@voratiq/sandbox-runtime 0.0.29-voratiq0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/LICENSE +201 -0
- package/NOTICE +12 -0
- package/README.md +17 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +158 -0
- package/dist/cli.js.map +1 -0
- package/dist/index.d.ts +12 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +9 -0
- package/dist/index.js.map +1 -0
- package/dist/sandbox/generate-seccomp-filter.d.ts +65 -0
- package/dist/sandbox/generate-seccomp-filter.d.ts.map +1 -0
- package/dist/sandbox/generate-seccomp-filter.js +185 -0
- package/dist/sandbox/generate-seccomp-filter.js.map +1 -0
- package/dist/sandbox/http-proxy.d.ts +14 -0
- package/dist/sandbox/http-proxy.d.ts.map +1 -0
- package/dist/sandbox/http-proxy.js +238 -0
- package/dist/sandbox/http-proxy.js.map +1 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts +121 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/linux-sandbox-utils.js +723 -0
- package/dist/sandbox/linux-sandbox-utils.js.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts +57 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.js +611 -0
- package/dist/sandbox/macos-sandbox-utils.js.map +1 -0
- package/dist/sandbox/observability.d.ts +56 -0
- package/dist/sandbox/observability.d.ts.map +1 -0
- package/dist/sandbox/observability.js +140 -0
- package/dist/sandbox/observability.js.map +1 -0
- package/dist/sandbox/sandbox-config.d.ts +277 -0
- package/dist/sandbox/sandbox-config.d.ts.map +1 -0
- package/dist/sandbox/sandbox-config.js +166 -0
- package/dist/sandbox/sandbox-config.js.map +1 -0
- package/dist/sandbox/sandbox-manager.d.ts +50 -0
- package/dist/sandbox/sandbox-manager.d.ts.map +1 -0
- package/dist/sandbox/sandbox-manager.js +816 -0
- package/dist/sandbox/sandbox-manager.js.map +1 -0
- package/dist/sandbox/sandbox-schemas.d.ts +53 -0
- package/dist/sandbox/sandbox-schemas.d.ts.map +1 -0
- package/dist/sandbox/sandbox-schemas.js +3 -0
- package/dist/sandbox/sandbox-schemas.js.map +1 -0
- package/dist/sandbox/sandbox-utils.d.ts +83 -0
- package/dist/sandbox/sandbox-utils.d.ts.map +1 -0
- package/dist/sandbox/sandbox-utils.js +343 -0
- package/dist/sandbox/sandbox-utils.js.map +1 -0
- package/dist/sandbox/sandbox-violation-store.d.ts +19 -0
- package/dist/sandbox/sandbox-violation-store.d.ts.map +1 -0
- package/dist/sandbox/sandbox-violation-store.js +54 -0
- package/dist/sandbox/sandbox-violation-store.js.map +1 -0
- package/dist/sandbox/socks-proxy.d.ts +14 -0
- package/dist/sandbox/socks-proxy.d.ts.map +1 -0
- package/dist/sandbox/socks-proxy.js +109 -0
- package/dist/sandbox/socks-proxy.js.map +1 -0
- package/dist/utils/config-loader.d.ts +11 -0
- package/dist/utils/config-loader.d.ts.map +1 -0
- package/dist/utils/config-loader.js +60 -0
- package/dist/utils/config-loader.js.map +1 -0
- package/dist/utils/debug.d.ts +7 -0
- package/dist/utils/debug.d.ts.map +1 -0
- package/dist/utils/debug.js +25 -0
- package/dist/utils/debug.js.map +1 -0
- package/dist/utils/platform.d.ts +15 -0
- package/dist/utils/platform.d.ts.map +1 -0
- package/dist/utils/platform.js +49 -0
- package/dist/utils/platform.js.map +1 -0
- package/dist/utils/ripgrep.d.ts +20 -0
- package/dist/utils/ripgrep.d.ts.map +1 -0
- package/dist/utils/ripgrep.js +51 -0
- package/dist/utils/ripgrep.js.map +1 -0
- package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp-src/apply-seccomp.c +98 -0
- package/dist/vendor/seccomp-src/seccomp-unix-block.c +97 -0
- package/package.json +90 -0
- package/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/vendor/seccomp/x64/apply-seccomp +0 -0
- package/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/vendor/seccomp-src/apply-seccomp.c +98 -0
- package/vendor/seccomp-src/seccomp-unix-block.c +97 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAE7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,oBAAoB,CAAA;AAQ3B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,+CAA+C;IAC/C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;QACtD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,wCAAwC;IACxC,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAKvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;KAClB,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;KACvD,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,+DAA+D;IAC/D,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;QAC9B,IAAI,YAAY,GAAG,wDAAwD,CAAA;QAE3E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,YAAY,IAAI,yDAAyD,CAAA;QAC3E,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,YAAY,IAAI,0BAA0B,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,YAAY,IAAI,cAAc,QAAQ,qBAAqB,CAAA;QAC7D,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IAC/B,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAAC,SAAS,CAAC,EAAE;YAC3D,qBAAqB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;YAE7C,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,oBAAoB,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3B,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,yBAAyB;IACzB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oCAAoC;IACpC,gCAAgC;IAChC,qCAAqC;IACrC,6BAA6B;IAC7B,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,CAAA;IAElD,qEAAqE;IACrE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,SAAS,EAAE,OAAO,KAAK,SAAS,CAAA;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,sCAAsC;QACtC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,mBAAmB,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,IAAI,KAAK,CAAA;QACzE,MAAM,aAAa,GAAG,MAAM,EAAE,OAAO,CAAA;QACrC,OAAO,+BAA+B,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAA;IAC5E,CAAC;IAED,mDAAmD;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACzB,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ;SACzC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,OAAO;QACL,QAAQ,EAAE,SAAS;KACpB,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,MAAM,cAAc,GAClB,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAA;IAC7E,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EACb,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE;KAC5E,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EACN,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE;KAC1E,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,cAAc,EAAE,iBAAiB,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;AACnC,CAAC;AAUD,KAAK,UAAU,KAAK,CAClB,OAAe,EACf,UAA+B,EAAE;IAEjC,MAAM,EACJ,aAAa,EACb,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,GAAG,YAAY,EAChB,GAAG,OAAO,CAAA;IAEX,0EAA0E;IAC1E,MAAM,eAAe,GAAG,WAAW,IAAI,YAAY,CAAC,MAAM,CAAA;IAE1D,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAC5C,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,CAChB,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAA;IAC1C,IAAI,gBAAgB,IAAI,2BAA2B,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB;QACrC,CAAC,CAAC,uBAAuB,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;IAEZ,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,SAAS;YAAE,OAAM;QACrB,SAAS,GAAG,IAAI,CAAA;QAChB,cAAc,EAAE,CAAA;IAClB,CAAC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE;YACxC,GAAG,YAAY;YACf,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,IAAI;SAClC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAA;QACT,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IAOxC,uDAAuD;IACvD,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAM;IAEpC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAM;IAE/B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAE3C,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACzD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IAEtC,MAAM,cAAc,GAAG,OAAO,CAAA;IAC9B,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAC5D,2EAA2E;QAC3E,gDAAgD;QAChD,OAAO,CACL,cAAc,KAAK,SAAS;YAC5B,cAAc,CAAC,UAAU,CACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CACtD,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;IAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ;QAC7B,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAgDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,KAAK;IACL,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Read restriction config using a "deny-only" pattern.
