npm - @theokit/sdk - Versions diffs - 4.53.0 → 4.53.1 - Mend

@theokit/sdk 4.53.0 → 4.53.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (373) hide show

package/dist/sandbox/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/sandbox/bwrap.ts","../../src/sandbox/seccomp.ts","../../src/sandbox/linux-sandbox.ts","../../src/sandbox/provision.ts"],"names":["path"],"mappings":";;;;;;;;;;AAkCA,SAAS,kBAAA,CAAmB,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAiB,MAAA,EAAsB;AAC9F,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAoB,GAAG,CAAA,OAAQ,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,CAAA;AAC3E,EAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,QAAQ,MAAM,CAAA;AACnD;AAGA,SAAS,oBAAoB,GAAA,EAAgC;AAC3D,EAAA,OAAO,CAAC,KAAK,MAAM,CAAA;AACrB;AAeO,SAAS,gBAAA,CAAiB,MAAmB,GAAA,EAAuC;AACzF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,WAAA;AACH,MAAA,OAAO,EAAC;AAAA,IACV,KAAK,iBAAA;AACH,MAAA,OAAO,oBAAoB,GAAG,CAAA;AAAA,IAChC,KAAK,oBAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AAqBO,SAAS,cAAA,CAAe,MAAmB,IAAA,EAAyC;AACzF,EAAA,IAAI,IAAA,KAAS,sBAAsB,OAAO,IAAA;AAE1C,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AACjC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAgB,UAAA,CAAW,MAAM,CAAA;AAErD,EAAA,MAAM,IAAA,GAAiB;AAAA;AAAA,IAErB,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA;AAAA,IAEA,WAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,KAAK,eAAe,CAAA;AAI5C,EAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,YAAY,CAAA;AACpC,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,GAAI,IAAA,CAAK,GAAA,IAAO,EAAC;AAAA;AAAA,IAEjB,GAAI,IAAA,CAAK,OAAA,GAAU,EAAC,GAAI,EAAE,gCAAgC,GAAA;AAAI,GAChE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,CAAC,CAAA;AAEvE,EAAA,IAAI,SAAS,iBAAA,EAAmB,kBAAA,CAAmB,IAAA,EAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AAG5E,EAAA,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA;AAC9B,EAAA,OAAO,IAAA;AACT;AAeO,SAAS,WAAA,CAAY,SAAsB,UAAA,EAA4B;AAC5E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,EAAM;AACzB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,yBAAA,EAA0B;AAChE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,IAAA,EAAM,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,SAAA,EAAY,GAAG,CAAA,gCAAA,CAAA,EAAmC;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4DAAA,EAA6D;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,uBAAuB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AACF;AASA,IAAI,aAAA,GAAgB,CAAA;AAGb,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,aAAA;AACT;AAGO,IAAM,UAAA,GAA0B;AAAA,EACrC,OAAO,MAAM;AACX,IAAA,aAAA,EAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,EAAE,IAAA,EAAK;AAExF,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,UAAA,CAAW,OAAA,CAAQ,KAAI,GAAI,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,IAAA;AAC7D,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,GAAA,KAAQ;AACjB,IAAA,IAAI;AAEF,MAAA,OAAO,YAAA,CAAa,GAAA,EAAK,CAAC,QAAQ,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,CAAC,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA;AAAA,IAC5D;AAAA,EACF,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,IAAA,IAAI;AAEF,MAAA,YAAA,CAAa,GAAA,EAAK,CAAC,gBAAA,EAAkB,eAAA,EAAiB,aAAa,GAAA,EAAK,GAAA,EAAK,WAAW,CAAA,EAAG;AAAA,QACzF,OAAA,EAAS,GAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;AAsCA,IAAI,IAAA;AAaG,SAAS,mBAAA,CAAoB,SAAsB,UAAA,EAA4B;AACpF,EAAA,IAAA,KAAS,YAAY,MAAM,CAAA;AAC3B,EAAA,IAAI,KAAK,EAAA,IAAM,CAAC,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,EAAG;AACpC,IAAA,IAAA,GAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA,gBAAA,CAAA,EAAmB;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,cAAA,GAAuB;AACrC,EAAA,IAAA,GAAO,MAAA;AACT;;;ACjQA,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,CAAA;AAEhB,IAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,OAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,QAAQ,OAAA,GAAU,KAAA;AAGxB,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,OAAA,GAAU,UAAA;AAGhB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,iBAAA,GAAoB,MAAA;AAC1B,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,SAAA,GAAY,oBAAqB,KAAA,GAAQ,KAAA;AAC/C,IAAM,wBAAA,GAA2B,UAAA;AAEjC,IAAM,OAAA,GAAU,CAAA;AAGhB,IAAM,gBAAgB,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AAEnD,IAAM,cAAA,GAAiB,CAAC,EAAA,EAAI,EAAA,EAAI,KAAK,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,IAAI,EAAE,CAAA;AAE7E,IAAM,eAAA,GAAkB,CAAC,EAAA,EAAI,EAAE,CAAA;AAS/B,IAAM,IAAA,GAAO,CAAC,IAAA,EAAc,CAAA,MAAqB,EAAE,MAAM,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,CAAA,EAAG,CAAA,EAAE,CAAA;AACzE,IAAM,GAAA,GAAM,CAAC,IAAA,EAAc,CAAA,EAAW,EAAA,EAAY,QAAsB,EAAE,IAAA,EAAM,EAAA,EAAI,EAAA,EAAI,CAAA,EAAE,CAAA;AAYnF,SAAS,mBAAmB,IAAA,EAA8B;AAI/D,EAAA,MAAM,QAAgB,EAAC;AAKvB,EAAA,MAAM,KAAA,0BAAe,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAC1B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAQ1B,EAAA,MAAM,OAAgB,EAAC;AACvB,EAAA,MAAM,OAAO,CAAC,IAAA,EAAc,GAAW,EAAA,GAAa,CAAA,EAAG,KAAa,CAAA,KAAY;AAC9E,IAAA,IAAA,CAAK,KAAK,EAAE,IAAA,EAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAA;AAAA,EAC/B,CAAA;AAGA,EAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,EAAA,IAAA,CAAK,KAAA,EAAO,iBAAA,EAAmB,CAAA,EAAG,IAAI,CAAA;AAEtC,EAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,EAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAC,CAAA;AAI5B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,iBAAA,GAChB,CAAC,GAAG,aAAA,EAAe,GAAG,cAAc,CAAA,GACpC,CAAC,GAAG,aAAa,CAAA;AACrB,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,EAAA,EAAI,MAAM,CAAC,CAAA;AAGhD,EAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,IAAA,KAAA,MAAW,SAAS,eAAA,EAAiB;AAEnC,MAAA,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,CAAC,CAAA;AACvB,MAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,MAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AAAA,IAIlC;AAAA,EACF;AAGA,EAAA,IAAA,CAAK,OAAO,iBAAiB,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,GAAS,CAAA;AAC/B,EAAA,IAAA,CAAK,OAAO,SAAS,CAAA;AACrB,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAC9B,EAAA,IAAA,CAAK,OAAO,wBAAwB,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAa9B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,EAAW,CAAA,KAAsB;AAChD,IAAA,MAAM,GAAA,GAAM,CAAA,KAAM,KAAA,GAAQ,QAAA,GAAW,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,CAAA;AAE3F,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,GAAI,CAAA,CAAA;AACvB,IAAA,IAAI,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,GAAA,EAAK,MAAM,IAAI,UAAA,CAAW,CAAA,6BAAA,EAAgC,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1F,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAIA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACnC,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,CAAA,CAAE,SAAS,KAAA,EAAO;AACxC,MAAA,KAAA,CAAM,KAAK,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,CAAC,CAAC,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,KAAK,IAAA,CAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA;AACjC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,cAAc,GAAA,CAAI,CAAA,KAAM,CAAA,EAAG,CAAA,GAAI,IAAI,CAAC,CAAA;AAAA,EAC1C,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;;;AChJA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AASO,SAAS,qBAAA,CACd,IAAA,EACA,IAAA,EAOA,OAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AACzF,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACxB,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,KAAgB,MAAA,GAAY,CAAC,WAAA,EAAa,GAAG,IAAI,EAAC;AAC3E,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAG,WAAA,EAAa,IAAI,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,YAAA,EAAe,UAAA,CAAW,OAAO,CAAC,CAAA,CAAA;AAC3I,EAAA,OAAO,IAAA,CAAK,WAAA,KAAgB,MAAA,GAAY,CAAA,EAAG,IAAI,OAAO,UAAA,CAAW,IAAA,CAAK,WAAW,CAAC,CAAA,CAAA,GAAK,IAAA;AACzF;AAQA,IAAM,aAAA,GAAgB;AAAA,EACpB,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,SAAS,cAAA,CAAe,MAAA,GAA4B,OAAA,CAAQ,GAAA,EAA6B;AAC9F,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,KAAK,aAAA,EAAe;AAC7B,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,YAAA,GAAN,cAA2B,YAAA,CAAa;AAAA,EAC5B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA;AAAA;AAAA,EAGA,WAAA;AAAA,EAEjB,WAAA,CACE,QACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,KAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,MAAA,CAAO,OAAA,IAAW,OAAA,CAAQ,GAAA,EAAI;AAGzC,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACvB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,cAAA,EAAe;AACtC,IAAA,IAAA,CAAK,WAAA,GAAc,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA;AAAA,EACvD;AAAA;AAAA,EAGA,YAAY,OAAA,EAAgC;AAC1C,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAe,UAAA,CAAWA,KAAAA,EAAc,OAAA,EAAyC;AAC/E,IAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,SAA6B,KAAA,CAAM,UAAA,CAAWA,OAAM,OAAO,CAAA;AAE7E,IAAA,MAAM,MAAA,GAASA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAIA,QAAO,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,CAAA,EAAIA,KAAI,CAAA,CAAA;AAChE,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAGlD,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,MACnB,CAAA,SAAA,EAAY,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA,cAAA,EAAiB,UAAA,CAAW,GAAG,CAAC,CAAA,eAAA,EAAkB,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,KAC7G;AACA,IAAA,IAAI,CAAA,CAAE,aAAa,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gDAAA,EAAmD,MAAM,CAAA,GAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAK,IAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAA;AAAA,OACxG;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAA,CAAQ,SAAiB,IAAA,EAA+B;AAC/D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,OAAO,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,SAAS,IAAI,CAAA;AACxD,IAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EACpC;AACF;AAEA,IAAI,YAAA,GAAe,KAAA;AAaZ,SAAS,kBAAA,CAAmB,MAAc,IAAA,EAA+C;AAC9F,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,YAAA,GAAe,IAAA;AACf,MAAA,IAAA;AAAA,QACE,mDAAmD,IAAI,CAAA,mGAAA;AAAA,OAEzD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAO,EAAG,aAAa,CAAC,CAAA;AACrD,IAAA,MAAMA,KAAAA,GAAO,IAAA,CAAK,GAAA,EAAK,YAAY,CAAA;AACnC,IAAA,aAAA,CAAcA,OAAM,kBAAA,CAAmB,EAAE,iBAAA,EAAmB,IAAA,EAAM,CAAC,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,MAAY,MAAA,CAAO,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AACxE,IAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,OAAO,CAAA;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,WAAW,OAAO,CAAA;AAC/B,IAAA,OAAOA,KAAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,yCAAyC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,qFAAA;AAAA,KAE3F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,IAAI,iBAAA;AAEG,SAAS,qBAAA,GAA4C;AAC1D,EAAA,IAAI,iBAAA,KAAsB,MAAA,EAAW,OAAO,iBAAA,IAAqB,MAAA;AACjE,EAAA,MAAMA,KAAAA,GAAO,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,iBAAA,GAAoBA,KAAAA,IAAQ,IAAA;AAC5B,EAAA,OAAOA,KAAAA;AACT;AAEA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,qBAAA,GAA8B;AAC5C,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAcO,SAAS,sBAAsB,IAAA,EAGnB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,oBAAA,EAAsB;AACtC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,qCAAA,EAAsC;AAAA,EAC3F;AACA,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,QAAA,EAAU,OAAO,MAAA,EAAQ,CAAA,wBAAA,EAAsB,SAAA,CAAU,MAAM,CAAA,CAAA,EAAG;AAAA,EAC9F;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,IAAA,EAAM,QAAQ,gBAAA,EAAiB;AACrE;AAoBO,SAAS,qBAAqB,IAAA,EAAmD;AACtF,EAAA,MAAM,SAAwB,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,SAAA,EAAW,KAAK,SAAA,EAAU;AACjF,EAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAI,aAAa,MAAM,CAAA;AAEtE,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,MAAA,IAAA;AAAA,QACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,8DAAA,EACL,KAAK,IAAI,CAAA,EAAA;AAAA,OACrE;AAAA,IACF;AACA,IAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,IAAI,YAAA,CAAa,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,SAAA,CAAU,KAAK,CAAA;AAChG;AAUA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,yBAAA,GAAkC;AAChD,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAgBA,SAAS,sBAAsB,WAAA,EAA0C;AACvE,EAAA,OAAO,WAAA,GAAc,SAAY,qBAAA,EAAsB;AACzD;AAuBA,SAAS,kBAAkB,IAAA,EAA6C;AACtE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAA;AAE/C,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,SAAA,CAAU,EAAA,EAAI,OAAO,SAAA,CAAU,GAAA;AAEnC,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,iBAAA,GAAoB,IAAA;AACpB,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,IAAA,IAAA;AAAA,MACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,2EAAA,EACZ,KAAK,IAAI,CAAA,EAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBO,SAAS,uBACd,IAAA,EACiD;AACjD,EAAA,OAAO,CAAC,SAAiB,GAAA,KAA+B;AACtD,IAAA,MAAM,GAAA,GAAM,kBAAkB,IAAI,CAAA;AAClC,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AAEzB,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,GAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,KAAA;AAAA,QACzB,KAAK,cAAA,EAAe;AAAA,QACpB,GAAA;AAAA,QACA,WAAA,EAAa,qBAAA,CAAsB,IAAA,CAAK,OAAA,IAAW,KAAK;AAAA,OAC1D;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA;AACF;;;AC1WO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EAGxD,WAAA,CACW,UAAA,EACT,OAAA,EACA,OAAA,GAA+B,EAAC,EAChC;AACA,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,UAAU,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,EAAI;AAAA,MAClC,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,KAC/D,CAAA;AARQ,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EATW,UAAA;AAAA,EAHO,IAAA,GAAO,oBAAA;AAa3B;AAyBA,IAAM,gBAAA,GAAmB,8BAAA;AAiBzB,eAAsB,aAAA,CACpB,eACA,SAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,SAAA,KAAc,MAAA,GAAa,aAAA,GAAmC,IAAI,YAAA,EAAa;AAC/F,EAAA,MAAM,OAAO,SAAA,IAAc,aAAA;AAC3B,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAK,UAAA,EAAW,GAAI,IAAA;AAGrC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,0CAAA,EAA6C,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EAC9F;AAIA,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC1B,oDAAoD,gBAAA,CAAiB,OAAO,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,GAC/G;AACA,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,cAAA,EAAiB,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,OAAA;AAAA,IACxB,CAAA,OAAA,EAAU,gBAAA,CAAiB,UAAU,CAAC,CAAA,0BAAA;AAAA,GACxC;AACA,EAAA,IAAI,GAAA,CAAI,aAAa,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,wBAAA,EAA2B,IAAI,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAGhC,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC7B,UAAU,gBAAA,CAAiB,OAAO,CAAC,CAAA,kBAAA,EAAqB,gBAAA,CAAiB,GAAG,CAAC,CAAA;AAAA,GAC/E;AACA,EAAA,IAAI,QAAA,CAAS,aAAa,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,SAAA,EAAY,GAAG,YAAY,QAAA,CAAS,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB","file":"index.js","sourcesContent":["// Promoted out of the agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): kernel\n// confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a pure-JS Buffer.\n\nimport { execFileSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/*\n M53 — bubblewrap argv + honest detection, faithful to Codex's Linux sandbox\n * (`codex-rs/linux-sandbox/src/bwrap.rs` + `codex-rs/sandboxing/src/bwrap.rs`).\n \n HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —\n * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`\n * via `restrictedSeccompPath()`. Ported in M63; this block claimed the opposite until M67 and\n * UNDER-DECLARED the real security posture. The honest limit that remains: the filter is x86_64\n * (an architecture guard refuses to install it on any other arch, with a WARN, and bwrap's FS/network\n * confinement still applies) and it is only installed when the network is restricted\n * (`backend.ts:87`, faithful to `landlock.rs:96-117`): with the network on there is no syscall\n * filter, only bwrap's FS confinement. `danger-full-access` skips bwrap entirely, mirroring\n * `bwrap.rs:245-252`. Deltas versus Codex remain documented in docs/CODEX-PARITY.md.