@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/ProcessConfinement.js

@@ -0,0 +1,311 @@
+/**
+ * The kernel's `ProcessConfinement` seam, filled with this host's native
+ * sandbox: bubblewrap on Linux, seatbelt on macOS.
+ *
+ * `@smthrs/kernel`'s `ChildProcessSpawner.layer` hands every stage that passed
+ * its `proc:spawn` check to the confinement in its context, together with the
+ * `ProcessConfinement.Profile` the grants in force admit. This module turns
+ * that profile into a {@link ProcessSandbox.Request}, plans it against the
+ * workspace, and wraps the stage's argv in the mechanism the host has, so an
+ * approved `bash` can write only where an `fs:write` grant says and reach the
+ * network only when a `net:*` grant says. A stage that asked for the platform
+ * shell is spelled out as `/bin/sh -c <line>` first: wrapping a `shell: true`
+ * command line would otherwise leave its redirections and pipes to a shell
+ * outside the sandbox.
+ *
+ * A host with no mechanism is the one decision this module leaves to its
+ * caller: {@link Options.unavailable} either refuses the spawn, so nothing
+ * runs that the profile would not have confined, or runs it unconfined with
+ * a warning, the way every host did before this seam existed. A write set
+ * the mechanism cannot enforce safely, a symbolic link below the workspace
+ * root, is always refused.
+ *
+ * @since 1.0.0-rc.1
+ */
+import * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as PlatformError from "effect/PlatformError";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as NodeFs from "node:fs";
+import * as NodeOs from "node:os";
+import * as NodePath from "node:path";
+import * as ProcessSandbox from "./ProcessSandbox.js";
+const shellLine = (command) => [command.command, ...command.args].join(" ");
+/**
+ * The argv a stage executes, with a shell request made explicit.
+ *
+ * Node runs a `shell: true` stage as `/bin/sh -c <line>` on POSIX, and a
+ * string shell as `<shell> -c <line>`; the wrapper needs that program to be
+ * the one it confines, so the shell becomes the argv's first token and the
+ * spawned stage no longer asks for one.
+ */
+const argvOf = (command) => {
+    const shell = command.options.shell;
+    if (shell === undefined || shell === false)
+        return [command.command, ...command.args];
+    return [shell === true ? "/bin/sh" : shell, "-c", shellLine(command)];
+};
+const failure = (tag, command, description, cause) => PlatformError.systemError({
+    _tag: tag,
+    module: "ProcessConfinement",
+    method: "confine",
+    pathOrDescriptor: shellLine(command),
+    description,
+    cause
+});
+const messageOf = (cause) => ProcessSandbox.isUnenforceable(cause)
+    ? cause.message
+    : cause instanceof Error
+        ? cause.message
+        : String(cause);
+/** Classic BPF for seccomp_data: deny host Unix sockets and io_uring, preserving stream socketpair.
+ * Closed networking additionally denies every IP socket family.
+ * Wrong ABI and x32 syscall encodings fail closed rather than bypassing socket(). */
+const networkFilter = (architecture, network) => {
+    const abi = architecture === "x64"
+        ? { audit: 0xc000003e, socket: 41, socketpair: 53 }
+        : architecture === "arm64"
+            ? { audit: 0xc00000b7, socket: 198, socketpair: 199 }
+            : undefined;
+    if (abi === undefined)
+        throw new Error(`native-network seccomp is unavailable on ${architecture}`);
+    const instructions = [
+        [0x20, 0, 0, 4], // load audit architecture
+        [0x15, 1, 0, abi.audit],
+        [0x06, 0, 0, 0x80000000], // kill unsupported ABI
+        [0x20, 0, 0, 0], // load syscall number
+        [0x35, 0, 1, 0x40000000],
+        [0x06, 0, 0, 0x80000000], // kill x32 / invalid high syscall numbers
+        [0x15, 0, 1, 425], // io_uring_setup on both supported ABIs
+        [0x06, 0, 0, 0x00050001], // io_uring can otherwise create sockets without socket()
+        [0x15, 0, 6, abi.socketpair],
+        [0x20, 0, 0, 16], // socketpair domain
+        [0x15, 0, 4, 1], // AF_UNIX
+        [0x20, 0, 0, 24], // socketpair type, low 32 bits of args[1]
+        [0x54, 0, 0, 0xf], // strip SOCK_NONBLOCK and SOCK_CLOEXEC
+        [0x15, 1, 0, 1], // only SOCK_STREAM; Linux aliases SOCK_RAW to datagram operations
+        [0x06, 0, 0, 0x00050001],
+        [0x20, 0, 0, 0] // reload syscall number before the socket() policy
+    ];
+    if (network === "none") {
+        instructions.push([0x15, 0, 1, abi.socket], [0x06, 0, 0, 0x00050001]); // EPERM for every socket family
+    }
+    else {
+        instructions.push([0x15, 0, 3, abi.socket], [0x20, 0, 0, 16], // socket domain, low 32 bits of args[0]
+        [0x15, 0, 1, 1], // AF_UNIX; IP families remain available
+        [0x06, 0, 0, 0x00050001]);
+    }
+    instructions.push([0x06, 0, 0, 0x7fff0000]); // SECCOMP_RET_ALLOW
+    const bytes = new Uint8Array(instructions.length * 8);
+    const view = new DataView(bytes.buffer);
+    for (const [index, [code, jt, jf, value]] of instructions.entries()) {
