@voratiq/sandbox-runtime 0.0.29-voratiq0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (85) hide show
  1. package/CHANGELOG.md +10 -0
  2. package/LICENSE +201 -0
  3. package/NOTICE +12 -0
  4. package/README.md +17 -0
  5. package/dist/cli.d.ts +3 -0
  6. package/dist/cli.d.ts.map +1 -0
  7. package/dist/cli.js +158 -0
  8. package/dist/cli.js.map +1 -0
  9. package/dist/index.d.ts +12 -0
  10. package/dist/index.d.ts.map +1 -0
  11. package/dist/index.js +9 -0
  12. package/dist/index.js.map +1 -0
  13. package/dist/sandbox/generate-seccomp-filter.d.ts +65 -0
  14. package/dist/sandbox/generate-seccomp-filter.d.ts.map +1 -0
  15. package/dist/sandbox/generate-seccomp-filter.js +185 -0
  16. package/dist/sandbox/generate-seccomp-filter.js.map +1 -0
  17. package/dist/sandbox/http-proxy.d.ts +14 -0
  18. package/dist/sandbox/http-proxy.d.ts.map +1 -0
  19. package/dist/sandbox/http-proxy.js +238 -0
  20. package/dist/sandbox/http-proxy.js.map +1 -0
  21. package/dist/sandbox/linux-sandbox-utils.d.ts +121 -0
  22. package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -0
  23. package/dist/sandbox/linux-sandbox-utils.js +723 -0
  24. package/dist/sandbox/linux-sandbox-utils.js.map +1 -0
  25. package/dist/sandbox/macos-sandbox-utils.d.ts +57 -0
  26. package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -0
  27. package/dist/sandbox/macos-sandbox-utils.js +611 -0
  28. package/dist/sandbox/macos-sandbox-utils.js.map +1 -0
  29. package/dist/sandbox/observability.d.ts +56 -0
  30. package/dist/sandbox/observability.d.ts.map +1 -0
  31. package/dist/sandbox/observability.js +140 -0
  32. package/dist/sandbox/observability.js.map +1 -0
  33. package/dist/sandbox/sandbox-config.d.ts +277 -0
  34. package/dist/sandbox/sandbox-config.d.ts.map +1 -0
  35. package/dist/sandbox/sandbox-config.js +166 -0
  36. package/dist/sandbox/sandbox-config.js.map +1 -0
  37. package/dist/sandbox/sandbox-manager.d.ts +50 -0
  38. package/dist/sandbox/sandbox-manager.d.ts.map +1 -0
  39. package/dist/sandbox/sandbox-manager.js +816 -0
  40. package/dist/sandbox/sandbox-manager.js.map +1 -0
  41. package/dist/sandbox/sandbox-schemas.d.ts +53 -0
  42. package/dist/sandbox/sandbox-schemas.d.ts.map +1 -0
  43. package/dist/sandbox/sandbox-schemas.js +3 -0
  44. package/dist/sandbox/sandbox-schemas.js.map +1 -0
  45. package/dist/sandbox/sandbox-utils.d.ts +83 -0
  46. package/dist/sandbox/sandbox-utils.d.ts.map +1 -0
  47. package/dist/sandbox/sandbox-utils.js +343 -0
  48. package/dist/sandbox/sandbox-utils.js.map +1 -0
  49. package/dist/sandbox/sandbox-violation-store.d.ts +19 -0
  50. package/dist/sandbox/sandbox-violation-store.d.ts.map +1 -0
  51. package/dist/sandbox/sandbox-violation-store.js +54 -0
  52. package/dist/sandbox/sandbox-violation-store.js.map +1 -0
  53. package/dist/sandbox/socks-proxy.d.ts +14 -0
  54. package/dist/sandbox/socks-proxy.d.ts.map +1 -0
  55. package/dist/sandbox/socks-proxy.js +109 -0
  56. package/dist/sandbox/socks-proxy.js.map +1 -0
  57. package/dist/utils/config-loader.d.ts +11 -0
  58. package/dist/utils/config-loader.d.ts.map +1 -0
  59. package/dist/utils/config-loader.js +60 -0
  60. package/dist/utils/config-loader.js.map +1 -0
  61. package/dist/utils/debug.d.ts +7 -0
  62. package/dist/utils/debug.d.ts.map +1 -0
  63. package/dist/utils/debug.js +25 -0
  64. package/dist/utils/debug.js.map +1 -0
  65. package/dist/utils/platform.d.ts +15 -0
  66. package/dist/utils/platform.d.ts.map +1 -0
  67. package/dist/utils/platform.js +49 -0
  68. package/dist/utils/platform.js.map +1 -0
  69. package/dist/utils/ripgrep.d.ts +20 -0
  70. package/dist/utils/ripgrep.d.ts.map +1 -0
  71. package/dist/utils/ripgrep.js +51 -0
  72. package/dist/utils/ripgrep.js.map +1 -0
  73. package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
  74. package/dist/vendor/seccomp/arm64/unix-block.bpf +0 -0
  75. package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
  76. package/dist/vendor/seccomp/x64/unix-block.bpf +0 -0
  77. package/dist/vendor/seccomp-src/apply-seccomp.c +98 -0
  78. package/dist/vendor/seccomp-src/seccomp-unix-block.c +97 -0
  79. package/package.json +90 -0
  80. package/vendor/seccomp/arm64/apply-seccomp +0 -0
  81. package/vendor/seccomp/arm64/unix-block.bpf +0 -0
  82. package/vendor/seccomp/x64/apply-seccomp +0 -0
  83. package/vendor/seccomp/x64/unix-block.bpf +0 -0
  84. package/vendor/seccomp-src/apply-seccomp.c +98 -0
  85. package/vendor/seccomp-src/seccomp-unix-block.c +97 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAE7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,oBAAoB,CAAA;AAQ3B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,+CAA+C;IAC/C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;QACtD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,wCAAwC;IACxC,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAKvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;KAClB,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;KACvD,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,+DAA+D;IAC/D,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;QAC9B,IAAI,YAAY,GAAG,wDAAwD,CAAA;QAE3E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,YAAY,IAAI,yDAAyD,CAAA;QAC3E,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,YAAY,IAAI,0BAA0B,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,YAAY,IAAI