@slopus/beer 0.1.1

package/dist/modules/providers/providerPriorityList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPriorityList.d.ts","sourceRoot":"","sources":["../../../sources/modules/providers/providerPriorityList.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAE1F;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,SAAS,iBAAiB,EAAE,EACvC,gBAAgB,EAAE,SAAS,UAAU,EAAE,GACtC,iBAAiB,EAAE,CAarB"}

package/dist/modules/providers/providerPriorityList.js

@@ -0,0 +1,16 @@
+/**
+ * Returns available providers ordered by requested provider id priority.
+ */
+export function providerPriorityList(providers, providerPriority) {
+    const providersById = new Map(providers.map((provider) => [provider.id, provider]));
+    const orderedProviders = [];
+    for (const providerId of providerPriority) {
+        const provider = providersById.get(providerId);
+        if (!provider?.available) {
+            continue;
+        }
+        orderedProviders.push(provider);
+    }
+    return orderedProviders;
+}
+//# sourceMappingURL=providerPriorityList.js.map

package/dist/modules/providers/providerPriorityList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPriorityList.js","sourceRoot":"","sources":["../../../sources/modules/providers/providerPriorityList.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAuC,EACvC,gBAAuC;IAEvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAwB,EAAE,CAAC;IAEjD,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/modules/providers/providerPriorityList.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=providerPriorityList.spec.d.ts.map

package/dist/modules/providers/providerPriorityList.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPriorityList.spec.d.ts","sourceRoot":"","sources":["../../../sources/modules/providers/providerPriorityList.spec.ts"],"names":[],"mappings":""}

package/dist/modules/providers/providerPriorityList.spec.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { providerPriorityList } from "@/modules/providers/providerPriorityList.js";
+describe("providerPriorityList", () => {
+    it("orders available providers by requested provider ids", () => {
+        const providers = [
+            { id: "pi", available: true, command: "pi", priority: 1 }
+        ];
+        const ordered = providerPriorityList(providers, ["pi"]);
+        expect(ordered.map((provider) => provider.id)).toEqual(["pi"]);
+    });
+    it("skips unavailable or missing providers", () => {
+        const providers = [
+            { id: "pi", available: false, command: "pi", priority: 1 }
+        ];
+        const ordered = providerPriorityList(providers, ["pi"]);
+        expect(ordered.map((provider) => provider.id)).toEqual([]);
+    });
+});
+//# sourceMappingURL=providerPriorityList.spec.js.map

package/dist/modules/providers/providerPriorityList.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPriorityList.spec.js","sourceRoot":"","sources":["../../../sources/modules/providers/providerPriorityList.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAEnF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,SAAS,GAAG;YAChB,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;SACjD,CAAC;QAEX,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,SAAS,GAAG;YAChB,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;SAClD,CAAC;QAEX,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/modules/providers/providerTypes.d.ts

@@ -0,0 +1,21 @@
+export type ProviderId = "pi";
+export type ProviderModelSelectionMode = "balanced" | "quality" | "fast";
+export interface ProviderModel {
+    id: string;
+    provider: string;
+    modelId: string;
+    name?: string;
+    reasoning?: boolean;
+    contextWindow?: number;
+    maxTokens?: number;
+    input?: readonly string[];
+}
+export interface ProviderDetection {
+    id: ProviderId;
+    available: boolean;
+    command?: string;
+    version?: string;
+    priority: number;
+    models?: readonly ProviderModel[];
+}
+//# sourceMappingURL=providerTypes.d.ts.map

package/dist/modules/providers/providerTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerTypes.d.ts","sourceRoot":"","sources":["../../../sources/modules/providers/providerTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC;AAC9B,MAAM,MAAM,0BAA0B,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,UAAU,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC"}

package/dist/modules/providers/providerTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=providerTypes.js.map

package/dist/modules/providers/providerTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerTypes.js","sourceRoot":"","sources":["../../../sources/modules/providers/providerTypes.ts"],"names":[],"mappings":""}

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.d.ts

@@ -0,0 +1,17 @@
+import type { InferenceWritePolicy } from "@/modules/sandbox/sandboxInferenceTypes.js";
+export interface SandboxInferenceFilesystemPolicyInput {
+    writePolicy?: InferenceWritePolicy;
+    homeDir?: string;
+    platform?: NodeJS.Platform;
+}
+export interface SandboxInferenceFilesystemPolicy {
+    denyRead: string[];
+    allowWrite: string[];
+    denyWrite: string[];
+}
+/**
+ * Builds per-call filesystem policy for inference execution.
+ * Expects: writePolicy paths are project-relative or absolute host paths.
+ */
+export declare function sandboxInferenceFilesystemPolicy(input?: SandboxInferenceFilesystemPolicyInput): SandboxInferenceFilesystemPolicy;
+//# sourceMappingURL=sandboxInferenceFilesystemPolicy.d.ts.map

