@xyit/wellspring 0.0.0-stage → 1.0.0

package/dist/plugin/scaffold.js

@@ -0,0 +1,126 @@
+/*
+ * 插件脚手架：生成可加载的最小插件目录。
+ */
+import { join, resolve } from "node:path";
+import { ensureDir, removePath, statIfExists, writeJsonAtomic, writeTextAtomic, } from "../platform/file.js";
+import { PLUGIN_NAME } from "./paths.js";
+/** 插件名 → 合法命令名；名字不适用时回落到 hello */
+export function commandNameOf(pluginName) {
+    let slug = pluginName
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    if (!/^[a-z][a-z0-9-]*$/.test(slug) || slug.length < 2) {
+        slug = "hello";
+    }
+    return slug.slice(0, 32).replace(/-+$/, "");
+}
+function template(pluginName, commandName) {
+    return [
+        'import { onMessage, onInit, onShutdown } from "wellspring/api/host/index.ts"',
+        'import type { WellspringPlugin } from "wellspring/api/host/index.ts"',
+        "",
+        "// 钩子可以放在模块顶层；平台在 import 时会把它们归属到当前插件",
+        "onMessage(({ phase, prompt }) => {",
+        '    if (phase === "before") prompt.push("你是一个运行在 Wellspring 里的助手")',
+        "})",
+        "",
+        "export function setup() {",
+        "    onInit(() => {",
+        "        // wellspring start 时触发",
+        "    })",
+        "    onShutdown(() => {",
+        "        // wellspring start 关闭时触发",
+        "    })",
+        "",
+        "    const plugin = {",
+        `        id: ${JSON.stringify(pluginName)},`,
+        `        name: ${JSON.stringify(pluginName)},`,
+        '        version: "0.1.0",',
+        '        status: "ok",',
+        "        deps: [],",
+        "        commands: [",
+        "            {",
+        `                name: ${JSON.stringify(commandName)},`,
+        `                summary: ${JSON.stringify(`${pluginName} 示例命令`)},`,
+        "                run: (ctx) => {",
+        '                    ctx.output.info("argv=" + ctx.argv.join(","))',
+        "                    return 0",
+        "                },",
+        "            },",
+        "        ],",
+        "    } satisfies WellspringPlugin",
+        "",
+        "    return plugin",
+        "}",
+        "",
+    ].join("\n");
+}
+function readmeTemplate(pluginName, commandName) {
+    return [
+        `# ${pluginName}`,
+        "",
+        "## 开发",
+        "",
+        "编辑器 / tsc 解析 `wellspring/api/host/index.ts` 需要先把 Wellspring 链接进来：",
+        "",
+        "```bash",
+        "pnpm link /path/to/Wellspring",
+        "pnpm add -D typescript @types/node   # 如果还没有",
+        "pnpm exec tsc --noEmit",
+        "```",
+        "",
+        "运行时不需要链接：通过 `wellspring plugin link <this-dir>` 加载时，平台会解析宿主 API。",
+        "",
+        "## 加载",
+        "",
+        "```bash",
+        `wellspring plugin link \"$PWD\"`,
+        "wellspring plugin list",
+        `wellspring ${commandName}`,
+        "```",
+        "",
+    ].join("\n");
+}
+export async function scaffoldPlugin(options) {
+    const name = options.name.trim();
+    if (!PLUGIN_NAME.test(name)) {
+        throw new Error(`插件名不合法：${name}`);
+    }
+    const parentDir = resolve(options.parentDir ?? process.cwd());
+    const dir = join(parentDir, name);
+    const existing = await statIfExists(dir);
+    if (existing !== null) {
+        if (options.force !== true) {
+            throw new Error(`目录已存在：${dir}`);
+        }
+        await removePath(dir);
+    }
+    await ensureDir(dir);
+    const commandName = commandNameOf(name);
+    await writeJsonAtomic(join(dir, "package.json"), {
+        name,
+        version: "0.1.0",
+        type: "module",
+        main: "index.ts",
+        wellspring: { apiVersion: 1 },
+    });
+    await writeTextAtomic(join(dir, "index.ts"), template(name, commandName));
+    await writeJsonAtomic(join(dir, "tsconfig.json"), {
+        compilerOptions: {
+            target: "ES2024",
+            module: "NodeNext",
+            moduleResolution: "NodeNext",
+            strict: true,
+            noEmit: true,
+            allowImportingTsExtensions: true,
+            skipLibCheck: true,
+            types: ["node"],
+        },
+        include: ["index.ts"],
+    });
+    await writeTextAtomic(join(dir, "README.md"), readmeTemplate(name, commandName));
+    return { dir, commandName };
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/plugin/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/plugin/scaffold.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACH,SAAS,EACT,UAAU,EACV,YAAY,EACZ,eAAe,EACf,eAAe,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAcxC,kCAAkC;AAClC,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC5C,IAAI,IAAI,GAAG,UAAU;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,OAAO,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB,EAAE,WAAmB;IACrD,OAAO;QACH,8EAA8E;QAC9E,sEAAsE;QACtE,EAAE;QACF,uCAAuC;QACvC,oCAAoC;QACpC,oEAAoE;QACpE,IAAI;QACJ,EAAE;QACF,2BAA2B;QAC3B,oBAAoB;QACpB,iCAAiC;QACjC,QAAQ;QACR,wBAAwB;QACxB,mCAAmC;QACnC,QAAQ;QACR,EAAE;QACF,sBAAsB;QACtB,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;QAC5C,iBAAiB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;QAC9C,2BAA2B;QAC3B,uBAAuB;QACvB,mBAAmB;QACnB,qBAAqB;QACrB,eAAe;QACf,yBAAyB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;QACvD,4BAA4B,IAAI,CAAC,SAAS,CAAC,GAAG,UAAU,OAAO,CAAC,GAAG;QACnE,iCAAiC;QACjC,mEAAmE;QACnE,8BAA8B;QAC9B,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,kCAAkC;QAClC,EAAE;QACF,mBAAmB;QACnB,GAAG;QACH,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,WAAmB;IAC3D,OAAO;QACH,KAAK,UAAU,EAAE;QACjB,EAAE;QACF,OAAO;QACP,EAAE;QACF,mEAAmE;QACnE,EAAE;QACF,SAAS;QACT,+BAA+B;QAC/B,8CAA8C;QAC9C,wBAAwB;QACxB,KAAK;QACL,EAAE;QACF,kEAAkE;QAClE,EAAE;QACF,OAAO;QACP,EAAE;QACF,SAAS;QACT,iCAAiC;QACjC,wBAAwB;QACxB,cAAc,WAAW,EAAE;QAC3B,KAAK;QACL,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,OAA8B;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACnC,CAAC;QACD,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE;QAC7C,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KAChC,CAAC,CAAA;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IACzE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE;QAC9C,eAAe,EAAE;YACb,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,UAAU;YAC5B,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,0BAA0B,EAAE,IAAI;YAChC,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,CAAC,MAAM,CAAC;SAClB;QACD,OAAO,EAAE,CAAC,UAAU,CAAC;KACxB,CAAC,CAAA;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAChF,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;AAC/B,CAAC"}

