@xioflow/kernel 0.2.0 → 0.4.0

package/README.md

@@ -2,15 +2,18 @@
 
 [![CI](https://github.com/Xio-Shark/xioflow/actions/workflows/ci.yml/badge.svg)](https://github.com/Xio-Shark/xioflow/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@xioflow/kernel.svg)](https://www.npmjs.com/package/@xioflow/kernel)
-[![Node](https://img.shields.io/badge/Node.js-22.5%2B-green.svg)](https://nodejs.org/)
+[![Node](https://img.shields.io/badge/Node.js-22.13%2B-green.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
-[![Docs](https://img.shields.io/badge/spec-ARCHITECTURE.md-informational.svg)](./ARCHITECTURE.md)
+[![Docs (EN)](https://img.shields.io/badge/spec-ARCHITECTURE.en.md-informational.svg)](./ARCHITECTURE.en.md)
+[![Docs (ZH)](https://img.shields.io/badge/spec-ARCHITECTURE.md-informational.svg)](./ARCHITECTURE.md)
 
-A supervised execution kernel for AI agent runtimes. Zero runtime dependencies.
+A supervised execution kernel for AI agent runtimes. Zero runtime dependencies. (See [Architecture & Protocol Specification (EN)](./ARCHITECTURE.en.md) / [中文规范](./ARCHITECTURE.md)).
 
 Agent runtimes usually call `spawn()` (or `exec()`) and hope for the best. When the host crashes mid-tool-call, or a cancel cannot be confirmed, they are left with orphan processes, double-applied side effects, and no honest record of what actually happened. This kernel makes those states first-class instead of silent.
 
-[xiocode](https://github.com/Xio-Shark/xiocode), the reference distribution, runs its supervised commands on this kernel by default on Node 22.5+ — the equivalence suite below is what made that switch safe to make.
+[xiocode](https://github.com/Xio-Shark/xiocode), the reference distribution, runs its supervised commands on this kernel by default — the equivalence suite below is what made that switch safe to make.
+
+Besides one-shot commands, the kernel supervises long-running services (MCP stdio servers, dev servers), makes operations idempotent by `opId` for durable engines (Temporal, LangGraph), and snapshots, rolls back and forks the workspace so an agent's file changes can be undone per step.
 
 ## Guarantees
 
@@ -21,14 +24,17 @@ Agent runtimes usually call `spawn()` (or `exec()`) and hope for the best. When
 | No premature release | Exclusive resource leases are released only after the platform driver confirms the process is gone. An unconfirmed stop keeps the lease and escalates to `indeterminate`. |
 | No silent output loss | In-memory output is capped by `maxOutputBytes` (default 10 MiB); each stream is spilled to `<domain>/artifacts/<opId>-stdout.log` / `-stderr.log`, `fsync`ed, and hashed. Truncation is reported per stream (`stdoutTruncated` / `stderrTruncated`) with `stdoutRef` / `stderrRef`, `stdoutBytes` / `stderrBytes` and `stdoutHash` / `stderrHash`; `isTruncated` / `outputRef` / `outputHash` remain as aggregate compatibility fields. |
 | No implicit environment | `envWhiteList` is exact: whatever you pass is what the child gets, with no injected `PATH`. Without a whitelist the child inherits `process.env`, unless you pass `inheritEnv: false` to get an empty environment. |
-| No orphan leak | Termination escalates SIGINT to SIGTERM to SIGKILL across the process group, then re-enumerates descendants. Escaped (`setsid`) survivors are reported honestly as `{ stopped: false, residualPids: [...] }` instead of a fake success. |
+| No orphan leak | Termination escalates SIGINT to SIGTERM to SIGKILL across the process group, then re-enumerates descendants. Escaped (`setsid`) survivors are reported honestly as `{ stopped: 'cannot_determine', residualPids: [...] }` instead of a fake success. If the group is confirmed empty but the output pipes are still held by a process the driver never saw, the operation is `indeterminate`, not `succeeded`. |
+| No blind retry | Resubmitting an `opId` with the same input fingerprint joins the in-flight execution or replays the recorded result (`replayed: true`); an `indeterminate` result is returned as-is and never re-executed. A different fingerprint throws `OperationIdConflictError`. |
+| No out-of-scope rollback | A rollback only rewrites and deletes files inside the snapshot's declared roots, never touches ignored files unless they were captured, and is verified by fingerprint. `coverage: 'complete'` is claimed only when every operation since the snapshot ran under a confinement driver. |
 | No split brain | A domain has one active owner, held by an exclusive lock file plus a heartbeat lease. Stale owners are fenced by an epoch counter; their writes are rejected. |
 