\n /\n\n/\n Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer\n * configuration: `danger-full-access` means \"do not wrap\", and that is a decision belonging to the\n * confinement subsystem.\n /\nexport type SandboxMode = \"read-only\" \| \"workspace-write\" \| \"danger-full-access\";\n\n/\n The RW binds `workspace-write` installs (protocol.rs:1189-1214), plus the metadata protection that\n * must sit ON TOP of them — order matters (permissions.rs:22-31; bwrap.rs:571-597).\n /\nfunction pushWorkspaceBinds(argv: string[], cwd: string, hasGit: boolean, gitDir: string): void {\n for (const root of workspaceWriteRoots(cwd)) argv.push(\"--bind\", root, root);\n if (hasGit) argv.push(\"--ro-bind\", gitDir, gitDir);\n}\n\n/* The RW binds `workspace-write` installs (protocol.rs:1189-1214): the workspace itself, and /tmp. /\nfunction workspaceWriteRoots(cwd: string): readonly string[] {\n return [cwd, \"/tmp\"];\n}\n\n/\n U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.\n \n `[]` means nothing is writable; `null` means unrestricted — which is not the same as `[\"/\"]`,\n * because unrestricted is the absence of a root rather than a root that happens to be `/`.\n \n The SDK already knew this: `buildBwrapArgv` binds these exact paths. It only knew it while\n * BUILDING an argv, and a consumer needs the answer earlier — tools are scoped at agent\n * construction, before any process exists, and a file-write tool has to be told its root then. With\n * nothing to ask, consumers keep a second encoding of this three-mode vocabulary and it drifts from\n * the argv builder with nothing to catch it. This reads from the same helper the builder uses, so\n * the two cannot disagree.\n /\nexport function writableRootsFor(mode: SandboxMode, cwd: string): readonly string[] \| null {\n switch (mode) {\n case \"read-only\":\n return [];\n case \"workspace-write\":\n return workspaceWriteRoots(cwd);\n case \"danger-full-access\":\n return null;\n }\n}\n\nexport interface BwrapArgvOptions {\n /* Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). /\n cwd: string;\n /* `true` removes `--unshare-net` (policy `network_access`, default false). /\n network?: boolean;\n /* Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. /\n gitDirExists?: boolean;\n /\n When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,\n * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the\n * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).\n /\n env?: Record<string, string>;\n}\n\n/\n Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),\n * or `null` when the policy skips the sandbox entirely (`danger-full-access`).\n /\nexport function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] \| null {\n if (mode === \"danger-full-access\") return null; // bwrap skipped entirely (bwrap.rs:245-252)\n\n const cwd = path.resolve(opts.cwd);\n const gitDir = path.join(cwd, \".git\");\n const hasGit = opts.gitDirExists ?? existsSync(gitDir);\n\n const argv: string[] = [\n // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)\n \"--new-session\",\n \"--die-with-parent\",\n \"--unshare-user\",\n \"--unshare-pid\",\n // full-read filesystem base (bwrap.rs:446-452)\n \"--ro-bind\",\n \"/\",\n \"/\",\n \"--dev\",\n \"/dev\",\n \"--proc\",\n \"/proc\",\n ];\n\n if (!opts.network) argv.push(\"--unshare-net\"); // network off by default (bwrap.rs:325-327)\n\n // env confinement — `--clearenv` MUST precede every `--setenv` or the clear wipes them\n // (exec_env.rs:25-31 clears then rebuilds). Only when an explicit allowlist is provided.\n if (opts.env) argv.push(\"--clearenv\");\n const setenv: Record<string, string> = {\n ...(opts.env ?? {}),\n // the flag signals the child that network is unshared (spawn.rs:20,79)\n ...(opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: \"1\" }),\n };\n for (const [k, v] of Object.entries(setenv)) argv.push(\"--setenv\", k, v);\n\n if (mode === \"workspace-write\") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);\n // read-only: zero writable roots (protocol.rs:1176) — nothing to add\n\n argv.push(\"--chdir\", cwd, \"--\");\n return argv;\n}\n\n/* Injectable probes — each mirrors one Codex availability check. /\nexport interface BwrapProbes {\n /* `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). /\n which: () => string \| null;\n /* `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). /\n helpText: (bin: string) => string \| null;\n /* Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). /\n userns: (bin: string) => boolean;\n}\n\nexport type BwrapDetection = { ok: true; bin: string } \| { ok: false; reason: string };\n\n/* Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). /\nexport function detectBwrap(probes: BwrapProbes = realProbes): BwrapDetection {\n try {\n const bin = probes.which();\n if (!bin) return { ok: false, reason: \"bwrap not found in PATH\" };\n const help = probes.helpText(bin);\n if (!help?.includes(\"--perms\")) {\n return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };\n }\n if (!probes.userns(bin)) {\n return { ok: false, reason: \"user namespaces unavailable (container/kernel restriction)\" };\n }\n return { ok: true, bin };\n } catch (err) {\n return {\n ok: false,\n reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n}\n\n/\n How many times the REAL probe ran in this process.\n \n Instrumented here rather than in a wrapper, because this is where the cost is: every `which`\n * spawns a subprocess (`which bwrap`), and the full probe cost 22.2 ms. A gate counting INJECTED\n * probes does not see the real one — that was the M71 gate's first mistake, and a mutant exposed it.\n /\nlet realProbeRuns = 0;\n\n/* How many real probes ran. TEST seam — the performance gate counts this. /\nexport function realProbeCount(): number {\n return realProbeRuns;\n}\n\n/* Real probes used in production. /\nexport const realProbes: BwrapProbes = {\n which: () => {\n realProbeRuns++;\n try {\n const out = execFileSync(\"which\", [\"bwrap\"], { encoding: \"utf8\", timeout: 2_000 }).trim();\n // anti-hijack: never accept a bwrap that lives inside the workspace (bwrap.rs:168-191)\n if (!out \|\| out.startsWith(process.cwd() + path.sep)) return null;\n return out;\n } catch {\n return null;\n }\n },\n helpText: (bin) => {\n try {\n // bwrap --help exits 0/1 depending on version; capture output either way\n return execFileSync(bin, [\"--help\"], { encoding: \"utf8\", timeout: 2_000 });\n } catch (err) {\n const e = err as { stdout?: string; stderr?: string };\n return [e.stdout, e.stderr].filter(Boolean).join(\"\\n\") \|\| null;\n }\n },\n userns: (bin) => {\n try {\n // active probe, 500ms budget like Codex (sandboxing/src/bwrap.rs:74-136)\n execFileSync(bin, [\"--unshare-user\", \"--unshare-net\", \"--ro-bind\", \"/\", \"/\", \"/bin/true\"], {\n timeout: 500,\n stdio: \"ignore\",\n });\n return true;\n } catch {\n return false;\n }\n },\n};\n\n/\n The probe result, memoized for the lifetime of the PROCESS.\n \n Measured before M71: `detectBwrap()` costs 22.2 ms and was not memoized — the second call\n * cost 19.4 ms. `buildChatAgent` on the headless path fired two (one from\n * `createSandboxBackend`, another from `resolveSandboxPosture`, which M70 added), totalling 46.4 ms\n * per construction — and construction happens per turn. Under `strace`, ~90% of the 182 syscalls of\n * an already-warm construction came from here: `which` sweeping the PATH, `/proc/filesystems`,\n * `/newroot`, and the `.so` files the two probe subprocesses load.\n \n ## Why there is no invalidation\n \n The milestone called for invalidating on `SessionStart`. That does not work:\n * `agents/lib/hooks/hooks.ts:28-30` documents — as a measured correction of an earlier\n * assumption — that the event fires once per TURN, not per session. Invalidating there would\n * re-probe every turn, exactly the behavior memoization exists to eliminate.\n \n The reference does not invalidate either: Codex's only real cache is a write-once `OnceLock`\n * (`codex-rs/linux-sandbox/src/launcher.rs:52`), and its expensive probe runs once per process,\n * only to print a UI warning (`sandboxing/src/bwrap.rs:40-72`).\n \n The price, stated plainly — in BOTH directions. The original m71-cost-per-turn#ADR-1 declared\n * only one of them; the M71 review (F-perf-9) showed the omitted one was precisely the one with a\n * security consequence:\n \n - Stale negative (`bwrap` installed AFTERWARDS): not detected until restart. The system fails\n * CLOSED — the posture reports `enforced: false` and M70's veto refuses. Cost: annoyance (the\n * message tells you to install the bwrap you just installed). Accepted.\n * - Stale positive (`bwrap` removed/renamed AFTERWARDS): the posture would keep asserting\n * `enforced: true / \"kernel (bwrap)\"` and the veto would approve, citing a confinement that no\n * longer exists. That is the literal reintroduction of the defect M70 fixed — \"telling the\n operator they are protected when they are not is worse than saying nothing\". Before M71 the\n per-turn re-probe closed that window on the next turn; memoization would leave it open for the\n * whole process. That is why the positive is revalidated below, at 1 syscall — 3 orders of\n * magnitude below the 22.2 ms of the full probe, which is the cost memoization exists to remove.\n /\nlet memo: BwrapDetection \| undefined;\n\n/\n `detectBwrap` with memoization — what production should call.\n \n Note that `detectBwrap` itself does not memoize, on purpose: it accepts injected probes, and\n * memoizing there would let a test with fake probes poison the process cache for everyone else.\n \n Revalidating the positive is NOT a re-probe: `detectBwrap` spends three probes (a `which`\n * subprocess + `--help` + a user namespace). Here we only confirm the validated binary is still in\n * place. If it vanished, the memo is downgraded to a negative with the reason stated — never\n * promoted to a positive, which would require the expensive probe back.\n /\nexport function detectBwrapMemoized(probes: BwrapProbes = realProbes): BwrapDetection {\n memo ??= detectBwrap(probes);\n if (memo.ok && !existsSync(memo.bin)) {\n memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };\n }\n return memo;\n}\n\n/* TEST seam — clears the memo. Production never calls it (see m71-cost-per-turn#ADR-1). /\nexport function resetBwrapMemo(): void {\n memo = undefined;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): confinement with\n// kernel confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// no dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a Buffer in pure JS.\n\n/\n M63 — cBPF seccomp filter generator, byte-faithful to Codex's Linux sandbox\n * (`codex-rs/linux-sandbox/src/landlock.rs:179-216`). Produces a raw `sock_filter[]` program (the exact\n * shape `bwrap --seccomp <fd>` consumes) so agent-builder ports Codex's syscall confinement WITHOUT a\n * native helper — bwrap applies `PR_SET_NO_NEW_PRIVS` + the filter before `execve`.\n \n Semantics (landlock.rs:252-253): default action = ALLOW; per-syscall match = ERRNO(EPERM). KILL is\n * used ONLY by the architecture/x32 guard. x86_64 only in v1 (aarch64 is a documented delta).\n /\n\n// BPF opcodes (linux/bpf_common.h)\nconst BPF_LD = 0x00;\nconst BPF_W = 0x00;\nconst BPF_ABS = 0x20;\nconst BPF_JMP = 0x05;\nconst BPF_JEQ = 0x10;\nconst BPF_JGE = 0x30;\nconst BPF_K = 0x00;\nconst BPF_RET = 0x06;\n\nconst LD_ABS_W = BPF_LD \| BPF_W \| BPF_ABS; // 0x20\nconst JEQ_K = BPF_JMP \| BPF_JEQ \| BPF_K; // 0x15\nconst JGE_K = BPF_JMP \| BPF_JGE \| BPF_K; // 0x35\nconst RET_K = BPF_RET \| BPF_K; // 0x06\n\n// seccomp_data offsets (little-endian): nr@0, arch@4, args[0] low dword @16\nconst OFF_NR = 0;\nconst OFF_ARCH = 4;\nconst OFF_ARG0 = 16;\n\nconst AUDIT_ARCH_X86_64 = 0xc000003e;\nconst X32_BIT = 0x40000000; // nr >= this ⇒ x32 ABI ⇒ reject\n\n// seccomp return actions (linux/seccomp.h)\nconst SECCOMP_RET_ALLOW = 0x7fff0000;\nconst SECCOMP_RET_ERRNO = 0x00050000;\nconst EPERM = 1;\nconst RET_EPERM = SECCOMP_RET_ERRNO \| (EPERM & 0xffff); // 0x00050001\nconst SECCOMP_RET_KILL_PROCESS = 0x80000000;\n\nconst AF_UNIX = 1;\n\n/* Always-denied, network-independent (landlock.rs:179-184). /\nconst ALWAYS_DENIED = [101, 310, 311, 425, 426, 427]; // ptrace, process_vm_readv/writev, io_uring_setup/enter/register\n/* Denied only when the network is restricted (landlock.rs:188-204). recvfrom(45)/sendmsg(46) are NOT here. /\nconst NETWORK_DENIED = [42, 43, 288, 49, 50, 52, 51, 48, 44, 307, 299, 55, 54];\n/* socket(2) / socketpair(2) — conditional on domain != AF_UNIX (landlock.rs:206-216). /\nconst SOCKET_SYSCALLS = [41, 53];\n\n/* One `sock_filter` instruction: `{u16 code, u8 jt, u8 jf, u32 k}`. /\ninterface Insn {\n code: number;\n jt: number;\n jf: number;\n k: number;\n}\nconst stmt = (code: number, k: number): Insn => ({ code, jt: 0, jf: 0, k });\nconst jmp = (code: number, k: number, jt: number, jf: number): Insn => ({ code, jt, jf, k });\n\nexport interface SeccompOptions {\n /* When true (network off), also deny the socket set + non-AF_UNIX socket(). /\n networkRestricted: boolean;\n}\n\n/\n Build the cBPF seccomp program as a `Buffer` (each `sock_filter` = 8 bytes). Jump targets are\n * expressed against labels and back-patched to relative offsets, so the layout is deterministic and\n * unit-testable against the authoritative syscall list.\n /\nexport function buildSeccompFilter(opts: SeccompOptions): Buffer {\n // We assemble with symbolic targets, then resolve to relative jumps. To keep the classic\n // \"deny → jump to a single DENY return; else fall through\" shape, DENY and ALLOW live at the END and\n // every JEQ jumps FORWARD to them. jt/jf carry the DISTANCE (in instructions) to the target.\n const insns: Insn[] = [];\n\n // Placeholder labels resolved after we know total length.\n // Layout: [arch guard][x32 guard][LD nr][deny checks...][socket checks...][ALLOW][DENY][KILL]\n // We build the body first with jumps to ALLOW/DENY/KILL as sentinel indices, then patch.\n const ALLOW = Symbol(\"ALLOW\");\n const DENY = Symbol(\"DENY\");\n const KILL = Symbol(\"KILL\");\n type Target = typeof ALLOW \| typeof DENY \| typeof KILL \| number;\n interface SInsn {\n code: number;\n k: number;\n jt: Target;\n jf: Target;\n }\n const body: SInsn[] = [];\n const push = (code: number, k: number, jt: Target = 0, jf: Target = 0): void => {\n body.push({ code, k, jt, jf });\n };\n\n // --- arch guard: arch == x86_64 ? continue : KILL ---\n push(LD_ABS_W, OFF_ARCH);\n push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL); // if != → KILL\n // --- x32 guard: nr >= 0x40000000 ? KILL : continue ---\n push(LD_ABS_W, OFF_NR);\n push(JGE_K, X32_BIT, KILL, 0); // if >= → KILL\n // nr already loaded; keep it loaded for the deny checks.