@within-7/minto 0.1.7 → 0.3.0

package/dist/services/responseStateManager.js

@@ -1,11 +1,32 @@
 class ResponseStateManager {
   conversationStates = /* @__PURE__ */ new Map();
+  cleanupIntervalId = null;
   // Cache cleanup after 1 hour of inactivity
   CLEANUP_INTERVAL = 60 * 60 * 1e3;
   constructor() {
-    setInterval(() => {
-      this.cleanup();
-    }, this.CLEANUP_INTERVAL);
+    this.startCleanupInterval();
+  }
+  /**
+   * Start the periodic cleanup interval
+   */
+  startCleanupInterval() {
+    if (this.cleanupIntervalId === null) {
+      this.cleanupIntervalId = setInterval(() => {
+        this.cleanup();
+      }, this.CLEANUP_INTERVAL);
+      if (this.cleanupIntervalId.unref) {
+        this.cleanupIntervalId.unref();
+      }
+    }
+  }
+  /**
+   * Stop the periodic cleanup interval
+   */
+  stopCleanupInterval() {
+    if (this.cleanupIntervalId !== null) {
+      clearInterval(this.cleanupIntervalId);
+      this.cleanupIntervalId = null;
+    }
   }
   /**
    * Set the previous response ID for a conversation
@@ -56,8 +77,21 @@ class ResponseStateManager {
   getStateSize() {
     return this.conversationStates.size;
   }
+  /**
+   * Dispose of the manager and stop cleanup interval
+   * Call this when shutting down to prevent memory leaks
+   */
+  dispose() {
+    this.stopCleanupInterval();
+    this.conversationStates.clear();
+  }
 }
 const responseStateManager = new ResponseStateManager();
+if (typeof process !== "undefined" && process.on) {
+  process.on("beforeExit", () => {
+    responseStateManager.dispose();
+  });
+}
 function getConversationId(agentId, messageId) {
   return agentId || messageId || `conv_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
 }

package/dist/services/responseStateManager.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/services/responseStateManager.ts"],
-  "sourcesContent": ["/**\n * GPT-5 Responses API state management\n * Manages previous_response_id for conversation continuity and reasoning context reuse\n */\n\ninterface ConversationState {\n  previousResponseId?: string\n  lastUpdate: number\n}\n\nclass ResponseStateManager {\n  private conversationStates = new Map<string, ConversationState>()\n\n  // Cache cleanup after 1 hour of inactivity\n  private readonly CLEANUP_INTERVAL = 60 * 60 * 1000\n\n  constructor() {\n    // Periodic cleanup of stale conversations\n    setInterval(() => {\n      this.cleanup()\n    }, this.CLEANUP_INTERVAL)\n  }\n\n  /**\n   * Set the previous response ID for a conversation\n   */\n  setPreviousResponseId(conversationId: string, responseId: string): void {\n    this.conversationStates.set(conversationId, {\n      previousResponseId: responseId,\n      lastUpdate: Date.now(),\n    })\n  }\n\n  /**\n   * Get the previous response ID for a conversation\n   */\n  getPreviousResponseId(conversationId: string): string | undefined {\n    const state = this.conversationStates.get(conversationId)\n    if (state) {\n      // Update last access time\n      state.lastUpdate = Date.now()\n      return state.previousResponseId\n    }\n    return undefined\n  }\n\n  /**\n   * Clear state for a conversation\n   */\n  clearConversation(conversationId: string): void {\n    this.conversationStates.delete(conversationId)\n  }\n\n  /**\n   * Clear all conversation states\n   */\n  clearAll(): void {\n    this.conversationStates.clear()\n  }\n\n  /**\n   * Clean up stale conversations\n   */\n  private cleanup(): void {\n    const now = Date.now()\n    for (const [conversationId, state] of this.conversationStates.entries()) {\n      if (now - state.lastUpdate > this.CLEANUP_INTERVAL) {\n        this.conversationStates.delete(conversationId)\n      }\n    }\n  }\n\n  /**\n   * Get current state size (for debugging/monitoring)\n   */\n  getStateSize(): number {\n    return this.conversationStates.size\n  }\n}\n\n// Singleton instance\nexport const responseStateManager = new ResponseStateManager()\n\n/**\n * Helper to generate conversation ID from context\n */\nexport function getConversationId(\n  agentId?: string,\n  messageId?: string,\n): string {\n  // Use agentId as primary identifier, fallback to messageId or timestamp\n  return (\n    agentId ||\n    messageId ||\n    `conv_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`\n  )\n}\n"],
-  "mappings": "AAUA,MAAM,qBAAqB;AAAA,EACjB,qBAAqB,oBAAI,IAA+B;AAAA;AAAA,EAG/C,mBAAmB,KAAK,KAAK;AAAA,EAE9C,cAAc;AAEZ,gBAAY,MAAM;AAChB,WAAK,QAAQ;AAAA,IACf,GAAG,KAAK,gBAAgB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB,gBAAwB,YAA0B;AACtE,SAAK,mBAAmB,IAAI,gBAAgB;AAAA,MAC1C,oBAAoB;AAAA,MACpB,YAAY,KAAK,IAAI;AAAA,IACvB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB,gBAA4C;AAChE,UAAM,QAAQ,KAAK,mBAAmB,IAAI,cAAc;AACxD,QAAI,OAAO;AAET,YAAM,aAAa,KAAK,IAAI;AAC5B,aAAO,MAAM;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAkB,gBAA8B;AAC9C,SAAK,mBAAmB,OAAO,cAAc;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,WAAiB;AACf,SAAK,mBAAmB,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKQ,UAAgB;AACtB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,gBAAgB,KAAK,KAAK,KAAK,mBAAmB,QAAQ,GAAG;AACvE,UAAI,MAAM,MAAM,aAAa,KAAK,kBAAkB;AAClD,aAAK,mBAAmB,OAAO,cAAc;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,eAAuB;AACrB,WAAO,KAAK,mBAAmB;AAAA,EACjC;AACF;AAGO,MAAM,uBAAuB,IAAI,qBAAqB;AAKtD,SAAS,kBACd,SACA,WACQ;AAER,SACE,WACA,aACA,QAAQ,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AAEjE;",
