@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (116) hide show
  1. package/README.md +43 -2
  2. package/dist/index.d.ts +3 -3
  3. package/dist/index.d.ts.map +1 -1
  4. package/dist/index.js +1 -1
  5. package/dist/index.js.map +1 -1
  6. package/dist/sandbox/credential-mask-files.d.ts +72 -0
  7. package/dist/sandbox/credential-mask-files.d.ts.map +1 -0
  8. package/dist/sandbox/credential-mask-files.js +146 -0
  9. package/dist/sandbox/credential-mask-files.js.map +1 -0
  10. package/dist/sandbox/credential-sentinel.d.ts +72 -0
  11. package/dist/sandbox/credential-sentinel.d.ts.map +1 -0
  12. package/dist/sandbox/credential-sentinel.js +130 -0
  13. package/dist/sandbox/credential-sentinel.js.map +1 -0
  14. package/dist/sandbox/domain-pattern.d.ts +36 -0
  15. package/dist/sandbox/domain-pattern.d.ts.map +1 -0
  16. package/dist/sandbox/domain-pattern.js +60 -0
  17. package/dist/sandbox/domain-pattern.js.map +1 -0
  18. package/dist/sandbox/http-proxy.d.ts +32 -1
  19. package/dist/sandbox/http-proxy.d.ts.map +1 -1
  20. package/dist/sandbox/http-proxy.js +10 -2
  21. package/dist/sandbox/http-proxy.js.map +1 -1
  22. package/dist/sandbox/linux-sandbox-utils.d.ts +15 -0
  23. package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -1
  24. package/dist/sandbox/linux-sandbox-utils.js +106 -47
  25. package/dist/sandbox/linux-sandbox-utils.js.map +1 -1
  26. package/dist/sandbox/listen-in-range.d.ts +12 -0
  27. package/dist/sandbox/listen-in-range.d.ts.map +1 -0
  28. package/dist/sandbox/listen-in-range.js +43 -0
  29. package/dist/sandbox/listen-in-range.js.map +1 -0
  30. package/dist/sandbox/macos-sandbox-utils.d.ts +11 -0
  31. package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -1
  32. package/dist/sandbox/macos-sandbox-utils.js +69 -14
  33. package/dist/sandbox/macos-sandbox-utils.js.map +1 -1
  34. package/dist/sandbox/mitm-ca.d.ts +18 -2
  35. package/dist/sandbox/mitm-ca.d.ts.map +1 -1
  36. package/dist/sandbox/mitm-ca.js +49 -9
  37. package/dist/sandbox/mitm-ca.js.map +1 -1
  38. package/dist/sandbox/mitm-leaf.d.ts.map +1 -1
  39. package/dist/sandbox/mitm-leaf.js +24 -6
  40. package/dist/sandbox/mitm-leaf.js.map +1 -1
  41. package/dist/sandbox/mux-proxy.d.ts +59 -0
  42. package/dist/sandbox/mux-proxy.d.ts.map +1 -0
  43. package/dist/sandbox/mux-proxy.js +159 -0
  44. package/dist/sandbox/mux-proxy.js.map +1 -0
  45. package/dist/sandbox/request-filter.d.ts +11 -1
  46. package/dist/sandbox/request-filter.d.ts.map +1 -1
  47. package/dist/sandbox/request-filter.js.map +1 -1
  48. package/dist/sandbox/sandbox-config.d.ts +254 -25
  49. package/dist/sandbox/sandbox-config.d.ts.map +1 -1
  50. package/dist/sandbox/sandbox-config.js +200 -13
  51. package/dist/sandbox/sandbox-config.js.map +1 -1
  52. package/dist/sandbox/sandbox-manager.d.ts +4 -0
  53. package/dist/sandbox/sandbox-manager.d.ts.map +1 -1
  54. package/dist/sandbox/sandbox-manager.js +601 -194
  55. package/dist/sandbox/sandbox-manager.js.map +1 -1
  56. package/dist/sandbox/sandbox-schemas.d.ts +15 -0
  57. package/dist/sandbox/sandbox-schemas.d.ts.map +1 -1
  58. package/dist/sandbox/sandbox-utils.d.ts +42 -6
  59. package/dist/sandbox/sandbox-utils.d.ts.map +1 -1
  60. package/dist/sandbox/sandbox-utils.js +115 -27
  61. package/dist/sandbox/sandbox-utils.js.map +1 -1
  62. package/dist/sandbox/socks-proxy.d.ts +11 -5
  63. package/dist/sandbox/socks-proxy.d.ts.map +1 -1
  64. package/dist/sandbox/socks-proxy.js +13 -81
  65. package/dist/sandbox/socks-proxy.js.map +1 -1
  66. package/dist/sandbox/tls-terminate-proxy.d.ts +2 -2
  67. package/dist/sandbox/tls-terminate-proxy.d.ts.map +1 -1
