@theokit/sdk 4.55.0 → 4.57.0

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/sandbox/bwrap.ts","../../src/sandbox/seccomp.ts","../../src/sandbox/linux-sandbox.ts","../../src/sandbox/provision.ts"],"names":["path"],"mappings":";;;;;;;;;;;AAiCA,SAAS,kBAAA,CAAmB,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAiB,MAAA,EAAsB;AAC9F,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAoB,GAAG,CAAA,OAAQ,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,CAAA;AAC3E,EAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,QAAQ,MAAM,CAAA;AACnD;AAGA,SAAS,oBAAoB,GAAA,EAAgC;AAC3D,EAAA,OAAO,CAAC,KAAK,MAAM,CAAA;AACrB;AAeO,SAAS,gBAAA,CAAiB,MAAmB,GAAA,EAAuC;AACzF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,WAAA;AACH,MAAA,OAAO,EAAC;AAAA,IACV,KAAK,iBAAA;AACH,MAAA,OAAO,oBAAoB,GAAG,CAAA;AAAA,IAChC,KAAK,oBAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AA8BO,SAAS,cAAA,CAAe,MAAmB,IAAA,EAAyC;AACzF,EAAA,IAAI,IAAA,KAAS,sBAAsB,OAAO,IAAA;AAE1C,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AACjC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAgB,UAAA,CAAW,MAAM,CAAA;AAErD,EAAA,MAAM,IAAA,GAAiB;AAAA;AAAA,IAErB,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA;AAAA,IAEA,WAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,KAAK,eAAe,CAAA;AAI5C,EAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,YAAY,CAAA;AACpC,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,GAAI,IAAA,CAAK,GAAA,IAAO,EAAC;AAAA;AAAA,IAEjB,GAAI,IAAA,CAAK,OAAA,GAAU,EAAC,GAAI,EAAE,gCAAgC,GAAA;AAAI,GAChE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,CAAC,CAAA;AAEvE,EAAA,IAAI,SAAS,iBAAA,EAAmB,kBAAA,CAAmB,IAAA,EAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AAG5E,EAAA,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA;AAC9B,EAAA,OAAO,IAAA;AACT;AAiCO,SAAS,WAAA,CAAY,SAAsB,UAAA,EAA4B;AAC5E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,EAAM;AACzB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,yBAAA,EAA0B;AAChE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,IAAA,EAAM,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,SAAA,EAAY,GAAG,CAAA,gCAAA,CAAA,EAAmC;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4DAAA,EAA6D;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,uBAAuB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AACF;AASA,IAAI,aAAA,GAAgB,CAAA;AAGb,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,aAAA;AACT;AAGO,IAAM,UAAA,GAA0B;AAAA,EACrC,OAAO,MAAM;AACX,IAAA,aAAA,EAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,EAAE,IAAA,EAAK;AAExF,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,UAAA,CAAW,OAAA,CAAQ,KAAI,GAAI,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,IAAA;AAC7D,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,GAAA,KAAQ;AACjB,IAAA,IAAI;AAEF,MAAA,OAAO,YAAA,CAAa,GAAA,EAAK,CAAC,QAAQ,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,CAAC,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA;AAAA,IAC5D;AAAA,EACF,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,IAAA,IAAI;AAEF,MAAA,YAAA,CAAa,GAAA,EAAK,CAAC,gBAAA,EAAkB,eAAA,EAAiB,aAAa,GAAA,EAAK,GAAA,EAAK,WAAW,CAAA,EAAG;AAAA,QACzF,OAAA,EAAS,GAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;AAqCA,IAAI,IAAA;AAaG,SAAS,mBAAA,CAAoB,SAAsB,UAAA,EAA4B;AACpF,EAAA,IAAA,KAAS,YAAY,MAAM,CAAA;AAC3B,EAAA,IAAI,KAAK,EAAA,IAAM,CAAC,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,EAAG;AACpC,IAAA,IAAA,GAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA,gBAAA,CAAA,EAAmB;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,cAAA,GAAuB;AACrC,EAAA,IAAA,GAAO,MAAA;AACT;;;AC3RA,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,CAAA;AAEhB,IAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,OAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,QAAQ,OAAA,GAAU,KAAA;AAGxB,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,OAAA,GAAU,UAAA;AAGhB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,iBAAA,GAAoB,MAAA;AAC1B,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,SAAA,GAAY,oBAAqB,KAAA,GAAQ,KAAA;AAC/C,IAAM,wBAAA,GAA2B,UAAA;AAEjC,IAAM,OAAA,GAAU,CAAA;AAGhB,IAAM,gBAAgB,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AAEnD,IAAM,cAAA,GAAiB,CAAC,EAAA,EAAI,EAAA,EAAI,KAAK,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,IAAI,EAAE,CAAA;AAE7E,IAAM,eAAA,GAAkB,CAAC,EAAA,EAAI,EAAE,CAAA;AAS/B,IAAM,IAAA,GAAO,CAAC,IAAA,EAAc,CAAA,MAAqB,EAAE,MAAM,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,CAAA,EAAG,CAAA,EAAE,CAAA;AACzE,IAAM,GAAA,GAAM,CAAC,IAAA,EAAc,CAAA,EAAW,EAAA,EAAY,QAAsB,EAAE,IAAA,EAAM,EAAA,EAAI,EAAA,EAAI,CAAA,EAAE,CAAA;AAkBnF,SAAS,mBAAmB,IAAA,EAA8B;AAI/D,EAAA,MAAM,QAAgB,EAAC;AAKvB,EAAA,MAAM,KAAA,0BAAe,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAC1B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAQ1B,EAAA,MAAM,OAAgB,EAAC;AACvB,EAAA,MAAM,OAAO,CAAC,IAAA,EAAc,GAAW,EAAA,GAAa,CAAA,EAAG,KAAa,CAAA,KAAY;AAC9E,IAAA,IAAA,CAAK,KAAK,EAAE,IAAA,EAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAA;AAAA,EAC/B,CAAA;AAGA,EAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,EAAA,IAAA,CAAK,KAAA,EAAO,iBAAA,EAAmB,CAAA,EAAG,IAAI,CAAA;AAEtC,EAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,EAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAC,CAAA;AAI5B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,iBAAA,GAChB,CAAC,GAAG,aAAA,EAAe,GAAG,cAAc,CAAA,GACpC,CAAC,GAAG,aAAa,CAAA;AACrB,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,EAAA,EAAI,MAAM,CAAC,CAAA;AAGhD,EAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,IAAA,KAAA,MAAW,SAAS,eAAA,EAAiB;AAEnC,MAAA,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,CAAC,CAAA;AACvB,MAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,MAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AAAA,IAIlC;AAAA,EACF;AAGA,EAAA,IAAA,CAAK,OAAO,iBAAiB,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,GAAS,CAAA;AAC/B,EAAA,IAAA,CAAK,OAAO,SAAS,CAAA;AACrB,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAC9B,EAAA,IAAA,CAAK,OAAO,wBAAwB,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAa9B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,EAAW,CAAA,KAAsB;AAChD,IAAA,MAAM,GAAA,GAAM,CAAA,KAAM,KAAA,GAAQ,QAAA,GAAW,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,CAAA;AAE3F,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,GAAI,CAAA,CAAA;AACvB,IAAA,IAAI,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,GAAA,EAAK,MAAM,IAAI,UAAA,CAAW,CAAA,6BAAA,EAAgC,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1F,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAIA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACnC,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,CAAA,CAAE,SAAS,KAAA,EAAO;AACxC,MAAA,KAAA,CAAM,KAAK,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,CAAC,CAAC,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,KAAK,IAAA,CAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA;AACjC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,cAAc,GAAA,CAAI,CAAA,KAAM,CAAA,EAAG,CAAA,GAAI,IAAI,CAAC,CAAA;AAAA,EAC1C,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;;;ACrJA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AASO,SAAS,qBAAA,CACd,IAAA,EACA,IAAA,EAOA,OAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AACzF,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACxB,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,KAAgB,MAAA,GAAY,CAAC,WAAA,EAAa,GAAG,IAAI,EAAC;AAC3E,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAG,WAAA,EAAa,IAAI,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,YAAA,EAAe,UAAA,CAAW,OAAO,CAAC,CAAA,CAAA;AAC3I,EAAA,OAAO,IAAA,CAAK,WAAA,KAAgB,MAAA,GAAY,CAAA,EAAG,IAAI,OAAO,UAAA,CAAW,IAAA,CAAK,WAAW,CAAC,CAAA,CAAA,GAAK,IAAA;AACzF;AAQA,IAAM,aAAA,GAAgB;AAAA,EACpB,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAiBO,SAAS,cAAA,CAAe,MAAA,GAA4B,OAAA,CAAQ,GAAA,EAA6B;AAC9F,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,KAAK,aAAA,EAAe;AAC7B,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AA0BO,IAAM,YAAA,GAAN,cAA2B,YAAA,CAAa;AAAA,EAC5B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA;AAAA;AAAA,EAGA,WAAA;AAAA,EAEjB,WAAA,CACE,QACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,KAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,MAAA,CAAO,OAAA,IAAW,OAAA,CAAQ,GAAA,EAAI;AAGzC,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACvB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,cAAA,EAAe;AACtC,IAAA,IAAA,CAAK,WAAA,GAAc,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA;AAAA,EACvD;AAAA;AAAA,EAGA,YAAY,OAAA,EAAgC;AAC1C,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAe,UAAA,CAAWA,KAAAA,EAAc,OAAA,EAAyC;AAC/E,IAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,SAA6B,KAAA,CAAM,UAAA,CAAWA,OAAM,OAAO,CAAA;AAE7E,IAAA,MAAM,MAAA,GAASA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAIA,QAAO,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,CAAA,EAAIA,KAAI,CAAA,CAAA;AAChE,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAGlD,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,MACnB,CAAA,SAAA,EAAY,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA,cAAA,EAAiB,UAAA,CAAW,GAAG,CAAC,CAAA,eAAA,EAAkB,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,KAC7G;AACA,IAAA,IAAI,CAAA,CAAE,aAAa,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gDAAA,EAAmD,MAAM,CAAA,GAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAK,IAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAA;AAAA,OACxG;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAA,CAAQ,SAAiB,IAAA,EAA+B;AAC/D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,OAAO,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,SAAS,IAAI,CAAA;AACxD,IAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EACpC;AACF;AAEA,IAAI,YAAA,GAAe,KAAA;AAaZ,SAAS,kBAAA,CAAmB,MAAc,IAAA,EAA+C;AAC9F,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,YAAA,GAAe,IAAA;AACf,MAAA,IAAA;AAAA,QACE,mDAAmD,IAAI,CAAA,mGAAA;AAAA,OAEzD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAO,EAAG,aAAa,CAAC,CAAA;AACrD,IAAA,MAAMA,KAAAA,GAAO,IAAA,CAAK,GAAA,EAAK,YAAY,CAAA;AACnC,IAAA,aAAA,CAAcA,OAAM,kBAAA,CAAmB,EAAE,iBAAA,EAAmB,IAAA,EAAM,CAAC,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,MAAY,MAAA,CAAO,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AACxE,IAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,OAAO,CAAA;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,WAAW,OAAO,CAAA;AAC/B,IAAA,OAAOA,KAAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,yCAAyC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,qFAAA;AAAA,KAE3F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,IAAI,iBAAA;AAEG,SAAS,qBAAA,GAA4C;AAC1D,EAAA,IAAI,iBAAA,KAAsB,MAAA,EAAW,OAAO,iBAAA,IAAqB,MAAA;AACjE,EAAA,MAAMA,KAAAA,GAAO,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,iBAAA,GAAoBA,KAAAA,IAAQ,IAAA;AAC5B,EAAA,OAAOA,KAAAA;AACT;AAEA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,qBAAA,GAA8B;AAC5C,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAcO,SAAS,sBAAsB,IAAA,EAGnB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,oBAAA,EAAsB;AACtC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,qCAAA,EAAsC;AAAA,EAC3F;AACA,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,QAAA,EAAU,OAAO,MAAA,EAAQ,CAAA,wBAAA,EAAsB,SAAA,CAAU,MAAM,CAAA,CAAA,EAAG;AAAA,EAC9F;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,IAAA,EAAM,QAAQ,gBAAA,EAAiB;AACrE;AAmCO,SAAS,qBAAqB,IAAA,EAAmD;AACtF,EAAA,MAAM,SAAwB,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,SAAA,EAAW,KAAK,SAAA,EAAU;AACjF,EAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAI,aAAa,MAAM,CAAA;AAEtE,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,MAAA,IAAA;AAAA,QACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,8DAAA,EACL,KAAK,IAAI,CAAA,EAAA;AAAA,OACrE;AAAA,IACF;AACA,IAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,IAAI,YAAA,CAAa,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,SAAA,CAAU,KAAK,CAAA;AAChG;AAUA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,yBAAA,GAAkC;AAChD,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAgBA,SAAS,sBAAsB,WAAA,EAA0C;AACvE,EAAA,OAAO,WAAA,GAAc,SAAY,qBAAA,EAAsB;AACzD;AAyCA,SAAS,kBAAkB,IAAA,EAA6C;AACtE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAA;AAE/C,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,SAAA,CAAU,EAAA,EAAI,OAAO,SAAA,CAAU,GAAA;AAEnC,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,iBAAA,GAAoB,IAAA;AACpB,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,IAAA,IAAA;AAAA,MACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,2EAAA,EACZ,KAAK,IAAI,CAAA,EAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBO,SAAS,uBACd,IAAA,EACiD;AACjD,EAAA,OAAO,CAAC,SAAiB,GAAA,KAA+B;AACtD,IAAA,MAAM,GAAA,GAAM,kBAAkB,IAAI,CAAA;AAClC,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AAEzB,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,GAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,KAAA;AAAA,QACzB,KAAK,cAAA,EAAe;AAAA,QACpB,GAAA;AAAA,QACA,WAAA,EAAa,qBAAA,CAAsB,IAAA,CAAK,OAAA,IAAW,KAAK;AAAA,OAC1D;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA;AACF;;;AClbO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EAGxD,WAAA,CACW,UAAA,EACT,OAAA,EACA,OAAA,GAA+B,EAAC,EAChC;AACA,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,UAAU,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,EAAI;AAAA,MAClC,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,KAC/D,CAAA;AARQ,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EATW,UAAA;AAAA,EAHO,IAAA,GAAO,oBAAA;AAa3B;AAyBA,IAAM,gBAAA,GAAmB,8BAAA;AAiBzB,eAAsB,aAAA,CACpB,eACA,SAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,SAAA,KAAc,MAAA,GAAa,aAAA,GAAmC,IAAI,YAAA,EAAa;AAC/F,EAAA,MAAM,OAAO,SAAA,IAAc,aAAA;AAC3B,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAK,UAAA,EAAW,GAAI,IAAA;AAGrC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,0CAAA,EAA6C,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EAC9F;AAIA,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC1B,oDAAoD,gBAAA,CAAiB,OAAO,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,GAC/G;AACA,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,cAAA,EAAiB,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,OAAA;AAAA,IACxB,CAAA,OAAA,EAAU,gBAAA,CAAiB,UAAU,CAAC,CAAA,0BAAA;AAAA,GACxC;AACA,EAAA,IAAI,GAAA,CAAI,aAAa,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,wBAAA,EAA2B,IAAI,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAGhC,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC7B,UAAU,gBAAA,CAAiB,OAAO,CAAC,CAAA,kBAAA,EAAqB,gBAAA,CAAiB,GAAG,CAAC,CAAA;AAAA,GAC/E;AACA,EAAA,IAAI,QAAA,CAAS,aAAa,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,SAAA,EAAY,GAAG,YAAY,QAAA,CAAS,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB","file":"index.js","sourcesContent":["// Promoted out of the agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): kernel\n// confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a pure-JS Buffer.\n\nimport { execFileSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/*\n * M53 — bubblewrap argv + honest detection.\n *\n * HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —\n * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`\n * via `restrictedSeccompPath()`. Ported in M63; this block claimed the opposite until M67 and\n * UNDER-DECLARED the real security posture. The honest limit that remains: the filter is **x86_64**\n * (an architecture guard refuses to install it on any other arch, with a WARN, and bwrap's FS/network\n * confinement still applies) **and** it is only installed when the network is restricted\n * (`backend.ts:87`, faithful to `landlock.rs:96-117`): with the network on there is no syscall\n * filter, only bwrap's FS confinement. `danger-full-access` skips bwrap entirely, mirroring\n * `bwrap.rs:245-252`. Deltas versus Codex remain documented in docs/CODEX-PARITY.md.\n */\n\n/**\n * Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer\n * configuration: `danger-full-access` means \"do not wrap\", and that is a decision belonging to the\n * confinement subsystem.\n */\nexport type SandboxMode = \"read-only\" | \"workspace-write\" | \"danger-full-access\";\n\n/**\n * The RW binds `workspace-write` installs (protocol.rs:1189-1214), plus the metadata protection that\n * must sit ON TOP of them — order matters (permissions.rs:22-31; bwrap.rs:571-597).\n */\nfunction pushWorkspaceBinds(argv: string[], cwd: string, hasGit: boolean, gitDir: string): void {\n  for (const root of workspaceWriteRoots(cwd)) argv.push(\"--bind\", root, root);\n  if (hasGit) argv.push(\"--ro-bind\", gitDir, gitDir);\n}\n\n/** The RW binds `workspace-write` installs (protocol.rs:1189-1214): the workspace itself, and /tmp. */\nfunction workspaceWriteRoots(cwd: string): readonly string[] {\n  return [cwd, \"/tmp\"];\n}\n\n/**\n * U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.\n *\n * `[]` means nothing is writable; `null` means unrestricted — which is not the same as `[\"/\"]`,\n * because unrestricted is the absence of a root rather than a root that happens to be `/`.\n *\n * The SDK already knew this: `buildBwrapArgv` binds these exact paths. It only knew it while\n * BUILDING an argv, and a consumer needs the answer earlier — tools are scoped at agent\n * construction, before any process exists, and a file-write tool has to be told its root then. With\n * nothing to ask, consumers keep a second encoding of this three-mode vocabulary and it drifts from\n * the argv builder with nothing to catch it. This reads from the same helper the builder uses, so\n * the two cannot disagree.\n */\nexport function writableRootsFor(mode: SandboxMode, cwd: string): readonly string[] | null {\n  switch (mode) {\n    case \"read-only\":\n      return [];\n    case \"workspace-write\":\n      return workspaceWriteRoots(cwd);\n    case \"danger-full-access\":\n      return null;\n  }\n}\n\n/**\n * Everything {@link buildBwrapArgv} needs besides the {@link SandboxMode}.\n *\n * Only `cwd` is required, and it is resolved to an absolute path before any bind\n * is emitted. The defaults are the restrictive ones in one direction and the\n * permissive one in the other: omitting `network` emits `--unshare-net` (no\n * network), while omitting `env` means the child INHERITS the parent\n * environment — bwrap only clears it when an allowlist is supplied.