@sysid/sandbox-runtime-improved 0.0.45-sysid.2 → 0.0.49-sysid.1

package/README.md

@@ -4,9 +4,8 @@
 
 
 Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/sandbox-runtime).
-Why: I just need faster feature cycle-times.
 
-This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.45**).
+This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.49**).
 As new features become available, equivalent local ones will be removed.
 
 > Objective: keep as close to original as possible, while allowing selected additional features.
@@ -17,12 +16,10 @@ As new features become available, equivalent local ones will be removed.
 
 ```json
 {
-    "allowBrowserProcess": false,
-    "allowMachLookup": ["com.1password.*"]
+    "allowBrowserProcess": false
 }
 ```
 - `allowBrowserProcess` - **Significantly weakens the macOS sandbox.** Grants `(allow mach*)`, `(allow process-info*)`, `(allow iokit-open)`, and `(allow ipc-posix-shm*)` — permissions Chromium-based browsers need to launch. Filesystem and network restrictions remain enforced. Only enable for browser automation (e.g. `agent-browser`). (boolean, default: false) *(fork-only)*
-- `allowMachLookup` - Additional Mach/XPC service names to allow in the macOS sandbox (string array, optional). Names ending with `*` use prefix matching (e.g., `"com.1password.*"`). Use for tools like 1Password CLI that need specific services. *(fork-only, mirrors [upstream PR #92](https://github.com/anthropic-experimental/sandbox-runtime/pull/92))*
 
 ---
 
@@ -324,10 +321,10 @@ Uses an **allow-only pattern** - all network access is denied by default.
 
 **Unix Socket Settings** (platform-specific behavior):
 
-| Setting | macOS | Linux |
-|---------|-------|-------|
-| `allowUnixSockets: string[]` | Allowlist of socket paths | *Ignored* (seccomp can't filter by path) |
-| `allowAllUnixSockets: boolean` | Allow all sockets | Disable seccomp blocking |
+| Setting                        | macOS                     | Linux                                    |
+| ------------------------------ | ------------------------- | ---------------------------------------- |
+| `allowUnixSockets: string[]`   | Allowlist of socket paths | _Ignored_ (seccomp can't filter by path) |
+| `allowAllUnixSockets: boolean` | Allow all sockets         | Disable seccomp blocking                 |
 
 Unix sockets are **blocked by default** on both platforms.
 
@@ -383,7 +380,6 @@ Examples:
 - `ignoreViolations` - Object mapping command patterns to arrays of paths where violations should be ignored
 - `enableWeakerNestedSandbox` - Enable weaker sandbox mode for Docker environments (boolean, default: false)
 - `enableWeakerNetworkIsolation` - Allow access to `com.apple.trustd.agent` in the macOS sandbox (boolean, default: false). This is needed for Go programs (`gh`, `gcloud`, `terraform`, `kubectl`, etc.) to verify TLS certificates when using `httpProxyPort` with a MITM proxy and custom CA. **Security warning:** enabling this opens a potential data exfiltration vector through the trustd service.
-- `allowMachLookup` - Additional Mach/XPC service names to allow in the macOS sandbox (string array, optional). Names ending with `*` use prefix matching (e.g., `"com.1password.*"` allows all 1Password services). Others use exact matching.
 
 ### Common Configuration Recipes
 
@@ -509,15 +505,9 @@ npm install
 # Build the project
 npm run build
 
-# Build seccomp binaries (requires Docker)
-npm run build:seccomp
-
 # Run tests
 npm test
 
-# Run integration tests
-npm run test:integration
-
 # Type checking
 npm run typecheck
 
@@ -530,18 +520,7 @@ npm run format
 
 ### Building Seccomp Binaries
 
-The pre-generated BPF filters are included in the repository, but you can rebuild them if needed:
-
-```bash
-npm run build:seccomp
-```
-
-This script uses Docker to cross-compile seccomp binaries for multiple architectures:
-
-- x64 (x86-64)
-- arm64 (aarch64)
-
-The script builds static generator binaries, generates the BPF filters (~104 bytes each), and stores them in `vendor/seccomp/x64/` and `vendor/seccomp/arm64/`. The generator binaries are removed to keep the package size small.
+The BPF filter and `apply-seccomp` loader are compiled from C source in `vendor/seccomp-src/` via `npm run build:seccomp` (Linux only; needs `gcc` and `libseccomp-dev`). CI runs it before tests on each Linux arch, and the release workflow builds both arches and bundles them into the published package.
 