+  "sourcesContent": ["/**\n * GPT-5 Responses API state management\n * Manages previous_response_id for conversation continuity and reasoning context reuse\n */\n\ninterface ConversationState {\n  previousResponseId?: string\n  lastUpdate: number\n}\n\nclass ResponseStateManager {\n  private conversationStates = new Map<string, ConversationState>()\n  private cleanupIntervalId: ReturnType<typeof setInterval> | null = null\n\n  // Cache cleanup after 1 hour of inactivity\n  private readonly CLEANUP_INTERVAL = 60 * 60 * 1000\n\n  constructor() {\n    this.startCleanupInterval()\n  }\n\n  /**\n   * Start the periodic cleanup interval\n   */\n  private startCleanupInterval(): void {\n    // Only start if not already running\n    if (this.cleanupIntervalId === null) {\n      this.cleanupIntervalId = setInterval(() => {\n        this.cleanup()\n      }, this.CLEANUP_INTERVAL)\n\n      // Ensure the interval doesn't prevent process exit\n      if (this.cleanupIntervalId.unref) {\n        this.cleanupIntervalId.unref()\n      }\n    }\n  }\n\n  /**\n   * Stop the periodic cleanup interval\n   */\n  private stopCleanupInterval(): void {\n    if (this.cleanupIntervalId !== null) {\n      clearInterval(this.cleanupIntervalId)\n      this.cleanupIntervalId = null\n    }\n  }\n\n  /**\n   * Set the previous response ID for a conversation\n   */\n  setPreviousResponseId(conversationId: string, responseId: string): void {\n    this.conversationStates.set(conversationId, {\n      previousResponseId: responseId,\n      lastUpdate: Date.now(),\n    })\n  }\n\n  /**\n   * Get the previous response ID for a conversation\n   */\n  getPreviousResponseId(conversationId: string): string | undefined {\n    const state = this.conversationStates.get(conversationId)\n    if (state) {\n      // Update last access time\n      state.lastUpdate = Date.now()\n      return state.previousResponseId\n    }\n    return undefined\n  }\n\n  /**\n   * Clear state for a conversation\n   */\n  clearConversation(conversationId: string): void {\n    this.conversationStates.delete(conversationId)\n  }\n\n  /**\n   * Clear all conversation states\n   */\n  clearAll(): void {\n    this.conversationStates.clear()\n  }\n\n  /**\n   * Clean up stale conversations\n   */\n  private cleanup(): void {\n    const now = Date.now()\n    for (const [conversationId, state] of this.conversationStates.entries()) {\n      if (now - state.lastUpdate > this.CLEANUP_INTERVAL) {\n        this.conversationStates.delete(conversationId)\n      }\n    }\n  }\n\n  /**\n   * Get current state size (for debugging/monitoring)\n   */\n  getStateSize(): number {\n    return this.conversationStates.size\n  }\n\n  /**\n   * Dispose of the manager and stop cleanup interval\n   * Call this when shutting down to prevent memory leaks\n   */\n  dispose(): void {\n    this.stopCleanupInterval()\n    this.conversationStates.clear()\n  }\n}\n\n// Singleton instance\nexport const responseStateManager = new ResponseStateManager()\n\n// Register cleanup on process exit\nif (typeof process !== 'undefined' && process.on) {\n  process.on('beforeExit', () => {\n    responseStateManager.dispose()\n  })\n}\n\n/**\n * Helper to generate conversation ID from context\n */\nexport function getConversationId(\n  agentId?: string,\n  messageId?: string,\n): string {\n  // Use agentId as primary identifier, fallback to messageId or timestamp\n  return (\n    agentId ||\n    messageId ||\n    `conv_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`\n  )\n}\n"],
+  "mappings": "AAUA,MAAM,qBAAqB;AAAA,EACjB,qBAAqB,oBAAI,IAA+B;AAAA,EACxD,oBAA2D;AAAA;AAAA,EAGlD,mBAAmB,KAAK,KAAK;AAAA,EAE9C,cAAc;AACZ,SAAK,qBAAqB;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAA6B;AAEnC,QAAI,KAAK,sBAAsB,MAAM;AACnC,WAAK,oBAAoB,YAAY,MAAM;AACzC,aAAK,QAAQ;AAAA,MACf,GAAG,KAAK,gBAAgB;AAGxB,UAAI,KAAK,kBAAkB,OAAO;AAChC,aAAK,kBAAkB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAA4B;AAClC,QAAI,KAAK,sBAAsB,MAAM;AACnC,oBAAc,KAAK,iBAAiB;AACpC,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB,gBAAwB,YAA0B;AACtE,SAAK,mBAAmB,IAAI,gBAAgB;AAAA,MAC1C,oBAAoB;AAAA,MACpB,YAAY,KAAK,IAAI;AAAA,IACvB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB,gBAA4C;AAChE,UAAM,QAAQ,KAAK,mBAAmB,IAAI,cAAc;AACxD,QAAI,OAAO;AAET,YAAM,aAAa,KAAK,IAAI;AAC5B,aAAO,MAAM;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAkB,gBAA8B;AAC9C,SAAK,mBAAmB,OAAO,cAAc;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,WAAiB;AACf,SAAK,mBAAmB,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKQ,UAAgB;AACtB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,gBAAgB,KAAK,KAAK,KAAK,mBAAmB,QAAQ,GAAG;AACvE,UAAI,MAAM,MAAM,aAAa,KAAK,kBAAkB;AAClD,aAAK,mBAAmB,OAAO,cAAc;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,eAAuB;AACrB,WAAO,KAAK,mBAAmB;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAgB;AACd,SAAK,oBAAoB;AACzB,SAAK,mBAAmB,MAAM;AAAA,EAChC;AACF;AAGO,MAAM,uBAAuB,IAAI,qBAAqB;AAG7D,IAAI,OAAO,YAAY,eAAe,QAAQ,IAAI;AAChD,UAAQ,GAAG,cAAc,MAAM;AAC7B,yBAAqB,QAAQ;AAAA,EAC/B,CAAC;AACH;AAKO,SAAS,kBACd,SACA,WACQ;AAER,SACE,WACA,aACA,QAAQ,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AAEjE;",
   "names": []
 }

package/dist/services/sandbox/filesystemBoundary.js

@@ -0,0 +1,341 @@
+import { resolve, relative, isAbsolute, dirname } from "path";
+import { minimatch } from "minimatch";
+import { safeResolvePath } from "../../utils/safePath.js";
+class FilesystemBoundary {
+  policy;
+  workingDir;
+  violations = [];