\n */\nexport interface BwrapArgvOptions {\n  /** Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). */\n  cwd: string;\n  /** `true` removes `--unshare-net` (policy `network_access`, default false). */\n  network?: boolean;\n  /** Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. */\n  gitDirExists?: boolean;\n  /**\n   * When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,\n   * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the\n   * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).\n   */\n  env?: Record<string, string>;\n}\n\n/**\n * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),\n * or `null` when the policy skips the sandbox entirely (`danger-full-access`).\n */\nexport function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] | null {\n  if (mode === \"danger-full-access\") return null; // bwrap skipped entirely (bwrap.rs:245-252)\n\n  const cwd = path.resolve(opts.cwd);\n  const gitDir = path.join(cwd, \".git\");\n  const hasGit = opts.gitDirExists ?? existsSync(gitDir);\n\n  const argv: string[] = [\n    // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)\n    \"--new-session\",\n    \"--die-with-parent\",\n    \"--unshare-user\",\n    \"--unshare-pid\",\n    // full-read filesystem base (bwrap.rs:446-452)\n    \"--ro-bind\",\n    \"/\",\n    \"/\",\n    \"--dev\",\n    \"/dev\",\n    \"--proc\",\n    \"/proc\",\n  ];\n\n  if (!opts.network) argv.push(\"--unshare-net\"); // network off by default (bwrap.rs:325-327)\n\n  // env confinement — `--clearenv` MUST precede every `--setenv` or the clear wipes them\n  // (exec_env.rs:25-31 clears then rebuilds). Only when an explicit allowlist is provided.\n  if (opts.env) argv.push(\"--clearenv\");\n  const setenv: Record<string, string> = {\n    ...(opts.env ?? {}),\n    // the flag signals the child that network is unshared (spawn.rs:20,79)\n    ...(opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: \"1\" }),\n  };\n  for (const [k, v] of Object.entries(setenv)) argv.push(\"--setenv\", k, v);\n\n  if (mode === \"workspace-write\") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);\n  // read-only: zero writable roots (protocol.rs:1176) — nothing to add\n\n  argv.push(\"--chdir\", cwd, \"--\");\n  return argv;\n}\n\n/** Injectable probes — each mirrors one Codex availability check. */\nexport interface BwrapProbes {\n  /** `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). */\n  which: () => string | null;\n  /** `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). */\n  helpText: (bin: string) => string | null;\n  /** Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). */\n  userns: (bin: string) => boolean;\n}\n\n/**\n * Result of {@link detectBwrap} / {@link detectBwrapMemoized}, discriminated on\n * `ok`: `{ ok: true, bin }` carries the absolute path of the validated `bwrap`,\n * `{ ok: false, reason }` a human-readable cause — \"bwrap not found in PATH\",\n * \"bwrap at <bin> lacks --perms support (too old)\",\n * \"user namespaces unavailable (container/kernel restriction)\",\n * \"bwrap probe failed: <err>\", or (memoized only)\n * \"bwrap disappeared from <bin> after detection\".\n *\n * `reason` is prose for a warning line. It is not a stable code — do not branch\n * on it.\n *\n * `ok: false` is an ordinary outcome rather than an error: bubblewrap is\n * Linux-only, so failing detection on macOS, on Windows, or inside a container\n * without user namespaces is expected. Detection NEVER throws, so wrapping it in\n * `try`/`catch` catches nothing; callers warn and fall back to an unconfined\n * `LocalSandbox`.\n */\nexport type BwrapDetection = { ok: true; bin: string } | { ok: false; reason: string };\n\n/** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */\nexport function detectBwrap(probes: BwrapProbes = realProbes): BwrapDetection {\n  try {\n    const bin = probes.which();\n    if (!bin) return { ok: false, reason: \"bwrap not found in PATH\" };\n    const help = probes.helpText(bin);\n    if (!help?.includes(\"--perms\")) {\n      return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };\n    }\n    if (!probes.userns(bin)) {\n      return { ok: false, reason: \"user namespaces unavailable (container/kernel restriction)\" };\n    }\n    return { ok: true, bin };\n  } catch (err) {\n    return {\n      ok: false,\n      reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n}\n\n/**\n * How many times the REAL probe ran in this process.\n *\n * Instrumented here rather than in a wrapper, because this is where the cost is: every `which`\n * spawns a subprocess (`which bwrap`), and the full probe cost 22.2 ms. A gate counting INJECTED\n * probes does not see the real one — that was the M71 gate's first mistake, and a mutant exposed it.\n */\nlet realProbeRuns = 0;\n\n/** How many real probes ran. TEST seam — the performance gate counts this. */\nexport function realProbeCount(): number {\n  return realProbeRuns;\n}\n\n/** Real probes used in production. */\nexport const realProbes: BwrapProbes = {\n  which: () => {\n    realProbeRuns++;\n    try {\n      const out = execFileSync(\"which\", [\"bwrap\"], { encoding: \"utf8\", timeout: 2_000 }).trim();\n      // anti-hijack: never accept a bwrap that lives inside the workspace (bwrap.rs:168-191)\n      if (!out || out.startsWith(process.cwd() + path.sep)) return null;\n      return out;\n    } catch {\n      return null;\n    }\n  },\n  helpText: (bin) => {\n    try {\n      // bwrap --help exits 0/1 depending on version; capture output either way\n      return execFileSync(bin, [\"--help\"], { encoding: \"utf8\", timeout: 2_000 });\n    } catch (err) {\n      const e = err as { stdout?: string; stderr?: string };\n      return [e.stdout, e.stderr].filter(Boolean).join(\"\\n\") || null;\n    }\n  },\n  userns: (bin) => {\n    try {\n      // active probe, 500ms budget like Codex (sandboxing/src/bwrap.rs:74-136)\n      execFileSync(bin, [\"--unshare-user\", \"--unshare-net\", \"--ro-bind\", \"/\", \"/\", \"/bin/true\"], {\n        timeout: 500,\n        stdio: \"ignore\",\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n};\n\n/**\n * The probe result, memoized for the lifetime of the PROCESS.\n *\n * Measured before M71: `detectBwrap()` costs **22.2 ms** and was not memoized — the second call\n * cost 19.4 ms. `buildChatAgent` on the headless path fired **two** (one from\n * `createSandboxBackend`, another from `resolveSandboxPosture`, which M70 added), totalling 46.4 ms\n * per construction — and construction happens per turn. Under `strace`, ~90% of the 182 syscalls of\n * an already-warm construction came from here: `which` sweeping the PATH, `/proc/filesystems`,\n * `/newroot`, and the `.so` files the two probe subprocesses load.\n *\n * ## Why there is no invalidation\n *\n * The milestone called for invalidating on `SessionStart`. That does not work:\n * `agents/lib/hooks/hooks.ts:28-30` documents — as a **measured** correction of an earlier\n * assumption — that the event fires **once per TURN**, not per session. Invalidating there would\n * re-probe every turn, exactly the behavior memoization exists to eliminate.\n *\n * A write-once cache is sufficient here: the expensive probe runs once per process,\n * only to print a UI warning.\n *\n * **The price, stated plainly — in BOTH directions.** The original m71-cost-per-turn#ADR-1 declared\n * only one of them; the M71 review (F-perf-9) showed the omitted one was precisely the one with a\n * security consequence:\n *\n * - **Stale negative** (`bwrap` installed AFTERWARDS): not detected until restart. The system fails\n *   CLOSED — the posture reports `enforced: false` and M70's veto **refuses**. Cost: annoyance (the\n *   message tells you to install the bwrap you just installed). Accepted.\n * - **Stale positive** (`bwrap` removed/renamed AFTERWARDS): the posture would keep asserting\n *   `enforced: true / \"kernel (bwrap)\"` and the veto would **approve**, citing a confinement that no\n *   longer exists. That is the literal reintroduction of the defect M70 fixed — *\"telling the\n *   operator they are protected when they are not is worse than saying nothing\"*. Before M71 the\n *   per-turn re-probe closed that window on the next turn; memoization would leave it open for the\n *   whole process. **That is why the positive is revalidated** below, at 1 syscall — 3 orders of\n *   magnitude below the 22.2 ms of the full probe, which is the cost memoization exists to remove.\n */\nlet memo: BwrapDetection | undefined;\n\n/**\n * `detectBwrap` with memoization — what production should call.\n *\n * Note that `detectBwrap` itself does **not** memoize, on purpose: it accepts injected probes, and\n * memoizing there would let a test with fake probes poison the process cache for everyone else.\n *\n * Revalidating the positive is NOT a re-probe: `detectBwrap` spends three probes (a `which`\n * subprocess + `--help` + a user namespace). Here we only confirm the validated binary is still in\n * place. If it vanished, the memo is downgraded to a negative with the reason stated — never\n * promoted to a positive, which would require the expensive probe back.\n */\nexport function detectBwrapMemoized(probes: BwrapProbes = realProbes): BwrapDetection {\n  memo ??= detectBwrap(probes);\n  if (memo.ok && !existsSync(memo.bin)) {\n    memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };\n  }\n  return memo;\n}\n\n/** TEST seam — clears the memo. Production never calls it (see m71-cost-per-turn#ADR-1). */\nexport function resetBwrapMemo(): void {\n  memo = undefined;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): confinement with\n// kernel confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// no dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a Buffer in pure JS.\n\n/**\n * M63 — cBPF seccomp filter generator. Produces a raw `sock_filter[]` program (the exact\n * shape `bwrap --seccomp <fd>` consumes) so syscall confinement needs no\n * native helper — bwrap applies `PR_SET_NO_NEW_PRIVS` + the filter before `execve`.\n *\n * Semantics (landlock.rs:252-253): default action = ALLOW; per-syscall match = ERRNO(EPERM). KILL is\n * used ONLY by the architecture/x32 guard. x86_64 only in v1 (aarch64 is a documented delta).\n */\n\n// BPF opcodes (linux/bpf_common.h)\nconst BPF_LD = 0x00;\nconst BPF_W = 0x00;\nconst BPF_ABS = 0x20;\nconst BPF_JMP = 0x05;\nconst BPF_JEQ = 0x10;\nconst BPF_JGE = 0x30;\nconst BPF_K = 0x00;\nconst BPF_RET = 0x06;\n\nconst LD_ABS_W = BPF_LD | BPF_W | BPF_ABS; // 0x20\nconst JEQ_K = BPF_JMP | BPF_JEQ | BPF_K; // 0x15\nconst JGE_K = BPF_JMP | BPF_JGE | BPF_K; // 0x35\nconst RET_K = BPF_RET | BPF_K; // 0x06\n\n// seccomp_data offsets (little-endian): nr@0, arch@4, args[0] low dword @16\nconst OFF_NR = 0;\nconst OFF_ARCH = 4;\nconst OFF_ARG0 = 16;\n\nconst AUDIT_ARCH_X86_64 = 0xc000003e;\nconst X32_BIT = 0x40000000; // nr >= this ⇒ x32 ABI ⇒ reject\n\n// seccomp return actions (linux/seccomp.h)\nconst SECCOMP_RET_ALLOW = 0x7fff0000;\nconst SECCOMP_RET_ERRNO = 0x00050000;\nconst EPERM = 1;\nconst RET_EPERM = SECCOMP_RET_ERRNO | (EPERM & 0xffff); // 0x00050001\nconst SECCOMP_RET_KILL_PROCESS = 0x80000000;\n\nconst AF_UNIX = 1;\n\n/** Always-denied, network-independent (landlock.rs:179-184). */\nconst ALWAYS_DENIED = [101, 310, 311, 425, 426, 427]; // ptrace, process_vm_readv/writev, io_uring_setup/enter/register\n/** Denied only when the network is restricted (landlock.rs:188-204). recvfrom(45)/sendmsg(46) are NOT here. */\nconst NETWORK_DENIED = [42, 43, 288, 49, 50, 52, 51, 48, 44, 307, 299, 55, 54];\n/** socket(2) / socketpair(2) — conditional on domain != AF_UNIX (landlock.rs:206-216). */\nconst SOCKET_SYSCALLS = [41, 53];\n\n/** One `sock_filter` instruction: `{u16 code, u8 jt, u8 jf, u32 k}`. */\ninterface Insn {\n  code: number;\n  jt: number;\n  jf: number;\n  k: number;\n}\nconst stmt = (code: number, k: number): Insn => ({ code, jt: 0, jf: 0, k });\nconst jmp = (code: number, k: number, jt: number, jf: number): Insn => ({ code, jt, jf, k });\n\n/**\n * Input to {@link buildSeccompFilter} — the one axis the generated cBPF program varies on.\n *\n * `networkRestricted: true` adds the socket-family denials on top of the always-denied syscall set;\n * `false` emits the base program, which is NOT \"no filter\". The always-denied set applies either way.\n */\nexport interface SeccompOptions {\n  /** When true (network off), also deny the socket set + non-AF_UNIX socket(). */\n  networkRestricted: boolean;\n}\n\n/**\n * Build the cBPF seccomp program as a `Buffer` (each `sock_filter` = 8 bytes). Jump targets are\n * expressed against labels and back-patched to relative offsets, so the layout is deterministic and\n * unit-testable against the authoritative syscall list.\n */\nexport function buildSeccompFilter(opts: SeccompOptions): Buffer {\n  // We assemble with symbolic targets, then resolve to relative jumps. To keep the classic\n  // \"deny → jump to a single DENY return; else fall through\" shape, DENY and ALLOW live at the END and\n  // every JEQ jumps FORWARD to them. jt/jf carry the DISTANCE (in instructions) to the target.\n  const insns: Insn[] = [];\n\n  // Placeholder labels resolved after we know total length.\n  // Layout: [arch guard][x32 guard][LD nr][deny checks...][socket checks...][ALLOW][DENY][KILL]\n  // We build the body first with jumps to ALLOW/DENY/KILL as sentinel indices, then patch.\n  const ALLOW = Symbol(\"ALLOW\");\n  const DENY = Symbol(\"DENY\");\n  const KILL = Symbol(\"KILL\");\n  type Target = typeof ALLOW | typeof DENY | typeof KILL | number;\n  interface SInsn {\n    code: number;\n    k: number;\n    jt: Target;\n    jf: Target;\n  }\n  const body: SInsn[] = [];\n  const push = (code: number, k: number, jt: Target = 0, jf: Target = 0): void => {\n    body.push({ code, k, jt, jf });\n  };\n\n  // --- arch guard: arch == x86_64 ? continue : KILL ---\n  push(LD_ABS_W, OFF_ARCH);\n  push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL); // if !=  → KILL\n  // --- x32 guard: nr >= 0x40000000 ? KILL : continue ---\n  push(LD_ABS_W, OFF_NR);\n  push(JGE_K, X32_BIT, KILL, 0); // if >= → KILL\n  // nr already loaded; keep it loaded for the deny checks.\n\n  // --- unconditional denials → DENY ---\n  const denied = opts.networkRestricted\n    ? [...ALWAYS_DENIED, ...NETWORK_DENIED]\n    : [...ALWAYS_DENIED];\n  for (const nr of denied) push(JEQ_K, nr, DENY, 0); // if nr == syscall → DENY\n\n  // --- socket-family: socket(41)/socketpair(53) → allow only AF_UNIX (only when restricted) ---\n  if (opts.networkRestricted) {\n    for (const sysno of SOCKET_SYSCALLS) {\n      // if nr == socket → check domain; else skip the 2 domain-check instructions\n      push(JEQ_K, sysno, 0, 2); // match: fall through to the LD/JEQ; no-match: jump +2 (past them)\n      push(LD_ABS_W, OFF_ARG0); // load domain (args[0] low dword)\n      push(JEQ_K, AF_UNIX, ALLOW, DENY); // AF_UNIX → ALLOW, else DENY\n      // NOTE: after these, nr is NO LONGER in the accumulator — but every remaining syscall check\n      // reloads via a fresh LD? No: the remaining path is only ALLOW. socket checks are LAST before\n      // the tail, so a fall-through (non-socket syscall that reached here) goes straight to ALLOW.\n    }\n  }\n\n  // --- tail ---\n  push(RET_K, SECCOMP_RET_ALLOW); // ALLOW label target\n  const allowIdx = body.length - 1;\n  push(RET_K, RET_EPERM); // DENY\n  const denyIdx = body.length - 1;\n  push(RET_K, SECCOMP_RET_KILL_PROCESS); // KILL\n  const killIdx = body.length - 1;\n\n  // --- resolve symbolic targets to relative offsets ---\n  // The branching IS the cBPF program: ALLOW/DENY/KILL are symbolic targets resolved to an\n  // offset RELATIVE to the next instruction. Breaking it into helpers does not reduce real complexity —\n  // it moves the jump arithmetic to another file and makes auditing against landlock.rs harder, the\n  // the authoritative source.\n  //\n  // Not refactoring NOW is an M75 process decision: this function is being MIGRATED without behavior\n  // change (plan m75, D4) and there is still no byte-for-byte equivalence oracle against the\n  // original version. Refactoring security without that oracle is changing the lock in the dark.\n  // Revisit when the parity gate (T4.2) is green — the oracle exists then.\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n  const resolve = (i: number, t: Target): number => {\n    const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;\n    // BPF jump offset is relative to the NEXT instruction: target - (i + 1)\n    const off = abs - (i + 1);\n    if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);\n    return off;\n  };\n  // `for...of` over entries instead of a raw index: the SDK compiles with `noUncheckedIndexedAccess`, which\n  // (correctly) types `body[i]` as possibly undefined. Iterating gives the guarantee in the type instead\n  // requiring a `!` — the code already could not leave the range, and now the compiler knows it.\n  for (const [i, b] of body.entries()) {\n    if (b.code === JEQ_K || b.code === JGE_K) {\n      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));\n    } else {\n      insns.push(stmt(b.code, b.k));\n    }\n  }\n\n  const buf = Buffer.alloc(insns.length * 8);\n  insns.forEach((ins, i) => {\n    buf.writeUInt16LE(ins.code, i * 8);\n    buf.writeUInt8(ins.jt, i * 8 + 2);\n    buf.writeUInt8(ins.jf, i * 8 + 3);\n    buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);\n  });\n  return buf;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1). Renamed from\n// `BwrapSandbox` to `LinuxSandbox`: bwrap is the IMPLEMENTATION, Linux is the contract — swapping the\n// mechanism (landlock, for example) should not change the name the consumer imports.\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { redactSecrets } from \"../internal/security/redact.js\";\nimport type { BwrapDetection, SandboxMode } from \"./bwrap.js\";\nimport { buildBwrapArgv, detectBwrapMemoized } from \"./bwrap.