@sysid/sandbox-runtime-improved 0.0.52-sysid.1 → 0.0.54-sysid.1

package/dist/sandbox/mitm-leaf.js.map

@@ -1 +1 @@
-{"version":3,"file":"mitm-leaf.js","sourceRoot":"","sources":["../../src/sandbox/mitm-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;AASvC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,QAAgB;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvD;YACE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,IAAI;SACtB;QACD,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;QACxD,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,8BAA8B;KAC/B,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAErC,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO;QAChD,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;KAC7C,CAAA;IACD,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChC,eAAe,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACpC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB;IAK9B,yDAAyD;IACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAClC,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,MAA6B;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACtC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;IACpB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAA;AACV,CAAC"}
+{"version":3,"file":"mitm-leaf.js","sourceRoot":"","sources":["../../src/sandbox/mitm-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;AASvC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,QAAgB;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,EAAE,CAAA;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvD;YACE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,IAAI;SACtB;QACD,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;QACxD,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,8BAA8B;KAC/B,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAErC,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO;QAChD,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;KAC7C,CAAA;IACD,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChC,eAAe,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACpC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB;IAK9B,yDAAyD;IACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,MAA6B,EAAE,SAAe;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;IACpB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/sandbox/sandbox-config.d.ts

@@ -178,6 +178,27 @@ export declare const RipgrepConfigSchema: z.ZodObject<{
     args?: string[] | undefined;
     argv0?: string | undefined;
 }>;
+/**
+ * Windows-specific configuration schema. See
+ * `windows-sandbox-utils.ts` for the install flow these settings
+ * must agree with.
+ */
+export declare const WindowsConfigSchema: z.ZodObject<{
+    groupName: z.ZodDefault<z.ZodString>;
+    groupSid: z.ZodOptional<z.ZodString>;
+    wfpSublayerGuid: z.ZodOptional<z.ZodString>;
+    proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+}, "strip", z.ZodTypeAny, {
+    groupName: string;
+    groupSid?: string | undefined;
+    wfpSublayerGuid?: string | undefined;
+    proxyPortRange?: [number, number] | undefined;
+}, {
+    groupName?: string | undefined;
+    groupSid?: string | undefined;
+    wfpSublayerGuid?: string | undefined;
+    proxyPortRange?: [number, number] | undefined;
+}>;
 /**
  * Seccomp configuration schema (Linux only)
  */
@@ -313,6 +334,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
     enableWeakerNetworkIsolation: z.ZodOptional<z.ZodBoolean>;
+    allowAppleEvents: z.ZodOptional<z.ZodBoolean>;
     ripgrep: z.ZodOptional<z.ZodObject<{
         command: z.ZodString;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -341,6 +363,22 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     }>>;
     bwrapPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     socatPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    windows: z.ZodOptional<z.ZodObject<{
+        groupName: z.ZodDefault<z.ZodString>;
+        groupSid: z.ZodOptional<z.ZodString>;
+        wfpSublayerGuid: z.ZodOptional<z.ZodString>;
+        proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+    }, "strip", z.ZodTypeAny, {
+        groupName: string;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    }, {
+        groupName?: string | undefined;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     network: {
         allowedDomains: string[];
@@ -376,6 +414,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     ignoreViolations?: Record<string, string[]> | undefined;
     enableWeakerNestedSandbox?: boolean | undefined;
     enableWeakerNetworkIsolation?: boolean | undefined;
+    allowAppleEvents?: boolean | undefined;
     ripgrep?: {
         command: string;
         args?: string[] | undefined;
@@ -390,6 +429,12 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     } | undefined;
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
+    windows?: {
+        groupName: string;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    } | undefined;
 }, {
     network: {
         allowedDomains: string[];
@@ -425,6 +470,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     ignoreViolations?: Record<string, string[]> | undefined;
     enableWeakerNestedSandbox?: boolean | undefined;
     enableWeakerNetworkIsolation?: boolean | undefined;
+    allowAppleEvents?: boolean | undefined;
     ripgrep?: {
         command: string;
         args?: string[] | undefined;
@@ -439,6 +485,12 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     } | undefined;
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
+    windows?: {
+        groupName?: string | undefined;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    } | undefined;
 }>;
 export type MitmProxyConfig = z.infer<typeof MitmProxyConfigSchema>;
 export type ParentProxyConfig = z.infer<typeof ParentProxyConfigSchema>;
@@ -447,6 +499,7 @@ export type FilesystemConfig = z.infer<typeof FilesystemConfigSchema>;
 export type IgnoreViolationsConfig = z.infer<typeof IgnoreViolationsConfigSchema>;
 export type RipgrepConfig = z.infer<typeof RipgrepConfigSchema>;
 export type SeccompConfig = z.infer<typeof SeccompConfigSchema>;
+export type WindowsConfig = z.infer<typeof WindowsConfigSchema>;
 export type SandboxRuntimeConfig = z.infer<typeof SandboxRuntimeConfigSchema>;
 export {};
 //# sourceMappingURL=sandbox-config.d.ts.map