+        view.setUint16(index * 8, code, true);
+        view.setUint8(index * 8 + 2, jt);
+        view.setUint8(index * 8 + 3, jf);
+        view.setUint32(index * 8 + 4, value, true);
+    }
+    return bytes;
+};
+/**
+ * Builds the native confinement.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export const make = (options = {}) => {
+    const hostFacts = options.host ?? ProcessSandbox.host();
+    const temporaryRoot = options.temporaryDirectory ?? NodeOs.tmpdir();
+    const unavailable = options.unavailable ?? "refuse";
+    const confine = Effect.fn("ProcessConfinement.confine")(function* (command, profile) {
+        const request = {
+            network: profile.network,
+            unixSockets: false,
+            strict: true,
+            reads: profile.reads,
+            writes: profile.writes,
+            readOnly: profile.readOnly
+        };
+        const selected = ProcessSandbox.select(request, hostFacts);
+        if (ProcessSandbox.isUnenforceable(selected)) {
+            if (unavailable === "refuse") {
+                return yield* failure("NotFound", command, `${selected.message} This host refuses to spawn unconfined.`, selected);
+            }
+            yield* Effect.logWarning(`${selected.message} Running unconfined.`);
+            return command;
+        }
+        // The stage's directory is absolute: the kernel spawner roots it first.
+        const cwd = command.options.cwd ?? profile.workspaceRoot;
+        const within = (root, path) => {
+            const relative = NodePath.relative(root, path);
+            return relative !== ".." && !relative.startsWith(`..${NodePath.sep}`) && !NodePath.isAbsolute(relative);
+        };
+        if (!within(profile.workspaceRoot, cwd)) {
+            return yield* failure("PermissionDenied", command, "command directory is outside the workspace", undefined);
+        }
+        // A lexical workspace path can enter an unrelated host directory through
+        // a symlink. Check the real directory before granting or preparing a run.
+        const canonical = yield* Effect.try({
+            try: () => {
+                const root = NodeFs.realpathSync(profile.workspaceRoot);
+                const directory = NodeFs.realpathSync(cwd);
+                if (!within(root, directory))
+                    throw new Error("command directory is outside the workspace");
+                for (const relative of profile.reads) {
+                    const lexical = NodePath.resolve(root, relative);
+                    if (!within(root, lexical))
+                        continue;
+                    // A read bind follows its source symlink. Refuse a grant that would
+                    // therefore mount unrelated host bytes inside the workspace.
+                    if (NodeFs.existsSync(lexical)) {
+                        const real = NodeFs.realpathSync(lexical);
+                        if (!within(root, real))
+                            throw new Error("read grant resolves outside the workspace");
+                        if (real !== lexical)
+                            throw new Error("read grant is a symbolic link");
+                    }
+                }
+                return { root, cwd: directory };
+            },
+            catch: (cause) => failure("PermissionDenied", command, messageOf(cause), cause)
+        });
+        // The private tmp lives as long as the spawn's scope, however preparation
+        // ends; the declared write directories are created so the mechanism has
+        // something to bind, which the grant that opened them already permits.
+        const allocatedTmp = yield* Effect.acquireRelease(Effect.try({
+            try: () => NodeFs.mkdtempSync(NodePath.join(temporaryRoot, "smithers-confinement-")),
+            catch: (cause) => failure("Unknown", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)
+        }), (directory) => Effect.sync(() => {
+            try {
+                NodeFs.rmSync(directory, { recursive: true, force: true });
+            }
+            catch {
+                // Cleanup is best-effort when the host refuses directory removal.
+            }
+        }));
+        const tmp = yield* Effect.try({
+            try: () => NodeFs.realpathSync(allocatedTmp),
+            catch: (cause) => failure("Unknown", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)
+        });
+        const planned = yield* Effect.try({
+            try: () => ProcessSandbox.plan(request, { workspaceRoot: canonical.root, cwd: canonical.cwd, tmp }, hostFacts),
+            catch: (cause) => failure("Unknown", command, `could not plan the confinement: ${messageOf(cause)}`, cause)
+        });
+        if (ProcessSandbox.isUnenforceable(planned)) {
+            return yield* failure("PermissionDenied", command, planned.message, planned);
+        }
+        // Build outputs may grant their parent directory. An agent grant must
+        // never inherit that widening when a requested tree is already a file.
