@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/terminal/TerminalSessionManager.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TerminalSessionManager = void 0;
+const crypto_1 = require("crypto");
+const global_logger_factory_1 = require("global-logger-factory");
+const TerminalSession_1 = require("./TerminalSession");
+const AclPermissionService_1 = require("./AclPermissionService");
+const types_1 = require("./types");
+const DEFAULT_OPTIONS = {
+    maxSessionsPerUser: 5,
+    maxTotalSessions: 100,
+    defaultTimeout: 3600, // 1 hour
+    maxTimeout: 86400, // 24 hours
+    defaultWorkdir: '/workspace',
+    requireAclControl: true,
+};
+class TerminalSessionManager {
+    constructor(options = {}) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.sessions = new Map();
+        this.userSessions = new Map();
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+        // Initialize ACL service if SPARQL endpoint is provided
+        if (this.options.sparqlEndpoint) {
+            this.aclService = new AclPermissionService_1.AclPermissionService(this.options.sparqlEndpoint);
+        }
+    }
+    /**
+     * Convert a file system path to a resource URL.
+     */
+    pathToUrl(path) {
+        if (!this.options.baseUrl || !this.options.fileSystemRoot) {
+            return undefined;
+        }
+        const root = this.options.fileSystemRoot.endsWith('/')
+            ? this.options.fileSystemRoot.slice(0, -1)
+            : this.options.fileSystemRoot;
+        if (!path.startsWith(root)) {
+            return undefined;
+        }
+        const relativePath = path.slice(root.length);
+        const baseUrl = this.options.baseUrl.endsWith('/')
+            ? this.options.baseUrl.slice(0, -1)
+            : this.options.baseUrl;
+        return baseUrl + relativePath;
+    }
+    /**
+     * Check if user has acl:Control permission for the working directory.
+     */
+    async checkWorkdirPermission(userId, workdir) {
+        if (!this.options.requireAclControl) {
+            return true;
+        }
+        if (!this.aclService) {
+            this.logger.warn('ACL service not configured, skipping permission check');
+            return true;
+        }
+        const resourceUrl = this.pathToUrl(workdir);
+        if (!resourceUrl) {
+            this.logger.warn(`Cannot map workdir to URL: ${workdir}`);
+            return false;
+        }
+        return this.aclService.hasControlPermission(userId, resourceUrl);
+    }
+    /**
+     * Create a new terminal session
+     */
+    async createSession(userId, request, secretResolver) {
+        // Validate command is trusted
+        if (!(0, types_1.isTrustedAgent)(request.command)) {
+            throw new Error(`Untrusted command: ${request.command}. Allowed: ${types_1.TRUSTED_AGENTS.join(', ')}`);
+        }
+        const workdir = request.workdir ?? this.options.defaultWorkdir;
+        // Check ACL Control permission
+        const hasPermission = await this.checkWorkdirPermission(userId, workdir);
+        if (!hasPermission) {
+            throw new Error(`Permission denied: acl:Control required for workdir ${workdir}`);
+        }
+        // Check limits
+        if (this.sessions.size >= this.options.maxTotalSessions) {
+            throw new Error('Maximum total sessions reached');
+        }
+        const userSessionIds = this.userSessions.get(userId) ?? new Set();
+        if (userSessionIds.size >= this.options.maxSessionsPerUser) {
+            throw new Error(`Maximum sessions per user reached (${this.options.maxSessionsPerUser})`);
+        }
+        // Resolve environment variables
+        const env = {};
+        if (request.env) {
+            for (const [key, value] of Object.entries(request.env)) {
+                if (typeof value === 'string') {
+                    env[key] = value;
+                }
+                else if (secretResolver) {
+                    try {
+                        env[key] = await secretResolver(value);
+                    }
+                    catch (error) {
+                        this.logger.warn(`Failed to resolve secret for ${key}: ${error}`);
+                    }
+                }
+            }
+        }
+        // Build session config
+        const sessionId = `sess_${(0, crypto_1.randomUUID)().replace(/-/g, '').slice(0, 12)}`;
+        const timeout = Math.min(request.timeout ?? this.options.defaultTimeout, this.options.maxTimeout);
+        const config = {
+            command: request.command,
+            args: request.args ?? [],
+            workdir,
+            env: request.env ?? {},
+            timeout,
+        };
+        // Create session
+        const session = new TerminalSession_1.TerminalSession(sessionId, userId, config, env);