package/dist/sandbox/sandbox-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAgEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4G9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+DrC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAgEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4G9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAsC9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6ErC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}

package/dist/sandbox/sandbox-config.js

@@ -215,6 +215,42 @@ export const RipgrepConfigSchema = z.object({
         .optional()
         .describe('Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])'),
 });
+/**
+ * Windows-specific configuration schema. See
+ * `windows-sandbox-utils.ts` for the install flow these settings
+ * must agree with.
+ */
+export const WindowsConfigSchema = z.object({
+    groupName: z
+        .string()
+        .min(1)
+        .default('sandbox-runtime-net')
+        .describe('Discriminator group name. Must match the group created at install ' +
+        'time. Ignored if groupSid is set.'),
+    groupSid: z
+        .string()
+        .regex(/^S-1-/, 'must be an S-1-… SID string')
+        .optional()
+        .describe('Discriminator group SID. Overrides groupName lookup — use for ' +
+        'domain groups or where name resolution is unreliable.'),
+    wfpSublayerGuid: z
+        .string()
+        .uuid()
+        .optional()
+        .describe('WFP sublayer GUID under which the filters were installed. Omit to ' +
+        'use the srt-win compile-time default. Set this when filters were ' +
+        'installed by enterprise tooling under a custom sublayer.'),
+    proxyPortRange: z
+        .tuple([z.number().int().min(1), z.number().int().max(65535)])
+        .refine(([lo, hi]) => lo <= hi && hi - lo <= 64, {
+        message: 'low must be ≤ high and range width ≤ 64',
+    })
+        .optional()
+        .describe('Inclusive [low, high] port range the JS http/socks proxies bind ' +
+        'inside. MUST match the range passed to `srt-win wfp install ' +
+        '--proxy-port-range` (default 60080–60089) — the WFP loopback ' +
+        'permit only covers ports in that range.'),
+});
 /**
  * Seccomp configuration schema (Linux only)
  */
@@ -248,6 +284,15 @@ export const SandboxRuntimeConfigSchema = z.object({
         'This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates ' +
         'when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data ' +
         'exfiltration vector through the trustd service. Only enable if you need Go TLS verification.'),
+    allowAppleEvents: z
+        .boolean()
+        .optional()
+        .describe('Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). ' +
+        'Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. ' +
+        'This removes code-execution isolation: sandboxed commands can launch other applications ' +
+        'unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or ' +
+        'network restrictions), and can script running apps subject to TCC automation consent. ' +
+        'Default: false.'),
     ripgrep: RipgrepConfigSchema.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),
     mandatoryDenySearchDepth: z
         .number()
@@ -278,5 +323,6 @@ export const SandboxRuntimeConfigSchema = z.object({
         .optional()
         .describe('Linux only: absolute path to the socat binary. ' +
         'When set, this path is used directly instead of resolving "socat" via PATH.'),
+    windows: WindowsConfigSchema.optional().describe('Windows-specific settings (group, WFP sublayer, proxy port range).'),
 });
 //# sourceMappingURL=sandbox-config.js.map

package/dist/sandbox/sandbox-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;CACJ,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,qBAAqB,CAAC;SAC9B,QAAQ,CACP,oEAAoE;QAClE,mCAAmC,CACtC;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC7C,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,uDAAuD,CAC1D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,yCAAyC,CAC5C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,oEAAoE,CACrE;CACF,CAAC,CAAA"}

package/dist/sandbox/sandbox-manager.d.ts

@@ -28,6 +28,10 @@ export interface ISandboxManager {
     getLinuxSocksSocketPath(): string | undefined;
     waitForNetworkInitialization(): Promise<boolean>;
     wrapWithSandbox(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<string>;
+    wrapWithSandboxArgv(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<{
+        argv: string[];
+        env: NodeJS.ProcessEnv;
+    }>;
     getSandboxViolationStore(): SandboxViolationStore;
     annotateStderrWithSandboxFailures(command: string, stderr: string): string;
     getLinuxGlobPatternWarnings(): string[];