\n\n // --- unconditional denials → DENY ---\n const denied = opts.networkRestricted\n ? [...ALWAYS_DENIED, ...NETWORK_DENIED]\n : [...ALWAYS_DENIED];\n for (const nr of denied) push(JEQ_K, nr, DENY, 0); // if nr == syscall → DENY\n\n // --- socket-family: socket(41)/socketpair(53) → allow only AF_UNIX (only when restricted) ---\n if (opts.networkRestricted) {\n for (const sysno of SOCKET_SYSCALLS) {\n // if nr == socket → check domain; else skip the 2 domain-check instructions\n push(JEQ_K, sysno, 0, 2); // match: fall through to the LD/JEQ; no-match: jump +2 (past them)\n push(LD_ABS_W, OFF_ARG0); // load domain (args[0] low dword)\n push(JEQ_K, AF_UNIX, ALLOW, DENY); // AF_UNIX → ALLOW, else DENY\n // NOTE: after these, nr is NO LONGER in the accumulator — but every remaining syscall check\n // reloads via a fresh LD? No: the remaining path is only ALLOW. socket checks are LAST before\n // the tail, so a fall-through (non-socket syscall that reached here) goes straight to ALLOW.\n }\n }\n\n // --- tail ---\n push(RET_K, SECCOMP_RET_ALLOW); // ALLOW label target\n const allowIdx = body.length - 1;\n push(RET_K, RET_EPERM); // DENY\n const denyIdx = body.length - 1;\n push(RET_K, SECCOMP_RET_KILL_PROCESS); // KILL\n const killIdx = body.length - 1;\n\n // --- resolve symbolic targets to relative offsets ---\n // The branching IS the cBPF program: ALLOW/DENY/KILL are symbolic targets resolved to an\n // offset RELATIVE to the next instruction. Breaking it into helpers does not reduce real complexity —\n // it moves the jump arithmetic to another file and makes auditing against landlock.rs harder, the\n // the authoritative source.\n //\n // Not refactoring NOW is an M75 process decision: this function is being MIGRATED without behavior\n // change (plan m75, D4) and there is still no byte-for-byte equivalence oracle against the\n // original version. Refactoring security without that oracle is changing the lock in the dark.\n // Revisit when the parity gate (T4.2) is green — the oracle exists then.\n // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n const resolve = (i: number, t: Target): number => {\n const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;\n // BPF jump offset is relative to the NEXT instruction: target - (i + 1)\n const off = abs - (i + 1);\n if (off < 0 \|\| off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);\n return off;\n };\n // `for...of` over entries instead of a raw index: the SDK compiles with `noUncheckedIndexedAccess`, which\n // (correctly) types `body[i]` as possibly undefined. Iterating gives the guarantee in the type instead\n // requiring a `!` — the code already could not leave the range, and now the compiler knows it.\n for (const [i, b] of body.entries()) {\n if (b.code === JEQ_K \|\| b.code === JGE_K) {\n insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));\n } else {\n insns.push(stmt(b.code, b.k));\n }\n }\n\n const buf = Buffer.alloc(insns.length 8);\n insns.forEach((ins, i) => {\n buf.writeUInt16LE(ins.code, i * 8);\n buf.writeUInt8(ins.jt, i * 8 + 2);\n buf.writeUInt8(ins.jf, i * 8 + 3);\n buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);\n });\n return buf;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1). Renamed from\n// `BwrapSandbox` to `LinuxSandbox`: bwrap is the IMPLEMENTATION, Linux is the contract — swapping the\n// mechanism (landlock, for example) should not change the name the consumer imports.\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { redactSecrets } from \"../internal/security/redact.js\";\nimport type { BwrapDetection, SandboxMode } from \"./bwrap.js\";\nimport { buildBwrapArgv, detectBwrapMemoized } from \"./bwrap.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { buildSeccompFilter } from \"./seccomp.js\";\nimport type { SandboxBackend, SandboxConfig } from \"./types.js\";\n\n/*\n M53 — kernel-enforced sandbox backend, injected into `createShellTool({ sandbox })`.\n \n `LinuxSandbox extends LocalSandbox` and only REWRITES the command: `<bwrap-bin> <policy flags> --\n * /bin/sh -c '<original>'`. Everything else (spawn, output caps, timeout, ExecuteResult shape, file\n * ops) is inherited — the SDK backend stays the single execution engine. Mirrors Codex's\n * `SandboxManager::transform` (argv prefixing before spawn, never in-process).\n /\n\n/* POSIX single-quote escaping — the inner command crosses ONE extra `/bin/sh -c` boundary. /\nfunction shellQuote(s: string): string {\n return `'${s.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\n/\n M57 — the single source of truth for the sandbox command wrap. Turns `command` into\n * `<bin> <bwrap flags> [--seccomp 3] -- /bin/sh -c '<command>' [3< <bpf>]`, or `null` when the policy\n * skips the sandbox (`danger-full-access`). Extracted from `LinuxSandbox.wrapCommand` so the interactive\n * PTY backend (M57) can reuse the EXACT wrap the one-shot `run_shell` already uses (DRY) — faithful to\n * Codex, where the sandbox transforms the argv before the PTY spawns it (`sandboxing/src/manager.rs:321`).\n /\nexport function wrapCommandForSandbox(\n mode: SandboxMode,\n opts: {\n cwd: string;\n network?: boolean;\n env?: Record<string, string>;\n bin?: string;\n seccompPath?: string;\n },\n command: string,\n): string \| null {\n const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });\n if (argv === null) return null; // danger-full-access: bwrap skipped\n const bin = opts.bin ?? \"bwrap\";\n const seccompArgv = opts.seccompPath !== undefined ? [\"--seccomp\", \"3\"] : [];\n const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, \"--\"].map(shellQuote).join(\" \")} /bin/sh -c ${shellQuote(command)}`;\n return opts.seccompPath !== undefined ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;\n}\n\n/\n Env allowlist re-injected inside the sandbox after `--clearenv`. Codex env_clear model: the child\n * gets exactly what it needs to run a shell, never the parent's full env (which may hold oddly-named\n * secrets the SDK name-pattern scrub misses). `CODEX_SANDBOX_NETWORK_DISABLED` is added by the argv\n * builder when network is unshared.\n /\nconst ENV_ALLOWLIST = [\n \"PATH\",\n \"HOME\",\n \"LANG\",\n \"LC_ALL\",\n \"LC_CTYPE\",\n \"TERM\",\n \"USER\",\n \"TMPDIR\",\n \"SHELL\",\n];\n\nexport function allowlistedEnv(source: NodeJS.ProcessEnv = process.env): Record<string, string> {\n const out: Record<string, string> = {};\n for (const k of ENV_ALLOWLIST) {\n const v = source[k];\n if (v !== undefined) out[k] = v;\n }\n return out;\n}\n\nexport class LinuxSandbox extends LocalSandbox {\n private readonly mode: SandboxMode;\n private readonly network: boolean;\n private readonly cwd: string;\n private readonly bin: string;\n private readonly env: Record<string, string>;\n /* M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a\n * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). /\n private readonly seccompPath: string \| undefined;\n\n constructor(\n config: SandboxConfig,\n opts: { mode: SandboxMode; network?: boolean; bin?: string; env?: Record<string, string> },\n ) {\n super(config);\n this.mode = opts.mode;\n this.network = opts.network ?? false;\n this.cwd = config.workDir ?? process.cwd();\n // MEDIUM-1: run the VALIDATED absolute binary from detection (anti-hijack), never bare `bwrap`\n // which the outer shell would re-resolve via $PATH at spawn time (TOCTOU / hijack window).\n this.bin = opts.bin ?? \"bwrap\";\n this.env = opts.env ?? allowlistedEnv();\n this.seccompPath = seccompPathForNetwork(this.network);\n }\n\n /* Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). /\n wrapCommand(command: string): string \| null {\n return wrapCommandForSandbox(\n this.mode,\n {\n cwd: this.cwd,\n network: this.network,\n env: this.env,\n bin: this.bin,\n seccompPath: this.seccompPath,\n },\n command,\n );\n }\n\n /\n M75 review (architecture, HIGH) — without this override the class LIED.\n \n `LinuxSandbox` documents itself as a \"kernel-enforced sandbox backend\", but it overrode only\n * `execute`. `uploadFile` stayed the one inherited from `LocalSandbox`, which writes straight to\n * the host via `fs/promises` and accepts an ABSOLUTE path — no bwrap, no seccomp, no path\n * restriction. And `SandboxBackend.writeFile` delegates to it. The result was an incoherent class:\n * reading, searching and listing went through the confinement; writing did not.\n \n Routing through the wrapped `execute` fixes it at the root: writes come to live under the SAME\n * policy as everything else — if bwrap denies the path, the write fails, as it should. The content\n * goes over stdin (not argv) because argv has a size limit and file content does not.\n /\n override async uploadFile(path: string, content: string \| Buffer): Promise<void> {\n if (this.mode === \"danger-full-access\") return super.uploadFile(path, content);\n\n const target = path.startsWith(\"/\") ? path : `${this.cwd}/${path}`;\n const b64 = Buffer.from(content).toString(\"base64\");\n // base64 on a single line: avoids any shell quoting over arbitrary content, which is exactly\n // where a \"confined\" write would turn into command injection.\n const r = await this.execute(\n `mkdir -p ${shellQuote(dirname(target))} && printf %s ${shellQuote(b64)} \| base64 -d > ${shellQuote(target)}`,\n );\n if (r.exitCode !== 0) {\n throw new Error(\n `uploadFile blocked or failed under confinement (${target}): ${r.stderr.trim() \|\| `exit ${r.exitCode}`}`,\n );\n }\n }\n\n override execute(command: string, opts?: { timeoutMs?: number }) {\n const wrapped = this.wrapCommand(command);\n if (wrapped === null) return super.execute(command, opts); // danger-full-access: plain local\n return super.execute(wrapped, opts);\n }\n}\n\nlet warnedNonX64 = false;\n\n/\n M63 — the restricted-network seccomp program is DETERMINISTIC, so write it ONCE per process and\n * reuse the path across every LinuxSandbox (no per-instance temp accumulation).\n \n ARCH GUARD (review HIGH): `buildSeccompFilter` emits an x86_64 program whose arch guard KILLs every\n * syscall whose `seccomp_data.arch != AUDIT_ARCH_X86_64`. On a non-x86_64 host that would brick EVERY\n * sandboxed command (the first execve is killed) — and silently, because generation succeeds and bwrap\n * accepts it. So we REFUSE to install on non-x64 and WARN through the honest-downgrade channel (bwrap\n * FS/network confinement still applies), exactly like the bwrap-missing fallback. `arch` is injectable\n * for tests. Cleaned on exit AND on SIGINT/SIGTERM (TUI Ctrl+C would otherwise leak the temp dir).\n /\nexport function seccompPathForArch(arch: string, warn: (m: string) => void): string \| undefined {\n if (arch !== \"x64\") {\n if (!warnedNonX64) {\n warnedNonX64 = true;\n warn(\n `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) — running without ` +\n \"the filter; bwrap FS/network confinement still applies.\",\n );\n }\n return undefined;\n }\n try {\n const dir = mkdtempSync(join(tmpdir(), \"ab-seccomp-\"));\n const path = join(dir, \"filter.bpf\");\n writeFileSync(path, buildSeccompFilter({ networkRestricted: true }));\n const cleanup = (): void => rmSync(dir, { recursive: true, force: true });\n process.once(\"exit\", cleanup);\n process.once(\"SIGINT\", cleanup);\n process.once(\"SIGTERM\", cleanup);\n return path;\n } catch (err) {\n warn(\n `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) — ` +\n \"running without syscall filter (bwrap FS/network confinement still applies).\",\n );\n return undefined;\n }\n}\n\nlet seccompFilterPath: string \| undefined \| null; // undefined = not tried; null = resolved absent\n/* M57 — exported so the interactive PTY backend reuses the SAME memoized x64-gated seccomp program. /\nexport function restrictedSeccompPath(): string \| undefined {\n if (seccompFilterPath !== undefined) return seccompFilterPath ?? undefined;\n const path = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));\n seccompFilterPath = path ?? null;\n return path;\n}\n\nlet warnedUnavailable = false;\n\n/* Test seam: reset the WARN-once latch. /\nexport function resetSandboxWarnLatch(): void {\n warnedUnavailable = false;\n}\n\n/* Durable sandbox posture for the UI — the honest answer to \"am I kernel-enforced right now?\". /\nexport interface SandboxPosture {\n mode: SandboxMode;\n enforced: boolean;\n detail: string;\n}\n\n/\n MEDIUM-2: compute the posture so a surface (TUI footer) can show enforcement DURABLY instead of a\n * one-shot warn. `danger-full-access` is honestly reported as unenforced; an unavailable bwrap reports\n * the downgrade reason so the user never believes they are confined when they are not.\n /\nexport function resolveSandboxPosture(opts: {\n mode: SandboxMode;\n detect?: () => BwrapDetection;\n}): SandboxPosture {\n if (opts.mode === \"danger-full-access\") {\n return { mode: opts.mode, enforced: false, detail: \"no confinement (danger-full-access)\" };\n }\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (!detection.ok) {\n return { mode: opts.mode, enforced: false, detail: `tool-gating only — ${detection.reason}` };\n }\n return { mode: opts.mode, enforced: true, detail: \"kernel (bwrap)\" };\n}\n\nexport interface CreateSandboxBackendOptions {\n mode: SandboxMode;\n workDir?: string;\n network?: boolean;\n timeoutMs?: number;\n /* Injectable for tests; defaults to the real 3-probe detection. /\n detect?: () => BwrapDetection;\n /* Injectable for tests; defaults to console.warn. /\n warn?: (message: string) => void;\n}\n\n/\n Honest factory: bwrap available + mode wants confinement → `LinuxSandbox` (kernel enforcement,\n * running the VALIDATED absolute bin); `danger-full-access` → plain `LocalSandbox` silently (explicit\n * opt-out, `bwrap.rs:245-252`); bwrap unavailable → WARN once + `LocalSandbox` (the declarative M23\n * gating remains the guard). NEVER pretends to sandbox — the fallback is loud, mirroring Codex's\n * MISSING_BWRAP_WARNING. The durable posture lives in `resolveSandboxPosture` for the UI.\n /\nexport function createSandboxBackend(opts: CreateSandboxBackendOptions): SandboxBackend {\n const config: SandboxConfig = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };\n if (opts.mode === \"danger-full-access\") return new LocalSandbox(config);\n\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (!detection.ok) {\n if (!warnedUnavailable) {\n warnedUnavailable = true;\n const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n warn(\n `[sandbox] OS-level enforcement unavailable (${detection.reason}) — ` +\n `falling back to tool-level gating only (sandbox_mode=${opts.mode}).`,\n );\n }\n return new LocalSandbox(config);\n }\n return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });\n}\n\n/\n M75 T3.2 — warning latch for the INTERACTIVE path.\n \n Kept separate from `createSandboxBackend`'s latch on purpose: they are two distinct decisions\n * taken at distinct moments, and a user who only ever runs an interactive shell needs to see the\n * warning even if the non-interactive path already emitted it — otherwise the session where they\n * actually type commands would be the one without the alert.\n /\nlet interactiveWarned = false;\n\n/* Reset for tests — the latch is module state and tests need isolation. /\nexport function resetInteractiveWarnLatch(): void {\n interactiveWarned = false;\n}\n\n/\n The rule \"seccomp ONLY with restricted network\" — in ONE place.\n \n Codex installs the filter only when the network is closed (`landlock.rs:96-117`), and that is not\n * a detail: the cBPF program denies the network syscalls (`NETWORK_DENIED`). Applying it with\n * the network open produces the worst possible combination — bwrap allows the network (no\n * `--unshare-net`) and seccomp denies it with EPERM. The user asked for network, got the bind,\n * and the calls die.\n \n It existed duplicated: the constructor decided conditionally, `interactiveWrapCommand` installed\n * unconditionally. They had already diverged in the first version (M75 architecture review, proven\n * at runtime: `network:true` gave `--seccomp` interactively and not one-shot). Two copies of a\n * security rule is not duplicated form — it is duplicated KNOWLEDGE, and it had already diverged.