  68. package/dist/sandbox/tls-terminate-proxy.js +31 -5
  69. package/dist/sandbox/tls-terminate-proxy.js.map +1 -1
  70. package/dist/sandbox/windows-sandbox-utils.d.ts +347 -11
  71. package/dist/sandbox/windows-sandbox-utils.d.ts.map +1 -1
  72. package/dist/sandbox/windows-sandbox-utils.js +437 -45
  73. package/dist/sandbox/windows-sandbox-utils.js.map +1 -1
  74. package/package.json +7 -4
  75. package/vendor/seccomp/build.ts +8 -30
  76. package/vendor/srt-win/build.ts +21 -0
  77. package/dist/vendor/seccomp/Dockerfile.build +0 -6
  78. package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
  79. package/dist/vendor/seccomp/build.ts +0 -91
  80. package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
  81. package/dist/vendor/seccomp-src/apply-seccomp.c +0 -280
  82. package/dist/vendor/seccomp-src/seccomp-unix-block.c +0 -148
  83. package/dist/vendor/srt-win/Cargo.lock +0 -361
  84. package/dist/vendor/srt-win/Cargo.toml +0 -46
  85. package/dist/vendor/srt-win/ci/cleanup.ps1 +0 -49
  86. package/dist/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
  87. package/dist/vendor/srt-win/ci/smoke.ps1 +0 -307
  88. package/dist/vendor/srt-win/src/job.rs +0 -102
  89. package/dist/vendor/srt-win/src/launch.rs +0 -732
  90. package/dist/vendor/srt-win/src/lib.rs +0 -20
  91. package/dist/vendor/srt-win/src/main.rs +0 -669
  92. package/dist/vendor/srt-win/src/self_protect.rs +0 -169
  93. package/dist/vendor/srt-win/src/sid.rs +0 -296
  94. package/dist/vendor/srt-win/src/token.rs +0 -341
  95. package/dist/vendor/srt-win/src/util.rs +0 -42
  96. package/dist/vendor/srt-win/src/wfp.rs +0 -992
  97. package/dist/vendor/srt-win/src/winsta.rs +0 -209
  98. package/dist/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
  99. package/vendor/seccomp-src/apply-seccomp.c +0 -280
  100. package/vendor/seccomp-src/seccomp-unix-block.c +0 -148
  101. package/vendor/srt-win/Cargo.lock +0 -361
  102. package/vendor/srt-win/Cargo.toml +0 -46
  103. package/vendor/srt-win/ci/cleanup.ps1 +0 -49
  104. package/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
  105. package/vendor/srt-win/ci/smoke.ps1 +0 -307
  106. package/vendor/srt-win/src/job.rs +0 -102
  107. package/vendor/srt-win/src/launch.rs +0 -732
  108. package/vendor/srt-win/src/lib.rs +0 -20
  109. package/vendor/srt-win/src/main.rs +0 -669
  110. package/vendor/srt-win/src/self_protect.rs +0 -169
  111. package/vendor/srt-win/src/sid.rs +0 -296
  112. package/vendor/srt-win/src/token.rs +0 -341
  113. package/vendor/srt-win/src/util.rs +0 -42
  114. package/vendor/srt-win/src/wfp.rs +0 -992
  115. package/vendor/srt-win/src/winsta.rs +0 -209
  116. package/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
@@ -1 +1 @@
1
- {"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGzD;;;;;;;;;;;;;;;;GAgBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAkDD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;QACxE,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,aAAa,CACd;KACF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,uEAAuE;QACvE,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAI,IAAc;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;YACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CACzD,CAAA;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAItB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC,EAAE;IAG1E,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GACT,KAAK,KAAK,MAAM;YACd,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAA;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,gDAAgD;IAChD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,SAAS,EACT,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IACvB,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAA;IAC/D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