+        // Track session
+        this.sessions.set(sessionId, session);
+        if (!this.userSessions.has(userId)) {
+            this.userSessions.set(userId, new Set());
+        }
+        this.userSessions.get(userId).add(sessionId);
+        // Clean up on exit
+        session.on('exit', () => {
+            this.removeSession(sessionId);
+        });
+        this.logger.info(`Created terminal session ${sessionId} for user ${userId} in ${workdir}`);
+        return session;
+    }
+    /**
+     * Get a session by ID
+     */
+    getSession(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    /**
+     * Get all sessions for a user
+     */
+    getUserSessions(userId) {
+        const sessionIds = this.userSessions.get(userId);
+        if (!sessionIds) {
+            return [];
+        }
+        return Array.from(sessionIds)
+            .map(id => this.sessions.get(id))
+            .filter((s) => s !== undefined);
+    }
+    /**
+     * Terminate a session
+     */
+    terminateSession(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            return false;
+        }
+        session.terminate();
+        return true;
+    }
+    /**
+     * Remove a session from tracking
+     */
+    removeSession(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (session) {
+            this.sessions.delete(sessionId);
+            const userSessionIds = this.userSessions.get(session.userId);
+            if (userSessionIds) {
+                userSessionIds.delete(sessionId);
+                if (userSessionIds.size === 0) {
+                    this.userSessions.delete(session.userId);
+                }
+            }
+            this.logger.debug(`Removed terminal session ${sessionId}`);
+        }
+    }
+    /**
+     * Get session statistics
+     */
+    getStats() {
+        return {
+            totalSessions: this.sessions.size,
+            activeUsers: this.userSessions.size,
+        };
+    }
+    /**
+     * Terminate all sessions (for shutdown)
+     */
+    terminateAll() {
+        for (const session of this.sessions.values()) {
+            session.terminate();
+        }
+        this.sessions.clear();
+        this.userSessions.clear();
+    }
+}
+exports.TerminalSessionManager = TerminalSessionManager;
+//# sourceMappingURL=TerminalSessionManager.js.map

package/dist/terminal/TerminalSessionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TerminalSessionManager.js","sourceRoot":"","sources":["../../src/terminal/TerminalSessionManager.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AACpC,iEAAqD;AACrD,uDAAoD;AACpD,iEAA8D;AAE9D,mCAAyD;AAuBzD,MAAM,eAAe,GAAkC;IACrD,kBAAkB,EAAE,CAAC;IACrB,gBAAgB,EAAE,GAAG;IACrB,cAAc,EAAE,IAAI,EAAE,SAAS;IAC/B,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,cAAc,EAAE,YAAY;IAC5B,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,MAAa,sBAAsB;IAQjC,YAAY,UAAkD,EAAE;QAP7C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAE9B,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,iBAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QAK7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;QAElD,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,IAAI,2CAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAEhC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAEzB,OAAO,OAAO,GAAG,YAAY,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAAc,EAAE,OAAe;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAA6B,EAC7B,cAAiD;QAEjD,8BAA8B;QAC9B,IAAI,CAAC,IAAA,sBAAc,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,OAAO,cAAc,sBAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAE/D,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAClE,IAAI,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAC5F,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACnB,CAAC;qBAAM,IAAI,cAAc,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,SAAS,GAAG,QAAQ,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CACxB,CAAC;QAEF,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YACxB,OAAO;YACP,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,OAAO;SACR,CAAC;QAEF,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,iCAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAEpE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,mBAAmB;QACnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,aAAa,MAAM,OAAO,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY;QACV,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AA1ND,wDA0NC","sourcesContent":["import { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { TerminalSession } from './TerminalSession';\nimport { AclPermissionService } from './AclPermissionService';\nimport type { SessionConfig, Session, EnvRef, CreateSessionRequest } from './types';\nimport { isTrustedAgent, TRUSTED_AGENTS } from './types';\n\nexport interface TerminalSessionManagerOptions {\n  /** Maximum sessions per user */\n  maxSessionsPerUser: number;\n  /** Maximum total sessions */\n  maxTotalSessions: number;\n  /** Default session timeout in seconds */\n  defaultTimeout: number;\n  /** Maximum session timeout in seconds */\n  maxTimeout: number;\n  /** Default working directory */\n  defaultWorkdir: string;\n  /** SPARQL endpoint for ACL queries */\n  sparqlEndpoint?: string;\n  /** Whether to require ACL Control permission (default: true) */\n  requireAclControl: boolean;\n  /** Base URL for mapping file paths to resource URLs */\n  baseUrl?: string;\n  /** File system root for mapping URLs to paths */\n  fileSystemRoot?: string;\n}\n\nconst DEFAULT_OPTIONS: TerminalSessionManagerOptions = {\n  maxSessionsPerUser: 5,\n  maxTotalSessions: 100,\n  defaultTimeout: 3600, // 1 hour\n  maxTimeout: 86400, // 24 hours\n  defaultWorkdir: '/workspace',\n  requireAclControl: true,\n};\n\nexport class TerminalSessionManager {\n  protected readonly logger = getLoggerFor(this);\n\n  private readonly sessions = new Map<string, TerminalSession>();\n  private readonly userSessions = new Map<string, Set<string>>();\n  private readonly options: TerminalSessionManagerOptions;\n  private readonly aclService?: AclPermissionService;\n\n  constructor(options: Partial<TerminalSessionManagerOptions> = {}) {\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n\n    // Initialize ACL service if SPARQL endpoint is provided\n    if (this.options.sparqlEndpoint) {\n      this.aclService = new AclPermissionService(this.options.sparqlEndpoint);\n    }\n  }\n\n  /**\n   * Convert a file system path to a resource URL.\n   */\n  private pathToUrl(path: string): string | undefined {\n    if (!this.options.baseUrl || !this.options.fileSystemRoot) {\n      return undefined;\n    }\n\n    const root = this.options.fileSystemRoot.endsWith('/')\n      ? this.options.fileSystemRoot.slice(0, -1)\n      : this.options.fileSystemRoot;\n\n    if (!path.startsWith(root)) {\n      return undefined;\n    }\n\n    const relativePath = path.slice(root.length);\n    const baseUrl = this.options.baseUrl.endsWith('/')\n      ? this.options.baseUrl.slice(0, -1)\n      : this.options.baseUrl;\n\n    return baseUrl + relativePath;\n  }\n\n  /**\n   * Check if user has acl:Control permission for the working directory.\n   */\n  async checkWorkdirPermission(userId: string, workdir: string): Promise<boolean> {\n    if (!this.options.requireAclControl) {\n      return true;\n    }\n\n    if (!this.aclService) {\n      this.logger.warn('ACL service not configured, skipping permission check');\n      return true;\n    }\n\n    const resourceUrl = this.pathToUrl(workdir);\n    if (!resourceUrl) {\n      this.logger.warn(`Cannot map workdir to URL: ${workdir}`);\n      return false;\n    }\n\n    return this.aclService.hasControlPermission(userId, resourceUrl);\n  }\n\n  /**\n   * Create a new terminal session\n   */\n  async createSession(\n    userId: string,\n    request: CreateSessionRequest,\n    secretResolver?: (ref: EnvRef) => Promise<string>,\n  ): Promise<TerminalSession> {\n    // Validate command is trusted\n    if (!isTrustedAgent(request.command)) {\n      throw new Error(\n        `Untrusted command: ${request.command}. Allowed: ${TRUSTED_AGENTS.join(', ')}`\n      );\n    }\n\n    const workdir = request.workdir ?? this.options.defaultWorkdir;\n\n    // Check ACL Control permission\n    const hasPermission = await this.checkWorkdirPermission(userId, workdir);\n    if (!hasPermission) {\n      throw new Error(\n        `Permission denied: acl:Control required for workdir ${workdir}`\n      );\n    }\n\n    // Check limits\n    if (this.sessions.size >= this.options.maxTotalSessions) {\n      throw new Error('Maximum total sessions reached');\n    }\n\n    const userSessionIds = this.userSessions.get(userId) ?? new Set();\n    if (userSessionIds.size >= this.options.maxSessionsPerUser) {\n      throw new Error(`Maximum sessions per user reached (${this.options.maxSessionsPerUser})`);\n    }\n\n    // Resolve environment variables\n    const env: Record<string, string> = {};\n    if (request.env) {\n      for (const [key, value] of Object.entries(request.env)) {\n        if (typeof value === 'string') {\n          env[key] = value;\n        } else if (secretResolver) {\n          try {\n            env[key] = await secretResolver(value);\n          } catch (error) {\n            this.logger.warn(`Failed to resolve secret for ${key}: ${error}`);\n          }\n        }\n      }\n    }\n\n    // Build session config\n    const sessionId = `sess_${randomUUID().replace(/-/g, '').slice(0, 12)}`;\n    const timeout = Math.min(\n      request.timeout ?? this.options.defaultTimeout,\n      