@tickernelz/paperclip-pro-adapter-utils 2026.925.0

package/dist/sandbox-file-sync.test.js

@@ -0,0 +1,419 @@
+import { lstat, mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+import { assertSyncOperationsConfined, prepareSandboxManagedRuntime, } from "./sandbox-managed-runtime.js";
+const execFile = promisify(execFileCallback);
+// A filesystem-backed client that additionally exposes native syncIn/syncOut,
+// mirroring a provider that opted into the sync verbs and HONORS an operation's
+// ordered `postUploadCommands` after its files land (PR-2 contract: execute or
+// fail-closed, never silently ignore). The native transfer is a faithful copy
+// honoring followSymlinks; single-file mappings stream verbatim.
+function makeNativeClient() {
+    const syncInOps = [];
+    const syncOutOps = [];
+    const transferDirectory = async (sourcePath, targetPath, followSymlinks) => {
+        await rm(targetPath, { recursive: true, force: true });
+        await mkdir(targetPath, { recursive: true });
+        // followSymlinks true dereferences to bytes (like tar -h); falsy preserves links.
+        const copyArgs = followSymlinks ? ["-RL"] : ["-a"];
+        await execFile("cp", [...copyArgs, `${sourcePath}/.`, targetPath]);
+        const entries = await readdir(targetPath, { withFileTypes: true }).catch(() => []);
+        return entries.length;
+    };
+    const applyOperations = async (operations) => ({
+        operations: await Promise.all(operations.map(async (operation) => {
+            let filesTransferred = 0;
+            for (const mapping of operation.files) {
+                if (mapping.kind === "directory") {
+                    filesTransferred += await transferDirectory(mapping.sourcePath, mapping.targetPath, mapping.followSymlinks);
+                }
+                else {
+                    await mkdir(path.dirname(mapping.targetPath), { recursive: true });
+                    await writeFile(mapping.targetPath, await readFile(mapping.sourcePath));
+                    filesTransferred += 1;
+                }
+            }
+            // Honor the operation's ordered post-upload commands (PR-2), fail-fast.
+            for (const command of operation.postUploadCommands ?? []) {
+                await execFile("sh", ["-c", command.command], { maxBuffer: 32 * 1024 * 1024 });
+            }
+            return { operationId: operation.operationId, filesTransferred, bytesTransferred: 0 };
+        })),
+    });
+    const client = {
+        makeDir: async (remotePath) => { await mkdir(remotePath, { recursive: true }); },
+        writeFile: async (remotePath, bytes) => {
+            await mkdir(path.dirname(remotePath), { recursive: true });
+            await writeFile(remotePath, Buffer.from(bytes));
+        },
+        readFile: async (remotePath) => await readFile(remotePath),
+        listFiles: async (remotePath) => {
+            const entries = await readdir(remotePath, { withFileTypes: true }).catch(() => []);
+            return entries.filter((e) => e.isFile()).map((e) => e.name).sort();
+        },
+        remove: async (remotePath) => { await rm(remotePath, { recursive: true, force: true }); },
+        run: async (command) => { await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 }); },
+        syncIn: async (operations) => { syncInOps.push(operations); return applyOperations(operations); },
+        syncOut: async (operations) => { syncOutOps.push(operations); return applyOperations(operations); },
+    };
+    return { client, syncInOps, syncOutOps };
+}
+describe("sandbox native file sync", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (dir)
+                await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    it("syncs a selected repository subfolder without parent files, history, or ignored files", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-nested-workspace-"));
+        cleanupDirs.push(rootDir);
+        const repo = path.join(rootDir, "repo");
+        const selectedDir = path.join(repo, "project");
+        const remoteDir = path.join(rootDir, "remote");
+        await mkdir(selectedDir, { recursive: true });
+        await execFile("git", ["-C", repo, "init"]);
+        await writeFile(path.join(repo, "outside.txt"), "outside boundary\n");
+        await writeFile(path.join(repo, ".gitignore"), "project/private.txt\n");
+        await writeFile(path.join(selectedDir, "draft.md"), "preserved draft\n");
+        await execFile("git", ["-C", repo, "add", "."]);