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { buildSeccompFilter } from \"./seccomp.js\";\nimport type { SandboxBackend, SandboxConfig } from \"./types.js\";\n\n/*\n * M53 — kernel-enforced sandbox backend, injected into `createShellTool({ sandbox })`.\n *\n * `LinuxSandbox extends LocalSandbox` and only REWRITES the command: `<bwrap-bin> <policy flags> --\n * /bin/sh -c '<original>'`. Everything else (spawn, output caps, timeout, ExecuteResult shape, file\n * ops) is inherited — the SDK backend stays the single execution engine. Mirrors Codex's\n * `SandboxManager::transform` (argv prefixing before spawn, never in-process).\n */\n\n/** POSIX single-quote escaping — the inner command crosses ONE extra `/bin/sh -c` boundary. */\nfunction shellQuote(s: string): string {\n  return `'${s.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\n/**\n * M57 — the single source of truth for the sandbox command wrap. Turns `command` into\n * `<bin> <bwrap flags> [--seccomp 3] -- /bin/sh -c '<command>' [3< <bpf>]`, or `null` when the policy\n * skips the sandbox (`danger-full-access`). Extracted from `LinuxSandbox.wrapCommand` so the interactive\n * PTY backend (M57) can reuse the EXACT wrap the one-shot `run_shell` already uses (DRY) — faithful to\n * Codex, where the sandbox transforms the argv before the PTY spawns it (`sandboxing/src/manager.rs:321`).\n */\nexport function wrapCommandForSandbox(\n  mode: SandboxMode,\n  opts: {\n    cwd: string;\n    network?: boolean;\n    env?: Record<string, string>;\n    bin?: string;\n    seccompPath?: string;\n  },\n  command: string,\n): string | null {\n  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });\n  if (argv === null) return null; // danger-full-access: bwrap skipped\n  const bin = opts.bin ?? \"bwrap\";\n  const seccompArgv = opts.seccompPath !== undefined ? [\"--seccomp\", \"3\"] : [];\n  const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, \"--\"].map(shellQuote).join(\" \")} /bin/sh -c ${shellQuote(command)}`;\n  return opts.seccompPath !== undefined ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;\n}\n\n/**\n * Env allowlist re-injected inside the sandbox after `--clearenv`. Codex env_clear model: the child\n * gets exactly what it needs to run a shell, never the parent's full env (which may hold oddly-named\n * secrets the SDK name-pattern scrub misses). `CODEX_SANDBOX_NETWORK_DISABLED` is added by the argv\n * builder when network is unshared.\n */\nconst ENV_ALLOWLIST = [\n  \"PATH\",\n  \"HOME\",\n  \"LANG\",\n  \"LC_ALL\",\n  \"LC_CTYPE\",\n  \"TERM\",\n  \"USER\",\n  \"TMPDIR\",\n  \"SHELL\",\n];\n\n/**\n * Build the environment a confined command runs with after `--clearenv`: `PATH`, `HOME`, `LANG`,\n * `LC_ALL`, `LC_CTYPE`, `TERM`, `USER`, `TMPDIR` and `SHELL`, copied from `source` (default\n * `process.env`) and omitted where unset.\n *\n * The allowlist shape is the point, and it is what separates this from the other env control in the\n * package. `SandboxConfig.env: \"inherit-scrubbed\"` is a denylist: it drops variables whose NAME looks\n * secret-ish, so an oddly named secret survives. Here the child gets these nine names and nothing\n * else, and a secret's name stops mattering.\n *\n * Call it when you compose the wrap yourself and need an `env` for `wrapCommandForSandbox`;\n * {@link LinuxSandbox} already applies it when its `env` option is omitted. Passing a different\n * `source` changes the VALUES, never the set of names — to give a confined command an extra variable,\n * extend the returned object, which is a fresh one on every call.\n */\nexport function allowlistedEnv(source: NodeJS.ProcessEnv = process.env): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const k of ENV_ALLOWLIST) {\n    const v = source[k];\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Kernel-confined backend for Linux hosts: a `LocalSandbox` whose commands are rewritten as\n * `bwrap <policy flags> -- /bin/sh -c '<command>'` before they are spawned. Spawning, output caps,\n * timeouts and the `ExecuteResult` shape are all inherited, so confinement is a change to the argv\n * and never an in-process one.\n *\n * Prefer `createSandboxBackend` over constructing this directly. The class assumes bubblewrap is\n * present and never probes for it, so on a host without it every command comes back failed rather\n * than confined; the factory probes first and degrades to a plain `LocalSandbox` with a warning.\n *\n * What the confinement actually covers: the filesystem is bound read-only in full, and\n * `mode: \"workspace-write\"` adds the workspace root plus `/tmp` as the only writable paths, while\n * `\"read-only\"` adds none. The network is unshared unless `network: true`. The environment is cleared\n * and repopulated from {@link allowlistedEnv} unless an explicit `env` is passed. The seccomp syscall\n * filter is a second stage with two conditions on it — x86_64 only, and only when the network is\n * restricted — so `network: true` gives you bwrap's filesystem confinement and no syscall filter.\n * `mode: \"danger-full-access\"` skips the wrap entirely and this class behaves as plain\n * `LocalSandbox`.\n *\n * `uploadFile` is overridden so that writes go through the confined `execute` (base64 over stdin,\n * keeping arbitrary content out of the shell command line). A write the policy forbids therefore\n * fails, throwing a plain `Error` naming the target path and the stderr, instead of quietly landing\n * on the host as the inherited implementation would.\n */\nexport class LinuxSandbox extends LocalSandbox {\n  private readonly mode: SandboxMode;\n  private readonly network: boolean;\n  private readonly cwd: string;\n  private readonly bin: string;\n  private readonly env: Record<string, string>;\n  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a\n   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */\n  private readonly seccompPath: string | undefined;\n\n  constructor(\n    config: SandboxConfig,\n    opts: { mode: SandboxMode; network?: boolean; bin?: string; env?: Record<string, string> },\n  ) {\n    super(config);\n    this.mode = opts.mode;\n    this.network = opts.network ?? false;\n    this.cwd = config.workDir ?? process.cwd();\n    // MEDIUM-1: run the VALIDATED absolute binary from detection (anti-hijack), never bare `bwrap`\n    // which the outer shell would re-resolve via $PATH at spawn time (TOCTOU / hijack window).\n    this.bin = opts.bin ?? \"bwrap\";\n    this.env = opts.env ?? allowlistedEnv();\n    this.seccompPath = seccompPathForNetwork(this.network);\n  }\n\n  /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */\n  wrapCommand(command: string): string | null {\n    return wrapCommandForSandbox(\n      this.mode,\n      {\n        cwd: this.cwd,\n        network: this.network,\n        env: this.env,\n        bin: this.bin,\n        seccompPath: this.seccompPath,\n      },\n      command,\n    );\n  }\n\n  /**\n   * M75 review (architecture, HIGH) — without this override the class LIED.\n   *\n   * `LinuxSandbox` documents itself as a \"kernel-enforced sandbox backend\", but it overrode only\n   * `execute`. `uploadFile` stayed the one inherited from `LocalSandbox`, which writes straight to\n   * the host via `fs/promises` and accepts an ABSOLUTE path — no bwrap, no seccomp, no path\n   * restriction. And `SandboxBackend.writeFile` delegates to it. The result was an incoherent class:\n   * reading, searching and listing went through the confinement; writing did not.\n   *\n   * Routing through the wrapped `execute` fixes it at the root: writes come to live under the SAME\n   * policy as everything else — if bwrap denies the path, the write fails, as it should. The content\n   * goes over stdin (not argv) because argv has a size limit and file content does not.\n   */\n  override async uploadFile(path: string, content: string | Buffer): Promise<void> {\n    if (this.mode === \"danger-full-access\") return super.uploadFile(path, content);\n\n    const target = path.startsWith(\"/\") ? path : `${this.cwd}/${path}`;\n    const b64 = Buffer.from(content).toString(\"base64\");\n    // base64 on a single line: avoids any shell quoting over arbitrary content, which is exactly\n    // where a \"confined\" write would turn into command injection.\n    const r = await this.execute(\n      `mkdir -p ${shellQuote(dirname(target))} && printf %s ${shellQuote(b64)} | base64 -d > ${shellQuote(target)}`,\n    );\n    if (r.exitCode !== 0) {\n      throw new Error(\n        `uploadFile blocked or failed under confinement (${target}): ${r.stderr.trim() || `exit ${r.exitCode}`}`,\n      );\n    }\n  }\n\n  override execute(command: string, opts?: { timeoutMs?: number }) {\n    const wrapped = this.wrapCommand(command);\n    if (wrapped === null) return super.execute(command, opts); // danger-full-access: plain local\n    return super.execute(wrapped, opts);\n  }\n}\n\nlet warnedNonX64 = false;\n\n/**\n * M63 — the restricted-network seccomp program is DETERMINISTIC, so write it ONCE per process and\n * reuse the path across every LinuxSandbox (no per-instance temp accumulation).\n *\n * ARCH GUARD (review HIGH): `buildSeccompFilter` emits an x86_64 program whose arch guard KILLs every\n * syscall whose `seccomp_data.arch != AUDIT_ARCH_X86_64`. On a non-x86_64 host that would brick EVERY\n * sandboxed command (the first execve is killed) — and silently, because generation succeeds and bwrap\n * accepts it. So we REFUSE to install on non-x64 and WARN through the honest-downgrade channel (bwrap\n * FS/network confinement still applies), exactly like the bwrap-missing fallback. `arch` is injectable\n * for tests. Cleaned on exit AND on SIGINT/SIGTERM (TUI Ctrl+C would otherwise leak the temp dir).\n */\nexport function seccompPathForArch(arch: string, warn: (m: string) => void): string | undefined {\n  if (arch !== \"x64\") {\n    if (!warnedNonX64) {\n      warnedNonX64 = true;\n      warn(\n        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) — running without ` +\n          \"the filter; bwrap FS/network confinement still applies.\",\n      );\n    }\n    return undefined;\n  }\n  try {\n    const dir = mkdtempSync(join(tmpdir(), \"ab-seccomp-\"));\n    const path = join(dir, \"filter.bpf\");\n    writeFileSync(path, buildSeccompFilter({ networkRestricted: true }));\n    const cleanup = (): void => rmSync(dir, { recursive: true, force: true });\n    process.once(\"exit\", cleanup);\n    process.once(\"SIGINT\", cleanup);\n    process.once(\"SIGTERM\", cleanup);\n    return path;\n  } catch (err) {\n    warn(\n      `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) — ` +\n        \"running without syscall filter (bwrap FS/network confinement still applies).\",\n    );\n    return undefined;\n  }\n}\n\nlet seccompFilterPath: string | undefined | null; // undefined = not tried; null = resolved absent\n/** M57 — exported so the interactive PTY backend reuses the SAME memoized x64-gated seccomp program. */\nexport function restrictedSeccompPath(): string | undefined {\n  if (seccompFilterPath !== undefined) return seccompFilterPath ?? undefined;\n  const path = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));\n  seccompFilterPath = path ?? null;\n  return path;\n}\n\nlet warnedUnavailable = false;\n\n/** Test seam: reset the WARN-once latch. */\nexport function resetSandboxWarnLatch(): void {\n  warnedUnavailable = false;\n}\n\n/** Durable sandbox posture for the UI — the honest answer to \"am I kernel-enforced right now?\". */\nexport interface SandboxPosture {\n  mode: SandboxMode;\n  enforced: boolean;\n  detail: string;\n}\n\n/**\n * MEDIUM-2: compute the posture so a surface (TUI footer) can show enforcement DURABLY instead of a\n * one-shot warn. `danger-full-access` is honestly reported as unenforced; an unavailable bwrap reports\n * the downgrade reason so the user never believes they are confined when they are not.\n */\nexport function resolveSandboxPosture(opts: {\n  mode: SandboxMode;\n  detect?: () => BwrapDetection;\n}): SandboxPosture {\n  if (opts.mode === \"danger-full-access\") {\n    return { mode: opts.mode, enforced: false, detail: \"no confinement (danger-full-access)\" };\n  }\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (!detection.ok) {\n    return { mode: opts.mode, enforced: false, detail: `tool-gating only — ${detection.reason}` };\n  }\n  return { mode: opts.mode, enforced: true, detail: \"kernel (bwrap)\" };\n}\n\n/**\n * Options for `createSandboxBackend`, which probes for bubblewrap and returns a {@link LinuxSandbox}\n * when confinement is genuinely available or a `LocalSandbox` when it is not — warning once when the\n * absence is a failure, and silently when `mode` is `\"danger-full-access\"`, since that is an explicit\n * opt-out rather than a degradation.\n *\n * The declared return type is `SandboxBackend` either way, so it does not tell you which one you got.\n * Call `resolveSandboxPosture({ mode })` for that, and surface it durably — the warning fires once\n * per process and a user who missed it has no way to tell they are unconfined.\n *\n * `workDir` and `timeoutMs` are forwarded into the backend's `SandboxConfig`; `maxOutputBytes` and\n * the env policy are not, and keep their defaults. `network` only reaches the confined path, being\n * meaningless on a fallback where the network was never restricted. `detect` and `warn` exist so\n * tests can drive both branches without a real bubblewrap.\n */\nexport interface CreateSandboxBackendOptions {\n  mode: SandboxMode;\n  workDir?: string;\n  network?: boolean;\n  timeoutMs?: number;\n  /** Injectable for tests; defaults to the real 3-probe detection. */\n  detect?: () => BwrapDetection;\n  /** Injectable for tests; defaults to console.warn. */\n  warn?: (message: string) => void;\n}\n\n/**\n * Honest factory: bwrap available + mode wants confinement → `LinuxSandbox` (kernel enforcement,\n * running the VALIDATED absolute bin); `danger-full-access` → plain `LocalSandbox` silently (explicit\n * opt-out, `bwrap.rs:245-252`); bwrap unavailable → WARN once + `LocalSandbox` (the declarative M23\n * gating remains the guard). NEVER pretends to sandbox — the fallback is loud, mirroring Codex's\n * MISSING_BWRAP_WARNING. The durable posture lives in `resolveSandboxPosture` for the UI.\n */\nexport function createSandboxBackend(opts: CreateSandboxBackendOptions): SandboxBackend {\n  const config: SandboxConfig = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };\n  if (opts.mode === \"danger-full-access\") return new LocalSandbox(config);\n\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (!detection.ok) {\n    if (!warnedUnavailable) {\n      warnedUnavailable = true;\n      const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n      warn(\n        `[sandbox] OS-level enforcement unavailable (${detection.reason}) — ` +\n          `falling back to tool-level gating only (sandbox_mode=${opts.mode}).`,\n      );\n    }\n    return new LocalSandbox(config);\n  }\n  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });\n}\n\n/**\n * M75 T3.2 — warning latch for the INTERACTIVE path.\n *\n * Kept separate from `createSandboxBackend`'s latch on purpose: they are two distinct decisions\n * taken at distinct moments, and a user who only ever runs an interactive shell needs to see the\n * warning even if the non-interactive path already emitted it — otherwise the session where they\n * actually type commands would be the one without the alert.\n */\nlet interactiveWarned = false;\n\n/** Reset for tests — the latch is module state and tests need isolation. */\nexport function resetInteractiveWarnLatch(): void {\n  interactiveWarned = false;\n}\n\n/**\n * The rule \"seccomp ONLY with restricted network\" — in ONE place.\n *\n * Codex installs the filter only when the network is closed (`landlock.rs:96-117`), and that is not\n * a detail: the cBPF program **denies the network syscalls** (`NETWORK_DENIED`). Applying it with\n * the network open produces the worst possible combination — bwrap **allows** the network (no\n * `--unshare-net`) and seccomp **denies** it with EPERM. The user asked for network, got the bind,\n * and the calls die.\n *\n * It existed duplicated: the constructor decided conditionally, `interactiveWrapCommand` installed\n * unconditionally. They had already diverged in the first version (M75 architecture review, proven\n * at runtime: `network:true` gave `--seccomp` interactively and not one-shot). Two copies of a\n * security rule is not duplicated form — it is duplicated KNOWLEDGE, and it had already diverged.\n */\nfunction seccompPathForNetwork(networkOpen: boolean): string | undefined {\n  return networkOpen ? undefined : restrictedSeccompPath();\n}\n\n/**\n * Options for `interactiveWrapCommand`, the PTY counterpart of `createSandboxBackend`.\n *\n * They differ in what they hand back, and that is how you choose. A PTY owns its own spawn and\n * accepts no backend object, so this path returns a `(command, cwd) => string | null` transform: the\n * wrapped command line, or `null` meaning run it as-is. Use it when something else does the spawning;\n * use `createSandboxBackend` when you want an object that executes.\n *\n * Detection is consulted on every wrap instead of being frozen at construction, because an\n * interactive session outlives the probe — a bubblewrap binary that disappears mid-session stops\n * being asserted as present.\n *\n * `network` defaults to `false`, matching the non-interactive path, and carries the same consequence:\n * the seccomp filter is installed only when the network is restricted. The warn-once latch is\n * deliberately separate from the one `createSandboxBackend` keeps, so a user who only ever opens an\n * interactive shell still sees the \"runs WITHOUT kernel confinement\" warning in the session where\n * they type commands.