|
|
3
|
+
*
|
|
4
|
+
* Semantics:
|
|
5
|
+
* - `undefined` = no restrictions (allow all reads)
|
|
6
|
+
* - `{denyOnly: []}` = no restrictions (empty deny list = allow all reads)
|
|
7
|
+
* - `{denyOnly: [...paths]}` = deny reads from these paths, allow all others
|
|
8
|
+
*
|
|
9
|
+
* This is maximally permissive by default - only explicitly denied paths are blocked.
|
|
10
|
+
*/
|
|
11
|
+
export interface FsReadRestrictionConfig {
|
|
12
|
+
denyOnly: string[];
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Write restriction config using an "allow-only" pattern.
|
|
16
|
+
*
|
|
17
|
+
* Semantics:
|
|
18
|
+
* - `undefined` = no restrictions (allow all writes)
|
|
19
|
+
* - `{allowOnly: [], denyWithinAllow: []}` = maximally restrictive (deny ALL writes)
|
|
20
|
+
* - `{allowOnly: [...paths], denyWithinAllow: [...]}` = allow writes only to these paths,
|
|
21
|
+
* with exceptions for denyWithinAllow
|
|
22
|
+
*
|
|
23
|
+
* This is maximally restrictive by default - only explicitly allowed paths are writable.
|
|
24
|
+
* Note: Empty `allowOnly` means NO paths are writable (unlike read's empty denyOnly).
|
|
25
|
+
*/
|
|
26
|
+
export interface FsWriteRestrictionConfig {
|
|
27
|
+
allowOnly: string[];
|
|
28
|
+
denyWithinAllow: string[];
|
|
29
|
+
}
|
|
30
|
+
/**
|
|
31
|
+
* Network restriction config (internal structure built from permission rules).
|
|
32
|
+
*
|
|
33
|
+
* This uses an "allow-only" pattern (like write restrictions):
|
|
34
|
+
* - `allowedHosts` = hosts that are explicitly allowed
|
|
35
|
+
* - `deniedHosts` = hosts that are explicitly denied (checked first, before allowedHosts)
|
|
36
|
+
*
|
|
37
|
+
* Semantics:
|
|
38
|
+
* - `undefined` = maximally restrictive (deny all network)
|
|
39
|
+
* - `{allowedHosts: [], deniedHosts: []}` = maximally restrictive (nothing allowed)
|
|
40
|
+
* - `{allowedHosts: [...], deniedHosts: [...]}` = apply allow/deny rules
|
|
41
|
+
*
|
|
42
|
+
* Note: Empty `allowedHosts` means NO hosts are allowed (unlike read's empty denyOnly).
|
|
43
|
+
*/
|
|
44
|
+
export interface NetworkRestrictionConfig {
|
|
45
|
+
allowedHosts?: string[];
|
|
46
|
+
deniedHosts?: string[];
|
|
47
|
+
}
|
|
48
|
+
export type NetworkHostPattern = {
|
|
49
|
+
host: string;
|
|
50
|
+
port: number | undefined;
|
|
51
|
+
};
|
|
52
|
+
export type SandboxAskCallback = (params: NetworkHostPattern) => Promise<boolean>;
|
|
53
|
+
//# sourceMappingURL=sandbox-schemas.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-schemas.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAAC,CAAA"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-schemas.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-schemas.ts"],"names":[],"mappings":"AAAA,mFAAmF"}
|
|
@@ -0,0 +1,83 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dangerous files that should be protected from writes.
|
|
3
|
+
* These files can be used for code execution or data exfiltration.
|
|
4
|
+
*/
|
|
5
|
+
export declare const DANGEROUS_FILES: readonly [".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc", ".zprofile", ".profile", ".ripgreprc", ".mcp.json"];
|
|
6
|
+
/**
|
|
7
|
+
* Dangerous directories that should be protected from writes.
|
|
8
|
+
* These directories contain sensitive configuration or executable files.
|
|
9
|
+
*/
|
|
10
|
+
export declare const DANGEROUS_DIRECTORIES: readonly [".git", ".vscode", ".idea"];
|
|
11
|
+
/**
|
|
12
|
+
* Get the list of dangerous directories to deny writes to.
|
|
13
|
+
* Excludes .git since we need it writable for git operations -
|
|
14
|
+
* instead we block specific paths within .git (hooks and config).
|
|
15
|
+
*/
|
|
16
|
+
export declare function getDangerousDirectories(): string[];
|
|
17
|
+
/**
|
|
18
|
+
* Normalizes a path for case-insensitive comparison.
|
|
19
|
+
* This prevents bypassing security checks using mixed-case paths on case-insensitive
|
|
20
|
+
* filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
|
|
21
|
+
*
|
|
22
|
+
* We always normalize to lowercase regardless of platform for consistent security.