 ## Requirements
 
-- Node.js >= 22.5 (`node:sqlite`). Verified on Node v24.14.0. `node:sqlite` is still marked experimental upstream, so Node prints an `ExperimentalWarning`; that is expected.
+- Node.js >= 22.13 (`node:sqlite` without a flag). CI covers Node 22.13 and 24 on Ubuntu and macOS. `node:sqlite` is still marked experimental upstream, so Node prints an `ExperimentalWarning`; that is expected.
 - Linux and macOS. Descendant enumeration and group termination use `ps(1)` and POSIX process groups.
-- Windows is not supported in 0.1. There the driver reports `processGroupKill: false` and `descendantEnumeration: 'none'` rather than pretending it can contain processes.
+- Snapshots need `git` on `PATH` and a git working tree. Confinement is optional and uses `sandbox-exec` (macOS), `bubblewrap` (Linux) or `srt` when available.
+- Windows is not supported. There the driver reports `processGroupKill: false` and `descendantEnumeration: 'none'` rather than pretending it can contain processes.
 
 ## Install
 
@@ -38,6 +44,36 @@ npm install @xioflow/kernel
 
 ## Quickstart
 
+### 1. Simplest Usage (`quickRun`)
+
+For standard tool calls and durable activity execution, `quickRun` automatically manages domain acquisition, Task and Run records, and lock lifecycles:
+
+```js
+import { quickRun } from '@xioflow/kernel';
+
+// 1. One-line supervised execution
+const result = await quickRun({
+  execPath: 'npm',
+  args: ['test'],
+  cwd: '/path/to/workspace',
+});
+
+console.log(result.status, result.exitCode, result.stdout);
+
+// 2. Idempotent execution (safe retry for Temporal / LangGraph / durable workflows)
+const idemResult = await quickRun(
+  { execPath: 'git', args: ['commit', '-m', 'chore: update'], cwd: '/path/to/workspace' },
+  { opId: 'workflow-step-42' } // Passing opId guarantees at-most-once execution across retries
+);
+if (idemResult.replayed) {
+  console.log('Result retrieved from journal without re-executing process');
+}
+```
+
+### 2. Full Architecture & Fine-Grained Supervision
+
+When you need granular control over Tasks, Runs, resource locks, streaming output, or multi-phase workflows:
+
 ```js
 import { ExecutionDomain, NodePlatformDriver, ProcessSupervisor } from '@xioflow/kernel';
 
@@ -89,6 +125,9 @@ domain.close(); // releases the owner lease and the domain lock
 
 To cancel, call `await supervisor.cancelOperation('op-1', graceMs)`. It returns `{ stopped, scope, residualPids? }`. The pending `executeProcess` promise then resolves with `status: 'cancelled'`, or with `status: 'indeterminate'` when the driver cannot confirm that the process actually stopped, in which case its leases stay locked.
 
+> **Note on In-Flight Join and Cancellation**:
+> When an in-flight operation with the same `opId` and fingerprint is joined concurrently, passing an `abortSignal` to the secondary caller only cancels the secondary caller's own wait promise—it never aborts the underlying process or the primary caller's execution. To deliberately terminate the underlying process, explicitly call `supervisor.cancelOperation(opId)`.
+
 ## Crash recovery
 
 After a restart, reacquire the domain and run the recovery engine:
@@ -111,11 +150,73 @@ For every unfinished operation, recovery verifies the recorded process identity
 
 The kernel records execution facts (state, output evidence, artifact references) and refuses to guess. Whether a failed test that was later fixed counts as business success is the distribution's decision, not the kernel's.
 
+An `indeterminate` operation leaves the kernel only through `domain.adjudicate(opId, verdict, actor, note)`, which re-scans for residual processes, refuses `confirmed_stopped` while any are alive (or while the scan itself fails), and journals the decision before releasing leases.
+
+## Long-running services
+
+MCP stdio servers, dev servers and watchers are supervised as services. Each instance is a kernel operation (`<serviceId>#<n>`), so a host crash leaves a record that recovery can act on:
+
+```js
+const service = await supervisor.startService({
+  serviceId: 'mcp-fs',
+  runId: 'run-1',
+  command: { execPath: 'node', args: ['server.mjs'], cwd: '/path/to/workspace' },
+  readiness: { stdoutLine: /listening/, timeoutMs: 5000 }, // or 'spawned'
+  restart: { policy: 'on-failure', maxRestarts: 3, backoffMs: 500 },
+  requiredResources: ['port:3000'],
+});
+await service.ready;          // rejects if the readiness line never appears; the instance is then stopped
+service.stdin.write('...');   // stdin stays open (stdinMode: 'stream'); stdout is passed through
+await service.stop(2000);
+```
+