this.options.maxTimeout\n    );\n\n    const config: SessionConfig = {\n      command: request.command,\n      args: request.args ?? [],\n      workdir,\n      env: request.env ?? {},\n      timeout,\n    };\n\n    // Create session\n    const session = new TerminalSession(sessionId, userId, config, env);\n\n    // Track session\n    this.sessions.set(sessionId, session);\n    if (!this.userSessions.has(userId)) {\n      this.userSessions.set(userId, new Set());\n    }\n    this.userSessions.get(userId)!.add(sessionId);\n\n    // Clean up on exit\n    session.on('exit', () => {\n      this.removeSession(sessionId);\n    });\n\n    this.logger.info(`Created terminal session ${sessionId} for user ${userId} in ${workdir}`);\n    return session;\n  }\n\n  /**\n   * Get a session by ID\n   */\n  getSession(sessionId: string): TerminalSession | undefined {\n    return this.sessions.get(sessionId);\n  }\n\n  /**\n   * Get all sessions for a user\n   */\n  getUserSessions(userId: string): TerminalSession[] {\n    const sessionIds = this.userSessions.get(userId);\n    if (!sessionIds) {\n      return [];\n    }\n    return Array.from(sessionIds)\n      .map(id => this.sessions.get(id))\n      .filter((s): s is TerminalSession => s !== undefined);\n  }\n\n  /**\n   * Terminate a session\n   */\n  terminateSession(sessionId: string): boolean {\n    const session = this.sessions.get(sessionId);\n    if (!session) {\n      return false;\n    }\n    session.terminate();\n    return true;\n  }\n\n  /**\n   * Remove a session from tracking\n   */\n  private removeSession(sessionId: string): void {\n    const session = this.sessions.get(sessionId);\n    if (session) {\n      this.sessions.delete(sessionId);\n      const userSessionIds = this.userSessions.get(session.userId);\n      if (userSessionIds) {\n        userSessionIds.delete(sessionId);\n        if (userSessionIds.size === 0) {\n          this.userSessions.delete(session.userId);\n        }\n      }\n      this.logger.debug(`Removed terminal session ${sessionId}`);\n    }\n  }\n\n  /**\n   * Get session statistics\n   */\n  getStats(): { totalSessions: number; activeUsers: number } {\n    return {\n      totalSessions: this.sessions.size,\n      activeUsers: this.userSessions.size,\n    };\n  }\n\n  /**\n   * Terminate all sessions (for shutdown)\n   */\n  terminateAll(): void {\n    for (const session of this.sessions.values()) {\n      session.terminate();\n    }\n    this.sessions.clear();\n    this.userSessions.clear();\n  }\n}\n"]}

package/dist/terminal/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types';
+export * from './TerminalSession';
+export * from './TerminalSessionManager';
+export * from './AclPermissionService';
+export * from './sandbox/index';

package/dist/terminal/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./TerminalSession"), exports);
+__exportStar(require("./TerminalSessionManager"), exports);
+__exportStar(require("./AclPermissionService"), exports);
+__exportStar(require("./sandbox/index"), exports);
+//# sourceMappingURL=index.js.map

package/dist/terminal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/terminal/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,oDAAkC;AAClC,2DAAyC;AACzC,yDAAuC;AACvC,kDAAgC","sourcesContent":["export * from './types';\nexport * from './TerminalSession';\nexport * from './TerminalSessionManager';\nexport * from './AclPermissionService';\nexport * from './sandbox/index';\n"]}

package/dist/terminal/sandbox/BubblewrapSandbox.d.ts

@@ -0,0 +1,8 @@
+import type { Sandbox, SandboxConfig, SandboxResult } from './types';
+export declare class BubblewrapSandbox implements Sandbox {
+    protected readonly logger: import("global-logger-factory").Logger<unknown>;
+    private static readonly SYSTEM_PATHS;
+    isAvailable(): boolean;
+    launch(config: SandboxConfig): SandboxResult;
+    private buildArgs;
+}

package/dist/terminal/sandbox/BubblewrapSandbox.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BubblewrapSandbox = void 0;
+/**
+ * Bubblewrap Sandbox (Linux)
+ *
+ * Uses Linux namespaces via bubblewrap for process isolation.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const child_process_2 = require("child_process");
+const global_logger_factory_1 = require("global-logger-factory");
+let bwrapAvailable;
+class BubblewrapSandbox {
+    constructor() {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+    }
+    isAvailable() {
+        if (bwrapAvailable === undefined) {
+            try {
+                (0, child_process_2.execSync)('which bwrap', { stdio: 'ignore' });
+                bwrapAvailable = true;
+            }
+            catch {
+                bwrapAvailable = false;
+            }
+        }
+        return bwrapAvailable;
+    }
