@sysid/sandbox-runtime-improved 0.0.52-sysid.1 → 0.0.55-sysid.1

package/dist/sandbox/sandbox-config.js

@@ -95,8 +95,12 @@ export const NetworkConfigSchema = z.object({
         .array(domainPatternSchema)
         .describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org"])'),
     deniedDomains: z
-        .array(domainPatternSchema)
-        .describe('List of denied domains'),
+        .array(z.union([z.literal('*'), domainPatternSchema]))
+        .describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all).'),
+    strictAllowlist: z
+        .boolean()
+        .optional()
+        .describe('If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint.'),
     allowUnixSockets: z
         .array(z.string())
         .optional()
@@ -215,6 +219,42 @@ export const RipgrepConfigSchema = z.object({
         .optional()
         .describe('Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])'),
 });
+/**
+ * Windows-specific configuration schema. See
+ * `windows-sandbox-utils.ts` for the install flow these settings
+ * must agree with.
+ */
+export const WindowsConfigSchema = z.object({
+    groupName: z
+        .string()
+        .min(1)
+        .default('sandbox-runtime-net')
+        .describe('Discriminator group name. Must match the group created at install ' +
+        'time. Ignored if groupSid is set.'),
+    groupSid: z
+        .string()
+        .regex(/^S-1-/, 'must be an S-1-… SID string')
+        .optional()
+        .describe('Discriminator group SID. Overrides groupName lookup — use for ' +
+        'domain groups or where name resolution is unreliable.'),
+    wfpSublayerGuid: z
+        .string()
+        .uuid()
+        .optional()
+        .describe('WFP sublayer GUID under which the filters were installed. Omit to ' +
+        'use the srt-win compile-time default. Set this when filters were ' +
+        'installed by enterprise tooling under a custom sublayer.'),
+    proxyPortRange: z
+        .tuple([z.number().int().min(1), z.number().int().max(65535)])
+        .refine(([lo, hi]) => lo <= hi && hi - lo <= 64, {
+        message: 'low must be ≤ high and range width ≤ 64',
+    })
+        .optional()
+        .describe('Inclusive [low, high] port range the JS http/socks proxies bind ' +
+        'inside. MUST match the range passed to `srt-win wfp install ' +
+        '--proxy-port-range` (default 60080–60089) — the WFP loopback ' +
+        'permit only covers ports in that range.'),
+});
 /**
  * Seccomp configuration schema (Linux only)
  */
@@ -248,6 +288,15 @@ export const SandboxRuntimeConfigSchema = z.object({
         'This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates ' +
         'when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data ' +
         'exfiltration vector through the trustd service. Only enable if you need Go TLS verification.'),
+    allowAppleEvents: z
+        .boolean()
+        .optional()
+        .describe('Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). ' +
+        'Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. ' +
+        'This removes code-execution isolation: sandboxed commands can launch other applications ' +
+        'unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or ' +
+        'network restrictions), and can script running apps subject to TCC automation consent. ' +
+        'Default: false.'),
     ripgrep: RipgrepConfigSchema.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),
     mandatoryDenySearchDepth: z
         .number()
@@ -278,5 +327,6 @@ export const SandboxRuntimeConfigSchema = z.object({
         .optional()
         .describe('Linux only: absolute path to the socat binary. ' +
         'When set, this path is used directly instead of resolving "socat" via PATH.'),
+    windows: WindowsConfigSchema.optional().describe('Windows-specific settings (group, WFP sublayer, proxy port range).'),
 });
 //# sourceMappingURL=sandbox-config.js.map

package/dist/sandbox/sandbox-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;CACJ,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;SACrD,QAAQ,CACP,wFAAwF,CACzF;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yKAAyK,CAC1K;IACH,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,qBAAqB,CAAC;SAC9B,QAAQ,CACP,oEAAoE;QAClE,mCAAmC,CACtC;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC7C,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,uDAAuD,CAC1D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,yCAAyC,CAC5C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,oEAAoE,CACrE;CACF,CAAC,CAAA"}

package/dist/sandbox/sandbox-manager.d.ts

@@ -23,11 +23,16 @@ export interface ISandboxManager {
     getIgnoreViolations(): Record<string, string[]> | undefined;
     getEnableWeakerNestedSandbox(): boolean | undefined;
     getProxyPort(): number | undefined;
+    getProxyAuthToken(): string | undefined;
     getSocksProxyPort(): number | undefined;
     getLinuxHttpSocketPath(): string | undefined;