+Leases are held by the service across restart backoff. A stop the driver cannot confirm records the instance as `indeterminate`, journals `SERVICE_FAILED { reason: 'stop_unconfirmed' }` and keeps the leases. After a host crash, `recover()` stops surviving instances and never restarts them automatically. See [`examples/mcp-stdio-transport`](./examples/mcp-stdio-transport) for an MCP SDK `Transport` on top of this.
+
+## Snapshots, rollback and forks
+
+The git-shadow driver snapshots declared roots without touching the user's index, HEAD or branch, and pins each snapshot under `refs/xioflow/snapshots/<id>`:
+
+```js
+const snap = await supervisor.captureSnapshot({ runId: 'run-1', opId: 'snap-1', roots: ['/path/to/workspace/src'] });
+
+// ... the agent edits files ...
+
+const rb = await supervisor.rollback({ runId: 'run-1', opId: 'rb-1', snapshotId: snap.snapshot.id });
+console.log(rb.status, rb.coverage, rb.outOfScopeEffects); // e.g. 'restored', 'declared_roots', 'possible'
+
+// Fork the snapshot into an independent worktree for a parallel candidate:
+await supervisor.materialize(snap.snapshot.id, '/tmp/candidate-a');
+await supervisor.dematerialize('/tmp/candidate-a');
+```
+
+Rollback only rewrites and deletes files inside the snapshot's roots and leaves ignored files alone unless the snapshot used `includeIgnored: true`. It is verified by fingerprint against the snapshot tree. `coverage` is `complete` only when every operation since the snapshot ran confined; otherwise it is `declared_roots` with `outOfScopeEffects: 'possible'`.
+
+To make `complete` reachable, bind operations to a capability and run them confined:
+
+```js
+const cap = domain.issueCapability(
+  { write: ['/path/to/workspace/src'], exclusive: ['workspace:write:/path/to/workspace/src'] },
+  'my-agent-policy',
+  10 * 60_000,
+);
+await supervisor.executeProcess({
+  runId: 'run-1',
+  opId: 'op-edit',
+  name: 'codegen',
+  command: { execPath: 'node', args: ['../codegen.mjs'], cwd: '/path/to/workspace/src' },
+  // mutation roots default to cwd; pass mutationRoots to declare others
+  capabilityId: cap.id,  // out-of-scope resources or paths are rejected at admission
+  confinement: true,     // sandbox-exec / bubblewrap / srt, whichever is available
+});
+```
+
+A capability can be narrowed with `domain.attenuate`, and revoked with `domain.revokeCapability`. Confinement exists so the rollback coverage claim is true. It is not a security boundary.
+
 ## Design notes
 
 ### Verify your own runtime
 
-The package ships the same 18-item contract suite that the kernel itself is tested against, so an embedding runtime can prove its consumer honors these guarantees:
+The package ships the same 44-item contract suite that the kernel itself is tested against, so an embedding runtime can prove its consumer honors these guarantees:
 
 ```js
 import { defineContractTestSuite } from '@xioflow/kernel/testing';
@@ -137,31 +238,31 @@ defineContractTestSuite('My Agent Runtime', async () => ({
 - When the root process exits while a descendant still holds its pipes, the supervisor reaps the process group and reports the root's real exit facts with `residualProcessesReaped: true`, instead of blocking the operation until its timeout.
 - A spawn failure is reported both as `status: 'failed'`/`exitCode: 127` and as `spawnFailure` with the underlying error message, so embedders can tell "the binary could not start" apart from "the child exited 127".
 - `onStreamChunk(stream, chunk)` forwards raw stdout/stderr chunks while the process runs, so a caller can render live output. A throwing callback never aborts the drain; the first error is recorded as `streamCallbackError`.
-- Hard resource requests (`maxMemoryBytes`, `maxPids`, `maxCpuTimeMs` with `enforcement: 'hard'`) are rejected at admission with `UnsupportedCapabilityError` on platforms that cannot enforce them, instead of degrading silently. The remaining capability flags are reported truthfully for callers to inspect, but are not enforced by admission in 0.1.
-- Protocol specification: [`ARCHITECTURE.md`](./ARCHITECTURE.md) (Chinese). It describes the target design; the phased plan and the spec-vs-implementation gap table live in [`ROADMAP.md`](./ROADMAP.md).
+- Hard resource requests (`maxMemoryBytes`, `maxPids`, `maxCpuTimeMs` with `enforcement: 'hard'`) are rejected at admission with `UnsupportedCapabilityError` on platforms that cannot enforce them, instead of degrading silently. The remaining capability flags are reported truthfully for callers to inspect, but are not enforced by admission yet.
+- Protocol specification: [`ARCHITECTURE.md`](./ARCHITECTURE.md) (Chinese, complete) and [`ARCHITECTURE.en.md`](./ARCHITECTURE.en.md) (English, §0, §3 and §7). They describe the target design; the phased plan and the spec-vs-implementation gap table live in [`ROADMAP.md`](./ROADMAP.md).
 