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceFilesystemPolicy.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceFilesystemPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AA0CvF,MAAM,WAAW,qCAAqC;IACpD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,GAAE,qCAA0C,GAChD,gCAAgC,CA8BlC"}

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.js

@@ -0,0 +1,88 @@
+import os from "node:os";
+import path from "node:path";
+import { pathResolveFromInitCwd } from "@/modules/util/pathResolveFromInitCwd.js";
+const COMMON_HOME_RELATIVE_DENY_PATHS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".kube",
+    ".docker",
+    ".config/gcloud",
+    ".config/op",
+    ".config/1Password",
+    ".local/share/keyrings",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials"
+];
+const COMMON_SYSTEM_DENY_PATHS = [
+    "/etc/ssh",
+    "/etc/sudoers",
+    "/etc/sudoers.d",
+    "/etc/shadow",
+    "/etc/gshadow",
+    "/etc/ssl/private"
+];
+const DARWIN_HOME_RELATIVE_DENY_PATHS = [
+    "Library/Application Support/iCloud",
+    "Library/Application Support/com.apple.TCC",
+    "Library/Group Containers"
+];
+const DARWIN_SYSTEM_DENY_PATHS = [
+    "/private/etc/ssh",
+    "/private/etc/sudoers",
+    "/private/etc/sudoers.d",
+    "/private/etc/master.passwd"
+];
+const LINUX_SYSTEM_DENY_PATHS = ["/root/.ssh"];
+/**
+ * Builds per-call filesystem policy for inference execution.
+ * Expects: writePolicy paths are project-relative or absolute host paths.
+ */
+export function sandboxInferenceFilesystemPolicy(input = {}) {
+    const platform = input.platform ?? process.platform;
+    const homeDir = path.resolve(input.homeDir ?? os.homedir());
+    const homeDeny = COMMON_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry));
+    const platformHomeDeny = platform === "darwin"
+        ? DARWIN_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry))
+        : [];
+    const platformSystemDeny = platform === "darwin"
+        ? DARWIN_SYSTEM_DENY_PATHS
+        : platform === "linux"
+            ? LINUX_SYSTEM_DENY_PATHS
+            : [];
+    const denyRead = dedupeResolvedPaths([
+        ...homeDeny,
+        ...platformHomeDeny,
+        ...COMMON_SYSTEM_DENY_PATHS,
+        ...platformSystemDeny
+    ]);
+    return {
+        denyRead,
+        allowWrite: allowWriteResolve(input.writePolicy, homeDir),
+        // Keep read/write denials aligned to prevent both access and tampering.
+        denyWrite: [...denyRead]
+    };
+}
+function allowWriteResolve(writePolicy, homeDir) {
+    const authPaths = [
+        path.resolve(homeDir, ".pi")
+    ];
+    if (!writePolicy || writePolicy.mode === "read-only") {
+        // Provider CLIs need writable auth/session state in home directory.
+        return dedupeResolvedPaths(authPaths);
+    }
+    return dedupeResolvedPaths([
+        ...writePolicy.writablePaths.map((entry) => pathResolveFromInitCwd(entry)),
+        ...authPaths
+    ]);
+}
+function dedupeResolvedPaths(values) {
+    const resolved = values
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+        .map((entry) => path.resolve(entry));
+    return Array.from(new Set(resolved));
+}
+//# sourceMappingURL=sandboxInferenceFilesystemPolicy.js.map

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceFilesystemPolicy.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceFilesystemPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGlF,MAAM,+BAA+B,GAAG;IACtC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;CACnB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,kBAAkB;CACnB,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,oCAAoC;IACpC,2CAA2C;IAC3C,0BAA0B;CAC3B,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,kBAAkB;IAClB,sBAAsB;IACtB,wBAAwB;IACxB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,CAAC;AAc/C;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA+C,EAAE;IAEjD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAC7B,CAAC;IACF,MAAM,gBAAgB,GACpB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,kBAAkB,GACtB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACnC,GAAG,QAAQ;QACX,GAAG,gBAAgB;QACnB,GAAG,wBAAwB;QAC3B,GAAG,kBAAkB;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACzD,wEAAwE;QACxE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,WAA6C,EAC7C,OAAe;IAEf,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;KAC7B,CAAC;IAEF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACrD,oEAAoE;QACpE,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,mBAAmB,CACxB;QACE,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC1E,GAAG,SAAS;KACb,CACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,QAAQ,GAAG,MAAM;SACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxInferenceFilesystemPolicy.spec.d.ts.map