package/dist/plugin/state.d.ts

@@ -0,0 +1,6 @@
+import { type ResolvedPaths } from "../platform/path.js";
+export declare function pluginStateFile(paths?: ResolvedPaths): string;
+/** 读取被禁用的插件目录名集合 */
+export declare function readPluginState(paths?: ResolvedPaths): Promise<ReadonlySet<string>>;
+/** 设置插件启用/禁用，返回是否发生变化 */
+export declare function setPluginEnabled(name: string, enabled: boolean, paths?: ResolvedPaths): Promise<boolean>;

package/dist/plugin/state.js

@@ -0,0 +1,38 @@
+/*
+ * 插件启用状态：<dataDir>/plugins-state.json。
+ * 以插件目录名为 key，禁用后 loader 不再 import 该插件。
+ */
+import { join } from "node:path";
+import { readJsonIfExists, writeJsonAtomic } from "../platform/file.js";
+import { getPaths } from "../platform/path.js";
+export function pluginStateFile(paths = getPaths()) {
+    return join(paths.dataDir, "plugins-state.json");
+}
+/** 读取被禁用的插件目录名集合 */
+export async function readPluginState(paths = getPaths()) {
+    const value = await readJsonIfExists(pluginStateFile(paths));
+    if (value === null || !Array.isArray(value.disabled)) {
+        return new Set();
+    }
+    return new Set(value.disabled.filter((item) => typeof item === "string"));
+}
+/** 设置插件启用/禁用，返回是否发生变化 */
+export async function setPluginEnabled(name, enabled, paths = getPaths()) {
+    const disabled = new Set(await readPluginState(paths));
+    const had = disabled.has(name);
+    if (enabled) {
+        disabled.delete(name);
+    }
+    else {
+        disabled.add(name);
+    }
+    if (had === !enabled) {
+        return false;
+    }
+    await writeJsonAtomic(pluginStateFile(paths), {
+        version: 1,
+        disabled: [...disabled].sort(),
+    });
+    return true;
+}
+//# sourceMappingURL=state.js.map

package/dist/plugin/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/plugin/state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAsB,MAAM,qBAAqB,CAAA;AAOlE,MAAM,UAAU,eAAe,CAAC,KAAK,GAAkB,QAAQ,EAAE;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;AACpD,CAAC;AAED,oBAAoB;AACpB,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,KAAK,GAAkB,QAAQ,EAAE;IAEjC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAkB,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,GAAG,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED,yBAAyB;AACzB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,IAAY,EACZ,OAAgB,EAChB,KAAK,GAAkB,QAAQ,EAAE;IAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,EAAE,CAAC;QACV,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACtB,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IAChB,CAAC;IACD,MAAM,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;QAC1C,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;KACjC,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACf,CAAC"}

package/dist/plugin/zip.d.ts

@@ -0,0 +1,7 @@
+export interface ZipEntry {
+    readonly name: string;
+    readonly data: Buffer;
+}
+export declare function readZip(buffer: Buffer): ZipEntry[];
+/** 解压到目标目录；调用方负责临时目录与清理 */
+export declare function extractZip(buffer: Buffer, destination: string): Promise<void>;