|
|
23
|
+
* @param path The path to normalize
|
|
24
|
+
* @returns The lowercase path for safe comparison
|
|
25
|
+
*/
|
|
26
|
+
export declare function normalizeCaseForComparison(pathStr: string): string;
|
|
27
|
+
/**
|
|
28
|
+
* Check if a path pattern contains glob characters
|
|
29
|
+
*/
|
|
30
|
+
export declare function containsGlobChars(pathPattern: string): boolean;
|
|
31
|
+
/**
|
|
32
|
+
* Remove trailing /** glob suffix from a path pattern
|
|
33
|
+
* Used to normalize path patterns since /** just means "directory and everything under it"
|
|
34
|
+
*/
|
|
35
|
+
export declare function removeTrailingGlobSuffix(pathPattern: string): string;
|
|
36
|
+
/**
|
|
37
|
+
* Check if a symlink resolution crosses expected path boundaries.
|
|
38
|
+
*
|
|
39
|
+
* When resolving symlinks for sandbox path normalization, we need to ensure
|
|
40
|
+
* the resolved path doesn't unexpectedly broaden the scope. This function
|
|
41
|
+
* returns true if the resolved path is an ancestor of the original path
|
|
42
|
+
* or resolves to a system root, which would indicate the symlink points
|
|
43
|
+
* outside expected boundaries.
|
|
44
|
+
*
|
|
45
|
+
* @param originalPath - The original path before symlink resolution
|
|
46
|
+
* @param resolvedPath - The path after fs.realpathSync() resolution
|
|
47
|
+
* @returns true if the resolved path is outside expected boundaries
|
|
48
|
+
*/
|
|
49
|
+
export declare function isSymlinkOutsideBoundary(originalPath: string, resolvedPath: string): boolean;
|
|
50
|
+
/**
|
|
51
|
+
* Normalize a path for use in sandbox configurations
|
|
52
|
+
* Handles:
|
|
53
|
+
* - Tilde (~) expansion for home directory
|
|
54
|
+
* - Relative paths (./foo, ../foo, etc.) converted to absolute
|
|
55
|
+
* - Absolute paths remain unchanged
|
|
56
|
+
* - Symlinks are resolved to their real paths for non-glob patterns
|
|
57
|
+
* - Glob patterns preserve wildcards after path normalization
|
|
58
|
+
*
|
|
59
|
+
* Returns the absolute path with symlinks resolved (or normalized glob pattern)
|
|
60
|
+
*/
|
|
61
|
+
export declare function normalizePathForSandbox(pathPattern: string): string;
|
|
62
|
+
/**
|
|
63
|
+
* Get recommended system paths that should be writable for commands to work properly
|
|
64
|
+
*
|
|
65
|
+
* WARNING: These default paths are intentionally broad for compatibility but may
|
|
66
|
+
* allow access to files from other processes. In highly security-sensitive
|
|
67
|
+
* environments, you should configure more restrictive write paths.
|
|
68
|
+
*/
|
|
69
|
+
export declare function getDefaultWritePaths(): string[];
|
|
70
|
+
/**
|
|
71
|
+
* Generate proxy environment variables for sandboxed processes
|
|
72
|
+
*/
|
|
73
|
+
export declare function generateProxyEnvVars(httpProxyPort?: number, socksProxyPort?: number): string[];
|
|
74
|
+
/**
|
|
75
|
+
* Encode a command for sandbox monitoring
|
|
76
|
+
* Truncates to 100 chars and base64 encodes to avoid parsing issues
|
|
77
|
+
*/
|
|
78
|
+
export declare function encodeSandboxedCommand(command: string): string;
|
|
79
|
+
/**
|
|
80
|
+
* Decode a base64-encoded command from sandbox monitoring
|
|
81
|
+
*/
|
|
82
|
+
export declare function decodeSandboxedCommand(encodedCommand: string): string;
|
|
83
|
+
//# sourceMappingURL=sandbox-utils.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,eAAe,kIAUlB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uCAAwC,CAAA;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAMlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAuGT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA6DnE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAgB/C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,CAAC,EAAE,MAAM,EACtB,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,EAAE,CAgGV;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE"}
|
|
@@ -0,0 +1,343 @@
|
|
|
1
|
+
import { homedir } from 'os';
|
|
2
|
+
import * as path from 'path';
|
|
3
|
+
import * as fs from 'fs';
|
|
4
|
+
import { getPlatform } from '../utils/platform.js';
|
|
5
|
+
/**
|
|
6
|
+
* Dangerous files that should be protected from writes.
|
|
7
|
+
* These files can be used for code execution or data exfiltration.
|
|
8
|
+
*/
|
|
9
|
+
export const DANGEROUS_FILES = [
|
|
10
|
+
'.gitconfig',
|
|
11
|
+
'.gitmodules',
|
|
12
|
+
'.bashrc',
|
|
13
|
+
'.bash_profile',
|
|
14
|
+
'.zshrc',
|
|
15
|
+
'.zprofile',
|
|
16
|
+
'.profile',
|
|
17
|
+
'.ripgreprc',
|
|
18
|
+
'.mcp.json',
|
|
19
|
+
];
|
|
20
|
+
/**
|
|
21
|
+
* Dangerous directories that should be protected from writes.
|
|
22
|
+
* These directories contain sensitive configuration or executable files.
|
|
23
|
+
*/
|
|
24
|
+
export const DANGEROUS_DIRECTORIES = ['.git', '.vscode', '.idea'];
|
|
25
|
+
/**
|
|
26
|
+
* Get the list of dangerous directories to deny writes to.
|
|
27
|
+
* Excludes .git since we need it writable for git operations -
|
|
28
|
+
* instead we block specific paths within .git (hooks and config).
|
|
29
|
+
*/
|
|
30
|
+
export function getDangerousDirectories() {
|
|
31
|
+
return [
|
|
32
|
+
...DANGEROUS_DIRECTORIES.filter(d => d !== '.git'),
|
|
33
|
+
'.claude/commands',
|
|
34
|
+
'.claude/agents',
|
|
35
|
+
];
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* Normalizes a path for case-insensitive comparison.
|
|
39
|
+
* This prevents bypassing security checks using mixed-case paths on case-insensitive
|
|
40
|
+
* filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
|
|
41
|
+
*
|
|
42
|
+
* We always normalize to lowercase regardless of platform for consistent security.