     getLinuxSocksSocketPath(): string | undefined;
     waitForNetworkInitialization(): Promise<boolean>;
     wrapWithSandbox(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<string>;
+    wrapWithSandboxArgv(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<{
+        argv: string[];
+        env: NodeJS.ProcessEnv;
+    }>;
     getSandboxViolationStore(): SandboxViolationStore;
     annotateStderrWithSandboxFailures(command: string, stderr: string): string;
     getLinuxGlobPatternWarnings(): string[];

package/dist/sandbox/sandbox-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAwgCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA2BnB,CAAA"}
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAMvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAmBjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA4tCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA6BnB,CAAA"}

package/dist/sandbox/sandbox-manager.js

@@ -5,8 +5,10 @@ import { logForDebugging } from '../utils/debug.js';
 import { whichSync } from '../utils/which.js';
 import { getPlatform, getWslVersion } from '../utils/platform.js';
 import * as fs from 'fs';
+import { randomBytes } from 'node:crypto';
 import { wrapCommandWithSandboxLinux, initializeLinuxNetworkBridge, checkLinuxDependencies, cleanupBwrapMountPoints, } from './linux-sandbox-utils.js';
 import { wrapCommandWithSandboxMacOS, startMacOSSandboxLogMonitor, } from './macos-sandbox-utils.js';
+import { checkWindowsDependencies, wrapCommandWithSandboxWindows, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
 import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, ensureSandboxTmpdir, } from './sandbox-utils.js';
 import { SandboxViolationStore } from './sandbox-violation-store.js';
 import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, stripBrackets, } from './parent-proxy.js';
@@ -24,6 +26,10 @@ let cleanupRegistered = false;
 let logMonitorShutdown;
 let parentProxy;
 let mitmCA;
+// Per-session proxy auth token. Generated at proxy start, exported only into
+// the sandbox child env, checked on every CONNECT/request — so a host process
+// dialing 127.0.0.1:<proxyPort> can't reach the filter callback.
+let proxyAuthToken;
 const sandboxViolationStore = new SandboxViolationStore();
 // ============================================================================
 // Private Helper Functions (not exported)
@@ -44,6 +50,10 @@ function registerCleanup() {
 }
 function matchesDomainPattern(hostname, pattern) {
     const h = hostname.toLowerCase();
+    // Bare '*' is deny-all when it appears in deniedDomains. The schema only
+    // accepts it there (allowedDomains still rejects it as too broad).
+    if (pattern === '*')
+        return true;
     // Support wildcard patterns like *.example.com. Never apply wildcard
     // suffix matching to IP literals — an IPv6 zone-ID payload like
     // `::ffff:1.2.3.4%x.allowed.com` would otherwise pass .endsWith() while
@@ -93,8 +103,9 @@ async function filterNetworkRequest(port, host, sandboxAskCallback) {
             return true;
         }
     }
-    // No matching rules - ask user or deny
-    if (!sandboxAskCallback) {
+    // No matching rules - ask user or deny. strictAllowlist makes the
+    // allowlist deterministic enforcement: never fall through to the callback.
+    if (!sandboxAskCallback || config.network.strictAllowlist) {
         logForDebugging(`No matching config rule, denying: ${host}:${port}`);
         return false;
     }
@@ -135,54 +146,102 @@ function getMitmSocketPath(host) {
     }
     return undefined;
 }
-async function startHttpProxyServer(sandboxAskCallback) {
+/**
+ * Bind `server.listen()` to the first free port in `[lo, hi]`,
+ * skipping `EADDRINUSE`. With `range` undefined, binds to ephemeral
+ * port 0 (the previous behaviour).
+ *
+ * Used on Windows: the WFP loopback permit only covers a fixed port
+ * range (default 60080–60089), so the JS proxies must bind inside it
+ * for the sandboxed child to reach them. On other platforms the
+ * sandbox layer (seatbelt rule, namespace+socat) targets whatever
+ * port we landed on, so ephemeral is fine.
+ */
+function listenInRange(server, doListen, range, exclude) {
+    return new Promise((resolve, reject) => {
+        const [lo, hi] = range ?? [0, 0];
+        let port = lo;
+        const tryNext = () => {
+            while (exclude.has(port) && port <= hi)
+                port++;
+            if (port > hi) {
+                reject(new Error(`No free port in range ${lo}-${hi} (excluding ${[...exclude].join(',')})`));
+                return;
+            }
+            const onListening = () => {
+                server.removeListener('error', onError);
+                resolve();
+            };
+            const onError = (err) => {
+                // The paired 'listening' once-listener never fired; drop it
+                // so retries don't accumulate stale listeners.