\n */\nexport interface InteractiveWrapOptions {\n  mode: SandboxMode;\n  /** `true` keeps the network. Default `false`, same as non-interactive `run_shell`. */\n  network?: boolean;\n  /** Injectable for tests; defaults to the real memoized detection. */\n  detect?: () => BwrapDetection;\n  /** Injectable for tests; defaults to `console.warn` with redaction. */\n  warn?: (message: string) => void;\n}\n\n/**\n * The decision to confine or degrade, separated from the wrap itself.\n *\n * Extracted because they are two responsibilities and the SDK's complexity gate separated them for\n * us: DECIDING (is confinement available? did the user opt out?) and APPLYING (assembling the argv).\n * Keeping them together pushed the closure past 10 cognitive complexity — and the linter was right:\n * the deciding part is the one with security consequences and deserves to be read on its own.\n *\n * Returns the validated binary when confinement exists, or `null` when it does not — warning ONCE,\n * and only when the absence is a failure (not when it is an opt-out).\n */\nfunction decideConfinement(opts: InteractiveWrapOptions): string | null {\n  if (opts.mode === \"danger-full-access\") return null;\n\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (detection.ok) return detection.bin;\n\n  if (!interactiveWarned) {\n    interactiveWarned = true;\n    const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n    warn(\n      `[sandbox] OS-level enforcement unavailable (${detection.reason}) — interactive session ` +\n        `runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`,\n    );\n  }\n  return null;\n}\n\n/**\n * The composition the interactive path needs — the counterpart of `createSandboxBackend`.\n *\n * `createSandboxBackend` solves this for the non-interactive path by returning a ready BACKEND. The\n * PTY accepts no backend: it owns the spawn and only allows transforming the command. This function\n * delivers the SAME decision in the shape the PTY accepts — `(command, cwd) => string | null` —\n * ready for `new PtyInteractiveBackend({ wrapCommand: interactiveWrapCommand({ mode }) })`.\n *\n * Detection is consulted on **every wrap**, not frozen at construction: an interactive session lives\n * for hours, and a stale positive detection would keep asserting confinement after the binary\n * disappeared (the `existsSync` revalidation lives inside `detectBwrapMemoized`).\n *\n * The two routes returning `null` are semantically different and the code does not merge them:\n * `danger-full-access` is an explicit opt-out and does NOT warn; bwrap being unavailable is a\n * failure and warns once.\n */\nexport function interactiveWrapCommand(\n  opts: InteractiveWrapOptions,\n): (command: string, cwd: string) => string | null {\n  return (command: string, cwd: string): string | null => {\n    const bin = decideConfinement(opts);\n    if (bin === null) return null;\n\n    return wrapCommandForSandbox(\n      opts.mode,\n      {\n        cwd,\n        network: opts.network ?? false,\n        env: allowlistedEnv(),\n        bin,\n        seccompPath: seccompPathForNetwork(opts.network ?? false),\n      },\n      command,\n    );\n  };\n}\n","/**\n * M6-3 — portable repo provisioner for the eval harness.\n *\n * Clones a repository and checks out a ref into an isolated working dir, issuing\n * every git command through {@link SandboxBackend.execute} (ADR D2 — same code\n * runs on Local/Docker/E2B; never a direct `child_process` import). Promotes\n * theocode's `prepareRepo` (`swebench-provision.ts:37`) onto the SDK's sandbox\n * abstraction.\n *\n * reference: knowledge-base/references/theocode-eval/lib/swebench-provision.ts:37\n * (clone+checkout), :13 (ProvisionError with instanceId).\n *\n * @public\n */\n\nimport { TheokitAgentError } from \"../errors.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { shellEscapePosix } from \"./shell-escape.js\";\nimport type { SandboxBackend } from \"./types.js\";\n\n/**\n * Raised when cloning or checking out a repo fails. Carries the `instanceId`\n * so a batch run can attribute the failure to the offending dataset row.\n */\nexport class RepoProvisionError extends TheokitAgentError {\n  override readonly name = \"RepoProvisionError\";\n\n  constructor(\n    readonly instanceId: string,\n    message: string,\n    options: { cause?: unknown } = {},\n  ) {\n    super(`[${instanceId}] ${message}`, {\n      code: \"repo_provision_failed\",\n      isRetryable: false,\n      ...(options.cause !== undefined ? { cause: options.cause } : {}),\n    });\n  }\n}\n\n/** Options for {@link provisionRepo}. */\nexport interface ProvisionRepoOptions {\n  /**\n   * Clonable repo URL or local path. SECURITY: when this comes from an\n   * untrusted dataset, the value is passed to `git clone` after a `--`\n   * end-of-options terminator (no flag injection) and with the `ext::`\n   * transport disabled (no arbitrary-command transport).\n   */\n  readonly repoUrl: string;\n  /** Branch, tag, or commit SHA to check out. Rejected if it begins with `-`. */\n  readonly ref: string;\n  /**\n   * Unique id for this row — names the target dir and any error. Validated to\n   * `[A-Za-z0-9._-]` (no path traversal) since it becomes a directory name.\n   */\n  readonly instanceId: string;\n}\n\n/**\n * Reject ids that would escape the workdir or be parsed as a git flag. Must\n * start with an alphanumeric (blocks `.`, `..`, `-foo`, leading-dot names) and\n * thereafter allow only `[A-Za-z0-9._-]`.\n */\nconst SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Clone `repoUrl` into `<sandbox workdir>/<instanceId>` and check out `ref`.\n * Returns the absolute `repoDir` (resolved via `git rev-parse --show-toplevel`,\n * which is portable across backends). Throws {@link RepoProvisionError} naming\n * the `instanceId` when clone or checkout exits non-zero.\n *\n * The `sandbox` is optional (V3-5): when omitted, a default {@link LocalSandbox}\n * is used (clones into the process cwd's `<instanceId>`) — pass an explicit\n * sandbox (e.g. `LocalSandbox({ workDir })` / Docker / E2B) to control the workdir.\n */\nexport function provisionRepo(opts: ProvisionRepoOptions): Promise<{ repoDir: string }>;\nexport function provisionRepo(\n  sandbox: SandboxBackend,\n  opts: ProvisionRepoOptions,\n): Promise<{ repoDir: string }>;\nexport async function provisionRepo(\n  sandboxOrOpts: SandboxBackend | ProvisionRepoOptions,\n  maybeOpts?: ProvisionRepoOptions,\n): Promise<{ repoDir: string }> {\n  const sandbox = maybeOpts !== undefined ? (sandboxOrOpts as SandboxBackend) : new LocalSandbox();\n  const opts = maybeOpts ?? (sandboxOrOpts as ProvisionRepoOptions);\n  const { repoUrl, ref, instanceId } = opts;\n\n  // Validate untrusted-derivable inputs before they reach git/the shell.\n  if (!SAFE_INSTANCE_ID.test(instanceId)) {\n    throw new RepoProvisionError(\n      instanceId,\n      \"invalid instanceId: must match [A-Za-z0-9._-] (no path traversal)\",\n    );\n  }\n  if (ref.startsWith(\"-\")) {\n    throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);\n  }\n\n  // `--` terminates options (no `--upload-pack=` flag injection); `protocol.ext.allow=never`\n  // blocks the `ext::` arbitrary-command transport. `file`/`https` stay allowed.\n  const clone = await sandbox.execute(\n    `git -c protocol.ext.allow=never clone --quiet -- ${shellEscapePosix(repoUrl)} ${shellEscapePosix(instanceId)}`,\n  );\n  if (clone.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);\n  }\n\n  const top = await sandbox.execute(\n    `git -C ${shellEscapePosix(instanceId)} rev-parse --show-toplevel`,\n  );\n  if (top.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);\n  }\n  const repoDir = top.stdout.trim();\n\n  // `ref` is validated above not to begin with `-`, so it cannot be parsed as a flag.\n  const checkout = await sandbox.execute(\n    `git -C ${shellEscapePosix(repoDir)} checkout --quiet ${shellEscapePosix(ref)}`,\n  );\n  if (checkout.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);\n  }\n\n  return { repoDir };\n}\n"]}
+{"version":3,"sources":["../../src/sandbox/bwrap.ts","../../src/sandbox/seccomp.ts","../../src/sandbox/linux-sandbox.ts","../../src/sandbox/provision.ts"],"names":["path"],"mappings":";;;;;;;;;;;AAiCA,SAAS,kBAAA,CAAmB,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAiB,MAAA,EAAsB;AAC9F,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAoB,GAAG,CAAA,OAAQ,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,CAAA;AAC3E,EAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,QAAQ,MAAM,CAAA;AACnD;AAGA,SAAS,oBAAoB,GAAA,EAAgC;AAC3D,EAAA,OAAO,CAAC,KAAK,MAAM,CAAA;AACrB;AAeO,SAAS,gBAAA,CAAiB,MAAmB,GAAA,EAAuC;AACzF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,WAAA;AACH,MAAA,OAAO,EAAC;AAAA,IACV,KAAK,iBAAA;AACH,MAAA,OAAO,oBAAoB,GAAG,CAAA;AAAA,IAChC,KAAK,oBAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AA8BO,SAAS,cAAA,CAAe,MAAmB,IAAA,EAAyC;AACzF,EAAA,IAAI,IAAA,KAAS,sBAAsB,OAAO,IAAA;AAE1C,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AACjC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAgB,UAAA,CAAW,MAAM,CAAA;AAErD,EAAA,MAAM,IAAA,GAAiB;AAAA;AAAA,IAErB,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA;AAAA,IAEA,WAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,KAAK,eAAe,CAAA;AAI5C,EAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,YAAY,CAAA;AACpC,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,GAAI,IAAA,CAAK,GAAA,IAAO,EAAC;AAAA;AAAA,IAEjB,GAAI,IAAA,CAAK,OAAA,GAAU,EAAC,GAAI,EAAE,gCAAgC,GAAA;AAAI,GAChE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,CAAC,CAAA;AAEvE,EAAA,IAAI,SAAS,iBAAA,EAAmB,kBAAA,CAAmB,IAAA,EAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AAG5E,EAAA,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA;AAC9B,EAAA,OAAO,IAAA;AACT;AAiCO,SAAS,WAAA,CAAY,SAAsB,UAAA,EAA4B;AAC5E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,EAAM;AACzB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,yBAAA,EAA0B;AAChE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,IAAA,EAAM,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,SAAA,EAAY,GAAG,CAAA,gCAAA,CAAA,EAAmC;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4DAAA,EAA6D;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,uBAAuB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AACF;AASA,IAAI,aAAA,GAAgB,CAAA;AAGb,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,aAAA;AACT;AAGO,IAAM,UAAA,GAA0B;AAAA,EACrC,OAAO,MAAM;AACX,IAAA,aAAA,EAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,EAAE,IAAA,EAAK;AAExF,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,UAAA,CAAW,OAAA,CAAQ,KAAI,GAAI,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,IAAA;AAC7D,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,GAAA,KAAQ;AACjB,IAAA,IAAI;AAEF,MAAA,OAAO,YAAA,CAAa,GAAA,EAAK,CAAC,QAAQ,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAO,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,CAAC,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA;AAAA,IAC5D;AAAA,EACF,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,IAAA,IAAI;AAEF,MAAA,YAAA,CAAa,GAAA,EAAK,CAAC,gBAAA,EAAkB,eAAA,EAAiB,aAAa,GAAA,EAAK,GAAA,EAAK,WAAW,CAAA,EAAG;AAAA,QACzF,OAAA,EAAS,GAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;AAqCA,IAAI,IAAA;AAaG,SAAS,mBAAA,CAAoB,SAAsB,UAAA,EAA4B;AACpF,EAAA,IAAA,KAAS,YAAY,MAAM,CAAA;AAC3B,EAAA,IAAI,KAAK,EAAA,IAAM,CAAC,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,EAAG;AACpC,IAAA,IAAA,GAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA,gBAAA,CAAA,EAAmB;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,cAAA,GAAuB;AACrC,EAAA,IAAA,GAAO,MAAA;AACT;;;AC3RA,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,OAAA,GAAU,EAAA;AAChB,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,OAAA,GAAU,CAAA;AAEhB,IAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,OAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,KAAA,GAAQ,UAAU,OAAA,GAAU,KAAA;AAClC,IAAM,QAAQ,OAAA,GAAU,KAAA;AAGxB,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,OAAA,GAAU,UAAA;AAGhB,IAAM,iBAAA,GAAoB,UAAA;AAC1B,IAAM,iBAAA,GAAoB,MAAA;AAC1B,IAAM,KAAA,GAAQ,CAAA;AACd,IAAM,SAAA,GAAY,oBAAqB,KAAA,GAAQ,KAAA;AAC/C,IAAM,wBAAA,GAA2B,UAAA;AAEjC,IAAM,OAAA,GAAU,CAAA;AAGhB,IAAM,gBAAgB,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AAwBnD,IAAM,cAAA,GAAiB,CAAC,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,IAAI,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,GAAG,CAAA;AAE7D,IAAM,eAAA,GAAkB,CAAC,EAAA,EAAI,EAAE,CAAA;AAS/B,IAAM,IAAA,GAAO,CAAC,IAAA,EAAc,CAAA,MAAqB,EAAE,MAAM,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,CAAA,EAAG,CAAA,EAAE,CAAA;AACzE,IAAM,GAAA,GAAM,CAAC,IAAA,EAAc,CAAA,EAAW,EAAA,EAAY,QAAsB,EAAE,IAAA,EAAM,EAAA,EAAI,EAAA,EAAI,CAAA,EAAE,CAAA;AAkBnF,SAAS,mBAAmB,IAAA,EAA8B;AAI/D,EAAA,MAAM,QAAgB,EAAC;AAKvB,EAAA,MAAM,KAAA,0BAAe,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAC1B,EAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAQ1B,EAAA,MAAM,OAAgB,EAAC;AACvB,EAAA,MAAM,OAAO,CAAC,IAAA,EAAc,GAAW,EAAA,GAAa,CAAA,EAAG,KAAa,CAAA,KAAY;AAC9E,IAAA,IAAA,CAAK,KAAK,EAAE,IAAA,EAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAA;AAAA,EAC/B,CAAA;AAGA,EAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,EAAA,IAAA,CAAK,KAAA,EAAO,iBAAA,EAAmB,CAAA,EAAG,IAAI,CAAA;AAEtC,EAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,EAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAC,CAAA;AAI5B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,iBAAA,GAChB,CAAC,GAAG,aAAA,EAAe,GAAG,cAAc,CAAA,GACpC,CAAC,GAAG,aAAa,CAAA;AACrB,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,EAAA,EAAI,MAAM,CAAC,CAAA;AAGhD,EAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,IAAA,KAAA,MAAW,SAAS,eAAA,EAAiB;AAEnC,MAAA,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,CAAC,CAAA;AACvB,MAAA,IAAA,CAAK,UAAU,QAAQ,CAAA;AACvB,MAAA,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AAAA,IAIlC;AAAA,EACF;AAGA,EAAA,IAAA,CAAK,OAAO,iBAAiB,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,GAAS,CAAA;AAC/B,EAAA,IAAA,CAAK,OAAO,SAAS,CAAA;AACrB,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAC9B,EAAA,IAAA,CAAK,OAAO,wBAAwB,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,CAAA;AAa9B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,EAAW,CAAA,KAAsB;AAChD,IAAA,MAAM,GAAA,GAAM,CAAA,KAAM,KAAA,GAAQ,QAAA,GAAW,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,KAAM,IAAA,GAAO,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,CAAA;AAE3F,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,GAAI,CAAA,CAAA;AACvB,IAAA,IAAI,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,GAAA,EAAK,MAAM,IAAI,UAAA,CAAW,CAAA,6BAAA,EAAgC,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1F,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAIA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACnC,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,CAAA,CAAE,SAAS,KAAA,EAAO;AACxC,MAAA,KAAA,CAAM,KAAK,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,CAAA,CAAE,EAAE,CAAC,CAAC,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,KAAK,IAAA,CAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA;AACjC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,CAAA,GAAI,IAAI,CAAC,CAAA;AAChC,IAAA,GAAA,CAAI,cAAc,GAAA,CAAI,CAAA,KAAM,CAAA,EAAG,CAAA,GAAI,IAAI,CAAC,CAAA;AAAA,EAC1C,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;;;AC3KA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AASO,SAAS,qBAAA,CACd,IAAA,EACA,IAAA,EAOA,OAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AACzF,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACxB,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,KAAgB,MAAA,GAAY,CAAC,WAAA,EAAa,GAAG,IAAI,EAAC;AAC3E,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAG,WAAA,EAAa,IAAI,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,YAAA,EAAe,UAAA,CAAW,OAAO,CAAC,CAAA,CAAA;AAC3I,EAAA,OAAO,IAAA,CAAK,WAAA,KAAgB,MAAA,GAAY,CAAA,EAAG,IAAI,OAAO,UAAA,CAAW,IAAA,CAAK,WAAW,CAAC,CAAA,CAAA,GAAK,IAAA;AACzF;AAQA,IAAM,aAAA,GAAgB;AAAA,EACpB,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAiBO,SAAS,cAAA,CAAe,MAAA,GAA4B,OAAA,CAAQ,GAAA,EAA6B;AAC9F,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,KAAK,aAAA,EAAe;AAC7B,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AA0BO,IAAM,YAAA,GAAN,cAA2B,YAAA,CAAa;AAAA,EAC5B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA,EACA,GAAA;AAAA;AAAA;AAAA,EAGA,WAAA;AAAA,EAEjB,WAAA,CACE,QACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,KAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,MAAA,CAAO,OAAA,IAAW,OAAA,CAAQ,GAAA,EAAI;AAGzC,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,OAAA;AACvB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,cAAA,EAAe;AACtC,IAAA,IAAA,CAAK,WAAA,GAAc,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA;AAAA,EACvD;AAAA;AAAA,EAGA,YAAY,OAAA,EAAgC;AAC1C,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAe,UAAA,CAAWA,KAAAA,EAAc,OAAA,EAAyC;AAC/E,IAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,SAA6B,KAAA,CAAM,UAAA,CAAWA,OAAM,OAAO,CAAA;AAE7E,IAAA,MAAM,MAAA,GAASA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAIA,QAAO,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,CAAA,EAAIA,KAAI,CAAA,CAAA;AAChE,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAGlD,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,MACnB,CAAA,SAAA,EAAY,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA,cAAA,EAAiB,UAAA,CAAW,GAAG,CAAC,CAAA,eAAA,EAAkB,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,KAC7G;AACA,IAAA,IAAI,CAAA,CAAE,aAAa,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gDAAA,EAAmD,MAAM,CAAA,GAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAK,IAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAA;AAAA,OACxG;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAA,CAAQ,SAAiB,IAAA,EAA+B;AAC/D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,OAAO,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,SAAS,IAAI,CAAA;AACxD,IAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EACpC;AACF;AAEA,IAAI,YAAA,GAAe,KAAA;AAaZ,SAAS,kBAAA,CAAmB,MAAc,IAAA,EAA+C;AAC9F,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,YAAA,GAAe,IAAA;AACf,MAAA,IAAA;AAAA,QACE,mDAAmD,IAAI,CAAA,mGAAA;AAAA,OAEzD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAO,EAAG,aAAa,CAAC,CAAA;AACrD,IAAA,MAAMA,KAAAA,GAAO,IAAA,CAAK,GAAA,EAAK,YAAY,CAAA;AACnC,IAAA,aAAA,CAAcA,OAAM,kBAAA,CAAmB,EAAE,iBAAA,EAAmB,IAAA,EAAM,CAAC,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,MAAY,MAAA,CAAO,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AACxE,IAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,OAAO,CAAA;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,WAAW,OAAO,CAAA;AAC/B,IAAA,OAAOA,KAAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,yCAAyC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,qFAAA;AAAA,KAE3F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,IAAI,iBAAA;AAEG,SAAS,qBAAA,GAA4C;AAC1D,EAAA,IAAI,iBAAA,KAAsB,MAAA,EAAW,OAAO,iBAAA,IAAqB,MAAA;AACjE,EAAA,MAAMA,KAAAA,GAAO,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,iBAAA,GAAoBA,KAAAA,IAAQ,IAAA;AAC5B,EAAA,OAAOA,KAAAA;AACT;AAEA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,qBAAA,GAA8B;AAC5C,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAcO,SAAS,sBAAsB,IAAA,EAGnB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,oBAAA,EAAsB;AACtC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,qCAAA,EAAsC;AAAA,EAC3F;AACA,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,QAAA,EAAU,OAAO,MAAA,EAAQ,CAAA,wBAAA,EAAsB,SAAA,CAAU,MAAM,CAAA,CAAA,EAAG;AAAA,EAC9F;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,IAAA,EAAM,QAAQ,gBAAA,EAAiB;AACrE;AAmCO,SAAS,qBAAqB,IAAA,EAAmD;AACtF,EAAA,MAAM,SAAwB,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,SAAA,EAAW,KAAK,SAAA,EAAU;AACjF,EAAA,IAAI,KAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAI,aAAa,MAAM,CAAA;AAEtE,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,MAAA,IAAA;AAAA,QACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,8DAAA,EACL,KAAK,IAAI,CAAA,EAAA;AAAA,OACrE;AAAA,IACF;AACA,IAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,IAAI,YAAA,CAAa,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,GAAA,EAAK,SAAA,CAAU,KAAK,CAAA;AAChG;AAUA,IAAI,iBAAA,GAAoB,KAAA;AAGjB,SAAS,yBAAA,GAAkC;AAChD,EAAA,iBAAA,GAAoB,KAAA;AACtB;AAgBA,SAAS,sBAAsB,WAAA,EAA0C;AACvE,EAAA,OAAO,WAAA,GAAc,SAAY,qBAAA,EAAsB;AACzD;AAyCA,SAAS,kBAAkB,IAAA,EAA6C;AACtE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,oBAAA,EAAsB,OAAO,IAAA;AAE/C,EAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAqB;AACvD,EAAA,IAAI,SAAA,CAAU,EAAA,EAAI,OAAO,SAAA,CAAU,GAAA;AAEnC,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,iBAAA,GAAoB,IAAA;AACpB,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,CAAC,MAAc,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA;AACvE,IAAA,IAAA;AAAA,MACE,CAAA,4CAAA,EAA+C,SAAA,CAAU,MAAM,CAAA,2EAAA,EACZ,KAAK,IAAI,CAAA,EAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBO,SAAS,uBACd,IAAA,EACiD;AACjD,EAAA,OAAO,CAAC,SAAiB,GAAA,KAA+B;AACtD,IAAA,MAAM,GAAA,GAAM,kBAAkB,IAAI,CAAA;AAClC,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AAEzB,IAAA,OAAO,qBAAA;AAAA,MACL,IAAA,CAAK,IAAA;AAAA,MACL;AAAA,QACE,GAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,KAAA;AAAA,QACzB,KAAK,cAAA,EAAe;AAAA,QACpB,GAAA;AAAA,QACA,WAAA,EAAa,qBAAA,CAAsB,IAAA,CAAK,OAAA,IAAW,KAAK;AAAA,OAC1D;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA;AACF;;;AClbO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EAGxD,WAAA,CACW,UAAA,EACT,OAAA,EACA,OAAA,GAA+B,EAAC,EAChC;AACA,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,UAAU,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,EAAI;AAAA,MAClC,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,KAC/D,CAAA;AARQ,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EATW,UAAA;AAAA,EAHO,IAAA,GAAO,oBAAA;AAa3B;AAyBA,IAAM,gBAAA,GAAmB,8BAAA;AAiBzB,eAAsB,aAAA,CACpB,eACA,SAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,SAAA,KAAc,MAAA,GAAa,aAAA,GAAmC,IAAI,YAAA,EAAa;AAC/F,EAAA,MAAM,OAAO,SAAA,IAAc,aAAA;AAC3B,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAK,UAAA,EAAW,GAAI,IAAA;AAGrC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,0CAAA,EAA6C,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EAC9F;AAIA,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC1B,oDAAoD,gBAAA,CAAiB,OAAO,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,GAC/G;AACA,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,cAAA,EAAiB,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,OAAA;AAAA,IACxB,CAAA,OAAA,EAAU,gBAAA,CAAiB,UAAU,CAAC,CAAA,0BAAA;AAAA,GACxC;AACA,EAAA,IAAI,GAAA,CAAI,aAAa,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,mBAAmB,UAAA,EAAY,CAAA,wBAAA,EAA2B,IAAI,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAGhC,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA;AAAA,IAC7B,UAAU,gBAAA,CAAiB,OAAO,CAAC,CAAA,kBAAA,EAAqB,gBAAA,CAAiB,GAAG,CAAC,CAAA;AAAA,GAC/E;AACA,EAAA,IAAI,QAAA,CAAS,aAAa,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,kBAAA,CAAmB,UAAA,EAAY,CAAA,SAAA,EAAY,GAAG,YAAY,QAAA,CAAS,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB","file":"index.js","sourcesContent":["// Promoted out of the agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): kernel\n// confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a pure-JS Buffer.\n\nimport { execFileSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/*\n * M53 — bubblewrap argv + honest detection.\n *\n * HONEST SCOPE: filesystem confinement + network isolation via bwrap, PLUS the second stage —\n * a cBPF seccomp syscall filter (`agents/sandbox/seccomp.ts`), wired in `agents/sandbox/backend.ts`\n * via `restrictedSeccompPath()`. Ported in M63; this block claimed the opposite until M67 and\n * UNDER-DECLARED the real security posture. The honest limit that remains: the filter is **x86_64**\n * (an architecture guard refuses to install it on any other arch, with a WARN, and bwrap's FS/network\n * confinement still applies) **and** it is only installed when the network is restricted\n * (`backend.ts:87`, faithful to `landlock.rs:96-117`): with the network on there is no syscall\n * filter, only bwrap's FS confinement. `danger-full-access` skips bwrap entirely, mirroring\n * `bwrap.rs:245-252`. Deltas versus Codex remain documented in docs/CODEX-PARITY.md.\n */\n\n/**\n * Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer\n * configuration: `danger-full-access` means \"do not wrap\", and that is a decision belonging to the\n * confinement subsystem.\n */\nexport type SandboxMode = \"read-only\" | \"workspace-write\" | \"danger-full-access\";\n\n/**\n * The RW binds `workspace-write` installs (protocol.rs:1189-1214), plus the metadata protection that\n * must sit ON TOP of them — order matters (permissions.rs:22-31; bwrap.rs:571-597).\n */\nfunction pushWorkspaceBinds(argv: string[], cwd: string, hasGit: boolean, gitDir: string): void {\n  for (const root of workspaceWriteRoots(cwd)) argv.push(\"--bind\", root, root);\n  if (hasGit) argv.push(\"--ro-bind\", gitDir, gitDir);\n}\n\n/** The RW binds `workspace-write` installs (protocol.rs:1189-1214): the workspace itself, and /tmp. */\nfunction workspaceWriteRoots(cwd: string): readonly string[] {\n  return [cwd, \"/tmp\"];\n}\n\n/**\n * U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.\n *\n * `[]` means nothing is writable; `null` means unrestricted — which is not the same as `[\"/\"]`,\n * because unrestricted is the absence of a root rather than a root that happens to be `/`.\n *\n * The SDK already knew this: `buildBwrapArgv` binds these exact paths. It only knew it while\n * BUILDING an argv, and a consumer needs the answer earlier — tools are scoped at agent\n * construction, before any process exists, and a file-write tool has to be told its root then. With\n * nothing to ask, consumers keep a second encoding of this three-mode vocabulary and it drifts from\n * the argv builder with nothing to catch it. This reads from the same helper the builder uses, so\n * the two cannot disagree.\n */\nexport function writableRootsFor(mode: SandboxMode, cwd: string): readonly string[] | null {\n  switch (mode) {\n    case \"read-only\":\n      return [];\n    case \"workspace-write\":\n      return workspaceWriteRoots(cwd);\n    case \"danger-full-access\":\n      return null;\n  }\n}\n\n/**\n * Everything {@link buildBwrapArgv} needs besides the {@link SandboxMode}.\n *\n * Only `cwd` is required, and it is resolved to an absolute path before any bind\n * is emitted. The defaults are the restrictive ones in one direction and the\n * permissive one in the other: omitting `network` emits `--unshare-net` (no\n * network), while omitting `env` means the child INHERITS the parent\n * environment — bwrap only clears it when an allowlist is supplied.\n */\nexport interface BwrapArgvOptions {\n  /** Workspace root — the single RW bind under `workspace-write` (protocol.rs:1189-1200). */\n  cwd: string;\n  /** `true` removes `--unshare-net` (policy `network_access`, default false). */\n  network?: boolean;\n  /** Injectable for tests; defaults to a real `existsSync` check on `<cwd>/.git`. */\n  gitDirExists?: boolean;\n  /**\n   * When present, emit `--clearenv` and re-inject ONLY these vars (Codex env_clear model,\n   * `exec_env.rs:25-31`). Closes the denylist gap: a secret in an oddly-named var never reaches the\n   * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).\n   */\n  env?: Record<string, string>;\n}\n\n/**\n * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),\n * or `null` when the policy skips the sandbox entirely (`danger-full-access`).\n */\nexport function buildBwrapArgv(mode: SandboxMode, opts: BwrapArgvOptions): string[] | null {\n  if (mode === \"danger-full-access\") return null; // bwrap skipped entirely (bwrap.rs:245-252)\n\n  const cwd = path.resolve(opts.cwd);\n  const gitDir = path.join(cwd, \".git\");\n  const hasGit = opts.gitDirExists ?? existsSync(gitDir);\n\n  const argv: string[] = [\n    // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)\n    \"--new-session\",\n    \"--die-with-parent\",\n    \"--unshare-user\",\n    \"--unshare-pid\",\n    // full-read filesystem base (bwrap.rs:446-452)\n    \"--ro-bind\",\n    \"/\",\n    \"/\",\n    \"--dev\",\n    \"/dev\",\n    \"--proc\",\n    \"/proc\",\n  ];\n\n  if (!opts.network) argv.push(\"--unshare-net\"); // network off by default (bwrap.rs:325-327)\n\n  // env confinement — `--clearenv` MUST precede every `--setenv` or the clear wipes them\n  // (exec_env.rs:25-31 clears then rebuilds). Only when an explicit allowlist is provided.\n  if (opts.env) argv.push(\"--clearenv\");\n  const setenv: Record<string, string> = {\n    ...(opts.env ?? {}),\n    // the flag signals the child that network is unshared (spawn.rs:20,79)\n    ...(opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: \"1\" }),\n  };\n  for (const [k, v] of Object.entries(setenv)) argv.push(\"--setenv\", k, v);\n\n  if (mode === \"workspace-write\") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);\n  // read-only: zero writable roots (protocol.rs:1176) — nothing to add\n\n  argv.push(\"--chdir\", cwd, \"--\");\n  return argv;\n}\n\n/** Injectable probes — each mirrors one Codex availability check. */\nexport interface BwrapProbes {\n  /** `which bwrap` outside the cwd (anti-hijack, sandboxing/src/bwrap.rs:168-191). */\n  which: () => string | null;\n  /** `bwrap --help` text — must advertise `--perms` (launcher.rs:108-124). */\n  helpText: (bin: string) => string | null;\n  /** Active user-namespace probe with timeout (sandboxing/src/bwrap.rs:74-136). */\n  userns: (bin: string) => boolean;\n}\n\n/**\n * Result of {@link detectBwrap} / {@link detectBwrapMemoized}, discriminated on\n * `ok`: `{ ok: true, bin }` carries the absolute path of the validated `bwrap`,\n * `{ ok: false, reason }` a human-readable cause — \"bwrap not found in PATH\",\n * \"bwrap at <bin> lacks --perms support (too old)\",\n * \"user namespaces unavailable (container/kernel restriction)\",\n * \"bwrap probe failed: <err>\", or (memoized only)\n * \"bwrap disappeared from <bin> after detection\".\n *\n * `reason` is prose for a warning line. It is not a stable code — do not branch\n * on it.\n *\n * `ok: false` is an ordinary outcome rather than an error: bubblewrap is\n * Linux-only, so failing detection on macOS, on Windows, or inside a container\n * without user namespaces is expected. Detection NEVER throws, so wrapping it in\n * `try`/`catch` catches nothing; callers warn and fall back to an unconfined\n * `LocalSandbox`.\n */\nexport type BwrapDetection = { ok: true; bin: string } | { ok: false; reason: string };\n\n/** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */\nexport function detectBwrap(probes: BwrapProbes = realProbes): BwrapDetection {\n  try {\n    const bin = probes.which();\n    if (!bin) return { ok: false, reason: \"bwrap not found in PATH\" };\n    const help = probes.helpText(bin);\n    if (!help?.includes(\"--perms\")) {\n      return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };\n    }\n    if (!probes.userns(bin)) {\n      return { ok: false, reason: \"user namespaces unavailable (container/kernel restriction)\" };\n    }\n    return { ok: true, bin };\n  } catch (err) {\n    return {\n      ok: false,\n      reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n}\n\n/**\n * How many times the REAL probe ran in this process.\n *\n * Instrumented here rather than in a wrapper, because this is where the cost is: every `which`\n * spawns a subprocess (`which bwrap`), and the full probe cost 22.2 ms. A gate counting INJECTED\n * probes does not see the real one — that was the M71 gate's first mistake, and a mutant exposed it.\n */\nlet realProbeRuns = 0;\n\n/** How many real probes ran. TEST seam — the performance gate counts this. */\nexport function realProbeCount(): number {\n  return realProbeRuns;\n}\n\n/** Real probes used in production. */\nexport const realProbes: BwrapProbes = {\n  which: () => {\n    realProbeRuns++;\n    try {\n      const out = execFileSync(\"which\", [\"bwrap\"], { encoding: \"utf8\", timeout: 2_000 }).trim();\n      // anti-hijack: never accept a bwrap that lives inside the workspace (bwrap.rs:168-191)\n      if (!out || out.startsWith(process.cwd() + path.sep)) return null;\n      return out;\n    } catch {\n      return null;\n    }\n  },\n  helpText: (bin) => {\n    try {\n      // bwrap --help exits 0/1 depending on version; capture output either way\n      return execFileSync(bin, [\"--help\"], { encoding: \"utf8\", timeout: 2_000 });\n    } catch (err) {\n      const e = err as { stdout?: string; stderr?: string };\n      return [e.stdout, e.stderr].filter(Boolean).join(\"\\n\") || null;\n    }\n  },\n  userns: (bin) => {\n    try {\n      // active probe, 500ms budget like Codex (sandboxing/src/bwrap.rs:74-136)\n      execFileSync(bin, [\"--unshare-user\", \"--unshare-net\", \"--ro-bind\", \"/\", \"/\", \"/bin/true\"], {\n        timeout: 500,\n        stdio: \"ignore\",\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n};\n\n/**\n * The probe result, memoized for the lifetime of the PROCESS.\n *\n * Measured before M71: `detectBwrap()` costs **22.2 ms** and was not memoized — the second call\n * cost 19.4 ms. `buildChatAgent` on the headless path fired **two** (one from\n * `createSandboxBackend`, another from `resolveSandboxPosture`, which M70 added), totalling 46.4 ms\n * per construction — and construction happens per turn. Under `strace`, ~90% of the 182 syscalls of\n * an already-warm construction came from here: `which` sweeping the PATH, `/proc/filesystems`,\n * `/newroot`, and the `.so` files the two probe subprocesses load.\n *\n * ## Why there is no invalidation\n *\n * The milestone called for invalidating on `SessionStart`. That does not work:\n * `agents/lib/hooks/hooks.ts:28-30` documents — as a **measured** correction of an earlier\n * assumption — that the event fires **once per TURN**, not per session. Invalidating there would\n * re-probe every turn, exactly the behavior memoization exists to eliminate.\n *\n * A write-once cache is sufficient here: the expensive probe runs once per process,\n * only to print a UI warning.\n *\n * **The price, stated plainly — in BOTH directions.** The original m71-cost-per-turn#ADR-1 declared\n * only one of them; the M71 review (F-perf-9) showed the omitted one was precisely the one with a\n * security consequence:\n *\n * - **Stale negative** (`bwrap` installed AFTERWARDS): not detected until restart. The system fails\n *   CLOSED — the posture reports `enforced: false` and M70's veto **refuses**. Cost: annoyance (the\n *   message tells you to install the bwrap you just installed). Accepted.\n * - **Stale positive** (`bwrap` removed/renamed AFTERWARDS): the posture would keep asserting\n *   `enforced: true / \"kernel (bwrap)\"` and the veto would **approve**, citing a confinement that no\n *   longer exists. That is the literal reintroduction of the defect M70 fixed — *\"telling the\n *   operator they are protected when they are not is worse than saying nothing\"*. Before M71 the\n *   per-turn re-probe closed that window on the next turn; memoization would leave it open for the\n *   whole process. **That is why the positive is revalidated** below, at 1 syscall — 3 orders of\n *   magnitude below the 22.2 ms of the full probe, which is the cost memoization exists to remove.\n */\nlet memo: BwrapDetection | undefined;\n\n/**\n * `detectBwrap` with memoization — what production should call.\n *\n * Note that `detectBwrap` itself does **not** memoize, on purpose: it accepts injected probes, and\n * memoizing there would let a test with fake probes poison the process cache for everyone else.\n *\n * Revalidating the positive is NOT a re-probe: `detectBwrap` spends three probes (a `which`\n * subprocess + `--help` + a user namespace). Here we only confirm the validated binary is still in\n * place. If it vanished, the memo is downgraded to a negative with the reason stated — never\n * promoted to a positive, which would require the expensive probe back.\n */\nexport function detectBwrapMemoized(probes: BwrapProbes = realProbes): BwrapDetection {\n  memo ??