+        const exactWrites = profile.writes.map((relative) => NodePath.resolve(planned.workspaceRoot, relative));
+        if (planned.writes.some((write) => !exactWrites.includes(write))) {
+            return yield* failure("PermissionDenied", command, "write grant is not a directory tree", undefined);
+        }
+        // A workspace link does not grant authority to its target on the host.
+        const confinement = { ...planned, externalReads: [] };
+        yield* Effect.try({
+            try: () => {
+                ProcessSandbox.validateWrites(confinement, hostFacts);
+                NodeFs.mkdirSync(NodePath.join(tmp, "home"), { recursive: true });
+                NodeFs.mkdirSync(NodePath.join(tmp, "cache"), { recursive: true });
+                for (const write of planned.writes)
+                    NodeFs.mkdirSync(write, { recursive: true });
+            },
+            catch: (cause) => failure("Unknown", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)
+        });
+        // Only the target receives its requested environment. Dynamic-loader and
+        // other startup variables must never configure the host sandbox launcher.
+        const targetEnvironment = {};
+        const inherited = command.options.env === undefined || command.options.extendEnv === true;
+        for (const [name, value] of Object.entries(inherited ? process.env : {})) {
+            // Bash exports functions as names such as BASH_FUNC_which%%. These
+            // ambient entries cannot be exported by the portable inner launcher.
+            if (typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+                targetEnvironment[name] = value;
+        }
+        for (const [name, value] of Object.entries(command.options.env ?? {})) {
+            if (typeof value === "string")
+                targetEnvironment[name] = value;
+            else
+                delete targetEnvironment[name];
+        }
+        const privateEnvironment = ProcessSandbox.environment(confinement);
+        const script = yield* Effect.try({
+            try: () => {
+                const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+                const exports = [];
+                for (const [name, value] of Object.entries({ ...targetEnvironment, ...privateEnvironment })) {
+                    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+                        throw new Error("environment variable name is not portable");
+                    if (value.includes("\0"))
+                        throw new Error("environment variable contains a null byte");
+                    exports.push(`export ${name}=${quote(value)}`);
+                }
+                const file = NodePath.join(tmp, "environment.sh");
+                // Values stay off argv and journal receipts; the script is private,
+                // removed with the scope, and interpreted only inside confinement.
+                NodeFs.writeFileSync(file, [
+                    "#!/bin/sh",
+                    "unset ENV BASH_ENV CDPATH PWD OLDPWD SHLVL _",
+                    ...exports,
+                    "exec \"$@\"",
+                    ""
+                ].join("\n"), { flag: "wx", mode: 0o600 });
+                return file;
+            },
+            catch: (cause) => failure("PermissionDenied", command, messageOf(cause), cause)
+        });
+        // Resolve the actual program before wrapping it in the environment shell.
+        // Otherwise the sandbox sees only /usr/bin/env and omits a native helper
+        // installed outside its ordinary runtime paths.
+        const originalArgv = argvOf(command);
+        const launch = ProcessSandbox.launcher(originalArgv[0], targetEnvironment.PATH, [...confinement.reads, ...confinement.writes, ...confinement.externalReads], confinement.workspaceRoot, hostFacts);
+        const targetArgv = ["/usr/bin/env", "-i", "/bin/sh", script, launch.program, ...originalArgv.slice(1)];
+        const wrapped = yield* Effect.try({
+            try: () => ProcessSandbox.wrap({ ...confinement, externalReads: [...confinement.externalReads, ...launch.reads, script] }, targetArgv, targetEnvironment, hostFacts),
+            catch: (cause) => failure("Unknown", command, `could not render the confinement: ${messageOf(cause)}`, cause)
+        });
+        let [executable, ...args] = wrapped.argv;
+        if (selected._tag === "bubblewrap") {
+            const filter = yield* Effect.try({
+                try: () => {
+                    const file = NodePath.join(tmp, "network.seccomp");
+                    NodeFs.writeFileSync(file, networkFilter(process.arch, profile.network), { flag: "wx", mode: 0o600 });
+                    return file;
+                },
+                catch: (cause) => failure("PermissionDenied", command, messageOf(cause), cause)
+            });
+            let fd = 3;
+            while (command.options.additionalFds?.[`fd${fd}`] !== undefined)
+                fd++;
+            // A regular file avoids a filter-input pipe whose early closure can
+            // surface as an unhandled ECONNRESET before bwrap reports its refusal.