|
|
43
|
+
* @param path The path to normalize
|
|
44
|
+
* @returns The lowercase path for safe comparison
|
|
45
|
+
*/
|
|
46
|
+
export function normalizeCaseForComparison(pathStr) {
|
|
47
|
+
return pathStr.toLowerCase();
|
|
48
|
+
}
|
|
49
|
+
/**
|
|
50
|
+
* Check if a path pattern contains glob characters
|
|
51
|
+
*/
|
|
52
|
+
export function containsGlobChars(pathPattern) {
|
|
53
|
+
return (pathPattern.includes('*') ||
|
|
54
|
+
pathPattern.includes('?') ||
|
|
55
|
+
pathPattern.includes('[') ||
|
|
56
|
+
pathPattern.includes(']'));
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Remove trailing /** glob suffix from a path pattern
|
|
60
|
+
* Used to normalize path patterns since /** just means "directory and everything under it"
|
|
61
|
+
*/
|
|
62
|
+
export function removeTrailingGlobSuffix(pathPattern) {
|
|
63
|
+
return pathPattern.replace(/\/\*\*$/, '');
|
|
64
|
+
}
|
|
65
|
+
/**
|
|
66
|
+
* Check if a symlink resolution crosses expected path boundaries.
|
|
67
|
+
*
|
|
68
|
+
* When resolving symlinks for sandbox path normalization, we need to ensure
|
|
69
|
+
* the resolved path doesn't unexpectedly broaden the scope. This function
|
|
70
|
+
* returns true if the resolved path is an ancestor of the original path
|
|
71
|
+
* or resolves to a system root, which would indicate the symlink points
|
|
72
|
+
* outside expected boundaries.
|
|
73
|
+
*
|
|
74
|
+
* @param originalPath - The original path before symlink resolution
|
|
75
|
+
* @param resolvedPath - The path after fs.realpathSync() resolution
|
|
76
|
+
* @returns true if the resolved path is outside expected boundaries
|
|
77
|
+
*/
|
|
78
|
+
export function isSymlinkOutsideBoundary(originalPath, resolvedPath) {
|
|
79
|
+
const normalizedOriginal = path.normalize(originalPath);
|
|
80
|
+
const normalizedResolved = path.normalize(resolvedPath);
|
|
81
|
+
// Same path after normalization - OK
|
|
82
|
+
if (normalizedResolved === normalizedOriginal) {
|
|
83
|
+
return false;
|
|
84
|
+
}
|
|
85
|
+
// Handle macOS /tmp -> /private/tmp canonical resolution
|
|
86
|
+
// This is a legitimate system symlink that should be allowed
|
|
87
|
+
// /tmp/claude -> /private/tmp/claude is OK
|
|
88
|
+
// /var/folders/... -> /private/var/folders/... is OK
|
|
89
|
+
if (normalizedOriginal.startsWith('/tmp/') &&
|
|
90
|
+
normalizedResolved === '/private' + normalizedOriginal) {
|
|
91
|
+
return false;
|
|
92
|
+
}
|
|
93
|
+
if (normalizedOriginal.startsWith('/var/') &&
|
|
94
|
+
normalizedResolved === '/private' + normalizedOriginal) {
|
|
95
|
+
return false;
|
|
96
|
+
}
|
|
97
|
+
// Also handle the reverse: /private/tmp/... resolving to itself
|
|
98
|
+
if (normalizedOriginal.startsWith('/private/tmp/') &&
|
|
99
|
+
normalizedResolved === normalizedOriginal) {
|
|
100
|
+
return false;
|
|
101
|
+
}
|
|
102
|
+
if (normalizedOriginal.startsWith('/private/var/') &&
|
|
103
|
+
normalizedResolved === normalizedOriginal) {
|
|
104
|
+
return false;
|
|
105
|
+
}
|
|
106
|
+
// If resolved path is "/" it's outside expected boundaries
|
|
107
|
+
if (normalizedResolved === '/') {
|
|
108
|
+
return true;
|
|
109
|
+
}
|
|
110
|
+
// If resolved path is very short (single component like /tmp, /usr, /var),
|
|
111
|
+
// it's likely outside expected boundaries
|
|
112
|
+
const resolvedParts = normalizedResolved.split('/').filter(Boolean);
|
|
113
|
+
if (resolvedParts.length <= 1) {
|
|
114
|
+
return true;
|
|
115
|
+
}
|
|
116
|
+
// If original path starts with resolved path, the resolved path is an ancestor
|
|
117
|
+
// e.g., /tmp/claude -> /tmp means the symlink points to a broader scope
|
|
118
|
+
if (normalizedOriginal.startsWith(normalizedResolved + '/')) {
|
|
119
|
+
return true;
|
|
120
|
+
}
|
|
121
|
+
// Also check the canonical form of the original path for macOS
|
|
122
|
+
// e.g., /tmp/claude should also be checked as /private/tmp/claude
|
|
123
|
+
let canonicalOriginal = normalizedOriginal;
|
|
124
|
+
if (normalizedOriginal.startsWith('/tmp/')) {
|
|
125
|
+
canonicalOriginal = '/private' + normalizedOriginal;
|
|
126
|
+
}
|
|
127
|
+
else if (normalizedOriginal.startsWith('/var/')) {
|
|
128
|
+
canonicalOriginal = '/private' + normalizedOriginal;
|
|
129
|
+
}
|
|
130
|
+
if (canonicalOriginal !== normalizedOriginal &&
|
|
131
|
+
canonicalOriginal.startsWith(normalizedResolved + '/')) {
|
|
132
|
+
return true;
|
|
133
|
+
}
|
|
134
|
+
// STRICT CHECK: Only allow resolutions that stay within the expected path tree
|
|
135
|
+
// The resolved path must either:
|
|
136
|
+
// 1. Start with the original path (deeper/same) - already covered by returning false below
|
|
137
|
+
// 2. Start with the canonical original (deeper/same under canonical form)
|
|
138
|
+
// 3. BE the canonical form of the original (e.g., /tmp/x -> /private/tmp/x)
|
|
139
|
+