\n /\nfunction seccompPathForNetwork(networkOpen: boolean): string \| undefined {\n return networkOpen ? undefined : restrictedSeccompPath();\n}\n\nexport interface InteractiveWrapOptions {\n mode: SandboxMode;\n /* `true` keeps the network. Default `false`, same as non-interactive `run_shell`. /\n network?: boolean;\n /* Injectable for tests; defaults to the real memoized detection. /\n detect?: () => BwrapDetection;\n /* Injectable for tests; defaults to `console.warn` with redaction. /\n warn?: (message: string) => void;\n}\n\n/\n The decision to confine or degrade, separated from the wrap itself.\n \n Extracted because they are two responsibilities and the SDK's complexity gate separated them for\n * us: DECIDING (is confinement available? did the user opt out?) and APPLYING (assembling the argv).\n * Keeping them together pushed the closure past 10 cognitive complexity — and the linter was right:\n * the deciding part is the one with security consequences and deserves to be read on its own.\n \n Returns the validated binary when confinement exists, or `null` when it does not — warning ONCE,\n * and only when the absence is a failure (not when it is an opt-out).\n /\nfunction decideConfinement(opts: InteractiveWrapOptions): string \| null {\n if (opts.mode === \"danger-full-access\") return null;\n\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (detection.ok) return detection.bin;\n\n if (!interactiveWarned) {\n interactiveWarned = true;\n const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n warn(\n `[sandbox] OS-level enforcement unavailable (${detection.reason}) — interactive session ` +\n `runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`,\n );\n }\n return null;\n}\n\n/\n The composition the interactive path needs — the counterpart of `createSandboxBackend`.\n \n `createSandboxBackend` solves this for the non-interactive path by returning a ready BACKEND. The\n * PTY accepts no backend: it owns the spawn and only allows transforming the command. This function\n * delivers the SAME decision in the shape the PTY accepts — `(command, cwd) => string \| null` —\n * ready for `new PtyInteractiveBackend({ wrapCommand: interactiveWrapCommand({ mode }) })`.\n \n Detection is consulted on every wrap, not frozen at construction: an interactive session lives\n * for hours, and a stale positive detection would keep asserting confinement after the binary\n * disappeared (the `existsSync` revalidation lives inside `detectBwrapMemoized`).\n \n The two routes returning `null` are semantically different and the code does not merge them:\n * `danger-full-access` is an explicit opt-out and does NOT warn; bwrap being unavailable is a\n * failure and warns once.\n /\nexport function interactiveWrapCommand(\n opts: InteractiveWrapOptions,\n): (command: string, cwd: string) => string \| null {\n return (command: string, cwd: string): string \| null => {\n const bin = decideConfinement(opts);\n if (bin === null) return null;\n\n return wrapCommandForSandbox(\n opts.mode,\n {\n cwd,\n network: opts.network ?? false,\n env: allowlistedEnv(),\n bin,\n seccompPath: seccompPathForNetwork(opts.network ?? false),\n },\n command,\n );\n };\n}\n","/\n M6-3 — portable repo provisioner for the eval harness.\n \n Clones a repository and checks out a ref into an isolated working dir, issuing\n * every git command through {@link SandboxBackend.execute} (ADR D2 — same code\n * runs on Local/Docker/E2B; never a direct `child_process` import). Promotes\n * theocode's `prepareRepo` (`swebench-provision.ts:37`) onto the SDK's sandbox\n * abstraction.\n \n reference: knowledge-base/references/theocode-eval/lib/swebench-provision.ts:37\n * (clone+checkout), :13 (ProvisionError with instanceId).\n \n @public\n /\n\nimport { TheokitAgentError } from \"../errors.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { shellEscapePosix } from \"./shell-escape.js\";\nimport type { SandboxBackend } from \"./types.js\";\n\n/\n Raised when cloning or checking out a repo fails. Carries the `instanceId`\n * so a batch run can attribute the failure to the offending dataset row.\n /\nexport class RepoProvisionError extends TheokitAgentError {\n override readonly name = \"RepoProvisionError\";\n\n constructor(\n readonly instanceId: string,\n message: string,\n options: { cause?: unknown } = {},\n ) {\n super(`[${instanceId}] ${message}`, {\n code: \"repo_provision_failed\",\n isRetryable: false,\n ...(options.cause !== undefined ? { cause: options.cause } : {}),\n });\n }\n}\n\n/* Options for {@link provisionRepo}. /\nexport interface ProvisionRepoOptions {\n /\n Clonable repo URL or local path. SECURITY: when this comes from an\n * untrusted dataset, the value is passed to `git clone` after a `--`\n * end-of-options terminator (no flag injection) and with the `ext::`\n * transport disabled (no arbitrary-command transport).\n /\n readonly repoUrl: string;\n /* Branch, tag, or commit SHA to check out. Rejected if it begins with `-`. /\n readonly ref: string;\n /\n Unique id for this row — names the target dir and any error. Validated to\n * `[A-Za-z0-9._-]` (no path traversal) since it becomes a directory name.\n /\n readonly instanceId: string;\n}\n\n/\n Reject ids that would escape the workdir or be parsed as a git flag. Must\n * start with an alphanumeric (blocks `.`, `..`, `-foo`, leading-dot names) and\n * thereafter allow only `[A-Za-z0-9._-]`.\n /\nconst SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]$/;\n\n/*\n Clone `repoUrl` into `<sandbox workdir>/<instanceId>` and check out `ref`.\n * Returns the absolute `repoDir` (resolved via `git rev-parse --show-toplevel`,\n * which is portable across backends). Throws {@link RepoProvisionError} naming\n * the `instanceId` when clone or checkout exits non-zero.\n \n The `sandbox` is optional (V3-5): when omitted, a default {@link LocalSandbox}\n * is used (clones into the process cwd's `<instanceId>`) — pass an explicit\n * sandbox (e.g. `LocalSandbox({ workDir })` / Docker / E2B) to control the workdir.\n */\nexport function provisionRepo(opts: ProvisionRepoOptions): Promise<{ repoDir: string }>;\nexport function provisionRepo(\n sandbox: SandboxBackend,\n opts: ProvisionRepoOptions,\n): Promise<{ repoDir: string }>;\nexport async function provisionRepo(\n sandboxOrOpts: SandboxBackend \| ProvisionRepoOptions,\n maybeOpts?: ProvisionRepoOptions,\n): Promise<{ repoDir: string }> {\n const sandbox = maybeOpts !== undefined ? (sandboxOrOpts as SandboxBackend) : new LocalSandbox();\n const opts = maybeOpts ?? (sandboxOrOpts as ProvisionRepoOptions);\n const { repoUrl, ref, instanceId } = opts;\n\n // Validate untrusted-derivable inputs before they reach git/the shell.\n if (!SAFE_INSTANCE_ID.test(instanceId)) {\n throw new RepoProvisionError(\n instanceId,\n \"invalid instanceId: must match [A-Za-z0-9._-] (no path traversal)\",\n );\n }\n if (ref.startsWith(\"-\")) {\n throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);\n }\n\n // `--` terminates options (no `--upload-pack=` flag injection); `protocol.ext.allow=never`\n // blocks the `ext::` arbitrary-command transport. `file`/`https` stay allowed.\n const clone = await sandbox.execute(\n `git -c protocol.ext.allow=never clone --quiet -- ${shellEscapePosix(repoUrl)} ${shellEscapePosix(instanceId)}`,\n );\n if (clone.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);\n }\n\n const top = await sandbox.execute(\n `git -C ${shellEscapePosix(instanceId)} rev-parse --show-toplevel`,\n );\n if (top.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);\n }\n const repoDir = top.stdout.trim();\n\n // `ref` is validated above not to begin with `-`, so it cannot be parsed as a flag.\n const checkout = await sandbox.execute(\n `git -C ${shellEscapePosix(repoDir)} checkout --quiet ${shellEscapePosix(ref)}`,\n );\n if (checkout.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);\n }\n\n return { repoDir };\n}\n"]}
1	+ {"version":3,"sources":["../../src/sandbox/bwrap.ts","../../src/sandbox/seccomp.ts","../../src/sandbox/linux-sandbox.ts","../../src/sandbox/provision.ts"],"names":["path"],"mappings":";;;;;;;;;;AAiCA,SAAS,kBAAA,CAAmB,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAiB,MAAA,EAAsB;AAC9F,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAoB,GAAG,CAAA,OAAQ,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,CAAA;AAC3E,EAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,QAAQ,MAAM,CAAA;AACnD;AAGA,SAAS,oBAAoB,GAAA,EAAgC;AAC3D,EAAA,OAAO,CAAC,KAAK,MAAM,CAAA;AACrB;AAeO,SAAS,gBAAA,CAAiB,MAAmB,GAAA,EAAuC;AACzF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,WAAA;AACH,MAAA,OAAO,EAAC;AAAA,IACV,KAAK,iBAAA;AACH,MAAA,OAAO,oBAAoB,GAAG,CAAA;AAAA,IAChC,KAAK,oBAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AAqBO,SAAS,cAAA,CAAe,MAAmB,IAAA,EAAyC;AACzF,EAAA,IAAI,IAAA,KAAS,sBAAsB,OAAO,IAAA;AAE1C,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AACjC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAgB,UAAA,CAAW,MAAM,CAAA;AAErD,EAAA,MAAM,IAAA,GAAiB;AAAA;AAAA,IAErB,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA;AAAA,IAEA,WAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,KAAK,eAAe,CAAA;AAI5C,EAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,YAAY,CAAA;AACpC,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,GAAI,IAAA,CAAK,GAAA,IAAO,EAAC;AAAA;AAAA,IAEjB,GAAI,IAAA,CAAK,OAAA,GAAU,EAAC,GAAI,EAAE,gCAAgC,GAAA;AAAI,GAChE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,CAAC,CAAA;AAEvE,EAAA,IAAI,SAAS,iBAAA,EAAmB,kBAAA,CAAmB,IAAA,EAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AAG5E,EAAA,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA;AAC9B,EAAA,OAAO,IAAA;AACT;AAeO,SAAS,WAAA,CAAY,SAAsB,UAAA,EAA4B;AAC5E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,EAAM;AACzB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,yBAAA,EAA0B;AAChE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,IAAA,EAAM,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,SAAA,EAAY,GAAG,CAAA,gCAAA,CAAA,EAAmC;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4DAAA,EAA6D;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,uBAAuB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AACF;AASA,IAAI,aAAA,GAAgB,CAAA;AAGb,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,aAAA;AACT;AAGO,IAAM,UAAA,GAA0B;AAAA,EACrC,OAAO,MAAM;AACX,IAAA,aAAA,EAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,EAAE,IAAA,EAAK;AAExF,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,UAAA,CAAW,OAAA,CAAQ,KAAI,GAAI,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,IAAA;AAC7D,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,GAAA,KAAQ;AACjB,IAAA,IAAI;AAEF,MAAA,OAAO,YAAA,CAAa,GAAA,EAAK,CAAC,QAAQ,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,CAAC,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA;AAAA,IAC5D;AAAA,EACF,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,IAAA,IAAI;AAEF,MAAA,YAAA,CAAa,GAAA,EAAK,CAAC,gBAAA,EAAkB,eAAA,EAAiB,aAAa,GAAA,EAAK,GAAA,EAAK,WAAW,CAAA,EAAG;AAAA,QACzF,OAAA,EAAS,GAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;AAqCA,IAAI,IAAA;AAaG,SAAS,mBAAA,CAAoB,SAAsB,UAAA,EAA4B;AACpF,EAAA,IAAA,KAAS,YAAY,MAAM,CAAA;AAC3B,EAAA,IAAI,KAAK,EAAA,IAAM,CAAC,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,EAAG;AACpC,IAAA,IAAA,GAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA,gBAAA,CAAA,EAAmB;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,cAAA,GAAuB;AACrC,EAAA,IAAA,GAAO,MAAA;AACT;;;AChQA,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,CAAA;AAEhB,IAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,OAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,QAAQ,OAAA,GAAU,KAAA;AAGxB,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,OAAA,GAAU,UAAA;AAGhB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,iBAAA,GAAoB,MAAA;AAC1B,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,SAAA,GAAY,oBAAqB,KAAA,GAAQ,KAAA;AAC/C,IAAM,wBAAA,GAA2B,UAAA;AAEjC,IAAM,OAAA,GAAU,CAAA;AAGhB,IAAM,gBAAgB,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AAEnD,IAAM,cAAA,GAAiB,CAAC,EAAA,EAAI,EAAA,EAAI,KAAK,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,IAAI,EAAE,CAAA;AAE7E,IAAM,eAAA,GAAkB,CAAC,EAAA,EAAI,EAAE,CAAA;AAS/B,IAAM,IAAA,GAAO,CAAC,IAAA,EAAc,CAAA,MAAqB,EAAE,MAAM,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,CAAA,EAAG,CAAA,EAAE,CAAA;AACzE,IAAM,GAAA,GAAM,CAAC,IAAA,EAAc,CAAA,EAAW,EAAA,EAAY,QAAsB,EAAE,IAAA,EAAM,EAAA,EAAI,EAAA,EAAI,CAAA,EAAE,CAAA;AAYnF,SAAS,mBAAmB,IAAA,EAA8B;AAI/D,EAAA,MAAM,QAAgB,EAAC;AAKvB,EAAA,MAAM,KAAA,0BAAe,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAC1B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAQ1B,EAAA,MAAM,OAAgB,EAAC;AACvB,EAAA,MAAM,OAAO,CAAC,IAAA,EAAc,GAAW,EAAA,GAAa,CAAA,EAAG,KAAa,CAAA,KAAY;AAC9E,IAAA,IAAA,CAAK,KAAK,EAAE,IAAA,EAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAA;AAAA,EAC/B,CAAA;AAGA,EAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,EAAA,IAAA,CAAK,KAAA,EAAO,iBAAA,EAAmB,CAAA,EAAG,IAAI,CAAA;AAEtC,EAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,EAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAC,CAAA;AAI5B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,iBAAA,GAChB,CAAC,GAAG,aAAA,EAAe,GAAG,cAAc,CAAA,GACpC,CAAC,GAAG,aAAa,CAAA;AACrB,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,EAAA,EAAI,MAAM,CAAC,CAAA;AAGhD,EAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,IAAA,KAAA,MAAW,SAAS,eAAA,EAAiB;AAEnC,MAAA,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,CAAC,CAAA;AACvB,MAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,MAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AAAA,IAIlC;AAAA,EACF;AAGA,EAAA,IAAA,CAAK,OAAO,iBAAiB,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,GAAS,CAAA;AAC/B,EAAA,IAAA,CAAK,OAAO,SAAS,CAAA;AACrB,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAC9B,EAAA,IAAA,CAAK,OAAO,wBAAwB,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAa9B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,EAAW,CAAA,KAAsB;AAChD,IAAA,MAAM,GAAA,GAAM,CAAA,KAAM,KAAA,GAAQ,QAAA,GAAW,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,CAAA;AAE3F,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,GAAI,CAAA,CAAA;AACvB,IAAA,IAAI,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,GAAA,EAAK,MAAM,IAAI,UAAA,CAAW,CAAA,6BAAA,EAAgC,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1F,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAIA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACnC,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,CAAA,CAAE,SAAS,KAAA,EAAO;AACxC,MAAA,KAAA,CAAM,KAAK,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,CAAC,CAAC,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,KAAK,IAAA,CAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA;AACjC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,cAAc,GAAA,CAAI,CAAA,KAAM,CAAA,EAAG,CAAA,GAAI,IAAI,CAAC,CAAA;AAAA,EAC1C,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;;;AC/IA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AASO,SAAS,qBAAA,CACd,IAAA,EACA,IAAA,EAOA,OAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AACzF,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACxB,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,KAAgB,MAAA,GAAY,CAAC,WAAA,EAAa,GAAG,IAAI,EAAC;AAC3E,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAG,WAAA,EAAa,IAAI,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,YAAA,EAAe,UAAA,CAAW,OAAO,CAAC,CAAA,CAAA;AAC3I,EAAA,OAAO,IAAA,CAAK,WAAA,KAAgB,MAAA,GAAY,CAAA,EAAG,IAAI,OAAO,UAAA,CAAW,IAAA,CAAK,WAAW,CAAC,CAAA,CAAA,GAAK,IAAA;AACzF;AAQA,IAAM,aAAA,GAAgB;AAAA,EACpB,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,SAAS,cAAA,CAAe,MAAA,GAA4B,OAAA,CAAQ,GAAA,EAA6B;AAC9F,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,KAAK,aAAA,EAAe;AAC7B,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,YAAA,GAAN,cAA2B,YAAA,CAAa;AAAA,EAC5B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA;AAAA;AAAA,EAGA,WAAA;AAAA,EAEjB,WAAA,CACE,QACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,KAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,MAAA,CAAO,OAAA,IAAW,OAAA,CAAQ,GAAA,EAAI;AAGzC,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACvB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,cAAA,EAAe;AACtC,IAAA,IAAA,CAAK,WAAA,GAAc,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA;AAAA,EACvD;AAAA;AAAA,EAGA,YAAY,OAAA,EAAgC;AAC1C,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAe,UAAA,CAAWA,KAAAA,EAAc,OAAA,EAAyC;AAC/E,IAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,SAA6B,KAAA,CAAM,UAAA,CAAWA,OAAM,OAAO,CAAA;AAE7E,IAAA,MAAM,MAAA,GAASA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAIA,QAAO,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,CAAA,EAAIA,KAAI,CAAA,CAAA;AAChE,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAGlD,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,MACnB,CAAA,SAAA,EAAY,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA,cAAA,EAAiB,UAAA,CAAW,GAAG,CAAC,CAAA,eAAA,EAAkB,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,KAC7G;AACA,IAAA,IAAI,CAAA,CAAE,aAAa,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gDAAA,EAAmD,MAAM,CAAA,GAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAK,IAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAA;AAAA,OACxG;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAA,CAAQ,SAAiB,IAAA,EAA+B;AAC/D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,OAAO,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,SAAS,IAAI,CAAA;AACxD,IAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EACpC;AACF;AAEA,IAAI,YAAA,GAAe,KAAA;AAaZ,SAAS,kBAAA,CAAmB,MAAc,IAAA,EAA+C;AAC9F,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,YAAA,GAAe,IAAA;AACf,MAAA,IAAA;AAAA,QACE,mDAAmD,IAAI,CAAA,mGAAA;AAAA,OAEzD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAO,EAAG,aAAa,CAAC,CAAA;AACrD,IAAA,MAAMA,KAAAA,GAAO,IAAA,CAAK,GAAA,EAAK,YAAY,CAAA;AACnC,IAAA,aAAA,CAAcA,OAAM,kBAAA,CAAmB,EAAE,iBAAA,EAAmB,IAAA,EAAM,CAAC,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,MAAY,MAAA,CAAO,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AACxE,IAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,OAAO,CAAA;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,WAAW,OAAO,CAAA;AAC/B,IAAA,OAAOA,KAAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,yCAAyC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,qFAAA;AAAA,KAE3F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,IAAI,iBAAA;AAEG,SAAS,qBAAA,GAA4C;AAC1D,EAAA,IAAI,iBAAA,KAAsB,MAAA,EAAW,OAAO,iBAAA,IAAqB,MAAA;AACjE,EAAA,MAAMA,KAAAA,GAAO,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,iBAAA,GAAoBA,KAAAA,IAAQ,IAAA;AAC5B,EAAA,OAAOA,KAAAA;AACT;AAEA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,qBAAA,GAA8B;AAC5C,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAcO,SAAS,sBAAsB,IAAA,EAGnB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,oBAAA,EAAsB;AACtC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,qCAAA,EAAsC;AAAA,EAC3F;AACA,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,QAAA,EAAU,OAAO,MAAA,EAAQ,CAAA,wBAAA,EAAsB,SAAA,CAAU,MAAM,CAAA,CAAA,EAAG;AAAA,EAC9F;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,IAAA,EAAM,QAAQ,gBAAA,EAAiB;AACrE;AAoBO,SAAS,qBAAqB,IAAA,EAAmD;AACtF,EAAA,MAAM,SAAwB,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,SAAA,EAAW,KAAK,SAAA,EAAU;AACjF,EAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAI,aAAa,MAAM,CAAA;AAEtE,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,MAAA,IAAA;AAAA,QACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,8DAAA,EACL,KAAK,IAAI,CAAA,EAAA;AAAA,OACrE;AAAA,IACF;AACA,IAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,IAAI,YAAA,CAAa,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,SAAA,CAAU,KAAK,CAAA;AAChG;AAUA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,yBAAA,GAAkC;AAChD,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAgBA,SAAS,sBAAsB,WAAA,EAA0C;AACvE,EAAA,OAAO,WAAA,GAAc,SAAY,qBAAA,EAAsB;AACzD;AAuBA,SAAS,kBAAkB,IAAA,EAA6C;AACtE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAA;AAE/C,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,SAAA,CAAU,EAAA,EAAI,OAAO,SAAA,CAAU,GAAA;AAEnC,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,iBAAA,GAAoB,IAAA;AACpB,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,IAAA,IAAA;AAAA,MACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,2EAAA,EACZ,KAAK,IAAI,CAAA,EAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBO,SAAS,uBACd,IAAA,EACiD;AACjD,EAAA,OAAO,CAAC,SAAiB,GAAA,KAA+B;AACtD,IAAA,MAAM,GAAA,GAAM,kBAAkB,IAAI,CAAA;AAClC,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AAEzB,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,GAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,KAAA;AAAA,QACzB,KAAK,cAAA,EAAe;AAAA,QACpB,GAAA;AAAA,QACA,WAAA,EAAa,qBAAA,CAAsB,IAAA,CAAK,OAAA,IAAW,KAAK;AAAA,OAC1D;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA;AACF;;;AC1WO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EAGxD,WAAA,CACW,UAAA,EACT,OAAA,EACA,OAAA,GAA+B,EAAC,EAChC;AACA,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,UAAU,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,EAAI;AAAA,MAClC,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,KAC/D,CAAA;AARQ,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EATW,UAAA;AAAA,EAHO,IAAA,GAAO,oBAAA;AAa3B;AAyBA,IAAM,gBAAA,GAAmB,8BAAA;AAiBzB,eAAsB,aAAA,CACpB,eACA,SAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,SAAA,KAAc,MAAA,GAAa,aAAA,GAAmC,IAAI,YAAA,EAAa;AAC/F,EAAA,MAAM,OAAO,SAAA,IAAc,aAAA;AAC3B,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAK,UAAA,EAAW,GAAI,IAAA;AAGrC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,0CAAA,EAA6C,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EAC9F;AAIA,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC1B,oDAAoD,gBAAA,CAAiB,OAAO,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,GAC/G;AACA,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,cAAA,EAAiB,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,OAAA;AAAA,IACxB,CAAA,OAAA,EAAU,gBAAA,CAAiB,UAAU,CAAC,CAAA,0BAAA;AAAA,GACxC;AACA,EAAA,IAAI,GAAA,CAAI,aAAa,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,wBAAA,EAA2B,IAAI,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAGhC,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC7B,UAAU,gBAAA,CAAiB,OAAO,CAAC,CAAA,kBAAA,EAAqB,gBAAA,CAAiB,GAAG,CAAC,CAAA;AAAA,GAC/E;AACA,EAAA,IAAI,QAAA,CAAS,aAAa,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,SAAA,EAAY,GAAG,YAAY,QAAA,CAAS,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB","file":"index.js","sourcesContent":["// Promoted out of the agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): kernel\n// confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a pure-JS Buffer.\n\nimport { execFileSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/*\n M53 — bubblewrap argv + honest detection.\n \n HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —\n * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`\n * via `restrictedSeccompPath()`. Ported in M63; this block claimed the opposite until M67 and\n * UNDER-DECLARED the real security posture. The honest limit that remains: the filter is x86_64\n * (an architecture guard refuses to install it on any other arch, with a WARN, and bwrap's FS/network\n * confinement still applies) and it is only installed when the network is restricted\n * (`backend.ts:87`, faithful to `landlock.rs:96-117`): with the network on there is no syscall\n * filter, only bwrap's FS confinement. `danger-full-access` skips bwrap entirely, mirroring\n * `bwrap.rs:245-252`. Deltas versus Codex remain documented in docs/CODEX-PARITY.md.\n /\n\n/\n Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer\n * configuration: `danger-full-access` means \"do not wrap\", and that is a decision belonging to the\n * confinement subsystem.\n /\nexport type SandboxMode = \"read-only\" \| \"workspace-write\" \| \"danger-full-access\";\n\n/\n The RW binds `workspace-write` installs (protocol.rs:1189-1214), plus the metadata protection that\n * must sit ON TOP of them — order matters (permissions.rs:22-31; bwrap.rs:571-597).\n /\nfunction pushWorkspaceBinds(argv: string[], cwd: string, hasGit: boolean, gitDir: string): void {\n for (const root of workspaceWriteRoots(cwd)) argv.push(\"--bind\", root, root);\n if (hasGit) argv.push(\"--ro-bind\", gitDir, gitDir);\n}\n\n/* The RW binds `workspace-write` installs (protocol.rs:1189-1214): the workspace itself, and /tmp. /\nfunction workspaceWriteRoots(cwd: string): readonly string[] {\n return [cwd, \"/tmp\"];\n}\n\n/\n U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.\n \n `[]` means nothing is writable; `null` means unrestricted — which is not the same as `[\"/\"]`,\n * because unrestricted is the absence of a root rather than a root that happens to be `/`.\n \n The SDK already knew this: `buildBwrapArgv` binds these exact paths. It only knew it while\n * BUILDING an argv, and a consumer needs the answer earlier — tools are scoped at agent\n * construction, before any process exists, and a file-write tool has to be told its root then. With\n * nothing to ask, consumers keep a second encoding of this three-mode vocabulary and it drifts from\n * the argv builder with nothing to catch it. This reads from the same helper the builder uses, so\n * the two cannot disagree.\n /\nexport function writableRootsFor(mode: SandboxMode, cwd: string): readonly string[] \| null {\n switch (mode) {\n case \"read-only\":\n return [];\n case \"workspace-write\":\n return workspaceWriteRoots(cwd);\n case \"danger-full-access\":\n return null;\n }\n}\n\nexport interface BwrapArgvOptions {\n /* Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). /\n cwd: string;\n /* `true` removes `--unshare-net` (policy `network_access`, default false). /\n network?: boolean;\n /* Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. /\n gitDirExists?: boolean;\n /\n When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,\n * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the\n * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).\n /\n env?: Record<string, string>;\n}\n\n/\n Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),\n * or `null` when the policy skips the sandbox entirely (`danger-full-access`).\n /\nexport function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] \| null {\n if (mode === \"danger-full-access\") return null; // bwrap skipped entirely (bwrap.rs:245-252)\n\n const cwd = path.resolve(opts.cwd);\n const gitDir = path.join(cwd, \".git\");\n const hasGit = opts.gitDirExists ?? existsSync(gitDir);\n\n const argv: string[] = [\n // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)\n \"--new-session\",\n \"--die-with-parent\",\n \"--unshare-user\",\n \"--unshare-pid\",\n // full-read filesystem base (bwrap.rs:446-452)\n \"--ro-bind\",\n \"/\",\n \"/\",\n \"--dev\",\n \"/dev\",\n \"--proc\",\n \"/proc\",\n ];\n\n if (!opts.network) argv.push(\"--unshare-net\"); // network off by default (bwrap.rs:325-327)\n\n // env confinement — `--clearenv` MUST precede every `--setenv` or the clear wipes them\n // (exec_env.rs:25-31 clears then rebuilds). Only when an explicit allowlist is provided.\n if (opts.env) argv.push(\"--clearenv\");\n const setenv: Record<string, string> = {\n ...(opts.env ?? {}),\n // the flag signals the child that network is unshared (spawn.rs:20,79)\n ...(opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: \"1\" }),\n };\n for (const [k, v] of Object.entries(setenv)) argv.push(\"--setenv\", k, v);\n\n if (mode === \"workspace-write\") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);\n // read-only: zero writable roots (protocol.rs:1176) — nothing to add\n\n argv.push(\"--chdir\", cwd, \"--\");\n return argv;\n}\n\n/* Injectable probes — each mirrors one Codex availability check. /\nexport interface BwrapProbes {\n /* `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). /\n which: () => string \| null;\n /* `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). /\n helpText: (bin: string) => string \| null;\n /* Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). /\n userns: (bin: string) => boolean;\n}\n\nexport type BwrapDetection = { ok: true; bin: string } \| { ok: false; reason: string };\n\n/* Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). /\nexport function detectBwrap(probes: BwrapProbes = realProbes): BwrapDetection {\n try {\n const bin = probes.which();\n if (!bin) return { ok: false, reason: \"bwrap not found in PATH\" };\n const help = probes.helpText(bin);\n if (!help?.includes(\"--perms\")) {\n return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };\n }\n if (!probes.userns(bin)) {\n return { ok: false, reason: \"user namespaces unavailable (container/kernel restriction)\" };\n }\n return { ok: true, bin };\n } catch (err) {\n return {\n ok: false,\n reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n}\n\n/\n How many times the REAL probe ran in this process.\n \n Instrumented here rather than in a wrapper, because this is where the cost is: every `which`\n * spawns a subprocess (`which bwrap`), and the full probe cost 22.2 ms. A gate counting INJECTED\n * probes does not see the real one — that was the M71 gate's first mistake, and a mutant exposed it.\n /\nlet realProbeRuns = 0;\n\n/* How many real probes ran. TEST seam — the performance gate counts this. /\nexport function realProbeCount(): number {\n return realProbeRuns;\n}\n\n/* Real probes used in production. /\nexport const realProbes: BwrapProbes = {\n which: () => {\n realProbeRuns++;\n try {\n const out = execFileSync(\"which\", [\"bwrap\"], { encoding: \"utf8\", timeout: 2_000 }).trim();\n // anti-hijack: never accept a bwrap that lives inside the workspace (bwrap.rs:168-191)\n if (!out \|\| out.startsWith(process.cwd() + path.sep)) return null;\n return out;\n } catch {\n return null;\n }\n },\n helpText: (bin) => {\n try {\n // bwrap --help exits 0/1 depending on version; capture output either way\n return execFileSync(bin, [\"--help\"], { encoding: \"utf8\", timeout: 2_000 });\n } catch (err) {\n const e = err as { stdout?: string; stderr?: string };\n return [e.stdout, e.stderr].filter(Boolean).join(\"\\n\") \|\| null;\n }\n },\n userns: (bin) => {\n try {\n // active probe, 500ms budget like Codex (sandboxing/src/bwrap.rs:74-136)\n execFileSync(bin, [\"--unshare-user\", \"--unshare-net\", \"--ro-bind\", \"/\", \"/\", \"/bin/true\"], {\n timeout: 500,\n stdio: \"ignore\",\n });\n return true;\n } catch {\n return false;\n }\n },\n};\n\n/\n The probe result, memoized for the lifetime of the PROCESS.\n \n Measured before M71: `detectBwrap()` costs 22.2 ms and was not memoized — the second call\n * cost 19.4 ms. `buildChatAgent` on the headless path fired two (one from\n * `createSandboxBackend`, another from `resolveSandboxPosture`, which M70 added), totalling 46.4 ms\n * per construction — and construction happens per turn. Under `strace`, ~90% of the 182 syscalls of\n * an already-warm construction came from here: `which` sweeping the PATH, `/proc/filesystems`,\n * `/newroot`, and the `.so` files the two probe subprocesses load.