,cAAc,QAAQ,qBAAqB,CAAA;QAC7D,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IAC/B,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAAC,SAAS,CAAC,EAAE;YAC3D,qBAAqB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;YAE7C,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,oBAAoB,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3B,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,yBAAyB;IACzB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oCAAoC;IACpC,gCAAgC;IAChC,qCAAqC;IACrC,6BAA6B;IAC7B,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,CAAA;IAElD,qEAAqE;IACrE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,SAAS,EAAE,OAAO,KAAK,SAAS,CAAA;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,sCAAsC;QACtC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,mBAAmB,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,IAAI,KAAK,CAAA;QACzE,MAAM,aAAa,GAAG,MAAM,EAAE,OAAO,CAAA;QACrC,OAAO,+BAA+B,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAA;IAC5E,CAAC;IAED,mDAAmD;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACzB,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ;SACzC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,OAAO;QACL,QAAQ,EAAE,SAAS;KACpB,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,MAAM,cAAc,GAClB,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAA;IAC7E,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EACb,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE;KAC5E,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EACN,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE;KAC1E,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,cAAc,EAAE,iBAAiB,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;AACnC,CAAC;AAUD,KAAK,UAAU,KAAK,CAClB,OAAe,EACf,UAA+B,EAAE;IAEjC,MAAM,EACJ,aAAa,EACb,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,GAAG,YAAY,EAChB,GAAG,OAAO,CAAA;IAEX,0EAA0E;IAC1E,MAAM,eAAe,GAAG,WAAW,IAAI,YAAY,CAAC,MAAM,CAAA;IAE1D,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAC5C,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,CAChB,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAA;IAC1C,IAAI,gBAAgB,IAAI,2BAA2B,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB;QACrC,CAAC,CAAC,uBAAuB,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;IAEZ,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,SAAS;YAAE,OAAM;QACrB,SAAS,GAAG,IAAI,CAAA;QAChB,cAAc,EAAE,CAAA;IAClB,CAAC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE;YACxC,GAAG,YAAY;YACf,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,IAAI;SAClC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAA;QACT,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IAOxC,uDAAuD;IACvD,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAM;IAEpC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAM;IAE/B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAE3C,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACzD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IAEtC,MAAM,cAAc,GAAG,OAAO,CAAA;IAC9B,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAC5D,2EAA2E;QAC3E,gDAAgD;QAChD,OAAO,CACL,cAAc,KAAK,SAAS;YAC5B,cAAc,CAAC,UAAU,CACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CACtD,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;IAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ;QAC7B,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAgDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,KAAK;IACL,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}
@@ -0,0 +1,53 @@
1
+ /**
2
+ * Read restriction config using a "deny-only" pattern.
3
+ *
4
+ * Semantics:
5
+ * - `undefined` = no restrictions (allow all reads)
6
+ * - `{denyOnly: []}` = no restrictions (empty deny list = allow all reads)
7
+ * - `{denyOnly: [...paths]}` = deny reads from these paths, allow all others
8
+ *
9
+ * This is maximally permissive by default - only explicitly denied paths are blocked.
10
+ */
11
+ export interface FsReadRestrictionConfig {
12
+ denyOnly: string[];
13
+ }
14
+ /**
15
+ * Write restriction config using an "allow-only" pattern.
16
+ *
17
+ * Semantics:
18
+ * - `undefined` = no restrictions (allow all writes)
19
+ * - `{allowOnly: [], denyWithinAllow: []}` = maximally restrictive (deny ALL writes)
20
+ * - `{allowOnly: [...paths], denyWithinAllow: [...]}` = allow writes only to these paths,
21
+ * with exceptions for denyWithinAllow
22
+ *
23
+ * This is maximally restrictive by default - only explicitly allowed paths are writable.
24
+ * Note: Empty `allowOnly` means NO paths are writable (unlike read's empty denyOnly).
25
+ */
26
+ export interface FsWriteRestrictionConfig {
27
+ allowOnly: string[];
28
+ denyWithinAllow: string[];
29
+ }
30
+ /**
31
+ * Network restriction config (internal structure built from permission rules).
32
+ *
33
+ * This uses an "allow-only" pattern (like write restrictions):
34
+ * - `allowedHosts` = hosts that are explicitly allowed
35
+ * - `deniedHosts` = hosts that are explicitly denied (checked first, before allowedHosts)
36
+ *
37
+ * Semantics:
38
+ * - `undefined` = maximally restrictive (deny all network)
39
+ * - `{allowedHosts: [], deniedHosts: []}` = maximally restrictive (nothing allowed)
40
+ * - `{allowedHosts: [...], deniedHosts: [...]}` = apply allow/deny rules
41
+ *
42
+ * Note: Empty `allowedHosts` means NO hosts are allowed (unlike read's empty denyOnly).