package/dist/sandbox/sandbox-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAwgCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA2BnB,CAAA"}
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAmBjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA8rCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA4BnB,CAAA"}

package/dist/sandbox/sandbox-manager.js

@@ -7,6 +7,7 @@ import { getPlatform, getWslVersion } from '../utils/platform.js';
 import * as fs from 'fs';
 import { wrapCommandWithSandboxLinux, initializeLinuxNetworkBridge, checkLinuxDependencies, cleanupBwrapMountPoints, } from './linux-sandbox-utils.js';
 import { wrapCommandWithSandboxMacOS, startMacOSSandboxLogMonitor, } from './macos-sandbox-utils.js';
+import { checkWindowsDependencies, wrapCommandWithSandboxWindows, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
 import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, ensureSandboxTmpdir, } from './sandbox-utils.js';
 import { SandboxViolationStore } from './sandbox-violation-store.js';
 import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, stripBrackets, } from './parent-proxy.js';
@@ -135,7 +136,53 @@ function getMitmSocketPath(host) {
     }
     return undefined;
 }
-async function startHttpProxyServer(sandboxAskCallback) {
+/**
+ * Bind `server.listen()` to the first free port in `[lo, hi]`,
+ * skipping `EADDRINUSE`. With `range` undefined, binds to ephemeral
+ * port 0 (the previous behaviour).
+ *
+ * Used on Windows: the WFP loopback permit only covers a fixed port
+ * range (default 60080–60089), so the JS proxies must bind inside it
+ * for the sandboxed child to reach them. On other platforms the
+ * sandbox layer (seatbelt rule, namespace+socat) targets whatever
+ * port we landed on, so ephemeral is fine.
+ */
+function listenInRange(server, doListen, range, exclude) {
+    return new Promise((resolve, reject) => {
+        const [lo, hi] = range ?? [0, 0];
+        let port = lo;
+        const tryNext = () => {
+            while (exclude.has(port) && port <= hi)
+                port++;
+            if (port > hi) {
+                reject(new Error(`No free port in range ${lo}-${hi} (excluding ${[...exclude].join(',')})`));
+                return;
+            }
+            const onListening = () => {
+                server.removeListener('error', onError);
+                resolve();
+            };
+            const onError = (err) => {
+                // The paired 'listening' once-listener never fired; drop it
+                // so retries don't accumulate stale listeners.
+                server.removeListener('listening', onListening);
+                if (range &&
+                    err?.code === 'EADDRINUSE' &&
+                    port < hi) {
+                    port++;
+                    tryNext();
+                    return;
+                }
+                reject(err ?? new Error('listen error'));
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            doListen(range ? port : 0);
+        };
+        tryNext();
+    });
+}
+async function startHttpProxyServer(sandboxAskCallback, portRange, excludePorts) {
     httpProxyServer = createHttpProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         getMitmSocketPath,
@@ -143,46 +190,46 @@ async function startHttpProxyServer(sandboxAskCallback) {
         filterRequest: config?.network.filterRequest,
         parentProxy,
     });
-    return new Promise((resolve, reject) => {
-        if (!httpProxyServer) {
-            reject(new Error('HTTP proxy server undefined before listen'));
-            return;
-        }
-        const server = httpProxyServer;
-        server.once('error', reject);
-        server.once('listening', () => {
-            const address = server.address();
-            if (address && typeof address === 'object') {
-                server.unref();
-                logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
-                resolve(address.port);
-            }
-            else {
-                reject(new Error('Failed to get proxy server address'));
-            }
-        });
-        server.listen(0, '127.0.0.1');
-    });
+    const server = httpProxyServer;
+    await listenInRange(server, p => server.listen(p, '127.0.0.1'), portRange, excludePorts);
+    const address = server.address();
+    if (!address || typeof address !== 'object') {
+        throw new Error('Failed to get HTTP proxy server address');
+    }
+    server.unref();
+    logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
+    return address.port;
 }
-async function startSocksProxyServer(sandboxAskCallback) {