+    launch(config) {
+        const args = this.buildArgs(config);
+        this.logger.info(`Launching bubblewrap sandbox: ${config.command}`);
+        const childProcess = (0, child_process_1.spawn)('bwrap', args, {
+            env: {
+                ...config.env,
+                TERM: 'xterm-256color',
+            },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return {
+            process: childProcess,
+            sandboxed: true,
+            technology: 'bubblewrap',
+        };
+    }
+    buildArgs(config) {
+        const args = [];
+        // Unshare namespaces for isolation
+        args.push('--unshare-user');
+        args.push('--unshare-pid');
+        args.push('--unshare-uts');
+        args.push('--unshare-ipc');
+        args.push('--unshare-cgroup');
+        if (config.isolateNetwork) {
+            args.push('--unshare-net');
+        }
+        args.push('--die-with-parent');
+        // Mount essential system paths as read-only
+        for (const path of BubblewrapSandbox.SYSTEM_PATHS) {
+            if ((0, fs_1.existsSync)(path)) {
+                args.push('--ro-bind', path, path);
+            }
+        }
+        // Mount /dev, /proc, /tmp
+        args.push('--dev', '/dev');
+        args.push('--proc', '/proc');
+        args.push('--tmpfs', '/tmp');
+        args.push('--tmpfs', '/home');
+        // Additional read-only paths
+        if (config.readonlyPaths) {
+            for (const path of config.readonlyPaths) {
+                if ((0, fs_1.existsSync)(path)) {
+                    args.push('--ro-bind', path, path);
+                }
+            }
+        }
+        // Mount the working directory with write access
+        args.push('--bind', config.workdir, config.workdir);
+        args.push('--chdir', config.workdir);
+        // Environment variables
+        for (const [key, value] of Object.entries(config.env)) {
+            args.push('--setenv', key, value);
+        }
+        args.push('--setenv', 'TERM', 'xterm-256color');
+        // Command
+        args.push(config.command);
+        args.push(...config.args);
+        return args;
+    }
+}
+exports.BubblewrapSandbox = BubblewrapSandbox;
+BubblewrapSandbox.SYSTEM_PATHS = [
+    '/usr',
+    '/lib',
+    '/lib64',
+    '/bin',
+    '/sbin',
+    '/etc/resolv.conf',
+    '/etc/hosts',
+    '/etc/passwd',
+    '/etc/group',
+    '/etc/ssl',
+    '/etc/ca-certificates',
+];
+//# sourceMappingURL=BubblewrapSandbox.js.map

package/dist/terminal/sandbox/BubblewrapSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BubblewrapSandbox.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/BubblewrapSandbox.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAAsC;AACtC,2BAAgC;AAChC,iDAAyC;AACzC,iEAAqD;AAGrD,IAAI,cAAmC,CAAC;AAExC,MAAa,iBAAiB;IAA9B;QACqB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;IAsGjD,CAAC;IAtFQ,WAAW;QAChB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,IAAA,wBAAQ,EAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,KAAK,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAEpE,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE;YACxC,GAAG,EAAE;gBACH,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,YAAY;SACzB,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAqB;QACrC,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE9B,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;YAClD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE9B,6BAA6B;QAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxC,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAErC,wBAAwB;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEhD,UAAU;QACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAE1B,OAAO,IAAI,CAAC;IACd,CAAC;;AAtGH,8CAuGC;AApGyB,8BAAY,GAAG;IACrC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,UAAU;IACV,sBAAsB;CACvB,AAZmC,CAYlC","sourcesContent":["/**\n * Bubblewrap Sandbox (Linux)\n *\n * Uses Linux namespaces via bubblewrap for process isolation.\n */\nimport { spawn } from 'child_process';\nimport { existsSync } from 'fs';\nimport { execSync } from 'child_process';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\n\nlet bwrapAvailable: boolean | undefined;\n\nexport class BubblewrapSandbox implements Sandbox {\n  protected readonly logger = getLoggerFor(this);\n\n  private static readonly SYSTEM_PATHS = [\n    '/usr',\n    '/lib',\n    '/lib64',\n    '/bin',\n    '/sbin',\n    '/etc/resolv.conf',\n    '/etc/hosts',\n    '/etc/passwd',\n    '/etc/group',\n    '/etc/ssl',\n    '/etc/ca-certificates',\n  ];\n\n  public isAvailable(): boolean {\n    if (bwrapAvailable === undefined) {\n      try {\n        execSync('which bwrap', { stdio: 'ignore' });\n        bwrapAvailable = true;\n      } catch {\n        bwrapAvailable = false;\n      }\n    }\n    return bwrapAvailable;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const args = this.buildArgs(config);\n\n    this.logger.info(`Launching bubblewrap sandbox: ${config.command}`);\n\n    const childProcess = spawn('bwrap', args, {\n      env: {\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: true,\n      technology: 'bubblewrap',\n    };\n  }\n\n  private buildArgs(config: SandboxConfig): string[] {\n    const args: string[] = [];\n\n    // Unshare namespaces for isolation\n    args.push('--unshare-user');\n    args.push('--unshare-pid');\n    args.push('--unshare-uts');\n    args.push('--unshare-ipc');\n    args.push('--unshare-cgroup');\n\n    if (config.isolateNetwork) {\n      args.push('--unshare-net');\n    }\n\n    args.push('--die-with-parent');\n\n    // Mount essential system paths as read-only\n    for (const path of BubblewrapSandbox.SYSTEM_PATHS) {\n      if (existsSync(path)) {\n        args.push('--ro-bind', path, path);\n      }\n    }\n\n    // Mount /dev, /proc, /tmp\n    args.push('--dev', '/dev');\n    args.push('--proc', '/proc');\n    args.push('--tmpfs', '/tmp');\n    args.push('--tmpfs', '/home');\n\n    // Additional read-only paths\n    if (config.readonlyPaths) {\n      for (const path of config.readonlyPaths) {\n        if (existsSync(path)) {\n          args.push('--ro-bind', path, path);\n        }\n      }\n    }\n\n    // Mount the working directory with write access\n    args.push('--bind', config.workdir, config.workdir);\n    args.push('--chdir', config.workdir);\n\n    // Environment variables\n    for (const [key, value] of Object.entries(config.env)) {\n      args.push('--setenv', key, value);\n    }\n    args.push('--setenv', 'TERM', 'xterm-256color');\n\n    // Command\n    args.push(config.command);\n    args.push(...config.args);\n\n    return args;\n  }\n}\n"]}

package/dist/terminal/sandbox/MacOSSandbox.d.ts

@@ -0,0 +1,19 @@
+import type { Sandbox, SandboxConfig, SandboxResult } from './types';
+export declare class MacOSSandbox implements Sandbox {
+    protected readonly logger: import("global-logger-factory").Logger<unknown>;
+    isAvailable(): boolean;
+    launch(config: SandboxConfig): SandboxResult;
+    /**
+     * Create a Seatbelt profile for the sandbox.
+     *
+     * Strategy: Allow most operations by default, then deny writes outside workdir.
+     * This is more robust than deny-by-default which breaks many macOS subsystems.
+     *
+     * Profile:
+     * - Allow default (reading, processes, etc.)
+     * - Deny writes to root filesystem
+     * - Allow writes only to: workdir, temp dirs, var/folders
+     * - Optionally deny network
+     */
+    private createProfile;
+}

package/dist/terminal/sandbox/MacOSSandbox.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MacOSSandbox = void 0;
+/**
+ * macOS Sandbox (sandbox-exec / Seatbelt)
+ *
+ * Uses macOS sandbox-exec with Seatbelt profiles for process isolation.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const crypto_1 = require("crypto");
+const global_logger_factory_1 = require("global-logger-factory");
+let sandboxExecAvailable;
+class MacOSSandbox {
+    constructor() {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+    }
+    isAvailable() {
+        if (sandboxExecAvailable === undefined) {
+            try {
+                // Check if we're on macOS and sandbox-exec exists
+                if (process.platform !== 'darwin') {
+                    sandboxExecAvailable = false;
+                }
+                else {
+                    (0, child_process_1.execSync)('which sandbox-exec', { stdio: 'ignore' });
+                    sandboxExecAvailable = true;
+                }
+            }
+            catch {
+                sandboxExecAvailable = false;
+            }
+        }
+        return sandboxExecAvailable;
+    }
+    launch(config) {
+        const profilePath = this.createProfile(config);
+        this.logger.info(`Launching macOS sandbox: ${config.command}`);
+        const childProcess = (0, child_process_1.spawn)('sandbox-exec', ['-f', profilePath, config.command, ...config.args], {
+            cwd: config.workdir,
+            env: {
+                ...process.env,
+                ...config.env,
+                TERM: 'xterm-256color',
+            },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        // Clean up profile after process exits
+        childProcess.on('exit', () => {
+            try {
+                (0, fs_1.unlinkSync)(profilePath);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        });
+        return {
+            process: childProcess,
+            sandboxed: true,
+            technology: 'sandbox-exec',
+        };
+    }
+    /**
+     * Create a Seatbelt profile for the sandbox.