+        await execFile("git", ["-C", repo, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "-m", "base"]);
+        await writeFile(path.join(selectedDir, "private.txt"), "stay local\n");
+        const { client } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: selectedDir,
+        });
+        expect(await readFile(path.join(remoteDir, "draft.md"), "utf8")).toBe("preserved draft\n");
+        for (const absent of [".git", "outside.txt", "project", "private.txt"]) {
+            await expect(lstat(path.join(remoteDir, absent))).rejects.toMatchObject({ code: "ENOENT" });
+        }
+        await writeFile(path.join(remoteDir, "draft.md"), "continued draft\n");
+        await prepared.restoreWorkspace();
+        expect(await readFile(path.join(selectedDir, "draft.md"), "utf8")).toBe("continued draft\n");
+        expect(await readFile(path.join(selectedDir, "private.txt"), "utf8")).toBe("stay local\n");
+        expect(await readFile(path.join(repo, "outside.txt"), "utf8")).toBe("outside boundary\n");
+    });
+    it("prepares a runtime whose workspace directory does not exist without failing the ignore scan", async () => {
+        // An env test staging only credential assets can hand the runtime a
+        // workspace path that never existed on this host. A directory with no
+        // files has nothing for ignore rules to govern, so the scan is skipped
+        // rather than failed (git-ignore-scan-failed took down the whole
+        // preparation in production).
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-absent-workspace-"));
+        cleanupDirs.push(rootDir);
+        const remoteDir = path.join(rootDir, "remote");
+        const { client } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: path.join(rootDir, "never-created"),
+        });
+        await prepared.restoreWorkspace();
+    });
+    it("fails preparation when the workspace cannot be read for a reason other than absence", async () => {
+        // Only absence means "nothing to sync". A workspace that is there but
+        // unreadable must not quietly become an empty remote workspace, so any
+        // other access error still fails the preparation. A path whose parent is
+        // a file gives a deterministic non-ENOENT error on every platform.
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-unreadable-workspace-"));
+        cleanupDirs.push(rootDir);
+        const notADirectory = path.join(rootDir, "a-file");
+        await writeFile(notADirectory, "not a directory\n");
+        const { client } = makeNativeClient();
+        await expect(prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: path.join(rootDir, "remote"), timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: path.join(notADirectory, "workspace"),
+        })).rejects.toMatchObject({ code: "ENOTDIR" });
+    });
+    it("prefers the native path for default-provision asset inbound and workspace outbound", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-sync-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        const localAssetsDir = path.join(rootDir, "local-assets");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await mkdir(localAssetsDir, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "local workspace\n", "utf8");
+        await writeFile(path.join(localAssetsDir, "skill.md"), "skill body\n", "utf8");
+        const { client, syncInOps, syncOutOps } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            assets: [{ key: "skills", localDir: localAssetsDir }],
+        });
+        // Both the workspace and the default-provision asset stage through syncIn:
+        // each uploads a single tar as a `file` mapping with an opaque operationId,
+        // and the extract runs as the operation's ordered post-upload command.
+        const inboundOps = syncInOps.flat();
+        expect(inboundOps.length).toBe(2);
+        const assetOp = inboundOps.find((op) => op.files.some((mapping) => mapping.targetPath.endsWith("skills-upload.tar")));
+        expect(assetOp).toBeDefined();
+        expect(assetOp.operationId).toMatch(/^sync-op-\d+$/);
+        expect(assetOp.operationId).not.toContain("skills");
+        expect(assetOp.files).toHaveLength(1);
+        expect(assetOp.files[0]).toMatchObject({
+            targetPath: path.posix.join(prepared.runtimeRootDir, "skills-upload.tar"),
+            kind: "file",
+        });
+        // Default provision → a plain destroy-then-replace tar extract post-command.