+            args = [
+                "-c",
+                `exec ${fd}<"$1"; shift; exec "$@"`,
+                "smithers-seccomp",
+                filter,
+                executable,
+                "--seccomp",
+                String(fd),
+                ...args
+            ];
+            executable = "/bin/sh";
+        }
+        return ChildProcess.make(executable, args, {
+            ...command.options,
+            cwd: canonical.cwd,
+            shell: false,
+            env: { PATH: "/usr/bin:/bin:/usr/sbin:/sbin", LANG: "C", ...privateEnvironment },
+            extendEnv: false
+        });
+    });
+    return KernelProcessConfinement.ProcessConfinement.of({ confine });
+};
+/**
+ * Provides the native confinement.
+ *
+ * @category layers
+ * @since 1.0.0-rc.1
+ */
+export const layer = (options = {}) => Layer.succeed(KernelProcessConfinement.ProcessConfinement)(make(options));
+//# sourceMappingURL=ProcessConfinement.js.map

package/dist/esm/ProcessConfinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessConfinement.js","sourceRoot":"","sources":["../../src/ProcessConfinement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AAErD,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,KAAK,MAAM,MAAM,SAAS,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAA;AACjC,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAsBrD,MAAM,SAAS,GAAG,CAAC,OAAqC,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEjH;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,CAAC,OAAqC,EAAyB,EAAE;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrF,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CACd,GAAgD,EAChD,OAAqC,EACrC,WAAmB,EACnB,KAAc,EACe,EAAE,CAC/B,aAAa,CAAC,WAAW,CAAC;IACxB,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,SAAS;IACjB,gBAAgB,EAAE,SAAS,CAAC,OAAO,CAAC;IACpC,WAAW;IACX,KAAK;CACN,CAAC,CAAA;AAEJ,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAC3C,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC;IACnC,CAAC,CAAC,KAAK,CAAC,OAAO;IACf,CAAC,CAAC,KAAK,YAAY,KAAK;QACxB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAEnB;;qFAEqF;AACrF,MAAM,aAAa,GAAG,CAAC,YAAoB,EAAE,OAAwB,EAAc,EAAE;IACnF,MAAM,GAAG,GAAG,YAAY,KAAK,KAAK;QAChC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACnD,CAAC,CAAC,YAAY,KAAK,OAAO;YAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE;YACrD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,EAAE,CAAC,CAAA;IAClG,MAAM,YAAY,GAAqD;QACrE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,0BAA0B;QAC3C,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;QACvB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,uBAAuB;QACjD,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,sBAAsB;QACvC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;QACxB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,0CAA0C;QACpE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,wCAAwC;QAC3D,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,yDAAyD;QACnF,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;QAC5B,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,oBAAoB;QACtC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU;QAC3B,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,0CAA0C;QAC5D,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,uCAAuC;QAC1D,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,kEAAkE;QACnF,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;QACxB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD;KACpE,CAAA;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA,CAAC,gCAAgC;IACxG,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,wCAAwC;QAC1D,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,wCAAwC;QACzD,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CACzB,CAAA;IACH,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA,CAAC,oBAAoB;IAChE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAChC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,UAAmB,EAAE,EAAoC,EAAE;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAA;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAA;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAC/D,OAAqC,EACrC,OAAyC;QAEzC,MAAM,OAAO,GAA2B;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,UAAU,EACV,OAAO,EACP,GAAG,QAAQ,CAAC,OAAO,yCAAyC,EAC5D,QAAQ,CACT,CAAA;YACH,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,OAAO,sBAAsB,CAAC,CAAA;YACnE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,wEAAwE;QACxE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,aAAa,CAAA;QACxD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC9C,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QACzG,CAAC,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,4CAA4C,EAAE,SAAS,CAAC,CAAA;QAC7G,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAClC,GAAG,EAAE,GAAG,EAAE;gBACR,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;gBACvD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;gBAC3F,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;oBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;wBAAE,SAAQ;oBACpC,oEAAoE;oBACpE,6DAA6D;oBAC7D,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;wBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