package/dist/plugin/zip.js

@@ -0,0 +1,138 @@
+/*
+ * 最小 ZIP 读取器，只服务本地插件安装。
+ * 支持 store/deflate 两种压缩方式，拒绝加密、ZIP64、符号链接与路径穿越。
+ */
+import { inflateRawSync } from "node:zlib";
+import { ensureDir, writeBytesAtomic } from "../platform/file.js";
+import { dirname, resolve, sep } from "node:path";
+const EOCD_SIGNATURE = 0x06054b50;
+const CENTRAL_SIGNATURE = 0x02014b50;
+const LOCAL_SIGNATURE = 0x04034b50;
+const MAX_ENTRIES = 10_000;
+const MAX_ENTRY_BYTES = 100 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 200 * 1024 * 1024;
+function fail(message) {
+    throw new Error(`zip 包非法：${message}`);
+}
+function validateName(name) {
+    if (name === "" || name.startsWith("/") || name.includes("\\") || /^[A-Za-z]:/.test(name)) {
+        fail(`非法路径：${name}`);
+    }
+    for (const segment of name.split("/")) {
+        if (segment === ".." || segment === ".") {
+            fail(`非法路径：${name}`);
+        }
+    }
+}
+function findEocd(buffer) {
+    const minimum = Math.max(0, buffer.length - 65_557);
+    for (let offset = buffer.length - 22; offset >= minimum; offset -= 1) {
+        if (buffer.readUInt32LE(offset) === EOCD_SIGNATURE) {
+            return offset;
+        }
+    }
+    return fail("找不到中央目录");
+}
+export function readZip(buffer) {
+    if (buffer.length < 22) {
+        fail("文件过短");
+    }
+    const eocd = findEocd(buffer);
+    const entries = buffer.readUInt16LE(eocd + 10);
+    const centralOffset = buffer.readUInt32LE(eocd + 16);
+    if (entries > MAX_ENTRIES) {
+        fail("文件条目过多");
+    }
+    if (centralOffset === 0xffffffff) {
+        fail("不支持 ZIP64");
+    }
+    const result = [];
+    let total = 0;
+    let offset = centralOffset;
+    for (let index = 0; index < entries; index += 1) {
+        if (offset + 46 > buffer.length || buffer.readUInt32LE(offset) !== CENTRAL_SIGNATURE) {
+            fail("中央目录损坏");
+        }
+        const flags = buffer.readUInt16LE(offset + 8);
+        const method = buffer.readUInt16LE(offset + 10);
+        const compressedSize = buffer.readUInt32LE(offset + 20);
+        const uncompressedSize = buffer.readUInt32LE(offset + 24);
+        const nameLength = buffer.readUInt16LE(offset + 28);
+        const extraLength = buffer.readUInt16LE(offset + 30);
+        const commentLength = buffer.readUInt16LE(offset + 32);
+        const externalAttributes = buffer.readUInt32LE(offset + 38);
+        const localOffset = buffer.readUInt32LE(offset + 42);
+        const name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString("utf8");
+        offset += 46 + nameLength + extraLength + commentLength;
+        validateName(name);
+        if ((flags & 0x1) !== 0) {
+            fail(`不支持加密条目：${name}`);
+        }
+        if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff) {
+            fail("不支持 ZIP64 条目");
+        }
+        if (uncompressedSize > MAX_ENTRY_BYTES) {
+            fail(`单文件过大：${name}`);
+        }
+        total += uncompressedSize;
+        if (total > MAX_TOTAL_BYTES) {
+            fail("解压后总大小超限");
+        }
+        if (name.endsWith("/")) {
+            result.push({ name, data: Buffer.alloc(0) });
+            continue;
+        }
+        if (((externalAttributes >>> 16) & 0o170000) === 0o120000) {
+            fail(`不支持符号链接：${name}`);
+        }
+        if (localOffset + 30 > buffer.length ||
+            buffer.readUInt32LE(localOffset) !== LOCAL_SIGNATURE) {
+            fail(`本地文件头损坏：${name}`);
+        }
+        const localNameLength = buffer.readUInt16LE(localOffset + 26);
+        const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+        const dataStart = localOffset + 30 + localNameLength + localExtraLength;
+        const end = dataStart + compressedSize;
+        if (end > buffer.length) {
+            fail(`数据越界：${name}`);
+        }
+        const compressed = buffer.subarray(dataStart, end);
+        let data;
+        if (method === 0) {
+            data = Buffer.from(compressed);
+        }
+        else if (method === 8) {
+            try {
+                data = inflateRawSync(compressed);
+            }
+            catch (error) {
+                fail(`解压失败：${name}（${error instanceof Error ? error.message : String(error)}）`);
+            }
+        }
+        else {
+            fail(`不支持的压缩方式 ${method}：${name}`);
+        }
+        if (data.length !== uncompressedSize) {
+            fail(`解压大小不符：${name}`);
+        }
+        result.push({ name, data });
+    }
+    return result;
+}
+/** 解压到目标目录；调用方负责临时目录与清理 */
+export async function extractZip(buffer, destination) {
+    const root = resolve(destination);
+    for (const entry of readZip(buffer)) {
+        const target = resolve(root, entry.name);
+        if (target !== root && !target.startsWith(`${root}${sep}`)) {
+            fail(`路径穿越：${entry.name}`);
+        }
+        if (entry.name.endsWith("/")) {
+            await ensureDir(target);
+            continue;
+        }
+        await ensureDir(dirname(target));
+        await writeBytesAtomic(target, entry.data);
+    }
+}
+//# sourceMappingURL=zip.js.map

