@sysid/sandbox-runtime-improved 0.0.55-sysid.1 → 0.0.61-sysid.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (118) hide show
  1. package/README.md +43 -2
  2. package/dist/cli.js +8 -0
  3. package/dist/cli.js.map +1 -1
  4. package/dist/index.d.ts +6 -6
  5. package/dist/index.d.ts.map +1 -1
  6. package/dist/index.js +2 -2
  7. package/dist/index.js.map +1 -1
  8. package/dist/sandbox/credential-mask-files.d.ts +72 -0
  9. package/dist/sandbox/credential-mask-files.d.ts.map +1 -0
  10. package/dist/sandbox/credential-mask-files.js +146 -0
  11. package/dist/sandbox/credential-mask-files.js.map +1 -0
  12. package/dist/sandbox/credential-sentinel.d.ts +72 -0
  13. package/dist/sandbox/credential-sentinel.d.ts.map +1 -0
  14. package/dist/sandbox/credential-sentinel.js +130 -0
  15. package/dist/sandbox/credential-sentinel.js.map +1 -0
  16. package/dist/sandbox/domain-pattern.d.ts +36 -0
  17. package/dist/sandbox/domain-pattern.d.ts.map +1 -0
  18. package/dist/sandbox/domain-pattern.js +60 -0
  19. package/dist/sandbox/domain-pattern.js.map +1 -0
  20. package/dist/sandbox/http-proxy.d.ts +32 -1
  21. package/dist/sandbox/http-proxy.d.ts.map +1 -1
  22. package/dist/sandbox/http-proxy.js +10 -2
  23. package/dist/sandbox/http-proxy.js.map +1 -1
  24. package/dist/sandbox/linux-sandbox-utils.d.ts +17 -0
  25. package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -1
  26. package/dist/sandbox/linux-sandbox-utils.js +155 -47
  27. package/dist/sandbox/linux-sandbox-utils.js.map +1 -1
  28. package/dist/sandbox/listen-in-range.d.ts +12 -0
  29. package/dist/sandbox/listen-in-range.d.ts.map +1 -0
  30. package/dist/sandbox/listen-in-range.js +43 -0
  31. package/dist/sandbox/listen-in-range.js.map +1 -0
  32. package/dist/sandbox/macos-sandbox-utils.d.ts +13 -0
  33. package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -1
  34. package/dist/sandbox/macos-sandbox-utils.js +76 -14
  35. package/dist/sandbox/macos-sandbox-utils.js.map +1 -1
  36. package/dist/sandbox/mitm-ca.d.ts +18 -2
  37. package/dist/sandbox/mitm-ca.d.ts.map +1 -1
  38. package/dist/sandbox/mitm-ca.js +49 -9
  39. package/dist/sandbox/mitm-ca.js.map +1 -1
  40. package/dist/sandbox/mitm-leaf.d.ts.map +1 -1
  41. package/dist/sandbox/mitm-leaf.js +24 -6
  42. package/dist/sandbox/mitm-leaf.js.map +1 -1
  43. package/dist/sandbox/mux-proxy.d.ts +59 -0
  44. package/dist/sandbox/mux-proxy.d.ts.map +1 -0
  45. package/dist/sandbox/mux-proxy.js +159 -0
  46. package/dist/sandbox/mux-proxy.js.map +1 -0
  47. package/dist/sandbox/request-filter.d.ts +11 -1
  48. package/dist/sandbox/request-filter.d.ts.map +1 -1
  49. package/dist/sandbox/request-filter.js.map +1 -1
  50. package/dist/sandbox/sandbox-config.d.ts +383 -1
  51. package/dist/sandbox/sandbox-config.d.ts.map +1 -1
  52. package/dist/sandbox/sandbox-config.js +252 -1
  53. package/dist/sandbox/sandbox-config.js.map +1 -1
  54. package/dist/sandbox/sandbox-manager.d.ts +4 -0
  55. package/dist/sandbox/sandbox-manager.d.ts.map +1 -1
  56. package/dist/sandbox/sandbox-manager.js +618 -168
  57. package/dist/sandbox/sandbox-manager.js.map +1 -1
  58. package/dist/sandbox/sandbox-schemas.d.ts +27 -0
  59. package/dist/sandbox/sandbox-schemas.d.ts.map +1 -1
  60. package/dist/sandbox/sandbox-utils.d.ts +42 -6
  61. package/dist/sandbox/sandbox-utils.d.ts.map +1 -1
  62. package/dist/sandbox/sandbox-utils.js +115 -27
  63. package/dist/sandbox/sandbox-utils.js.map +1 -1
  64. package/dist/sandbox/socks-proxy.d.ts +11 -5
  65. package/dist/sandbox/socks-proxy.d.ts.map +1 -1
  66. package/dist/sandbox/socks-proxy.js +13 -81
  67. package/dist/sandbox/socks-proxy.js.map +1 -1