43
+ */
44
+ export interface NetworkRestrictionConfig {
45
+ allowedHosts?: string[];
46
+ deniedHosts?: string[];
47
+ }
48
+ export type NetworkHostPattern = {
49
+ host: string;
50
+ port: number | undefined;
51
+ };
52
+ export type SandboxAskCallback = (params: NetworkHostPattern) => Promise<boolean>;
53
+ //# sourceMappingURL=sandbox-schemas.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-schemas.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAAC,CAAA"}
@@ -0,0 +1,3 @@
1
+ // Filesystem restriction configs (internal structures built from permission rules)
2
+ export {};
3
+ //# sourceMappingURL=sandbox-schemas.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-schemas.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAAA,mFAAmF"}
@@ -0,0 +1,83 @@
1
+ /**
2
+ * Dangerous files that should be protected from writes.
3
+ * These files can be used for code execution or data exfiltration.
4
+ */
5
+ export declare const DANGEROUS_FILES: readonly [".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc", ".zprofile", ".profile", ".ripgreprc", ".mcp.json"];
6
+ /**
7
+ * Dangerous directories that should be protected from writes.
8
+ * These directories contain sensitive configuration or executable files.
9
+ */
10
+ export declare const DANGEROUS_DIRECTORIES: readonly [".git", ".vscode", ".idea"];
11
+ /**
12
+ * Get the list of dangerous directories to deny writes to.
13
+ * Excludes .git since we need it writable for git operations -
14
+ * instead we block specific paths within .git (hooks and config).
15
+ */
16
+ export declare function getDangerousDirectories(): string[];
17
+ /**
18
+ * Normalizes a path for case-insensitive comparison.
19
+ * This prevents bypassing security checks using mixed-case paths on case-insensitive
20
+ * filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
21
+ *
22
+ * We always normalize to lowercase regardless of platform for consistent security.
23
+ * @param path The path to normalize
24
+ * @returns The lowercase path for safe comparison
25
+ */
26
+ export declare function normalizeCaseForComparison(pathStr: string): string;
27
+ /**
28
+ * Check if a path pattern contains glob characters
29
+ */
30
+ export declare function containsGlobChars(pathPattern: string): boolean;
31
+ /**
32
+ * Remove trailing /** glob suffix from a path pattern
33
+ * Used to normalize path patterns since /** just means "directory and everything under it"
34
+ */
35
+ export declare function removeTrailingGlobSuffix(pathPattern: string): string;
36
+ /**
37
+ * Check if a symlink resolution crosses expected path boundaries.
38
+ *
39
+ * When resolving symlinks for sandbox path normalization, we need to ensure
40
+ * the resolved path doesn't unexpectedly broaden the scope. This function
41
+ * returns true if the resolved path is an ancestor of the original path
42
+ * or resolves to a system root, which would indicate the symlink points
43
+ * outside expected boundaries.
44
+ *
45
+ * @param originalPath - The original path before symlink resolution
46
+ * @param resolvedPath - The path after fs.realpathSync() resolution
47
+ * @returns true if the resolved path is outside expected boundaries
48
+ */
49
+ export declare function isSymlinkOutsideBoundary(originalPath: string, resolvedPath: string): boolean;
50
+ /**
51
+ * Normalize a path for use in sandbox configurations
52
+ * Handles:
53
+ * - Tilde (~) expansion for home directory
54
+ * - Relative paths (./foo, ../foo, etc.) converted to absolute
55
+ * - Absolute paths remain unchanged
56
+ * - Symlinks are resolved to their real paths for non-glob patterns
57
+ * - Glob patterns preserve wildcards after path normalization
58
+ *
59
+ * Returns the absolute path with symlinks resolved (or normalized glob pattern)
60
+ */
61
+ export declare function normalizePathForSandbox(pathPattern: string): string;
62
+ /**
63
+ * Get recommended system paths that should be writable for commands to work properly
64
+ *
65
+ * WARNING: These default paths are intentionally broad for compatibility but may
66
+ * allow access to files from other processes. In highly security-sensitive
67
+ * environments, you should configure more restrictive write paths.
68
+ */
69
+ export declare function getDefaultWritePaths(): string[];
70
+ /**
71
+ * Generate proxy environment variables for sandboxed processes
72
+ */
73
+ export declare function generateProxyEnvVars(httpProxyPort?: number, socksProxyPort?: number): string[];
74
+ /**
75
+ * Encode a command for sandbox monitoring
76
+ * Truncates to 100 chars and base64 encodes to avoid parsing issues
77
+ */
78
+ export declare function encodeSandboxedCommand(command: string): string;
79
+ /**
80
+ * Decode a base64-encoded command from sandbox monitoring
81
+ */
82
+ export declare function decodeSandboxedCommand(encodedCommand: string): string;
83
+ //# sourceMappingURL=sandbox-utils.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,eAAe,kIAUlB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uCAAwC,CAAA;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAMlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAuGT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA6DnE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAgB/C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,CAAC,EAAE,MAAM,EACtB,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,EAAE,CAgGV;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE"}
@@ -0,0 +1,343 @@
1
+ import { homedir } from 'os';
2
+ import * as path from 'path';
3
+ import * as fs from 'fs';
4
+ import { getPlatform } from '../utils/platform.js';
5
+ /**
6
+ * Dangerous files that should be protected from writes.
