@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/ProcessSandbox.js

@@ -0,0 +1,774 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ProcessSandbox_exports = {};
+__export(ProcessSandbox_exports, {
+  bubblewrap: () => bubblewrap,
+  diagnose: () => diagnose,
+  docker: () => docker,
+  environment: () => environment,
+  host: () => host,
+  isUnenforceable: () => isUnenforceable,
+  launcher: () => launcher,
+  plan: () => plan,
+  seatbelt: () => seatbelt,
+  select: () => select,
+  unenforceable: () => unenforceable,
+  validateWrites: () => validateWrites,
+  wrap: () => wrap
+});
+module.exports = __toCommonJS(ProcessSandbox_exports);
+var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var NodeFs = __toESM(require("node:fs"), 1);
+var NodeOs = __toESM(require("node:os"), 1);
+var NodePath = __toESM(require("node:path"), 1);
+const isUnenforceable = (value) => typeof value === "object" && value !== null && value._tag === "@smthrs/platform-node/SandboxUnenforceable";
+const unenforceable = (platform, mechanism, missing, detail) => ({
+  _tag: "@smthrs/platform-node/SandboxUnenforceable",
+  platform,
+  mechanism,
+  missing,
+  message: `sandbox: the declared confinement cannot be enforced on this ${platform} host: ${detail}.`
+});
+const pathSeparator = (platform) => platform === "win32" ? ";" : ":";
+const ambientEnvironment = () => process.env;
+const host = (env = ambientEnvironment()) => {
+  const platform = process.platform;
+  let developerDirectory = env["DEVELOPER_DIR"];
+  if (platform === "darwin" && developerDirectory === void 0) {
+    try {
+      developerDirectory = (0, import_node_child_process.execFileSync)("/usr/bin/xcode-select", ["-p"], { encoding: "utf8", timeout: 2e3 }).trim();
+    } catch {
+    }
+  }
+  const entries = (env["PATH"] ?? "").split(pathSeparator(platform)).filter((entry) => entry !== "");
+  const extensions = platform === "win32" ? (env["PATHEXT"] ?? ".EXE;.CMD;.BAT").split(";") : [""];
+  return {
+    platform,
+    developerDirectory,
+    home: NodeOs.homedir(),
+    executable: (name) => {
+      if (NodePath.isAbsolute(name)) return isExecutable(name) ? name : void 0;
+      for (const entry of entries) {
+        for (const extension of extensions) {
+          const candidate = NodePath.join(entry, name + extension);
+          if (isExecutable(candidate)) return candidate;
+        }
+      }
+      return void 0;
+    },
+    exists: (path) => NodeFs.existsSync(path),
+    isSymbolicLink,
+    isDirectory: (path) => {
+      try {
+        return NodeFs.statSync(path).isDirectory();
+      } catch {
+        return false;
+      }
+    },
+    entries: (directory) => {
+      try {
+        return NodeFs.readdirSync(directory);
+      } catch {
+        return void 0;
+      }
+    },
+    realpath: (path) => {
+      try {
+        return NodeFs.realpathSync(path);
+      } catch {
+        return void 0;
+      }
+    },
+    shimTarget,
+    uid: typeof process.getuid === "function" ? process.getuid() : void 0,
+    gid: typeof process.getgid === "function" ? process.getgid() : void 0
+  };
+};
+const shimLimit = 64 * 1024;
+const shimTarget = (path) => {
+  try {
+    if (NodeFs.statSync(path).size > shimLimit) return void 0;
+    const text = NodeFs.readFileSync(path, "utf8");
+    if (!text.startsWith("#!")) return void 0;
+    const target = /^# cmd-shim-target=(.+)$/m.exec(text)?.[1];
+    return target !== void 0 && NodePath.isAbsolute(target) ? target : void 0;
+  } catch {
+    return void 0;
+  }
+};
+const isExecutable = (path) => {
+  try {
+    NodeFs.accessSync(path, NodeFs.constants.X_OK);
+    return NodeFs.statSync(path).isFile();
+  } catch {
+    return false;
+  }
+};
+const select = (request, hostFacts) => {
+  const declared = request.mechanism;
+  const platform = hostFacts.platform;
+  if (declared !== void 0 && declared._tag === "docker") {
+    const executable = hostFacts.executable("docker");
+    if (executable === void 0) {