\n \n ## Why there is no invalidation\n \n The milestone called for invalidating on `SessionStart`. That does not work:\n * `agents/lib/hooks/hooks.ts:28-30` documents — as a measured correction of an earlier\n * assumption — that the event fires once per TURN, not per session. Invalidating there would\n * re-probe every turn, exactly the behavior memoization exists to eliminate.\n \n A write-once cache is sufficient here: the expensive probe runs once per process,\n * only to print a UI warning.\n \n The price, stated plainly — in BOTH directions. The original m71-cost-per-turn#ADR-1 declared\n * only one of them; the M71 review (F-perf-9) showed the omitted one was precisely the one with a\n * security consequence:\n \n - Stale negative (`bwrap` installed AFTERWARDS): not detected until restart. The system fails\n * CLOSED — the posture reports `enforced: false` and M70's veto refuses. Cost: annoyance (the\n * message tells you to install the bwrap you just installed). Accepted.\n * - Stale positive (`bwrap` removed/renamed AFTERWARDS): the posture would keep asserting\n * `enforced: true / \"kernel (bwrap)\"` and the veto would approve, citing a confinement that no\n * longer exists. That is the literal reintroduction of the defect M70 fixed — \"telling the\n operator they are protected when they are not is worse than saying nothing\". Before M71 the\n per-turn re-probe closed that window on the next turn; memoization would leave it open for the\n * whole process. That is why the positive is revalidated below, at 1 syscall — 3 orders of\n * magnitude below the 22.2 ms of the full probe, which is the cost memoization exists to remove.\n /\nlet memo: BwrapDetection \| undefined;\n\n/\n `detectBwrap` with memoization — what production should call.\n \n Note that `detectBwrap` itself does not memoize, on purpose: it accepts injected probes, and\n * memoizing there would let a test with fake probes poison the process cache for everyone else.\n \n Revalidating the positive is NOT a re-probe: `detectBwrap` spends three probes (a `which`\n * subprocess + `--help` + a user namespace). Here we only confirm the validated binary is still in\n * place. If it vanished, the memo is downgraded to a negative with the reason stated — never\n * promoted to a positive, which would require the expensive probe back.\n /\nexport function detectBwrapMemoized(probes: BwrapProbes = realProbes): BwrapDetection {\n memo ??= detectBwrap(probes);\n if (memo.ok && !existsSync(memo.bin)) {\n memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };\n }\n return memo;\n}\n\n/* TEST seam — clears the memo. Production never calls it (see m71-cost-per-turn#ADR-1). /\nexport function resetBwrapMemo(): void {\n memo = undefined;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): confinement with\n// kernel confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// no dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a Buffer in pure JS.\n\n/\n M63 — cBPF seccomp filter generator. Produces a raw `sock_filter[]` program (the exact\n * shape `bwrap --seccomp <fd>` consumes) so syscall confinement needs no\n * native helper — bwrap applies `PR_SET_NO_NEW_PRIVS` + the filter before `execve`.\n \n Semantics (landlock.rs:252-253): default action = ALLOW; per-syscall match = ERRNO(EPERM). KILL is\n * used ONLY by the architecture/x32 guard. x86_64 only in v1 (aarch64 is a documented delta).\n /\n\n// BPF opcodes (linux/bpf_common.h)\nconst BPF_LD = 0x00;\nconst BPF_W = 0x00;\nconst BPF_ABS = 0x20;\nconst BPF_JMP = 0x05;\nconst BPF_JEQ = 0x10;\nconst BPF_JGE = 0x30;\nconst BPF_K = 0x00;\nconst BPF_RET = 0x06;\n\nconst LD_ABS_W = BPF_LD \| BPF_W \| BPF_ABS; // 0x20\nconst JEQ_K = BPF_JMP \| BPF_JEQ \| BPF_K; // 0x15\nconst JGE_K = BPF_JMP \| BPF_JGE \| BPF_K; // 0x35\nconst RET_K = BPF_RET \| BPF_K; // 0x06\n\n// seccomp_data offsets (little-endian): nr@0, arch@4, args[0] low dword @16\nconst OFF_NR = 0;\nconst OFF_ARCH = 4;\nconst OFF_ARG0 = 16;\n\nconst AUDIT_ARCH_X86_64 = 0xc000003e;\nconst X32_BIT = 0x40000000; // nr >= this ⇒ x32 ABI ⇒ reject\n\n// seccomp return actions (linux/seccomp.h)\nconst SECCOMP_RET_ALLOW = 0x7fff0000;\nconst SECCOMP_RET_ERRNO = 0x00050000;\nconst EPERM = 1;\nconst RET_EPERM = SECCOMP_RET_ERRNO \| (EPERM & 0xffff); // 0x00050001\nconst SECCOMP_RET_KILL_PROCESS = 0x80000000;\n\nconst AF_UNIX = 1;\n\n/* Always-denied, network-independent (landlock.rs:179-184). /\nconst ALWAYS_DENIED = [101, 310, 311, 425, 426, 427]; // ptrace, process_vm_readv/writev, io_uring_setup/enter/register\n/* Denied only when the network is restricted (landlock.rs:188-204). recvfrom(45)/sendmsg(46) are NOT here. /\nconst NETWORK_DENIED = [42, 43, 288, 49, 50, 52, 51, 48, 44, 307, 299, 55, 54];\n/* socket(2) / socketpair(2) — conditional on domain != AF_UNIX (landlock.rs:206-216). /\nconst SOCKET_SYSCALLS = [41, 53];\n\n/* One `sock_filter` instruction: `{u16 code, u8 jt, u8 jf, u32 k}`. /\ninterface Insn {\n code: number;\n jt: number;\n jf: number;\n k: number;\n}\nconst stmt = (code: number, k: number): Insn => ({ code, jt: 0, jf: 0, k });\nconst jmp = (code: number, k: number, jt: number, jf: number): Insn => ({ code, jt, jf, k });\n\nexport interface SeccompOptions {\n /* When true (network off), also deny the socket set + non-AF_UNIX socket(). /\n networkRestricted: boolean;\n}\n\n/\n Build the cBPF seccomp program as a `Buffer` (each `sock_filter` = 8 bytes). Jump targets are\n * expressed against labels and back-patched to relative offsets, so the layout is deterministic and\n * unit-testable against the authoritative syscall list.\n /\nexport function buildSeccompFilter(opts: SeccompOptions): Buffer {\n // We assemble with symbolic targets, then resolve to relative jumps. To keep the classic\n // \"deny → jump to a single DENY return; else fall through\" shape, DENY and ALLOW live at the END and\n // every JEQ jumps FORWARD to them. jt/jf carry the DISTANCE (in instructions) to the target.\n const insns: Insn[] = [];\n\n // Placeholder labels resolved after we know total length.\n // Layout: [arch guard][x32 guard][LD nr][deny checks...][socket checks...][ALLOW][DENY][KILL]\n // We build the body first with jumps to ALLOW/DENY/KILL as sentinel indices, then patch.\n const ALLOW = Symbol(\"ALLOW\");\n const DENY = Symbol(\"DENY\");\n const KILL = Symbol(\"KILL\");\n type Target = typeof ALLOW \| typeof DENY \| typeof KILL \| number;\n interface SInsn {\n code: number;\n k: number;\n jt: Target;\n jf: Target;\n }\n const body: SInsn[] = [];\n const push = (code: number, k: number, jt: Target = 0, jf: Target = 0): void => {\n body.push({ code, k, jt, jf });\n };\n\n // --- arch guard: arch == x86_64 ? continue : KILL ---\n push(LD_ABS_W, OFF_ARCH);\n push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL); // if != → KILL\n // --- x32 guard: nr >= 0x40000000 ? KILL : continue ---\n push(LD_ABS_W, OFF_NR);\n push(JGE_K, X32_BIT, KILL, 0); // if >= → KILL\n // nr already loaded; keep it loaded for the deny checks.\n\n // --- unconditional denials → DENY ---\n const denied = opts.networkRestricted\n ? [...ALWAYS_DENIED, ...NETWORK_DENIED]\n : [...ALWAYS_DENIED];\n for (const nr of denied) push(JEQ_K, nr, DENY, 0); // if nr == syscall → DENY\n\n // --- socket-family: socket(41)/socketpair(53) → allow only AF_UNIX (only when restricted) ---\n if (opts.networkRestricted) {\n for (const sysno of SOCKET_SYSCALLS) {\n // if nr == socket → check domain; else skip the 2 domain-check instructions\n push(JEQ_K, sysno, 0, 2); // match: fall through to the LD/JEQ; no-match: jump +2 (past them)\n push(LD_ABS_W, OFF_ARG0); // load domain (args[0] low dword)\n push(JEQ_K, AF_UNIX, ALLOW, DENY); // AF_UNIX → ALLOW, else DENY\n // NOTE: after these, nr is NO LONGER in the accumulator — but every remaining syscall check\n // reloads via a fresh LD? No: the remaining path is only ALLOW. socket checks are LAST before\n // the tail, so a fall-through (non-socket syscall that reached here) goes straight to ALLOW.\n }\n }\n\n // --- tail ---\n push(RET_K, SECCOMP_RET_ALLOW); // ALLOW label target\n const allowIdx = body.length - 1;\n push(RET_K, RET_EPERM); // DENY\n const denyIdx = body.length - 1;\n push(RET_K, SECCOMP_RET_KILL_PROCESS); // KILL\n const killIdx = body.length - 1;\n\n // --- resolve symbolic targets to relative offsets ---\n // The branching IS the cBPF program: ALLOW/DENY/KILL are symbolic targets resolved to an\n // offset RELATIVE to the next instruction. Breaking it into helpers does not reduce real complexity —\n // it moves the jump arithmetic to another file and makes auditing against landlock.rs harder, the\n // the authoritative source.\n //\n // Not refactoring NOW is an M75 process decision: this function is being MIGRATED without behavior\n // change (plan m75, D4) and there is still no byte-for-byte equivalence oracle against the\n // original version. Refactoring security without that oracle is changing the lock in the dark.\n // Revisit when the parity gate (T4.2) is green — the oracle exists then.\n // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n const resolve = (i: number, t: Target): number => {\n const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;\n // BPF jump offset is relative to the NEXT instruction: target - (i + 1)\n const off = abs - (i + 1);\n if (off < 0 \|\| off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);\n return off;\n };\n // `for...of` over entries instead of a raw index: the SDK compiles with `noUncheckedIndexedAccess`, which\n // (correctly) types `body[i]` as possibly undefined. Iterating gives the guarantee in the type instead\n // requiring a `!` — the code already could not leave the range, and now the compiler knows it.\n for (const [i, b] of body.entries()) {\n if (b.code === JEQ_K \|\| b.code === JGE_K) {\n insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));\n } else {\n insns.push(stmt(b.code, b.k));\n }\n }\n\n const buf = Buffer.alloc(insns.length 8);\n insns.forEach((ins, i) => {\n buf.writeUInt16LE(ins.code, i * 8);\n buf.writeUInt8(ins.jt, i * 8 + 2);\n buf.writeUInt8(ins.jf, i * 8 + 3);\n buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);\n });\n return buf;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1). Renamed from\n// `BwrapSandbox` to `LinuxSandbox`: bwrap is the IMPLEMENTATION, Linux is the contract — swapping the\n// mechanism (landlock, for example) should not change the name the consumer imports.\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { redactSecrets } from \"../internal/security/redact.js\";\nimport type { BwrapDetection, SandboxMode } from \"./bwrap.js\";\nimport { buildBwrapArgv, detectBwrapMemoized } from \"./bwrap.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { buildSeccompFilter } from \"./seccomp.js\";\nimport type { SandboxBackend, SandboxConfig } from \"./types.js\";\n\n/*\n M53 — kernel-enforced sandbox backend, injected into `createShellTool({ sandbox })`.\n \n `LinuxSandbox extends LocalSandbox` and only REWRITES the command: `<bwrap-bin> <policy flags> --\n * /bin/sh -c '<original>'`. Everything else (spawn, output caps, timeout, ExecuteResult shape, file\n * ops) is inherited — the SDK backend stays the single execution engine. Mirrors Codex's\n * `SandboxManager::transform` (argv prefixing before spawn, never in-process).\n /\n\n/* POSIX single-quote escaping — the inner command crosses ONE extra `/bin/sh -c` boundary. /\nfunction shellQuote(s: string): string {\n return `'${s.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\n/\n M57 — the single source of truth for the sandbox command wrap. Turns `command` into\n * `<bin> <bwrap flags> [--seccomp 3] -- /bin/sh -c '<command>' [3< <bpf>]`, or `null` when the policy\n * skips the sandbox (`danger-full-access`). Extracted from `LinuxSandbox.wrapCommand` so the interactive\n * PTY backend (M57) can reuse the EXACT wrap the one-shot `run_shell` already uses (DRY) — faithful to\n * Codex, where the sandbox transforms the argv before the PTY spawns it (`sandboxing/src/manager.rs:321`).\n /\nexport function wrapCommandForSandbox(\n mode: SandboxMode,\n opts: {\n cwd: string;\n network?: boolean;\n env?: Record<string, string>;\n bin?: string;\n seccompPath?: string;\n },\n command: string,\n): string \| null {\n const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });\n if (argv === null) return null; // danger-full-access: bwrap skipped\n const bin = opts.bin ?? \"bwrap\";\n const seccompArgv = opts.seccompPath !== undefined ? [\"--seccomp\", \"3\"] : [];\n const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, \"--\"].map(shellQuote).join(\" \")} /bin/sh -c ${shellQuote(command)}`;\n return opts.seccompPath !== undefined ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;\n}\n\n/\n Env allowlist re-injected inside the sandbox after `--clearenv`. Codex env_clear model: the child\n * gets exactly what it needs to run a shell, never the parent's full env (which may hold oddly-named\n * secrets the SDK name-pattern scrub misses). `CODEX_SANDBOX_NETWORK_DISABLED` is added by the argv\n * builder when network is unshared.\n /\nconst ENV_ALLOWLIST = [\n \"PATH\",\n \"HOME\",\n \"LANG\",\n \"LC_ALL\",\n \"LC_CTYPE\",\n \"TERM\",\n \"USER\",\n \"TMPDIR\",\n \"SHELL\",\n];\n\nexport function allowlistedEnv(source: NodeJS.ProcessEnv = process.env): Record<string, string> {\n const out: Record<string, string> = {};\n for (const k of ENV_ALLOWLIST) {\n const v = source[k];\n if (v !== undefined) out[k] = v;\n }\n return out;\n}\n\nexport class LinuxSandbox extends LocalSandbox {\n private readonly mode: SandboxMode;\n private readonly network: boolean;\n private readonly cwd: string;\n private readonly bin: string;\n private readonly env: Record<string, string>;\n /* M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a\n * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). /\n private readonly seccompPath: string \| undefined;\n\n constructor(\n config: SandboxConfig,\n opts: { mode: SandboxMode; network?: boolean; bin?: string; env?: Record<string, string> },\n ) {\n super(config);\n this.mode = opts.mode;\n this.network = opts.network ?? false;\n this.cwd = config.workDir ?? process.cwd();\n // MEDIUM-1: run the VALIDATED absolute binary from detection (anti-hijack), never bare `bwrap`\n // which the outer shell would re-resolve via $PATH at spawn time (TOCTOU / hijack window).\n this.bin = opts.bin ?? \"bwrap\";\n this.env = opts.env ?? allowlistedEnv();\n this.seccompPath = seccompPathForNetwork(this.network);\n }\n\n /* Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). /\n wrapCommand(command: string): string \| null {\n return wrapCommandForSandbox(\n this.mode,\n {\n cwd: this.cwd,\n network: this.network,\n env: this.env,\n bin: this.bin,\n seccompPath: this.seccompPath,\n },\n command,\n );\n }\n\n /\n M75 review (architecture, HIGH) — without this override the class LIED.\n \n `LinuxSandbox` documents itself as a \"kernel-enforced sandbox backend\", but it overrode only\n * `execute`. `uploadFile` stayed the one inherited from `LocalSandbox`, which writes straight to\n * the host via `fs/promises` and accepts an ABSOLUTE path — no bwrap, no seccomp, no path\n * restriction. And `SandboxBackend.writeFile` delegates to it. The result was an incoherent class:\n * reading, searching and listing went through the confinement; writing did not.\n \n Routing through the wrapped `execute` fixes it at the root: writes come to live under the SAME\n * policy as everything else — if bwrap denies the path, the write fails, as it should. The content\n * goes over stdin (not argv) because argv has a size limit and file content does not.