7
+ * These files can be used for code execution or data exfiltration.
8
+ */
9
+ export const DANGEROUS_FILES = [
10
+ '.gitconfig',
11
+ '.gitmodules',
12
+ '.bashrc',
13
+ '.bash_profile',
14
+ '.zshrc',
15
+ '.zprofile',
16
+ '.profile',
17
+ '.ripgreprc',
18
+ '.mcp.json',
19
+ ];
20
+ /**
21
+ * Dangerous directories that should be protected from writes.
22
+ * These directories contain sensitive configuration or executable files.
23
+ */
24
+ export const DANGEROUS_DIRECTORIES = ['.git', '.vscode', '.idea'];
25
+ /**
26
+ * Get the list of dangerous directories to deny writes to.
27
+ * Excludes .git since we need it writable for git operations -
28
+ * instead we block specific paths within .git (hooks and config).
29
+ */
30
+ export function getDangerousDirectories() {
31
+ return [
32
+ ...DANGEROUS_DIRECTORIES.filter(d => d !== '.git'),
33
+ '.claude/commands',
34
+ '.claude/agents',
35
+ ];
36
+ }
37
+ /**
38
+ * Normalizes a path for case-insensitive comparison.
39
+ * This prevents bypassing security checks using mixed-case paths on case-insensitive
40
+ * filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
41
+ *
42
+ * We always normalize to lowercase regardless of platform for consistent security.
43
+ * @param path The path to normalize
44
+ * @returns The lowercase path for safe comparison
45
+ */
46
+ export function normalizeCaseForComparison(pathStr) {
47
+ return pathStr.toLowerCase();
48
+ }
49
+ /**
50
+ * Check if a path pattern contains glob characters
51
+ */
52
+ export function containsGlobChars(pathPattern) {
53
+ return (pathPattern.includes('*') ||
54
+ pathPattern.includes('?') ||
55
+ pathPattern.includes('[') ||
56
+ pathPattern.includes(']'));
57
+ }
58
+ /**
59
+ * Remove trailing /** glob suffix from a path pattern
60
+ * Used to normalize path patterns since /** just means "directory and everything under it"
61
+ */
62
+ export function removeTrailingGlobSuffix(pathPattern) {
63
+ return pathPattern.replace(/\/\*\*$/, '');
64
+ }
65
+ /**
66
+ * Check if a symlink resolution crosses expected path boundaries.
67
+ *
68
+ * When resolving symlinks for sandbox path normalization, we need to ensure
69
+ * the resolved path doesn't unexpectedly broaden the scope. This function
70
+ * returns true if the resolved path is an ancestor of the original path
71
+ * or resolves to a system root, which would indicate the symlink points
72
+ * outside expected boundaries.
73
+ *
74
+ * @param originalPath - The original path before symlink resolution
75
+ * @param resolvedPath - The path after fs.realpathSync() resolution
76
+ * @returns true if the resolved path is outside expected boundaries
77
+ */
78
+ export function isSymlinkOutsideBoundary(originalPath, resolvedPath) {
79
+ const normalizedOriginal = path.normalize(originalPath);
80
+ const normalizedResolved = path.normalize(resolvedPath);
81
+ // Same path after normalization - OK
82
+ if (normalizedResolved === normalizedOriginal) {
83
+ return false;
84
+ }
85
+ // Handle macOS /tmp -> /private/tmp canonical resolution
86
+ // This is a legitimate system symlink that should be allowed
87
+ // /tmp/claude -> /private/tmp/claude is OK
88
+ // /var/folders/... -> /private/var/folders/... is OK
89
+ if (normalizedOriginal.startsWith('/tmp/') &&
90
+ normalizedResolved === '/private' + normalizedOriginal) {
91
+ return false;
92
+ }
93
+ if (normalizedOriginal.startsWith('/var/') &&
94
+ normalizedResolved === '/private' + normalizedOriginal) {
95
+ return false;
96
+ }
97
+ // Also handle the reverse: /private/tmp/... resolving to itself
98
+ if (normalizedOriginal.startsWith('/private/tmp/') &&
99
+ normalizedResolved === normalizedOriginal) {
100
+ return false;
101
+ }
102
+ if (normalizedOriginal.startsWith('/private/var/') &&
103
+ normalizedResolved === normalizedOriginal) {
104
+ return false;
105
+ }
106
+ // If resolved path is "/" it's outside expected boundaries
107
+ if (normalizedResolved === '/') {
108
+ return true;
109
+ }
110
+ // If resolved path is very short (single component like /tmp, /usr, /var),
111
+ // it's likely outside expected boundaries
112
+ const resolvedParts = normalizedResolved.split('/').filter(Boolean);
113
+ if (resolvedParts.length <= 1) {
114
+ return true;
115
+ }
116
+ // If original path starts with resolved path, the resolved path is an ancestor
117
+ // e.g., /tmp/claude -> /tmp means the symlink points to a broader scope
118
+ if (normalizedOriginal.startsWith(normalizedResolved + '/')) {
119
+ return true;
120
+ }
121
+ // Also check the canonical form of the original path for macOS
122
+ // e.g., /tmp/claude should also be checked as /private/tmp/claude
123
+ let canonicalOriginal = normalizedOriginal;
124
+ if (normalizedOriginal.startsWith('/tmp/')) {
125
+ canonicalOriginal = '/private' + normalizedOriginal;
126
+ }
127
+ else if (normalizedOriginal.startsWith('/var/')) {
128