+        expect(assetOp.postUploadCommands).toHaveLength(1);
+        expect(assetOp.postUploadCommands[0].command).toContain("tar -xf");
+        expect(await readFile(path.join(prepared.assetDirs.skills, "skill.md"), "utf8")).toBe("skill body\n");
+        // Mutate the sandbox workspace, then restore through the native outbound path.
+        await writeFile(path.join(remoteWorkspaceDir, "README.md"), "remote workspace\n", "utf8");
+        await writeFile(path.join(remoteWorkspaceDir, "new.txt"), "added\n", "utf8");
+        await prepared.restoreWorkspace();
+        const outboundOps = syncOutOps.flat();
+        expect(outboundOps.length).toBe(1);
+        expect(outboundOps[0].files[0]).toMatchObject({ sourcePath: remoteWorkspaceDir, kind: "directory" });
+        expect(await readFile(path.join(localWorkspaceDir, "README.md"), "utf8")).toBe("remote workspace\n");
+        expect(await readFile(path.join(localWorkspaceDir, "new.txt"), "utf8")).toBe("added\n");
+    });
+    it("stamps the run-specific timeout onto every delegated post-upload command", async () => {
+        // The extract/wipe/merge commands are delegated to the provider through
+        // `syncIn` as `postUploadCommands`. They MUST carry the run-specific timeout
+        // (`spec.timeoutMs`) — the same limit the pre-syncIn code passed to
+        // `client.run` — not the provider sync client's own default. When the two
+        // differ, a command left without a `timeoutMs` outlives (or is killed under)
+        // the wrong limit; here a distinctive `spec.timeoutMs` proves propagation.
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-timeout-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        const defaultAssetDir = path.join(rootDir, "default-asset");
+        const customAssetDir = path.join(rootDir, "custom-asset");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await mkdir(defaultAssetDir, { recursive: true });
+        await mkdir(customAssetDir, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "ws\n", "utf8");
+        await writeFile(path.join(defaultAssetDir, "skill.md"), "skill\n", "utf8");
+        await writeFile(path.join(customAssetDir, "cred.txt"), "secret\n", "utf8");
+        const runTimeoutMs = 7_000;
+        const { client, syncInOps } = makeNativeClient();
+        await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: runTimeoutMs, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            assets: [
+                { key: "skills", localDir: defaultAssetDir },
+                {
+                    key: "creds",
+                    localDir: customAssetDir,
+                    provision: { postUploadCommand: ({ assetTarPath, assetDir }) => `rm -rf ${assetDir} && mkdir -p ${assetDir} && tar -xf ${assetTarPath} -C ${assetDir} && rm -f ${assetTarPath}` },
+                },
+            ],
+        });
+        // Workspace extract + default-asset extract + custom-provision merge — every
+        // delegated command across every operation carries the run timeout.
+        const commands = syncInOps.flat().flatMap((op) => op.postUploadCommands ?? []);
+        expect(commands.length).toBeGreaterThanOrEqual(3);
+        for (const command of commands) {
+            expect(command.timeoutMs).toBe(runTimeoutMs);
+        }
+    });
+    it("routes a custom-provision asset through syncIn with its bespoke post-upload command (native)", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-custom-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        const localAssetsDir = path.join(rootDir, "local-assets");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await mkdir(localAssetsDir, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "ws\n", "utf8");
+        await writeFile(path.join(localAssetsDir, "cred.txt"), "secret\n", "utf8");
+        const { client, syncInOps } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            assets: [{
+                    key: "creds",
+                    localDir: localAssetsDir,
+                    // A bespoke post-upload command (e.g. a credential merge) rides syncIn as
+                    // the operation's ordered post-upload command — no native-diversion gate.
+                    provision: { postUploadCommand: ({ assetTarPath, assetDir }) => `rm -rf ${assetDir} && mkdir -p ${assetDir} && tar -xf ${assetTarPath} -C ${assetDir} && rm -f ${assetTarPath}` },
+                }],
+        });
+        // The custom asset now rides syncIn (native uploadFiles), carrying its
+        // bespoke command as the operation's ordered post-upload command.