1
+ {"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,4DAA4D;AAC5D,6CAA6C;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAG3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAiGD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC7C,iEAAiE;IACjE,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IACE,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,QAAQ,EACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;gBAClE,yCAAyC,CAC5C,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACpC,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,4CAA4C;IAC5C,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC/B,KAAK,KAAK,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB;YACE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa;gBACvD,sEAAsE,CACzE,CAAA;IACL,CAAC;AACH,CAAC;AAwGD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,aAAa,GAA2B,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,CACd;IACD,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CACzE,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,2EAA2E;QAC3E,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAChB,IAAc,EACd,KAAc,EACd,SAAS,GAAG,KAAM;IAElB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAaD,SAAS,aAAa,CACpB,IAAc,EACd,IAAqD;IAErD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,0DAA0D;IAC1D,IAAI,IAAmB,CAAA;IACvB,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAI,CAAW,CAAC,OAAO,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;QACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAMtB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QACpD,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,aAAa,CActB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtB,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3D,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB;QAC3C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI;YAC5C,aAAa,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiC;IAEjC,MAAM,CAAC,GAAG,MAAM,IAAI,2BAA2B,EAAE,CAAA;IACjD,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,wDAAwD;IACxD,iEAAiE;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IACxE,eAAe,CACb,wCAAwC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC5E,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,iBAAiB;YACnD,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC1C,CAAA;IACH,CAAC;AACH,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IAC5C,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,wCAAwC;IACxC,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,EAAE,2BAA2B,EAAE;gBACnC,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,sDAAsD,GAAG,EAAE,CAC5D,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7D,IAAI,EAAE,2BAA2B,EAAE;KACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsD,EAAE;IAIxD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AA0DD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC;YAC3C,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAC9C,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB;oBAC/C,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAC/D,CAAA;YACH,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AACjB,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,SAAS,CACjB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,EAC1E,KAAK,EACL,KAAM,CACP,CAAA;IACD,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,4DAA4D;QAC5D,4DAA4D;QAC5D,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,MAAM,GAAG;YACrC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