+     *
+     * Strategy: Allow most operations by default, then deny writes outside workdir.
+     * This is more robust than deny-by-default which breaks many macOS subsystems.
+     *
+     * Profile:
+     * - Allow default (reading, processes, etc.)
+     * - Deny writes to root filesystem
+     * - Allow writes only to: workdir, temp dirs, var/folders
+     * - Optionally deny network
+     */
+    createProfile(config) {
+        const profileId = (0, crypto_1.randomUUID)().replace(/-/g, '').slice(0, 8);
+        const profilePath = (0, path_1.join)((0, os_1.tmpdir)(), `xpod-sandbox-${profileId}.sb`);
+        const rules = [
+            '(version 1)',
+            '',
+            '; Allow most operations by default (macOS needs many subsystems)',
+            '(allow default)',
+            '',
+            '; Deny writes to the entire filesystem by default',
+            '(deny file-write* (subpath "/"))',
+            '',
+            '; Allow writes to workdir',
+            `(allow file-write* (subpath "${config.workdir}"))`,
+            '',
+            '; Allow writes to temp directories',
+            '(allow file-write* (subpath "/private/tmp"))',
+            '(allow file-write* (subpath "/tmp"))',
+            `(allow file-write* (subpath "${(0, os_1.tmpdir)()}"))`,
+            '(allow file-write* (subpath "/var/folders"))',
+            '(allow file-write* (subpath "/private/var/folders"))',
+        ];
+        // Network isolation
+        if (config.isolateNetwork) {
+            rules.push('');
+            rules.push('; Deny network access');
+            rules.push('(deny network*)');
+        }
+        // Additional read-only paths (already readable by default)
+        if (config.readonlyPaths) {
+            rules.push('');
+            rules.push('; Additional read-only paths (already allowed by default)');
+            for (const p of config.readonlyPaths) {
+                rules.push(`; readonly: ${p}`);
+            }
+        }
+        const profile = rules.join('\n');
+        (0, fs_1.writeFileSync)(profilePath, profile);
+        this.logger.debug(`Created sandbox profile: ${profilePath}`);
+        return profilePath;
+    }
+}
+exports.MacOSSandbox = MacOSSandbox;
+//# sourceMappingURL=MacOSSandbox.js.map

package/dist/terminal/sandbox/MacOSSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacOSSandbox.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/MacOSSandbox.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAAgD;AAChD,2BAA+C;AAC/C,2BAA4B;AAC5B,+BAA4B;AAC5B,mCAAoC;AACpC,iEAAqD;AAGrD,IAAI,oBAAyC,CAAC;AAE9C,MAAa,YAAY;IAAzB;QACqB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;IA4GjD,CAAC;IA1GQ,WAAW;QAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,kDAAkD;gBAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAClC,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpD,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,cAAc,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE;YAC9F,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,WAAW,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,aAAa,CAAC,MAAqB;QACzC,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,gBAAgB,SAAS,KAAK,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAa;YACtB,aAAa;YACb,EAAE;YACF,kEAAkE;YAClE,iBAAiB;YACjB,EAAE;YACF,mDAAmD;YACnD,kCAAkC;YAClC,EAAE;YACF,2BAA2B;YAC3B,gCAAgC,MAAM,CAAC,OAAO,KAAK;YACnD,EAAE;YACF,oCAAoC;YACpC,8CAA8C;YAC9C,sCAAsC;YACtC,gCAAgC,IAAA,WAAM,GAAE,KAAK;YAC7C,8CAA8C;YAC9C,sDAAsD;SACvD,CAAC;QAEF,oBAAoB;QACpB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,CAAC;QAED,2DAA2D;QAC3D,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAA,kBAAa,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA7GD,oCA6GC","sourcesContent":["/**\n * macOS Sandbox (sandbox-exec / Seatbelt)\n *\n * Uses macOS sandbox-exec with Seatbelt profiles for process isolation.\n */\nimport { spawn, execSync } from 'child_process';\nimport { writeFileSync, unlinkSync } from 'fs';\nimport { tmpdir } from 'os';\nimport { join } from 'path';\nimport { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\n\nlet sandboxExecAvailable: boolean | undefined;\n\nexport class MacOSSandbox implements Sandbox {\n  protected readonly logger = getLoggerFor(this);\n\n  public isAvailable(): boolean {\n    if (sandboxExecAvailable === undefined) {\n      try {\n        // Check if we're on macOS and sandbox-exec exists\n        if (process.platform !