceRoot,
+                        '--allow-write=' + tmpDir,
+                        '--allow-env=NODE_ENV',
+                        '--no-remote',
+                        '--no-prompt',
+                        setupFile,
+                    ], { ...opts, timeoutMs: Math.min(opts.timeoutMs, 10_000) }, this.name + '/setup');
+                    if (setupResult.verdict === 'error' || setupResult.verdict === 'timeout') {
+                        return {
+                            verdict: 'error',
+                            output: `Setup script failed: ${setupResult.output}`,
+                            exitCode: setupResult.exitCode,
+                            backend: this.name,
+                        };
+                    }
+                }
+                finally {
+                    safeUnlink(setupFile);
+                }
+            }
+            const denoArgs = [
+                'run',
+                '--allow-read=' + opts.workspaceRoot + ',' + testFile,
+                '--allow-write=' + tmpDir,
+                '--allow-env=NODE_ENV',
+                '--no-remote',
+                '--no-prompt',
+                testFile,
+            ];
+            return await runSandboxedProcess('deno', denoArgs, opts, this.name);
+        }
+        finally {
+            safeUnlink(testFile);
+            try {
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+// ── Subprocess runner shared by Docker/Deno backends ────────────────────────
+function runSandboxedProcess(bin, args, opts, backendLabel) {
+    const isCommandMode = opts.mode === 'command';
+    return new Promise((resolve) => {
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        let cancelled = false;
+        let settled = false;
+        const proc = (0, child_process_1.spawn)(bin, args, {
+            cwd: opts.workspaceRoot,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: false,
+            env: {
+                NODE_ENV: 'test',
+                CI: '1',
+                PATH: process.env.PATH || '',
+                PATHEXT: process.env.PATHEXT || '',
+                SystemRoot: process.env.SystemRoot || '',
+            },
+            windowsHide: true,
+        });
+        proc.stdout?.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+        proc.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killTree(proc);
+        }, opts.timeoutMs);
+        const onAbort = () => {
+            if (settled)
+                return;
+            cancelled = true;
+            killTree(proc);
+        };
+        opts.signal?.addEventListener('abort', onAbort, { once: true });
+        proc.on('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            opts.signal?.removeEventListener('abort', onAbort);
+            resolve({
+                verdict: 'error',
+                output: `Failed to spawn ${bin}: ${err.message}`,
+                exitCode: -1,
+                backend: backendLabel,
+            });
+        });
+        proc.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            opts.signal?.removeEventListener('abort', onAbort);
+            const output = (stdout + '\n' + stderr).trim();
+            const exitCode = code ?? -1;
+            // Cancellation takes priority over timeout — if the user aborted,
+            // we must not report a timeout (which can trigger a retry).
+            if (cancelled) {
+                resolve({
+                    verdict: 'cancelled',
+                    output: `Test cancelled by user. Partial output:\n${output.slice(0, 4000)}`,
+                    exitCode: -1,
+                    backend: backendLabel,
+                });
+                return;
+            }
+            const verdict = isCommandMode
+                ? parseVerdictCommandMode(exitCode, timedOut)
+                : parseVerdict(output, exitCode, timedOut);
+            if (timedOut && verdict === 'error') {
+                resolve({
+                    verdict: 'timeout',
+                    output: `Test timed out after ${opts.timeoutMs}ms. Partial output:\n${output.slice(0, 4000)}`,
+                    exitCode: -1,
+                    backend: backendLabel,
+                });
+                return;
+            }
+            resolve({
+                verdict,
+                output: output.slice(0, 16000),
+                exitCode,
+                backend: backendLabel,
+            });
+        });
+    });
+}
+// ── Backend selection ───────────────────────────────────────────────────────
+let cachedBackend;
+/**
+ * Detect the best available sandbox backend. Docker is preferred (runs any
+ * Node/Python test unchanged); Deno is a fallback for TS/JS tests only.
+ * Returns null if neither is available — the caller MUST return INCONCLUSIVE.
+ */
+function detectSandbox() {
+    if (cachedBackend !== undefined)
+        return cachedBackend;
+    const docker = new DockerSandbox();
+    if (docker.available) {
+        cachedBackend = docker;
+        return docker;
+    }
+    const deno = new DenoSandbox();
+    if (deno.available) {
+        cachedBackend = deno;
+        return deno;
+    }
+    cachedBackend = null;
+    return null;
+}
+/** Reset the cached backend selection. Used by tests. */
+function _resetSandboxCacheForTests() {
+    cachedBackend = undefined;
+}
+/** Force a specific backend (for tests). Pass null to simulate "no sandbox". */
+function _setSandboxForTests(backend) {
+    cachedBackend = backend;
+}
+// ── Unsafe host execution — ONLY for unit tests of the runner logic ─────────
+//
+// This backend runs scripts via direct `execFileSync` with the host's full
+// privileges. It is NOT a security boundary. It exists solely so the runner's
+// PASS/FAIL parsing and cleanup logic can be unit-tested without a real
+// sandbox. Production code MUST NOT use it — `detectSandbox()` never returns
+// it. The constructor requires `SECURECODE_TEST_MODE=1` so it cannot be
+// accidentally instantiated in production.
+class __UnsafeHostSandboxForTests {
+    name = 'unsafe-host-tests-only';
+    constructor() {
+        if (process.env.SECURECODE_TEST_MODE !== '1') {
+            throw new Error('__UnsafeHostSandboxForTests cannot be used in production. Set SECURECODE_TEST_MODE=1 only in tests.');
+        }
+    }
+    get available() { return true; }
+    async execute(opts) {
+        if (opts.mode === 'command') {
+            const executable = opts.executable || 'echo';
+            const cmdArgs = opts.args || [];
+            return await runSandboxedProcess(executable, cmdArgs, opts, this.name);
+        }
+        const sandboxDir = ensureSandboxDir(opts.workspaceRoot);
+        const ext = fileExtFor(opts.runner || 'node');
+        const testFile = path.join(sandboxDir, `verify-test-${uniqueSuffix()}${ext}`);
+        try {
+            fs.writeFileSync(testFile, opts.script || '', 'utf8');
+            let runnerBin = opts.runner || 'node';
+            let runnerArgs = [testFile];
+            if (opts.runner === 'tsx') {
+                runnerBin = 'npx';
+                runnerArgs = ['tsx', testFile];
+            }
+            else if (opts.runner === 'pnpm-tsx') {
+                runnerBin = 'pnpm';
+                runnerArgs = ['exec', 'tsx', testFile];
+            }
+            else if (opts.runner === 'yarn-tsx') {
+                runnerBin = 'yarn';
+                runnerArgs = ['tsx', testFile];
+            }
+            else if (opts.runner === 'deno') {
+                runnerBin = 'deno';
+                runnerArgs = ['run', '--allow-all', testFile];
+            }
+            return await runSandboxedProcess(runnerBin, runnerArgs, opts, this.name);
+        }
+        finally {
+            safeUnlink(testFile);
+        }
+    }
+}
+exports.__UnsafeHostSandboxForTests = __UnsafeHostSandboxForTests;
+//# sourceMappingURL=verificationSandbox.js.map