+  constructor(policy, workingDir) {
+    this.policy = policy;
+    this.workingDir = resolve(workingDir);
+  }
+  /**
+   * Update the filesystem policy
+   */
+  updatePolicy(policy) {
+    this.policy = { ...this.policy, ...policy };
+  }
+  /**
+   * Update the working directory
+   */
+  setWorkingDir(dir) {
+    this.workingDir = resolve(dir);
+  }
+  /**
+   * Check if a path can be read
+   */
+  canRead(path) {
+    const validationResult = safeResolvePath(
+      path,
+      this.workingDir,
+      this.workingDir
+    );
+    const absolutePath = validationResult.resolvedPath;
+    if (!validationResult.valid) {
+      const violation2 = this.createViolation(
+        "filesystem_path_denied",
+        `Symlink traversal detected: ${validationResult.error}`,
+        absolutePath
+      );
+      return { allowed: false, violation: violation2, isSymlink: true };
+    }
+    const relativePath = this.getRelativePath(absolutePath);
+    if (this.matchesPattern(relativePath, this.policy.denied)) {
+      const violation2 = this.createViolation(
+        "filesystem_path_denied",
+        `Read access denied for path matching deny pattern: ${path}`,
+        absolutePath
+      );
+      return {
+        allowed: false,
+        violation: violation2,
+        isSymlink: validationResult.isSymlink
+      };
+    }
+    if (this.matchesPattern(relativePath, this.policy.readAllowed)) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    if (this.matchesPattern(absolutePath, this.policy.readAllowed)) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    if (this.policy.readAllowed.includes("*")) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    const violation = this.createViolation(
+      "filesystem_read_denied",
+      `Read access denied: path does not match any allowed pattern: ${path}`,
+      absolutePath
+    );
+    return { allowed: false, violation, isSymlink: validationResult.isSymlink };
+  }
+  /**
+   * Check if a path can be written
+   */
+  canWrite(path) {
+    const validationResult = safeResolvePath(
+      path,
+      this.workingDir,
+      this.workingDir
+    );
+    const absolutePath = validationResult.resolvedPath;
+    if (!validationResult.valid) {
+      const violation2 = this.createViolation(
+        "filesystem_path_denied",
+        `Symlink traversal detected: ${validationResult.error}`,
+        absolutePath
+      );
+      return { allowed: false, violation: violation2, isSymlink: true };
+    }
+    const relativePath = this.getRelativePath(absolutePath);
+    if (this.matchesPattern(relativePath, this.policy.denied)) {
+      const violation2 = this.createViolation(
+        "filesystem_path_denied",
+        `Write access denied for path matching deny pattern: ${path}`,
+        absolutePath
+      );
+      return {
+        allowed: false,
+        violation: violation2,
+        isSymlink: validationResult.isSymlink
+      };
+    }
+    if (this.matchesPattern(relativePath, this.policy.writeAllowed)) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    if (this.matchesPattern(absolutePath, this.policy.writeAllowed)) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    if (this.policy.writeAllowed.includes("*")) {
+      return { allowed: true, isSymlink: validationResult.isSymlink };
+    }
+    if (this.isUnderWorkingDir(absolutePath)) {
+      if (this.policy.writeAllowed.includes("./")) {
+        return { allowed: true, isSymlink: validationResult.isSymlink };
+      }
+    }
+    const violation = this.createViolation(
+      "filesystem_write_denied",
+      `Write access denied: path does not match any allowed pattern: ${path}`,
+      absolutePath
+    );
+    return { allowed: false, violation, isSymlink: validationResult.isSymlink };
+  }
+  /**
+   * Analyze a command for filesystem operations and validate them
+   */
+  analyzeCommand(command) {
+    const readPaths = [];
+    const writePaths = [];
+    const violations = [];
+    const extractedPaths = this.extractPathsFromCommand(command);
+    const redirectMatches = command.matchAll(/>\s*["']?([^\s"';&|]+)["']?/g);
+    for (const match of redirectMatches) {
+      if (match[1] && !match[1].startsWith("&")) {
+        writePaths.push(match[1]);
+      }
+    }
+    const teeMatches = command.matchAll(
+      /\btee\s+(?:-a\s+)?["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of teeMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const cpMatches = command.matchAll(
+      /\bcp\s+(?:-[a-zA-Z]+\s+)*\S+\s+["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of cpMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const mvMatches = command.matchAll(
+      /\bmv\s+(?:-[a-zA-Z]+\s+)*\S+\s+["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of mvMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const rmMatches = command.matchAll(
+      /\brm\s+(?:-[a-zA-Z]+\s+)*["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of rmMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const mkdirMatches = command.matchAll(
+      /\bmkdir\s+(?:-[a-zA-Z]+\s+)*["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of mkdirMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const rmdirMatches = command.matchAll(
+      /\brmdir\s+(?:-[a-zA-Z]+\s+)*["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of rmdirMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const touchMatches = command.matchAll(/\btouch\s+["']?([^\s"';&|]+)["']?/g);