+      return unenforceable(platform, "docker", "docker", "a docker mechanism is selected but docker is not on PATH");
+    }
+    return { _tag: "docker", executable, image: declared.image };
+  }
+  if (declared !== void 0 && platform !== "linux") {
+    return unenforceable(
+      platform,
+      "bubblewrap",
+      "linux",
+      "bubblewrap is selected but runs only on Linux; on macOS the seatbelt mechanism is selected when no mechanism is named"
+    );
+  }
+  if (platform === "linux") {
+    const executable = hostFacts.executable("bwrap");
+    if (executable === void 0) {
+      return unenforceable(platform, "bubblewrap", "bwrap", "bwrap is not on PATH (install the bubblewrap package)");
+    }
+    if (request.network === "loopback") {
+      return unenforceable(
+        platform,
+        "bubblewrap",
+        "network: true",
+        "bubblewrap cannot expose only the host loopback interface: sharing that interface also grants full host networking; open the whole network to opt into that access"
+      );
+    }
+    return { _tag: "bubblewrap", executable };
+  }
+  if (platform === "darwin") {
+    const executable = hostFacts.executable("/usr/bin/sandbox-exec");
+    if (executable === void 0) {
+      return unenforceable(platform, "seatbelt", "/usr/bin/sandbox-exec", "/usr/bin/sandbox-exec is missing");
+    }
+    return { _tag: "seatbelt", executable };
+  }
+  return unenforceable(
+    platform,
+    "docker",
+    "docker image",
+    `${platform} has no process sandbox of its own; select a docker mechanism with an image`
+  );
+};
+const toPosix = (path) => path.split(NodePath.sep).join("/");
+const realized = (path) => {
+  let head = path;
+  const tail = [];
+  while (head !== NodePath.dirname(head)) {
+    try {
+      const real = NodeFs.realpathSync(head);
+      return tail.length === 0 ? real : NodePath.join(real, ...tail);
+    } catch {
+      tail.unshift(NodePath.basename(head));
+      head = NodePath.dirname(head);
+    }
+  }
+  return path;
+};
+const insideRoot = (root, candidate) => {
+  const relative = NodePath.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${NodePath.sep}`) && !NodePath.isAbsolute(relative);
+};
+const isSymbolicLink = (path) => {
+  try {
+    return NodeFs.lstatSync(path).isSymbolicLink();
+  } catch (cause) {
+    if (cause.code === "ENOENT") return false;
+    throw cause;
+  }
+};
+const safeWrite = (root, path, hostFacts) => {
+  if (!insideRoot(root, path)) return false;
+  try {
+    const realpath = hostFacts.realpath ?? NodeFs.realpathSync;
+    const link = hostFacts.isSymbolicLink ?? isSymbolicLink;
+    if (realpath(root) !== root) return false;
+    let current = root;
+    for (const component of NodePath.relative(root, path).split(NodePath.sep).filter(Boolean)) {
+      current = NodePath.join(current, component);
+      if (link(current)) return false;
+      if (hostFacts.exists(current) && realpath(current) !== current) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+const unsafeWrite = (platform, mechanism, path) => unenforceable(
+  platform,
+  mechanism,
+  "canonical workspace write path",
+  `write path ${path} has a symbolic link, an unresolved ancestor, or leaves the canonical workspace`
+);
+const validateWrites = (confinement, hostFacts = host()) => {
+  for (const write of confinement.writes) {
+    if (!safeWrite(confinement.workspaceRoot, write, hostFacts)) {
+      throw unsafeWrite(hostFacts.platform, confinement.mechanism._tag, write);
+    }
+  }
+};
+const fold = (root, declared, alsoCovered, hostFacts) => {
+  const entries = hostFacts.entries;
+  if (entries === void 0) return { reads: declared, denies: [] };
+  const covered = /* @__PURE__ */ new Set([...declared, ...alsoCovered]);
+  const candidates = /* @__PURE__ */ new Set();
+  for (const path of declared) {
+    let current = NodePath.dirname(path);
+    while (insideRoot(root, current) && current !== root && !candidates.has(current)) {
+      candidates.add(current);
+      current = NodePath.dirname(current);
+    }