  68. package/dist/sandbox/tls-terminate-proxy.d.ts +2 -2
  69. package/dist/sandbox/tls-terminate-proxy.d.ts.map +1 -1
  70. package/dist/sandbox/tls-terminate-proxy.js +31 -5
  71. package/dist/sandbox/tls-terminate-proxy.js.map +1 -1
  72. package/dist/sandbox/windows-sandbox-utils.d.ts +347 -11
  73. package/dist/sandbox/windows-sandbox-utils.d.ts.map +1 -1
  74. package/dist/sandbox/windows-sandbox-utils.js +437 -45
  75. package/dist/sandbox/windows-sandbox-utils.js.map +1 -1
  76. package/package.json +7 -4
  77. package/vendor/seccomp/build.ts +8 -30
  78. package/vendor/srt-win/build.ts +21 -0
  79. package/dist/vendor/seccomp/Dockerfile.build +0 -6
  80. package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
  81. package/dist/vendor/seccomp/build.ts +0 -91
  82. package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
  83. package/dist/vendor/seccomp-src/apply-seccomp.c +0 -280
  84. package/dist/vendor/seccomp-src/seccomp-unix-block.c +0 -148
  85. package/dist/vendor/srt-win/Cargo.lock +0 -361
  86. package/dist/vendor/srt-win/Cargo.toml +0 -46
  87. package/dist/vendor/srt-win/ci/cleanup.ps1 +0 -49
  88. package/dist/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
  89. package/dist/vendor/srt-win/ci/smoke.ps1 +0 -307
  90. package/dist/vendor/srt-win/src/job.rs +0 -102
  91. package/dist/vendor/srt-win/src/launch.rs +0 -732
  92. package/dist/vendor/srt-win/src/lib.rs +0 -20
  93. package/dist/vendor/srt-win/src/main.rs +0 -669
  94. package/dist/vendor/srt-win/src/self_protect.rs +0 -169
  95. package/dist/vendor/srt-win/src/sid.rs +0 -296
  96. package/dist/vendor/srt-win/src/token.rs +0 -341
  97. package/dist/vendor/srt-win/src/util.rs +0 -42
  98. package/dist/vendor/srt-win/src/wfp.rs +0 -992
  99. package/dist/vendor/srt-win/src/winsta.rs +0 -209
  100. package/dist/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
  101. package/vendor/seccomp-src/apply-seccomp.c +0 -280
  102. package/vendor/seccomp-src/seccomp-unix-block.c +0 -148
  103. package/vendor/srt-win/Cargo.lock +0 -361
  104. package/vendor/srt-win/Cargo.toml +0 -46
  105. package/vendor/srt-win/ci/cleanup.ps1 +0 -49
  106. package/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
  107. package/vendor/srt-win/ci/smoke.ps1 +0 -307
  108. package/vendor/srt-win/src/job.rs +0 -102
  109. package/vendor/srt-win/src/launch.rs +0 -732
  110. package/vendor/srt-win/src/lib.rs +0 -20
  111. package/vendor/srt-win/src/main.rs +0 -669
  112. package/vendor/srt-win/src/self_protect.rs +0 -169
  113. package/vendor/srt-win/src/sid.rs +0 -296
  114. package/vendor/srt-win/src/token.rs +0 -341
  115. package/vendor/srt-win/src/util.rs +0 -42
  116. package/vendor/srt-win/src/wfp.rs +0 -992
  117. package/vendor/srt-win/src/winsta.rs +0 -209
  118. package/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
@@ -1 +1 @@
1
- {"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGzD;;;;;;;;;;;;;;;;GAgBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAkDD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;QACxE,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,aAAa,CACd;KACF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,uEAAuE;QACvE,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAI,IAAc;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;YACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CACzD,CAAA;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAItB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC,EAAE;IAG1E,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GACT,KAAK,KAAK,MAAM;YACd,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAA;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,gDAAgD;IAChD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,SAAS,EACT,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IACvB,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAA;IAC/D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