+    for (const match of touchMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const chmodMatches = command.matchAll(
+      /\bchmod\s+(?:-[a-zA-Z]+\s+)*\S+\s+["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of chmodMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    const chownMatches = command.matchAll(
+      /\bchown\s+(?:-[a-zA-Z]+\s+)*\S+\s+["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of chownMatches) {
+      if (match[1]) writePaths.push(match[1]);
+    }
+    if (!command.includes(">")) {
+      const catMatches = command.matchAll(/\bcat\s+["']?([^\s"';&|]+)["']?/g);
+      for (const match of catMatches) {
+        if (match[1]) readPaths.push(match[1]);
+      }
+    }
+    const headTailMatches = command.matchAll(
+      /\b(?:head|tail)\s+(?:-[a-zA-Z0-9]+\s+)*["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of headTailMatches) {
+      if (match[1]) readPaths.push(match[1]);
+    }
+    const pagerMatches = command.matchAll(
+      /\b(?:less|more)\s+["']?([^\s"';&|]+)["']?/g
+    );
+    for (const match of pagerMatches) {
+      if (match[1]) readPaths.push(match[1]);
+    }
+    for (const path of extractedPaths) {
+      if (!writePaths.includes(path) && !readPaths.includes(path)) {
+        readPaths.push(path);
+      }
+    }
+    const uniqueWritePaths = [...new Set(writePaths)];
+    const uniqueReadPaths = [...new Set(readPaths)];
+    for (const path of uniqueReadPaths) {
+      const result = this.canRead(path);
+      if (!result.allowed && result.violation) {
+        violations.push(result.violation);
+      }
+    }
+    for (const path of uniqueWritePaths) {
+      const result = this.canWrite(path);
+      if (!result.allowed && result.violation) {
+        violations.push(result.violation);
+      }
+    }
+    this.violations.push(...violations);
+    return {
+      readPaths: uniqueReadPaths,
+      writePaths: uniqueWritePaths,
+      violations
+    };
+  }
+  /**
+   * Get all recorded violations
+   */
+  getViolations() {
+    return [...this.violations];
+  }
+  /**
+   * Clear violation history
+   */
+  clearViolations() {
+    this.violations = [];
+  }
+  /**
+   * Extract potential file paths from a command string
+   */
+  extractPathsFromCommand(command) {
+    const paths = [];
+    const quotedMatches = command.matchAll(/["']([^"']+)["']/g);
+    for (const match of quotedMatches) {
+      if (match[1] && this.looksLikePath(match[1])) {
+        paths.push(match[1]);
+      }
+    }
+    const unquotedMatches = command.matchAll(
+      /(?:^|\s)((?:\.\/|\/|\.\.\/)[^\s;&|>]+)/g
+    );
+    for (const match of unquotedMatches) {
+      if (match[1]) {
+        paths.push(match[1]);
+      }
+    }
+    return [...new Set(paths)];
+  }
+  /**
+   * Check if a string looks like a file path
+   */
+  looksLikePath(str) {
+    return str.includes("/") || str.startsWith(".") || str.endsWith(".txt") || str.endsWith(".json") || str.endsWith(".js") || str.endsWith(".ts") || str.endsWith(".md");
+  }
+  /**
+   * Resolve a path to absolute, following symlinks and validating boundaries.
+   * Uses safe resolution to prevent symlink traversal attacks.
+   */
+  resolvePath(path) {
+    const validationResult = safeResolvePath(
+      path,
+      this.workingDir,
+      this.workingDir
+    );
+    if (!validationResult.valid) {
+      return validationResult.resolvedPath;
+    }
+    return validationResult.resolvedPath;
+  }
+  /**
+   * Get path relative to working directory
+   */
+  getRelativePath(absolutePath) {
+    return relative(this.workingDir, absolutePath);
+  }
+  /**
+   * Check if a path is under the working directory
+   */
+  isUnderWorkingDir(absolutePath) {
+    const rel = relative(this.workingDir, absolutePath);
+    return !rel.startsWith("..") && !isAbsolute(rel);
+  }
+  /**
+   * Check if a path matches any of the given patterns
+   */
+  matchesPattern(path, patterns) {
+    for (const pattern of patterns) {
+      if (pattern === "*") {
+        return true;
+      }
+      if (pattern === "./") {
+        if (this.isUnderWorkingDir(this.resolvePath(path))) {
+          return true;
+        }
+        continue;
+      }
+      if (minimatch(path, pattern, { dot: true }) || minimatch(path, `**/${pattern}`, { dot: true })) {
+        return true;
+      }
+      const pathDir = dirname(path);
+      if (minimatch(pathDir, pattern, { dot: true })) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Create a violation record
+   */
+  createViolation(type, details, path) {
+    return {
+      type,
+      timestamp: Date.now(),
+      command: "",
+      // Will be set by caller
+      details,
+      path
+    };
+  }
+}
+export {
+  FilesystemBoundary
+};
+//# sourceMappingURL=filesystemBoundary.js.map

package/dist/services/sandbox/filesystemBoundary.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/services/sandbox/filesystemBoundary.ts"],
