@theokit/sdk 4.19.4 → 4.20.0

package/dist/sandbox/bwrap.d.cts

@@ -0,0 +1,75 @@
+/**
+ * M53 — bubblewrap argv + honest detection, faithful to Codex's Linux sandbox
+ * (`codex-rs/linux-sandbox/src/bwrap.rs` + `codex-rs/sandboxing/src/bwrap.rs`).
+ *
+ * HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —
+ * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`
+ * via `restrictedSeccompPath()`. Portado no M63; este bloco afirmava o contrário até o M67 e
+ * SUBDECLARAVA a postura de segurança real. Limite honesto que permanece: o filtro é **x86_64**
+ * (guarda de arquitetura recusa instalar em outra arch, com WARN, e o confinamento de FS/rede do
+ * bwrap segue valendo) **e** só é instalado quando a rede está restrita (`backend.ts:87`, fiel a
+ * `landlock.rs:96-117`): com rede ligada não há filtro de syscall, apenas o confinamento de FS do
+ * bwrap. `danger-full-access` pula o bwrap por completo, espelhando `bwrap.rs:245-252`.
+ * Deltas versus o Codex seguem documentados em docs/CODEX-PARITY.md.
+ */
+/**
+ * Os tres modos canonicos do Codex. Definidos AQUI porque sao vocabulario do sandbox, nao da
+ * configuracao do consumidor: `danger-full-access` significa "nao embrulhe", e essa e uma decisao do
+ * subsistema de confinamento.
+ */
+export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
+export interface BwrapArgvOptions {
+    /** Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). */
+    cwd: string;
+    /** `true` removes `--unshare-net` (policy `network_access`, default false). */
+    network?: boolean;
+    /** Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. */
+    gitDirExists?: boolean;
+    /**
+     * When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,
+     * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the
+     * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).
+     */
+    env?: Record<string, string>;
+}
+/**
+ * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),
+ * or `null` when the policy skips the sandbox entirely (`danger-full-access`).
+ */
+export declare function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] | null;
+/** Injectable probes — each mirrors one Codex availability check. */
+export interface BwrapProbes {
+    /** `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). */
+    which: () => string | null;
+    /** `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). */
+    helpText: (bin: string) => string | null;
+    /** Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). */
+    userns: (bin: string) => boolean;
+}
+export type BwrapDetection = {
+    ok: true;
+    bin: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */
+export declare function detectBwrap(probes?: BwrapProbes): BwrapDetection;
+/** Quantas sondagens reais rodaram. Seam de TESTE — o gate de performance conta isto. */
+export declare function realProbeCount(): number;
+/** Real probes used in production. */
+export declare const realProbes: BwrapProbes;
+/**
+ * `detectBwrap` com memoização — o que a produção deve chamar.
+ *
+ * Note que `detectBwrap` em si **não** memoiza, de propósito: ele aceita probes injetados, e memoizar
+ * ali faria um teste com probes falsos envenenar o cache do processo para todos os outros.
+ *
+ * A revalidação do positivo NÃO é uma re-sondagem: `detectBwrap` gasta três probes (subprocesso
+ * `which` + `--help` + namespace de usuário). Aqui só se confirma que o binário validado continua no
+ * lugar. Se sumiu, o memo é rebaixado a negativo com o motivo dito — nunca promovido a positivo, que
+ * exigiria a sondagem cara de volta.
+ */
+export declare function detectBwrapMemoizado(probes?: BwrapProbes): BwrapDetection;
+/** Seam de TESTE — limpa o memo. Produção nunca chama (ver m71-custo-por-turn#ADR-1). */
+export declare function resetBwrapMemo(): void;