;wBACrF,IAAI,IAAI,KAAK,OAAO;4BAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;oBACxE,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;YACjC,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;SAChF,CAAC,CAAA;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC/C,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;YACpF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,sCAAsC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;SAC/G,CAAC,EACF,CAAC,SAAS,EAAE,EAAE,CACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC,CAAC,CACL,CAAA;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;YAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,sCAAsC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;SAC/G,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC;YAC9G,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;SAC5G,CAAC,CAAA;QACF,IAAI,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9E,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;QACvG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,EAAE,SAAS,CAAC,CAAA;QACtG,CAAC;QACD,uEAAuE;QACvE,MAAM,WAAW,GAAwB,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;QAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE;gBACR,cAAc,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;gBACrD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;oBAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,sCAAsC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;SAC/G,CAAC,CAAA;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,iBAAiB,GAA2B,EAAE,CAAA;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAA;QACzF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzE,mEAAmE;YACnE,qEAAqE;YACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QACzG,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;;gBACzD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,kBAAkB,GAAG,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,GAAG,EAAE;gBACR,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAA;gBAC9E,MAAM,OAAO,GAAkB,EAAE,CAAA;gBACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,kBAAkB,EAAE,CAAC,EAAE,CAAC;oBAC5F,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;oBACxG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;oBACtF,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAChD,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;gBACjD,oEAAoE;gBACpE,mEAAmE;gBACnE,MAAM,CAAC,aAAa,CAClB,IAAI,EACJ;oBACE,WAAW;oBACX,8CAA8C;oBAC9C,GAAG,OAAO;oBACV,aAAa;oBACb,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5B,CAAA;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;SAChF,CAAC,CAAA;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CACpC,YAAY,CAAC,CAAC,CAAE,EAChB,iBAAiB,CAAC,IAAI,EACtB,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,aAAa,CAAC,EAC3E,WAAW,CAAC,aAAa,EACzB,SAAS,CACV,CAAA;QACD,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE,GAAG,EAAE,CACR,cAAc,CAAC,IAAI,CACjB,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAC1F,UAAU,EACV,iBAAiB,EACjB,SAAS,CACV;YACH,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,qCAAqC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;SAC9G,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAA;QACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC/B,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;oBAClD,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;oBACrG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;aAChF,CAAC,CAAA;YACF,IAAI,EAAE,GAAG,CAAC,CAAA;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,SAAS;gBAAE,EAAE,EAAE,CAAA;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,IAAI,GAAG;gBACL,IAAI;gBACJ,QAAQ,EAAE,yBAAyB;gBACnC,kBAAkB;gBAClB,MAAM;gBACN,UAAW;gBACX,WAAW;gBACX,MAAM,CAAC,EAAE,CAAC;gBACV,GAAG,IAAI;aACR,CAAA;YACD,UAAU,GAAG,SAAS,CAAA;QACxB,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,UAAW,EAAE,IAAI,EAAE;YAC1C,GAAG,OAAO,CAAC,OAAO;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,kBAAkB,EAAE;YAChF,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;AACpE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,UAAmB,EAAE,EAA4D,EAAE,CACvG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The kernel's `ProcessConfinement` seam, filled with this host's native\n * sandbox: bubblewrap on Linux, seatbelt on macOS.\n *\n * `@smthrs/kernel`'s `ChildProcessSpawner.layer` hands every stage that passed\n * its `proc:spawn` check to the confinement in its context, together with the\n * `ProcessConfinement.Profile` the grants in force admit. This module turns\n * that profile into a {@link ProcessSandbox.Request}, plans it against the\n * workspace, and wraps the stage's argv in the mechanism the host has, so an\n * approved `bash` can write only where an `fs:write` grant says and reach the\n * network only when a `net:*` grant says. A stage that asked for the platform\n * shell is spelled out as `/bin/sh -c <line>` first: wrapping a `shell: true`\n * command line would otherwise leave its redirections and pipes to a shell\n * outside the sandbox.