+  "sourcesContent": ["/**\n * Filesystem Boundary Service\n *\n * Validates file system access against configured policies.\n * Provides path validation and access control for sandboxed execution.\n */\n\nimport { resolve, relative, isAbsolute, dirname } from 'path'\nimport { minimatch } from 'minimatch'\nimport { safeResolvePath } from '../../utils/safePath'\nimport type { FilesystemPolicy, SandboxViolation } from './types'\n\n/**\n * Result of a filesystem access check\n */\nexport interface FilesystemCheckResult {\n  allowed: boolean\n  violation?: SandboxViolation\n  /**\n   * Whether the path or any component in its chain is a symbolic link.\n   * Set when symlink traversal protection detects symlinks.\n   */\n  isSymlink?: boolean\n}\n\n/**\n * Filesystem Boundary Validator\n */\nexport class FilesystemBoundary {\n  private policy: FilesystemPolicy\n  private workingDir: string\n  private violations: SandboxViolation[] = []\n\n  constructor(policy: FilesystemPolicy, workingDir: string) {\n    this.policy = policy\n    this.workingDir = resolve(workingDir)\n  }\n\n  /**\n   * Update the filesystem policy\n   */\n  updatePolicy(policy: Partial<FilesystemPolicy>): void {\n    this.policy = { ...this.policy, ...policy }\n  }\n\n  /**\n   * Update the working directory\n   */\n  setWorkingDir(dir: string): void {\n    this.workingDir = resolve(dir)\n  }\n\n  /**\n   * Check if a path can be read\n   */\n  canRead(path: string): FilesystemCheckResult {\n    // Use safe resolution to detect symlinks and validate boundaries\n    const validationResult = safeResolvePath(\n      path,\n      this.workingDir,\n      this.workingDir,\n    )\n    const absolutePath = validationResult.resolvedPath\n\n    // If safe resolution detected a boundary escape, deny access\n    if (!validationResult.valid) {\n      const violation = this.createViolation(\n        'filesystem_path_denied',\n        `Symlink traversal detected: ${validationResult.error}`,\n        absolutePath,\n      )\n      return { allowed: false, violation, isSymlink: true }\n    }\n\n    const relativePath = this.getRelativePath(absolutePath)\n\n    // Check denied patterns first (highest priority)\n    if (this.matchesPattern(relativePath, this.policy.denied)) {\n      const violation = this.createViolation(\n        'filesystem_path_denied',\n        `Read access denied for path matching deny pattern: ${path}`,\n        absolutePath,\n      )\n      return {\n        allowed: false,\n        violation,\n        isSymlink: validationResult.isSymlink,\n      }\n    }\n\n    // Check if path matches read-allowed patterns\n    if (this.matchesPattern(relativePath, this.policy.readAllowed)) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    // Also check with absolute path\n    if (this.matchesPattern(absolutePath, this.policy.readAllowed)) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    // Wildcard allows all reads\n    if (this.policy.readAllowed.includes('*')) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    const violation = this.createViolation(\n      'filesystem_read_denied',\n      `Read access denied: path does not match any allowed pattern: ${path}`,\n      absolutePath,\n    )\n    return { allowed: false, violation, isSymlink: validationResult.isSymlink }\n  }\n\n  /**\n   * Check if a path can be written\n   */\n  canWrite(path: string): FilesystemCheckResult {\n    // Use safe resolution to detect symlinks and validate boundaries\n    const validationResult = safeResolvePath(\n      path,\n      this.workingDir,\n      this.workingDir,\n    )\n    const absolutePath = validationResult.resolvedPath\n\n    // If safe resolution detected a boundary escape, deny access\n    if (!validationResult.valid) {\n      const violation = this.createViolation(\n        'filesystem_path_denied',\n        `Symlink traversal detected: ${validationResult.error}`,\n        absolutePath,\n      )\n      return { allowed: false, violation, isSymlink: true }\n    }\n\n    const relativePath = this.getRelativePath(absolutePath)\n\n    // Check denied patterns first (highest priority)\n    if (this.matchesPattern(relativePath, this.policy.denied)) {\n      const violation = this.createViolation(\n        'filesystem_path_denied',\n        `Write access denied for path matching deny pattern: ${path}`,\n        absolutePath,\n      )\n      return {\n        allowed: false,\n        violation,\n        isSymlink: validationResult.isSymlink,\n      }\n    }\n\n    // Check if path matches write-allowed patterns\n    if (this.matchesPattern(relativePath, this.policy.writeAllowed)) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    // Also check with absolute path\n    if (this.matchesPattern(absolutePath, this.policy.writeAllowed)) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    // Wildcard allows all writes\n    if (this.policy.writeAllowed.includes('*')) {\n      return { allowed: true, isSymlink: validationResult.isSymlink }\n    }\n\n    // Check if path is under working directory (default write location)\n    if (this.isUnderWorkingDir(absolutePath)) {\n      // Only allow if './' is in writeAllowed\n      if (this.policy.writeAllowed.includes('./')) {\n        return { allowed: true, isSymlink: validationResult.isSymlink }\n      }\n    }\n\n    const violation = this.createViolation(\n      'filesystem_write_denied',\n      `Write access denied: path does not match any allowed pattern: ${path}`,\n      absolutePath,\n    )\n    return { allowed: false, violation, isSymlink: validationResult.isSymlink }\n  }\n\n  /**\n   * Analyze a command for filesystem operations and validate them\n   */\n  analyzeCommand(command: string): {\n    readPaths: string[]\n    writePaths: string[]\n    violations: SandboxViolation[]\n  } {\n    const readPaths: string[] = []\n    const writePaths: string[] = []\n    const violations: SandboxViolation[] = []\n\n    // Extract potential paths from command\n    const extractedPaths = this.extractPathsFromCommand(command)\n\n    // Detect redirect write operations first (highest priority)\n    // Match patterns like: command > file, command >> file\n    const redirectMatches = command.matchAll(/>\\s*[\"']?