 ## Implementation Details
 
@@ -633,9 +612,9 @@ On Linux, the sandbox uses **seccomp BPF (Berkeley Packet Filter)** to block Uni
 
 **How it works:**
 
-1. **Pre-generated BPF filters**: The package includes pre-compiled BPF filters for different architectures (x64, ARM64). These are ~104 bytes each and stored in `vendor/seccomp/`. The filters are architecture-specific but libc-independent, so they work with both glibc and musl.
+1. **Baked-in BPF filter**: The package ships a static `apply-seccomp` binary for x64 and arm64 with the seccomp BPF filter compiled in. The filter is architecture-specific but libc-independent, so the binary works with both glibc and musl.
 
-2. **Runtime detection**: The sandbox automatically detects your system's architecture and loads the appropriate pre-generated BPF filter.
+2. **Runtime detection**: The sandbox automatically detects your system's architecture and uses the matching `apply-seccomp` binary.
 
 3. **Syscall filtering**: The BPF filter intercepts the `socket()` syscall and blocks creation of `AF_UNIX` sockets by returning `EPERM`. This prevents sandboxed code from creating new Unix domain sockets.
 

package/dist/sandbox/generate-seccomp-filter.d.ts

@@ -1,22 +1,3 @@
-/**
- * Get the path to a pre-generated BPF filter file from the vendor directory
- * Returns the path if it exists, null otherwise
- *
- * Pre-generated BPF files are organized by architecture:
- * - vendor/seccomp/{x64,arm64}/unix-block.bpf
- *
- * Tries multiple paths for resilience:
- * 0. Explicit path provided via parameter (checked first if provided)
- * 1. vendor/seccomp/{arch}/unix-block.bpf (bundled - when bundled into consuming packages)
- * 2. ../../vendor/seccomp/{arch}/unix-block.bpf (package root - standard npm installs)
- * 3. ../vendor/seccomp/{arch}/unix-block.bpf (dist/vendor - for bundlers)
- * 4. Global npm install (if seccompBinaryPath not provided) - for native builds
- *
- * @param seccompBinaryPath - Optional explicit path to the BPF filter file. If provided and
- *   exists, it will be used. If not provided, falls back to searching local paths and then
- *   global npm install (for native builds where vendor directory isn't bundled).
- */
-export declare function getPreGeneratedBpfPath(seccompBinaryPath?: string): string | null;
 /**
  * Get the path to the apply-seccomp binary from the vendor directory
  * Returns the path if it exists, null otherwise
@@ -36,36 +17,4 @@ export declare function getPreGeneratedBpfPath(seccompBinaryPath?: string): stri
  *   then global npm install (for native builds where vendor directory isn't bundled).
  */
 export declare function getApplySeccompBinaryPath(seccompBinaryPath?: string): string | null;
-/**
- * Get the path to a pre-generated seccomp BPF filter that blocks Unix domain socket creation
- * Returns the path to the BPF filter file, or null if not available
- *
- * The filter blocks socket(AF_UNIX, ...) syscalls while allowing all other syscalls.
- * This prevents creation of new Unix domain socket file descriptors.
- *
- * Security scope:
- * - Blocks: socket(AF_UNIX, ...) syscall (creating new Unix socket FDs)
- * - Does NOT block: Operations on inherited Unix socket FDs (bind, connect, sendto, etc.)
- * - Does NOT block: Unix socket FDs passed via SCM_RIGHTS
- * - For most sandboxing scenarios, blocking socket creation is sufficient
- *
- * Note: This blocks ALL Unix socket creation, regardless of path. The allowUnixSockets
- * configuration is not supported on Linux due to seccomp-bpf limitations (it cannot
- * read user-space memory to inspect socket paths).
- *
- * Requirements:
- * - Pre-generated BPF filters included for x64 and ARM64 only
- * - Other architectures are not supported
- *
- * @param seccompBinaryPath - Optional explicit path to the BPF filter file
- * @returns Path to the pre-generated BPF filter file, or null if not available
- */
-export declare function generateSeccompFilter(seccompBinaryPath?: string): string | null;
-/**
- * Clean up a seccomp filter file
- * Since we only use pre-generated BPF files from vendor/, this is a no-op.
- * Pre-generated files are never deleted.
- * Kept for backward compatibility with existing code that calls it.
- */
-export declare function cleanupSeccompFilter(_filterPath: string): void;
 //# sourceMappingURL=generate-seccomp-filter.d.ts.map