\n *\n * A host with no mechanism is the one decision this module leaves to its\n * caller: {@link Options.unavailable} either refuses the spawn, so nothing\n * runs that the profile would not have confined, or runs it unconfined with\n * a warning, the way every host did before this seam existed. A write set\n * the mechanism cannot enforce safely, a symbolic link below the workspace\n * root, is always refused.\n *\n * @since 1.0.0-rc.1\n */\n\nimport * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as PlatformError from \"effect/PlatformError\"\nimport type * as Scope from \"effect/Scope\"\nimport * as ChildProcess from \"effect/unstable/process/ChildProcess\"\nimport * as NodeFs from \"node:fs\"\nimport * as NodeOs from \"node:os\"\nimport * as NodePath from \"node:path\"\nimport * as ProcessSandbox from \"./ProcessSandbox.ts\"\n\n/**\n * How the confinement is built.\n *\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface Options {\n  /**\n   * What happens when this host has no mechanism to enforce a profile with.\n   * `\"refuse\"` fails the spawn, so a command never runs with more than the\n   * profile allows; `\"unconfined\"` runs it as given and logs a\n   * warning naming what the host lacks.\n   */\n  readonly unavailable?: \"refuse\" | \"unconfined\" | undefined\n  /** The host facts mechanism selection reads; defaults to the real host. */\n  readonly host?: ProcessSandbox.Host | undefined\n  /** Where each run's private temporary directory is created; defaults to the OS temporary directory. */\n  readonly temporaryDirectory?: string | undefined\n}\n\nconst shellLine = (command: ChildProcess.StandardCommand): string => [command.command, ...command.args].join(\" \")\n\n/**\n * The argv a stage executes, with a shell request made explicit.\n *\n * Node runs a `shell: true` stage as `/bin/sh -c <line>` on POSIX, and a\n * string shell as `<shell> -c <line>`; the wrapper needs that program to be\n * the one it confines, so the shell becomes the argv's first token and the\n * spawned stage no longer asks for one.\n */\nconst argvOf = (command: ChildProcess.StandardCommand): ReadonlyArray<string> => {\n  const shell = command.options.shell\n  if (shell === undefined || shell === false) return [command.command, ...command.args]\n  return [shell === true ? \"/bin/sh\" : shell, \"-c\", shellLine(command)]\n}\n\nconst failure = (\n  tag: \"NotFound\" | \"PermissionDenied\" | \"Unknown\",\n  command: ChildProcess.StandardCommand,\n  description: string,\n  cause: unknown\n): PlatformError.PlatformError =>\n  PlatformError.systemError({\n    _tag: tag,\n    module: \"ProcessConfinement\",\n    method: \"confine\",\n    pathOrDescriptor: shellLine(command),\n    description,\n    cause\n  })\n\nconst messageOf = (cause: unknown): string =>\n  ProcessSandbox.isUnenforceable(cause)\n    ? cause.message\n    : cause instanceof Error\n    ? cause.message\n    : String(cause)\n\n/** Classic BPF for seccomp_data: deny host Unix sockets and io_uring, preserving stream socketpair.\n * Closed networking additionally denies every IP socket family.\n * Wrong ABI and x32 syscall encodings fail closed rather than bypassing socket(). */\nconst networkFilter = (architecture: string, network: \"none\" | \"open\"): Uint8Array => {\n  const abi = architecture === \"x64\"\n    ? { audit: 0xc000003e, socket: 41, socketpair: 53 }\n    : architecture === \"arm64\"\n    ? { audit: 0xc00000b7, socket: 198, socketpair: 199 }\n    : undefined\n  if (abi === undefined) throw new Error(`native-network seccomp is unavailable on ${architecture}`)\n  const instructions: Array<readonly [number, number, number, number]> = [\n    [0x20, 0, 0, 4], // load audit architecture\n    [0x15, 1, 0, abi.audit],\n    [0x06, 0, 0, 0x80000000], // kill unsupported ABI\n    [0x20, 0, 0, 0], // load syscall number\n    [0x35, 0, 1, 0x40000000],\n    [0x06, 0, 0, 0x80000000], // kill x32 / invalid high syscall numbers\n    [0x15, 0, 1, 425], // io_uring_setup on both supported ABIs\n    [0x06, 0, 0, 0x00050001], // io_uring can otherwise create sockets without socket()\n    [0x15, 0, 6, abi.socketpair],\n    [0x20, 0, 0, 16], // socketpair domain\n    [0x15, 0, 4, 1], // AF_UNIX\n    [0x20, 0, 0, 24], // socketpair type, low 32 bits of args[1]\n    [0x54, 0, 0, 0xf], // strip SOCK_NONBLOCK and SOCK_CLOEXEC\n    [0x15, 1, 0, 1], // only SOCK_STREAM; Linux aliases SOCK_RAW to datagram operations\n    [0x06, 0, 0, 0x00050001],\n    [0x20, 0, 0, 0] // reload syscall number before the socket() policy\n  ]\n  if (network === \"none\") {\n    instructions.push([0x15, 0, 1, abi.socket], [0x06, 0, 0, 0x00050001]) // EPERM for every socket family\n  } else {\n    instructions.push(\n      [0x15, 0, 3, abi.socket],\n      [0x20, 0, 0, 16], // socket domain, low 32 bits of args[0]\n      [0x15, 0, 1, 1], // AF_UNIX; IP families remain available\n      [0x06, 0, 0, 0x00050001]\n    )\n  }\n  instructions.push([0x06, 0, 0, 0x7fff0000]) // SECCOMP_RET_ALLOW\n  const bytes = new Uint8Array(instructions.length * 8)\n  const view = new DataView(bytes.buffer)\n  for (const [index, [code, jt, jf, value]] of instructions.entries()) {\n    view.setUint16(index * 8, code, true)\n    view.setUint8(index * 8 + 2, jt)\n    view.setUint8(index * 8 + 3, jf)\n    view.setUint32(index * 8 + 4, value, true)\n  }\n  return bytes\n}\n\n/**\n * Builds the native confinement.