+                server.removeListener('listening', onListening);
+                if (range &&
+                    err?.code === 'EADDRINUSE' &&
+                    port < hi) {
+                    port++;
+                    tryNext();
+                    return;
+                }
+                reject(err ?? new Error('listen error'));
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            doListen(range ? port : 0);
+        };
+        tryNext();
+    });
+}
+async function startHttpProxyServer(sandboxAskCallback, portRange, excludePorts) {
     httpProxyServer = createHttpProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         getMitmSocketPath,
         mitmCA,
         filterRequest: config?.network.filterRequest,
         parentProxy,
+        proxyAuthToken,
     });
-    return new Promise((resolve, reject) => {
-        if (!httpProxyServer) {
-            reject(new Error('HTTP proxy server undefined before listen'));
-            return;
-        }
-        const server = httpProxyServer;
-        server.once('error', reject);
-        server.once('listening', () => {
-            const address = server.address();
-            if (address && typeof address === 'object') {
-                server.unref();
-                logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
-                resolve(address.port);
-            }
-            else {
-                reject(new Error('Failed to get proxy server address'));
-            }
-        });
-        server.listen(0, '127.0.0.1');
-    });
+    const server = httpProxyServer;
+    await listenInRange(server, p => server.listen(p, '127.0.0.1'), portRange, excludePorts);
+    const address = server.address();
+    if (!address || typeof address !== 'object') {
+        throw new Error('Failed to get HTTP proxy server address');
+    }
+    server.unref();
+    logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
+    return address.port;
 }
-async function startSocksProxyServer(sandboxAskCallback) {
+async function startSocksProxyServer(sandboxAskCallback, portRange, excludePorts) {
     socksProxyServer = createSocksProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         parentProxy,
+        proxyAuthToken,
     });
-    return new Promise((resolve, reject) => {
-        if (!socksProxyServer) {
-            // This is mostly just for the typechecker
-            reject(new Error('SOCKS proxy server undefined before listen'));
-            return;
+    const wrapper = socksProxyServer;
+    // SocksProxyWrapper.listen() resolves with the bound port; we
+    // adapt it to the listenInRange shape by retrying on EADDRINUSE
+    // here directly rather than via the once('error') path.
+    if (!portRange) {
+        const port = await wrapper.listen(0, '127.0.0.1');
+        wrapper.unref();
+        return port;
+    }
+    let lastErr;
+    for (let p = portRange[0]; p <= portRange[1]; p++) {
+        if (excludePorts.has(p))
+            continue;
+        try {
+            const port = await wrapper.listen(p, '127.0.0.1');
+            wrapper.unref();
+            return port;
         }
-        socksProxyServer
-            .listen(0, '127.0.0.1')
-            .then((port) => {
-            socksProxyServer?.unref();
-            resolve(port);
-        })
-            .catch(reject);
-    });
+        catch (err) {
+            lastErr = err;
+            if (err?.code !== 'EADDRINUSE')
+                throw err;
+        }
+    }
+    throw new Error(`No free SOCKS port in range ${portRange[0]}-${portRange[1]}: ${lastErr?.message ?? 'all in use'}`);
 }
 // ============================================================================
 // Public Module Functions (will be exported via namespace)
@@ -229,7 +288,20 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
     // Initialize network infrastructure
     initializationPromise = (async () => {
         try {
-            // Conditionally start proxy servers based on config
+            // On Windows the WFP loopback permit covers a fixed port
+            // range, so the proxies must bind inside it. Other platforms
+            // bake the actual ephemeral port into the sandbox profile, so
+            // they keep using port 0.
+            const portRange = getPlatform() === 'windows'
+                ? (config.windows?.proxyPortRange ?? DEFAULT_WINDOWS_PROXY_PORT_RANGE)
+                : undefined;
+            // The auth token is only set when this process owns the proxy; an
+            // external proxy (config.network.httpProxyPort) handles its own auth,
+            // and embedding our token in its URL would be wrong.