package/dist/sandbox/generate-seccomp-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-seccomp-filter.d.ts","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AA8IA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,iBAAiB,CAAC,EAAE,MAAM,GACzB,MAAM,GAAG,IAAI,CASf;AA6DD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,iBAAiB,CAAC,EAAE,MAAM,GACzB,MAAM,GAAG,IAAI,CASf;AA6DD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB,MAAM,GAAG,IAAI,CAaf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9D"}
+{"version":3,"file":"generate-seccomp-filter.d.ts","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AA6IA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,iBAAiB,CAAC,EAAE,MAAM,GACzB,MAAM,GAAG,IAAI,CASf"}

package/dist/sandbox/generate-seccomp-filter.js

@@ -5,7 +5,6 @@ import { execSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { logForDebugging } from '../utils/debug.js';
 // Cache for path lookups (key: explicit path or empty string, value: resolved path or null)
-const bpfPathCache = new Map();
 const applySeccompPathCache = new Map();
 // Cache for global npm paths (computed once per process)
 let cachedGlobalNpmPaths = null;
@@ -95,68 +94,6 @@ function getLocalSeccompPaths(filename) {
         join(baseDir, '..', relativePath), // dist: dist/vendor/seccomp/...
     ];
 }
-/**
- * Get the path to a pre-generated BPF filter file from the vendor directory
- * Returns the path if it exists, null otherwise
- *
- * Pre-generated BPF files are organized by architecture:
- * - vendor/seccomp/{x64,arm64}/unix-block.bpf
- *
- * Tries multiple paths for resilience:
- * 0. Explicit path provided via parameter (checked first if provided)
- * 1. vendor/seccomp/{arch}/unix-block.bpf (bundled - when bundled into consuming packages)
- * 2. ../../vendor/seccomp/{arch}/unix-block.bpf (package root - standard npm installs)
- * 3. ../vendor/seccomp/{arch}/unix-block.bpf (dist/vendor - for bundlers)
- * 4. Global npm install (if seccompBinaryPath not provided) - for native builds
- *
- * @param seccompBinaryPath - Optional explicit path to the BPF filter file. If provided and
- *   exists, it will be used. If not provided, falls back to searching local paths and then
- *   global npm install (for native builds where vendor directory isn't bundled).
- */
-export function getPreGeneratedBpfPath(seccompBinaryPath) {
-    const cacheKey = seccompBinaryPath ?? '';
-    if (bpfPathCache.has(cacheKey)) {
-        return bpfPathCache.get(cacheKey);
-    }
-    const result = findBpfPath(seccompBinaryPath);
-    bpfPathCache.set(cacheKey, result);
-    return result;
-}
-// NOTE: This is a slow operation (synchronous fs lookups + execSync). Ensure calls
-// are memoized at the top level rather than invoked repeatedly.
-function findBpfPath(seccompBinaryPath) {
-    // Check explicit path first (highest priority)
-    if (seccompBinaryPath) {
-        if (fs.existsSync(seccompBinaryPath)) {
-            logForDebugging(`[SeccompFilter] Using BPF filter from explicit path: ${seccompBinaryPath}`);
-            return seccompBinaryPath;
-        }
-        logForDebugging(`[SeccompFilter] Explicit path provided but file not found: ${seccompBinaryPath}`);
-    }
-    const arch = getVendorArchitecture();
-    if (!arch) {
-        logForDebugging(`[SeccompFilter] Cannot find pre-generated BPF filter: unsupported architecture ${process.arch}`);