,UAAU,CAAC;YACjE,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC9B,CAAA;IACH,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,SAAS;QACT,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,cAAc;QACd,GAAG,MAAM,EAAE;QACX,QAAQ;KACT,CAAA;IACD,gEAAgE;IAChE,4DAA4D;IAC5D,8DAA8D;IAC9D,2DAA2D;IAC3D,+DAA+D;IAC/D,0DAA0D;IAC1D,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,aAAa,CAA0B,IAAI,EAAE;YACrD,SAAS,EAAE,KAAM;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,eAAe,CACb,0DAA0D;gBACxD,wBAAwB,CAAC,CAAC,MAAM,EAAE,EACpC,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAA;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAe,CAAC,kCAAmC,CAAW,CAAC,OAAO,EAAE,EAAE;YACxE,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAkC;IAC1E,UAAU;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAC1C,CAAC,UAAU,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAC7C,CAAA;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,6DAA6D;IAC7D,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,iEAAiE;IACjE,sDAAsD;IACtD,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,eAAe,CACb,iCAAiC,CAAC,CAAC,UAAU,kBAAkB;YAC7D,sDAAsD;YACtD,2DAA2D;YAC3D,kDAAkD,CACrD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC1C,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IAEvB,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,0CAA0C;IAC1C,8DAA8D;IAC9D,8DAA8D;IAC9D,iEAAiE;IACjE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;IAChE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAC7D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC9B,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,2DAA2D;QAC3D,8BAA8B;QAC9B,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;YAC5B,GAAG,SAAS;SACb,CAAA;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,0DAA0D;YAC1D,8DAA8D;YAC9D,kEAAkE;YAClE,6DAA6D;YAC7D,8DAA8D;YAC9D,+DAA+D;YAC/D,iEAAiE;YACjE,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YACnC,MAAK;QACP,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YAC1D,MAAK;QACP,KAAK,YAAY;YACf,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,EACD,YAAY,EACZ,UAAU,EACV,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;QACP,KAAK,KAAK;YACR,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;IACT,CAAC;IAED,6DAA6D;IAC7D,8DAA8D;IAC9D,6DAA6D;IAC7D,2DAA2D;IAC3D,0DAA0D;IAC1D,2DAA2D;IAC3D,4DAA4D;IAC5D,6DAA6D;IAC7D,2DAA2D;IAC3D,0BAA0B;IAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,IAAI,eAAe,GAAG,KAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAA;QACpE,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,SAAS;YAClD,qCAAqC,KAAK,YAAY;YACtD,4DAA4D;YAC5D,6DAA6D;YAC7D,8DAA8D;YAC9D,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,4DAA4D;IAC5D,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAE1C,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sysid/sandbox-runtime-improved",
3
- "version": "0.0.56-sysid.1",
3
+ "version": "0.0.61-sysid.1",
4
4
  "description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -9,18 +9,19 @@
9
9
  "srti": "dist/cli.js"
10
10
  },
11
11
  "engines": {
12
- "node": ">=18.0.0"
12
+ "node": ">=20.11.0"
13
13
  },
14
14
  "scripts": {
15
15
  "build": "tsc",
16
16
  "build:seccomp": "bun vendor/seccomp/build.ts",
17
+ "build:srt-win": "bun vendor/srt-win/build.ts",
17
18
  "clean": "rm -rf dist",
18
19
  "test": "bun test",
19
20
  "typecheck": "tsc --noEmit",
20
21
  "lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
21
22
  "lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",
22
23
  "format": "prettier --write 'src/**/*.ts' --cache --log-level warn",
23