+        const credsOp = syncInOps.flat().find((op) => op.files.some((mapping) => mapping.targetPath.endsWith("creds-upload.tar")));
+        expect(credsOp).toBeDefined();
+        expect(credsOp.files.every((mapping) => mapping.kind === "file")).toBe(true);
+        expect(credsOp.postUploadCommands).toHaveLength(1);
+        expect(credsOp.postUploadCommands[0].command).toContain("tar -xf");
+        expect(await readFile(path.join(prepared.assetDirs.creds, "cred.txt"), "utf8")).toBe("secret\n");
+    });
+    it("stages each additional project into its own isolated dir via a native directory syncIn", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-additional-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "anchor\n", "utf8");
+        // Three referenced projects, each with a distinctive file, staged as plain
+        // read-only trees.
+        const projects = [
+            { projectId: "alpha", localDir: path.join(rootDir, "src-alpha"), file: "alpha.txt", body: "alpha body\n" },
+            { projectId: "bravo", localDir: path.join(rootDir, "src-bravo"), file: "bravo.txt", body: "bravo body\n" },
+            { projectId: "charlie", localDir: path.join(rootDir, "src-charlie"), file: "charlie.txt", body: "charlie body\n" },
+        ];
+        for (const project of projects) {
+            await mkdir(project.localDir, { recursive: true });
+            await writeFile(path.join(project.localDir, project.file), project.body, "utf8");
+        }
+        const { client, syncInOps } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            additionalSources: projects.map((project) => ({
+                localPath: project.localDir,
+                projectId: project.projectId,
+                ignoreResolution: { kind: "other" },
+            })),
+        });
+        // Each project lands in its OWN `project-<projectId>` directory under the
+        // runtime root, and its file materializes there.
+        const projectDirs = projects.map((project) => {
+            const dir = prepared.additionalSourceDirs[project.projectId];
+            expect(dir).toBe(path.posix.join(prepared.runtimeRootDir, `project-${project.projectId}`));
+            return dir;
+        });
+        for (const [index, project] of projects.entries()) {
+            expect(await readFile(path.join(projectDirs[index], project.file), "utf8")).toBe(project.body);
+        }
+        // The target dirs are pairwise distinct and never nested inside one another.
+        for (const outer of projectDirs) {
+            for (const inner of projectDirs) {
+                if (outer === inner)
+                    continue;
+                expect(inner.startsWith(`${outer}/`)).toBe(false);
+            }
+        }
+        // Each project rides its own `syncIn` operation as a single `directory`
+        // mapping, source = the host checkout dir, target = the isolated project dir.
+        const inboundOps = syncInOps.flat();
+        for (const [index, project] of projects.entries()) {
+            const op = inboundOps.find((candidate) => candidate.files.some((mapping) => mapping.targetPath === projectDirs[index]));
+            expect(op).toBeDefined();
+            expect(op.operationId).toMatch(/^sync-op-\d+$/);
+            expect(op.operationId).not.toContain(project.projectId);
+            expect(op.files).toHaveLength(1);
+            expect(op.files[0]).toMatchObject({
+                sourcePath: project.localDir,
+                targetPath: projectDirs[index],
+                kind: "directory",
+            });
+            // Plain read-only tree — no post-upload extract/wipe/merge command.
+            expect(op.postUploadCommands ?? []).toHaveLength(0);
+        }
+    });
+    it("isolates one additional project's sync failure and stages the rest", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-additional-fail-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        const goodDir = path.join(rootDir, "src-good");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await mkdir(goodDir, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "anchor\n", "utf8");
+        await writeFile(path.join(goodDir, "good.txt"), "good body\n", "utf8");
+        // The middle source points at a directory that does not exist, so its native
+        // transfer fails. Failure isolation must skip only it and stage the rest.