// Any other resolution (e.g., /tmp/claude -> /Users/dworken) is outside expected bounds
|
|
140
|
+
const resolvedStartsWithOriginal = normalizedResolved.startsWith(normalizedOriginal + '/');
|
|
141
|
+
const resolvedStartsWithCanonical = canonicalOriginal !== normalizedOriginal &&
|
|
142
|
+
normalizedResolved.startsWith(canonicalOriginal + '/');
|
|
143
|
+
const resolvedIsCanonical = canonicalOriginal !== normalizedOriginal &&
|
|
144
|
+
normalizedResolved === canonicalOriginal;
|
|
145
|
+
const resolvedIsSame = normalizedResolved === normalizedOriginal;
|
|
146
|
+
// If resolved path is not within expected tree, it's outside boundary
|
|
147
|
+
if (!resolvedIsSame &&
|
|
148
|
+
!resolvedIsCanonical &&
|
|
149
|
+
!resolvedStartsWithOriginal &&
|
|
150
|
+
!resolvedStartsWithCanonical) {
|
|
151
|
+
return true;
|
|
152
|
+
}
|
|
153
|
+
// Allow resolution to same directory level or deeper within expected tree
|
|
154
|
+
return false;
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Normalize a path for use in sandbox configurations
|
|
158
|
+
* Handles:
|
|
159
|
+
* - Tilde (~) expansion for home directory
|
|
160
|
+
* - Relative paths (./foo, ../foo, etc.) converted to absolute
|
|
161
|
+
* - Absolute paths remain unchanged
|
|
162
|
+
* - Symlinks are resolved to their real paths for non-glob patterns
|
|
163
|
+
* - Glob patterns preserve wildcards after path normalization
|
|
164
|
+
*
|
|
165
|
+
* Returns the absolute path with symlinks resolved (or normalized glob pattern)
|
|
166
|
+
*/
|
|
167
|
+
export function normalizePathForSandbox(pathPattern) {
|
|
168
|
+
const cwd = process.cwd();
|
|
169
|
+
let normalizedPath = pathPattern;
|
|
170
|
+
// Expand ~ to home directory
|
|
171
|
+
if (pathPattern === '~') {
|
|
172
|
+
normalizedPath = homedir();
|
|
173
|
+
}
|
|
174
|
+
else if (pathPattern.startsWith('~/')) {
|
|
175
|
+
normalizedPath = homedir() + pathPattern.slice(1);
|
|
176
|
+
}
|
|
177
|
+
else if (pathPattern.startsWith('./') || pathPattern.startsWith('../')) {
|
|
178
|
+
// Convert relative to absolute based on current working directory
|
|
179
|
+
normalizedPath = path.resolve(cwd, pathPattern);
|
|
180
|
+
}
|
|
181
|
+
else if (!path.isAbsolute(pathPattern)) {
|
|
182
|
+
// Handle other relative paths (e.g., ".", "..", "foo/bar")
|
|
183
|
+
normalizedPath = path.resolve(cwd, pathPattern);
|
|
184
|
+
}
|
|
185
|
+
// For glob patterns, resolve symlinks for the directory portion only
|
|
186
|
+
if (containsGlobChars(normalizedPath)) {
|
|
187
|
+
// Extract the static directory prefix before glob characters
|
|
188
|
+
const staticPrefix = normalizedPath.split(/[*?[\]]/)[0];
|
|
189
|
+
if (staticPrefix && staticPrefix !== '/') {
|
|
190
|
+
// Get the directory containing the glob pattern
|
|
191
|
+
// If staticPrefix ends with /, remove it to get the directory
|
|
192
|
+
const baseDir = staticPrefix.endsWith('/')
|
|
193
|
+
? staticPrefix.slice(0, -1)
|
|
194
|
+
: path.dirname(staticPrefix);
|
|
195
|
+
// Try to resolve symlinks for the base directory
|
|
196
|
+
try {
|
|
197
|
+
const resolvedBaseDir = fs.realpathSync(baseDir);
|
|
198
|
+
// Validate that resolution stays within expected boundaries
|
|
199
|
+
if (!isSymlinkOutsideBoundary(baseDir, resolvedBaseDir)) {
|
|
200
|
+
// Reconstruct the pattern with the resolved directory
|
|
201
|
+
const patternSuffix = normalizedPath.slice(baseDir.length);
|
|
202
|
+
return resolvedBaseDir + patternSuffix;
|
|
203
|
+
}
|
|
204
|
+
// If resolution would broaden scope, keep original pattern
|
|
205
|
+
}
|
|
206
|
+
catch {
|
|
207
|
+
// If directory doesn't exist or can't be resolved, keep the original pattern
|
|
208
|
+
}
|
|
209
|
+
}
|
|
210
|
+
return normalizedPath;
|
|
211
|
+
}
|
|
212
|
+
// Resolve symlinks to real paths to avoid bwrap issues
|
|
213
|
+
// Validate that the resolution stays within expected boundaries
|
|
214
|
+
try {
|
|
215
|
+
const resolvedPath = fs.realpathSync(normalizedPath);
|
|
216
|
+
// Only use resolved path if it doesn't cross boundary (e.g., symlink to parent dir)
|
|
217
|
+
if (isSymlinkOutsideBoundary(normalizedPath, resolvedPath)) {
|
|
218
|
+
// Symlink points outside expected boundaries - keep original path
|
|
219
|
+
}
|
|
220
|
+
else {
|
|
221
|
+
normalizedPath = resolvedPath;
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
catch {
|
|
225
|
+
// If path doesn't exist or can't be resolved, keep the normalized path
|
|
226
|
+
}
|
|
227
|
+
return normalizedPath;
|
|
228
|
+
}
|
|
229
|
+
/**
|
|
230
|
+
* Get recommended system paths that should be writable for commands to work properly
|
|
231
|
+
*
|
|
232
|
+
* WARNING: These default paths are intentionally broad for compatibility but may
|
|
233
|
+
* allow access to files from other processes. In highly security-sensitive
|
|
234
|
+
* environments, you should configure more restrictive write paths.