 ## Status
 
-0.1.5, pre-1.0: the API may change. Not implemented yet: Linux cgroup v2 backend (hard memory/CPU/PID enforcement), enforced domain-wide memory budgets, artifact retrieval helpers. Known correctness gaps in 0.1.x and the plan toward a Rust core with snapshot/rollback and a daemon mode are tracked in [`ROADMAP.md`](./ROADMAP.md).
+0.4.0 on npm (services, snapshots/rollback/forks, capabilities and confinement; see [`CHANGELOG.md`](./CHANGELOG.md)), pre-1.0: the API may change. Not implemented yet: Linux cgroup v2 backend (hard memory/CPU/PID enforcement), enforced domain-wide memory budgets, artifact retrieval helpers, daemon mode and non-TypeScript bindings. Remaining gaps are tracked in [`ROADMAP.md`](./ROADMAP.md).
 
 ## Releasing
 
 Releases are tag-driven. A tag always produces a GitHub Release; the npm upload is switched on separately, so a tag can never ship an artifact that is not traceable to this repository:
 
 1. Bump `version` in `package.json`, commit, and push to `main`.
-2. Push the matching tag, e.g. `git tag v0.1.5 && git push origin v0.1.5`.
+2. Push the matching tag, e.g. `git tag v0.3.0 && git push origin v0.3.0`.
 3. `.github/workflows/release.yml` re-runs typecheck, tests and the pack smoke test, refuses a tag that does not match `package.json`, creates the GitHub Release with the packed tarball, `SHA256SUMS` and a build provenance attestation attached, and — only when the repository variable `NPM_TRUSTED_PUBLISHING_ENABLED` is `true` — publishes with `npm publish --provenance` and verifies the attestation.
 
 One-time setup, in this order: (1) npmjs.com → package settings → Trusted Publisher → GitHub Actions: organization `Xio-Shark`, repository `xioflow`, workflow filename `release.yml`, environment left empty; (2) set the repository variable `NPM_TRUSTED_PUBLISHING_ENABLED=true`. Until both exist the publish job is skipped and the reason is printed in the `verify` job's log. npm's registry index can lag several minutes behind an upload, so the verification step polls and may need a job re-run.
 
-To attach assets to an existing tag without publishing to npm, run the workflow manually: `gh workflow run release.yml -f tag=v0.1.5`. An asset that is already attached is kept if identical and fails the run if it differs; published assets are never overwritten.
+To attach assets to an existing tag without publishing to npm, run the workflow manually: `gh workflow run release.yml -f tag=v0.3.0`. An asset that is already attached is kept if identical and fails the run if it differs; published assets are never overwritten.
 
 ### Verifying a release
 
 ```bash
-gh release download v0.1.5 --repo Xio-Shark/xioflow
+gh release download v0.3.0 --repo Xio-Shark/xioflow
 shasum -a 256 -c SHA256SUMS
-gh attestation verify xioflow-kernel-0.1.5.tgz --repo Xio-Shark/xioflow
+gh attestation verify xioflow-kernel-0.3.0.tgz --repo Xio-Shark/xioflow
 npm audit signatures   # inside a project that installed @xioflow/kernel from npm
 ```
 