+        const { client } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            additionalSources: [
+                { localPath: goodDir, projectId: "good-a", ignoreResolution: { kind: "other" } },
+                { localPath: path.join(rootDir, "does-not-exist"), projectId: "broken", ignoreResolution: { kind: "other" } },
+                { localPath: goodDir, projectId: "good-b", ignoreResolution: { kind: "other" } },
+            ],
+        });
+        // Both healthy projects staged; the broken one is absent, not fatal.
+        expect(Object.keys(prepared.additionalSourceDirs).sort()).toEqual(["good-a", "good-b"]);
+        expect(prepared.additionalSourceDirs.broken).toBeUndefined();
+        expect(await readFile(path.join(prepared.additionalSourceDirs["good-a"], "good.txt"), "utf8")).toBe("good body\n");
+        expect(await readFile(path.join(prepared.additionalSourceDirs["good-b"], "good.txt"), "utf8")).toBe("good body\n");
+    });
+    it("dereferences symlinks only when followSymlinks is true (native honors the flag)", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-native-symlink-"));
+        cleanupDirs.push(rootDir);
+        const localWorkspaceDir = path.join(rootDir, "local-workspace");
+        const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+        const assetsPreserve = path.join(rootDir, "assets-preserve");
+        const assetsDeref = path.join(rootDir, "assets-deref");
+        const target = path.join(rootDir, "target.md");
+        await mkdir(localWorkspaceDir, { recursive: true });
+        await mkdir(assetsPreserve, { recursive: true });
+        await mkdir(assetsDeref, { recursive: true });
+        await writeFile(path.join(localWorkspaceDir, "README.md"), "ws\n", "utf8");
+        await writeFile(target, "link body\n", "utf8");
+        await symlink(target, path.join(assetsPreserve, "link.md"));
+        await symlink(target, path.join(assetsDeref, "link.md"));
+        const { client } = makeNativeClient();
+        const prepared = await prepareSandboxManagedRuntime({
+            spec: { transport: "sandbox", provider: "test", sandboxId: "s1", remoteCwd: remoteWorkspaceDir, timeoutMs: 30_000, apiKey: null },
+            adapterKey: "test-adapter",
+            client,
+            workspaceLocalDir: localWorkspaceDir,
+            assets: [
+                { key: "preserve", localDir: assetsPreserve, followSymlinks: false },
+                { key: "deref", localDir: assetsDeref, followSymlinks: true },
+            ],
+        });
+        expect((await lstat(path.join(prepared.assetDirs.preserve, "link.md"))).isSymbolicLink()).toBe(true);
+        const dereffed = await lstat(path.join(prepared.assetDirs.deref, "link.md"));
+        expect(dereffed.isSymbolicLink()).toBe(false);
+        expect(await readFile(path.join(prepared.assetDirs.deref, "link.md"), "utf8")).toBe("link body\n");
+    });
+});
+describe("assertSyncOperationsConfined", () => {
+    const op = (targetPath, sourcePath = "/host/src") => [
+        { operationId: "sync-op-1", files: [{ sourcePath, targetPath, kind: "directory" }] },
+    ];
+    it("accepts targets within an allowed root", () => {
+        expect(() => assertSyncOperationsConfined(op("/remote/ws/sub"), {
+            sourceRoots: ["/host/src"], targetRoots: ["/remote/ws"],
+        })).not.toThrow();
+    });
+    it("rejects a relative target", () => {
+        expect(() => assertSyncOperationsConfined(op("relative/path"), {
+            sourceRoots: ["/host/src"], targetRoots: ["/remote/ws"],
+        })).toThrow(/confined absolute path/);
+    });
+    it("rejects a parent-traversal escape", () => {
+        expect(() => assertSyncOperationsConfined(op("/remote/ws/../etc/passwd"), {
+            sourceRoots: ["/host/src"], targetRoots: ["/remote/ws"],
+        })).toThrow(/confined absolute path|escapes its confinement root/);
+    });
+    it("rejects an absolute target outside every root", () => {
+        expect(() => assertSyncOperationsConfined(op("/etc/passwd"), {
+            sourceRoots: ["/host/src"], targetRoots: ["/remote/ws"],
+        })).toThrow(/escapes its confinement root/);
+    });
+    it("rejects a source outside every source root", () => {
+        expect(() => assertSyncOperationsConfined(op("/remote/ws/ok", "/etc/shadow"), {