package/dist/sandbox/bwrap.d.ts

@@ -0,0 +1,75 @@
+/**
+ * M53 — bubblewrap argv + honest detection, faithful to Codex's Linux sandbox
+ * (`codex-rs/linux-sandbox/src/bwrap.rs` + `codex-rs/sandboxing/src/bwrap.rs`).
+ *
+ * HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —
+ * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`
+ * via `restrictedSeccompPath()`. Portado no M63; este bloco afirmava o contrário até o M67 e
+ * SUBDECLARAVA a postura de segurança real. Limite honesto que permanece: o filtro é **x86_64**
+ * (guarda de arquitetura recusa instalar em outra arch, com WARN, e o confinamento de FS/rede do
+ * bwrap segue valendo) **e** só é instalado quando a rede está restrita (`backend.ts:87`, fiel a
+ * `landlock.rs:96-117`): com rede ligada não há filtro de syscall, apenas o confinamento de FS do
+ * bwrap. `danger-full-access` pula o bwrap por completo, espelhando `bwrap.rs:245-252`.
+ * Deltas versus o Codex seguem documentados em docs/CODEX-PARITY.md.
+ */
+/**
+ * Os tres modos canonicos do Codex. Definidos AQUI porque sao vocabulario do sandbox, nao da
+ * configuracao do consumidor: `danger-full-access` significa "nao embrulhe", e essa e uma decisao do
+ * subsistema de confinamento.
+ */
+export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
+export interface BwrapArgvOptions {
+    /** Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). */
+    cwd: string;
+    /** `true` removes `--unshare-net` (policy `network_access`, default false). */
+    network?: boolean;
+    /** Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. */
+    gitDirExists?: boolean;
+    /**
+     * When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,
+     * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the
+     * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).
+     */
+    env?: Record<string, string>;
+}
+/**
+ * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),
+ * or `null` when the policy skips the sandbox entirely (`danger-full-access`).
+ */
+export declare function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] | null;
+/** Injectable probes — each mirrors one Codex availability check. */
+export interface BwrapProbes {
+    /** `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). */
+    which: () => string | null;
+    /** `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). */
+    helpText: (bin: string) => string | null;
+    /** Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). */
+    userns: (bin: string) => boolean;
+}
+export type BwrapDetection = {
+    ok: true;
+    bin: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */
+export declare function detectBwrap(probes?: BwrapProbes): BwrapDetection;
+/** Quantas sondagens reais rodaram. Seam de TESTE — o gate de performance conta isto. */
+export declare function realProbeCount(): number;
+/** Real probes used in production. */
+export declare const realProbes: BwrapProbes;
+/**
+ * `detectBwrap` com memoização — o que a produção deve chamar.
+ *
+ * Note que `detectBwrap` em si **não** memoiza, de propósito: ele aceita probes injetados, e memoizar
+ * ali faria um teste com probes falsos envenenar o cache do processo para todos os outros.
+ *
+ * A revalidação do positivo NÃO é uma re-sondagem: `detectBwrap` gasta três probes (subprocesso
+ * `which` + `--help` + namespace de usuário). Aqui só se confirma que o binário validado continua no
+ * lugar. Se sumiu, o memo é rebaixado a negativo com o motivo dito — nunca promovido a positivo, que
+ * exigiria a sondagem cara de volta.
+ */
+export declare function detectBwrapMemoizado(probes?: BwrapProbes): BwrapDetection;
+/** Seam de TESTE — limpa o memo. Produção nunca chama (ver m71-custo-por-turn#ADR-1). */
+export declare function resetBwrapMemo(): void;

package/dist/sandbox/index.cjs

@@ -1,10 +1,242 @@
 'use strict';
 
 var child_process = require('child_process');
-var promises = require('fs/promises');
+var fs = require('fs');
 var path = require('path');
+var os = require('os');
+var promises = require('fs/promises');
 