package/dist/plugin/zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../../src/plugin/zip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEjD,MAAM,cAAc,GAAG,UAAU,CAAA;AACjC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AACpC,MAAM,eAAe,GAAG,UAAU,CAAA;AAClC,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AAOzC,SAAS,IAAI,CAAC,OAAe;IACzB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACxB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QACxB,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IACnD,KAAK,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;YACjD,OAAO,MAAM,CAAA;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;IACpD,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClB,CAAC;IACD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,CAAA;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAAM,GAAG,aAAa,CAAA;IAE1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,iBAAiB,EAAE,CAAC;YACnF,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACvD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACpD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACtD,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACpF,MAAM,IAAI,EAAE,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAA;QAEvD,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC3B,CAAC;QACD,IAAI,cAAc,KAAK,UAAU,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACnE,IAAI,CAAC,cAAc,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,gBAAgB,GAAG,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,KAAK,IAAI,gBAAgB,CAAA;QACzB,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,CAAA;QACpB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC5C,SAAQ;QACZ,CAAC;QACD,IAAI,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxD,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC3B,CAAC;QACD,IACI,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM;YAChC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,eAAe,EACtD,CAAC;YACC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC3B,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAA;QAC7D,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,WAAW,GAAG,EAAE,GAAG,eAAe,GAAG,gBAAgB,CAAA;QACvE,MAAM,GAAG,GAAG,SAAS,GAAG,cAAc,CAAA;QACtC,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QACxB,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAElD,IAAI,IAAY,CAAA;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,CAAC;aAAM,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CACA,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC5E,CAAA;YACL,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,YAAY,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;QAC1B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAmB;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;YACvB,SAAQ;QACZ,CAAC;QACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAChC,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;AACL,CAAC"}

package/dist/sandbox/audit.d.ts

@@ -0,0 +1,12 @@
+import type { ResolvedPaths } from "../platform/path.js";
+export interface SandboxAuditEvent {
+    readonly type: string;
+    readonly sandboxId: string;
+    readonly pluginId?: string;
+    readonly backend?: string;
+    readonly decision?: "allowed" | "denied";
+    readonly reason?: string;
+    readonly [key: string]: unknown;
+}
+export declare function auditSandbox(paths: ResolvedPaths, event: SandboxAuditEvent): void;
+export declare function flushSandboxAudit(): Promise<void>;

package/dist/sandbox/audit.js

@@ -0,0 +1,20 @@
+/*
+ * sandbox 审计日志：<logDir>/sandbox-audit.log，JSONL。
+ */
+import { appendFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { ensureDir } from "../platform/file.js";
+let queue = Promise.resolve();
+export function auditSandbox(paths, event) {
+    const file = join(paths.logDir, "sandbox-audit.log");
+    queue = queue
+        .then(async () => {
+        await ensureDir(dirname(file));
+        await appendFile(file, `${JSON.stringify({ time: new Date().toISOString(), ...event })}\n`);
+    })
+        .catch(() => undefined);
+}
+export async function flushSandboxAudit() {
+    await queue;
+}
+//# sourceMappingURL=audit.js.map

package/dist/sandbox/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/sandbox/audit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAa/C,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;AAE5C,MAAM,UAAU,YAAY,CAAC,KAAoB,EAAE,KAAwB;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,KAAK,GAAG,KAAK;SACR,IAAI,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9B,MAAM,UAAU,CACZ,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CACtE,CAAA;IACL,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,MAAM,KAAK,CAAA;AACf,CAAC"}