([^\\s\"';&|]+)[\"']?/g)\n    for (const match of redirectMatches) {\n      if (match[1] && !match[1].startsWith('&')) {\n        writePaths.push(match[1])\n      }\n    }\n\n    // Detect write operations with specific commands\n    // tee command\n    const teeMatches = command.matchAll(\n      /\\btee\\s+(?:-a\\s+)?[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of teeMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // cp command - target is the last argument\n    const cpMatches = command.matchAll(\n      /\\bcp\\s+(?:-[a-zA-Z]+\\s+)*\\S+\\s+[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of cpMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // mv command - target is the last argument\n    const mvMatches = command.matchAll(\n      /\\bmv\\s+(?:-[a-zA-Z]+\\s+)*\\S+\\s+[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of mvMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // rm command\n    const rmMatches = command.matchAll(\n      /\\brm\\s+(?:-[a-zA-Z]+\\s+)*[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of rmMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // mkdir command\n    const mkdirMatches = command.matchAll(\n      /\\bmkdir\\s+(?:-[a-zA-Z]+\\s+)*[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of mkdirMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // rmdir command\n    const rmdirMatches = command.matchAll(\n      /\\brmdir\\s+(?:-[a-zA-Z]+\\s+)*[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of rmdirMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // touch command\n    const touchMatches = command.matchAll(/\\btouch\\s+[\"']?([^\\s\"';&|]+)[\"']?/g)\n    for (const match of touchMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // chmod command - target is the last argument\n    const chmodMatches = command.matchAll(\n      /\\bchmod\\s+(?:-[a-zA-Z]+\\s+)*\\S+\\s+[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of chmodMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // chown command - target is the last argument\n    const chownMatches = command.matchAll(\n      /\\bchown\\s+(?:-[a-zA-Z]+\\s+)*\\S+\\s+[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of chownMatches) {\n      if (match[1]) writePaths.push(match[1])\n    }\n\n    // Detect read operations\n    // cat command (when not redirecting)\n    if (!command.includes('>')) {\n      const catMatches = command.matchAll(/\\bcat\\s+[\"']?([^\\s\"';&|]+)[\"']?/g)\n      for (const match of catMatches) {\n        if (match[1]) readPaths.push(match[1])\n      }\n    }\n\n    // head/tail commands\n    const headTailMatches = command.matchAll(\n      /\\b(?:head|tail)\\s+(?:-[a-zA-Z0-9]+\\s+)*[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of headTailMatches) {\n      if (match[1]) readPaths.push(match[1])\n    }\n\n    // less/more commands\n    const pagerMatches = command.matchAll(\n      /\\b(?:less|more)\\s+[\"']?([^\\s\"';&|]+)[\"']?/g,\n    )\n    for (const match of pagerMatches) {\n      if (match[1]) readPaths.push(match[1])\n    }\n\n    // Add extracted paths that might be read (if not already in writePaths)\n    for (const path of extractedPaths) {\n      if (!writePaths.includes(path) && !readPaths.includes(path)) {\n        readPaths.push(path)\n      }\n    }\n\n    // Deduplicate paths\n    const uniqueWritePaths = [...new Set(writePaths)]\n    const uniqueReadPaths = [...new Set(readPaths)]\n\n    // Validate all paths\n    for (const path of uniqueReadPaths) {\n      const result = this.canRead(path)\n      if (!result.allowed && result.violation) {\n        violations.push(result.violation)\n      }\n    }\n\n    for (const path of uniqueWritePaths) {\n      const result = this.canWrite(path)\n      if (!result.allowed && result.violation) {\n        violations.push(result.violation)\n      }\n    }\n\n    // Store violations\n    this.violations.push(...violations)\n\n    return {\n      readPaths: uniqueReadPaths,\n      writePaths: uniqueWritePaths,\n      violations,\n    }\n  }\n\n  /**\n   * Get all recorded violations\n   */\n  getViolations(): SandboxViolation[] {\n    return [...this.violations]\n  }\n\n  /**\n   * Clear violation history\n   */\n  clearViolations(): void {\n    this.violations = []\n  }\n\n  /**\n   * Extract potential file paths from a command string\n   */\n  private extractPathsFromCommand(command: string): string[] {\n    const paths: string[] = []\n\n    // Match quoted strings\n    const quotedMatches = command.matchAll(/[\"']([^\"']+)[\"']/g)\n    for (const match of quotedMatches) {\n      if (match[1] && this.looksLikePath(match[1])) {\n        paths.push(match[1])\n      }\n    }\n\n    // Match unquoted paths (starting with ./ or / or containing /)\n    const unquotedMatches = command.matchAll(\n      /(?:^|\\s)((?:\\.\\/|\\/|\\.\\.\\/)[^\\s;&|>]+)/g,\n    )\n    for (const match of unquotedMatches) {\n      if (match[1]) {\n        paths.push(match[1])\n      }\n    }\n\n    return [...new Set(paths)] // Deduplicate\n  }\n\n  /**\n   * Check if a string looks like a file path\n   */\n  private looksLikePath(str: string): boolean {\n    return (\n      str.includes('/') ||\n      str.startsWith('.') ||\n      str.endsWith('.txt') ||\n      str.endsWith('.json') ||\n      str.endsWith('.js') ||\n      str.endsWith('.ts') ||\n      str.endsWith('.md')\n    )\n  }\n\n  /**\n   * Resolve a path to absolute, following symlinks and validating boundaries.