1
+ {"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,4DAA4D;AAC5D,6CAA6C;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAG3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAiGD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC7C,iEAAiE;IACjE,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IACE,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,QAAQ,EACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;gBAClE,yCAAyC,CAC5C,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACpC,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,4CAA4C;IAC5C,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC/B,KAAK,KAAK,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB;YACE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa;gBACvD,sEAAsE,CACzE,CAAA;IACL,CAAC;AACH,CAAC;AAwGD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,aAAa,GAA2B,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,CACd;IACD,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CACzE,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,2EAA2E;QAC3E,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAChB,IAAc,EACd,KAAc,EACd,SAAS,GAAG,KAAM;IAElB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAaD,SAAS,aAAa,CACpB,IAAc,EACd,IAAqD;IAErD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,0DAA0D;IAC1D,IAAI,IAAmB,CAAA;IACvB,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAI,CAAW,CAAC,OAAO,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;QACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAMtB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QACpD,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,aAAa,CActB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtB,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3D,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB;QAC3C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI;YAC5C,aAAa,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiC;IAEjC,MAAM,CAAC,GAAG,MAAM,IAAI,2BAA2B,EAAE,CAAA;IACjD,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,wDAAwD;IACxD,iEAAiE;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IACxE,eAAe,CACb,wCAAwC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC5E,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,iBAAiB;YACnD,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC1C,CAAA;IACH,CAAC;AACH,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IAC5C,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,wCAAwC;IACxC,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,EAAE,2BAA2B,EAAE;gBACnC,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,sDAAsD,GAAG,EAAE,CAC5D,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7D,IAAI,EAAE,2BAA2B,EAAE;KACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsD,EAAE;IAIxD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AA0DD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC;YAC3C,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAC9C,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB;oBAC/C,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAC/D,CAAA;YACH,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AACjB,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,SAAS,CACjB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,EAC1E,KAAK,EACL,KAAM,CACP,CAAA;IACD,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,4DAA4D;QAC5D,4DAA4D;QAC5D,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,MAAM,GAAG;YACrC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,UAAU,CAAC;YACjE,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC9B,CAAA;IACH,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,SAAS;QACT,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,cAAc;QACd,GAAG,MAAM,EAAE;QACX,QAAQ;KACT,CAAA;IACD,gEAAgE;IAChE,4DAA4D;IAC5D,8DAA8D;IAC9D,2DAA2D;IAC3D,+DAA+D;IAC/D,0DAA0D;IAC1D,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,aAAa,CAA0B,IAAI,EAAE;YACrD,SAAS,EAAE,KAAM;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,eAAe,CACb,0DAA0D;gBACxD,wBAAwB,CAAC,CAAC,MAAM,EAAE,EACpC,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAA;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAe,CAAC,kCAAmC,CAAW,CAAC,OAAO,EAAE,EAAE;YACxE,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAkC;IAC1E,UAAU;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAC1C,CAAC,UAAU,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAC7C,CAAA;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,6DAA6D;IAC7D,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,iEAAiE;IACjE,sDAAsD;IACtD,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,eAAe,CACb,iCAAiC,CAAC,CAAC,UAAU,kBAAkB;YAC7D,sDAAsD;YACtD,2DAA2D;YAC3D,kDAAkD,CACrD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC1C,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IAEvB,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,0CAA0C;IAC1C,8DAA8D;IAC9D,8DAA8D;IAC9D,iEAAiE;IACjE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;IAChE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAC7D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC9B,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,2DAA2D;QAC3D,8BAA8B;QAC9B,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;YAC5B,GAAG,SAAS;SACb,CAAA;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,0DAA0D;YAC1D,8DAA8D;YAC9D,kEAAkE;YAClE,6DAA6D;YAC7D,8DAA8D;YAC9D,+DAA+D;YAC/D,iEAAiE;YACjE,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YACnC,MAAK;QACP,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YAC1D,MAAK;QACP,KAAK,YAAY;YACf,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,EACD,YAAY,EACZ,UAAU,EACV,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;QACP,KAAK,KAAK;YACR,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;IACT,CAAC;IAED,6DAA6D;IAC7D,8DAA8D;IAC9D,6DAA6D;IAC7D,2DAA2D;IAC3D,0DAA0D;IAC1D,2DAA2D;IAC3D,4DAA4D;IAC5D,6DAA6D;IAC7D,2DAA2D;IAC3D,0BAA0B;IAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,IAAI,eAAe,GAAG,KAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAA;QACpE,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,SAAS;YAClD,qCAAqC,KAAK,YAAY;YACtD,4DAA4D;YAC5D,6DAA6D;YAC7D,8DAA8D;YAC9D,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,4DAA4D;IAC5D,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAE1C,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sysid/sandbox-runtime-improved",
3
- "version": "0.0.55-sysid.1",
3
+ "version": "0.0.61-sysid.1",
4
4
  "description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -9,18 +9,19 @@
9
9
  "srti": "dist/cli.js"
10
10
  },
11
11
  "engines": {
12
- "node": ">=18.0.0"
12
+ "node": ">=20.11.0"
13
13
  },
14
14
  "scripts": {
15
15
  "build": "tsc",
16
16
  "build:seccomp": "bun vendor/seccomp/build.ts",
17
+ "build:srt-win": "bun vendor/srt-win/build.ts",
17
18
  "clean": "rm -rf dist",
18
19
  "test": "bun test",
19
20
  "typecheck": "tsc --noEmit",
20
21
  "lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
21
22
  "lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",
22
23
  "format": "prettier --write 'src/**/*.ts' --cache --log-level warn",
23