package/dist/sandbox/backends/bwrap.d.ts

@@ -0,0 +1,28 @@
+import type { AgentLaunchInput, LaunchSpec, PluginLaunchInput, SandboxBackend, SandboxBackendStatus } from "../types.js";
+/** 沙箱内挂载 Node 运行时的目录 */
+export declare const NODE_ROOT = "/opt/wellspring";
+export interface NodeRuntimeLayout {
+    /** 可整体挂载的 Node 前缀（含 bin/npm 与 lib/node_modules）；只有裸二进制时为 null */
+    readonly prefix: string | null;
+    /** 沙箱内的 node 路径 */
+    readonly nodePath: string;
+    /** PATH 里的目录 */
+    readonly pathEntry: string;
+}
+/**
+ * 找到当前 node 的安装前缀。
+ *
+ * 只 bind 单个 node 二进制会丢掉同目录的 npm/npx（npm 在 lib/node_modules/npm 里），
+ * 所以优先把整个前缀挂到 /opt/wellspring；找不到 npm 的发行版才退回裸二进制。
+ */
+export declare function resolveNodeRuntime(execPath?: string, exists?: (path: string) => boolean): NodeRuntimeLayout;
+/** 纯函数，方便单测 */
+export declare function buildBwrapLaunch(input: AgentLaunchInput): LaunchSpec;
+/** 纯函数：插件 profile 的 bwrap launch spec */
+export declare function buildBwrapPluginLaunch(input: PluginLaunchInput): LaunchSpec;
+export declare class BwrapBackend implements SandboxBackend {
+    readonly name = "bwrap";
+    probe(): Promise<SandboxBackendStatus>;
+    buildAgentLaunch(input: AgentLaunchInput): LaunchSpec;
+    buildPluginLaunch(input: PluginLaunchInput): LaunchSpec;
+}