-        return null;
-    }
-    logForDebugging(`[SeccompFilter] Detected architecture: ${arch}`);
-    // Check local paths first (bundled or package install)
-    for (const bpfPath of getLocalSeccompPaths('unix-block.bpf')) {
-        if (fs.existsSync(bpfPath)) {
-            logForDebugging(`[SeccompFilter] Found pre-generated BPF filter: ${bpfPath} (${arch})`);
-            return bpfPath;
-        }
-    }
-    // Fallback: check global npm install (for native builds without bundled vendor)
-    for (const globalBase of getGlobalNpmPaths()) {
-        const bpfPath = join(globalBase, 'vendor', 'seccomp', arch, 'unix-block.bpf');
-        if (fs.existsSync(bpfPath)) {
-            logForDebugging(`[SeccompFilter] Found pre-generated BPF filter in global install: ${bpfPath} (${arch})`);
-            return bpfPath;
-        }
-    }
-    logForDebugging(`[SeccompFilter] Pre-generated BPF filter not found in any expected location (${arch})`);
-    return null;
-}
 /**
  * Get the path to the apply-seccomp binary from the vendor directory
  * Returns the path if it exists, null otherwise
@@ -217,47 +154,4 @@ function findApplySeccompPath(seccompBinaryPath) {
     logForDebugging(`[SeccompFilter] apply-seccomp binary not found in any expected location (${arch})`);
     return null;
 }
-/**
- * Get the path to a pre-generated seccomp BPF filter that blocks Unix domain socket creation
- * Returns the path to the BPF filter file, or null if not available
- *
- * The filter blocks socket(AF_UNIX, ...) syscalls while allowing all other syscalls.
- * This prevents creation of new Unix domain socket file descriptors.
- *
- * Security scope:
- * - Blocks: socket(AF_UNIX, ...) syscall (creating new Unix socket FDs)
- * - Does NOT block: Operations on inherited Unix socket FDs (bind, connect, sendto, etc.)
- * - Does NOT block: Unix socket FDs passed via SCM_RIGHTS
- * - For most sandboxing scenarios, blocking socket creation is sufficient
- *
- * Note: This blocks ALL Unix socket creation, regardless of path. The allowUnixSockets
- * configuration is not supported on Linux due to seccomp-bpf limitations (it cannot
- * read user-space memory to inspect socket paths).
- *
- * Requirements:
- * - Pre-generated BPF filters included for x64 and ARM64 only
- * - Other architectures are not supported
- *
- * @param seccompBinaryPath - Optional explicit path to the BPF filter file
- * @returns Path to the pre-generated BPF filter file, or null if not available
- */
-export function generateSeccompFilter(seccompBinaryPath) {
-    const preGeneratedBpf = getPreGeneratedBpfPath(seccompBinaryPath);
-    if (preGeneratedBpf) {
-        logForDebugging('[SeccompFilter] Using pre-generated BPF filter');
-        return preGeneratedBpf;
-    }
-    logForDebugging('[SeccompFilter] Pre-generated BPF filter not available for this architecture. ' +
-        'Only x64 and arm64 are supported.', { level: 'error' });
-    return null;
-}
-/**
- * Clean up a seccomp filter file
- * Since we only use pre-generated BPF files from vendor/, this is a no-op.
- * Pre-generated files are never deleted.
- * Kept for backward compatibility with existing code that calls it.
- */
-export function cleanupSeccompFilter(_filterPath) {
-    // No-op: pre-generated BPF files are never cleaned up
-}
 //# sourceMappingURL=generate-seccomp-filter.js.map