package/dist/capability/check.d.ts

@@ -0,0 +1,32 @@
+import { Capability, CapabilityScope } from '../types.js';
+import { resolveRealPath, isPathContained } from './path-utils.js';
+import { SqliteStore } from '../store/sqlite.js';
+export { resolveRealPath, isPathContained };
+/**
+ * 规范化 Capability 作用域
+ */
+export declare function normalizeScope(scope: CapabilityScope): CapabilityScope;
+/**
+ * 校验并生成收窄的作用域（禁止放宽）
+ */
+export declare function validateScopeNarrowing(parentScope: CapabilityScope, narrowerScope: Partial<CapabilityScope>): CapabilityScope;
+export interface CheckCapabilityAdmissionOptions {
+    domainId: string;
+    currentEpoch: number;
+    store: SqliteStore;
+    capabilityId: string;
+    requiredResources?: string[];
+    mutationRoots?: string[];
+    runId?: string;
+    opId?: string;
+}
+export interface CapabilityAdmissionResult {
+    capability: Capability;
+    effectiveResources: string[];
+    effectiveMutationRoots: string[];
+}
+/**
+ * 准入校验：在意图登记前校验结构完整性与作用域合法性（契约 #55）
+ */
+export declare function checkCapabilityAdmission(options: CheckCapabilityAdmissionOptions): CapabilityAdmissionResult;
+//# sourceMappingURL=check.d.ts.map

package/dist/capability/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/capability/check.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAE5C;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAKtE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC,GACtC,eAAe,CAmCjB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,+BAA+B,GACvC,yBAAyB,CAwG3B"}

package/dist/capability/check.js

@@ -0,0 +1,136 @@
+import { CapabilityViolationError, } from '../types.js';
+import { resolveRealPath, isPathContained } from './path-utils.js';
+export { resolveRealPath, isPathContained };
+/**
+ * 规范化 Capability 作用域
+ */
+export function normalizeScope(scope) {
+    return {
+        write: scope.write.map((w) => resolveRealPath(w)),
+        exclusive: [...new Set(scope.exclusive)],
+    };
+}
+/**
+ * 校验并生成收窄的作用域（禁止放宽）
+ */
+export function validateScopeNarrowing(parentScope, narrowerScope) {
+    const normParent = normalizeScope(parentScope);
+    let newWrite = normParent.write;
+    if (narrowerScope.write !== undefined) {
+        const resolvedWrites = narrowerScope.write.map((w) => resolveRealPath(w));
+        for (const rw of resolvedWrites) {
+            const allowed = normParent.write.some((pw) => isPathContained(pw, rw));
+            if (!allowed) {
+                throw new CapabilityViolationError('attenuation_widened', `Cannot widen writable scope: '${rw}' is not contained within parent scope [${normParent.write.join(', ')}]`);
+            }
+        }
+        newWrite = resolvedWrites;
+    }
+    let newExclusive = normParent.exclusive;
+    if (narrowerScope.exclusive !== undefined) {
+        for (const res of narrowerScope.exclusive) {
+            if (!normParent.exclusive.includes(res)) {
+                throw new CapabilityViolationError('attenuation_widened', `Cannot widen exclusive resource scope: '${res}' is not in parent exclusive scope [${normParent.exclusive.join(', ')}]`);
+            }
+        }
+        newExclusive = [...new Set(narrowerScope.exclusive)];
+    }
+    return {
+        write: newWrite,
+        exclusive: newExclusive,
+    };
+}
+/**
+ * 准入校验：在意图登记前校验结构完整性与作用域合法性（契约 #55）
+ */
+export function checkCapabilityAdmission(options) {
+    const { domainId, currentEpoch, store, capabilityId, runId, opId } = options;
+    const reject = (reason, message) => {
+        const err = new CapabilityViolationError(reason, message);
+        try {
+            store.recordJournalEvent({
+                domainId,
+                runId,
+                operationId: opId,
+                type: 'CAPABILITY_REJECTED',
+                payload: {
+                    capabilityId,
+                    reason,
+                    message,
+                    requiredResources: options.requiredResources,
+                    mutationRoots: options.mutationRoots,
+                },
+                timestamp: new Date().toISOString(),
+            });
+        }
+        catch {
+            // 保证即便 journal 写入异常也必须抛出 CapabilityViolationError
+        }
+        throw err;
+    };
+    const cap = store.getCapability(capabilityId);
+    if (!cap) {
+        return reject('revoked', `Capability '${capabilityId}' not found`);
+    }
+    if (cap.epoch !== currentEpoch) {
+        return reject('epoch_mismatch', `Capability '${capabilityId}' epoch ${cap.epoch} does not match current domain epoch ${currentEpoch}`);
+    }
+    if (new Date(cap.expiresAt).getTime() <= Date.now()) {
+        return reject('expired', `Capability '${capabilityId}' expired at ${cap.expiresAt}`);
+    }
+    if (cap.revokedAt) {
+        return reject('revoked', `Capability '${capabilityId}' was revoked at ${cap.revokedAt}`);
+    }
+    // 递归校验祖先链，父撤销/过期/换代导致子级联失效
+    let ancestorId = cap.parentId;
+    while (ancestorId) {
+        const ancestor = store.getCapability(ancestorId);
+        if (!ancestor) {
+            return reject('revoked', `Capability ancestor '${ancestorId}' not found`);
+        }
+        if (ancestor.revokedAt) {
+            return reject('revoked', `Capability ancestor '${ancestorId}' was revoked`);
+        }
+        if (ancestor.epoch !== currentEpoch) {
+            return reject('epoch_mismatch', `Capability ancestor '${ancestorId}' epoch mismatch`);
+        }
+        if (new Date(ancestor.expiresAt).getTime() <= Date.now()) {
+            return reject('expired', `Capability ancestor '${ancestorId}' has expired`);
+        }
+        ancestorId = ancestor.parentId;
+    }
+    // 1. 资源推导与越界检查
+    let effectiveResources;
+    if (options.requiredResources !== undefined && options.requiredResources.length > 0) {
+        for (const res of options.requiredResources) {
+            if (!cap.scope.exclusive.includes(res)) {
+                return reject('out_of_scope_resource', `Resource '${res}' is not permitted by capability '${capabilityId}' exclusive scope [${cap.scope.exclusive.join(', ')}]`);
+            }
+        }
+        effectiveResources = [...options.requiredResources];
+    }
+    else {
+        effectiveResources = [...cap.scope.exclusive];
+    }
+    // 2. 写入根推导与越界检查 (按路径段真实路径包含判定)
+    let effectiveMutationRoots;
+    if (options.mutationRoots !== undefined && options.mutationRoots.length > 0) {
+        const resolvedRoots = options.mutationRoots.map((r) => resolveRealPath(r));
+        for (const rr of resolvedRoots) {
+            const allowed = cap.scope.write.some((cw) => isPathContained(cw, rr));
+            if (!allowed) {
+                return reject('out_of_scope_path', `Mutation root '${rr}' is outside capability '${capabilityId}' writable scope [${cap.scope.write.join(', ')}]`);
+            }
+        }
+        effectiveMutationRoots = resolvedRoots;
+    }
+    else {
+        effectiveMutationRoots = [...cap.scope.write];
+    }
+    return {
+        capability: cap,
+        effectiveResources,
+        effectiveMutationRoots,
+    };
+}
+//# sourceMappingURL=check.js.map