- "prepublishOnly": "npm run clean && npm run build && cp -r vendor dist/ && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('dist/vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
24
+ "prepublishOnly": "npm run clean && npm run build && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
24
25
  "prepare": "husky"
25
26
  },
26
27
  "dependencies": {
@@ -42,6 +43,7 @@
42
43
  "eslint-plugin-import": "^2.31.0",
43
44
  "eslint-plugin-n": "^17.16.2",
44
45
  "eslint-plugin-prettier": "^5.1.3",
46
+ "fast-check": "^4.8.0",
45
47
  "globals": "^15.12.0",
46
48
  "husky": "^9.1.7",
47
49
  "lint-staged": "^16.2.6",
@@ -51,7 +53,8 @@
51
53
  },
52
54
  "files": [
53
55
  "dist",
54
- "vendor",
56
+ "vendor/seccomp",
57
+ "vendor/srt-win",
55
58
  "README.md",
56
59
  "LICENSE"
57
60
  ],
@@ -1,32 +1,12 @@
1
- import { spawnSync } from 'node:child_process'
2
- import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
3
- import { dirname, join } from 'node:path'
4
- import { fileURLToPath } from 'node:url'
1
+ import { readFileSync, rmSync, writeFileSync } from 'node:fs'
2
+ import { join } from 'node:path'
3
+ import { run, setup } from '../build-common.js'
5
4
 
6
- if (process.platform !== 'linux') {
7
- console.error('seccomp build: Linux only')
8
- process.exit(1)
9
- }
10
-
11
- const HERE = dirname(fileURLToPath(import.meta.url))
12
- const SRC = join(HERE, '..', 'seccomp-src')
13
-
14
- const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
15
- const arch = nodeArchToDir[process.arch]
16
- if (!arch) {
17
- console.error('seccomp build: unsupported arch ' + process.arch)
18
- process.exit(1)
19
- }
20
- const OUT = join(HERE, arch)
21
-
22
- function run(argv: string[]): void {
23
- const [cmd, ...args] = argv
24
- const r = spawnSync(cmd, args, { stdio: 'inherit' })
25
- if (r.status !== 0) {
26
- console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
27
- process.exit(1)
28
- }
29
- }
5
+ const { SRC, OUT } = setup({
6
+ importMetaUrl: import.meta.url,
7
+ requirePlatform: 'linux',
8
+ srcDirName: 'seccomp-src',
9
+ })
30
10
 
31
11
  function toCArray(bytes: Buffer): string {
32
12
  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
@@ -37,8 +17,6 @@ function toCArray(bytes: Buffer): string {
37
17
  return lines.join('\n')
38
18
  }
39
19
 
40
- mkdirSync(OUT, { recursive: true })
41
-
42
20
  const cflags = ['-static', '-O2', '-Wall', '-Wextra']
43
21
 
44
22
  const gen = join(OUT, 'seccomp-unix-block')
@@ -0,0 +1,21 @@
1
+ import { copyFileSync, existsSync } from 'node:fs'
2
+ import { join } from 'node:path'
3
+ import { run, setup } from '../build-common.js'
4
+
5
+ const { SRC, OUT } = setup({
6
+ importMetaUrl: import.meta.url,
7
+ requirePlatform: 'win32',
8
+ srcDirName: 'srt-win-src',
9
+ })
10
+
11
+ run(['cargo', 'build', '--release', '--manifest-path', join(SRC, 'Cargo.toml')])
12
+
13
+ const built = join(SRC, 'target', 'release', 'srt-win.exe')
14
+ if (!existsSync(built)) {
15
+ console.error('srt-win build: expected output not found at ' + built)
16
+ process.exit(1)
17
+ }
18
+
19
+ const dest = join(OUT, 'srt-win.exe')
20
+ copyFileSync(built, dest)
21
+ console.log('built ' + dest)
@@ -1,6 +0,0 @@
1
- FROM ubuntu:24.04
2
- RUN apt-get update && apt-get install -y --no-install-recommends \
3
- gcc libc6-dev libseccomp-dev curl unzip ca-certificates && \
4
- rm -rf /var/lib/apt/lists/*
5
- RUN curl -fsSL https://bun.sh/install | BUN_INSTALL=/usr/local bash
6
- WORKDIR /build
@@ -1,91 +0,0 @@
1
- import { spawnSync } from 'node:child_process'
2
- import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
3
- import { dirname, join } from 'node:path'
4
- import { fileURLToPath } from 'node:url'
5
-
6