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceFilesystemPolicy.spec.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.ts"],"names":[],"mappings":""}

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.js

@@ -0,0 +1,70 @@
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import path from "node:path";
+import { sandboxInferenceFilesystemPolicy } from "@/modules/sandbox/sandboxInferenceFilesystemPolicy.js";
+describe("sandboxInferenceFilesystemPolicy", () => {
+    const initCwd = process.env.INIT_CWD;
+    beforeEach(() => {
+        process.env.INIT_CWD = "/workspace/project";
+    });
+    afterAll(() => {
+        process.env.INIT_CWD = initCwd;
+    });
+    it("allows provider auth state writes when no policy is provided", () => {
+        const result = sandboxInferenceFilesystemPolicy({
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.allowWrite).toEqual([
+            path.resolve("/home/alice/.pi")
+        ]);
+    });
+    it("dedupes and resolves whitelisted write paths with auth dirs", () => {
+        const result = sandboxInferenceFilesystemPolicy({
+            writePolicy: {
+                mode: "write-whitelist",
+                writablePaths: [
+                    "README.md",
+                    "./README.md",
+                    "doc/inference-sandbox.md"
+                ]
+            },
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.allowWrite).toEqual([
+            path.resolve("/workspace/project/README.md"),
+            path.resolve("/workspace/project/doc/inference-sandbox.md"),
+            path.resolve("/home/alice/.pi")
+        ]);
+    });
+    it("adds linux sensitive deny paths to read and write", () => {
+        const result = sandboxInferenceFilesystemPolicy({
+            writePolicy: { mode: "read-only" },
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.denyRead).toEqual(expect.arrayContaining([
+            path.resolve("/home/alice/.ssh"),
+            path.resolve("/home/alice/.gnupg"),
+            path.resolve("/home/alice/.aws"),
+            path.resolve("/etc/ssh"),
+            path.resolve("/etc/ssl/private"),
+            path.resolve("/root/.ssh")
+        ]));
+        expect(result.denyWrite).toEqual(result.denyRead);
+    });
+    it("adds macOS sensitive deny paths to read and write", () => {
+        const result = sandboxInferenceFilesystemPolicy({
+            writePolicy: { mode: "read-only" },
+            platform: "darwin",
+            homeDir: "/Users/alice"
+        });
+        expect(result.denyRead).toEqual(expect.arrayContaining([
+            path.resolve("/Users/alice/.ssh"),
+            path.resolve("/Users/alice/Library/Application Support/com.apple.TCC"),
+            path.resolve("/private/etc/ssh")
+        ]));
+        expect(result.denyWrite).toEqual(result.denyRead);
+    });
+});
+//# sourceMappingURL=sandboxInferenceFilesystemPolicy.spec.js.map

package/dist/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceFilesystemPolicy.spec.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceFilesystemPolicy.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AAEzG,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,oBAAoB,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,gCAAgC,CAAC;YAC9C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,gCAAgC,CAAC;YAC9C,WAAW,EAAE;gBACX,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE;oBACb,WAAW;oBACX,aAAa;oBACb,0BAA0B;iBAC3B;aACF;YACD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,6CAA6C,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,gCAAgC,CAAC;YAC9C,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAClC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,gCAAgC,CAAC;YAC9C,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAClC,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;SACjC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/modules/sandbox/sandboxInferenceGet.d.ts