-// src/sandbox/local-sandbox.ts
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var path__default = /*#__PURE__*/_interopDefault(path);
+
+// src/sandbox/bwrap.ts
+function buildBwrapArgv(mode, opts) {
+  if (mode === "danger-full-access") return null;
+  const cwd = path__default.default.resolve(opts.cwd);
+  const gitDir = path__default.default.join(cwd, ".git");
+  const hasGit = opts.gitDirExists ?? fs.existsSync(gitDir);
+  const argv = [
+    // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)
+    "--new-session",
+    "--die-with-parent",
+    "--unshare-user",
+    "--unshare-pid",
+    // full-read filesystem base (bwrap.rs:446-452)
+    "--ro-bind",
+    "/",
+    "/",
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc"
+  ];
+  if (!opts.network) argv.push("--unshare-net");
+  if (opts.env) argv.push("--clearenv");
+  const setenv = {
+    ...opts.env ?? {},
+    // the flag signals the child that network is unshared (spawn.rs:20,79)
+    ...opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: "1" }
+  };
+  for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
+  if (mode === "workspace-write") {
+    argv.push("--bind", cwd, cwd, "--bind", "/tmp", "/tmp");
+    if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
+  }
+  argv.push("--chdir", cwd, "--");
+  return argv;
+}
+function detectBwrap(probes = realProbes) {
+  try {
+    const bin = probes.which();
+    if (!bin) return { ok: false, reason: "bwrap not found in PATH" };
+    const help = probes.helpText(bin);
+    if (!help?.includes("--perms")) {
+      return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };
+    }
+    if (!probes.userns(bin)) {
+      return { ok: false, reason: "user namespaces unavailable (container/kernel restriction)" };
+    }
+    return { ok: true, bin };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+var sondagensReais = 0;
+function realProbeCount() {
+  return sondagensReais;
+}
+var realProbes = {
+  which: () => {
+    sondagensReais++;
+    try {
+      const out = child_process.execFileSync("which", ["bwrap"], { encoding: "utf8", timeout: 2e3 }).trim();
+      if (!out || out.startsWith(process.cwd() + path__default.default.sep)) return null;
+      return out;
+    } catch {
+      return null;
+    }
+  },
+  helpText: (bin) => {
+    try {
+      return child_process.execFileSync(bin, ["--help"], { encoding: "utf8", timeout: 2e3 });
+    } catch (err) {
+      const e = err;
+      return [e.stdout, e.stderr].filter(Boolean).join("\n") || null;
+    }
+  },
+  userns: (bin) => {
+    try {
+      child_process.execFileSync(bin, ["--unshare-user", "--unshare-net", "--ro-bind", "/", "/", "/bin/true"], {
+        timeout: 500,
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var memo;
+function detectBwrapMemoizado(probes = realProbes) {
+  memo ??= detectBwrap(probes);
+  if (memo.ok && !fs.existsSync(memo.bin)) {
+    memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };
+  }
+  return memo;
+}
+function resetBwrapMemo() {
+  memo = void 0;
+}
+
+// src/internal/security/redact.ts
+var REDACT_ENABLED = readEnvOnce();
+function readEnvOnce() {
+  const raw = process.env.THEOKIT_REDACT_SECRETS;
+  if (raw === void 0) return true;
+  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
+}
+var warnedOptOut = false;
+if (!REDACT_ENABLED && !warnedOptOut) {
+  process.stderr.write(
+    "[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. Credentials may leak into errors, telemetry, logs, transcripts.\n"
+  );
+  warnedOptOut = true;
+}
+var BUILTIN_PATTERNS = [
+  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more
+  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before
+  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its
+  // multi-line span runs before any per-line patterns can fire.
+  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,
+  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per
+  // segment matches the minimum legal payload while skipping `a.b.c` noise.
+  /eyJ[A-Za-z0-9_-]{4,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
+  // Azure Storage SAS — match the sig= component (URL-encoded base64).
+  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,
+  // Anthropic
+  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g,
+  //   Anthropic admin keys (must precede sk-ant-)
+  /sk-ant-[A-Za-z0-9_-]{10,}/g,
+  //           Anthropic regular
+  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)
+  /sk-proj-[A-Za-z0-9_-]{10,}/g,
+  //  OpenAI project key (must precede sk- generic)
+  /sk-[A-Za-z0-9_-]{10,}/g,
+  //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek
+  // Provider prefixes (alphabetized for maintainability)
+  /AIza[A-Za-z0-9_-]{35}/g,
+  //       Google API key
+  /AKIA[A-Z0-9]{16}/g,
+  //            AWS access key
+  /fw_[A-Za-z0-9]{20,}/g,
+  //         Fireworks
+  /glpat-[A-Za-z0-9_-]{20}/g,
+  //     GitLab PAT
+  /ghp_[A-Za-z0-9]{36}/g,
+  //         GitHub PAT classic
+  /github_pat_[A-Za-z0-9_]{82}/g,
+  // GitHub PAT fine-grained
+  /gsk_[A-Za-z0-9]{20,}/g,
+  //        Groq
+  /hf_[A-Za-z0-9]{20,}/g,
+  //         HuggingFace
+  /\bpa-[A-Za-z0-9_-]{20,}/g,
+  //     Voyage AI (word-boundary to skip CSS / kebab IDs)
+  /pcsk_[A-Za-z0-9_-]{20,}/g,
+  //     Pinecone
+  /pplx-[A-Za-z0-9_-]{20,}/g,
+  //     Perplexity
+  /r8_[A-Za-z0-9_-]{20,}/g,
+  //       Replicate
+  /rk_live_[A-Za-z0-9]{20,}/g,
+  //    Stripe restricted
+  /sk_live_[A-Za-z0-9]{20,}/g,
+  //    Stripe secret
+  /sntrys_[A-Za-z0-9]{40,}/g,
+  //     Sentry user auth
+  /xai-[A-Za-z0-9_-]{20,}/g,
+  //      xAI (Grok)
+  /xox[bpasr]-[A-Za-z0-9-]{10,}/g,
+  //Slack tokens
+  // Additional unique-prefix tokens with low false-positive risk
+  /npm_[A-Za-z0-9]{36}/g,
+  //         npm access token
+  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+  // SendGrid
+  /\bSK[A-Za-z0-9]{32}\b/g,
+  //       Twilio API SID (word-boundary to skip CSS class noise)
+  /\bkey-[a-f0-9]{32}\b/g,
+  //        Mailgun (hex-only narrows false positives)
+  /MT[A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/g,
+  // Discord bot
+  /\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g
+  // LaunchDarkly
+];
+var BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9_\-.+/=]{8,})/g;
+var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\b["']?\s*[:=]\s*["']?)([A-Za-z0-9_\-.+/]+)/gi;
+var _extraPatterns = [];
+function maskToken(token) {
+  if (token.length < 18) return "***";
+  return `${token.slice(0, 6)}...${token.slice(-4)}`;
+}
+var MASK_SHAPE = /^.{6}\.\.\..{4}$/s;
+function coerceToString(value) {
+  if (typeof value === "string") return value;
+  if (value === null || value === void 0) return null;
+  if (typeof value === "object") {
+    try {
+      const s = JSON.stringify(value);
+      return s === void 0 ? null : s;
+    } catch {
+      return "[unredactable: circular]";
+    }
+  }
+  return String(value);
+}
+function redactSecrets(text, opts) {
+  const coerced = coerceToString(text);
+  if (coerced === null) return "";
+  if (!REDACT_ENABLED) return coerced;
+  let s = coerced;
+  for (const re of BUILTIN_PATTERNS) {
+    s = s.replace(re, (m) => maskToken(m));
+  }
+  for (const re of _extraPatterns) {
+    s = s.replace(re, (m) => maskToken(m));
+  }
+  {
+    s = s.replace(BEARER_PATTERN, (_, prefix) => `${prefix}***`);
+    s = s.replace(PARAM_PATTERN, (whole, prefix, value) => {
+      if (MASK_SHAPE.test(value)) return whole;
+      return `${prefix}***`;
+    });
+  }
+  return s;
+}
 