+            sourceRoots: ["/host/src"], targetRoots: ["/remote/ws"],
+        })).toThrow(/escapes its confinement root/);
+    });
+});
+//# sourceMappingURL=sandbox-file-sync.test.js.map

package/dist/sandbox-file-sync.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-file-sync.test.js","sourceRoot":"","sources":["../src/sandbox-file-sync.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAQ7C,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,iEAAiE;AACjE,SAAS,gBAAgB;IACvB,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,MAAM,UAAU,GAA6B,EAAE,CAAC;IAEhD,MAAM,iBAAiB,GAAG,KAAK,EAC7B,UAAkB,EAClB,UAAkB,EAClB,cAAmC,EAClB,EAAE;QACnB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,kFAAkF;QAClF,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,UAAkC,EAAE,EAAE,CAAC,CAAC;QACrE,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YAC/D,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACjC,gBAAgB,IAAI,MAAM,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;gBAC9G,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;oBACxE,gBAAgB,IAAI,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;gBACzD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACvF,CAAC,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC;QAC1D,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KACpG,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oCAAoC,CAAC,CAAC,CAAC;QAC5F,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;QAEvE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACxH,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3F,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACvE,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3F,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,8BAA8B;QAC9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oCAAoC,CAAC,CAAC,CAAC;QAC5F,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACxH,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC,CAAC;QAChG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,4BAA4B,CAAC;YACxC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3I,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;SACzD,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAChF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAE/E,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACjI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;SACtD,CAAC,CAAC;QAEH,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACrC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,OAAQ,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;YACzE,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,6EAA6E;QAC7E,MAAM,CAAC,OAAQ,CAAC,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,OAAQ,CAAC,kBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEtG,+EAA+E;QAC/E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC1F,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7E,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAElC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACrG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,wEAAwE;QACxE,6EAA6E;QAC7E,oEAAoE;QACpE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,YAAY,GAAG,KAAK,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACjD,MAAM,4BAA4B,CAAC;YACjC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;YACvI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,MAAM,EAAE;gBACN,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE;gBAC5C;oBACE,GAAG,EAAE,OAAO;oBACZ,QAAQ,EAAE,cAAc;oBACxB,SAAS,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC7D,UAAU,QAAQ,gBAAgB,QAAQ,eAAe,YAAY,OAAO,QAAQ,aAAa,YAAY,EAAE,EAAE;iBACpH;aACF;SACF,CAAC,CAAC;QAEH,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAClF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACjI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,MAAM,EAAE,CAAC;oBACP,GAAG,EAAE,OAAO;oBACZ,QAAQ,EAAE,cAAc;oBACxB,0EAA0E;oBAC1E,0EAA0E;oBAC1E,SAAS,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC7D,UAAU,QAAQ,gBAAgB,QAAQ,eAAe,YAAY,OAAO,QAAQ,aAAa,YAAY,EAAE,EAAE;iBACpH,CAAC;SACH,CAAC,CAAC;QAEH,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC3C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAC5E,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,OAAQ,CAAC,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,OAAQ,CAAC,kBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAE/E,2EAA2E;QAC3E,mBAAmB;QACnB,MAAM,QAAQ,GAAG;YACf,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;YAC1G,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;YAC1G,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACnH,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACjI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aACpC,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC;QAED,6EAA6E;QAC7E,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,KAAK,KAAK,KAAK;oBAAE,SAAS;gBAC9B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,CAAC,EAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACjD,MAAM,CAAC,EAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,CAAC,EAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,EAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBACjC,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;YACH,oEAAoE;YACpE,MAAM,CAAC,EAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;QAC3F,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAEvE,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACjI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,iBAAiB,EAAE;gBACjB,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAChF,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC7G,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;aACjF;SACF,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAEzD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;YAClD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YACjI,UAAU,EAAE,cAAc;YAC1B,MAAM;YACN,iBAAiB,EAAE,iBAAiB;YACpC,MAAM,EAAE;gBACN,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE;gBACpE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE;aAC9D;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,MAAM,EAAE,GAAG,CAAC,UAAkB,EAAE,UAAU,GAAG,WAAW,EAA0B,EAAE,CAAC;QACnF,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;KACrF,CAAC;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE;YAC9D,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC;SACxD,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE;YAC7D,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC;SACxD,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE;YACxE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC;SACxD,CAAC,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE;YAC3D,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC;SACxD,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC;SACxD,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sandbox-install-command.d.ts

@@ -0,0 +1,2 @@
+export declare function buildSandboxNpmInstallCommand(packageName: string): string;
+//# sourceMappingURL=sandbox-install-command.d.ts.map

package/dist/sandbox-install-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-install-command.d.ts","sourceRoot":"","sources":["../src/sandbox-install-command.ts"],"names":[],"mappings":"AAkCA,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAczE"}

package/dist/sandbox-install-command.js

@@ -0,0 +1,47 @@
+function shellSingleQuote(value) {
+    return `'${value.replaceAll("'", `'\"'\"'`)}'`;
+}
+// Bootstrap a usable npm when the sandbox image ships without one (e.g. the
+// default exe.dev VM image has sshd + a normal user homedir but no Node
+// toolchain). We install a portable Node tarball into $HOME/.local rather
+// than using apt-get because the distro-packaged Node is often old enough to
+// reject modern JS syntax (regex /v flag, etc.) used by adapter CLIs like
+// @google/gemini-cli. The bootstrap also sets PAPERCLIP_NPM_BOOTSTRAPPED=1
+// so the install step knows to skip sudo — sudo would reset PATH via
+// secure_path and lose visibility of the freshly-installed npm in
+// $HOME/.local/bin.
+const ENSURE_NPM_PREAMBLE = "PAPERCLIP_NPM_BOOTSTRAPPED=; " +
+    "if ! command -v npm >/dev/null 2>&1 || " +
+    "! command -v node >/dev/null 2>&1 || " +
+    "! node -e 'const v=process.versions.node.split(\".\").map(Number);" +
+    "process.exit(v[0]>24||(v[0]===24&&v[1]>=11)?0:1)' >/dev/null 2>&1; then " +
+    'NODE_ARCH="$(uname -m)"; ' +
+    'case "$NODE_ARCH" in ' +
+    "x86_64) NODE_ARCH=x64 ;; " +
+    "aarch64|arm64) NODE_ARCH=arm64 ;; " +
+    "esac; " +
+    'NODE_VERSION="v24.11.0"; ' +
+    'NODE_TARBALL="node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz"; ' +
