@sysid/sandbox-runtime-improved 0.0.42-sysid.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/README.md +676 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +166 -0
- package/dist/cli.js.map +1 -0
- package/dist/index.d.ts +11 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +9 -0
- package/dist/index.js.map +1 -0
- package/dist/sandbox/generate-seccomp-filter.d.ts +71 -0
- package/dist/sandbox/generate-seccomp-filter.d.ts.map +1 -0
- package/dist/sandbox/generate-seccomp-filter.js +263 -0
- package/dist/sandbox/generate-seccomp-filter.js.map +1 -0
- package/dist/sandbox/http-proxy.d.ts +19 -0
- package/dist/sandbox/http-proxy.d.ts.map +1 -0
- package/dist/sandbox/http-proxy.js +295 -0
- package/dist/sandbox/http-proxy.js.map +1 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts +158 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/linux-sandbox-utils.js +875 -0
- package/dist/sandbox/linux-sandbox-utils.js.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts +41 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.js +672 -0
- package/dist/sandbox/macos-sandbox-utils.js.map +1 -0
- package/dist/sandbox/sandbox-config.d.ts +307 -0
- package/dist/sandbox/sandbox-config.d.ts.map +1 -0
- package/dist/sandbox/sandbox-config.js +195 -0
- package/dist/sandbox/sandbox-config.js.map +1 -0
- package/dist/sandbox/sandbox-manager.d.ts +42 -0
- package/dist/sandbox/sandbox-manager.d.ts.map +1 -0
- package/dist/sandbox/sandbox-manager.js +796 -0
- package/dist/sandbox/sandbox-manager.js.map +1 -0
- package/dist/sandbox/sandbox-schemas.d.ts +57 -0
- package/dist/sandbox/sandbox-schemas.d.ts.map +1 -0
- package/dist/sandbox/sandbox-schemas.js +3 -0
- package/dist/sandbox/sandbox-schemas.js.map +1 -0
- package/dist/sandbox/sandbox-utils.d.ts +116 -0
- package/dist/sandbox/sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/sandbox-utils.js +463 -0
- package/dist/sandbox/sandbox-utils.js.map +1 -0
- package/dist/sandbox/sandbox-violation-store.d.ts +19 -0
- package/dist/sandbox/sandbox-violation-store.d.ts.map +1 -0
- package/dist/sandbox/sandbox-violation-store.js +54 -0
- package/dist/sandbox/sandbox-violation-store.js.map +1 -0
- package/dist/sandbox/socks-proxy.d.ts +13 -0
- package/dist/sandbox/socks-proxy.d.ts.map +1 -0
- package/dist/sandbox/socks-proxy.js +95 -0
- package/dist/sandbox/socks-proxy.js.map +1 -0
- package/dist/utils/config-loader.d.ts +11 -0
- package/dist/utils/config-loader.d.ts.map +1 -0
- package/dist/utils/config-loader.js +60 -0
- package/dist/utils/config-loader.js.map +1 -0
- package/dist/utils/debug.d.ts +7 -0
- package/dist/utils/debug.d.ts.map +1 -0
- package/dist/utils/debug.js +25 -0
- package/dist/utils/debug.js.map +1 -0
- package/dist/utils/platform.d.ts +15 -0
- package/dist/utils/platform.d.ts.map +1 -0
- package/dist/utils/platform.js +49 -0
- package/dist/utils/platform.js.map +1 -0
- package/dist/utils/ripgrep.d.ts +22 -0
- package/dist/utils/ripgrep.d.ts.map +1 -0
- package/dist/utils/ripgrep.js +45 -0
- package/dist/utils/ripgrep.js.map +1 -0
- package/dist/utils/which.d.ts +9 -0
- package/dist/utils/which.d.ts.map +1 -0
- package/dist/utils/which.js +25 -0
- package/dist/utils/which.js.map +1 -0
- package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp-src/apply-seccomp.c +98 -0
- package/dist/vendor/seccomp-src/seccomp-unix-block.c +97 -0
- package/package.json +88 -0
- package/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/vendor/seccomp/x64/apply-seccomp +0 -0
- package/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/vendor/seccomp-src/apply-seccomp.c +98 -0
- package/vendor/seccomp-src/seccomp-unix-block.c +97 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAQ7B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,+CAA+C;IAC/C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;QACtD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,wCAAwC;IACxC,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;QACjB,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB;YAClD,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3C,CAAC,CAAC,SAAS;KACd,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;KACvD,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,mBAAmB,EAAE,CAAA;IAErB,qBAAqB;IACrB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAC9C,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAC9D,MAAM,CAAC,gBAAgB,CACxB,CAAA;QACD,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,kFAAkF;IAClF,