- "prepublishOnly": "npm run clean && npm run build && cp -r vendor dist/ && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('dist/vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
24
+ "prepublishOnly": "npm run clean && npm run build && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
24
25
  "prepare": "husky"
25
26
  },
26
27
  "dependencies": {
@@ -42,6 +43,7 @@
42
43
  "eslint-plugin-import": "^2.31.0",
43
44
  "eslint-plugin-n": "^17.16.2",
44
45
  "eslint-plugin-prettier": "^5.1.3",
46
+ "fast-check": "^4.8.0",
45
47
  "globals": "^15.12.0",
46
48
  "husky": "^9.1.7",
47
49
  "lint-staged": "^16.2.6",
@@ -51,7 +53,8 @@
51
53
  },
52
54
  "files": [
53
55
  "dist",
54
- "vendor",
56
+ "vendor/seccomp",
57
+ "vendor/srt-win",
55
58
  "README.md",
56
59
  "LICENSE"
57
60
  ],
@@ -1,32 +1,12 @@
1
- import { spawnSync } from 'node:child_process'
2
- import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
3
- import { dirname, join } from 'node:path'
4
- import { fileURLToPath } from 'node:url'
1
+ import { readFileSync, rmSync, writeFileSync } from 'node:fs'
2
+ import { join } from 'node:path'
3
+ import { run, setup } from '../build-common.js'
5
4
 
6
- if (process.platform !== 'linux') {
7
- console.error('seccomp build: Linux only')
8
- process.exit(1)
9
- }
10
-
11
- const HERE = dirname(fileURLToPath(import.meta.url))
12
- const SRC = join(HERE, '..', 'seccomp-src')
13
-
14
- const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
15
- const arch = nodeArchToDir[process.arch]
16
- if (!arch) {
17
- console.error('seccomp build: unsupported arch ' + process.arch)
18
- process.exit(1)
19
- }
20
- const OUT = join(HERE, arch)
21
-
22
- function run(argv: string[]): void {
23
- const [cmd, ...args] = argv
24
- const r = spawnSync(cmd, args, { stdio: 'inherit' })
25
- if (r.status !== 0) {
26
- console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
27
- process.exit(1)
28
- }
29
- }
5
+ const { SRC, OUT } = setup({
6
+ importMetaUrl: import.meta.url,
7
+ requirePlatform: 'linux',
8
+ srcDirName: 'seccomp-src',
9
+ })
30
10
 
31
11
  function toCArray(bytes: Buffer): string {
32
12
  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
@@ -37,8 +17,6 @@ function toCArray(bytes: Buffer): string {
37
17
  return lines.join('\n')
38
18
  }
39
19
 
40
- mkdirSync(OUT, { recursive: true })
41
-
42
20
  const cflags = ['-static', '-O2', '-Wall', '-Wextra']
43
21
 
44
22
  const gen = join(OUT, 'seccomp-unix-block')
@@ -0,0 +1,21 @@
1
+ import { copyFileSync, existsSync } from 'node:fs'
2
+ import { join } from 'node:path'
3
+ import { run, setup } from '../build-common.js'
4
+
5
+ const { SRC, OUT } = setup({
6
+ importMetaUrl: import.meta.url,
7
+ requirePlatform: 'win32',
8
+ srcDirName: 'srt-win-src',
9
+ })
10
+
11
+ run(['cargo', 'build', '--release', '--manifest-path', join(SRC, 'Cargo.toml')])
12
+
13
+ const built = join(SRC, 'target', 'release', 'srt-win.exe')
14
+ if (!existsSync(built)) {
15
+ console.error('srt-win build: expected output not found at ' + built)
16
+ process.exit(1)
17
+ }
18
+
19
+ const dest = join(OUT, 'srt-win.exe')
20
+ copyFileSync(built, dest)
21
+ console.log('built ' + dest)
@@ -1,6 +0,0 @@
1
- FROM ubuntu:24.04
2
- RUN apt-get update && apt-get install -y --no-install-recommends \
3
- gcc libc6-dev libseccomp-dev curl unzip ca-certificates && \
4
- rm -rf /var/lib/apt/lists/*
5
- RUN curl -fsSL https://bun.sh/install | BUN_INSTALL=/usr/local bash
6
- WORKDIR /build
@@ -1,91 +0,0 @@
1
- import { spawnSync } from 'node:child_process'
2
- import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
3
- import { dirname, join } from 'node:path'
4
- import { fileURLToPath } from 'node:url'
5
-
6
- if (process.platform !== 'linux') {