+            proxyAuthToken =
+                config.network.httpProxyPort !== undefined
+                    ? undefined
+                    : randomBytes(16).toString('hex');
             let httpProxyPort;
             if (config.network.httpProxyPort !== undefined) {
                 // Use external HTTP proxy (don't start a server)
@@ -238,7 +310,7 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
             }
             else {
                 // Start local HTTP proxy
-                httpProxyPort = await startHttpProxyServer(sandboxAskCallback);
+                httpProxyPort = await startHttpProxyServer(sandboxAskCallback, portRange, new Set());
             }
             let socksProxyPort;
             if (config.network.socksProxyPort !== undefined) {
@@ -247,8 +319,9 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
                 logForDebugging(`Using external SOCKS proxy on port ${socksProxyPort}`);
             }
             else {
-                // Start local SOCKS proxy
-                socksProxyPort = await startSocksProxyServer(sandboxAskCallback);
+                // Start local SOCKS proxy. Skip the port the HTTP proxy
+                // already took.
+                socksProxyPort = await startSocksProxyServer(sandboxAskCallback, portRange, new Set([httpProxyPort]));
             }
             // Initialize platform-specific infrastructure
             let linuxBridge;
@@ -284,7 +357,17 @@ function isSupportedPlatform() {
         // WSL1 doesn't support bubblewrap
         return getWslVersion() !== '1';
     }
-    return platform === 'macos';
+    return platform === 'macos' || platform === 'windows';
+}
+/**
+ * Resolve the Windows group reference from config. Used by both the
+ * dependency check and `wrapWithSandbox` so they agree.
+ */
+function getWindowsGroupRef() {
+    return {
+        groupName: config?.windows?.groupName ?? DEFAULT_WINDOWS_GROUP_NAME,
+        groupSid: config?.windows?.groupSid,
+    };
 }
 function isSandboxingEnabled() {
     // Sandboxing is enabled if config has been set (via initialize())
@@ -318,6 +401,11 @@ function checkDependencies(ripgrepConfig) {
         errors.push(...linuxDeps.errors);
         warnings.push(...linuxDeps.warnings);
     }
+    else if (platform === 'windows') {
+        const winDeps = checkWindowsDependencies(getWindowsGroupRef(), config?.windows?.wfpSublayerGuid);
+        errors.push(...winDeps.errors);
+        warnings.push(...winDeps.warnings);
+    }
     return { errors, warnings };
 }
 function getFsReadConfig() {
@@ -390,10 +478,16 @@ function getNetworkRestrictionConfig() {
     if (!config) {
         return {};
     }
+    // Preserve an explicitly-empty allowlist: consumers need to distinguish
+    // "no network restriction configured" (absent) from "allowlist configured
+    // with zero entries" (block-all / ask-only). Stripping the empty array
+    // made a host app's restriction-status UI report an airgapped config as
+    // unrestricted. deniedHosts keeps the strip — an empty denylist and an
+    // absent one are semantically identical.
     const allowedHosts = config.network.allowedDomains;
     const deniedHosts = config.network.deniedDomains;
     return {
-        ...(allowedHosts.length > 0 && { allowedHosts }),
+        allowedHosts,
         ...(deniedHosts.length > 0 && { deniedHosts }),
     };
 }
@@ -418,6 +512,9 @@ function getEnableWeakerNestedSandbox() {
 function getEnableWeakerNetworkIsolation() {
     return config?.enableWeakerNetworkIsolation;
 }
+function getAllowAppleEvents() {
+    return config?.allowAppleEvents;
+}
 function getRipgrepConfig() {
     return config?.ripgrep ?? { command: 'rg' };
 }
@@ -430,6 +527,9 @@ function getAllowGitConfig() {
 function getSeccompConfig() {
     return config?.seccomp;
 }
+function getProxyAuthToken() {
+    return proxyAuthToken;
+}
 function getProxyPort() {
     return managerContext?.httpProxyPort;
 }
@@ -548,6 +648,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 // Only pass proxy ports if proxy is running (when there are domains to filter)
                 httpProxyPort: needsNetworkProxy ? getProxyPort() : undefined,
                 socksProxyPort: needsNetworkProxy ? getSocksProxyPort() : undefined,
+                proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
                 caCertPath: mitmCA?.certPath,
                 readConfig,
                 writeConfig,
@@ -560,6 +661,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 allowBrowserProcess,
                 allowGitConfig: getAllowGitConfig(),
                 enableWeakerNetworkIsolation: getEnableWeakerNetworkIsolation(),
+                allowAppleEvents: getAllowAppleEvents(),
                 binShell,
             });
         case 'linux':
@@ -579,6 +681,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 socksProxyPort: needsNetworkProxy
                     ? managerContext?.socksProxyPort
                     : undefined,
+                proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
                 caCertPath: mitmCA?.certPath,
                 readConfig,
                 writeConfig,
@@ -593,11 +696,55 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 socatPath: config?.socatPath,
                 abortSignal,
             });
+        case 'windows':
+            // Windows wraps to an argv array, not a shell string. Forcing
+            // callers through wrapWithSandboxArgv() means they spawn with
+            // {shell:false}, which is the security boundary that keeps the
+            // user's command bytes off the HOST shell.