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACvE,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,OAAO,aAAa,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,oCAAoC,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CAC9E,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,8CAA8C,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CACxF,CAAA;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,UAAU;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,MAAM,EAAE,4BAA4B,CAAA;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,eAAe,GAAG,CAAC,KAAe,EAAY,EAAE,CACpD,KAAK;SACF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE;QACV,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,eAAe,CACb,mDAAmD,CAAC,EAAE,CACvD,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACN,MAAM,cAAc,GAAG,eAAe,CACpC,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5E,CAAA;IACD,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EAAE,eAAe,CAC9B,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAC1E;KACF,CAAA;IACD,MAAM,WAAW,GACf,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAA;IACzE,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,gBAAgB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAChB,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAAA;IAC3E,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,iBAAiB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,iBAAiB;KACnC,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,4EAA4E;IAC5E,MAAM,mBAAmB,GACvB,YAAY,EAAE,mBAAmB,IAAI,MAAM,EAAE,mBAAmB,CAAA;IAElE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,mBAAmB;gBACnB,cAAc,EAAE,iBAAiB,EAAE;gBACnC,4BAA4B,EAAE,+BAA+B,EAAE;gBAC/D,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,uBAAuB,EAAE,CAAA;AAC3B,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,2CAA2C;IAC3C,mBAAmB,EAAE,CAAA;IAErB,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;AACnC,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,uFAAuF;IACvF,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAgDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Read restriction config using a "deny then allow-back" pattern.
|
|
3
|
+
*
|
|
4
|
+
* Semantics:
|
|
5
|
+
* - `undefined` = no restrictions (allow all reads)
|
|
6
|
+
* - `{denyOnly: []}` = no restrictions (empty deny list = allow all reads)
|
|
7
|
+
* - `{denyOnly: [...paths]}` = deny reads from these paths, allow all others
|
|
8
|
+
* - `{denyOnly: [...paths], allowWithinDeny: [...paths]}` = deny reads from
|
|
9
|
+
* denyOnly paths, but re-allow reads within allowWithinDeny paths.
|
|
10
|
+
* allowWithinDeny takes precedence over denyOnly (most-specific rule wins).
|
|
11
|
+
*
|
|
12
|
+
* This is maximally permissive by default - only explicitly denied paths are blocked.
|
|
13
|
+
*/
|
|
14
|
+
export interface FsReadRestrictionConfig {
|
|
15
|
+
denyOnly: string[];
|
|
16
|
+
allowWithinDeny?: string[];
|
|
17
|
+
}
|
|
18
|
+
/**
|
|
19
|
+
* Write restriction config using an "allow-only" pattern.
|
|
20
|
+
*
|
|
21
|
+
* Semantics:
|
|
22
|
+
* - `undefined` = no restrictions (allow all writes)
|
|
23
|
+
* - `{allowOnly: [], denyWithinAllow: []}` = maximally restrictive (deny ALL writes)
|
|
24
|
+
* - `{allowOnly: [...paths], denyWithinAllow: [...]}` = allow writes only to these paths,
|
|
25
|
+
* with exceptions for denyWithinAllow
|
|
26
|
+
*
|
|
27
|
+
* This is maximally restrictive by default - only explicitly allowed paths are writable.
|
|
28
|
+
* Note: Empty `allowOnly` means NO paths are writable (unlike read's empty denyOnly).
|
|
29
|
+
*/
|
|
30
|
+
export interface FsWriteRestrictionConfig {
|
|
31
|
+
allowOnly: string[];
|
|
32
|
+
denyWithinAllow: string[];
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* Network restriction config (internal structure built from permission rules).
|
|
36
|
+
*
|
|
37
|
+
* This uses an "allow-only" pattern (like write restrictions):
|
|
38
|
+
* - `allowedHosts` = hosts that are explicitly allowed
|
|
39
|
+
* - `deniedHosts` = hosts that are explicitly denied (checked first, before allowedHosts)
|
|
40
|
+
*
|
|
41
|
+
* Semantics:
|
|
42
|
+
* - `undefined` = maximally restrictive (deny all network)
|
|
43
|
+
* - `{allowedHosts: [], deniedHosts: []}` = maximally restrictive (nothing allowed)
|
|
44
|
+
* - `{allowedHosts: [...], deniedHosts: [...]}` = apply allow/deny rules
|
|
45
|
+
*
|
|
46
|
+
* Note: Empty `allowedHosts` means NO hosts are allowed (unlike read's empty denyOnly).