+  }
+  const holdsCovered = /* @__PURE__ */ new Set();
+  for (const path of alsoCovered) {
+    let current = NodePath.dirname(path);
+    while (insideRoot(root, current) && current !== root && !holdsCovered.has(current)) {
+      holdsCovered.add(current);
+      current = NodePath.dirname(current);
+    }
+  }
+  const deepestFirst = [...candidates].sort((left, right) => right.length - left.length || (left < right ? -1 : 1));
+  const promoted = [];
+  const denies = [];
+  for (const directory of deepestFirst) {
+    if (covered.has(directory)) continue;
+    const children = entries(directory);
+    if (children === void 0 || children.length === 0) continue;
+    const uncovered = [];
+    let coveredCount = 0;
+    let partial = false;
+    for (const child of children) {
+      const path = NodePath.join(directory, child);
+      if (covered.has(path)) coveredCount += 1;
+      else if (candidates.has(path) || holdsCovered.has(path)) partial = true;
+      else uncovered.push(path);
+    }
+    if (partial || coveredCount === 0 || coveredCount < uncovered.length) continue;
+    covered.add(directory);
+    promoted.push(directory);
+    denies.push(...uncovered);
+  }
+  return { reads: [...declared, ...promoted], denies };
+};
+const bySubtree = (left, right) => {
+  const leftKey = left + NodePath.sep;
+  const rightKey = right + NodePath.sep;
+  return leftKey < rightKey ? -1 : 1;
+};
+const collapse = (paths) => {
+  const unique = [...new Set(paths)];
+  const kept = /* @__PURE__ */ new Set();
+  let ancestor;
+  for (const path of [...unique].sort(bySubtree)) {
+    if (ancestor !== void 0 && path.startsWith(ancestor + NodePath.sep)) continue;
+    kept.add(path);
+    ancestor = path;
+  }
+  return unique.filter((path) => kept.has(path)).sort(
+    (left, right) => left.length - right.length || (left < right ? -1 : 1)
+  );
+};
+const plan = (request, location, hostFacts) => {
+  const selected = select(request, hostFacts);
+  if (isUnenforceable(selected)) return selected;
+  let root;
+  try {
+    const canonical = (hostFacts.realpath ?? NodeFs.realpathSync)(location.workspaceRoot);
+    if (canonical === void 0) return unsafeWrite(hostFacts.platform, selected._tag, location.workspaceRoot);
+    root = canonical;
+  } catch {
+    return unsafeWrite(hostFacts.platform, selected._tag, location.workspaceRoot);
+  }
+  const anchor = (relative) => {
+    const absolute = NodePath.resolve(root, ...relative.split("/"));
+    return insideRoot(root, absolute) ? absolute : void 0;
+  };
+  const declared = [];
+  const externalReads = [];
+  for (const relative of request.reads) {
+    const absolute = anchor(relative);
+    if (absolute === void 0 || !hostFacts.exists(absolute)) continue;
+    declared.push(absolute);
+    const real = hostFacts.realpath?.(absolute);
+    if (real !== void 0 && real !== absolute && !insideRoot(root, real)) externalReads.push(real);
+  }
+  for (const path of request.externalReads ?? []) {
+    if (!NodePath.isAbsolute(path) || insideRoot(root, path) || !hostFacts.exists(path)) continue;
+    externalReads.push(hostFacts.realpath?.(path) ?? path);
+  }
+  const writes = [];
+  const add = (absolute) => {
+    if (!safeWrite(root, absolute, hostFacts)) return unsafeWrite(hostFacts.platform, selected._tag, absolute);
+    writes.push(absolute);
+    return void 0;
+  };
+  for (const relative of request.writes) {
+    const absolute = anchor(relative);
+    if (absolute === void 0) continue;
+    if (!safeWrite(root, absolute, hostFacts)) return unsafeWrite(hostFacts.platform, selected._tag, absolute);
+    const refusal = add(
+      hostFacts.exists(absolute) && !hostFacts.isDirectory(absolute) ? NodePath.dirname(absolute) : absolute
+    );
+    if (refusal !== void 0) return refusal;
+  }
+  for (const relative of request.writeFiles ?? []) {
+    const absolute = anchor(relative);
+    if (absolute === void 0) continue;
+    if (!safeWrite(root, absolute, hostFacts)) return unsafeWrite(hostFacts.platform, selected._tag, absolute);