package/dist/sandbox/backends/bwrap.js

@@ -0,0 +1,197 @@
+/*
+ * Linux bwrap 后端。
+ * 由 bwrap 提供 mount / PID / network namespace；Node permission model 作为第二层。
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+const SYSTEM_DIRS = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/lib32"];
+/** 沙箱内挂载 Node 运行时的目录 */
+export const NODE_ROOT = "/opt/wellspring";
+function existingSystemDirs() {
+    return SYSTEM_DIRS.filter((dir) => existsSync(dir));
+}
+/**
+ * 找到当前 node 的安装前缀。
+ *
+ * 只 bind 单个 node 二进制会丢掉同目录的 npm/npx（npm 在 lib/node_modules/npm 里），
+ * 所以优先把整个前缀挂到 /opt/wellspring；找不到 npm 的发行版才退回裸二进制。
+ */
+export function resolveNodeRuntime(execPath = process.execPath, exists = existsSync) {
+    const prefix = resolve(dirname(execPath), "..");
+    const hasNpm = exists(join(prefix, "bin", "npm")) ||
+        exists(join(prefix, "lib", "node_modules", "npm")) ||
+        exists(join(prefix, "share", "nodejs", "npm"));
+    if (hasNpm) {
+        return {
+            prefix,
+            nodePath: `${NODE_ROOT}/bin/node`,
+            pathEntry: `${NODE_ROOT}/bin`,
+        };
+    }
+    return {
+        prefix: null,
+        nodePath: `${NODE_ROOT}/node`,
+        pathEntry: NODE_ROOT,
+    };
+}
+function nodeRuntimeMount(runtime, execPath) {
+    if (runtime.prefix !== null) {
+        return ["--dir", NODE_ROOT, "--ro-bind", runtime.prefix, NODE_ROOT];
+    }
+    return ["--dir", NODE_ROOT, "--ro-bind", execPath, `${NODE_ROOT}/node`];
+}
+function insideWorkspace(workspaceDir, cwd) {
+    const root = resolve(workspaceDir);
+    const target = resolve(cwd);
+    if (target !== root && !target.startsWith(`${root}${sep}`)) {
+        throw new Error(`cwd 不在 workspace 内：${cwd}`);
+    }
+    const rel = relative(root, target);
+    return rel === "" ? "/workspace" : `/workspace/${rel.split(sep).join("/")}`;
+}
+/** 纯函数，方便单测 */
+export function buildBwrapLaunch(input) {
+    const args = [
+        "--unshare-all",
+        "--die-with-parent",
+        "--new-session",
+        "--clearenv",
+        "--cap-drop",
+        "ALL",
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--tmpfs",
+        "/tmp",
+    ];
+    if (input.network === true) {
+        args.push("--share-net");
+    }
+    for (const dir of existingSystemDirs()) {
+        args.push("--ro-bind-try", dir, dir);
+    }
+    // DNS、CA 证书与用户解析
+    args.push("--ro-bind-try", "/etc", "/etc");
+    // systemd-resolved 的 resolv.conf 指向 /run；先建目标目录再尝试绑定
+    if (existsSync("/run/systemd/resolve")) {
+        args.push("--dir", "/run", "--dir", "/run/systemd", "--dir", "/run/systemd/resolve");
+        args.push("--ro-bind-try", "/run/systemd/resolve", "/run/systemd/resolve");
+    }
+    const nodeRuntime = resolveNodeRuntime();
+    args.push(...nodeRuntimeMount(nodeRuntime, process.execPath));
+    const workspaceBind = input.access === "workspace-write" ? "--bind" : "--ro-bind";
+    args.push(workspaceBind, resolve(input.workspaceDir), "/workspace");
+    args.push("--bind", resolve(input.scratchDir), "/scratch");
+    args.push("--chdir", insideWorkspace(input.workspaceDir, input.cwd));
+    const env = { ...input.env };
+    env["PATH"] = `${nodeRuntime.pathEntry}:${env["PATH"] ?? "/usr/bin:/bin"}`;
+    /*
+     * 不再限制 RLIMIT_AS（虚拟地址空间会直接打死 V8 / JVM / Go）。
+     * 物理内存由 SandboxManager 挂 cgroup v2 memory.max；这里只留 V8 堆上限，
+     * 且对所有命令生效，npx / npm 派生的 node 子进程也能继承。