- if (process.platform !== 'linux') {
7
- console.error('seccomp build: Linux only')
8
- process.exit(1)
9
- }
10
-
11
- const HERE = dirname(fileURLToPath(import.meta.url))
12
- const SRC = join(HERE, '..', 'seccomp-src')
13
-
14
- const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
15
- const arch = nodeArchToDir[process.arch]
16
- if (!arch) {
17
- console.error('seccomp build: unsupported arch ' + process.arch)
18
- process.exit(1)
19
- }
20
- const OUT = join(HERE, arch)
21
-
22
- function run(argv: string[]): void {
23
- const [cmd, ...args] = argv
24
- const r = spawnSync(cmd, args, { stdio: 'inherit' })
25
- if (r.status !== 0) {
26
- console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
27
- process.exit(1)
28
- }
29
- }
30
-
31
- function toCArray(bytes: Buffer): string {
32
- const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
33
- const lines: string[] = []
34
- for (let i = 0; i < hex.length; i += 8) {
35
- lines.push(' ' + hex.slice(i, i + 8).join(', ') + ',')
36
- }
37
- return lines.join('\n')
38
- }
39
-
40
- mkdirSync(OUT, { recursive: true })
41
-
42
- const cflags = ['-static', '-O2', '-Wall', '-Wextra']
43
-
44
- const gen = join(OUT, 'seccomp-unix-block')
45
- run([
46
- 'gcc',
47
- ...cflags,
48
- '-o',
49
- gen,
50
- join(SRC, 'seccomp-unix-block.c'),
51
- '-lseccomp',
52
- ])
53
-
54
- const bpf: Record<string, Buffer> = {}
55
- for (const target of ['x86_64', 'aarch64']) {
56
- const tmp = join(OUT, target + '.bpf')
57
- run([gen, tmp, target])
58
- bpf[target] = readFileSync(tmp)
59
- rmSync(tmp)
60
- }
61
- rmSync(gen)
62
-
63
- const header = join(OUT, 'unix-block-bpf.h')
64
- writeFileSync(
65
- header,
66
- '#if defined(__x86_64__)\n' +
67
- 'static const unsigned char unix_block_bpf[] = {\n' +
68
- toCArray(bpf.x86_64) +
69
- '\n};\n' +
70
- '#elif defined(__aarch64__)\n' +
71
- 'static const unsigned char unix_block_bpf[] = {\n' +
72
- toCArray(bpf.aarch64) +
73
- '\n};\n' +
74
- '#else\n' +
75
- '#error "unsupported architecture for unix-block BPF filter"\n' +
76
- '#endif\n',
77
- )
78
-
79
- run([
80
- 'gcc',
81
- ...cflags,
82
- '-I',
83
- OUT,
84
- '-o',
85
- join(OUT, 'apply-seccomp'),
86
- join(SRC, 'apply-seccomp.c'),
87
- ])
88
- run(['strip', join(OUT, 'apply-seccomp')])
89
- rmSync(header)
90
-
91
- console.log('built ' + join(OUT, 'apply-seccomp'))
@@ -1,280 +0,0 @@
1
- /*
2
- * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
3
- *
4
- * Usage: apply-seccomp <command> [args...]
5
- *
6
- * This program applies a baked-in seccomp BPF filter, isolates the
7
- * target command in a nested user+PID+mount namespace so it cannot see or
8
- * ptrace any process that lacks the filter, applies the filter with
9
- * prctl(PR_SET_SECCOMP), and execs the command.
10
- *
11
- * Process layout inside the outer bwrap sandbox:
12
- *
13
- * bwrap init (PID 1) <- outer PID ns, no seccomp
14
- * \_ bash / socat ... <- outer PID ns, no seccomp
15
- * \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
16
- * ================================================= PID ns boundary
17
- * \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
18
- * \_ user command <- inner PID 2, seccomp applied
19
- *
20
- * From the user command's point of view /proc contains only its own process
21
- * tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
22
- * so they cannot be ptraced or patched via /proc/N/mem even on systems with
23
- * kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
24
- * so it cannot be ptraced either.
25
- *
26
- * Any failure to set up the nested namespaces aborts with a non-zero exit
27
- * status; we never fall back to running the command without isolation.