+async function startSocksProxyServer(sandboxAskCallback, portRange, excludePorts) {
     socksProxyServer = createSocksProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         parentProxy,
     });
-    return new Promise((resolve, reject) => {
-        if (!socksProxyServer) {
-            // This is mostly just for the typechecker
-            reject(new Error('SOCKS proxy server undefined before listen'));
-            return;
+    const wrapper = socksProxyServer;
+    // SocksProxyWrapper.listen() resolves with the bound port; we
+    // adapt it to the listenInRange shape by retrying on EADDRINUSE
+    // here directly rather than via the once('error') path.
+    if (!portRange) {
+        const port = await wrapper.listen(0, '127.0.0.1');
+        wrapper.unref();
+        return port;
+    }
+    let lastErr;
+    for (let p = portRange[0]; p <= portRange[1]; p++) {
+        if (excludePorts.has(p))
+            continue;
+        try {
+            const port = await wrapper.listen(p, '127.0.0.1');
+            wrapper.unref();
+            return port;
         }
-        socksProxyServer
-            .listen(0, '127.0.0.1')
-            .then((port) => {
-            socksProxyServer?.unref();
-            resolve(port);
-        })
-            .catch(reject);
-    });
+        catch (err) {
+            lastErr = err;
+            if (err?.code !== 'EADDRINUSE')
+                throw err;
+        }
+    }
+    throw new Error(`No free SOCKS port in range ${portRange[0]}-${portRange[1]}: ${lastErr?.message ?? 'all in use'}`);
 }
 // ============================================================================
 // Public Module Functions (will be exported via namespace)
@@ -229,6 +276,13 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
     // Initialize network infrastructure
     initializationPromise = (async () => {
         try {
+            // On Windows the WFP loopback permit covers a fixed port
+            // range, so the proxies must bind inside it. Other platforms
+            // bake the actual ephemeral port into the sandbox profile, so
+            // they keep using port 0.
+            const portRange = getPlatform() === 'windows'
+                ? (config.windows?.proxyPortRange ?? DEFAULT_WINDOWS_PROXY_PORT_RANGE)
+                : undefined;
             // Conditionally start proxy servers based on config
             let httpProxyPort;
             if (config.network.httpProxyPort !== undefined) {
@@ -238,7 +292,7 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
             }
             else {
                 // Start local HTTP proxy
-                httpProxyPort = await startHttpProxyServer(sandboxAskCallback);
+                httpProxyPort = await startHttpProxyServer(sandboxAskCallback, portRange, new Set());
             }
             let socksProxyPort;
             if (config.network.socksProxyPort !== undefined) {
@@ -247,8 +301,9 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
                 logForDebugging(`Using external SOCKS proxy on port ${socksProxyPort}`);
             }
             else {
-                // Start local SOCKS proxy
-                socksProxyPort = await startSocksProxyServer(sandboxAskCallback);
+                // Start local SOCKS proxy. Skip the port the HTTP proxy
+                // already took.
+                socksProxyPort = await startSocksProxyServer(sandboxAskCallback, portRange, new Set([httpProxyPort]));
             }
             // Initialize platform-specific infrastructure
             let linuxBridge;
@@ -284,7 +339,17 @@ function isSupportedPlatform() {
         // WSL1 doesn't support bubblewrap
         return getWslVersion() !== '1';
     }
-    return platform === 'macos';
+    return platform === 'macos' || platform === 'windows';
+}
+/**
+ * Resolve the Windows group reference from config. Used by both the
+ * dependency check and `wrapWithSandbox` so they agree.
+ */
+function getWindowsGroupRef() {
+    return {
+        groupName: config?.windows?.groupName ?? DEFAULT_WINDOWS_GROUP_NAME,
+        groupSid: config?.windows?.groupSid,
+    };
 }
 function isSandboxingEnabled() {
     // Sandboxing is enabled if config has been set (via initialize())
@@ -318,6 +383,11 @@ function checkDependencies(ripgrepConfig) {
         errors.push(...linuxDeps.errors);
         warnings.push(...linuxDeps.warnings);
     }
+    else if (platform === 'windows') {
+        const winDeps = checkWindowsDependencies(getWindowsGroupRef(), config?.windows?.wfpSublayerGuid);
+        errors.push(...winDeps.errors);
+        warnings.push(...winDeps.warnings);