+    const refusal = add(
+      hostFacts.exists(absolute) && hostFacts.isDirectory(absolute) ? absolute : NodePath.dirname(absolute)
+    );
+    if (refusal !== void 0) return refusal;
+  }
+  const readOnly = [];
+  for (const relative of request.readOnly ?? []) {
+    const absolute = anchor(relative);
+    if (absolute !== void 0) readOnly.push(absolute);
+  }
+  const folded = selected._tag === "seatbelt" ? fold(root, declared, [...writes, ...readOnly, location.tmp], hostFacts) : { reads: declared, denies: [] };
+  return {
+    mechanism: selected,
+    network: request.network,
+    unixSockets: request.unixSockets,
+    strict: request.strict,
+    workspaceRoot: root,
+    cwd: location.cwd,
+    reads: collapse(folded.reads),
+    readDenies: collapse(folded.denies),
+    writes: collapse(writes),
+    readOnly: collapse(readOnly),
+    externalReads: collapse(externalReads),
+    tmp: location.tmp,
+    uid: hostFacts.uid,
+    gid: hostFacts.gid
+  };
+};
+const corepackHome = (env, home) => {
+  const declared = env["COREPACK_HOME"];
+  if (declared !== void 0 && declared !== "") return declared;
+  const base = env["XDG_CACHE_HOME"] ?? env["LOCALAPPDATA"] ?? NodePath.join(home, process.platform === "win32" ? "AppData/Local" : ".cache");
+  return NodePath.join(base, "node", "corepack");
+};
+const environment = (confinement, hostEnv = ambientEnvironment(), hostHome = NodeOs.homedir()) => {
+  const tmp = confinement.mechanism._tag === "seatbelt" ? confinement.tmp : "/tmp";
+  const home = NodePath.posix.join(toPosix(tmp), "home");
+  return {
+    COREPACK_HOME: corepackHome(hostEnv, hostHome),
+    HOME: home,
+    TMPDIR: tmp,
+    TMP: tmp,
+    TEMP: tmp,
+    XDG_CACHE_HOME: NodePath.posix.join(toPosix(tmp), "cache"),
+    XDG_CONFIG_HOME: NodePath.posix.join(toPosix(tmp), "config"),
+    XDG_DATA_HOME: NodePath.posix.join(toPosix(tmp), "data"),
+    XDG_STATE_HOME: NodePath.posix.join(toPosix(tmp), "state")
+  };
+};
+const runtimeReads = (hostFacts) => {
+  const paths = [
+    "/usr",
+    "/bin",
+    "/sbin",
+    "/lib",
+    "/lib64",
+    "/nix/store",
+    "/opt/homebrew",
+    // A Smithers machine's toolchain layer: the repository's Node, pnpm, Go,
+    // Rust and Python, which the machine's environment puts first on PATH
+    // (packages/backend/microsandbox layers.go toolchainRoot). Never all of
+    // /opt/smithers, which holds the machine's environment and helpers.
+    "/opt/smithers/toolchain",
+    "/opt/smithers/rust",
+    "/System/Library",
+    "/System/Volumes/Preboot/Cryptexes/OS",
+    "/private/var/db/dyld",
+    // macOS shell and developer-tool dispatch read these system selectors.
+    "/var/select/sh",
+    "/private/var/select/sh",
+    "/var/select/developer_dir",
+    "/private/var/select/developer_dir",
+    "/Library/Apple",
+    "/Library/Developer",
+    "/Applications/Xcode.app/Contents/Developer",
+    "/Applications/Xcode.app/Contents/Info.plist",
+    "/Applications/Xcode.app/Contents/Frameworks",
+    "/Applications/Xcode.app/Contents/SharedFrameworks",
+    "/Applications/Xcode.app/Contents/PlugIns",
+    "/etc/ld.so.cache",
+    "/etc/ld.so.conf",
+    "/etc/ld.so.conf.d",
+    "/etc/localtime",
+    "/etc/ssl",
+    "/etc/hosts",
+    "/etc/resolv.conf",
+    "/etc/nsswitch.conf"
+  ];
+  const developerDirectory = hostFacts.developerDirectory;
+  if (hostFacts.platform === "darwin" && developerDirectory !== void 0 && /^\/Applications\/Xcode[^/]*\.app\/Contents\/Developer$/.test(developerDirectory)) {
+    paths.push(developerDirectory);
+  }
+  if (hostFacts.home !== void 0) paths.push(NodePath.join(hostFacts.home, ".cache/node/corepack"));
+  for (const name of ["node", "bun"]) {
+    const executable = hostFacts.executable(name);
+    if (executable !== void 0) {
+      paths.push(executable);
+      const real = hostFacts.realpath?.(executable) ?? executable;
+      paths.push(real);
+      paths.push(NodePath.resolve(NodePath.dirname(real), "../lib/node_modules"));
+    }