 // src/internal/runtime/lifecycle/env-policy.ts
 var SECRET_PATTERNS = [
@@ -91,15 +323,15 @@ var SandboxBackend = class {
       env: config.env ?? "inherit-scrubbed"
     };
   }
-  async readFile(path) {
-    const result = await this.execute(`cat ${this.shellEscape(path)}`);
+  async readFile(path2) {
+    const result = await this.execute(`cat ${this.shellEscape(path2)}`);
     if (result.exitCode !== 0) {
       throw new Error(`readFile failed: ${result.stderr}`);
     }
     return result.stdout;
   }
-  async writeFile(path, content) {
-    await this.uploadFile(path, content);
+  async writeFile(path2, content) {
+    await this.uploadFile(path2, content);
   }
   async glob(pattern, cwd) {
     const dir = cwd ?? this.config.workDir ?? ".";
@@ -109,16 +341,16 @@ var SandboxBackend = class {
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
-  async grep(pattern, path) {
-    const target = path ?? ".";
+  async grep(pattern, path2) {
+    const target = path2 ?? ".";
     const result = await this.execute(
       `grep -rn ${this.shellEscape(pattern)} ${this.shellEscape(target)} 2>/dev/null`
     );
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
-  async listDir(path) {
-    const result = await this.execute(`ls -1 ${this.shellEscape(path)}`);
+  async listDir(path2) {
+    const result = await this.execute(`ls -1 ${this.shellEscape(path2)}`);
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
@@ -176,13 +408,227 @@ var LocalSandbox = class extends SandboxBackend {
       timedOut
     };
   }
-  async uploadFile(path$1, content) {
-    const fullPath = path$1.startsWith("/") ? path$1 : `${this.config.workDir}/${path$1}`;
+  async uploadFile(path2, content) {
+    const fullPath = path2.startsWith("/") ? path2 : `${this.config.workDir}/${path2}`;
     await promises.mkdir(path.dirname(fullPath), { recursive: true });
     await promises.writeFile(fullPath, content, "utf-8");
   }
 };
 