+     */
+    env["NODE_OPTIONS"] =
+        `${env["NODE_OPTIONS"] ?? ""} --max-old-space-size=${input.limits.memoryMB}`.trim();
+    for (const [key, value] of Object.entries(env)) {
+        args.push("--setenv", key, value);
+    }
+    args.push("--");
+    // prlimit 自身在 /usr/bin；只留文件描述符与进程数上限，超时交给 supervisor 的 wall timeout
+    const prlimitArgs = ["--nofile=256", `--nproc=${input.limits.pids}`];
+    args.push("/usr/bin/prlimit", ...prlimitArgs, "--", input.command, ...input.argv);
+    return {
+        command: "bwrap",
+        args,
+        cwd: resolve(input.workspaceDir),
+        env: { ...input.env },
+    };
+}
+/** 纯函数：插件 profile 的 bwrap launch spec */
+export function buildBwrapPluginLaunch(input) {
+    const args = [
+        "--unshare-all",
+        "--die-with-parent",
+        "--new-session",
+        "--clearenv",
+        "--cap-drop",
+        "ALL",
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--tmpfs",
+        "/tmp",
+    ];
+    for (const dir of existingSystemDirs()) {
+        args.push("--ro-bind-try", dir, dir);
+    }
+    const nodeRuntime = resolveNodeRuntime();
+    args.push(...nodeRuntimeMount(nodeRuntime, process.execPath));
+    args.push("--ro-bind", resolve(input.pluginDir), "/plugin");
+    args.push("--ro-bind", resolve(input.hostSdkDir), "/host");
+    args.push("--chdir", "/plugin");
+    const env = { ...input.env };
+    env["PATH"] = `${nodeRuntime.pathEntry}:${env["PATH"] ?? "/usr/bin:/bin"}`;
+    env["NODE_OPTIONS"] =
+        `${env["NODE_OPTIONS"] ?? ""} --max-old-space-size=${input.limits.memoryMB}`.trim();
+    for (const [key, value] of Object.entries(env)) {
+        args.push("--setenv", key, value);
+    }
+    args.push("--");
+    args.push("/usr/bin/prlimit", "--nofile=256", `--nproc=${input.limits.pids}`, "--", nodeRuntime.nodePath, "--permission", "--allow-fs-read=/plugin", "--allow-fs-read=/host", "/host/src/sandbox/plugin-host.ts");
+    return {
+        command: "bwrap",
+        args,
+        cwd: resolve(input.pluginDir),
+        env: { ...input.env },
+    };
+}
+export class BwrapBackend {
+    name = "bwrap";
+    async probe() {
+        if (!existsSync("/usr/bin/bwrap")) {
+            return {
+                available: false,
+                backend: this.name,
+                reason: "找不到 bwrap",
+                version: null,
+            };
+        }
+        const result = spawnSync("bwrap", [
+            "--unshare-all",
+            "--die-with-parent",
+            "--ro-bind",
+            "/",
+            "/",
+            "--dev",
+            "/dev",
+            "--proc",
+            "/proc",
+            "--",
+            "/bin/true",
+        ], { timeout: 3_000, encoding: "utf8" });
+        if (result.status !== 0) {
+            return {
+                available: false,
+                backend: this.name,
+                reason: (result.stderr ?? "").trim() || "bwrap 无法创建 namespace",
+                version: null,
+            };
+        }
+        return {
+            available: true,
+            backend: this.name,
+            reason: null,
+            version: null,
+        };
+    }
+    buildAgentLaunch(input) {
+        return buildBwrapLaunch(input);
+    }
+    buildPluginLaunch(input) {
+        return buildBwrapPluginLaunch(input);
+    }
+}
+//# sourceMappingURL=bwrap.js.map