+    }
     return { errors, warnings };
 }
 function getFsReadConfig() {
@@ -418,6 +488,9 @@ function getEnableWeakerNestedSandbox() {
 function getEnableWeakerNetworkIsolation() {
     return config?.enableWeakerNetworkIsolation;
 }
+function getAllowAppleEvents() {
+    return config?.allowAppleEvents;
+}
 function getRipgrepConfig() {
     return config?.ripgrep ?? { command: 'rg' };
 }
@@ -560,6 +633,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 allowBrowserProcess,
                 allowGitConfig: getAllowGitConfig(),
                 enableWeakerNetworkIsolation: getEnableWeakerNetworkIsolation(),
+                allowAppleEvents: getAllowAppleEvents(),
                 binShell,
             });
         case 'linux':
@@ -593,11 +667,54 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 socatPath: config?.socatPath,
                 abortSignal,
             });
+        case 'windows':
+            // Windows wraps to an argv array, not a shell string. Forcing
+            // callers through wrapWithSandboxArgv() means they spawn with
+            // {shell:false}, which is the security boundary that keeps the
+            // user's command bytes off the HOST shell.
+            throw new Error('wrapWithSandbox() returns a shell string and is not supported ' +
+                'on Windows. Use SandboxManager.wrapWithSandboxArgv() and ' +
+                'spawn the result with {shell: false}.');
         default:
             // Unsupported platform - this should not happen since isSandboxingEnabled() checks platform support
             throw new Error(`Sandbox configuration is not supported on platform: ${platform}`);
     }
 }
+/**
+ * Wrap `command` for the sandbox and return a spawn descriptor:
+ * `{ argv, env }`, suitable for
+ * `spawn(argv[0], argv.slice(1), {shell: false, env})`.
+ *
+ * On Windows this is the ONLY supported wrap method (see
+ * {@link wrapWithSandbox}); `env` carries the full proxy set that the
+ * sandboxed child inherits (`srt-win exec` forwards its environment
+ * verbatim — see {@link wrapCommandWithSandboxWindows}). On
+ * macOS/Linux `argv` is `[binShell, '-c', <wrapWithSandbox result>]`
+ * (proxy env is baked into that command) and `env` is the unchanged
+ * `process.env`, so callers can spawn uniformly across platforms.
+ */
+async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal) {
+    const platform = getPlatform();
+    if (platform === 'windows') {
+        const hasNetworkConfig = customConfig?.network?.allowedDomains !== undefined ||
+            config?.network?.allowedDomains !== undefined;
+        if (hasNetworkConfig) {
+            await waitForNetworkInitialization();
+        }
+        return wrapCommandWithSandboxWindows({
+            command,
+            group: getWindowsGroupRef(),
+            httpProxyPort: hasNetworkConfig ? getProxyPort() : undefined,
+            socksProxyPort: hasNetworkConfig ? getSocksProxyPort() : undefined,
+            binShell,
+        });
+    }
+    // macOS/Linux: delegate to the existing string wrapper, then put
+    // the result behind `<shell> -c` so the caller's argv-spawn works.
+    const wrapped = await wrapWithSandbox(command, binShell, customConfig, abortSignal);
+    const shell = binShell ?? '/bin/bash';
+    return { argv: [shell, '-c', wrapped], env: process.env };
+}
 /**
  * Get the current sandbox configuration
  * @returns The current configuration, or undefined if not initialized
@@ -606,7 +723,21 @@ function getConfig() {
     return config;
 }
 /**
- * Update the sandbox configuration
+ * Update the sandbox configuration in place.
+ *
+ * **Network/allowlist changes are a live swap**: the running
+ * http/socks proxies read `config.network.allowedDomains` /
+ * `deniedDomains` per-request (via `filterNetworkRequest`), so
+ * reassigning `config` here takes effect on the next connection
+ * with no proxy rebind and no port change — on every platform,
+ * including Windows. This is what lets a host enable/deny domains
+ * for already-running sandboxed children.
+ *
+ * Filesystem changes (denyRead/denyWrite) are NOT applied live:
+ * macOS bakes them into the seatbelt profile at wrap time, and
+ * Windows will need an explicit re-stamp. To change FS
+ * restrictions, reset() then initialize() with the new config.
+ *
  * @param newConfig - The new configuration to use
  */
 function updateConfig(newConfig) {
@@ -886,6 +1017,7 @@ export const SandboxManager = {
     getLinuxSocksSocketPath,
     waitForNetworkInitialization,
     wrapWithSandbox,
+    wrapWithSandboxArgv,
     cleanupAfterCommand,
     reset,
     getMitmCA: () => mitmCA,