+ canonicalOriginal = '/private' + normalizedOriginal;
129
+ }
130
+ if (canonicalOriginal !== normalizedOriginal &&
131
+ canonicalOriginal.startsWith(normalizedResolved + '/')) {
132
+ return true;
133
+ }
134
+ // STRICT CHECK: Only allow resolutions that stay within the expected path tree
135
+ // The resolved path must either:
136
+ // 1. Start with the original path (deeper/same) - already covered by returning false below
137
+ // 2. Start with the canonical original (deeper/same under canonical form)
138
+ // 3. BE the canonical form of the original (e.g., /tmp/x -> /private/tmp/x)
139
+ // Any other resolution (e.g., /tmp/claude -> /Users/dworken) is outside expected bounds
140
+ const resolvedStartsWithOriginal = normalizedResolved.startsWith(normalizedOriginal + '/');
141
+ const resolvedStartsWithCanonical = canonicalOriginal !== normalizedOriginal &&
142
+ normalizedResolved.startsWith(canonicalOriginal + '/');
143
+ const resolvedIsCanonical = canonicalOriginal !== normalizedOriginal &&
144
+ normalizedResolved === canonicalOriginal;
145
+ const resolvedIsSame = normalizedResolved === normalizedOriginal;
146
+ // If resolved path is not within expected tree, it's outside boundary
147
+ if (!resolvedIsSame &&
148
+ !resolvedIsCanonical &&
149
+ !resolvedStartsWithOriginal &&
150
+ !resolvedStartsWithCanonical) {
151
+ return true;
152
+ }
153
+ // Allow resolution to same directory level or deeper within expected tree
154
+ return false;
155
+ }
156
+ /**
157
+ * Normalize a path for use in sandbox configurations
158
+ * Handles:
159
+ * - Tilde (~) expansion for home directory
160
+ * - Relative paths (./foo, ../foo, etc.) converted to absolute
161
+ * - Absolute paths remain unchanged
162
+ * - Symlinks are resolved to their real paths for non-glob patterns
163
+ * - Glob patterns preserve wildcards after path normalization
164
+ *
165
+ * Returns the absolute path with symlinks resolved (or normalized glob pattern)
166
+ */
167
+ export function normalizePathForSandbox(pathPattern) {
168
+ const cwd = process.cwd();
169
+ let normalizedPath = pathPattern;
170
+ // Expand ~ to home directory
171
+ if (pathPattern === '~') {
172
+ normalizedPath = homedir();
173
+ }
174
+ else if (pathPattern.startsWith('~/')) {
175
+ normalizedPath = homedir() + pathPattern.slice(1);
176
+ }
177
+ else if (pathPattern.startsWith('./') || pathPattern.startsWith('../')) {
178
+ // Convert relative to absolute based on current working directory
179
+ normalizedPath = path.resolve(cwd, pathPattern);
180
+ }
181
+ else if (!path.isAbsolute(pathPattern)) {
182
+ // Handle other relative paths (e.g., ".", "..", "foo/bar")
183
+ normalizedPath = path.resolve(cwd, pathPattern);
184
+ }
185
+ // For glob patterns, resolve symlinks for the directory portion only
186
+ if (containsGlobChars(normalizedPath)) {
187
+ // Extract the static directory prefix before glob characters
188
+ const staticPrefix = normalizedPath.split(/[*?[\]]/)[0];
189
+ if (staticPrefix && staticPrefix !== '/') {
190
+ // Get the directory containing the glob pattern
191
+ // If staticPrefix ends with /, remove it to get the directory
192
+ const baseDir = staticPrefix.endsWith('/')
193
+ ? staticPrefix.slice(0, -1)
194
+ : path.dirname(staticPrefix);
195
+ // Try to resolve symlinks for the base directory
196
+ try {
197
+ const resolvedBaseDir = fs.realpathSync(baseDir);
198
+ // Validate that resolution stays within expected boundaries
199
+ if (!isSymlinkOutsideBoundary(baseDir, resolvedBaseDir)) {
200
+ // Reconstruct the pattern with the resolved directory
201
+ const patternSuffix = normalizedPath.slice(baseDir.length);
202
+ return resolvedBaseDir + patternSuffix;
203
+ }
204
+ // If resolution would broaden scope, keep original pattern
205
+ }
206
+ catch {
207
+ // If directory doesn't exist or can't be resolved, keep the original pattern
208
+ }
209
+ }
210
+ return normalizedPath;
211
+ }
212
+ // Resolve symlinks to real paths to avoid bwrap issues
213
+ // Validate that the resolution stays within expected boundaries
214
+ try {
215
+ const resolvedPath = fs.realpathSync(normalizedPath);
216
+ // Only use resolved path if it doesn't cross boundary (e.g., symlink to parent dir)
217
+ if (isSymlinkOutsideBoundary(normalizedPath, resolvedPath)) {
218
+ // Symlink points outside expected boundaries - keep original path
219
+ }
220
+ else {
221
+ normalizedPath = resolvedPath;
222
+ }
223
+ }
224
+ catch {
225
+ // If path doesn't exist or can't be resolved, keep the normalized path
226
+ }
227
+ return normalizedPath;
228
+ }
229
+ /**
230
+ * Get recommended system paths that should be writable for commands to work properly
231
+ *
232
+ * WARNING: These default paths are intentionally broad for compatibility but may
233
+ * allow access to files from other processes. In highly security-sensitive
234
+ * environments, you should configure more restrictive write paths.