package/dist/capability/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/capability/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACjD,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAA4B,EAC5B,aAAuC;IAEvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,iCAAiC,EAAE,2CAA2C,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,cAAc,CAAC;IAC5B,CAAC;IAED,IAAI,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,2CAA2C,GAAG,uCAAuC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAwC;IAExC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAE7E,MAAM,MAAM,GAAG,CAAC,MAAW,EAAE,OAAe,EAAS,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,KAAK,CAAC,kBAAkB,CAAC;gBACvB,QAAQ;gBACR,KAAK;gBACL,WAAW,EAAE,IAAI;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE;oBACP,YAAY;oBACZ,MAAM;oBACN,OAAO;oBACP,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;oBAC5C,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;gBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,YAAY,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,gBAAgB,EAChB,eAAe,YAAY,WAAW,GAAG,CAAC,KAAK,wCAAwC,YAAY,EAAE,CACtG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,YAAY,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,YAAY,oBAAoB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,2BAA2B;IAC3B,IAAI,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,OAAO,UAAU,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,SAAS,EAAE,wBAAwB,UAAU,aAAa,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,SAAS,EAAE,wBAAwB,UAAU,eAAe,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,UAAU,kBAAkB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,SAAS,EAAE,wBAAwB,UAAU,eAAe,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED,eAAe;IACf,IAAI,kBAA4B,CAAC;IACjC,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,MAAM,CACX,uBAAuB,EACvB,aAAa,GAAG,qCAAqC,YAAY,sBAAsB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,kBAAkB,GAAG,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,kBAAkB,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,+BAA+B;IAC/B,IAAI,sBAAgC,CAAC;IACrC,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CACX,mBAAmB,EACnB,kBAAkB,EAAE,4BAA4B,YAAY,qBAAqB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,sBAAsB,GAAG,aAAa,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,sBAAsB,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG;QACf,kBAAkB;QAClB,sBAAsB;KACvB,CAAC;AACJ,CAAC"}

package/dist/capability/index.d.ts

@@ -0,0 +1,3 @@
+export * from './path-utils.js';
+export * from './check.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/capability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/capability/index.js