\n /\n override async uploadFile(path: string, content: string \| Buffer): Promise<void> {\n if (this.mode === \"danger-full-access\") return super.uploadFile(path, content);\n\n const target = path.startsWith(\"/\") ? path : `${this.cwd}/${path}`;\n const b64 = Buffer.from(content).toString(\"base64\");\n // base64 on a single line: avoids any shell quoting over arbitrary content, which is exactly\n // where a \"confined\" write would turn into command injection.\n const r = await this.execute(\n `mkdir -p ${shellQuote(dirname(target))} && printf %s ${shellQuote(b64)} \| base64 -d > ${shellQuote(target)}`,\n );\n if (r.exitCode !== 0) {\n throw new Error(\n `uploadFile blocked or failed under confinement (${target}): ${r.stderr.trim() \|\| `exit ${r.exitCode}`}`,\n );\n }\n }\n\n override execute(command: string, opts?: { timeoutMs?: number }) {\n const wrapped = this.wrapCommand(command);\n if (wrapped === null) return super.execute(command, opts); // danger-full-access: plain local\n return super.execute(wrapped, opts);\n }\n}\n\nlet warnedNonX64 = false;\n\n/\n M63 — the restricted-network seccomp program is DETERMINISTIC, so write it ONCE per process and\n * reuse the path across every LinuxSandbox (no per-instance temp accumulation).\n \n ARCH GUARD (review HIGH): `buildSeccompFilter` emits an x86_64 program whose arch guard KILLs every\n * syscall whose `seccomp_data.arch != AUDIT_ARCH_X86_64`. On a non-x86_64 host that would brick EVERY\n * sandboxed command (the first execve is killed) — and silently, because generation succeeds and bwrap\n * accepts it. So we REFUSE to install on non-x64 and WARN through the honest-downgrade channel (bwrap\n * FS/network confinement still applies), exactly like the bwrap-missing fallback. `arch` is injectable\n * for tests. Cleaned on exit AND on SIGINT/SIGTERM (TUI Ctrl+C would otherwise leak the temp dir).\n /\nexport function seccompPathForArch(arch: string, warn: (m: string) => void): string \| undefined {\n if (arch !== \"x64\") {\n if (!warnedNonX64) {\n warnedNonX64 = true;\n warn(\n `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) — running without ` +\n \"the filter; bwrap FS/network confinement still applies.\",\n );\n }\n return undefined;\n }\n try {\n const dir = mkdtempSync(join(tmpdir(), \"ab-seccomp-\"));\n const path = join(dir, \"filter.bpf\");\n writeFileSync(path, buildSeccompFilter({ networkRestricted: true }));\n const cleanup = (): void => rmSync(dir, { recursive: true, force: true });\n process.once(\"exit\", cleanup);\n process.once(\"SIGINT\", cleanup);\n process.once(\"SIGTERM\", cleanup);\n return path;\n } catch (err) {\n warn(\n `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) — ` +\n \"running without syscall filter (bwrap FS/network confinement still applies).\",\n );\n return undefined;\n }\n}\n\nlet seccompFilterPath: string \| undefined \| null; // undefined = not tried; null = resolved absent\n/* M57 — exported so the interactive PTY backend reuses the SAME memoized x64-gated seccomp program. /\nexport function restrictedSeccompPath(): string \| undefined {\n if (seccompFilterPath !== undefined) return seccompFilterPath ?? undefined;\n const path = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));\n seccompFilterPath = path ?? null;\n return path;\n}\n\nlet warnedUnavailable = false;\n\n/* Test seam: reset the WARN-once latch. /\nexport function resetSandboxWarnLatch(): void {\n warnedUnavailable = false;\n}\n\n/* Durable sandbox posture for the UI — the honest answer to \"am I kernel-enforced right now?\". /\nexport interface SandboxPosture {\n mode: SandboxMode;\n enforced: boolean;\n detail: string;\n}\n\n/\n MEDIUM-2: compute the posture so a surface (TUI footer) can show enforcement DURABLY instead of a\n * one-shot warn. `danger-full-access` is honestly reported as unenforced; an unavailable bwrap reports\n * the downgrade reason so the user never believes they are confined when they are not.\n /\nexport function resolveSandboxPosture(opts: {\n mode: SandboxMode;\n detect?: () => BwrapDetection;\n}): SandboxPosture {\n if (opts.mode === \"danger-full-access\") {\n return { mode: opts.mode, enforced: false, detail: \"no confinement (danger-full-access)\" };\n }\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (!detection.ok) {\n return { mode: opts.mode, enforced: false, detail: `tool-gating only — ${detection.reason}` };\n }\n return { mode: opts.mode, enforced: true, detail: \"kernel (bwrap)\" };\n}\n\nexport interface CreateSandboxBackendOptions {\n mode: SandboxMode;\n workDir?: string;\n network?: boolean;\n timeoutMs?: number;\n /* Injectable for tests; defaults to the real 3-probe detection. /\n detect?: () => BwrapDetection;\n /* Injectable for tests; defaults to console.warn. /\n warn?: (message: string) => void;\n}\n\n/\n Honest factory: bwrap available + mode wants confinement → `LinuxSandbox` (kernel enforcement,\n * running the VALIDATED absolute bin); `danger-full-access` → plain `LocalSandbox` silently (explicit\n * opt-out, `bwrap.rs:245-252`); bwrap unavailable → WARN once + `LocalSandbox` (the declarative M23\n * gating remains the guard). NEVER pretends to sandbox — the fallback is loud, mirroring Codex's\n * MISSING_BWRAP_WARNING. The durable posture lives in `resolveSandboxPosture` for the UI.\n /\nexport function createSandboxBackend(opts: CreateSandboxBackendOptions): SandboxBackend {\n const config: SandboxConfig = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };\n if (opts.mode === \"danger-full-access\") return new LocalSandbox(config);\n\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (!detection.ok) {\n if (!warnedUnavailable) {\n warnedUnavailable = true;\n const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n warn(\n `[sandbox] OS-level enforcement unavailable (${detection.reason}) — ` +\n `falling back to tool-level gating only (sandbox_mode=${opts.mode}).`,\n );\n }\n return new LocalSandbox(config);\n }\n return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });\n}\n\n/\n M75 T3.2 — warning latch for the INTERACTIVE path.\n \n Kept separate from `createSandboxBackend`'s latch on purpose: they are two distinct decisions\n * taken at distinct moments, and a user who only ever runs an interactive shell needs to see the\n * warning even if the non-interactive path already emitted it — otherwise the session where they\n * actually type commands would be the one without the alert.\n /\nlet interactiveWarned = false;\n\n/* Reset for tests — the latch is module state and tests need isolation. /\nexport function resetInteractiveWarnLatch(): void {\n interactiveWarned = false;\n}\n\n/\n The rule \"seccomp ONLY with restricted network\" — in ONE place.\n \n Codex installs the filter only when the network is closed (`landlock.rs:96-117`), and that is not\n * a detail: the cBPF program denies the network syscalls (`NETWORK_DENIED`). Applying it with\n * the network open produces the worst possible combination — bwrap allows the network (no\n * `--unshare-net`) and seccomp denies it with EPERM. The user asked for network, got the bind,\n * and the calls die.\n \n It existed duplicated: the constructor decided conditionally, `interactiveWrapCommand` installed\n * unconditionally. They had already diverged in the first version (M75 architecture review, proven\n * at runtime: `network:true` gave `--seccomp` interactively and not one-shot). Two copies of a\n * security rule is not duplicated form — it is duplicated KNOWLEDGE, and it had already diverged.\n /\nfunction seccompPathForNetwork(networkOpen: boolean): string \| undefined {\n return networkOpen ? undefined : restrictedSeccompPath();\n}\n\nexport interface InteractiveWrapOptions {\n mode: SandboxMode;\n /* `true` keeps the network. Default `false`, same as non-interactive `run_shell`. /\n network?: boolean;\n /* Injectable for tests; defaults to the real memoized detection. /\n detect?: () => BwrapDetection;\n /* Injectable for tests; defaults to `console.warn` with redaction. /\n warn?: (message: string) => void;\n}\n\n/\n The decision to confine or degrade, separated from the wrap itself.\n \n Extracted because they are two responsibilities and the SDK's complexity gate separated them for\n * us: DECIDING (is confinement available? did the user opt out?) and APPLYING (assembling the argv).\n * Keeping them together pushed the closure past 10 cognitive complexity — and the linter was right:\n * the deciding part is the one with security consequences and deserves to be read on its own.\n \n Returns the validated binary when confinement exists, or `null` when it does not — warning ONCE,\n * and only when the absence is a failure (not when it is an opt-out).\n /\nfunction decideConfinement(opts: InteractiveWrapOptions): string \| null {\n if (opts.mode === \"danger-full-access\") return null;\n\n const detection = (opts.detect ?? detectBwrapMemoized)();\n if (detection.ok) return detection.bin;\n\n if (!interactiveWarned) {\n interactiveWarned = true;\n const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n warn(\n `[sandbox] OS-level enforcement unavailable (${detection.reason}) — interactive session ` +\n `runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`,\n );\n }\n return null;\n}\n\n/\n The composition the interactive path needs — the counterpart of `createSandboxBackend`.\n \n `createSandboxBackend` solves this for the non-interactive path by returning a ready BACKEND. The\n * PTY accepts no backend: it owns the spawn and only allows transforming the command. This function\n * delivers the SAME decision in the shape the PTY accepts — `(command, cwd) => string \| null` —\n * ready for `new PtyInteractiveBackend({ wrapCommand: interactiveWrapCommand({ mode }) })`.\n \n Detection is consulted on every wrap, not frozen at construction: an interactive session lives\n * for hours, and a stale positive detection would keep asserting confinement after the binary\n * disappeared (the `existsSync` revalidation lives inside `detectBwrapMemoized`).\n \n The two routes returning `null` are semantically different and the code does not merge them:\n * `danger-full-access` is an explicit opt-out and does NOT warn; bwrap being unavailable is a\n * failure and warns once.\n /\nexport function interactiveWrapCommand(\n opts: InteractiveWrapOptions,\n): (command: string, cwd: string) => string \| null {\n return (command: string, cwd: string): string \| null => {\n const bin = decideConfinement(opts);\n if (bin === null) return null;\n\n return wrapCommandForSandbox(\n opts.mode,\n {\n cwd,\n network: opts.network ?? false,\n env: allowlistedEnv(),\n bin,\n seccompPath: seccompPathForNetwork(opts.network ?? false),\n },\n command,\n );\n };\n}\n","/\n M6-3 — portable repo provisioner for the eval harness.\n \n Clones a repository and checks out a ref into an isolated working dir, issuing\n * every git command through {@link SandboxBackend.execute} (ADR D2 — same code\n * runs on Local/Docker/E2B; never a direct `child_process` import). Promotes\n * theocode's `prepareRepo` (`swebench-provision.ts:37`) onto the SDK's sandbox\n * abstraction.\n \n reference: knowledge-base/references/theocode-eval/lib/swebench-provision.ts:37\n * (clone+checkout), :13 (ProvisionError with instanceId).\n \n @public\n /\n\nimport { TheokitAgentError } from \"../errors.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { shellEscapePosix } from \"./shell-escape.js\";\nimport type { SandboxBackend } from \"./types.js\";\n\n/\n Raised when cloning or checking out a repo fails. Carries the `instanceId`\n * so a batch run can attribute the failure to the offending dataset row.\n /\nexport class RepoProvisionError extends TheokitAgentError {\n override readonly name = \"RepoProvisionError\";\n\n constructor(\n readonly instanceId: string,\n message: string,\n options: { cause?: unknown } = {},\n ) {\n super(`[${instanceId}] ${message}`, {\n code: \"repo_provision_failed\",\n isRetryable: false,\n ...(options.cause !== undefined ? { cause: options.cause } : {}),\n });\n }\n}\n\n/* Options for {@link provisionRepo}. /\nexport interface ProvisionRepoOptions {\n /\n Clonable repo URL or local path. SECURITY: when this comes from an\n * untrusted dataset, the value is passed to `git clone` after a `--`\n * end-of-options terminator (no flag injection) and with the `ext::`\n * transport disabled (no arbitrary-command transport).\n /\n readonly repoUrl: string;\n /* Branch, tag, or commit SHA to check out. Rejected if it begins with `-`. /\n readonly ref: string;\n /\n Unique id for this row — names the target dir and any error. Validated to\n * `[A-Za-z0-9._-]` (no path traversal) since it becomes a directory name.\n /\n readonly instanceId: string;\n}\n\n/\n Reject ids that would escape the workdir or be parsed as a git flag. Must\n * start with an alphanumeric (blocks `.`, `..`, `-foo`, leading-dot names) and\n * thereafter allow only `[A-Za-z0-9._-]`.\n /\nconst SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]$/;\n\n/*\n Clone `repoUrl` into `<sandbox workdir>/<instanceId>` and check out `ref`.\n * Returns the absolute `repoDir` (resolved via `git rev-parse --show-toplevel`,\n * which is portable across backends). Throws {@link RepoProvisionError} naming\n * the `instanceId` when clone or checkout exits non-zero.\n \n The `sandbox` is optional (V3-5): when omitted, a default {@link LocalSandbox}\n * is used (clones into the process cwd's `<instanceId>`) — pass an explicit\n * sandbox (e.g. `LocalSandbox({ workDir })` / Docker / E2B) to control the workdir.\n */\nexport function provisionRepo(opts: ProvisionRepoOptions): Promise<{ repoDir: string }>;\nexport function provisionRepo(\n sandbox: SandboxBackend,\n opts: ProvisionRepoOptions,\n): Promise<{ repoDir: string }>;\nexport async function provisionRepo(\n sandboxOrOpts: SandboxBackend \| ProvisionRepoOptions,\n maybeOpts?: ProvisionRepoOptions,\n): Promise<{ repoDir: string }> {\n const sandbox = maybeOpts !== undefined ? (sandboxOrOpts as SandboxBackend) : new LocalSandbox();\n const opts = maybeOpts ?? (sandboxOrOpts as ProvisionRepoOptions);\n const { repoUrl, ref, instanceId } = opts;\n\n // Validate untrusted-derivable inputs before they reach git/the shell.\n if (!SAFE_INSTANCE_ID.test(instanceId)) {\n throw new RepoProvisionError(\n instanceId,\n \"invalid instanceId: must match [A-Za-z0-9._-] (no path traversal)\",\n );\n }\n if (ref.startsWith(\"-\")) {\n throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);\n }\n\n // `--` terminates options (no `--upload-pack=` flag injection); `protocol.ext.allow=never`\n // blocks the `ext::` arbitrary-command transport. `file`/`https` stay allowed.\n const clone = await sandbox.execute(\n `git -c protocol.ext.allow=never clone --quiet -- ${shellEscapePosix(repoUrl)} ${shellEscapePosix(instanceId)}`,\n );\n if (clone.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);\n }\n\n const top = await sandbox.execute(\n `git -C ${shellEscapePosix(instanceId)} rev-parse --show-toplevel`,\n );\n if (top.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);\n }\n const repoDir = top.stdout.trim();\n\n // `ref` is validated above not to begin with `-`, so it cannot be parsed as a flag.\n const checkout = await sandbox.execute(\n `git -C ${shellEscapePosix(repoDir)} checkout --quiet ${shellEscapePosix(ref)}`,\n );\n if (checkout.exitCode !== 0) {\n throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);\n }\n\n return { repoDir };\n}\n"]}