235
+ */
236
+ export function getDefaultWritePaths() {
237
+ const homeDir = homedir();
238
+ const recommendedPaths = [
239
+ '/dev/stdout',
240
+ '/dev/stderr',
241
+ '/dev/null',
242
+ '/dev/tty',
243
+ '/dev/dtracehelper',
244
+ '/dev/autofs_nowait',
245
+ '/tmp/claude',
246
+ '/private/tmp/claude',
247
+ path.join(homeDir, '.npm/_logs'),
248
+ path.join(homeDir, '.claude/debug'),
249
+ ];
250
+ return recommendedPaths;
251
+ }
252
+ /**
253
+ * Generate proxy environment variables for sandboxed processes
254
+ */
255
+ export function generateProxyEnvVars(httpProxyPort, socksProxyPort) {
256
+ // Respect CLAUDE_TMPDIR if set, otherwise default to /tmp/claude
257
+ const tmpdir = process.env.CLAUDE_TMPDIR || '/tmp/claude';
258
+ const envVars = [`SANDBOX_RUNTIME=1`, `TMPDIR=${tmpdir}`];
259
+ // If no proxy ports provided, return minimal env vars
260
+ if (!httpProxyPort && !socksProxyPort) {
261
+ return envVars;
262
+ }
263
+ // Always set NO_PROXY to exclude localhost and private networks from proxying
264
+ const noProxyAddresses = [
265
+ 'localhost',
266
+ '127.0.0.1',
267
+ '::1',
268
+ '*.local',
269
+ '.local',
270
+ '169.254.0.0/16', // Link-local
271
+ '10.0.0.0/8', // Private network
272
+ '172.16.0.0/12', // Private network
273
+ '192.168.0.0/16', // Private network
274
+ ].join(',');
275
+ envVars.push(`NO_PROXY=${noProxyAddresses}`);
276
+ envVars.push(`no_proxy=${noProxyAddresses}`);
277
+ if (httpProxyPort) {
278
+ envVars.push(`HTTP_PROXY=http://localhost:${httpProxyPort}`);
279
+ envVars.push(`HTTPS_PROXY=http://localhost:${httpProxyPort}`);
280
+ // Lowercase versions for compatibility with some tools
281
+ envVars.push(`http_proxy=http://localhost:${httpProxyPort}`);
282
+ envVars.push(`https_proxy=http://localhost:${httpProxyPort}`);
283
+ }
284
+ if (socksProxyPort) {
285
+ // Use socks5h:// for proper DNS resolution through proxy
286
+ envVars.push(`ALL_PROXY=socks5h://localhost:${socksProxyPort}`);
287
+ envVars.push(`all_proxy=socks5h://localhost:${socksProxyPort}`);
288
+ // Configure Git to use SSH through SOCKS proxy (platform-aware)
289
+ if (getPlatform() === 'macos') {
290
+ // macOS has nc available
291
+ // Note: No outer quotes - bwrap --setenv sets the value directly without shell interpretation
292
+ envVars.push(`GIT_SSH_COMMAND=ssh -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`);
293
+ }
294
+ // FTP proxy support (use socks5h for DNS resolution through proxy)
295
+ envVars.push(`FTP_PROXY=socks5h://localhost:${socksProxyPort}`);
296
+ envVars.push(`ftp_proxy=socks5h://localhost:${socksProxyPort}`);
297
+ // rsync proxy support
298
+ envVars.push(`RSYNC_PROXY=localhost:${socksProxyPort}`);
299
+ // Database tools NOTE: Most database clients don't have built-in proxy support
300
+ // You typically need to use SSH tunneling or a SOCKS wrapper like tsocks/proxychains
301
+ // Docker CLI uses HTTP for the API
302
+ // This makes Docker use the HTTP proxy for registry operations
303
+ envVars.push(`DOCKER_HTTP_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
304
+ envVars.push(`DOCKER_HTTPS_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
305
+ // Kubernetes kubectl - uses standard HTTPS_PROXY
306
+ // kubectl respects HTTPS_PROXY which we already set above
307
+ // AWS CLI - uses standard HTTPS_PROXY (v2 supports it well)
308
+ // AWS CLI v2 respects HTTPS_PROXY which we already set above
309
+ // Google Cloud SDK - has specific proxy settings
310
+ // Use HTTPS proxy to match other HTTP-based tools
311
+ if (httpProxyPort) {
312
+ envVars.push(`CLOUDSDK_PROXY_TYPE=https`);
313
+ envVars.push(`CLOUDSDK_PROXY_ADDRESS=localhost`);
314
+ envVars.push(`CLOUDSDK_PROXY_PORT=${httpProxyPort}`);
315
+ }
316
+ // Azure CLI - uses HTTPS_PROXY
317
+ // Azure CLI respects HTTPS_PROXY which we already set above
318
+ // Terraform - uses standard HTTP/HTTPS proxy vars
319
+ // Terraform respects HTTP_PROXY/HTTPS_PROXY which we already set above
320
+ // gRPC-based tools - use standard proxy vars
321
+ envVars.push(`GRPC_PROXY=socks5h://localhost:${socksProxyPort}`);
322
+ envVars.push(`grpc_proxy=socks5h://localhost:${socksProxyPort}`);
323
+ }
324
+ // WARNING: Do not set HTTP_PROXY/HTTPS_PROXY to SOCKS URLs when only SOCKS proxy is available
325
+ // Most HTTP clients do not support SOCKS URLs in these variables and will fail, and we want
326
+ // to avoid overriding the client otherwise respecting the ALL_PROXY env var which points to SOCKS.