package/dist/sandbox/generate-seccomp-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-seccomp-filter.js","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,4FAA4F;AAC5F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAA;AACrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAE9D,yDAAyD;AACzD,IAAI,oBAAoB,GAAoB,IAAI,CAAA;AAEhD;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAA;IAErD,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,2CAA2C;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,KAAK,CAAC,IAAI;IACR,2BAA2B;IAC3B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,EACvE,IAAI,CACF,MAAM,EACN,OAAO,EACP,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,yDAAyD;IACzD,IAAI,CACF,MAAM,EACN,UAAU,EACV,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,wBAAwB;IACxB,IAAI,CACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,EACD,IAAI,CACF,IAAI,EACJ,aAAa,EACb,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,CACF,CAAA;IAED,oBAAoB,GAAG,KAAK,CAAA;IAC5B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAc,CAAA;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,OAAO,CAAA;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,0CAA0C;YAC1C,wFAAwF;YACxF,mGAAmG;YACnG,4FAA4F;YAC5F,6FAA6F;YAC7F,EAAE;YACF,8CAA8C;YAC9C,8EAA8E;YAC9E,2FAA2F;YAC3F,8CAA8C;YAC9C,kDAAkD;YAClD,mFAAmF;YACnF,EAAE;YACF,sEAAsE;YACtE,eAAe,CACb,6GAA6G;gBAC3G,0HAA0H,EAC5H,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,OAAO,IAAI,CAAA;QACb;YACE,eAAe,CACb,6CAA6C,IAAI,qCAAqC,CACvF,CAAA;YACD,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAE9D,OAAO;QACL,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,yEAAyE;QACtG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,mCAAmC;QAC5E,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,gCAAgC;KACpE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAA;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAC7C,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAClC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,mFAAmF;AACnF,gEAAgE;AAChE,SAAS,WAAW,CAAC,iBAA0B;IAC7C,+CAA+C;IAC/C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,eAAe,CACb,wDAAwD,iBAAiB,EAAE,CAC5E,CAAA;YACD,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,eAAe,CACb,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,CACb,kFAAkF,OAAO,CAAC,IAAI,EAAE,CACjG,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAA;IAEjE,uDAAuD;IACvD,KAAK,MAAM,OAAO,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,eAAe,CACb,mDAAmD,OAAO,KAAK,IAAI,GAAG,CACvE,CAAA;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAClB,UAAU,EACV,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,gBAAgB,CACjB,CAAA;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,eAAe,CACb,qEAAqE,OAAO,KAAK,IAAI,GAAG,CACzF,CAAA;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,eAAe,CACb,gFAAgF,IAAI,GAAG,CACxF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAA;IACxC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;IACtD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,iBAA0B;IACtD,+CAA+C;IAC/C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,eAAe,CACb,kEAAkE,iBAAiB,EAAE,CACtF,CAAA;YACD,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,eAAe,CACb,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,CACb,8EAA8E,OAAO,CAAC,IAAI,EAAE,CAC7F,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe,CACb,sEAAsE,IAAI,EAAE,CAC7E,CAAA;IAED,uDAAuD;IACvD,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,+CAA+C,UAAU,KAAK,IAAI,GAAG,CACtE,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CACrB,UAAU,EACV,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,eAAe,CAChB,CAAA;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,iEAAiE,UAAU,KAAK,IAAI,GAAG,CACxF,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,eAAe,CACb,4EAA4E,IAAI,GAAG,CACpF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAA0B;IAE1B,MAAM,eAAe,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAA;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,eAAe,CAAC,gDAAgD,CAAC,CAAA;QACjE,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,eAAe,CACb,gFAAgF;QAC9E,mCAAmC,EACrC,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,sDAAsD;AACxD,CAAC"}
+{"version":3,"file":"generate-seccomp-filter.js","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAE9D,yDAAyD;AACzD,IAAI,oBAAoB,GAAoB,IAAI,CAAA;AAEhD;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAA;IAErD,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,2CAA2C;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,KAAK,CAAC,IAAI;IACR,2BAA2B;IAC3B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,EACvE,IAAI,CACF,MAAM,EACN,OAAO,EACP,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,yDAAyD;IACzD,IAAI,CACF,MAAM,EACN,UAAU,EACV,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,wBAAwB;IACxB,IAAI,CACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,EACD,IAAI,CACF,IAAI,EACJ,aAAa,EACb,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,CACF,CAAA;IAED,oBAAoB,GAAG,KAAK,CAAA;IAC5B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAc,CAAA;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,OAAO,CAAA;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,0CAA0C;YAC1C,wFAAwF;YACxF,mGAAmG;YACnG,4FAA4F;YAC5F,6FAA6F;YAC7F,EAAE;YACF,8CAA8C;YAC9C,8EAA8E;YAC9E,2FAA2F;YAC3F,8CAA8C;YAC9C,kDAAkD;YAClD,mFAAmF;YACnF,EAAE;YACF,sEAAsE;YACtE,eAAe,CACb,6GAA6G;gBAC3G,0HAA0H,EAC5H,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,OAAO,IAAI,CAAA;QACb;YACE,eAAe,CACb,6CAA6C,IAAI,qCAAqC,CACvF,CAAA;YACD,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAE9D,OAAO;QACL,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,yEAAyE;QACtG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,mCAAmC;QAC5E,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,gCAAgC;KACpE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAA;IACxC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;IACtD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,iBAA0B;IACtD,+CAA+C;IAC/C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,eAAe,CACb,kEAAkE,iBAAiB,EAAE,CACtF,CAAA;YACD,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,eAAe,CACb,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,CACb,8EAA8E,OAAO,CAAC,IAAI,EAAE,CAC7F,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe,CACb,sEAAsE,IAAI,EAAE,CAC7E,CAAA;IAED,uDAAuD;IACvD,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,+CAA+C,UAAU,KAAK,IAAI,GAAG,CACtE,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CACrB,UAAU,EACV,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,eAAe,CAChB,CAAA;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,iEAAiE,UAAU,KAAK,IAAI,GAAG,CACxF,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,eAAe,CACb,4EAA4E,IAAI,GAAG,CACpF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/sandbox/linux-sandbox-utils.d.ts