|
|
235
|
+
*/
|
|
236
|
+
export function getDefaultWritePaths() {
|
|
237
|
+
const homeDir = homedir();
|
|
238
|
+
const recommendedPaths = [
|
|
239
|
+
'/dev/stdout',
|
|
240
|
+
'/dev/stderr',
|
|
241
|
+
'/dev/null',
|
|
242
|
+
'/dev/tty',
|
|
243
|
+
'/dev/dtracehelper',
|
|
244
|
+
'/dev/autofs_nowait',
|
|
245
|
+
'/tmp/claude',
|
|
246
|
+
'/private/tmp/claude',
|
|
247
|
+
path.join(homeDir, '.npm/_logs'),
|
|
248
|
+
path.join(homeDir, '.claude/debug'),
|
|
249
|
+
];
|
|
250
|
+
return recommendedPaths;
|
|
251
|
+
}
|
|
252
|
+
/**
|
|
253
|
+
* Generate proxy environment variables for sandboxed processes
|
|
254
|
+
*/
|
|
255
|
+
export function generateProxyEnvVars(httpProxyPort, socksProxyPort) {
|
|
256
|
+
// Respect CLAUDE_TMPDIR if set, otherwise default to /tmp/claude
|
|
257
|
+
const tmpdir = process.env.CLAUDE_TMPDIR || '/tmp/claude';
|
|
258
|
+
const envVars = [`SANDBOX_RUNTIME=1`, `TMPDIR=${tmpdir}`];
|
|
259
|
+
// If no proxy ports provided, return minimal env vars
|
|
260
|
+
if (!httpProxyPort && !socksProxyPort) {
|
|
261
|
+
return envVars;
|
|
262
|
+
}
|
|
263
|
+
// Always set NO_PROXY to exclude localhost and private networks from proxying
|
|
264
|
+
const noProxyAddresses = [
|
|
265
|
+
'localhost',
|
|
266
|
+
'127.0.0.1',
|
|
267
|
+
'::1',
|
|
268
|
+
'*.local',
|
|
269
|
+
'.local',
|
|
270
|
+
'169.254.0.0/16', // Link-local
|
|
271
|
+
'10.0.0.0/8', // Private network
|
|
272
|
+
'172.16.0.0/12', // Private network
|
|
273
|
+
'192.168.0.0/16', // Private network
|
|
274
|
+
].join(',');
|
|
275
|
+
envVars.push(`NO_PROXY=${noProxyAddresses}`);
|
|
276
|
+
envVars.push(`no_proxy=${noProxyAddresses}`);
|
|
277
|
+
if (httpProxyPort) {
|
|
278
|
+
envVars.push(`HTTP_PROXY=http://localhost:${httpProxyPort}`);
|
|
279
|
+
envVars.push(`HTTPS_PROXY=http://localhost:${httpProxyPort}`);
|
|
280
|
+
// Lowercase versions for compatibility with some tools
|
|
281
|
+
envVars.push(`http_proxy=http://localhost:${httpProxyPort}`);
|
|
282
|
+
envVars.push(`https_proxy=http://localhost:${httpProxyPort}`);
|
|
283
|
+
}
|
|
284
|
+
if (socksProxyPort) {
|
|
285
|
+
// Use socks5h:// for proper DNS resolution through proxy
|
|
286
|
+
envVars.push(`ALL_PROXY=socks5h://localhost:${socksProxyPort}`);
|
|
287
|
+
envVars.push(`all_proxy=socks5h://localhost:${socksProxyPort}`);
|
|
288
|
+
// Configure Git to use SSH through SOCKS proxy (platform-aware)
|
|
289
|
+
if (getPlatform() === 'macos') {
|
|
290
|
+
// macOS has nc available
|
|
291
|
+
// Note: No outer quotes - bwrap --setenv sets the value directly without shell interpretation
|
|
292
|
+
envVars.push(`GIT_SSH_COMMAND=ssh -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`);
|
|
293
|
+
}
|
|
294
|
+
// FTP proxy support (use socks5h for DNS resolution through proxy)
|
|
295
|
+
envVars.push(`FTP_PROXY=socks5h://localhost:${socksProxyPort}`);
|
|
296
|
+
envVars.push(`ftp_proxy=socks5h://localhost:${socksProxyPort}`);
|
|
297
|
+
// rsync proxy support
|
|
298
|
+
envVars.push(`RSYNC_PROXY=localhost:${socksProxyPort}`);
|
|
299
|
+
// Database tools NOTE: Most database clients don't have built-in proxy support
|
|
300
|
+
// You typically need to use SSH tunneling or a SOCKS wrapper like tsocks/proxychains
|
|
301
|
+
// Docker CLI uses HTTP for the API
|
|
302
|
+
// This makes Docker use the HTTP proxy for registry operations
|
|
303
|
+
envVars.push(`DOCKER_HTTP_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
|
|
304
|
+
envVars.push(`DOCKER_HTTPS_PROXY=http://localhost:${httpProxyPort || socksProxyPort}`);
|
|
305
|
+
// Kubernetes kubectl - uses standard HTTPS_PROXY
|
|
306
|
+
// kubectl respects HTTPS_PROXY which we already set above
|
|
307
|
+
// AWS CLI - uses standard HTTPS_PROXY (v2 supports it well)
|
|
308
|
+
// AWS CLI v2 respects HTTPS_PROXY which we already set above
|
|
309
|
+
// Google Cloud SDK - has specific proxy settings
|
|
310
|
+
// Use HTTPS proxy to match other HTTP-based tools
|
|
311
|
+
if (httpProxyPort) {
|
|
312
|
+
envVars.push(`CLOUDSDK_PROXY_TYPE=https`);
|
|
313
|
+
envVars.push(`CLOUDSDK_PROXY_ADDRESS=localhost`);
|
|
314
|
+
envVars.push(`CLOUDSDK_PROXY_PORT=${httpProxyPort}`);
|
|
315
|
+
}
|
|
316
|
+
// Azure CLI - uses HTTPS_PROXY
|
|
317
|
+
// Azure CLI respects HTTPS_PROXY which we already set above
|
|
318
|
+
// Terraform - uses standard HTTP/HTTPS proxy vars
|
|
319
|
+
// Terraform respects HTTP_PROXY/HTTPS_PROXY which we already set above
|
|
320
|
+
// gRPC-based tools - use standard proxy vars
|
|
321
|
+
envVars.push(`GRPC_PROXY=socks5h://localhost:${socksProxyPort}`);
|
|
322
|
+
envVars.push(`grpc_proxy=socks5h://localhost:${socksProxyPort}`);
|
|
323
|
+
}
|
|
324
|
+
// WARNING: Do not set HTTP_PROXY/HTTPS_PROXY to SOCKS URLs when only SOCKS proxy is available
|
|
325
|
+
// Most HTTP clients do not support SOCKS URLs in these variables and will fail, and we want
|
|
326
|
+
// to avoid overriding the client otherwise respecting the ALL_PROXY env var which points to SOCKS.