@@ -0,0 +1,12 @@
+import type { CommandSandbox } from "@/modules/sandbox/sandboxTypes.js";
+import type { InferenceWritePolicy } from "@/modules/sandbox/sandboxInferenceTypes.js";
+export interface SandboxInferenceGetInput {
+    writePolicy?: InferenceWritePolicy;
+    enableWeakerNetworkIsolation?: boolean;
+}
+/**
+ * Returns a per-call sandbox for inference commands.
+ * Network is unrestricted (no network config), writes follow writePolicy.
+ */
+export declare function sandboxInferenceGet(input?: SandboxInferenceGetInput): Promise<CommandSandbox>;
+//# sourceMappingURL=sandboxInferenceGet.d.ts.map

package/dist/modules/sandbox/sandboxInferenceGet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceGet.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceGet.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAEvF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,GAAE,wBAA6B,GACnC,OAAO,CAAC,cAAc,CAAC,CAYzB"}

package/dist/modules/sandbox/sandboxInferenceGet.js

@@ -0,0 +1,18 @@
+import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+import { sandboxInferenceFilesystemPolicy } from "@/modules/sandbox/sandboxInferenceFilesystemPolicy.js";
+/**
+ * Returns a per-call sandbox for inference commands.
+ * Network is unrestricted (no network config), writes follow writePolicy.
+ */
+export async function sandboxInferenceGet(input = {}) {
+    const filesystem = sandboxInferenceFilesystemPolicy({
+        writePolicy: input.writePolicy
+    });
+    const options = typeof input.enableWeakerNetworkIsolation === "boolean"
+        ? { filesystem, enableWeakerNetworkIsolation: input.enableWeakerNetworkIsolation }
+        : { filesystem };
+    return {
+        wrapCommand: (command, abortSignal) => SandboxManager.wrapWithSandbox(command, undefined, options, abortSignal)
+    };
+}
+//# sourceMappingURL=sandboxInferenceGet.js.map

package/dist/modules/sandbox/sandboxInferenceGet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceGet.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceGet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AASzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,gCAAgC,CAAC;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,4BAA4B,KAAK,SAAS;QACrE,CAAC,CAAC,EAAE,UAAU,EAAE,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,EAAE;QAClF,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IAEnB,OAAO;QACL,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CACpC,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/modules/sandbox/sandboxInferenceGet.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxInferenceGet.spec.d.ts.map

package/dist/modules/sandbox/sandboxInferenceGet.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceGet.spec.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceGet.spec.ts"],"names":[],"mappings":""}

package/dist/modules/sandbox/sandboxInferenceGet.spec.js

@@ -0,0 +1,65 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const wrapWithSandboxMock = vi.hoisted(() => vi.fn());
+const sandboxInferenceFilesystemPolicyMock = vi.hoisted(() => vi.fn());
+vi.mock("@anthropic-ai/sandbox-runtime", () => ({
+    SandboxManager: {
+        wrapWithSandbox: wrapWithSandboxMock
+    }
+}));
+vi.mock("./sandboxInferenceFilesystemPolicy.js", () => ({
+    sandboxInferenceFilesystemPolicy: sandboxInferenceFilesystemPolicyMock
+}));
+describe("sandboxInferenceGet", () => {
+    beforeEach(() => {
+        vi.resetModules();
+        wrapWithSandboxMock.mockReset();
+        sandboxInferenceFilesystemPolicyMock.mockReset();
+        sandboxInferenceFilesystemPolicyMock.mockReturnValue({
+            denyRead: ["deny-read"],
+            allowWrite: ["allow-write"],
+            denyWrite: ["deny-write"]
+        });
+    });
+    it("builds read-only filesystem policy by default", async () => {
+        wrapWithSandboxMock.mockResolvedValue("wrapped-command");
+        const { sandboxInferenceGet } = await import("./sandboxInferenceGet.js");
+        const sandbox = await sandboxInferenceGet();
+        await sandbox.wrapCommand("echo hi");
+        expect(sandboxInferenceFilesystemPolicyMock).toHaveBeenCalledWith({
+            writePolicy: undefined
+        });
+        expect(wrapWithSandboxMock).toHaveBeenCalledWith("echo hi", undefined, {
+            filesystem: {
+                denyRead: ["deny-read"],
+                allowWrite: ["allow-write"],
+                denyWrite: ["deny-write"]
+            }
+        }, undefined);
+    });
+    it("forwards enableWeakerNetworkIsolation to sandbox runtime options", async () => {
+        wrapWithSandboxMock.mockResolvedValue("wrapped-command");
+        const { sandboxInferenceGet } = await import("./sandboxInferenceGet.js");
+        const writePolicy = {
+            mode: "write-whitelist",
+            writablePaths: ["README.md"]
+        };
+        const sandbox = await sandboxInferenceGet({
+            writePolicy,
+            enableWeakerNetworkIsolation: true
+        });
+        const wrapped = await sandbox.wrapCommand("echo hi");
+        expect(wrapped).toBe("wrapped-command");
+        expect(sandboxInferenceFilesystemPolicyMock).toHaveBeenCalledWith({
+            writePolicy
+        });
+        expect(wrapWithSandboxMock).toHaveBeenCalledWith("echo hi", undefined, {
+            filesystem: {
+                denyRead: ["deny-read"],
+                allowWrite: ["allow-write"],
+                denyWrite: ["deny-write"]
+            },
+            enableWeakerNetworkIsolation: true
+        }, undefined);
+    });
+});
+//# sourceMappingURL=sandboxInferenceGet.spec.js.map