\n *\n * @category constructors\n * @since 1.0.0-rc.1\n */\nexport const make = (options: Options = {}): KernelProcessConfinement.Service => {\n  const hostFacts = options.host ?? ProcessSandbox.host()\n  const temporaryRoot = options.temporaryDirectory ?? NodeOs.tmpdir()\n  const unavailable = options.unavailable ?? \"refuse\"\n  const confine = Effect.fn(\"ProcessConfinement.confine\")(function*(\n    command: ChildProcess.StandardCommand,\n    profile: KernelProcessConfinement.Profile\n  ): Effect.fn.Return<ChildProcess.StandardCommand, PlatformError.PlatformError, Scope.Scope> {\n    const request: ProcessSandbox.Request = {\n      network: profile.network,\n      unixSockets: false,\n      strict: true,\n      reads: profile.reads,\n      writes: profile.writes,\n      readOnly: profile.readOnly\n    }\n    const selected = ProcessSandbox.select(request, hostFacts)\n    if (ProcessSandbox.isUnenforceable(selected)) {\n      if (unavailable === \"refuse\") {\n        return yield* failure(\n          \"NotFound\",\n          command,\n          `${selected.message} This host refuses to spawn unconfined.`,\n          selected\n        )\n      }\n      yield* Effect.logWarning(`${selected.message} Running unconfined.`)\n      return command\n    }\n    // The stage's directory is absolute: the kernel spawner roots it first.\n    const cwd = command.options.cwd ?? profile.workspaceRoot\n    const within = (root: string, path: string): boolean => {\n      const relative = NodePath.relative(root, path)\n      return relative !== \"..\" && !relative.startsWith(`..${NodePath.sep}`) && !NodePath.isAbsolute(relative)\n    }\n    if (!within(profile.workspaceRoot, cwd)) {\n      return yield* failure(\"PermissionDenied\", command, \"command directory is outside the workspace\", undefined)\n    }\n    // A lexical workspace path can enter an unrelated host directory through\n    // a symlink. Check the real directory before granting or preparing a run.\n    const canonical = yield* Effect.try({\n      try: () => {\n        const root = NodeFs.realpathSync(profile.workspaceRoot)\n        const directory = NodeFs.realpathSync(cwd)\n        if (!within(root, directory)) throw new Error(\"command directory is outside the workspace\")\n        for (const relative of profile.reads) {\n          const lexical = NodePath.resolve(root, relative)\n          if (!within(root, lexical)) continue\n          // A read bind follows its source symlink. Refuse a grant that would\n          // therefore mount unrelated host bytes inside the workspace.\n          if (NodeFs.existsSync(lexical)) {\n            const real = NodeFs.realpathSync(lexical)\n            if (!within(root, real)) throw new Error(\"read grant resolves outside the workspace\")\n            if (real !== lexical) throw new Error(\"read grant is a symbolic link\")\n          }\n        }\n        return { root, cwd: directory }\n      },\n      catch: (cause) => failure(\"PermissionDenied\", command, messageOf(cause), cause)\n    })\n    // The private tmp lives as long as the spawn's scope, however preparation\n    // ends; the declared write directories are created so the mechanism has\n    // something to bind, which the grant that opened them already permits.\n    const allocatedTmp = yield* Effect.acquireRelease(\n      Effect.try({\n        try: () => NodeFs.mkdtempSync(NodePath.join(temporaryRoot, \"smithers-confinement-\")),\n        catch: (cause) => failure(\"Unknown\", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)\n      }),\n      (directory) =>\n        Effect.sync(() => {\n          try {\n            NodeFs.rmSync(directory, { recursive: true, force: true })\n          } catch {\n            // Cleanup is best-effort when the host refuses directory removal.\n          }\n        })\n    )\n    const tmp = yield* Effect.try({\n      try: () => NodeFs.realpathSync(allocatedTmp),\n      catch: (cause) => failure(\"Unknown\", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)\n    })\n    const planned = yield* Effect.try({\n      try: () => ProcessSandbox.plan(request, { workspaceRoot: canonical.root, cwd: canonical.cwd, tmp }, hostFacts),\n      catch: (cause) => failure(\"Unknown\", command, `could not plan the confinement: ${messageOf(cause)}`, cause)\n    })\n    if (ProcessSandbox.isUnenforceable(planned)) {\n      return yield* failure(\"PermissionDenied\", command, planned.message, planned)\n    }\n    // Build outputs may grant their parent directory. An agent grant must\n    // never inherit that widening when a requested tree is already a file.\n    const exactWrites = profile.writes.map((relative) => NodePath.resolve(planned.workspaceRoot, relative))\n    if (planned.writes.some((write) => !exactWrites.includes(write))) {\n      return yield* failure(\"PermissionDenied\", command, \"write grant is not a directory tree\", undefined)\n    }\n    // A workspace link does not grant authority to its target on the host.