|
|
327
|
+
return envVars;
|
|
328
|
+
}
|
|
329
|
+
/**
|
|
330
|
+
* Encode a command for sandbox monitoring
|
|
331
|
+
* Truncates to 100 chars and base64 encodes to avoid parsing issues
|
|
332
|
+
*/
|
|
333
|
+
export function encodeSandboxedCommand(command) {
|
|
334
|
+
const truncatedCommand = command.slice(0, 100);
|
|
335
|
+
return Buffer.from(truncatedCommand).toString('base64');
|
|
336
|
+
}
|
|
337
|
+
/**
|
|
338
|
+
* Decode a base64-encoded command from sandbox monitoring
|
|
339
|
+
*/
|
|
340
|
+
export function decodeSandboxedCommand(encodedCommand) {
|
|
341
|
+
return Buffer.from(encodedCommand, 'base64').toString('utf8');
|
|
342
|
+
}
|
|
343
|
+
//# sourceMappingURL=sandbox-utils.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY;IACZ,aAAa;IACb,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,WAAW;CACH,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAU,CAAA;AAE1E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;QAClD,kBAAkB;QAClB,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAA;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,CACL,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC1B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,OAAO,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,YAAoB;IAEpB,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IACvD,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAEvD,qCAAqC;IACrC,IAAI,kBAAkB,KAAK,kBAAkB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yDAAyD;IACzD,6DAA6D;IAC7D,2CAA2C;IAC3C,qDAAqD;IACrD,IACE,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC;QACtC,kBAAkB,KAAK,UAAU,GAAG,kBAAkB,EACtD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IACE,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC;QACtC,kBAAkB,KAAK,UAAU,GAAG,kBAAkB,EACtD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,gEAAgE;IAChE,IACE,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC9C,kBAAkB,KAAK,kBAAkB,EACzC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IACE,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC9C,kBAAkB,KAAK,kBAAkB,EACzC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,kBAAkB,CAAC,UAAU,CAAC,kBAAkB,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,IAAI,iBAAiB,GAAG,kBAAkB,CAAA;IAC1C,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,iBAAiB,GAAG,UAAU,GAAG,kBAAkB,CAAA;IACrD,CAAC;SAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,iBAAiB,GAAG,UAAU,GAAG,kBAAkB,CAAA;IACrD,CAAC;IAED,IACE,iBAAiB,KAAK,kBAAkB;QACxC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,GAAG,GAAG,CAAC,EACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IAC/E,iCAAiC;IACjC,2FAA2F;IAC3F,0EAA0E;IAC1E,4EAA4E;IAC5E,wFAAwF;IAExF,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,UAAU,CAC9D,kBAAkB,GAAG,GAAG,CACzB,CAAA;IACD,MAAM,2BAA2B,GAC/B,iBAAiB,KAAK,kBAAkB;QACxC,kBAAkB,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;IACxD,MAAM,mBAAmB,GACvB,iBAAiB,KAAK,kBAAkB;QACxC,kBAAkB,KAAK,iBAAiB,CAAA;IAC1C,MAAM,cAAc,GAAG,kBAAkB,KAAK,kBAAkB,CAAA;IAEhE,sEAAsE;IACtE,IACE,CAAC,cAAc;QACf,CAAC,mBAAmB;QACpB,CAAC,0BAA0B;QAC3B,CAAC,2BAA2B,EAC5B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,cAAc,GAAG,WAAW,CAAA;IAEhC,6BAA6B;IAC7B,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;QACxB,cAAc,GAAG,OAAO,EAAE,CAAA;IAC5B,CAAC;SAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,cAAc,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,kEAAkE;QAClE,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,2DAA2D;QAC3D,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,qEAAqE;IACrE,IAAI,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,6DAA6D;QAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,gDAAgD;YAChD,8DAA8D;YAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAE9B,iDAAiD;YACjD,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;gBAChD,4DAA4D;gBAC5D,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;oBACxD,sDAAsD;oBACtD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;oBAC1D,OAAO,eAAe,GAAG,aAAa,CAAA;gBACxC,CAAC;gBACD,2DAA2D;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;YAC/E,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,uDAAuD;IACvD,gEAAgE;IAChE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QAEpD,oFAAoF;QACpF,IAAI,wBAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3D,kEAAkE;QACpE,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,YAAY,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,gBAAgB,GAAG;QACvB,aAAa;QACb,aAAa;QACb,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC;KACpC,CAAA;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAAsB,EACtB,cAAuB;IAEvB,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa,CAAA;IACzD,MAAM,OAAO,GAAa,CAAC,mBAAmB,EAAE,UAAU,MAAM,EAAE,CAAC,CAAA;IAEnE,sDAAsD;IACtD,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG;QACvB,WAAW;QACX,WAAW;QACX,KAAK;QACL,SAAS;QACT,QAAQ;QACR,gBAAgB,EAAE,aAAa;QAC/B,YAAY,EAAE,kBAAkB;QAChC,eAAe,EAAE,kBAAkB;QACnC,gBAAgB,EAAE,kBAAkB;KACrC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,OAAO,CAAC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAA;IAC5C,OAAO,CAAC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAA;IAE5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAA;QAC7D,uDAAuD;QACvD,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,yDAAyD;QACzD,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAE/D,gEAAgE;QAChE,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