|
|
47
|
+
*/
|
|
48
|
+
export interface NetworkRestrictionConfig {
|
|
49
|
+
allowedHosts?: string[];
|
|
50
|
+
deniedHosts?: string[];
|
|
51
|
+
}
|
|
52
|
+
export type NetworkHostPattern = {
|
|
53
|
+
host: string;
|
|
54
|
+
port: number | undefined;
|
|
55
|
+
};
|
|
56
|
+
export type SandboxAskCallback = (params: NetworkHostPattern) => Promise<boolean>;
|
|
57
|
+
//# sourceMappingURL=sandbox-schemas.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-schemas.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAAC,CAAA"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-schemas.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAAA,mFAAmF"}
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dangerous files that should be protected from writes.
|
|
3
|
+
* These files can be used for code execution or data exfiltration.
|
|
4
|
+
*/
|
|
5
|
+
export declare const DANGEROUS_FILES: readonly [".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc", ".zprofile", ".profile", ".ripgreprc", ".mcp.json"];
|
|
6
|
+
/**
|
|
7
|
+
* Dangerous directories that should be protected from writes.
|
|
8
|
+
* These directories contain sensitive configuration or executable files.
|
|
9
|
+
*/
|
|
10
|
+
export declare const DANGEROUS_DIRECTORIES: readonly [".git", ".vscode", ".idea"];
|
|
11
|
+
/**
|
|
12
|
+
* Get the list of dangerous directories to deny writes to.
|
|
13
|
+
* Excludes .git since we need it writable for git operations -
|
|
14
|
+
* instead we block specific paths within .git (hooks and config).
|
|
15
|
+
*/
|
|
16
|
+
export declare function getDangerousDirectories(): string[];
|
|
17
|
+
/**
|
|
18
|
+
* Normalizes a path for case-insensitive comparison.
|
|
19
|
+
* This prevents bypassing security checks using mixed-case paths on case-insensitive
|
|
20
|
+
* filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
|
|
21
|
+
*
|
|
22
|
+
* We always normalize to lowercase regardless of platform for consistent security.
|
|
23
|
+
* @param path The path to normalize
|
|
24
|
+
* @returns The lowercase path for safe comparison
|
|
25
|
+
*/
|
|
26
|
+
export declare function normalizeCaseForComparison(pathStr: string): string;
|
|
27
|
+
/**
|
|
28
|
+
* Check if a path pattern contains glob characters
|
|
29
|
+
*/
|
|
30
|
+
export declare function containsGlobChars(pathPattern: string): boolean;
|
|
31
|
+
/**
|
|
32
|
+
* Remove trailing /** glob suffix from a path pattern
|
|
33
|
+
* Used to normalize path patterns since /** just means "directory and everything under it"
|
|
34
|
+
*/
|
|
35
|
+
export declare function removeTrailingGlobSuffix(pathPattern: string): string;
|
|
36
|
+
/**
|
|
37
|
+
* Check if a symlink resolution crosses expected path boundaries.
|
|
38
|
+
*
|
|
39
|
+
* When resolving symlinks for sandbox path normalization, we need to ensure
|
|
40
|
+
* the resolved path doesn't unexpectedly broaden the scope. This function
|
|
41
|
+
* returns true if the resolved path is an ancestor of the original path
|
|
42
|
+
* or resolves to a system root, which would indicate the symlink points
|
|
43
|
+
* outside expected boundaries.