= detectBwrap(probes);\n  if (memo.ok && !existsSync(memo.bin)) {\n    memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };\n  }\n  return memo;\n}\n\n/** TEST seam — clears the memo. Production never calls it (see m71-cost-per-turn#ADR-1). */\nexport function resetBwrapMemo(): void {\n  memo = undefined;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1): confinement with\n// kernel confinement is framework infrastructure, not the consumer's. Measured cost of the promotion: ZERO\n// no dependencies — only node:child_process, node:fs and node:path. The cBPF filter is a Buffer in pure JS.\n\n/**\n * M63 — cBPF seccomp filter generator. Produces a raw `sock_filter[]` program (the exact\n * shape `bwrap --seccomp <fd>` consumes) so syscall confinement needs no\n * native helper — bwrap applies `PR_SET_NO_NEW_PRIVS` + the filter before `execve`.\n *\n * Semantics (landlock.rs:252-253): default action = ALLOW; per-syscall match = ERRNO(EPERM). KILL is\n * used ONLY by the architecture/x32 guard. x86_64 only in v1 (aarch64 is a documented delta).\n */\n\n// BPF opcodes (linux/bpf_common.h)\nconst BPF_LD = 0x00;\nconst BPF_W = 0x00;\nconst BPF_ABS = 0x20;\nconst BPF_JMP = 0x05;\nconst BPF_JEQ = 0x10;\nconst BPF_JGE = 0x30;\nconst BPF_K = 0x00;\nconst BPF_RET = 0x06;\n\nconst LD_ABS_W = BPF_LD | BPF_W | BPF_ABS; // 0x20\nconst JEQ_K = BPF_JMP | BPF_JEQ | BPF_K; // 0x15\nconst JGE_K = BPF_JMP | BPF_JGE | BPF_K; // 0x35\nconst RET_K = BPF_RET | BPF_K; // 0x06\n\n// seccomp_data offsets (little-endian): nr@0, arch@4, args[0] low dword @16\nconst OFF_NR = 0;\nconst OFF_ARCH = 4;\nconst OFF_ARG0 = 16;\n\nconst AUDIT_ARCH_X86_64 = 0xc000003e;\nconst X32_BIT = 0x40000000; // nr >= this ⇒ x32 ABI ⇒ reject\n\n// seccomp return actions (linux/seccomp.h)\nconst SECCOMP_RET_ALLOW = 0x7fff0000;\nconst SECCOMP_RET_ERRNO = 0x00050000;\nconst EPERM = 1;\nconst RET_EPERM = SECCOMP_RET_ERRNO | (EPERM & 0xffff); // 0x00050001\nconst SECCOMP_RET_KILL_PROCESS = 0x80000000;\n\nconst AF_UNIX = 1;\n\n/** Always-denied, network-independent (landlock.rs:179-184). */\nconst ALWAYS_DENIED = [101, 310, 311, 425, 426, 427]; // ptrace, process_vm_readv/writev, io_uring_setup/enter/register\n/**\n * Denied only when the network is restricted (landlock.rs:188-204). recvfrom(45)/sendmsg(46) are\n * NOT here — and, since #385, neither are `getsockname`(51), `getpeername`(52), `setsockopt`(54)\n * and `getsockopt`(55).\n *\n * Those four take an ALREADY-OPEN fd rather than an address, and cBPF cannot dereference an fd to\n * learn the family behind it. Denying them therefore denied them on AF_UNIX as well — which is\n * exactly what libuv calls on a child's IPC channel, so any command that spawned a child died.\n * Measured: `node --test` returned 0 lines under the filter and 38 without it, and the parent's\n * own stdout vanished with it (killed mid-flight, its buffered pipe write never flushed, while the\n * child's already-written bytes survived). The AF_UNIX exemption on `socket`/`socketpair` below\n * shows breaking local IPC was never the intent.\n *\n * They cannot reach a network on their own. Everything that takes an address or changes an fd's\n * role — `connect`, `bind`, `listen`, `accept`, `accept4`, `sendto`, `sendmmsg`, `recvmmsg`,\n * `shutdown` — stays denied, and `socket()` still refuses every family but AF_UNIX. Measured\n * unchanged across the fix: an AF_INET socket is `EPERM` before and after, an AF_UNIX socketpair\n * works before and after.\n *\n * The blunt alternative — dropping the whole set, on the grounds that `--unshare-net` already\n * removes the network — would restore the output AND let a confined command open a connection the\n * moment a future mode runs the filter with the network on. This keeps the belt.\n */\nconst NETWORK_DENIED = [42, 43, 288, 49, 50, 48, 44, 307, 299];\n/** socket(2) / socketpair(2) — conditional on domain != AF_UNIX (landlock.rs:206-216). */\nconst SOCKET_SYSCALLS = [41, 53];\n\n/** One `sock_filter` instruction: `{u16 code, u8 jt, u8 jf, u32 k}`. */\ninterface Insn {\n  code: number;\n  jt: number;\n  jf: number;\n  k: number;\n}\nconst stmt = (code: number, k: number): Insn => ({ code, jt: 0, jf: 0, k });\nconst jmp = (code: number, k: number, jt: number, jf: number): Insn => ({ code, jt, jf, k });\n\n/**\n * Input to {@link buildSeccompFilter} — the one axis the generated cBPF program varies on.\n *\n * `networkRestricted: true` adds the socket-family denials on top of the always-denied syscall set;\n * `false` emits the base program, which is NOT \"no filter\". The always-denied set applies either way.\n */\nexport interface SeccompOptions {\n  /** When true (network off), also deny the socket set + non-AF_UNIX socket(). */\n  networkRestricted: boolean;\n}\n\n/**\n * Build the cBPF seccomp program as a `Buffer` (each `sock_filter` = 8 bytes). Jump targets are\n * expressed against labels and back-patched to relative offsets, so the layout is deterministic and\n * unit-testable against the authoritative syscall list.\n */\nexport function buildSeccompFilter(opts: SeccompOptions): Buffer {\n  // We assemble with symbolic targets, then resolve to relative jumps. To keep the classic\n  // \"deny → jump to a single DENY return; else fall through\" shape, DENY and ALLOW live at the END and\n  // every JEQ jumps FORWARD to them. jt/jf carry the DISTANCE (in instructions) to the target.\n  const insns: Insn[] = [];\n\n  // Placeholder labels resolved after we know total length.\n  // Layout: [arch guard][x32 guard][LD nr][deny checks...][socket checks...][ALLOW][DENY][KILL]\n  // We build the body first with jumps to ALLOW/DENY/KILL as sentinel indices, then patch.\n  const ALLOW = Symbol(\"ALLOW\");\n  const DENY = Symbol(\"DENY\");\n  const KILL = Symbol(\"KILL\");\n  type Target = typeof ALLOW | typeof DENY | typeof KILL | number;\n  interface SInsn {\n    code: number;\n    k: number;\n    jt: Target;\n    jf: Target;\n  }\n  const body: SInsn[] = [];\n  const push = (code: number, k: number, jt: Target = 0, jf: Target = 0): void => {\n    body.push({ code, k, jt, jf });\n  };\n\n  // --- arch guard: arch == x86_64 ? continue : KILL ---\n  push(LD_ABS_W, OFF_ARCH);\n  push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL); // if !=  → KILL\n  // --- x32 guard: nr >= 0x40000000 ? KILL : continue ---\n  push(LD_ABS_W, OFF_NR);\n  push(JGE_K, X32_BIT, KILL, 0); // if >= → KILL\n  // nr already loaded; keep it loaded for the deny checks.\n\n  // --- unconditional denials → DENY ---\n  const denied = opts.networkRestricted\n    ? [...ALWAYS_DENIED, ...NETWORK_DENIED]\n    : [...ALWAYS_DENIED];\n  for (const nr of denied) push(JEQ_K, nr, DENY, 0); // if nr == syscall → DENY\n\n  // --- socket-family: socket(41)/socketpair(53) → allow only AF_UNIX (only when restricted) ---\n  if (opts.networkRestricted) {\n    for (const sysno of SOCKET_SYSCALLS) {\n      // if nr == socket → check domain; else skip the 2 domain-check instructions\n      push(JEQ_K, sysno, 0, 2); // match: fall through to the LD/JEQ; no-match: jump +2 (past them)\n      push(LD_ABS_W, OFF_ARG0); // load domain (args[0] low dword)\n      push(JEQ_K, AF_UNIX, ALLOW, DENY); // AF_UNIX → ALLOW, else DENY\n      // NOTE: after these, nr is NO LONGER in the accumulator — but every remaining syscall check\n      // reloads via a fresh LD? No: the remaining path is only ALLOW. socket checks are LAST before\n      // the tail, so a fall-through (non-socket syscall that reached here) goes straight to ALLOW.\n    }\n  }\n\n  // --- tail ---\n  push(RET_K, SECCOMP_RET_ALLOW); // ALLOW label target\n  const allowIdx = body.length - 1;\n  push(RET_K, RET_EPERM); // DENY\n  const denyIdx = body.length - 1;\n  push(RET_K, SECCOMP_RET_KILL_PROCESS); // KILL\n  const killIdx = body.length - 1;\n\n  // --- resolve symbolic targets to relative offsets ---\n  // The branching IS the cBPF program: ALLOW/DENY/KILL are symbolic targets resolved to an\n  // offset RELATIVE to the next instruction. Breaking it into helpers does not reduce real complexity —\n  // it moves the jump arithmetic to another file and makes auditing against landlock.rs harder, the\n  // the authoritative source.\n  //\n  // Not refactoring NOW is an M75 process decision: this function is being MIGRATED without behavior\n  // change (plan m75, D4) and there is still no byte-for-byte equivalence oracle against the\n  // original version. Refactoring security without that oracle is changing the lock in the dark.\n  // Revisit when the parity gate (T4.2) is green — the oracle exists then.\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n  const resolve = (i: number, t: Target): number => {\n    const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;\n    // BPF jump offset is relative to the NEXT instruction: target - (i + 1)\n    const off = abs - (i + 1);\n    if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);\n    return off;\n  };\n  // `for...of` over entries instead of a raw index: the SDK compiles with `noUncheckedIndexedAccess`, which\n  // (correctly) types `body[i]` as possibly undefined. Iterating gives the guarantee in the type instead\n  // requiring a `!` — the code already could not leave the range, and now the compiler knows it.\n  for (const [i, b] of body.entries()) {\n    if (b.code === JEQ_K || b.code === JGE_K) {\n      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));\n    } else {\n      insns.push(stmt(b.code, b.k));\n    }\n  }\n\n  const buf = Buffer.alloc(insns.length * 8);\n  insns.forEach((ins, i) => {\n    buf.writeUInt16LE(ins.code, i * 8);\n    buf.writeUInt8(ins.jt, i * 8 + 2);\n    buf.writeUInt8(ins.jf, i * 8 + 3);\n    buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);\n  });\n  return buf;\n}\n","// Promoted from agent-builder in M75 (plan m75-sandbox-kernel-no-framework, D1). Renamed from\n// `BwrapSandbox` to `LinuxSandbox`: bwrap is the IMPLEMENTATION, Linux is the contract — swapping the\n// mechanism (landlock, for example) should not change the name the consumer imports.\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { redactSecrets } from \"../internal/security/redact.js\";\nimport type { BwrapDetection, SandboxMode } from \"./bwrap.js\";\nimport { buildBwrapArgv, detectBwrapMemoized } from \"./bwrap.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { buildSeccompFilter } from \"./seccomp.js\";\nimport type { SandboxBackend, SandboxConfig } from \"./types.js\";\n\n/*\n * M53 — kernel-enforced sandbox backend, injected into `createShellTool({ sandbox })`.\n *\n * `LinuxSandbox extends LocalSandbox` and only REWRITES the command: `<bwrap-bin> <policy flags> --\n * /bin/sh -c '<original>'`. Everything else (spawn, output caps, timeout, ExecuteResult shape, file\n * ops) is inherited — the SDK backend stays the single execution engine. Mirrors Codex's\n * `SandboxManager::transform` (argv prefixing before spawn, never in-process).\n */\n\n/** POSIX single-quote escaping — the inner command crosses ONE extra `/bin/sh -c` boundary. */\nfunction shellQuote(s: string): string {\n  return `'${s.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\n/**\n * M57 — the single source of truth for the sandbox command wrap. Turns `command` into\n * `<bin> <bwrap flags> [--seccomp 3] -- /bin/sh -c '<command>' [3< <bpf>]`, or `null` when the policy\n * skips the sandbox (`danger-full-access`). Extracted from `LinuxSandbox.wrapCommand` so the interactive\n * PTY backend (M57) can reuse the EXACT wrap the one-shot `run_shell` already uses (DRY) — faithful to\n * Codex, where the sandbox transforms the argv before the PTY spawns it (`sandboxing/src/manager.rs:321`).\n */\nexport function wrapCommandForSandbox(\n  mode: SandboxMode,\n  opts: {\n    cwd: string;\n    network?: boolean;\n    env?: Record<string, string>;\n    bin?: string;\n    seccompPath?: string;\n  },\n  command: string,\n): string | null {\n  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });\n  if (argv === null) return null; // danger-full-access: bwrap skipped\n  const bin = opts.bin ?? \"bwrap\";\n  const seccompArgv = opts.seccompPath !== undefined ? [\"--seccomp\", \"3\"] : [];\n  const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, \"--\"].map(shellQuote).join(\" \")} /bin/sh -c ${shellQuote(command)}`;\n  return opts.seccompPath !== undefined ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;\n}\n\n/**\n * Env allowlist re-injected inside the sandbox after `--clearenv`. Codex env_clear model: the child\n * gets exactly what it needs to run a shell, never the parent's full env (which may hold oddly-named\n * secrets the SDK name-pattern scrub misses). `CODEX_SANDBOX_NETWORK_DISABLED` is added by the argv\n * builder when network is unshared.\n */\nconst ENV_ALLOWLIST = [\n  \"PATH\",\n  \"HOME\",\n  \"LANG\",\n  \"LC_ALL\",\n  \"LC_CTYPE\",\n  \"TERM\",\n  \"USER\",\n  \"TMPDIR\",\n  \"SHELL\",\n];\n\n/**\n * Build the environment a confined command runs with after `--clearenv`: `PATH`, `HOME`, `LANG`,\n * `LC_ALL`, `LC_CTYPE`, `TERM`, `USER`, `TMPDIR` and `SHELL`, copied from `source` (default\n * `process.env`) and omitted where unset.\n *\n * The allowlist shape is the point, and it is what separates this from the other env control in the\n * package. `SandboxConfig.env: \"inherit-scrubbed\"` is a denylist: it drops variables whose NAME looks\n * secret-ish, so an oddly named secret survives. Here the child gets these nine names and nothing\n * else, and a secret's name stops mattering.\n *\n * Call it when you compose the wrap yourself and need an `env` for `wrapCommandForSandbox`;\n * {@link LinuxSandbox} already applies it when its `env` option is omitted. Passing a different\n * `source` changes the VALUES, never the set of names — to give a confined command an extra variable,\n * extend the returned object, which is a fresh one on every call.\n */\nexport function allowlistedEnv(source: NodeJS.ProcessEnv = process.env): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const k of ENV_ALLOWLIST) {\n    const v = source[k];\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Kernel-confined backend for Linux hosts: a `LocalSandbox` whose commands are rewritten as\n * `bwrap <policy flags> -- /bin/sh -c '<command>'` before they are spawned. Spawning, output caps,\n * timeouts and the `ExecuteResult` shape are all inherited, so confinement is a change to the argv\n * and never an in-process one.\n *\n * Prefer `createSandboxBackend` over constructing this directly. The class assumes bubblewrap is\n * present and never probes for it, so on a host without it every command comes back failed rather\n * than confined; the factory probes first and degrades to a plain `LocalSandbox` with a warning.\n *\n * What the confinement actually covers: the filesystem is bound read-only in full, and\n * `mode: \"workspace-write\"` adds the workspace root plus `/tmp` as the only writable paths, while\n * `\"read-only\"` adds none. The network is unshared unless `network: true`. The environment is cleared\n * and repopulated from {@link allowlistedEnv} unless an explicit `env` is passed. The seccomp syscall\n * filter is a second stage with two conditions on it — x86_64 only, and only when the network is\n * restricted — so `network: true` gives you bwrap's filesystem confinement and no syscall filter.\n * `mode: \"danger-full-access\"` skips the wrap entirely and this class behaves as plain\n * `LocalSandbox`.\n *\n * `uploadFile` is overridden so that writes go through the confined `execute` (base64 over stdin,\n * keeping arbitrary content out of the shell command line). A write the policy forbids therefore\n * fails, throwing a plain `Error` naming the target path and the stderr, instead of quietly landing\n * on the host as the inherited implementation would.\n */\nexport class LinuxSandbox extends LocalSandbox {\n  private readonly mode: SandboxMode;\n  private readonly network: boolean;\n  private readonly cwd: string;\n  private readonly bin: string;\n  private readonly env: Record<string, string>;\n  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a\n   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */\n  private readonly seccompPath: string | undefined;\n\n  constructor(\n    config: SandboxConfig,\n    opts: { mode: SandboxMode; network?: boolean; bin?: string; env?: Record<string, string> },\n  ) {\n    super(config);\n    this.mode = opts.mode;\n    this.network = opts.network ?? false;\n    this.cwd = config.workDir ?? process.cwd();\n    // MEDIUM-1: run the VALIDATED absolute binary from detection (anti-hijack), never bare `bwrap`\n    // which the outer shell would re-resolve via $PATH at spawn time (TOCTOU / hijack window).\n    this.bin = opts.bin ?? \"bwrap\";\n    this.env = opts.env ?? allowlistedEnv();\n    this.seccompPath = seccompPathForNetwork(this.network);\n  }\n\n  /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */\n  wrapCommand(command: string): string | null {\n    return wrapCommandForSandbox(\n      this.mode,\n      {\n        cwd: this.cwd,\n        network: this.network,\n        env: this.env,\n        bin: this.bin,\n        seccompPath: this.seccompPath,\n      },\n      command,\n    );\n  }\n\n  /**\n   * M75 review (architecture, HIGH) — without this override the class LIED.\n   *\n   * `LinuxSandbox` documents itself as a \"kernel-enforced sandbox backend\", but it overrode only\n   * `execute`. `uploadFile` stayed the one inherited from `LocalSandbox`, which writes straight to\n   * the host via `fs/promises` and accepts an ABSOLUTE path — no bwrap, no seccomp, no path\n   * restriction. And `SandboxBackend.writeFile` delegates to it. The result was an incoherent class:\n   * reading, searching and listing went through the confinement; writing did not.\n   *\n   * Routing through the wrapped `execute` fixes it at the root: writes come to live under the SAME\n   * policy as everything else — if bwrap denies the path, the write fails, as it should. The content\n   * goes over stdin (not argv) because argv has a size limit and file content does not.