+  }
+  const present = paths.filter((path) => hostFacts.exists(path));
+  return collapse(present.flatMap((path) => [path, hostFacts.realpath?.(path) ?? path]));
+};
+const credentialPaths = (hostFacts) => {
+  const home = hostFacts.home;
+  if (home === void 0) return [];
+  return collapse([
+    ".aws",
+    ".ssh",
+    ".gnupg",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".npmrc",
+    ".netrc",
+    ".git-credentials"
+  ].flatMap((relative) => {
+    const path = NodePath.join(home, relative);
+    return [path, hostFacts.realpath?.(path) ?? path];
+  }));
+};
+const launcher = (program, searchPath, granted, workspaceRoot, hostFacts) => {
+  const unchanged = { program, reads: [] };
+  if (program.includes("/") && !NodePath.isAbsolute(program)) return unchanged;
+  const found = NodePath.isAbsolute(program) ? hostFacts.executable(program) : searchPath === void 0 ? hostFacts.executable(program) : searchPath.split(":").filter((entry) => NodePath.isAbsolute(entry)).map((entry) => hostFacts.executable(NodePath.join(entry, program))).find((candidate) => candidate !== void 0);
+  if (found === void 0 || granted.some((parent) => insideRoot(parent, found))) return unchanged;
+  const resolved = hostFacts.realpath?.(found) ?? found;
+  const named = hostFacts.shimTarget?.(resolved);
+  const real = named === void 0 || hostFacts.executable(named) === void 0 ? resolved : hostFacts.realpath?.(named) ?? named;
+  if ([found, resolved, real].some((path) => insideRoot(workspaceRoot, path))) return unchanged;
+  if (granted.some((parent) => insideRoot(parent, real))) return { program: real, reads: [] };
+  let directory = NodePath.dirname(real);
+  for (let level = 0; level < 3; level++) {
+    if (directory === NodePath.dirname(directory) || directory === hostFacts.home) break;
+    if (hostFacts.exists(NodePath.join(directory, "package.json"))) return { program: real, reads: [directory] };
+    directory = NodePath.dirname(directory);
+  }
+  return { program: real, reads: [real] };
+};
+const bubblewrap = (confinement, argv, hostFacts = host(), searchPath) => {
+  if (confinement.mechanism._tag !== "bubblewrap") throw new Error("bubblewrap argv needs a bubblewrap plan");
+  validateWrites(confinement, hostFacts);
+  const home = "/tmp/home";
+  const out = [
+    confinement.mechanism.executable,
+    "--tmpfs",
+    "/"
+  ];
+  const runtime = runtimeReads(hostFacts);
+  for (const read of runtime) out.push("--ro-bind", read, read);
+  out.push(
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc",
+    "--tmpfs",
+    "/tmp",
+    "--dir",
+    home,
+    "--dir",
+    "/tmp/cache",
+    "--tmpfs",
+    confinement.workspaceRoot,
+    "--dir",
+    confinement.cwd
+  );
+  for (const real of confinement.externalReads) out.push("--ro-bind", real, real);
+  const [program, ...args] = argv;
+  const launch = program === void 0 ? void 0 : launcher(
+    program,
+    searchPath,
+    [...runtime, ...confinement.reads, ...confinement.writes, ...confinement.externalReads],
+    confinement.workspaceRoot,
+    hostFacts
+  );
+  for (const read of launch?.reads ?? []) out.push("--ro-bind", read, read);
+  for (const read of confinement.reads) out.push("--ro-bind", read, read);
+  for (const write of confinement.writes) out.push("--bind", write, write);
+  for (const closed of confinement.readOnly) {
+    if (confinement.writes.some((write) => closed === write || closed.startsWith(write + NodePath.sep))) {
+      out.push("--ro-bind-try", closed, closed);
+    }
+  }
+  const granted = [
+    ...runtime,
+    ...launch?.reads ?? [],
+    ...confinement.reads,
+    ...confinement.writes,
+    ...confinement.externalReads
+  ];
+  for (const path of credentialPaths(hostFacts)) {
+    if (!hostFacts.exists(path) || !granted.some((parent) => insideRoot(parent, path))) continue;
+    if (confinement.externalReads.some((parent) => insideRoot(parent, path))) continue;
+    const directory = hostFacts.isDirectory(path);
+    if (directory) out.push("--tmpfs", path);