7
- console.error('seccomp build: Linux only')
8
- process.exit(1)
9
- }
10
-
11
- const HERE = dirname(fileURLToPath(import.meta.url))
12
- const SRC = join(HERE, '..', 'seccomp-src')
13
-
14
- const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
15
- const arch = nodeArchToDir[process.arch]
16
- if (!arch) {
17
- console.error('seccomp build: unsupported arch ' + process.arch)
18
- process.exit(1)
19
- }
20
- const OUT = join(HERE, arch)
21
-
22
- function run(argv: string[]): void {
23
- const [cmd, ...args] = argv
24
- const r = spawnSync(cmd, args, { stdio: 'inherit' })
25
- if (r.status !== 0) {
26
- console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
27
- process.exit(1)
28
- }
29
- }
30
-
31
- function toCArray(bytes: Buffer): string {
32
- const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
33
- const lines: string[] = []
34
- for (let i = 0; i < hex.length; i += 8) {
35
- lines.push(' ' + hex.slice(i, i + 8).join(', ') + ',')
36
- }
37
- return lines.join('\n')
38
- }
39
-
40
- mkdirSync(OUT, { recursive: true })
41
-
42
- const cflags = ['-static', '-O2', '-Wall', '-Wextra']
43
-
44
- const gen = join(OUT, 'seccomp-unix-block')
45
- run([
46
- 'gcc',
47
- ...cflags,
48
- '-o',
49
- gen,
50
- join(SRC, 'seccomp-unix-block.c'),
51
- '-lseccomp',
52
- ])
53
-
54
- const bpf: Record<string, Buffer> = {}
55
- for (const target of ['x86_64', 'aarch64']) {
56
- const tmp = join(OUT, target + '.bpf')
57
- run([gen, tmp, target])
58
- bpf[target] = readFileSync(tmp)
59
- rmSync(tmp)
60
- }
61
- rmSync(gen)
62
-
63
- const header = join(OUT, 'unix-block-bpf.h')
64
- writeFileSync(
65
- header,
66
- '#if defined(__x86_64__)\n' +
67
- 'static const unsigned char unix_block_bpf[] = {\n' +
68
- toCArray(bpf.x86_64) +
69
- '\n};\n' +
70
- '#elif defined(__aarch64__)\n' +
71
- 'static const unsigned char unix_block_bpf[] = {\n' +
72
- toCArray(bpf.aarch64) +
73
- '\n};\n' +
74
- '#else\n' +
75
- '#error "unsupported architecture for unix-block BPF filter"\n' +
76
- '#endif\n',
77
- )
78
-
79
- run([
80
- 'gcc',
81
- ...cflags,
82
- '-I',
83
- OUT,
84
- '-o',
85
- join(OUT, 'apply-seccomp'),
86
- join(SRC, 'apply-seccomp.c'),
87
- ])
88
- run(['strip', join(OUT, 'apply-seccomp')])
89
- rmSync(header)
90
-
91
- console.log('built ' + join(OUT, 'apply-seccomp'))
@@ -1,280 +0,0 @@
1
- /*
2
- * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
3
- *
4
- * Usage: apply-seccomp <command> [args...]
5
- *
6
- * This program applies a baked-in seccomp BPF filter, isolates the
7
- * target command in a nested user+PID+mount namespace so it cannot see or
8
- * ptrace any process that lacks the filter, applies the filter with
9
- * prctl(PR_SET_SECCOMP), and execs the command.
10
- *
11
- * Process layout inside the outer bwrap sandbox:
12
- *
13
- * bwrap init (PID 1) <- outer PID ns, no seccomp
14
- * \_ bash / socat ... <- outer PID ns, no seccomp
15
- * \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
16
- * ================================================= PID ns boundary
17
- * \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
18
- * \_ user command <- inner PID 2, seccomp applied
19
- *
20
- * From the user command's point of view /proc contains only its own process
21
- * tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
22
- * so they cannot be ptraced or patched via /proc/N/mem even on systems with
23
- * kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
24
- * so it cannot be ptraced either.
25
- *
26
- * Any failure to set up the nested namespaces aborts with a non-zero exit
27
- * status; we never fall back to running the command without isolation.