@@ -0,0 +1,3 @@
+export * from './path-utils.js';
+export * from './check.js';
+//# sourceMappingURL=index.js.map

package/dist/capability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/capability/path-utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * 规范化真实路径（处理软链接、.. 与大小写）
+ * 若路径不存在，回溯寻找最近存在的祖先目录 realpath 后拼接剩余段
+ */
+export declare function resolveRealPath(p: string): string;
+/**
+ * 路径包含判定：按路径段严格比对（/a/b 不包含 /a/bc）
+ * 双方均做 realpath，杜绝符号链接逃逸与 .. 越界
+ */
+export declare function isPathContained(parentPath: string, childPath: string): boolean;
+//# sourceMappingURL=path-utils.d.ts.map

package/dist/capability/path-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../src/capability/path-utils.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAqBjD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAS9E"}

package/dist/capability/path-utils.js

@@ -0,0 +1,46 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * 规范化真实路径（处理软链接、.. 与大小写）
+ * 若路径不存在，回溯寻找最近存在的祖先目录 realpath 后拼接剩余段
+ */
+export function resolveRealPath(p) {
+    const resolved = path.resolve(p);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        const parts = [];
+        let cur = resolved;
+        while (!fs.existsSync(cur)) {
+            const parent = path.dirname(cur);
+            if (parent === cur)
+                break;
+            parts.unshift(path.basename(cur));
+            cur = parent;
+        }
+        let realBase = cur;
+        try {
+            realBase = fs.realpathSync(cur);
+        }
+        catch {
+            realBase = cur;
+        }
+        return parts.length > 0 ? path.join(realBase, ...parts) : realBase;
+    }
+}
+/**
+ * 路径包含判定：按路径段严格比对（/a/b 不包含 /a/bc）
+ * 双方均做 realpath，杜绝符号链接逃逸与 .. 越界
+ */
+export function isPathContained(parentPath, childPath) {
+    const realParent = resolveRealPath(parentPath);
+    const realChild = resolveRealPath(childPath);
+    if (realParent === realChild)
+        return true;
+    if (realParent === path.sep)
+        return true;
+    const parentWithSep = realParent.endsWith(path.sep) ? realParent : realParent + path.sep;
+    return realChild.startsWith(parentWithSep);
+}
+//# sourceMappingURL=path-utils.js.map

package/dist/capability/path-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../../src/capability/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,GAAG,GAAG,MAAM,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,CAAC;QACnB,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;IACzF,OAAO,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAC7C,CAAC"}

package/dist/confinement/bubblewrap.d.ts

@@ -0,0 +1,8 @@
+import { ConfinementDriver } from '../types.js';
+import { StructuredCommand } from '../driver/types.js';
+export declare class BubblewrapConfinementDriver implements ConfinementDriver {
+    readonly name = "bubblewrap";
+    static isAvailable(): boolean;
+    wrap(command: StructuredCommand, writableRoots: string[]): StructuredCommand;
+}
+//# sourceMappingURL=bubblewrap.d.ts.map

package/dist/confinement/bubblewrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bubblewrap.d.ts","sourceRoot":"","sources":["../../src/confinement/bubblewrap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiBvD,qBAAa,2BAA4B,YAAW,iBAAiB;IACnE,SAAgB,IAAI,gBAAgB;IAEpC,OAAc,WAAW,IAAI,OAAO,CAEnC;IAEM,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAwBlF;CACF"}

package/dist/confinement/bubblewrap.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveRealPath } from '../capability/path-utils.js';
+function findExecutable(name) {
+    const envPath = process.env.PATH || '';
+    const dirs = envPath.split(path.delimiter);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, name);
+        try {
+            if (fs.existsSync(candidate) && (fs.statSync(candidate).mode & 0o111)) {
+                return candidate;
+            }
+        }
+        catch { }
+    }
+    return null;
+}
+export class BubblewrapConfinementDriver {
+    name = 'bubblewrap';
+    static isAvailable() {
+        return process.platform === 'linux' && findExecutable('bwrap') !== null;
+    }
+    wrap(command, writableRoots) {
+        const bwrapPath = findExecutable('bwrap');
+        if (!bwrapPath || process.platform !== 'linux') {
+            throw new Error("Confinement driver 'bubblewrap' is not available on this platform");
+        }
+        const realRoots = writableRoots.map((r) => resolveRealPath(r));
+        const bwrapArgs = [
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+        ];
+        for (const root of realRoots) {
+            bwrapArgs.push('--bind', root, root);
+        }
+        bwrapArgs.push('--', command.execPath, ...command.args);
+        return {
+            ...command,
+            execPath: bwrapPath,
+            args: bwrapArgs,
+        };
+    }
+}
+//# sourceMappingURL=bubblewrap.js.map