+// src/sandbox/seccomp.ts
+var BPF_LD = 0;
+var BPF_W = 0;
+var BPF_ABS = 32;
+var BPF_JMP = 5;
+var BPF_JEQ = 16;
+var BPF_JGE = 48;
+var BPF_K = 0;
+var BPF_RET = 6;
+var LD_ABS_W = BPF_LD | BPF_W | BPF_ABS;
+var JEQ_K = BPF_JMP | BPF_JEQ | BPF_K;
+var JGE_K = BPF_JMP | BPF_JGE | BPF_K;
+var RET_K = BPF_RET | BPF_K;
+var OFF_NR = 0;
+var OFF_ARCH = 4;
+var OFF_ARG0 = 16;
+var AUDIT_ARCH_X86_64 = 3221225534;
+var X32_BIT = 1073741824;
+var SECCOMP_RET_ALLOW = 2147418112;
+var SECCOMP_RET_ERRNO = 327680;
+var EPERM = 1;
+var RET_EPERM = SECCOMP_RET_ERRNO | EPERM & 65535;
+var SECCOMP_RET_KILL_PROCESS = 2147483648;
+var AF_UNIX = 1;
+var ALWAYS_DENIED = [101, 310, 311, 425, 426, 427];
+var NETWORK_DENIED = [42, 43, 288, 49, 50, 52, 51, 48, 44, 307, 299, 55, 54];
+var SOCKET_SYSCALLS = [41, 53];
+var stmt = (code, k) => ({ code, jt: 0, jf: 0, k });
+var jmp = (code, k, jt, jf) => ({ code, jt, jf, k });
+function buildSeccompFilter(opts) {
+  const insns = [];
+  const ALLOW = /* @__PURE__ */ Symbol("ALLOW");
+  const DENY = /* @__PURE__ */ Symbol("DENY");
+  const KILL = /* @__PURE__ */ Symbol("KILL");
+  const body = [];
+  const push = (code, k, jt = 0, jf = 0) => {
+    body.push({ code, k, jt, jf });
+  };
+  push(LD_ABS_W, OFF_ARCH);
+  push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL);
+  push(LD_ABS_W, OFF_NR);
+  push(JGE_K, X32_BIT, KILL, 0);
+  const denied = opts.networkRestricted ? [...ALWAYS_DENIED, ...NETWORK_DENIED] : [...ALWAYS_DENIED];
+  for (const nr of denied) push(JEQ_K, nr, DENY, 0);
+  if (opts.networkRestricted) {
+    for (const sysno of SOCKET_SYSCALLS) {
+      push(JEQ_K, sysno, 0, 2);
+      push(LD_ABS_W, OFF_ARG0);
+      push(JEQ_K, AF_UNIX, ALLOW, DENY);
+    }
+  }
+  push(RET_K, SECCOMP_RET_ALLOW);
+  const allowIdx = body.length - 1;
+  push(RET_K, RET_EPERM);
+  const denyIdx = body.length - 1;
+  push(RET_K, SECCOMP_RET_KILL_PROCESS);
+  const killIdx = body.length - 1;
+  const resolve = (i, t) => {
+    const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;
+    const off = abs - (i + 1);
+    if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);
+    return off;
+  };
+  for (const [i, b] of body.entries()) {
+    if (b.code === JEQ_K || b.code === JGE_K) {
+      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));
+    } else {
+      insns.push(stmt(b.code, b.k));
+    }
+  }
+  const buf = Buffer.alloc(insns.length * 8);
+  insns.forEach((ins, i) => {
+    buf.writeUInt16LE(ins.code, i * 8);
+    buf.writeUInt8(ins.jt, i * 8 + 2);
+    buf.writeUInt8(ins.jf, i * 8 + 3);
+    buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);
+  });
+  return buf;
+}
+
+// src/sandbox/linux-sandbox.ts
+function shellQuote(s) {
+  return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+function wrapCommandForSandbox(mode, opts, command) {
+  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  if (argv === null) return null;
+  const bin = opts.bin ?? "bwrap";
+  const seccompArgv = opts.seccompPath !== void 0 ? ["--seccomp", "3"] : [];
+  const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, "--"].map(shellQuote).join(" ")} /bin/sh -c ${shellQuote(command)}`;
+  return opts.seccompPath !== void 0 ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;
+}
+var ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "USER",
+  "TMPDIR",
+  "SHELL"
+];
+function allowlistedEnv(source = process.env) {
+  const out = {};
+  for (const k of ENV_ALLOWLIST) {
+    const v = source[k];
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+var LinuxSandbox = class extends LocalSandbox {
+  mode;
+  network;
+  cwd;
+  bin;
+  env;
+  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a
+   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */
+  seccompPath;
+  constructor(config, opts) {
+    super(config);
+    this.mode = opts.mode;
+    this.network = opts.network ?? false;
+    this.cwd = config.workDir ?? process.cwd();
+    this.bin = opts.bin ?? "bwrap";
+    this.env = opts.env ?? allowlistedEnv();
+    this.seccompPath = this.network ? void 0 : restrictedSeccompPath();
+  }
+  /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
+  wrapCommand(command) {
+    return wrapCommandForSandbox(
+      this.mode,
+      {
+        cwd: this.cwd,
+        network: this.network,
+        env: this.env,
+        bin: this.bin,
+        seccompPath: this.seccompPath
+      },
+      command
+    );
+  }
+  execute(command, opts) {
+    const wrapped = this.wrapCommand(command);
+    if (wrapped === null) return super.execute(command, opts);
+    return super.execute(wrapped, opts);
+  }
+};
+var warnedNonX64 = false;
+function seccompPathForArch(arch, warn) {
+  if (arch !== "x64") {
+    if (!warnedNonX64) {
+      warnedNonX64 = true;
+      warn(
+        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`
+      );
+    }
+    return void 0;
+  }
+  try {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ab-seccomp-"));
+    const path2 = path.join(dir, "filter.bpf");
+    fs.writeFileSync(path2, buildSeccompFilter({ networkRestricted: true }));
+    const cleanup = () => fs.rmSync(dir, { recursive: true, force: true });
+    process.once("exit", cleanup);
+    process.once("SIGINT", cleanup);
+    process.once("SIGTERM", cleanup);
+    return path2;
+  } catch (err) {
+    warn(
+      `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
+    );
+    return void 0;
+  }
+}
+var seccompFilterPath;
+function restrictedSeccompPath() {
+  if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
+  const path2 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
+  seccompFilterPath = path2 ?? null;
+  return path2;
+}
+var warnedUnavailable = false;
+function resetSandboxWarnLatch() {
+  warnedUnavailable = false;
+}
+function resolveSandboxPosture(opts) {
+  if (opts.mode === "danger-full-access") {
+    return { mode: opts.mode, enforced: false, detail: "no confinement (danger-full-access)" };
+  }
+  const detection = (opts.detect ?? detectBwrapMemoizado)();
+  if (!detection.ok) {
+    return { mode: opts.mode, enforced: false, detail: `tool-gating only \u2014 ${detection.reason}` };
+  }
+  return { mode: opts.mode, enforced: true, detail: "kernel (bwrap)" };
+}
+function createSandboxBackend(opts) {
+  const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
+  if (opts.mode === "danger-full-access") return new LocalSandbox(config);
+  const detection = (opts.detect ?? detectBwrapMemoizado)();
+  if (!detection.ok) {
+    if (!warnedUnavailable) {
+      warnedUnavailable = true;
+      const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+      warn(
+        `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
+      );
+    }
+    return new LocalSandbox(config);
+  }
+  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+}
+
 // src/errors.ts
 var TheokitAgentError = class extends Error {
   name = "TheokitAgentError";
@@ -248,12 +694,27 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
   return { repoDir };
 }
 