,yBAAyB;YACzB,8FAA8F;YAC9F,OAAO,CAAC,IAAI,CACV,6DAA6D,cAAc,SAAS,CACrF,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAA;QAE/D,sBAAsB;QACtB,OAAO,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAA;QAEvD,+EAA+E;QAC/E,qFAAqF;QAErF,mCAAmC;QACnC,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,sCAAsC,aAAa,IAAI,cAAc,EAAE,CACxE,CAAA;QACD,OAAO,CAAC,IAAI,CACV,uCAAuC,aAAa,IAAI,cAAc,EAAE,CACzE,CAAA;QAED,iDAAiD;QACjD,0DAA0D;QAE1D,4DAA4D;QAC5D,6DAA6D;QAE7D,iDAAiD;QACjD,kDAAkD;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACzC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,CAAC,uBAAuB,aAAa,EAAE,CAAC,CAAA;QACtD,CAAC;QAED,+BAA+B;QAC/B,4DAA4D;QAE5D,kDAAkD;QAClD,uEAAuE;QAEvE,6CAA6C;QAC7C,OAAO,CAAC,IAAI,CAAC,kCAAkC,cAAc,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,kCAAkC,cAAc,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IAEnG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/D,CAAC"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import { type SandboxViolationEvent } from './macos-sandbox-utils.js';
|
|
2
|
+
/**
|
|
3
|
+
* In-memory tail for sandbox violations
|
|
4
|
+
*/
|
|
5
|
+
export declare class SandboxViolationStore {
|
|
6
|
+
private violations;
|
|
7
|
+
private totalCount;
|
|
8
|
+
private readonly maxSize;
|
|
9
|
+
private listeners;
|
|
10
|
+
addViolation(violation: SandboxViolationEvent): void;
|
|
11
|
+
getViolations(limit?: number): SandboxViolationEvent[];
|
|
12
|
+
getCount(): number;
|
|
13
|
+
getTotalCount(): number;
|
|
14
|
+
getViolationsForCommand(command: string): SandboxViolationEvent[];
|
|
15
|
+
clear(): void;
|
|
16
|
+
subscribe(listener: (violations: SandboxViolationEvent[]) => void): () => void;
|
|
17
|
+
private notifyListeners;
|
|
18
|
+
}
|
|
19
|
+
//# sourceMappingURL=sandbox-violation-store.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-violation-store.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-violation-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAGrE;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAM;IAC9B,OAAO,CAAC,SAAS,CACN;IAEX,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAG,IAAI;IASpD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAOtD,QAAQ,IAAI,MAAM;IAIlB,aAAa,IAAI,MAAM;IAIvB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAKjE,KAAK,IAAI,IAAI;IAMb,SAAS,CACP,QAAQ,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,IAAI,GACtD,MAAM,IAAI;IAQb,OAAO,CAAC,eAAe;CAKxB"}
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
import { encodeSandboxedCommand } from './sandbox-utils.js';
|
|
2
|
+
/**
|
|
3
|
+
* In-memory tail for sandbox violations
|
|
4
|
+
*/
|
|
5
|
+
export class SandboxViolationStore {
|
|
6
|
+
constructor() {
|
|
7
|
+
this.violations = [];
|
|
8
|
+
this.totalCount = 0;
|
|
9
|
+
this.maxSize = 100;
|
|
10
|
+
this.listeners = new Set();
|
|
11
|
+
}
|
|
12
|
+
addViolation(violation) {
|
|
13
|
+
this.violations.push(violation);
|
|
14
|
+
this.totalCount++;
|
|
15
|
+
if (this.violations.length > this.maxSize) {
|
|
16
|
+
this.violations = this.violations.slice(-this.maxSize);
|
|
17
|
+
}
|
|
18
|
+
this.notifyListeners();
|
|
19
|
+
}
|
|
20
|
+
getViolations(limit) {
|
|
21
|
+
if (limit === undefined) {
|
|
22
|
+
return [...this.violations];
|
|
23
|
+
}
|
|
24
|
+
return this.violations.slice(-limit);
|
|
25
|
+
}
|
|
26
|
+
getCount() {
|
|
27
|
+
return this.violations.length;
|
|
28
|
+
}
|
|
29
|
+
getTotalCount() {
|
|
30
|
+
return this.totalCount;
|
|
31
|
+
}
|
|
32
|
+
getViolationsForCommand(command) {
|
|
33
|
+
const commandBase64 = encodeSandboxedCommand(command);
|
|
34
|
+
return this.violations.filter(v => v.encodedCommand === commandBase64);
|
|
35
|
+
}
|
|
36
|
+
clear() {
|
|
37
|
+
this.violations = [];
|
|
38
|
+
// Don't reset totalCount when clearing
|
|
39
|
+
this.notifyListeners();
|
|
40
|
+
}
|
|
41
|
+
subscribe(listener) {
|
|
42
|
+
this.listeners.add(listener);
|
|
43
|
+
listener(this.getViolations());
|
|
44
|
+
return () => {
|
|
45
|
+
this.listeners.delete(listener);
|
|
46
|
+
};
|
|
47
|
+
}
|
|
48
|
+
notifyListeners() {
|
|
49
|
+
// Always notify with all violations so listeners can track the full count
|
|
50
|
+
const violations = this.getViolations();
|
|
51
|
+
this.listeners.forEach(listener => listener(violations));
|
|
52
|
+
}
|
|
53
|
+
}
|
|
54
|
+
//# sourceMappingURL=sandbox-violation-store.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-violation-store.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-violation-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAAlC;QACU,eAAU,GAA4B,EAAE,CAAA;QACxC,eAAU,GAAG,CAAC,CAAA;QACL,YAAO,GAAG,GAAG,CAAA;QACtB,cAAS,GACf,IAAI,GAAG,EAAE,CAAA;IAoDb,CAAC;IAlDC,YAAY,CAAC,SAAgC;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAED,aAAa,CAAC,KAAc;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAA;IAC/B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,uBAAuB,CAAC,OAAe;QACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,aAAa,CAAC,CAAA;IACxE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,EAAE,CAAA;QACpB,uCAAuC;QACvC,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAED,SAAS,CACP,QAAuD;QAEvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC,CAAA;IACH,CAAC;IAEO,eAAe;QACrB,0EAA0E;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;QACvC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1D,CAAC;CACF"}
|