+    else out.push("--ro-bind", "/dev/null", path);
+    for (const read of confinement.externalReads) {
+      if (insideRoot(path, read)) out.push("--ro-bind", read, read);
+    }
+    if (directory) out.push("--remount-ro", path);
+  }
+  if (!confinement.writes.includes(confinement.workspaceRoot)) out.push("--remount-ro", confinement.workspaceRoot);
+  out.push("--remount-ro", "/");
+  out.push("--chdir", confinement.cwd, "--unshare-all", "--new-session", "--die-with-parent");
+  if (confinement.network === "loopback") {
+    throw new Error("bubblewrap cannot render loopback-only networking");
+  }
+  if (confinement.network === "open") out.push("--share-net");
+  out.push("--", ...launch === void 0 ? argv : [launch.program, ...args]);
+  return out;
+};
+const sbpl = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+const ancestors = (root, paths) => {
+  const found = /* @__PURE__ */ new Set([root]);
+  for (const path of paths) {
+    let current = NodePath.dirname(path);
+    while (current.length >= root.length && current !== NodePath.dirname(current)) {
+      found.add(current);
+      if (current === root) break;
+      current = NodePath.dirname(current);
+    }
+  }
+  return [...found].sort();
+};
+const seatbelt = (confinement, hostFacts = host()) => {
+  if (confinement.mechanism._tag !== "seatbelt") throw new Error("a seatbelt profile needs a seatbelt plan");
+  validateWrites(confinement, hostFacts);
+  const lines = ["(version 1)", confinement.strict === true ? "(deny default)" : "(allow default)"];
+  if (confinement.strict === true) {
+    lines.push(
+      "(allow process-exec)",
+      "(allow process-fork)",
+      "(allow signal (target same-sandbox))",
+      "(allow process-info* (target same-sandbox))",
+      '(allow sysctl-read (sysctl-name-prefix "hw.") (sysctl-name-prefix "machdep.cpu.") (sysctl-name "kern.argmax") (sysctl-name "kern.hostname") (sysctl-name "kern.maxfilesperproc") (sysctl-name "kern.maxproc") (sysctl-name "kern.osproductversion") (sysctl-name "kern.osrelease") (sysctl-name "kern.ostype") (sysctl-name "kern.osversion") (sysctl-name "kern.secure_kernel") (sysctl-name "kern.usrstack64") (sysctl-name "kern.version") (sysctl-name "sysctl.proc_cputype") (sysctl-name "vm.loadavg"))',
+      "(allow mach-host*)"
+    );
+    if (confinement.network === "open") lines.push("(allow network*)");
+  }
+  if (confinement.network !== "open") {
+    lines.push("(deny network*)");
+    if (confinement.unixSockets !== false) lines.push("(allow network* (local unix-socket))");
+    if (confinement.network === "loopback") {
+      lines.push(
+        '(allow network-bind (local ip "localhost:*"))',
+        '(allow network-inbound (local ip "localhost:*"))',
+        '(allow network-outbound (remote ip "localhost:*"))'
+      );
+    }
+  }
+  if (confinement.network === "open" && confinement.unixSockets === false) {
+    lines.push("(deny network* (local unix-socket))");
+    if (confinement.strict === true) {
+      lines.push('(allow network-outbound (literal "/private/var/run/mDNSResponder"))');
+    }
+  }
+  const writable = [...confinement.writes, confinement.tmp];
+  lines.push(
+    "(deny file-write*)",
+    `(allow file-write* ${confinement.strict === true ? '(literal "/dev/null")' : '(subpath "/dev")'} ${writable.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`
+  );
+  if (confinement.readOnly.length > 0) {
+    lines.push(`(deny file-write* ${confinement.readOnly.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+  }
+  lines.push(
+    "(deny file-read*)",
+    confinement.strict === true ? '(allow file-read* (literal "/") (literal "/dev/null") (literal "/dev/zero") (literal "/dev/random") (literal "/dev/urandom"))' : '(allow file-read* (literal "/") (subpath "/dev"))',
+    // macOS's system aliases need readlink access before a shell can execute
+    // an admitted file through them. Literal grants expose the links only;
+    // their target directories still cannot be listed or read wholesale.