28
- *
29
- * Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
30
- */
31
-
32
- #define _GNU_SOURCE
33
- #include <stdio.h>
34
- #include <stdlib.h>
35
- #include <stdarg.h>
36
- #include <string.h>
37
- #include <unistd.h>
38
- #include <fcntl.h>
39
- #include <errno.h>
40
- #include <sched.h>
41
- #include <signal.h>
42
- #include <sys/prctl.h>
43
- #include <sys/wait.h>
44
- #include <sys/mount.h>
45
- #include <linux/seccomp.h>
46
- #include <linux/filter.h>
47
-
48
- #include "unix-block-bpf.h"
49
-
50
- #ifndef PR_SET_NO_NEW_PRIVS
51
- #define PR_SET_NO_NEW_PRIVS 38
52
- #endif
53
-
54
- #ifndef PR_CAP_AMBIENT
55
- #define PR_CAP_AMBIENT 47
56
- #define PR_CAP_AMBIENT_CLEAR_ALL 4
57
- #endif
58
-
59
- #ifndef SECCOMP_MODE_FILTER
60
- #define SECCOMP_MODE_FILTER 2
61
- #endif
62
-
63
- static void die(const char *msg) {
64
- perror(msg);
65
- _exit(1);
66
- }
67
-
68
- static int write_file(const char *path, const char *fmt, ...) {
69
- char buf[256];
70
- va_list ap;
71
- va_start(ap, fmt);
72
- int len = vsnprintf(buf, sizeof(buf), fmt, ap);
73
- va_end(ap);
74
- if (len < 0 || (size_t)len >= sizeof(buf)) {
75
- errno = EOVERFLOW;
76
- return -1;
77
- }
78
-
79
- int fd = open(path, O_WRONLY);
80
- if (fd < 0) {
81
- return -1;
82
- }
83
- ssize_t r = write(fd, buf, (size_t)len);
84
- int saved = errno;
85
- close(fd);
86
- if (r != len) {
87
- errno = (r < 0) ? saved : EIO;
88
- return -1;
89
- }
90
- return 0;
91
- }
92
-
93
- /* PID the current process forwards signals to. Used by both the outer stub
94
- * (forwards to inner init) and the inner init (forwards to the worker).
95
- * PID 1 ignores signals it has no handler for, so the inner init MUST install
96
- * these or SIGTERM from the outside is silently dropped. */
97
- static volatile pid_t forward_target = -1;
98
-
99
- static void forward_signal(int sig) {
100
- if (forward_target > 0) {
101
- kill(forward_target, sig);
102
- }
103
- }
104
-
105
- static void install_forwarders(pid_t target) {
106
- forward_target = target;
107
- struct sigaction sa = { .sa_handler = forward_signal };
108
- sigemptyset(&sa.sa_mask);
109
- sigaction(SIGTERM, &sa, NULL);
110
- sigaction(SIGINT, &sa, NULL);
111
- sigaction(SIGHUP, &sa, NULL);
112
- sigaction(SIGQUIT, &sa, NULL);
113
- sigaction(SIGUSR1, &sa, NULL);
114
- sigaction(SIGUSR2, &sa, NULL);
115
- }
116
-
117
- /*
118
- * Wait for `main_child`, reaping any other children that exit first.
119
- * Returns as soon as `main_child` terminates — the caller then _exit()s,
120
- * which as PID 1 tears down the namespace and SIGKILLs any stragglers.
121
- * Returns an exit(3)-style status: exit code, or 128+signal.
122
- */
123
- static int reap_until(pid_t main_child) {
124
- int status = 0;
125
- for (;;) {
126
- pid_t r = waitpid(-1, &status, 0);
127
- if (r < 0) {
128
- if (errno == EINTR) {
129
- continue;
130
- }
131
- return 1; /* ECHILD without seeing main_child — shouldn't happen. */
132
- }
133
- if (r == main_child) {
134
- if (WIFEXITED(status)) {
135
- return WEXITSTATUS(status);
136
- }
137
- if (WIFSIGNALED(status)) {
138
- return 128 + WTERMSIG(status);
139
- }
140
- return 1;
141
- }
142
- /* Reaped an orphan that died before main_child; keep waiting. */
143
- }
144
- }
145
-
146
- int main(int argc, char *argv[]) {
147
- if (argc < 2) {
148
- fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
149
- return 1;
150
- }
151
-
152
- char **command_argv = &argv[1];
153
-
154
- _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
155
- "BPF filter size must be a multiple of sock_filter");
156
- struct sock_fprog prog = {
157
- .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
158
- .filter = (struct sock_filter *)unix_block_bpf,
159
- };
160
-
161
- /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
162
- *
163
- * Two paths to get CAP_SYS_ADMIN for the unshare:
164
- * (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
165
- * --cap-add. Just unshare directly.