package/dist/server/errors-envelope.cjs CHANGED Viewed

@@ -1,7 +1,7 @@
 'use strict';
-var chunk2YGIBOUH_cjs = require('../chunk-2YGIBOUH.cjs');
-require('../chunk-SXSPMRSV.cjs');
+var chunkLPVIRJVF_cjs = require('../chunk-LPVIRJVF.cjs');
+require('../chunk-BM6N4KHO.cjs');
 // src/server/errors-envelope.ts
 var NAME_TO_CODE = /* @__PURE__ */ new Map([
@@ -37,7 +37,7 @@ function toEnvelope(value) {
 }
 function buildMeta(name, err) {
   const meta = { sdkErrorName: name };
-  if (err instanceof chunk2YGIBOUH_cjs.TheokitAgentError && err.metadata !== void 0) {
+  if (err instanceof chunkLPVIRJVF_cjs.TheokitAgentError && err.metadata !== void 0) {
     meta.provider = err.metadata.provider;
     meta.endpoint = err.metadata.endpoint;
     if (err.metadata.statusCode !== void 0) {
@@ -47,13 +47,13 @@ function buildMeta(name, err) {
   return meta;
 }
 function buildExt(err) {
-  if (err instanceof chunk2YGIBOUH_cjs.RateLimitError && err.metadata?.retryAfter !== void 0) {
+  if (err instanceof chunkLPVIRJVF_cjs.RateLimitError && err.metadata?.retryAfter !== void 0) {
     return {
       retryable: true,
       retryAfterMs: err.metadata.retryAfter * 1e3
     };
   }
-  if (err instanceof chunk2YGIBOUH_cjs.CredentialPoolExhaustedError && err.nextRetryAt !== void 0) {
+  if (err instanceof chunkLPVIRJVF_cjs.CredentialPoolExhaustedError && err.nextRetryAt !== void 0) {
     const delayMs = Math.max(0, err.nextRetryAt - Date.now());
     return {
       retryable: true,
@@ -63,22 +63,22 @@ function buildExt(err) {
   return void 0;
 }
 var CODE_TO_RECONSTRUCTOR = /* @__PURE__ */ new Map([
-  ["UNAUTHORIZED", (env) => new chunk2YGIBOUH_cjs.AuthenticationError(env.message)],
+  ["UNAUTHORIZED", (env) => new chunkLPVIRJVF_cjs.AuthenticationError(env.message)],
   [
     "RATE_LIMITED",
-    (env) => new chunk2YGIBOUH_cjs.RateLimitError(env.message, env.cause !== void 0 ? { cause: env.cause } : {})
+    (env) => new chunkLPVIRJVF_cjs.RateLimitError(env.message, env.cause !== void 0 ? { cause: env.cause } : {})
   ],
-  ["PROVIDER_KEY_MISSING", (env) => new chunk2YGIBOUH_cjs.ConfigurationError(env.message)],
-  ["SERVICE_UNAVAILABLE", (env) => new chunk2YGIBOUH_cjs.NetworkError(env.message)],
-  ["GATEWAY_TIMEOUT", (env) => new chunk2YGIBOUH_cjs.NetworkError(env.message)],
+  ["PROVIDER_KEY_MISSING", (env) => new chunkLPVIRJVF_cjs.ConfigurationError(env.message)],
+  ["SERVICE_UNAVAILABLE", (env) => new chunkLPVIRJVF_cjs.NetworkError(env.message)],
+  ["GATEWAY_TIMEOUT", (env) => new chunkLPVIRJVF_cjs.NetworkError(env.message)],
   [
     "AGENT_RUN_ERROR",
-    (env) => new chunk2YGIBOUH_cjs.AgentRunError(env.message, {
+    (env) => new chunkLPVIRJVF_cjs.AgentRunError(env.message, {
       code: "unknown",
       ...env.cause !== void 0 ? { cause: env.cause } : {}
     })
   ],
-  ["INTERNAL_SERVER_ERROR", (env) => new chunk2YGIBOUH_cjs.UnknownAgentError(env.message)]
+  ["INTERNAL_SERVER_ERROR", (env) => new chunkLPVIRJVF_cjs.UnknownAgentError(env.message)]
   // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require
   // domain-specific args (budgetName, provider) that the envelope doesn't
   // always carry. Fall back to UnknownAgentError when those fields are
@@ -88,12 +88,12 @@ var CODE_TO_RECONSTRUCTOR = /* @__PURE__ */ new Map([
 function fromEnvelope(env) {
   const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);
   if (reconstructor) return reconstructor(env);
-  return new chunk2YGIBOUH_cjs.UnknownAgentError(env.message);
+  return new chunkLPVIRJVF_cjs.UnknownAgentError(env.message);
 }
 Object.defineProperty(exports, "MemoryAdapterError", {
   enumerable: true,
-  get: function () { return chunk2YGIBOUH_cjs.MemoryAdapterError; }
+  get: function () { return chunkLPVIRJVF_cjs.MemoryAdapterError; }
 });
 exports.fromEnvelope = fromEnvelope;
 exports.toEnvelope = toEnvelope;

package/dist/server/errors-envelope.js CHANGED Viewed

@@ -1,6 +1,6 @@
-import { TheokitAgentError, RateLimitError, CredentialPoolExhaustedError, UnknownAgentError, AuthenticationError, ConfigurationError, NetworkError, AgentRunError } from '../chunk-HI4ZW62S.js';
-export { MemoryAdapterError } from '../chunk-HI4ZW62S.js';
-import '../chunk-4X3SBHPK.js';
+import { TheokitAgentError, RateLimitError, CredentialPoolExhaustedError, UnknownAgentError, AuthenticationError, ConfigurationError, NetworkError, AgentRunError } from '../chunk-U4UJHOSH.js';
+export { MemoryAdapterError } from '../chunk-U4UJHOSH.js';
+import '../chunk-5F5NWKPN.js';
 // src/server/errors-envelope.ts
 var NAME_TO_CODE = /* @__PURE__ */ new Map([

package/dist/session-transcript-DOM3UTXR.cjs ADDED Viewed

@@ -0,0 +1,50 @@
+'use strict';
+var chunkY4AXQOT4_cjs = require('./chunk-Y4AXQOT4.cjs');
+require('./chunk-C4H6PB5J.cjs');
+require('./chunk-BM6N4KHO.cjs');
+Object.defineProperty(exports, "SessionTranscript", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.SessionTranscript; }
+});
+Object.defineProperty(exports, "defaultBaseDir", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.defaultBaseDir; }
+});
+Object.defineProperty(exports, "encodeProjectDir", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.encodeProjectDir; }
+});
+Object.defineProperty(exports, "expandTilde", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.expandTilde; }
+});
+Object.defineProperty(exports, "readTranscript", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.readTranscript; }
+});
+Object.defineProperty(exports, "reconstructMessages", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.reconstructMessages; }
+});
+Object.defineProperty(exports, "safeSessionId", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.safeSessionId; }
+});
+Object.defineProperty(exports, "transcriptPath", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.transcriptPath; }
+});
+Object.defineProperty(exports, "transcriptRoot", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.transcriptRoot; }
+});
+Object.defineProperty(exports, "writeTranscript", {
+  enumerable: true,
+  get: function () { return chunkY4AXQOT4_cjs.writeTranscript; }
+});
+//# sourceMappingURL=session-transcript-DOM3UTXR.cjs.map
+//# sourceMappingURL=session-transcript-DOM3UTXR.cjs.map

package/dist/{session-transcript-TNAJ4O3M.cjs.map → session-transcript-DOM3UTXR.cjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-~~TNAJ4O3M~~.cjs"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-DOM3UTXR.cjs"}

package/dist/session-transcript-RAKEK76V.js ADDED Viewed

@@ -0,0 +1,5 @@
+export { SessionTranscript, defaultBaseDir, encodeProjectDir, expandTilde, readTranscript, reconstructMessages, safeSessionId, transcriptPath, transcriptRoot, writeTranscript } from './chunk-N5CR3TJZ.js';
+import './chunk-6AZDM6LK.js';
+import './chunk-5F5NWKPN.js';
+//# sourceMappingURL=session-transcript-RAKEK76V.js.map
+//# sourceMappingURL=session-transcript-RAKEK76V.js.map

package/dist/{session-transcript-SKIRBEJE.js.map → session-transcript-RAKEK76V.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-~~SKIRBEJE~~.js"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-RAKEK76V.js"}

package/dist/skills.cjs CHANGED Viewed

@@ -1,21 +1,21 @@
 'use strict';
-var chunkFUASIT3E_cjs = require('./chunk-FUASIT3E.cjs');
-require('./chunk-YTO5BRBD.cjs');
+var chunkZN2DGEY3_cjs = require('./chunk-ZN2DGEY3.cjs');
+require('./chunk-ZT57WTUJ.cjs');
 require('./chunk-VKJ7V7EB.cjs');
-require('./chunk-44IISBRZ.cjs');
-require('./chunk-2YGIBOUH.cjs');
-require('./chunk-SXSPMRSV.cjs');
+require('./chunk-SZHU7A5B.cjs');
+require('./chunk-LPVIRJVF.cjs');
+require('./chunk-BM6N4KHO.cjs');
 Object.defineProperty(exports, "buildSkillsBlock", {
   enumerable: true,
-  get: function () { return chunkFUASIT3E_cjs.buildSkillsBlock; }
+  get: function () { return chunkZN2DGEY3_cjs.buildSkillsBlock; }
 });
 Object.defineProperty(exports, "discoverSkills", {
   enumerable: true,
-  get: function () { return chunkFUASIT3E_cjs.discoverSkills; }
+  get: function () { return chunkZN2DGEY3_cjs.discoverSkills; }
 });
 //# sourceMappingURL=skills.cjs.map
 //# sourceMappingURL=skills.cjs.map

package/dist/skills.js CHANGED Viewed

@@ -1,8 +1,8 @@
-export { buildSkillsBlock, discoverSkills } from './chunk-BXVSBYGW.js';
-import './chunk-XWCTBGYK.js';
+export { buildSkillsBlock, discoverSkills } from './chunk-OY7O3Q6R.js';
+import './chunk-SK4QLUBK.js';
 import './chunk-RIAM53CP.js';
-import './chunk-5XXUYU3M.js';
-import './chunk-HI4ZW62S.js';
-import './chunk-4X3SBHPK.js';
+import './chunk-DGOG5NXR.js';
+import './chunk-U4UJHOSH.js';
+import './chunk-5F5NWKPN.js';
 //# sourceMappingURL=skills.js.map
 //# sourceMappingURL=skills.js.map

package/dist/stream-object-L3Q7PBMF.cjs ADDED Viewed

@@ -0,0 +1,20 @@
+'use strict';
+var chunkGD63JPGC_cjs = require('./chunk-GD63JPGC.cjs');
+require('./chunk-CZ2GKKYL.cjs');
+require('./chunk-WJVHMTKB.cjs');
+require('./chunk-LPVIRJVF.cjs');
+require('./chunk-BM6N4KHO.cjs');
+Object.defineProperty(exports, "StreamObjectError", {
+  enumerable: true,
+  get: function () { return chunkGD63JPGC_cjs.StreamObjectError; }
+});
+Object.defineProperty(exports, "streamObjectImpl", {
+  enumerable: true,
+  get: function () { return chunkGD63JPGC_cjs.streamObjectImpl; }
+});
+//# sourceMappingURL=stream-object-L3Q7PBMF.cjs.map
+//# sourceMappingURL=stream-object-L3Q7PBMF.cjs.map

package/dist/{stream-object-T4DAMNVB.cjs.map → stream-object-L3Q7PBMF.cjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-~~T4DAMNVB~~.cjs"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-L3Q7PBMF.cjs"}

package/dist/stream-object-ZYXWS4B2.js ADDED Viewed

@@ -0,0 +1,7 @@
+export { StreamObjectError, streamObjectImpl } from './chunk-Y4I4EQFK.js';
+import './chunk-D24WJWN2.js';
+import './chunk-4VPXM6UU.js';
+import './chunk-U4UJHOSH.js';
+import './chunk-5F5NWKPN.js';
+//# sourceMappingURL=stream-object-ZYXWS4B2.js.map
+//# sourceMappingURL=stream-object-ZYXWS4B2.js.map

package/dist/{stream-object-QMNR3YFF.js.map → stream-object-ZYXWS4B2.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-~~QMNR3YFF~~.js"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-ZYXWS4B2.js"}

package/dist/subagents-loader-I56GSKAQ.js ADDED Viewed

@@ -0,0 +1,6 @@
+export { loadSubagents } from './chunk-UFIXH26P.js';
+import './chunk-DGOG5NXR.js';
+import './chunk-U4UJHOSH.js';
+import './chunk-5F5NWKPN.js';
+//# sourceMappingURL=subagents-loader-I56GSKAQ.js.map
+//# sourceMappingURL=subagents-loader-I56GSKAQ.js.map

package/dist/{subagents-loader-WN2SB6PV.js.map → subagents-loader-I56GSKAQ.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"subagents-loader-~~WN2SB6PV~~.js"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"subagents-loader-I56GSKAQ.js"}

package/dist/subagents-loader-VRW73QQT.cjs ADDED Viewed

@@ -0,0 +1,15 @@
+'use strict';
+var chunkE7FJOO4G_cjs = require('./chunk-E7FJOO4G.cjs');
+require('./chunk-SZHU7A5B.cjs');
+require('./chunk-LPVIRJVF.cjs');
+require('./chunk-BM6N4KHO.cjs');
+Object.defineProperty(exports, "loadSubagents", {
+  enumerable: true,
+  get: function () { return chunkE7FJOO4G_cjs.loadSubagents; }
+});
+//# sourceMappingURL=subagents-loader-VRW73QQT.cjs.map
+//# sourceMappingURL=subagents-loader-VRW73QQT.cjs.map

package/dist/{subagents-loader-3CXBQWWY.cjs.map → subagents-loader-VRW73QQT.cjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":[],"names":[],"mappings":"","file":"subagents-loader-~~3CXBQWWY~~.cjs"}
1	+ {"version":3,"sources":[],"names":[],"mappings":"","file":"subagents-loader-VRW73QQT.cjs"}

package/dist/subagents-loader.cjs CHANGED Viewed

@@ -1,9 +1,9 @@
 'use strict';
-var chunkRTLUZKDL_cjs = require('./chunk-RTLUZKDL.cjs');
-require('./chunk-44IISBRZ.cjs');
-var chunk2YGIBOUH_cjs = require('./chunk-2YGIBOUH.cjs');
-require('./chunk-SXSPMRSV.cjs');
+var chunkE7FJOO4G_cjs = require('./chunk-E7FJOO4G.cjs');
+require('./chunk-SZHU7A5B.cjs');
+var chunkLPVIRJVF_cjs = require('./chunk-LPVIRJVF.cjs');
+require('./chunk-BM6N4KHO.cjs');
 // src/subagents-loader.ts
 var ACCEPTED_SOURCES = ["project"];
@@ -12,7 +12,7 @@ function resolveSources(options) {
   if (declared === void 0) return ACCEPTED_SOURCES;
   for (const source of declared) {
     if (!ACCEPTED_SOURCES.includes(source)) {
-      throw new chunk2YGIBOUH_cjs.ConfigurationError(
+      throw new chunkLPVIRJVF_cjs.ConfigurationError(
         `Unknown subagent setting source "${String(source)}" (accepted: ${ACCEPTED_SOURCES.join(", ")})`,
         { code: "subagent_unknown_setting_source" }
       );
@@ -22,7 +22,7 @@ function resolveSources(options) {
 }
 async function discoverSubagents(cwd, options) {
   const sources = resolveSources(options);
-  return chunkRTLUZKDL_cjs.loadSubagents(cwd, sources.includes("project"), void 0);
+  return chunkE7FJOO4G_cjs.loadSubagents(cwd, sources.includes("project"), void 0);
 }
 async function loadSubagentDefinition(name, cwd, options) {
   return (await discoverSubagents(cwd, options))[name];

package/dist/subagents-loader.d.cts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { a as AgentDefinition } from './agent-Zta1kvGH.cjs';
+import { a as AgentDefinition } from './agent-nLqeXKIX.cjs';
 import './run-C8FBAC8o.cjs';
 import 'zod';

package/dist/subagents-loader.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { a as AgentDefinition } from './agent-BiCINq25.js';
+import { a as AgentDefinition } from './agent-B9HXlwID.js';
 import './run-C8FBAC8o.js';
 import 'zod';