== 'darwin') {\n          sandboxExecAvailable = false;\n        } else {\n          execSync('which sandbox-exec', { stdio: 'ignore' });\n          sandboxExecAvailable = true;\n        }\n      } catch {\n        sandboxExecAvailable = false;\n      }\n    }\n    return sandboxExecAvailable;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const profilePath = this.createProfile(config);\n\n    this.logger.info(`Launching macOS sandbox: ${config.command}`);\n\n    const childProcess = spawn('sandbox-exec', ['-f', profilePath, config.command, ...config.args], {\n      cwd: config.workdir,\n      env: {\n        ...process.env,\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    // Clean up profile after process exits\n    childProcess.on('exit', () => {\n      try {\n        unlinkSync(profilePath);\n      } catch {\n        // Ignore cleanup errors\n      }\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: true,\n      technology: 'sandbox-exec',\n    };\n  }\n\n  /**\n   * Create a Seatbelt profile for the sandbox.\n   *\n   * Strategy: Allow most operations by default, then deny writes outside workdir.\n   * This is more robust than deny-by-default which breaks many macOS subsystems.\n   *\n   * Profile:\n   * - Allow default (reading, processes, etc.)\n   * - Deny writes to root filesystem\n   * - Allow writes only to: workdir, temp dirs, var/folders\n   * - Optionally deny network\n   */\n  private createProfile(config: SandboxConfig): string {\n    const profileId = randomUUID().replace(/-/g, '').slice(0, 8);\n    const profilePath = join(tmpdir(), `xpod-sandbox-${profileId}.sb`);\n\n    const rules: string[] = [\n      '(version 1)',\n      '',\n      '; Allow most operations by default (macOS needs many subsystems)',\n      '(allow default)',\n      '',\n      '; Deny writes to the entire filesystem by default',\n      '(deny file-write* (subpath \"/\"))',\n      '',\n      '; Allow writes to workdir',\n      `(allow file-write* (subpath \"${config.workdir}\"))`,\n      '',\n      '; Allow writes to temp directories',\n      '(allow file-write* (subpath \"/private/tmp\"))',\n      '(allow file-write* (subpath \"/tmp\"))',\n      `(allow file-write* (subpath \"${tmpdir()}\"))`,\n      '(allow file-write* (subpath \"/var/folders\"))',\n      '(allow file-write* (subpath \"/private/var/folders\"))',\n    ];\n\n    // Network isolation\n    if (config.isolateNetwork) {\n      rules.push('');\n      rules.push('; Deny network access');\n      rules.push('(deny network*)');\n    }\n\n    // Additional read-only paths (already readable by default)\n    if (config.readonlyPaths) {\n      rules.push('');\n      rules.push('; Additional read-only paths (already allowed by default)');\n      for (const p of config.readonlyPaths) {\n        rules.push(`; readonly: ${p}`);\n      }\n    }\n\n    const profile = rules.join('\\n');\n    writeFileSync(profilePath, profile);\n\n    this.logger.debug(`Created sandbox profile: ${profilePath}`);\n    return profilePath;\n  }\n}\n"]}

package/dist/terminal/sandbox/index.d.ts

@@ -0,0 +1,29 @@
+import type { Sandbox, SandboxConfig, SandboxResult } from './types';
+export * from './types';
+export { BubblewrapSandbox } from './BubblewrapSandbox';
+export { MacOSSandbox } from './MacOSSandbox';
+/**
+ * Sandbox Factory
+ */
+export declare class SandboxFactory {
+    protected static readonly logger: import("global-logger-factory").Logger<unknown>;
+    private static bubblewrap;
+    private static macos;
+    private static noSandbox;
+    /**
+     * Get the best available sandbox for the current platform.
+     */
+    static getSandbox(): Sandbox;
+    /**
+     * Launch a sandboxed process.
+     */
+    static launch(config: SandboxConfig): SandboxResult;
+    /**
+     * Check if sandbox is available.
+     */
+    static isAvailable(): boolean;
+    /**
+     * Get the sandbox technology name.
+     */
+    static getTechnology(): 'bubblewrap' | 'sandbox-exec' | 'none';
+}