\n    const confinement: ProcessSandbox.Plan = { ...planned, externalReads: [] }\n    yield* Effect.try({\n      try: () => {\n        ProcessSandbox.validateWrites(confinement, hostFacts)\n        NodeFs.mkdirSync(NodePath.join(tmp, \"home\"), { recursive: true })\n        NodeFs.mkdirSync(NodePath.join(tmp, \"cache\"), { recursive: true })\n        for (const write of planned.writes) NodeFs.mkdirSync(write, { recursive: true })\n      },\n      catch: (cause) => failure(\"Unknown\", command, `could not prepare the confinement: ${messageOf(cause)}`, cause)\n    })\n    // Only the target receives its requested environment. Dynamic-loader and\n    // other startup variables must never configure the host sandbox launcher.\n    const targetEnvironment: Record<string, string> = {}\n    const inherited = command.options.env === undefined || command.options.extendEnv === true\n    for (const [name, value] of Object.entries(inherited ? process.env : {})) {\n      // Bash exports functions as names such as BASH_FUNC_which%%. These\n      // ambient entries cannot be exported by the portable inner launcher.\n      if (typeof value === \"string\" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) targetEnvironment[name] = value\n    }\n    for (const [name, value] of Object.entries(command.options.env ?? {})) {\n      if (typeof value === \"string\") targetEnvironment[name] = value\n      else delete targetEnvironment[name]\n    }\n    const privateEnvironment = ProcessSandbox.environment(confinement)\n    const script = yield* Effect.try({\n      try: () => {\n        const quote = (value: string): string => `'${value.replaceAll(\"'\", \"'\\\\''\")}'`\n        const exports: Array<string> = []\n        for (const [name, value] of Object.entries({ ...targetEnvironment, ...privateEnvironment })) {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error(\"environment variable name is not portable\")\n          if (value.includes(\"\\0\")) throw new Error(\"environment variable contains a null byte\")\n          exports.push(`export ${name}=${quote(value)}`)\n        }\n        const file = NodePath.join(tmp, \"environment.sh\")\n        // Values stay off argv and journal receipts; the script is private,\n        // removed with the scope, and interpreted only inside confinement.\n        NodeFs.writeFileSync(\n          file,\n          [\n            \"#!/bin/sh\",\n            \"unset ENV BASH_ENV CDPATH PWD OLDPWD SHLVL _\",\n            ...exports,\n            \"exec \\\"$@\\\"\",\n            \"\"\n          ].join(\"\\n\"),\n          { flag: \"wx\", mode: 0o600 }\n        )\n        return file\n      },\n      catch: (cause) => failure(\"PermissionDenied\", command, messageOf(cause), cause)\n    })\n    // Resolve the actual program before wrapping it in the environment shell.\n    // Otherwise the sandbox sees only /usr/bin/env and omits a native helper\n    // installed outside its ordinary runtime paths.\n    const originalArgv = argvOf(command)\n    const launch = ProcessSandbox.launcher(\n      originalArgv[0]!,\n      targetEnvironment.PATH,\n      [...confinement.reads, ...confinement.writes, ...confinement.externalReads],\n      confinement.workspaceRoot,\n      hostFacts\n    )\n    const targetArgv = [\"/usr/bin/env\", \"-i\", \"/bin/sh\", script, launch.program, ...originalArgv.slice(1)]\n    const wrapped = yield* Effect.try({\n      try: () =>\n        ProcessSandbox.wrap(\n          { ...confinement, externalReads: [...confinement.externalReads, ...launch.reads, script] },\n          targetArgv,\n          targetEnvironment,\n          hostFacts\n        ),\n      catch: (cause) => failure(\"Unknown\", command, `could not render the confinement: ${messageOf(cause)}`, cause)\n    })\n    let [executable, ...args] = wrapped.argv\n    if (selected._tag === \"bubblewrap\") {\n      const filter = yield* Effect.try({\n        try: () => {\n          const file = NodePath.join(tmp, \"network.seccomp\")\n          NodeFs.writeFileSync(file, networkFilter(process.arch, profile.network), { flag: \"wx\", mode: 0o600 })\n          return file\n        },\n        catch: (cause) => failure(\"PermissionDenied\", command, messageOf(cause), cause)\n      })\n      let fd = 3\n      while (command.options.additionalFds?.[`fd${fd}`] !== undefined) fd++\n      // A regular file avoids a filter-input pipe whose early closure can\n      // surface as an unhandled ECONNRESET before bwrap reports its refusal.\n      args = [\n        \"-c\",\n        `exec ${fd}<\"$1\"; shift; exec \"$@\"`,\n        \"smithers-seccomp\",\n        filter,\n        executable!,\n        \"--seccomp\",\n        String(fd),\n        ...args\n      ]\n      executable = \"/bin/sh\"\n    }\n    return ChildProcess.make(executable!, args, {\n      ...command.options,\n      cwd: canonical.cwd,\n      shell: false,\n      env: { PATH: \"/usr/bin:/bin:/usr/sbin:/sbin\", LANG: \"C\", ...privateEnvironment },\n      extendEnv: false\n    })\n  })\n  return KernelProcessConfinement.ProcessConfinement.of({ confine })\n}\n\n/**\n * Provides the native confinement.\n *\n * @category layers\n * @since 1.0.0-rc.1\n */\nexport const layer = (options: Options = {}): Layer.Layer<KernelProcessConfinement.ProcessConfinement> =>\n  Layer.succeed(KernelProcessConfinement.ProcessConfinement)(make(options))\n"]}