+    '(allow file-read* (literal "/tmp") (literal "/var") (literal "/etc"))'
+  );
+  const runtime = runtimeReads(hostFacts);
+  if (runtime.length > 0) lines.push(`(allow file-read* ${runtime.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+  const readable = [...confinement.reads, ...confinement.writes, confinement.tmp];
+  const traversable = ancestors("/", [...runtime, ...readable, ...confinement.externalReads]).filter((path) => !insideRoot(confinement.workspaceRoot, path));
+  lines.push(`(allow file-read-metadata ${traversable.map((path) => `(literal ${sbpl(path)})`).join(" ")})`);
+  const listable = ancestors(
+    confinement.workspaceRoot,
+    readable.filter((path) => insideRoot(confinement.workspaceRoot, path))
+  );
+  lines.push(
+    `(deny file-read* (subpath ${sbpl(confinement.workspaceRoot)}))`
+  );
+  if (confinement.strict === true) {
+    const metadata = [
+      .../* @__PURE__ */ new Set([
+        ...listable,
+        ...ancestors(confinement.workspaceRoot, [confinement.cwd]),
+        confinement.cwd
+      ])
+    ].sort();
+    lines.push(`(allow file-read-metadata ${metadata.map((path) => `(literal ${sbpl(path)})`).join(" ")})`);
+  } else {
+    lines.push(`(allow file-read-metadata (subpath ${sbpl(confinement.workspaceRoot)}))`);
+  }
+  lines.push(
+    `(allow file-read* ${[
+      ...confinement.strict === true ? [] : listable.map((path) => `(literal ${sbpl(path)})`),
+      ...readable.map((path) => `(subpath ${sbpl(path)})`)
+    ].join(" ")})`
+  );
+  if (confinement.readDenies.length > 0) {
+    lines.push(`(deny file-read* ${confinement.readDenies.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+  }
+  const credentials = credentialPaths(hostFacts);
+  if (credentials.length > 0) {
+    lines.push(`(deny file-read* ${credentials.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+    if (confinement.strict === true) {
+      lines.push(`(deny file-write* ${credentials.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+    }
+  }
+  if (confinement.externalReads.length > 0) {
+    lines.push(`(allow file-read* ${confinement.externalReads.map((path) => `(subpath ${sbpl(path)})`).join(" ")})`);
+  }
+  return lines.join("");
+};
+const mountField = (key, value) => {
+  const field = `${key}=${value}`;
+  return /[",\r\n]/.test(field) ? `"${field.replaceAll('"', '""')}"` : field;
+};
+const bindMount = (path, readonly) => ["type=bind", mountField("src", path), mountField("dst", toPosix(path)), ...readonly ? ["readonly"] : []].join(",");
+const docker = (confinement, argv, env, hostFacts = host(), containerName = `smithers-${(0, import_node_crypto.randomUUID)()}`) => {
+  if (confinement.mechanism._tag !== "docker") throw new Error("docker argv needs a docker plan");
+  validateWrites(confinement, hostFacts);
+  const out = [
+    confinement.mechanism.executable,
+    "run",
+    "--rm",
+    "--init",
+    "--name",
+    containerName,
+    "--read-only",
+    "--tmpfs",
+    "/tmp:rw,exec",
+    "--network",
+    confinement.network === "open" ? "bridge" : "none",
+    "--workdir",
+    toPosix(confinement.cwd)
+  ];
+  if (confinement.uid !== void 0 && confinement.gid !== void 0) {
+    out.push("--user", `${confinement.uid}:${confinement.gid}`);
+  }
+  for (const real of confinement.externalReads) out.push("--mount", bindMount(real, true));
+  for (const read of confinement.reads) out.push("--mount", bindMount(read, true));
+  for (const write of confinement.writes) out.push("--mount", bindMount(write, false));
+  for (const closed of confinement.readOnly) {
+    if (confinement.writes.some((write) => closed === write || closed.startsWith(write + NodePath.sep))) {
+      out.push("--mount", bindMount(closed, true));
+    }
+  }
+  for (const [name, value] of Object.entries(env).sort(([left], [right]) => left < right ? -1 : 1)) {