+exports.LinuxSandbox = LinuxSandbox;
 exports.LocalSandbox = LocalSandbox;
 exports.RepoProvisionError = RepoProvisionError;
 exports.SandboxBackend = SandboxBackend;
 exports.SandboxNotAvailableError = SandboxNotAvailableError;
 exports.SandboxSecurityError = SandboxSecurityError;
+exports.allowlistedEnv = allowlistedEnv;
+exports.buildBwrapArgv = buildBwrapArgv;
+exports.buildSeccompFilter = buildSeccompFilter;
+exports.createSandboxBackend = createSandboxBackend;
+exports.detectBwrap = detectBwrap;
+exports.detectBwrapMemoizado = detectBwrapMemoizado;
 exports.provisionRepo = provisionRepo;
+exports.realProbeCount = realProbeCount;
+exports.realProbes = realProbes;
+exports.resetBwrapMemo = resetBwrapMemo;
+exports.resetSandboxWarnLatch = resetSandboxWarnLatch;
 exports.resolveSandbox = resolveSandbox;
+exports.resolveSandboxPosture = resolveSandboxPosture;
+exports.restrictedSeccompPath = restrictedSeccompPath;
+exports.seccompPathForArch = seccompPathForArch;
+exports.wrapCommandForSandbox = wrapCommandForSandbox;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map