\n   */\n  override async uploadFile(path: string, content: string | Buffer): Promise<void> {\n    if (this.mode === \"danger-full-access\") return super.uploadFile(path, content);\n\n    const target = path.startsWith(\"/\") ? path : `${this.cwd}/${path}`;\n    const b64 = Buffer.from(content).toString(\"base64\");\n    // base64 on a single line: avoids any shell quoting over arbitrary content, which is exactly\n    // where a \"confined\" write would turn into command injection.\n    const r = await this.execute(\n      `mkdir -p ${shellQuote(dirname(target))} && printf %s ${shellQuote(b64)} | base64 -d > ${shellQuote(target)}`,\n    );\n    if (r.exitCode !== 0) {\n      throw new Error(\n        `uploadFile blocked or failed under confinement (${target}): ${r.stderr.trim() || `exit ${r.exitCode}`}`,\n      );\n    }\n  }\n\n  override execute(command: string, opts?: { timeoutMs?: number }) {\n    const wrapped = this.wrapCommand(command);\n    if (wrapped === null) return super.execute(command, opts); // danger-full-access: plain local\n    return super.execute(wrapped, opts);\n  }\n}\n\nlet warnedNonX64 = false;\n\n/**\n * M63 — the restricted-network seccomp program is DETERMINISTIC, so write it ONCE per process and\n * reuse the path across every LinuxSandbox (no per-instance temp accumulation).\n *\n * ARCH GUARD (review HIGH): `buildSeccompFilter` emits an x86_64 program whose arch guard KILLs every\n * syscall whose `seccomp_data.arch != AUDIT_ARCH_X86_64`. On a non-x86_64 host that would brick EVERY\n * sandboxed command (the first execve is killed) — and silently, because generation succeeds and bwrap\n * accepts it. So we REFUSE to install on non-x64 and WARN through the honest-downgrade channel (bwrap\n * FS/network confinement still applies), exactly like the bwrap-missing fallback. `arch` is injectable\n * for tests. Cleaned on exit AND on SIGINT/SIGTERM (TUI Ctrl+C would otherwise leak the temp dir).\n */\nexport function seccompPathForArch(arch: string, warn: (m: string) => void): string | undefined {\n  if (arch !== \"x64\") {\n    if (!warnedNonX64) {\n      warnedNonX64 = true;\n      warn(\n        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) — running without ` +\n          \"the filter; bwrap FS/network confinement still applies.\",\n      );\n    }\n    return undefined;\n  }\n  try {\n    const dir = mkdtempSync(join(tmpdir(), \"ab-seccomp-\"));\n    const path = join(dir, \"filter.bpf\");\n    writeFileSync(path, buildSeccompFilter({ networkRestricted: true }));\n    const cleanup = (): void => rmSync(dir, { recursive: true, force: true });\n    process.once(\"exit\", cleanup);\n    process.once(\"SIGINT\", cleanup);\n    process.once(\"SIGTERM\", cleanup);\n    return path;\n  } catch (err) {\n    warn(\n      `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) — ` +\n        \"running without syscall filter (bwrap FS/network confinement still applies).\",\n    );\n    return undefined;\n  }\n}\n\nlet seccompFilterPath: string | undefined | null; // undefined = not tried; null = resolved absent\n/** M57 — exported so the interactive PTY backend reuses the SAME memoized x64-gated seccomp program. */\nexport function restrictedSeccompPath(): string | undefined {\n  if (seccompFilterPath !== undefined) return seccompFilterPath ?? undefined;\n  const path = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));\n  seccompFilterPath = path ?? null;\n  return path;\n}\n\nlet warnedUnavailable = false;\n\n/** Test seam: reset the WARN-once latch. */\nexport function resetSandboxWarnLatch(): void {\n  warnedUnavailable = false;\n}\n\n/** Durable sandbox posture for the UI — the honest answer to \"am I kernel-enforced right now?\". */\nexport interface SandboxPosture {\n  mode: SandboxMode;\n  enforced: boolean;\n  detail: string;\n}\n\n/**\n * MEDIUM-2: compute the posture so a surface (TUI footer) can show enforcement DURABLY instead of a\n * one-shot warn. `danger-full-access` is honestly reported as unenforced; an unavailable bwrap reports\n * the downgrade reason so the user never believes they are confined when they are not.\n */\nexport function resolveSandboxPosture(opts: {\n  mode: SandboxMode;\n  detect?: () => BwrapDetection;\n}): SandboxPosture {\n  if (opts.mode === \"danger-full-access\") {\n    return { mode: opts.mode, enforced: false, detail: \"no confinement (danger-full-access)\" };\n  }\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (!detection.ok) {\n    return { mode: opts.mode, enforced: false, detail: `tool-gating only — ${detection.reason}` };\n  }\n  return { mode: opts.mode, enforced: true, detail: \"kernel (bwrap)\" };\n}\n\n/**\n * Options for `createSandboxBackend`, which probes for bubblewrap and returns a {@link LinuxSandbox}\n * when confinement is genuinely available or a `LocalSandbox` when it is not — warning once when the\n * absence is a failure, and silently when `mode` is `\"danger-full-access\"`, since that is an explicit\n * opt-out rather than a degradation.\n *\n * The declared return type is `SandboxBackend` either way, so it does not tell you which one you got.\n * Call `resolveSandboxPosture({ mode })` for that, and surface it durably — the warning fires once\n * per process and a user who missed it has no way to tell they are unconfined.\n *\n * `workDir` and `timeoutMs` are forwarded into the backend's `SandboxConfig`; `maxOutputBytes` and\n * the env policy are not, and keep their defaults. `network` only reaches the confined path, being\n * meaningless on a fallback where the network was never restricted. `detect` and `warn` exist so\n * tests can drive both branches without a real bubblewrap.\n */\nexport interface CreateSandboxBackendOptions {\n  mode: SandboxMode;\n  workDir?: string;\n  network?: boolean;\n  timeoutMs?: number;\n  /** Injectable for tests; defaults to the real 3-probe detection. */\n  detect?: () => BwrapDetection;\n  /** Injectable for tests; defaults to console.warn. */\n  warn?: (message: string) => void;\n}\n\n/**\n * Honest factory: bwrap available + mode wants confinement → `LinuxSandbox` (kernel enforcement,\n * running the VALIDATED absolute bin); `danger-full-access` → plain `LocalSandbox` silently (explicit\n * opt-out, `bwrap.rs:245-252`); bwrap unavailable → WARN once + `LocalSandbox` (the declarative M23\n * gating remains the guard). NEVER pretends to sandbox — the fallback is loud, mirroring Codex's\n * MISSING_BWRAP_WARNING. The durable posture lives in `resolveSandboxPosture` for the UI.\n */\nexport function createSandboxBackend(opts: CreateSandboxBackendOptions): SandboxBackend {\n  const config: SandboxConfig = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };\n  if (opts.mode === \"danger-full-access\") return new LocalSandbox(config);\n\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (!detection.ok) {\n    if (!warnedUnavailable) {\n      warnedUnavailable = true;\n      const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n      warn(\n        `[sandbox] OS-level enforcement unavailable (${detection.reason}) — ` +\n          `falling back to tool-level gating only (sandbox_mode=${opts.mode}).`,\n      );\n    }\n    return new LocalSandbox(config);\n  }\n  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });\n}\n\n/**\n * M75 T3.2 — warning latch for the INTERACTIVE path.\n *\n * Kept separate from `createSandboxBackend`'s latch on purpose: they are two distinct decisions\n * taken at distinct moments, and a user who only ever runs an interactive shell needs to see the\n * warning even if the non-interactive path already emitted it — otherwise the session where they\n * actually type commands would be the one without the alert.\n */\nlet interactiveWarned = false;\n\n/** Reset for tests — the latch is module state and tests need isolation. */\nexport function resetInteractiveWarnLatch(): void {\n  interactiveWarned = false;\n}\n\n/**\n * The rule \"seccomp ONLY with restricted network\" — in ONE place.\n *\n * Codex installs the filter only when the network is closed (`landlock.rs:96-117`), and that is not\n * a detail: the cBPF program **denies the network syscalls** (`NETWORK_DENIED`). Applying it with\n * the network open produces the worst possible combination — bwrap **allows** the network (no\n * `--unshare-net`) and seccomp **denies** it with EPERM. The user asked for network, got the bind,\n * and the calls die.\n *\n * It existed duplicated: the constructor decided conditionally, `interactiveWrapCommand` installed\n * unconditionally. They had already diverged in the first version (M75 architecture review, proven\n * at runtime: `network:true` gave `--seccomp` interactively and not one-shot). Two copies of a\n * security rule is not duplicated form — it is duplicated KNOWLEDGE, and it had already diverged.\n */\nfunction seccompPathForNetwork(networkOpen: boolean): string | undefined {\n  return networkOpen ? undefined : restrictedSeccompPath();\n}\n\n/**\n * Options for `interactiveWrapCommand`, the PTY counterpart of `createSandboxBackend`.\n *\n * They differ in what they hand back, and that is how you choose. A PTY owns its own spawn and\n * accepts no backend object, so this path returns a `(command, cwd) => string | null` transform: the\n * wrapped command line, or `null` meaning run it as-is. Use it when something else does the spawning;\n * use `createSandboxBackend` when you want an object that executes.\n *\n * Detection is consulted on every wrap instead of being frozen at construction, because an\n * interactive session outlives the probe — a bubblewrap binary that disappears mid-session stops\n * being asserted as present.\n *\n * `network` defaults to `false`, matching the non-interactive path, and carries the same consequence:\n * the seccomp filter is installed only when the network is restricted. The warn-once latch is\n * deliberately separate from the one `createSandboxBackend` keeps, so a user who only ever opens an\n * interactive shell still sees the \"runs WITHOUT kernel confinement\" warning in the session where\n * they type commands.\n */\nexport interface InteractiveWrapOptions {\n  mode: SandboxMode;\n  /** `true` keeps the network. Default `false`, same as non-interactive `run_shell`. */\n  network?: boolean;\n  /** Injectable for tests; defaults to the real memoized detection. */\n  detect?: () => BwrapDetection;\n  /** Injectable for tests; defaults to `console.warn` with redaction. */\n  warn?: (message: string) => void;\n}\n\n/**\n * The decision to confine or degrade, separated from the wrap itself.\n *\n * Extracted because they are two responsibilities and the SDK's complexity gate separated them for\n * us: DECIDING (is confinement available? did the user opt out?) and APPLYING (assembling the argv).\n * Keeping them together pushed the closure past 10 cognitive complexity — and the linter was right:\n * the deciding part is the one with security consequences and deserves to be read on its own.\n *\n * Returns the validated binary when confinement exists, or `null` when it does not — warning ONCE,\n * and only when the absence is a failure (not when it is an opt-out).\n */\nfunction decideConfinement(opts: InteractiveWrapOptions): string | null {\n  if (opts.mode === \"danger-full-access\") return null;\n\n  const detection = (opts.detect ?? detectBwrapMemoized)();\n  if (detection.ok) return detection.bin;\n\n  if (!interactiveWarned) {\n    interactiveWarned = true;\n    const warn = opts.warn ?? ((m: string) => console.warn(redactSecrets(m)));\n    warn(\n      `[sandbox] OS-level enforcement unavailable (${detection.reason}) — interactive session ` +\n        `runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`,\n    );\n  }\n  return null;\n}\n\n/**\n * The composition the interactive path needs — the counterpart of `createSandboxBackend`.\n *\n * `createSandboxBackend` solves this for the non-interactive path by returning a ready BACKEND. The\n * PTY accepts no backend: it owns the spawn and only allows transforming the command. This function\n * delivers the SAME decision in the shape the PTY accepts — `(command, cwd) => string | null` —\n * ready for `new PtyInteractiveBackend({ wrapCommand: interactiveWrapCommand({ mode }) })`.\n *\n * Detection is consulted on **every wrap**, not frozen at construction: an interactive session lives\n * for hours, and a stale positive detection would keep asserting confinement after the binary\n * disappeared (the `existsSync` revalidation lives inside `detectBwrapMemoized`).\n *\n * The two routes returning `null` are semantically different and the code does not merge them:\n * `danger-full-access` is an explicit opt-out and does NOT warn; bwrap being unavailable is a\n * failure and warns once.\n */\nexport function interactiveWrapCommand(\n  opts: InteractiveWrapOptions,\n): (command: string, cwd: string) => string | null {\n  return (command: string, cwd: string): string | null => {\n    const bin = decideConfinement(opts);\n    if (bin === null) return null;\n\n    return wrapCommandForSandbox(\n      opts.mode,\n      {\n        cwd,\n        network: opts.network ?? false,\n        env: allowlistedEnv(),\n        bin,\n        seccompPath: seccompPathForNetwork(opts.network ?? false),\n      },\n      command,\n    );\n  };\n}\n","/**\n * M6-3 — portable repo provisioner for the eval harness.\n *\n * Clones a repository and checks out a ref into an isolated working dir, issuing\n * every git command through {@link SandboxBackend.execute} (ADR D2 — same code\n * runs on Local/Docker/E2B; never a direct `child_process` import). Promotes\n * theocode's `prepareRepo` (`swebench-provision.ts:37`) onto the SDK's sandbox\n * abstraction.\n *\n * reference: knowledge-base/references/theocode-eval/lib/swebench-provision.ts:37\n * (clone+checkout), :13 (ProvisionError with instanceId).\n *\n * @public\n */\n\nimport { TheokitAgentError } from \"../errors.js\";\nimport { LocalSandbox } from \"./local-sandbox.js\";\nimport { shellEscapePosix } from \"./shell-escape.js\";\nimport type { SandboxBackend } from \"./types.js\";\n\n/**\n * Raised when cloning or checking out a repo fails. Carries the `instanceId`\n * so a batch run can attribute the failure to the offending dataset row.\n */\nexport class RepoProvisionError extends TheokitAgentError {\n  override readonly name = \"RepoProvisionError\";\n\n  constructor(\n    readonly instanceId: string,\n    message: string,\n    options: { cause?: unknown } = {},\n  ) {\n    super(`[${instanceId}] ${message}`, {\n      code: \"repo_provision_failed\",\n      isRetryable: false,\n      ...(options.cause !== undefined ? { cause: options.cause } : {}),\n    });\n  }\n}\n\n/** Options for {@link provisionRepo}. */\nexport interface ProvisionRepoOptions {\n  /**\n   * Clonable repo URL or local path. SECURITY: when this comes from an\n   * untrusted dataset, the value is passed to `git clone` after a `--`\n   * end-of-options terminator (no flag injection) and with the `ext::`\n   * transport disabled (no arbitrary-command transport).\n   */\n  readonly repoUrl: string;\n  /** Branch, tag, or commit SHA to check out. Rejected if it begins with `-`. */\n  readonly ref: string;\n  /**\n   * Unique id for this row — names the target dir and any error. Validated to\n   * `[A-Za-z0-9._-]` (no path traversal) since it becomes a directory name.\n   */\n  readonly instanceId: string;\n}\n\n/**\n * Reject ids that would escape the workdir or be parsed as a git flag. Must\n * start with an alphanumeric (blocks `.`, `..`, `-foo`, leading-dot names) and\n * thereafter allow only `[A-Za-z0-9._-]`.\n */\nconst SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Clone `repoUrl` into `<sandbox workdir>/<instanceId>` and check out `ref`.\n * Returns the absolute `repoDir` (resolved via `git rev-parse --show-toplevel`,\n * which is portable across backends). Throws {@link RepoProvisionError} naming\n * the `instanceId` when clone or checkout exits non-zero.\n *\n * The `sandbox` is optional (V3-5): when omitted, a default {@link LocalSandbox}\n * is used (clones into the process cwd's `<instanceId>`) — pass an explicit\n * sandbox (e.g. `LocalSandbox({ workDir })` / Docker / E2B) to control the workdir.\n */\nexport function provisionRepo(opts: ProvisionRepoOptions): Promise<{ repoDir: string }>;\nexport function provisionRepo(\n  sandbox: SandboxBackend,\n  opts: ProvisionRepoOptions,\n): Promise<{ repoDir: string }>;\nexport async function provisionRepo(\n  sandboxOrOpts: SandboxBackend | ProvisionRepoOptions,\n  maybeOpts?: ProvisionRepoOptions,\n): Promise<{ repoDir: string }> {\n  const sandbox = maybeOpts !== undefined ? (sandboxOrOpts as SandboxBackend) : new LocalSandbox();\n  const opts = maybeOpts ?? (sandboxOrOpts as ProvisionRepoOptions);\n  const { repoUrl, ref, instanceId } = opts;\n\n  // Validate untrusted-derivable inputs before they reach git/the shell.\n  if (!SAFE_INSTANCE_ID.test(instanceId)) {\n    throw new RepoProvisionError(\n      instanceId,\n      \"invalid instanceId: must match [A-Za-z0-9._-] (no path traversal)\",\n    );\n  }\n  if (ref.startsWith(\"-\")) {\n    throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);\n  }\n\n  // `--` terminates options (no `--upload-pack=` flag injection); `protocol.ext.allow=never`\n  // blocks the `ext::` arbitrary-command transport. `file`/`https` stay allowed.\n  const clone = await sandbox.execute(\n    `git -c protocol.ext.allow=never clone --quiet -- ${shellEscapePosix(repoUrl)} ${shellEscapePosix(instanceId)}`,\n  );\n  if (clone.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);\n  }\n\n  const top = await sandbox.execute(\n    `git -C ${shellEscapePosix(instanceId)} rev-parse --show-toplevel`,\n  );\n  if (top.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);\n  }\n  const repoDir = top.stdout.trim();\n\n  // `ref` is validated above not to begin with `-`, so it cannot be parsed as a flag.\n  const checkout = await sandbox.execute(\n    `git -C ${shellEscapePosix(repoDir)} checkout --quiet ${shellEscapePosix(ref)}`,\n  );\n  if (checkout.exitCode !== 0) {\n    throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);\n  }\n\n  return { repoDir };\n}\n"]}