+    if (name === "PATH" || name === "HOME") continue;
+    out.push("--env", `${name}=${value}`);
+  }
+  out.push("--env", "HOME=/tmp/home", confinement.mechanism.image, ...argv);
+  return out;
+};
+const wrap = (confinement, argv, env, hostFacts = host()) => {
+  const extra = environment(confinement);
+  switch (confinement.mechanism._tag) {
+    case "bubblewrap":
+      return { argv: bubblewrap(confinement, argv, hostFacts, env["PATH"]), env: extra };
+    case "seatbelt": {
+      const profile = seatbelt(confinement, hostFacts);
+      return { argv: [confinement.mechanism.executable, "-p", profile, ...argv], env: extra };
+    }
+    case "docker": {
+      const containerName = `smithers-${(0, import_node_crypto.randomUUID)()}`;
+      return { argv: docker(confinement, argv, { ...env, ...extra }, hostFacts, containerName), env: {}, containerName };
+    }
+  }
+};
+const denialPatterns = [
+  { pattern: /\b(?:EACCES|EPERM|ENOENT)\b[^'"\n]*['"]([^'"\n]+)['"]/g, write: false },
+  { pattern: /\bEROFS\b[^'"\n]*['"]([^'"\n]+)['"]/g, write: true },
+  {
+    pattern: /(?:^|[\s:])((?:\/|\.{0,2}\/?)[^\s:'"]+): (?:Operation not permitted|Permission denied|No such file or directory|Directory nonexistent|Not a directory)/gm,
+    write: false
+  },
+  { pattern: /(?:^|[\s:])((?:\/|\.{0,2}\/?)[^\s:'"]+): Read-only file system/gm, write: true },
+  {
+    pattern: /(?:Operation not permitted|Permission denied|No such file or directory|Directory nonexistent)[^\n]*?[:\s]['"]?((?:\/|[A-Za-z]:\\)[^'"\s:]+)/g,
+    write: false
+  },
+  { pattern: /Read-only file system[^\n]*?[:\s]['"]?((?:\/|[A-Za-z]:\\)[^'"\s:]+)/g, write: true },
+  {
+    pattern: /cannot (?:create|write|touch|mkdir|remove) (?:directory )?['"]?((?:\/|[A-Za-z]:\\|\.{0,2}\/?)[^'":\s]+)/g,
+    write: true
+  },
+  { pattern: /cannot (?:open|access|stat|read) ['"]?((?:\/|[A-Za-z]:\\|\.{0,2}\/?)[^'":\s]+)/g, write: false }
+];
+const diagnose = (confinement, text) => {
+  const named = /* @__PURE__ */ new Map();
+  for (const { pattern, write } of denialPatterns) {
+    for (const match of text.matchAll(pattern)) {
+      const raw = match[1];
+      const absolute = NodePath.isAbsolute(raw) ? raw : NodePath.resolve(confinement.cwd, raw);
+      if (insideRoot(confinement.workspaceRoot, absolute)) named.set(absolute, (named.get(absolute) ?? false) || write);
+      if (named.size >= 5) break;
+    }
+    if (named.size >= 5) break;
+  }
+  if (named.size === 0) return void 0;
+  const covered = (path, set) => set.some((entry) => entry === path || path.startsWith(entry + NodePath.sep));
+  const lines = [...named.entries()].sort(([left], [right]) => left < right ? -1 : 1).map(([path, write]) => {
+    const relative = toPosix(NodePath.relative(confinement.workspaceRoot, path));
+    const real = realized(path);
+    const escapes = !insideRoot(confinement.workspaceRoot, real);
+    const readable = !escapes && (covered(path, confinement.reads) || covered(path, confinement.writes));
+    const writable = !escapes && covered(path, confinement.writes) && !covered(path, confinement.readOnly);
+    if (escapes) {
+      return `sandbox: ${relative} resolves to ${real}, outside the declared ${write ? "write" : "read"} set`;
+    }
+    if (write) {
+      return writable ? `sandbox: ${relative} was denied inside the declared set` : `sandbox: ${relative} is outside the declared write set`;
+    }
+    if (!readable) return `sandbox: ${relative} is outside the declared read set`;
+    if (!writable) return `sandbox: ${relative} is outside the declared write set`;
+    return `sandbox: ${relative} was denied inside the declared set`;
+  });
+  return `${lines.join("\n")}
+sandbox: ${confinement.mechanism._tag}, network ${confinement.network}, ${confinement.reads.length} read path(s), ${confinement.writes.length} write path(s)`;
+};
+//# sourceMappingURL=ProcessSandbox.js.map