166
- * (b) We don't have the cap. Create a nested user namespace to get it,
167
- * map uid/gid, then unshare. This also works when apply-seccomp is
168
- * run standalone outside bwrap.
169
- *
170
- * Path (a) is tried first. If the caller didn't give us the cap, the
171
- * kernel returns EPERM and we fall through to (b). Path (b) can itself
172
- * fail on hosts where unprivileged user namespaces are gated by an LSM
173
- * (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
174
- * succeeds but the new namespace grants no capabilities, so the setgroups
175
- * write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
176
- */
177
- if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
178
- if (errno != EPERM) {
179
- die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
180
- }
181
-
182
- uid_t uid = geteuid();
183
- gid_t gid = getegid();
184
-
185
- if (unshare(CLONE_NEWUSER) < 0) {
186
- die("apply-seccomp: unshare(CLONE_NEWUSER)");
187
- }
188
- if (write_file("/proc/self/setgroups", "deny") < 0) {
189
- die("apply-seccomp: write /proc/self/setgroups "
190
- "(nested userns is capability-restricted; "
191
- "caller must provide CAP_SYS_ADMIN)");
192
- }
193
- if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
194
- die("apply-seccomp: write /proc/self/uid_map");
195
- }
196
- if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
197
- die("apply-seccomp: write /proc/self/gid_map");
198
- }
199
- if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
200
- die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
201
- }
202
- }
203
-
204
- pid_t child = fork();
205
- if (child < 0) {
206
- die("apply-seccomp: fork");
207
- }
208
-
209
- if (child > 0) {
210
- /* Outer stub: still in bwrap's PID namespace. Forward signals and
211
- * wait so the caller sees the real exit status. */
212
- install_forwarders(child);
213
-
214
- int status;
215
- for (;;) {
216
- pid_t r = waitpid(child, &status, 0);
217
- if (r < 0 && errno == EINTR) continue;
218
- if (r < 0) die("apply-seccomp: waitpid");
219
- break;
220
- }
221
- if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
222
- return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
223
- }
224
-
225
- /* ================================================================
226
- * Inner init — PID 1 in the nested PID namespace.
227
- * ================================================================ */
228
-
229
- /* Block ptrace and /proc/1/mem writes against this process. */
230
- if (prctl(PR_SET_DUMPABLE, 0) < 0) {
231
- die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
232
- }
233
-
234
- /* Don't let our /proc mount propagate anywhere. */
235
- if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
236
- die("apply-seccomp: mount(MS_PRIVATE)");
237
- }
238
- /* EPERM here means a masked /proc is underneath (unprivileged Docker)
239
- * and the kernel domination check refused the overmount. The nested
240
- * userns above is the isolation boundary; this remount only hides
241
- * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
242
- * exactly this environment. */
243
- if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
244
- && errno != EPERM) {
245
- die("apply-seccomp: mount(/proc)");
246
- }
247
-
248
- /* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
249
- * exec. Clear it now that the mount is done; combined with
250
- * PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
251
- if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
252
- die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
253
- }
254
-
255
- /* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
256
- pid_t worker = fork();
257
- if (worker < 0) {
258
- die("apply-seccomp: fork(worker)");
259
- }
260
-
261
- if (worker > 0) {
262
- /* Inner init: reap everything, exit with the worker's status.
263
- * When PID 1 exits the kernel tears down the whole namespace.
264
- * PID 1 drops signals without handlers, so install forwarders. */
265
- install_forwarders(worker);
266
- _exit(reap_until(worker));
267
- }
268
-
269
- /* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
270
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
271
- die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
272
- }
273
- if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
274
- die("apply-seccomp: prctl(PR_SET_SECCOMP)");
275
- }
276
-
277
- execvp(command_argv[0], command_argv);
278
- die("apply-seccomp: execvp");
279
- return 1;
280
- }