+    'mkdir -p "$HOME/.local"; ' +
+    'curl -fsSL "https://nodejs.org/dist/${NODE_VERSION}/${NODE_TARBALL}" -o "/tmp/${NODE_TARBALL}" && ' +
+    'tar -xJf "/tmp/${NODE_TARBALL}" -C "$HOME/.local" --strip-components=1 && ' +
+    'rm -f "/tmp/${NODE_TARBALL}" && ' +
+    'export PATH="$HOME/.local/bin:$PATH" && ' +
+    "PAPERCLIP_NPM_BOOTSTRAPPED=1; " +
+    "fi;";
+export function buildSandboxNpmInstallCommand(packageName) {
+    const quotedPackageName = shellSingleQuote(packageName);
+    return [
+        ENSURE_NPM_PREAMBLE,
+        'if [ -n "$PAPERCLIP_NPM_BOOTSTRAPPED" ]; then',
+        `npm install -g ${quotedPackageName};`,
+        'elif [ "$(id -u)" -eq 0 ]; then',
+        `npm install -g ${quotedPackageName};`,
+        'elif command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then',
+        `sudo -E npm install -g ${quotedPackageName};`,
+        "else",
+        `mkdir -p "$HOME/.local" && npm install -g --prefix "$HOME/.local" ${quotedPackageName};`,
+        "fi",
+    ].join(" ");
+}
+//# sourceMappingURL=sandbox-install-command.js.map

package/dist/sandbox-install-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-install-command.js","sourceRoot":"","sources":["../src/sandbox-install-command.ts"],"names":[],"mappings":"AAAA,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,kEAAkE;AAClE,oBAAoB;AACpB,MAAM,mBAAmB,GACvB,+BAA+B;IAC/B,yCAAyC;IACzC,uCAAuC;IACvC,oEAAoE;IACpE,0EAA0E;IAC1E,2BAA2B;IAC3B,uBAAuB;IACvB,2BAA2B;IAC3B,oCAAoC;IACpC,QAAQ;IACR,2BAA2B;IAC3B,iEAAiE;IACjE,2BAA2B;IAC3B,oGAAoG;IACpG,4EAA4E;IAC5E,kCAAkC;IAClC,0CAA0C;IAC1C,gCAAgC;IAChC,KAAK,CAAC;AAER,MAAM,UAAU,6BAA6B,CAAC,WAAmB;IAC/D,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO;QACL,mBAAmB;QACnB,+CAA+C;QAC/C,kBAAkB,iBAAiB,GAAG;QACtC,iCAAiC;QACjC,kBAAkB,iBAAiB,GAAG;QACtC,4EAA4E;QAC5E,0BAA0B,iBAAiB,GAAG;QAC9C,MAAM;QACN,qEAAqE,iBAAiB,GAAG;QACzF,IAAI;KACL,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/sandbox-install-command.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox-install-command.test.d.ts.map

package/dist/sandbox-install-command.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-install-command.test.d.ts","sourceRoot":"","sources":["../src/sandbox-install-command.test.ts"],"names":[],"mappings":""}

package/dist/sandbox-install-command.test.js

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { buildSandboxNpmInstallCommand } from "./sandbox-install-command.js";
+describe("buildSandboxNpmInstallCommand", () => {
+    it("installs globally as root, via sudo when available, and under ~/.local otherwise", () => {
+        const command = buildSandboxNpmInstallCommand("@google/gemini-cli");
+        expect(command).toContain("if [ \"$(id -u)\" -eq 0 ]; then npm install -g '@google/gemini-cli';");
+        expect(command).toContain("sudo -E npm install -g '@google/gemini-cli'");
+        expect(command).toContain("npm install -g --prefix \"$HOME/.local\" '@google/gemini-cli'");
+    });
+    it("bootstraps npm from a portable Node tarball when missing or unsupported", () => {
+        const command = buildSandboxNpmInstallCommand("@google/gemini-cli");
+        expect(command).toContain("if ! command -v npm >/dev/null 2>&1 || ! command -v node >/dev/null 2>&1 ||");
+        expect(command).toContain("process.versions.node");
+        expect(command).toContain("v[0]>24||(v[0]===24&&v[1]>=11)");
+        expect(command).toContain("https://nodejs.org/dist/");
+        expect(command).toContain('export PATH="$HOME/.local/bin:$PATH"');
+    });
+    it("shell-quotes package names", () => {
+        expect(buildSandboxNpmInstallCommand("odd'pkg")).toContain("'odd'\"'\"'pkg'");
+    });
+});
+//# sourceMappingURL=sandbox-install-command.test.js.map

package/dist/sandbox-install-command.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-install-command.test.js","sourceRoot":"","sources":["../src/sandbox-install-command.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,OAAO,GAAG,6BAA6B,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sEAAsE,CAAC,CAAC;QAClG,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,+DAA+D,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,OAAO,GAAG,6BAA6B,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6EAA6E,CAAC,CAAC;QACzG,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}