package/dist/modules/sandbox/sandboxInferenceGet.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceGet.spec.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceGet.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,mBAAmB,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,MAAM,oCAAoC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEvE,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,cAAc,EAAE;QACd,eAAe,EAAE,mBAAmB;KACrC;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,gCAAgC,EAAE,oCAAoC;CACvE,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAChC,oCAAoC,CAAC,SAAS,EAAE,CAAC;QACjD,oCAAoC,CAAC,eAAe,CAAC;YACnD,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,UAAU,EAAE,CAAC,aAAa,CAAC;YAC3B,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,mBAAmB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAErC,MAAM,CAAC,oCAAoC,CAAC,CAAC,oBAAoB,CAAC;YAChE,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAC9C,SAAS,EACT,SAAS,EACT;YACE,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,WAAW,CAAC;gBACvB,UAAU,EAAE,CAAC,aAAa,CAAC;gBAC3B,SAAS,EAAE,CAAC,YAAY,CAAC;aAC1B;SACF,EACD,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,mBAAmB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG;YAClB,IAAI,EAAE,iBAA0B;YAChC,aAAa,EAAE,CAAC,WAAW,CAAC;SAC7B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,WAAW;YACX,4BAA4B,EAAE,IAAI;SACnC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,CAAC,oCAAoC,CAAC,CAAC,oBAAoB,CAAC;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAC9C,SAAS,EACT,SAAS,EACT;YACE,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,WAAW,CAAC;gBACvB,UAAU,EAAE,CAAC,aAAa,CAAC;gBAC3B,SAAS,EAAE,CAAC,YAAY,CAAC;aAC1B;YACD,4BAA4B,EAAE,IAAI;SACnC,EACD,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/modules/sandbox/sandboxInferenceTypes.d.ts

@@ -0,0 +1,7 @@
+export type InferenceWritePolicy = {
+    mode: "read-only";
+} | {
+    mode: "write-whitelist";
+    writablePaths: readonly string[];
+};
+//# sourceMappingURL=sandboxInferenceTypes.d.ts.map

package/dist/modules/sandbox/sandboxInferenceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceTypes.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC"}

package/dist/modules/sandbox/sandboxInferenceTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxInferenceTypes.js.map

package/dist/modules/sandbox/sandboxInferenceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxInferenceTypes.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxInferenceTypes.ts"],"names":[],"mappings":""}

package/dist/modules/sandbox/sandboxTypes.d.ts

@@ -0,0 +1,4 @@
+export interface CommandSandbox {
+    wrapCommand(command: string, abortSignal?: AbortSignal): Promise<string>;
+}
+//# sourceMappingURL=sandboxTypes.d.ts.map

package/dist/modules/sandbox/sandboxTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxTypes.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxTypes.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1E"}

package/dist/modules/sandbox/sandboxTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxTypes.js.map

package/dist/modules/sandbox/sandboxTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxTypes.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/sandboxTypes.ts"],"names":[],"mappings":""}

package/dist/modules/util/commandRun.d.ts

@@ -0,0 +1,22 @@
+import type { CommandSandbox } from "@/modules/sandbox/sandboxTypes.js";
+export interface CommandRunOptions {
+    cwd?: string;
+    timeoutMs?: number;
+    input?: string;
+    allowFailure?: boolean;
+    onStdoutText?: (text: string) => void;
+    onStderrText?: (text: string) => void;
+    sandbox?: CommandSandbox;
+    env?: Record<string, string>;
+}
+export interface CommandRunResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Runs a command and captures stdout/stderr.
+ * Throws on non-zero exit unless allowFailure is true.
+ */
+export declare function commandRun(command: string, args: string[], options?: CommandRunOptions): Promise<CommandRunResult>;
+//# sourceMappingURL=commandRun.d.ts.map

package/dist/modules/util/commandRun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandRun.d.ts","sourceRoot":"","sources":["../../../sources/modules/util/commandRun.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGxE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAuF3B"}