+            throw new Error('wrapWithSandbox() returns a shell string and is not supported ' +
+                'on Windows. Use SandboxManager.wrapWithSandboxArgv() and ' +
+                'spawn the result with {shell: false}.');
         default:
             // Unsupported platform - this should not happen since isSandboxingEnabled() checks platform support
             throw new Error(`Sandbox configuration is not supported on platform: ${platform}`);
     }
 }
+/**
+ * Wrap `command` for the sandbox and return a spawn descriptor:
+ * `{ argv, env }`, suitable for
+ * `spawn(argv[0], argv.slice(1), {shell: false, env})`.
+ *
+ * On Windows this is the ONLY supported wrap method (see
+ * {@link wrapWithSandbox}); `env` carries the full proxy set that the
+ * sandboxed child inherits (`srt-win exec` forwards its environment
+ * verbatim — see {@link wrapCommandWithSandboxWindows}). On
+ * macOS/Linux `argv` is `[binShell, '-c', <wrapWithSandbox result>]`
+ * (proxy env is baked into that command) and `env` is the unchanged
+ * `process.env`, so callers can spawn uniformly across platforms.
+ */
+async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal) {
+    const platform = getPlatform();
+    if (platform === 'windows') {
+        const hasNetworkConfig = customConfig?.network?.allowedDomains !== undefined ||
+            config?.network?.allowedDomains !== undefined;
+        if (hasNetworkConfig) {
+            await waitForNetworkInitialization();
+        }
+        return wrapCommandWithSandboxWindows({
+            command,
+            group: getWindowsGroupRef(),
+            httpProxyPort: hasNetworkConfig ? getProxyPort() : undefined,
+            socksProxyPort: hasNetworkConfig ? getSocksProxyPort() : undefined,
+            proxyAuthToken: hasNetworkConfig ? proxyAuthToken : undefined,
+            binShell,
+        });
+    }
+    // macOS/Linux: delegate to the existing string wrapper, then put
+    // the result behind `<shell> -c` so the caller's argv-spawn works.
+    const wrapped = await wrapWithSandbox(command, binShell, customConfig, abortSignal);
+    const shell = binShell ?? '/bin/bash';
+    return { argv: [shell, '-c', wrapped], env: process.env };
+}
 /**
  * Get the current sandbox configuration
  * @returns The current configuration, or undefined if not initialized
@@ -606,7 +753,21 @@ function getConfig() {
     return config;
 }
 /**
- * Update the sandbox configuration
+ * Update the sandbox configuration in place.
+ *
+ * **Network/allowlist changes are a live swap**: the running
+ * http/socks proxies read `config.network.allowedDomains` /
+ * `deniedDomains` per-request (via `filterNetworkRequest`), so
+ * reassigning `config` here takes effect on the next connection
+ * with no proxy rebind and no port change — on every platform,
+ * including Windows. This is what lets a host enable/deny domains
+ * for already-running sandboxed children.
+ *
+ * Filesystem changes (denyRead/denyWrite) are NOT applied live:
+ * macOS bakes them into the seatbelt profile at wrap time, and
+ * Windows will need an explicit re-stamp. To change FS
+ * restrictions, reset() then initialize() with the new config.
+ *
  * @param newConfig - The new configuration to use
  */
 function updateConfig(newConfig) {
@@ -805,6 +966,7 @@ async function reset() {
     await Promise.all(closePromises);
     // Clear references
     httpProxyServer = undefined;
+    proxyAuthToken = undefined;
     socksProxyServer = undefined;
     managerContext = undefined;
     initializationPromise = undefined;
@@ -881,11 +1043,13 @@ export const SandboxManager = {
     getIgnoreViolations,
     getEnableWeakerNestedSandbox,
     getProxyPort,
+    getProxyAuthToken,
     getSocksProxyPort,
     getLinuxHttpSocketPath,
     getLinuxSocksSocketPath,
     waitForNetworkInitialization,
     wrapWithSandbox,
+    wrapWithSandboxArgv,
     cleanupAfterCommand,
     reset,
     getMitmCA: () => mitmCA,