28
- *
29
- * Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
30
- */
31
-
32
- #define _GNU_SOURCE
33
- #include <stdio.h>
34
- #include <stdlib.h>
35
- #include <stdarg.h>
36
- #include <string.h>
37
- #include <unistd.h>
38
- #include <fcntl.h>
39
- #include <errno.h>
40
- #include <sched.h>
41
- #include <signal.h>
42
- #include <sys/prctl.h>
43
- #include <sys/wait.h>
44
- #include <sys/mount.h>
45
- #include <linux/seccomp.h>
46
- #include <linux/filter.h>
47
-
48
- #include "unix-block-bpf.h"
49
-
50
- #ifndef PR_SET_NO_NEW_PRIVS
51
- #define PR_SET_NO_NEW_PRIVS 38
52
- #endif
53
-
54
- #ifndef PR_CAP_AMBIENT
55
- #define PR_CAP_AMBIENT 47
56
- #define PR_CAP_AMBIENT_CLEAR_ALL 4
57
- #endif
58
-
59
- #ifndef SECCOMP_MODE_FILTER
60
- #define SECCOMP_MODE_FILTER 2
61
- #endif
62
-
63
- static void die(const char *msg) {
64
- perror(msg);
65
- _exit(1);
66
- }
67
-
68
- static int write_file(const char *path, const char *fmt, ...) {
69
- char buf[256];
70
- va_list ap;
71
- va_start(ap, fmt);
72
- int len = vsnprintf(buf, sizeof(buf), fmt, ap);
73
- va_end(ap);
74
- if (len < 0 || (size_t)len >= sizeof(buf)) {
75
- errno = EOVERFLOW;
76
- return -1;
77
- }
78
-
79
- int fd = open(path, O_WRONLY);
80
- if (fd < 0) {
81
- return -1;
82
- }
83
- ssize_t r = write(fd, buf, (size_t)len);
84
- int saved = errno;
85
- close(fd);
86
- if (r != len) {
87
- errno = (r < 0) ? saved : EIO;
88
- return -1;
89
- }
90
- return 0;
91
- }
92
-
93
- /* PID the current process forwards signals to. Used by both the outer stub
94
- * (forwards to inner init) and the inner init (forwards to the worker).
95
- * PID 1 ignores signals it has no handler for, so the inner init MUST install
96
- * these or SIGTERM from the outside is silently dropped. */
97
- static volatile pid_t forward_target = -1;
98
-
99
- static void forward_signal(int sig) {
100
- if (forward_target > 0) {
101
- kill(forward_target, sig);
102
- }
103
- }
104
-
105
- static void install_forwarders(pid_t target) {
106
- forward_target = target;
107
- struct sigaction sa = { .sa_handler = forward_signal };
108
- sigemptyset(&sa.sa_mask);
109
- sigaction(SIGTERM, &sa, NULL);
110
- sigaction(SIGINT, &sa, NULL);
111
- sigaction(SIGHUP, &sa, NULL);
112
- sigaction(SIGQUIT, &sa, NULL);
113
- sigaction(SIGUSR1, &sa, NULL);
114
- sigaction(SIGUSR2, &sa, NULL);
115
- }
116
-
117
- /*
118
- * Wait for `main_child`, reaping any other children that exit first.
119
- * Returns as soon as `main_child` terminates — the caller then _exit()s,
120
- * which as PID 1 tears down the namespace and SIGKILLs any stragglers.
121
- * Returns an exit(3)-style status: exit code, or 128+signal.
122
- */
123
- static int reap_until(pid_t main_child) {
124
- int status = 0;
125
- for (;;) {
126
- pid_t r = waitpid(-1, &status, 0);
127
- if (r < 0) {
128
- if (errno == EINTR) {
129
- continue;
130
- }
131
- return 1; /* ECHILD without seeing main_child — shouldn't happen. */
132
- }
133
- if (r == main_child) {
134
- if (WIFEXITED(status)) {
135
- return WEXITSTATUS(status);
136
- }
137
- if (WIFSIGNALED(status)) {
138
- return 128 + WTERMSIG(status);
139
- }
140
- return 1;
141
- }
142
- /* Reaped an orphan that died before main_child; keep waiting. */
143
- }
144
- }
145
-
146
- int main(int argc, char *argv[]) {
147
- if (argc < 2) {
148
- fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
149
- return 1;
150
- }
151
-
152
- char **command_argv = &argv[1];
153
-
154
- _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
155
- "BPF filter size must be a multiple of sock_filter");
156
- struct sock_fprog prog = {
157
- .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
158
- .filter = (struct sock_filter *)unix_block_bpf,
159
- };
160
-
161
- /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
162
- *
163
- * Two paths to get CAP_SYS_ADMIN for the unshare:
164
- * (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
165
- * --cap-add. Just unshare directly.