package/dist/modules/util/commandRun.js

@@ -0,0 +1,112 @@
+import { spawn } from "node:child_process";
+import { text as catalog, textFormat } from "@text";
+import { pathResolveFromInitCwd } from "@/modules/util/pathResolveFromInitCwd.js";
+/**
+ * Runs a command and captures stdout/stderr.
+ * Throws on non-zero exit unless allowFailure is true.
+ */
+export async function commandRun(command, args, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 60_000;
+    const cwdResolved = options.cwd ?? pathResolveFromInitCwd(".");
+    const displayCommand = `${command} ${args.join(" ")}`;
+    const abortController = new AbortController();
+    const invocation = await commandInvocationResolve(command, args, cwdResolved, options, abortController.signal);
+    const result = await new Promise((resolve, reject) => {
+        const child = spawn(invocation.command, invocation.args, invocation.spawnOptions);
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const timeout = setTimeout(() => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            abortController.abort();
+            child.kill("SIGTERM");
+            reject(new Error(textFormat(catalog["error_command_timeout"], {
+                ms: timeoutMs,
+                command: displayCommand
+            })));
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => {
+            const text = chunk.toString("utf-8");
+            stdout += text;
+            options.onStdoutText?.(text);
+        });
+        child.stderr.on("data", (chunk) => {
+            const text = chunk.toString("utf-8");
+            stderr += text;
+            options.onStderrText?.(text);
+        });
+        child.on("error", (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timeout);
+            reject(error);
+        });
+        child.on("close", (code) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timeout);
+            resolve({
+                exitCode: code ?? 1,
+                stdout,
+                stderr
+            });
+        });
+        if (options.input) {
+            child.stdin.write(options.input);
+        }
+        child.stdin.end();
+    });
+    if (!options.allowFailure && result.exitCode !== 0) {
+        throw new Error(textFormat(catalog["error_command_failed"], {
+            code: result.exitCode,
+            command: displayCommand
+        }) + `\n${result.stderr || result.stdout}`);
+    }
+    return result;
+}
+async function commandInvocationResolve(command, args, cwd, options, abortSignal) {
+    const env = options.env
+        ? { ...process.env, ...options.env }
+        : process.env;
+    if (!options.sandbox) {
+        return {
+            command,
+            args,
+            spawnOptions: {
+                cwd,
+                stdio: "pipe",
+                env
+            }
+        };
+    }
+    const shellCommand = commandShellBuild(command, args);
+    const sandboxedCommand = await options.sandbox.wrapCommand(shellCommand, abortSignal);
+    return {
+        command: sandboxedCommand,
+        args: [],
+        spawnOptions: {
+            cwd,
+            stdio: "pipe",
+            env,
+            shell: true
+        }
+    };
+}
+function commandShellBuild(command, args) {
+    const commandParts = [command, ...args].map((part) => commandShellQuote(part));
+    return commandParts.join(" ");
+}
+function commandShellQuote(value) {
+    if (/^[A-Za-z0-9_/.:-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=commandRun.js.map

package/dist/modules/util/commandRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandRun.js","sourceRoot":"","sources":["../../../sources/modules/util/commandRun.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAmBlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,IAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,OAAO,EACP,IAAI,EACJ,WAAW,EACX,OAAO,EACP,eAAe,CAAC,MAAM,CACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,CAAC,KAAK,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CACJ,IAAI,KAAK,CACP,UAAU,CAAC,OAAO,CAAC,uBAAuB,CAAE,EAAE;gBAC5C,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;aACxB,CAAC,CACH,CACF,CAAC;QACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,OAAO,CAAC,sBAAsB,CAAE,EAAE;YAC3C,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,OAAO,EAAE,cAAc;SACxB,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAAe,EACf,IAAc,EACd,GAAW,EACX,OAA0B,EAC1B,WAAwB;IAWxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG;QACrB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAEhB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO;YACP,IAAI;YACJ,YAAY,EAAE;gBACZ,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,GAAG;aACJ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,EAAE;QACR,YAAY,EAAE;YACZ,GAAG;YACH,KAAK,EAAE,MAAM;YACb,GAAG;YACH,KAAK,EAAE,IAAI;SACZ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,IAAc;IACxD,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC"}

package/dist/modules/util/commandRun.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=commandRun.spec.d.ts.map

package/dist/modules/util/commandRun.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandRun.spec.d.ts","sourceRoot":"","sources":["../../../sources/modules/util/commandRun.spec.ts"],"names":[],"mappings":""}