package/dist/confinement/bubblewrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bubblewrap.js","sourceRoot":"","sources":["../../src/confinement/bubblewrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,2BAA2B;IACtB,IAAI,GAAG,YAAY,CAAC;IAE7B,MAAM,CAAC,WAAW;QACvB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC1E,CAAC;IAEM,IAAI,CAAC,OAA0B,EAAE,aAAuB;QAC7D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAa;YAC1B,WAAW,EAAE,GAAG,EAAE,GAAG;YACrB,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;SAClB,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/confinement/detector.d.ts

@@ -0,0 +1,4 @@
+import { ConfinementDriver } from '../types.js';
+export declare function detectAvailableConfinementDrivers(): string[];
+export declare function createConfinementDriver(name?: string): ConfinementDriver | null;
+//# sourceMappingURL=detector.d.ts.map

package/dist/confinement/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/confinement/detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAY5D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAa/E"}

package/dist/confinement/detector.js

@@ -0,0 +1,35 @@
+import { SandboxExecConfinementDriver } from './sandbox-exec.js';
+import { BubblewrapConfinementDriver } from './bubblewrap.js';
+import { SrtConfinementDriver } from './srt.js';
+export function detectAvailableConfinementDrivers() {
+    const drivers = [];
+    if (SrtConfinementDriver.isAvailable()) {
+        drivers.push('srt');
+    }
+    if (SandboxExecConfinementDriver.isAvailable()) {
+        drivers.push('sandbox-exec');
+    }
+    if (BubblewrapConfinementDriver.isAvailable()) {
+        drivers.push('bubblewrap');
+    }
+    return drivers;
+}
+export function createConfinementDriver(name) {
+    if (name === 'sandbox-exec')
+        return new SandboxExecConfinementDriver();
+    if (name === 'bubblewrap')
+        return new BubblewrapConfinementDriver();
+    if (name === 'srt')
+        return new SrtConfinementDriver();
+    if (!name) {
+        if (SandboxExecConfinementDriver.isAvailable())
+            return new SandboxExecConfinementDriver();
+        if (BubblewrapConfinementDriver.isAvailable())
+            return new BubblewrapConfinementDriver();
+        if (SrtConfinementDriver.isAvailable())
+            return new SrtConfinementDriver();
+        return null;
+    }
+    throw new Error(`Unknown confinement driver: '${name}'`);
+}
+//# sourceMappingURL=detector.js.map

package/dist/confinement/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/confinement/detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,UAAU,iCAAiC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,4BAA4B,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,2BAA2B,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,4BAA4B,EAAE,CAAC;IACvE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;IACpE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,4BAA4B,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,4BAA4B,EAAE,CAAC;QAC1F,IAAI,2BAA2B,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;QACxF,IAAI,oBAAoB,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/confinement/index.d.ts

@@ -0,0 +1,5 @@
+export * from './sandbox-exec.js';
+export * from './bubblewrap.js';
+export * from './srt.js';
+export * from './detector.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/confinement/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/confinement/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC"}

package/dist/confinement/index.js

@@ -0,0 +1,5 @@
+export * from './sandbox-exec.js';
+export * from './bubblewrap.js';
+export * from './srt.js';
+export * from './detector.js';
+//# sourceMappingURL=index.js.map

package/dist/confinement/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/confinement/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC"}

package/dist/confinement/sandbox-exec.d.ts

@@ -0,0 +1,8 @@
+import { ConfinementDriver } from '../types.js';
+import { StructuredCommand } from '../driver/types.js';
+export declare class SandboxExecConfinementDriver implements ConfinementDriver {
+    readonly name = "sandbox-exec";
+    static isAvailable(): boolean;
+    wrap(command: StructuredCommand, writableRoots: string[]): StructuredCommand;
+}
+//# sourceMappingURL=sandbox-exec.d.ts.map

package/dist/confinement/sandbox-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-exec.d.ts","sourceRoot":"","sources":["../../src/confinement/sandbox-exec.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD,qBAAa,4BAA6B,YAAW,iBAAiB;IACpE,SAAgB,IAAI,kBAAkB;IAEtC,OAAc,WAAW,IAAI,OAAO,CAEnC;IAEM,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAwBlF;CACF"}