166
- * (b) We don't have the cap. Create a nested user namespace to get it,
167
- * map uid/gid, then unshare. This also works when apply-seccomp is
168
- * run standalone outside bwrap.
169
- *
170
- * Path (a) is tried first. If the caller didn't give us the cap, the
171
- * kernel returns EPERM and we fall through to (b). Path (b) can itself
172
- * fail on hosts where unprivileged user namespaces are gated by an LSM
173
- * (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
174
- * succeeds but the new namespace grants no capabilities, so the setgroups
175
- * write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
176
- */
177
- if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
178
- if (errno != EPERM) {
179
- die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
180
- }
181
-
182
- uid_t uid = geteuid();
183
- gid_t gid = getegid();
184
-
185
- if (unshare(CLONE_NEWUSER) < 0) {
186
- die("apply-seccomp: unshare(CLONE_NEWUSER)");
187
- }
188
- if (write_file("/proc/self/setgroups", "deny") < 0) {
189
- die("apply-seccomp: write /proc/self/setgroups "
190
- "(nested userns is capability-restricted; "
191
- "caller must provide CAP_SYS_ADMIN)");
192
- }
193
- if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
194
- die("apply-seccomp: write /proc/self/uid_map");
195
- }
196
- if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
197
- die("apply-seccomp: write /proc/self/gid_map");
198
- }
199
- if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
200
- die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
201
- }
202
- }
203
-
204
- pid_t child = fork();
205
- if (child < 0) {
206
- die("apply-seccomp: fork");
207
- }
208
-
209
- if (child > 0) {
210
- /* Outer stub: still in bwrap's PID namespace. Forward signals and
211
- * wait so the caller sees the real exit status. */
212
- install_forwarders(child);
213
-
214
- int status;
215
- for (;;) {
216
- pid_t r = waitpid(child, &status, 0);
217
- if (r < 0 && errno == EINTR) continue;
218
- if (r < 0) die("apply-seccomp: waitpid");
219
- break;
220
- }
221
- if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
222
- return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
223
- }
224
-
225
- /* ================================================================
226
- * Inner init — PID 1 in the nested PID namespace.
227
- * ================================================================ */
228
-
229
- /* Block ptrace and /proc/1/mem writes against this process. */
230
- if (prctl(PR_SET_DUMPABLE, 0) < 0) {
231
- die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
232
- }
233
-
234
- /* Don't let our /proc mount propagate anywhere. */
235
- if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
236
- die("apply-seccomp: mount(MS_PRIVATE)");
237
- }
238
- /* EPERM here means a masked /proc is underneath (unprivileged Docker)
239
- * and the kernel domination check refused the overmount. The nested
240
- * userns above is the isolation boundary; this remount only hides
241
- * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
242
- * exactly this environment. */
243
- if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
244
- && errno != EPERM) {
245
- die("apply-seccomp: mount(/proc)");
246
- }
247
-
248
- /* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
249
- * exec. Clear it now that the mount is done; combined with
250
- * PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
251
- if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
252
- die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
253
- }
254
-
255
- /* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
256
- pid_t worker = fork();
257
- if (worker < 0) {
258
- die("apply-seccomp: fork(worker)");
259
- }
260
-
261
- if (worker > 0) {
262
- /* Inner init: reap everything, exit with the worker's status.
263
- * When PID 1 exits the kernel tears down the whole namespace.
264
- * PID 1 drops signals without handlers, so install forwarders. */
265
- install_forwarders(worker);
266
- _exit(reap_until(worker));
267
- }
268
-
269
- /* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
270
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
271
- die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
272
- }
273
- if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
274
- die("apply-seccomp: prctl(PR_SET_SECCOMP)");
275
- }
276
-
277
- execvp(command_argv[0], command_argv);
278
- die("apply-seccomp: execvp");
279
- return 1;
280
- }