package/dist/session-transcript-HF5GEU5M.cjs

@@ -0,0 +1,63 @@
+'use strict';
+
+var chunkBUIK7GUA_cjs = require('./chunk-BUIK7GUA.cjs');
+require('./chunk-I6TGFUCO.cjs');
+require('./chunk-JTB5Q42C.cjs');
+require('./chunk-NUKRL3I6.cjs');
+
+
+
+Object.defineProperty(exports, "SessionTranscript", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.SessionTranscript; }
+});
+Object.defineProperty(exports, "defaultBaseDir", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.defaultBaseDir; }
+});
+Object.defineProperty(exports, "encodeProjectDir", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.encodeProjectDir; }
+});
+Object.defineProperty(exports, "expandTilde", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.expandTilde; }
+});
+Object.defineProperty(exports, "isSessionUuid", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.isSessionUuid; }
+});
+Object.defineProperty(exports, "legacyTranscriptPath", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.legacyTranscriptPath; }
+});
+Object.defineProperty(exports, "readTranscript", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.readTranscript; }
+});
+Object.defineProperty(exports, "reconstructMessages", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.reconstructMessages; }
+});
+Object.defineProperty(exports, "safeSessionId", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.safeSessionId; }
+});
+Object.defineProperty(exports, "sessionUuidFor", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.sessionUuidFor; }
+});
+Object.defineProperty(exports, "transcriptPath", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.transcriptPath; }
+});
+Object.defineProperty(exports, "transcriptRoot", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.transcriptRoot; }
+});
+Object.defineProperty(exports, "writeTranscript", {
+  enumerable: true,
+  get: function () { return chunkBUIK7GUA_cjs.writeTranscript; }
+});
+//# sourceMappingURL=session-transcript-HF5GEU5M.cjs.map
+//# sourceMappingURL=session-transcript-HF5GEU5M.cjs.map

package/dist/{session-transcript-JXHFTB7G.cjs.map → session-transcript-HF5GEU5M.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-JXHFTB7G.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-HF5GEU5M.cjs"}

package/dist/session-transcript-P462ZRHX.js

@@ -0,0 +1,6 @@
+export { SessionTranscript, defaultBaseDir, encodeProjectDir, expandTilde, isSessionUuid, legacyTranscriptPath, readTranscript, reconstructMessages, safeSessionId, sessionUuidFor, transcriptPath, transcriptRoot, writeTranscript } from './chunk-FKMUFNQE.js';
+import './chunk-VF7EWVDG.js';
+import './chunk-T7XEKOVW.js';
+import './chunk-T7O6K6PX.js';
+//# sourceMappingURL=session-transcript-P462ZRHX.js.map
+//# sourceMappingURL=session-transcript-P462ZRHX.js.map

package/dist/{session-transcript-AKDYYGXQ.js.map → session-transcript-P462ZRHX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-AKDYYGXQ.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-P462ZRHX.js"}

package/docs/error-codes.md

@@ -6,15 +6,16 @@ Branch on `code`, never on the message: messages carry context (an id, a path, a
 
 **Transport codes vs the rest.** `ErrorCode` in `errors.ts` is the small canonical union a provider failure maps onto — the codes marked *transport* below. Everything else is raised by a specific subsystem at a specific place, and a `catch` that only handles the union will meet them anyway.
 
-202 distinct code(s).
+204 distinct code(s).
 
 | Code | Kind | Raised by | Sites |
 |---|---|---|---|
+| `a2a_request_timeout` | domain | A2ARequestTimeoutError | `packages/sdk/src/a2a/message-bus.ts:31` |
 | `aborted` | domain | TheokitAgentError | `packages/sdk/src/batch.ts:280` +1 |
 | `agent_disposed` | domain | — | `packages/sdk/src/errors.ts:668` |
 | `agent_id_already_exists` | domain | ConfigurationError | `packages/sdk/src/agent-helpers.ts:54` |
 | `agent_not_registered` | domain | UnknownAgentError | `packages/sdk/src/internal/cron/run-job.ts:61` |
-| `agent_rehydration_failed` | domain | UnknownAgentError | `packages/sdk/src/agent-helpers.ts:300` |
+| `agent_rehydration_failed` | domain | UnknownAgentError | `packages/sdk/src/agent-helpers.ts:332` |
 | `anthropic_auth_failed` | domain | AuthenticationError | `packages/sdk/src/internal/error-mappers/anthropic.ts:56` |
 | `anthropic_rate_limit` | domain | RateLimitError | `packages/sdk/src/internal/error-mappers/anthropic.ts:59` |
 | `anthropic_server_error` | domain | NetworkError | `packages/sdk/src/internal/error-mappers/anthropic.ts:71` |
@@ -87,6 +88,7 @@ Branch on `code`, never on the message: messages carry context (an id, a path, a
 | `invalid_input` | domain | MemoryAdapterError | `packages/memory-honcho/src/adapter.ts:98` +9 |
 | `invalid_max_iterations` | domain | ConfigurationError | `packages/sdk/src/internal/local-agent/real-local-run.ts:215` |
 | `invalid_memory_backend` | domain | ConfigurationError | `packages/sdk/src/internal/memory/index-manager-dispatch.ts:24` +1 |
+| `invalid_memory_kind` | domain | ConfigurationError | `packages/sdk/src/internal/memory/storage/markdown-store.ts:118` |
 | `invalid_model_selection` | domain | ConfigurationError | `packages/sdk/src/internal/runtime/model-selection.ts:21` |
 | `invalid_request` | transport | — | `packages/sdk/src/internal/error-mappers/vertex.ts:52` +1 |
 | `invalid_retry_config` | domain | ConfigurationError | `packages/sdk/src/internal/runtime/retry/with-retry.ts:67` |
@@ -100,7 +102,7 @@ Branch on `code`, never on the message: messages carry context (an id, a path, a
 | `live_session_protected` | domain | — | `packages/sdk/src/internal/persistence/transcript-ops.ts:39` +1 |
 | `local_provider_http_error` | domain | ConfigurationError | `packages/sdk/src/internal/catalog/local-models.ts:61` |
 | `local_provider_unreachable` | domain | ConfigurationError | `packages/sdk/src/internal/catalog/local-models.ts:46` |
-| `malformed_api_key` | domain | AuthenticationError | `packages/sdk/src/agent-helpers.ts:195` +1 |
+| `malformed_api_key` | domain | AuthenticationError | `packages/sdk/src/agent-helpers.ts:226` +1 |
 | `max_delegation_depth` | domain | MaxDelegationDepthError | `packages/sdk/src/a2a/subagent.ts:218` |
 | `mcp_buffer_overflow` | domain | NetworkError | `packages/sdk/src/internal/mcp/client.ts:314` |
 | `mcp_closed` | domain | NetworkError | `packages/sdk/src/internal/mcp/client.ts:289` |
@@ -114,7 +116,7 @@ Branch on `code`, never on the message: messages carry context (an id, a path, a
 | `memory_path_traversal` | domain | ConfigurationError | `packages/sdk/src/internal/runtime/validation/validate-agent-options.ts:280` |
 | `memory_tool_bad_args` | domain | ConfigurationError | `packages/sdk/src/internal/memory/tools.ts:132` +1 |
 | `migration_destination_exists` | domain | ConfigurationError | `packages/sdk/src/internal/memory/migrate-sqlite-to-lance.ts:114` +1 |
-| `missing_api_key` | domain | AuthenticationError, ConfigurationError | `packages/sdk/src/agent-helpers.ts:183` +2 |
+| `missing_api_key` | domain | AuthenticationError, ConfigurationError | `packages/sdk/src/agent-helpers.ts:217` +2 |
 | `missing_frontmatter` | domain | ConfigurationError | `packages/sdk/src/internal/runtime/skills/skill-frontmatter.ts:66` |
 | `missing_model` | domain | ConfigurationError | `packages/sdk/src/internal/runtime/validation/validate-agent-options.ts:35` |
 | `model_unavailable` | transport | buildErrorMetadata | `packages/sdk/src/internal/error-mappers/ollama.ts:75` +1 |
@@ -201,7 +203,7 @@ Branch on `code`, never on the message: messages carry context (an id, a path, a
 | `transport_failure` | domain | NetworkError | `packages/sdk/src/internal/llm/transport-error.ts:48` |
 | `transport_unavailable` | domain | ConfigurationError | `packages/sdk/src/internal/llm/router.ts:484` +1 |
 | `unknown` | transport | AgentRunError, MemoryAdapterError, TheokitAgentError | `packages/memory-honcho/src/adapter.ts:264` +5 |
-| `unknown_agent` | domain | UnknownAgentError | `packages/sdk/src/agent-helpers.ts:379` +1 |
+| `unknown_agent` | domain | UnknownAgentError | `packages/sdk/src/agent-helpers.ts:411` +1 |
 | `unknown_artifact` | domain | UnknownAgentError | `packages/sdk/src/internal/cloud-agent/cloud-agent.ts:279` |
 | `unknown_category` | domain | ConfigurationError | `packages/sdk-memory/src/internal/categorized-memory.ts:76` |
 | `unknown_cron_job` | domain | UnknownAgentError | `packages/sdk/src/cron.ts:84` +2 |

package/docs/harness-capability-map.md

@@ -4,7 +4,7 @@ Every public symbol the TheoKit workspace publishes, and the exact specifier to
 
 A symbol listed under two specifiers is reachable from both, but that does NOT make the two interchangeable: a class emitted separately into a subpath entry is a distinct nominal type from the one in the root bundle, so passing one where the other is expected fails on a private field. When a symbol appears twice, import it and everything it is passed to from the SAME specifier.
 
-1125 export(s) across 45 entry point(s).
+1126 export(s) across 45 entry point(s).
 
 ## `@theokit/acp`
 
@@ -787,6 +787,7 @@ A symbol listed under two specifiers is reachable from both, but that does NOT m
 | Symbol | Kind | Summary |
 |---|---|---|
 | `A2AMessage` | interface | One message as a handler receives it.  |
+| `A2ARequestTimeoutError` | class | A peer did not answer a {@link MessageBus.request } within its timeout.  |
 | `AgentMailbox` | class | One agent's endpoint on a {@link MessageBus } : registers `agentId` on construction and forwards inbound messages to the handler installed by `onMessage`.  |
 | `DelegationCompleteContext` | interface | Context passed to {@link SubAgentSpec.onDelegationComplete } after the child settles. |
 | `DelegationCompleteDecision` | interface | Decision returned from {@link SubAgentSpec.onDelegationComplete } . |
@@ -1143,7 +1144,7 @@ A symbol listed under two specifiers is reachable from both, but that does NOT m
 | `SessionWriterLease` | interface | A held writer lease.  |
 | `TranscriptBlock` | type | A content block inside {@link TranscriptMessage } . |
 | `TranscriptMessage` | interface | The message body of a {@link SessionRecord } .  |
-| `transcriptPath` | function | The `.jsonl` path for a session: `<baseDir>/projects/<encoded-cwd>/<safe-sessionId>.jsonl`. |
+| `transcriptPath` | function | The `.jsonl` path for a session: `<baseDir>/projects/<encoded-cwd>/<session-uuid>.jsonl`. |
 | `transcriptRoot` | function | Root of the transcript state.  |
 | `WalApplyResult` | interface | What journal mode a connection ended up in after `applyWalWithFallback`.  |
 | `withCwdMutex` | function | Run `fn` after every earlier `withCwdMutex` call for the same `key` has settled, and return what `fn` returns.  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/sdk",
-  "version": "4.55.0",
+  "version": "4.57.0",
   "description": "TypeScript SDK for the Theo agent harness — same surface, local or cloud.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/usetheokit/theokit-sdk#readme",
@@ -374,8 +374,7 @@
     "better-sqlite3": "^12.0.0",
     "proper-lockfile": "^4.1.2",
     "sqlite-vec": "^0.1.0",
-    "ws": ">=8.0.0",
-    "zod": "^4.0.0"
+    "ws": ">=8.0.0"
   },
   "peerDependenciesMeta": {
     "@lancedb/lancedb": {
@@ -398,9 +397,6 @@
     },
     "ws": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "publishConfig": {
@@ -424,7 +420,8 @@
   ],
   "dependencies": {
     "croner": "^9.0.0",
-    "jsonrepair": "^3.13.2"
+    "jsonrepair": "^3.13.2",
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@opentelemetry/api": "^1.9.1",
@@ -437,8 +434,7 @@
     "proper-lockfile": "^4.1.2",
     "sqlite-vec": "^0.1.9",
     "typedoc": "^0.28.19",
-    "ws": "^8.18.0",
-    "zod": "^4.0.0"
+    "ws": "^8.18.0"
   },
   "scripts": {
     "build": "tsup && cp src/internal/providers/provider-catalog.json dist/provider-catalog.json && node ../../tools/repair-dts-imports.mjs .",

package/dist/agent-session-store-P6V3FINW.js

@@ -1,7 +0,0 @@
-export { appendCompactBoundaryRecord, persistTurn, readSessionMessages } from './chunk-BMAZLQQ4.js';
-import './chunk-DZBSJX6J.js';
-import './chunk-VF7EWVDG.js';
-import './chunk-T7XEKOVW.js';
-import './chunk-T7O6K6PX.js';
-//# sourceMappingURL=agent-session-store-P6V3FINW.js.map
-//# sourceMappingURL=agent-session-store-P6V3FINW.js.map

package/dist/agent-session-store-ZJ3JSRS4.cjs

@@ -1,24 +0,0 @@
-'use strict';
-
-var chunkCTCGWIUD_cjs = require('./chunk-CTCGWIUD.cjs');
-require('./chunk-JHPGF3FP.cjs');
-require('./chunk-I6TGFUCO.cjs');
-require('./chunk-JTB5Q42C.cjs');
-require('./chunk-NUKRL3I6.cjs');
-
-
-
-Object.defineProperty(exports, "appendCompactBoundaryRecord", {
-  enumerable: true,
-  get: function () { return chunkCTCGWIUD_cjs.appendCompactBoundaryRecord; }
-});
-Object.defineProperty(exports, "persistTurn", {
-  enumerable: true,
-  get: function () { return chunkCTCGWIUD_cjs.persistTurn; }
-});
-Object.defineProperty(exports, "readSessionMessages", {
-  enumerable: true,
-  get: function () { return chunkCTCGWIUD_cjs.readSessionMessages; }
-});
-//# sourceMappingURL=agent-session-store-ZJ3JSRS4.cjs.map
-//# sourceMappingURL=agent-session-store-ZJ3JSRS4.cjs.map