\n   * Uses safe resolution to prevent symlink traversal attacks.\n   */\n  private resolvePath(path: string): string {\n    // Use safe path resolution to follow symlinks and validate boundaries\n    const validationResult = safeResolvePath(\n      path,\n      this.workingDir,\n      this.workingDir,\n    )\n\n    if (!validationResult.valid) {\n      // If validation fails, still return the attempted path for error reporting\n      // The caller (canRead/canWrite) will handle the violation\n      return validationResult.resolvedPath\n    }\n\n    return validationResult.resolvedPath\n  }\n\n  /**\n   * Get path relative to working directory\n   */\n  private getRelativePath(absolutePath: string): string {\n    return relative(this.workingDir, absolutePath)\n  }\n\n  /**\n   * Check if a path is under the working directory\n   */\n  private isUnderWorkingDir(absolutePath: string): boolean {\n    const rel = relative(this.workingDir, absolutePath)\n    return !rel.startsWith('..') && !isAbsolute(rel)\n  }\n\n  /**\n   * Check if a path matches any of the given patterns\n   */\n  private matchesPattern(path: string, patterns: string[]): boolean {\n    for (const pattern of patterns) {\n      // Handle special '*' pattern for everything\n      if (pattern === '*') {\n        return true\n      }\n\n      // Handle './' for current directory\n      if (pattern === './') {\n        if (this.isUnderWorkingDir(this.resolvePath(path))) {\n          return true\n        }\n        continue\n      }\n\n      // Use minimatch for glob patterns\n      if (\n        minimatch(path, pattern, { dot: true }) ||\n        minimatch(path, `**/${pattern}`, { dot: true })\n      ) {\n        return true\n      }\n\n      // Check if pattern matches directory\n      const pathDir = dirname(path)\n      if (minimatch(pathDir, pattern, { dot: true })) {\n        return true\n      }\n    }\n    return false\n  }\n\n  /**\n   * Create a violation record\n   */\n  private createViolation(\n    type: SandboxViolation['type'],\n    details: string,\n    path: string,\n  ): SandboxViolation {\n    return {\n      type,\n      timestamp: Date.now(),\n      command: '', // Will be set by caller\n      details,\n      path,\n    }\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,SAAS,UAAU,YAAY,eAAe;AACvD,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAmBzB,MAAM,mBAAmB;AAAA,EACtB;AAAA,EACA;AAAA,EACA,aAAiC,CAAC;AAAA,EAE1C,YAAY,QAA0B,YAAoB;AACxD,SAAK,SAAS;AACd,SAAK,aAAa,QAAQ,UAAU;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAAyC;AACpD,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,KAAmB;AAC/B,SAAK,aAAa,QAAQ,GAAG;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,MAAqC;AAE3C,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,eAAe,iBAAiB;AAGtC,QAAI,CAAC,iBAAiB,OAAO;AAC3B,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,+BAA+B,iBAAiB,KAAK;AAAA,QACrD;AAAA,MACF;AACA,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,WAAW,KAAK;AAAA,IACtD;AAEA,UAAM,eAAe,KAAK,gBAAgB,YAAY;AAGtD,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,MAAM,GAAG;AACzD,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,sDAAsD,IAAI;AAAA,QAC1D;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAAA;AAAA,QACA,WAAW,iBAAiB;AAAA,MAC9B;AAAA,IACF;AAGA,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,WAAW,GAAG;AAC9D,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAGA,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,WAAW,GAAG;AAC9D,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAGA,QAAI,KAAK,OAAO,YAAY,SAAS,GAAG,GAAG;AACzC,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAEA,UAAM,YAAY,KAAK;AAAA,MACrB;AAAA,MACA,gEAAgE,IAAI;AAAA,MACpE;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,WAAW,WAAW,iBAAiB,UAAU;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,SAAS,MAAqC;AAE5C,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,eAAe,iBAAiB;AAGtC,QAAI,CAAC,iBAAiB,OAAO;AAC3B,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,+BAA+B,iBAAiB,KAAK;AAAA,QACrD;AAAA,MACF;AACA,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,WAAW,KAAK;AAAA,IACtD;AAEA,UAAM,eAAe,KAAK,gBAAgB,YAAY;AAGtD,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,MAAM,GAAG;AACzD,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,uDAAuD,IAAI;AAAA,QAC3D;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAAA;AAAA,QACA,WAAW,iBAAiB;AAAA,MAC9B;AAAA,IACF;AAGA,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,YAAY,GAAG;AAC/D,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAGA,QAAI,KAAK,eAAe,cAAc,KAAK,OAAO,YAAY,GAAG;AAC/D,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAGA,QAAI,KAAK,OAAO,aAAa,SAAS,GAAG,GAAG;AAC1C,aAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,IAChE;AAGA,QAAI,KAAK,kBAAkB,YAAY,GAAG;AAExC,UAAI,KAAK,OAAO,aAAa,SAAS,IAAI,GAAG;AAC3C,eAAO,EAAE,SAAS,MAAM,WAAW,iBAAiB,UAAU;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,YAAY,KAAK;AAAA,MACrB;AAAA,MACA,iEAAiE,IAAI;AAAA,MACrE;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,WAAW,WAAW,iBAAiB,UAAU;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,SAIb;AACA,UAAM,YAAsB,CAAC;AAC7B,UAAM,aAAuB,CAAC;AAC9B,UAAM,aAAiC,CAAC;AAGxC,UAAM,iBAAiB,KAAK,wBAAwB,OAAO;AAI3D,UAAM,kBAAkB,QAAQ,SAAS,8BAA8B;AACvE,eAAW,SAAS,iBAAiB;AACnC,UAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,GAAG;AACzC,mBAAW,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1B;AAAA,IACF;AAIA,UAAM,aAAa,QAAQ;AAAA,MACzB;AAAA,IACF;AACA,eAAW,SAAS,YAAY;AAC9B,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,eAAW,SAAS,WAAW;AAC7B,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,eAAW,SAAS,WAAW;AAC7B,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,eAAW,SAAS,WAAW;AAC7B,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,eAAe,QAAQ;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,eAAe,QAAQ;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,eAAe,QAAQ,SAAS,oCAAoC;AAC1E,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,eAAe,QAAQ;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAGA,UAAM,eAAe,QAAQ;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,YAAW,KAAK,MAAM,CAAC,CAAC;AAAA,IACxC;AAIA,QAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,YAAM,aAAa,QAAQ,SAAS,kCAAkC;AACtE,iBAAW,SAAS,YAAY;AAC9B,YAAI,MAAM,CAAC,EAAG,WAAU,KAAK,MAAM,CAAC,CAAC;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,kBAAkB,QAAQ;AAAA,MAC9B;AAAA,IACF;AACA,eAAW,SAAS,iBAAiB;AACnC,UAAI,MAAM,CAAC,EAAG,WAAU,KAAK,MAAM,CAAC,CAAC;AAAA,IACvC;AAGA,UAAM,eAAe,QAAQ;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,CAAC,EAAG,WAAU,KAAK,MAAM,CAAC,CAAC;AAAA,IACvC;AAGA,eAAW,QAAQ,gBAAgB;AACjC,UAAI,CAAC,WAAW,SAAS,IAAI,KAAK,CAAC,UAAU,SAAS,IAAI,GAAG;AAC3D,kBAAU,KAAK,IAAI;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,mBAAmB,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC;AAChD,UAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAG9C,eAAW,QAAQ,iBAAiB;AAClC,YAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,UAAI,CAAC,OAAO,WAAW,OAAO,WAAW;AACvC,mBAAW,KAAK,OAAO,SAAS;AAAA,MAClC;AAAA,IACF;AAEA,eAAW,QAAQ,kBAAkB;AACnC,YAAM,SAAS,KAAK,SAAS,IAAI;AACjC,UAAI,CAAC,OAAO,WAAW,OAAO,WAAW;AACvC,mBAAW,KAAK,OAAO,SAAS;AAAA,MAClC;AAAA,IACF;AAGA,SAAK,WAAW,KAAK,GAAG,UAAU;AAElC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,YAAY;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAoC;AAClC,WAAO,CAAC,GAAG,KAAK,UAAU;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAwB;AACtB,SAAK,aAAa,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKQ,wBAAwB,SAA2B;AACzD,UAAM,QAAkB,CAAC;AAGzB,UAAM,gBAAgB,QAAQ,SAAS,mBAAmB;AAC1D,eAAW,SAAS,eAAe;AACjC,UAAI,MAAM,CAAC,KAAK,KAAK,cAAc,MAAM,CAAC,CAAC,GAAG;AAC5C,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,kBAAkB,QAAQ;AAAA,MAC9B;AAAA,IACF;AACA,eAAW,SAAS,iBAAiB;AACnC,UAAI,MAAM,CAAC,GAAG;AACZ,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAEA,WAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,KAAsB;AAC1C,WACE,IAAI,SAAS,GAAG,KAChB,IAAI,WAAW,GAAG,KAClB,IAAI,SAAS,MAAM,KACnB,IAAI,SAAS,OAAO,KACpB,IAAI,SAAS,KAAK,KAClB,IAAI,SAAS,KAAK,KAClB,IAAI,SAAS,KAAK;AAAA,EAEtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,YAAY,MAAsB;AAExC,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAEA,QAAI,CAAC,iBAAiB,OAAO;AAG3B,aAAO,iBAAiB;AAAA,IAC1B;AAEA,WAAO,iBAAiB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,cAA8B;AACpD,WAAO,SAAS,KAAK,YAAY,YAAY;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,cAA+B;AACvD,UAAM,MAAM,SAAS,KAAK,YAAY,YAAY;AAClD,WAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,MAAc,UAA6B;AAChE,eAAW,WAAW,UAAU;AAE9B,UAAI,YAAY,KAAK;AACnB,eAAO;AAAA,MACT;AAGA,UAAI,YAAY,MAAM;AACpB,YAAI,KAAK,kBAAkB,KAAK,YAAY,IAAI,CAAC,GAAG;AAClD,iBAAO;AAAA,QACT;AACA;AAAA,MACF;AAGA,UACE,UAAU,MAAM,SAAS,EAAE,KAAK,KAAK,CAAC,KACtC,UAAU,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK,KAAK,CAAC,GAC9C;AACA,eAAO;AAAA,MACT;AAGA,YAAM,UAAU,QAAQ,IAAI;AAC5B,UAAI,UAAU,SAAS,SAAS,EAAE,KAAK,KAAK,CAAC,GAAG;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,gBACN,MACA,SACA,MACkB;AAClB,WAAO;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,SAAS;AAAA;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["violation"]
+}

package/dist/services/sandbox/index.js

@@ -0,0 +1,14 @@
+export * from "./types.js";
+export * from "./filesystemBoundary.js";
+export * from "./networkProxy.js";
+import {
+  SandboxController,
+  getSandboxController,
+  resetSandboxController
+} from "./sandboxController.js";
+export {
+  SandboxController,
+  getSandboxController,
+  resetSandboxController
+};
+//# sourceMappingURL=index.js.map

package/dist/services/sandbox/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/services/sandbox/index.ts"],
+  "sourcesContent": ["/**\n * Sandbox System\n *\n * Provides OS-level isolation for command execution.\n *\n * Features:\n * - Filesystem boundary enforcement\n * - Network access control\n * - Process isolation (macOS seatbelt, Linux bubblewrap, Docker)\n * - Violation tracking and reporting\n *\n * Usage:\n * ```typescript\n * import { getSandboxController } from '@services/sandbox'\n *\n * const sandbox = getSandboxController('/path/to/project')\n * sandbox.updateConfig({ enabled: true })\n *\n * const result = await sandbox.execute('npm install', '/path/to/project')\n * if (result.blocked) {\n *   console.log('Command blocked:', result.blockReason)\n * }\n * ```\n */\n\nexport * from './types'\nexport * from './filesystemBoundary'\nexport * from './networkProxy'\nexport {\n  SandboxController,\n  getSandboxController,\n  resetSandboxController,\n} from './sandboxController'\n"],
+  "mappings": "AAyBA,cAAc;AACd,cAAc;AACd,cAAc;AACd;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "names": []
+}