|
|
44
|
+
*
|
|
45
|
+
* @param originalPath - The original path before symlink resolution
|
|
46
|
+
* @param resolvedPath - The path after fs.realpathSync() resolution
|
|
47
|
+
* @returns true if the resolved path is outside expected boundaries
|
|
48
|
+
*/
|
|
49
|
+
export declare function isSymlinkOutsideBoundary(originalPath: string, resolvedPath: string): boolean;
|
|
50
|
+
/**
|
|
51
|
+
* Normalize a path for use in sandbox configurations
|
|
52
|
+
* Handles:
|
|
53
|
+
* - Tilde (~) expansion for home directory
|
|
54
|
+
* - Relative paths (./foo, ../foo, etc.) converted to absolute
|
|
55
|
+
* - Absolute paths remain unchanged
|
|
56
|
+
* - Symlinks are resolved to their real paths for non-glob patterns
|
|
57
|
+
* - Glob patterns preserve wildcards after path normalization
|
|
58
|
+
*
|
|
59
|
+
* Returns the absolute path with symlinks resolved (or normalized glob pattern)
|
|
60
|
+
*/
|
|
61
|
+
export declare function normalizePathForSandbox(pathPattern: string): string;
|
|
62
|
+
/**
|
|
63
|
+
* Get recommended system paths that should be writable for commands to work properly
|
|
64
|
+
*
|
|
65
|
+
* WARNING: These default paths are intentionally broad for compatibility but may
|
|
66
|
+
* allow access to files from other processes. In highly security-sensitive
|
|
67
|
+
* environments, you should configure more restrictive write paths.
|
|
68
|
+
*/
|
|
69
|
+
export declare function getDefaultWritePaths(): string[];
|
|
70
|
+
/**
|
|
71
|
+
* Ensure the sandbox TMPDIR exists so tools like mktemp work inside the sandbox.
|
|
72
|
+
* When TMPDIR is set to a non-existent path, mktemp silently returns an empty
|
|
73
|
+
* string; any subsequent use of that empty string as a redirect target (e.g.
|
|
74
|
+
* `cat $tmp`) reads from stdin and hangs the shell session indefinitely.
|
|
75
|
+
*/
|
|
76
|
+
export declare function ensureSandboxTmpdir(): void;
|
|
77
|
+
/**
|
|
78
|
+
* Generate proxy environment variables for sandboxed processes
|
|
79
|
+
*/
|
|
80
|
+
export declare function generateProxyEnvVars(httpProxyPort?: number, socksProxyPort?: number): string[];
|
|
81
|
+
/**
|
|
82
|
+
* Encode a command for sandbox monitoring
|
|
83
|
+
* Truncates to 100 chars and base64 encodes to avoid parsing issues
|
|
84
|
+
*/
|
|
85
|
+
export declare function encodeSandboxedCommand(command: string): string;
|
|
86
|
+
/**
|
|
87
|
+
* Decode a base64-encoded command from sandbox monitoring
|
|
88
|
+
*/
|
|
89
|
+
export declare function decodeSandboxedCommand(encodedCommand: string): string;
|
|
90
|
+
/**
|
|
91
|
+
* Convert a glob pattern to a regular expression
|
|
92
|
+
*
|
|
93
|
+
* This implements gitignore-style pattern matching to match the behavior of the
|
|
94
|
+
* `ignore` library used by the permission system.
|
|
95
|
+
*
|
|
96
|
+
* Supported patterns:
|
|
97
|
+
* - * matches any characters except / (e.g., *.ts matches foo.ts but not foo/bar.ts)
|
|
98
|
+
* - ** matches any characters including / (e.g., src/**\/*.ts matches all .ts files in src/)
|
|
99
|
+
* - ? matches any single character except / (e.g., file?.txt matches file1.txt)
|
|
100
|
+
* - [abc] matches any character in the set (e.g., file[0-9].txt matches file3.txt)
|
|
101
|
+
*
|
|
102
|
+
* Exported for testing and shared between macOS sandbox profiles and Linux glob expansion.
|
|
103
|
+
*/
|
|
104
|
+
export declare function globToRegex(globPattern: string): string;
|
|
105
|
+
/**
|
|
106
|
+
* Expand a glob pattern into concrete file paths.
|
|
107
|
+
*
|
|
108
|
+
* Used on Linux where bubblewrap doesn't support glob patterns natively.
|
|
109
|
+
* Resolves the static directory prefix, lists files recursively, and filters
|
|
110
|
+
* using globToRegex().
|
|
111
|
+
*
|
|
112
|
+
* @param globPath - A path pattern containing glob characters (e.g., ~/test/*.env)
|
|
113
|
+
* @returns Array of absolute paths matching the glob pattern
|
|
114
|
+
*/
|
|
115
|
+
export declare function expandGlobPattern(globPath: string): string[];
|
|
116
|
+
//# sourceMappingURL=sandbox-utils.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,eAAO,MAAM,eAAe,kIAUlB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uCAAwC,CAAA;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAMlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAuGT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA6DnE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAgB/C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAS1C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,CAAC,EAAE,MAAM,EACtB,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,EAAE,CAqHV;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAkBvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsD5D"}
|