327
+ return envVars;
328
+ }
329
+ /**
330
+ * Encode a command for sandbox monitoring
331
+ * Truncates to 100 chars and base64 encodes to avoid parsing issues
332
+ */
333
+ export function encodeSandboxedCommand(command) {
334
+ const truncatedCommand = command.slice(0, 100);
335
+ return Buffer.from(truncatedCommand).toString('base64');
336
+ }
337
+ /**
338
+ * Decode a base64-encoded command from sandbox monitoring
339
+ */
340
+ export function decodeSandboxedCommand(encodedCommand) {
341
+ return Buffer.from(encodedCommand, 'base64').toString('utf8');
342
+ }
343
+ //# sourceMappingURL=sandbox-utils.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY;IACZ,aAAa;IACb,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,WAAW;CACH,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAU,CAAA;AAE1E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;QAClD,kBAAkB;QAClB,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAA;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,CACL,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC1B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,OAAO,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,YAAoB;IAEpB,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IACvD,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAEvD,qCAAqC;IACrC,IAAI,kBAAkB,KAAK,kBAAkB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yDAAyD;IACzD,6DAA6D;IAC7D,2CAA2C;IAC3C,qDAAqD;IACrD,IACE,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC;QACtC,kBAAkB,KAAK,UAAU,GAAG,kBAAkB,EACtD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IACE,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC;QACtC,kBAAkB,KAAK,UAAU,GAAG,kBAAkB,EACtD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,gEAAgE;IAChE,IACE,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC9C,kBAAkB,KAAK,kBAAkB,EACzC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IACE,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC9C,kBAAkB,KAAK,kBAAkB,EACzC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,kBAAkB,CAAC,UAAU,CAAC,kBAAkB,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,IAAI,iBAAiB,GAAG,kBAAkB,CAAA;IAC1C,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,iBAAiB,GAAG,UAAU,GAAG,kBAAkB,CAAA;IACrD,CAAC;SAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,iBAAiB,GAAG,UAAU,GAAG,kBAAkB,CAAA;IACrD,CAAC;IAED,IACE,iBAAiB,KAAK,kBAAkB;QACxC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,GAAG,GAAG,CAAC,EACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IAC/E,iCAAiC;IACjC,2FAA2F;IAC3F,0EAA0E;IAC1E,4EAA4E;IAC5E,wFAAwF;IAExF,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,UAAU,CAC9D,kBAAkB,GAAG,GAAG,CACzB,CAAA;IACD,MAAM,2BAA2B,GAC/B,iBAAiB,KAAK,kBAAkB;QACxC,kBAAkB,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;IACxD,MAAM,mBAAmB,GACvB,iBAAiB,KAAK,kBAAkB;QACxC,kBAAkB,KAAK,iBAAiB,CAAA;IAC1C,MAAM,cAAc,GAAG,kBAAkB,KAAK,kBAAkB,CAAA;IAEhE,sEAAsE;IACtE,IACE,CAAC,cAAc;QACf,CAAC,mBAAmB;QACpB,CAAC,0BAA0B;QAC3B,CAAC,2BAA2B,EAC5B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,cAAc,GAAG,WAAW,CAAA;IAEhC,6BAA6B;IAC7B,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;QACxB,cAAc,GAAG,OAAO,EAAE,CAAA;IAC5B,CAAC;SAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,cAAc,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,kEAAkE;QAClE,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,2DAA2D;QAC3D,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,qEAAqE;IACrE,IAAI,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,6DAA6D;QAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,gDAAgD;YAChD,8DAA8D;YAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAE9B,iDAAiD;YACjD,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;gBAChD,4DAA4D;gBAC5D,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;oBACxD,sDAAsD;oBACtD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;oBAC1D,OAAO,eAAe,GAAG,aAAa,CAAA;gBACxC,CAAC;gBACD,2DAA2D;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;YAC/E,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,uDAAuD;IACvD,gEAAgE;IAChE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QAEpD,oFAAoF;QACpF,IAAI,wBAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3D,kEAAkE;QACpE,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,YAAY,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,gBAAgB,GAAG;QACvB,aAAa;QACb,aAAa;QACb,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC;KACpC,CAAA;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAAsB,EACtB,cAAuB;IAEvB,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa,CAAA;IACzD,MAAM,OAAO,GAAa,CAAC,mBAAmB,EAAE,UAAU,MAAM,EAAE,CAAC,CAAA;IAEnE,sDAAsD;IACtD,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG;QACvB,WAAW;QACX,WAAW;QACX,KAAK;QACL,SAAS;QACT,QAAQ;QACR,gBAAgB,EAAE,aAAa;QAC/B,YAAY,EAAE,kBAAkB;QAChC,eAAe,EAAE,kBAAkB;QACnC,gBAAgB,EAAE,kBAAkB;KACrC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,OAAO,CAAC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAA;IAC5C,OAAO,CAAC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAA;IAE5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAA;QAC7D,uDAAuD;QACvD,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,yDAAyD;QACzD,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAE/D,gEAAgE;QAChE,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,yBAAyB;YACzB,8FAA8F;YAC9F,OAAO,CAAC,IAAI,CACV,6DAA6D,cAAc,SAAS,CACrF,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAE/D,sBAAsB;QACtB,OAAO,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAA;QAEvD,+EAA+E;QAC/E,qFAAqF;QAErF,mCAAmC;QACnC,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,sCAAsC,aAAa,IAAI,cAAc,EAAE,CACxE,CAAA;QACD,OAAO,CAAC,IAAI,CACV,uCAAuC,aAAa,IAAI,cAAc,EAAE,CACzE,CAAA;QAED,iDAAiD;QACjD,0DAA0D;QAE1D,4DAA4D;QAC5D,6DAA6D;QAE7D,iDAAiD;QACjD,kDAAkD;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACzC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,CAAC,uBAAuB,aAAa,EAAE,CAAC,CAAA;QACtD,CAAC;QAED,+BAA+B;QAC/B,4DAA4D;QAE5D,kDAAkD;QAClD,uEAAuE;QAEvE,6CAA6C;QAC7C,OAAO,CAAC,IAAI,CAAC,kCAAkC,cAAc,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,kCAAkC,cAAc,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IAEnG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/D,CAAC"}
@@ -0,0 +1,19 @@
1
+ import { type SandboxViolationEvent } from './macos-sandbox-utils.js';
2
+ /**
3
+ * In-memory tail for sandbox violations
4
+ */
5
+ export declare class SandboxViolationStore {
6
+ private violations;
7
+ private totalCount;
8
+ private readonly maxSize;
9
+ private listeners;
10
+ addViolation(violation: SandboxViolationEvent): void;
11
+ getViolations(limit?: number): SandboxViolationEvent[];
12
+ getCount(): number;
13
+ getTotalCount(): number;
14
+ getViolationsForCommand(command: string): SandboxViolationEvent[];
15
+ clear(): void;
16
+ subscribe(listener: (violations: SandboxViolationEvent[]) => void): () => void;
17
+ private notifyListeners;
18
+ }
19
+ //# sourceMappingURL=sandbox-violation-store.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-violation-store.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-violation-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAGrE;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAM;IAC9B,OAAO,CAAC,SAAS,CACN;IAEX,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAG,IAAI;IASpD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAOtD,QAAQ,IAAI,MAAM;IAIlB,aAAa,IAAI,MAAM;IAIvB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAKjE,KAAK,IAAI,IAAI;IAMb,SAAS,CACP,QAAQ,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,IAAI,GACtD,MAAM,IAAI;IAQb,OAAO,CAAC,eAAe;CAKxB"}
@@ -0,0 +1,54 @@
1
+ import { encodeSandboxedCommand } from './sandbox-utils.js';
2
+ /**
3
+ * In-memory tail for sandbox violations
4
+ */
5
+ export class SandboxViolationStore {
6
+ constructor() {
7
+ this.violations = [];
8
+ this.totalCount = 0;
9
+ this.maxSize = 100;
10
+ this.listeners = new Set();
11
+ }
12
+ addViolation(violation) {
13
+ this.violations.push(violation);
14
+ this.totalCount++;
15
+ if (this.violations.length > this.maxSize) {
16
+ this.violations = this.violations.slice(-this.maxSize);
17
+ }
18
+ this.notifyListeners();
19
+ }
20
+ getViolations(limit) {
21
+ if (limit === undefined) {
22
+ return [...this.violations];
23
+ }
24
+ return this.violations.slice(-limit);
25
+ }
26
+ getCount() {
27
+ return this.violations.length;
28
+ }
29
+ getTotalCount() {
30
+ return this.totalCount;
31
+ }
32
+ getViolationsForCommand(command) {
33
+ const commandBase64 = encodeSandboxedCommand(command);
34
+ return this.violations.filter(v => v.encodedCommand === commandBase64);
35
+ }
36
+ clear() {
37
+ this.violations = [];
38
+ // Don't reset totalCount when clearing
39
+ this.notifyListeners();
40
+ }
41
+ subscribe(listener) {
42
+ this.listeners.add(listener);
43
+ listener(this.getViolations());
44
+ return () => {
45
+ this.listeners.delete(listener);
46
+ };
47
+ }
48
+ notifyListeners() {
49
+ // Always notify with all violations so listeners can track the full count
50
+ const violations = this.getViolations();
51
+ this.listeners.forEach(listener => listener(violations));
52
+ }
53
+ }
54
+ //# sourceMappingURL=sandbox-violation-store.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sandbox-violation-store.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-violation-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAAlC;QACU,eAAU,GAA4B,EAAE,CAAA;QACxC,eAAU,GAAG,CAAC,CAAA;QACL,YAAO,GAAG,GAAG,CAAA;QACtB,cAAS,GACf,IAAI,GAAG,EAAE,CAAA;IAoDb,CAAC;IAlDC,YAAY,CAAC,SAAgC;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAED,aAAa,CAAC,KAAc;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAA;IAC/B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,uBAAuB,CAAC,OAAe;QACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,aAAa,CAAC,CAAA;IACxE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,EAAE,CAAA;QACpB,uCAAuC;QACvC,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAED,SAAS,CACP,QAAuD;QAEvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC,CAAA;IACH,CAAC;IAEO,eAAe;QACrB,0EAA0E;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;QACvC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1D,CAAC;CACF"}