@@ -1,5 +1,6 @@
 import type { ChildProcess } from 'node:child_process';
 import type { FsReadRestrictionConfig, FsWriteRestrictionConfig } from './sandbox-schemas.js';
+import type { SeccompConfig } from './sandbox-config.js';
 export interface LinuxNetworkBridgeContext {
     httpSocketPath: string;
     socksSocketPath: string;
@@ -29,10 +30,7 @@ export interface LinuxSandboxParams {
     /** Allow writes to .git/config files (default: false) */
     allowGitConfig?: boolean;
     /** Custom seccomp binary paths */
-    seccompConfig?: {
-        bpfPath?: string;
-        applyPath?: string;
-    };
+    seccompConfig?: SeccompConfig;
     /** Abort signal to cancel the ripgrep scan */
     abortSignal?: AbortSignal;
 }
@@ -66,7 +64,6 @@ export declare function cleanupBwrapMountPoints(opts?: {
 export type LinuxDependencyStatus = {
     hasBwrap: boolean;
     hasSocat: boolean;
-    hasSeccompBpf: boolean;
     hasSeccompApply: boolean;
 };
 /**
@@ -79,17 +76,11 @@ export type SandboxDependencyCheck = {
 /**
  * Get detailed status of Linux sandbox dependencies
  */
-export declare function getLinuxDependencyStatus(seccompConfig?: {
-    bpfPath?: string;
-    applyPath?: string;
-}): LinuxDependencyStatus;
+export declare function getLinuxDependencyStatus(seccompConfig?: SeccompConfig): LinuxDependencyStatus;
 /**
  * Check sandbox dependencies and return structured result
  */
-export declare function checkLinuxDependencies(seccompConfig?: {
-    bpfPath?: string;
-    applyPath?: string;
-}): SandboxDependencyCheck;
+export declare function checkLinuxDependencies(seccompConfig?: SeccompConfig): SandboxDependencyCheck;
 /**
  * Initialize the Linux network bridge for sandbox networking
  *

package/dist/sandbox/linux-sandbox-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAYtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAQ7B,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAwQD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAyCxE;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,aAAa,EAAE,OAAO,CAAA;IACtB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,CAAC,EAAE;IACvD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,qBAAqB,CAQxB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,CAAC,EAAE;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,sBAAsB,CAezB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,yBAAyB,CAAC,CA2HpC;AA2XD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CA2QjB"}
+{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAYtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AA8PD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAyCxE;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,CAAC,EAAE,aAAa,GAC5B,qBAAqB,CAUvB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,CAAC,EAAE,aAAa,GAC5B,sBAAsB,CAgBxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,yBAAyB,CAAC,CA2HpC;AAsYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAuOjB"}