package/dist/sandbox/backends/bwrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bwrap.js","sourceRoot":"","sources":["../../../src/sandbox/backends/bwrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAUjE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAE1C,SAAS,kBAAkB;IACvB,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACvD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAC9B,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,MAAM,GAA8B,UAAU;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/C,MAAM,MAAM,GACR,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IAClD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO;YACH,MAAM;YACN,QAAQ,EAAE,GAAG,SAAS,WAAW;YACjC,SAAS,EAAE,GAAG,SAAS,MAAM;SAChC,CAAA;IACL,CAAC;IACD,OAAO;QACH,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,GAAG,SAAS,OAAO;QAC7B,SAAS,EAAE,SAAS;KACvB,CAAA;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0B,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,GAAW;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,eAAe;AACf,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACpD,MAAM,IAAI,GAAa;QACnB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,MAAM;KACT,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,qDAAqD;IACrD,IAAI,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IACjF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAA;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEpE,MAAM,GAAG,GAA2B,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACpD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,CAAA;IAC1E;;;;OAIG;IACH,GAAG,CAAC,cAAc,CAAC;QACf,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACvF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjF,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QAChC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;KACxB,CAAA;AACL,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,sBAAsB,CAAC,KAAwB;IAC3D,MAAM,IAAI,GAAa;QACnB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,MAAM;KACT,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAE/B,MAAM,GAAG,GAA2B,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACpD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,CAAA;IAC1E,GAAG,CAAC,cAAc,CAAC;QACf,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACvF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,IAAI,CAAC,IAAI,CACL,kBAAkB,EAClB,cAAc,EACd,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAC9B,IAAI,EACJ,WAAW,CAAC,QAAQ,EACpB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,kCAAkC,CACrC,CAAA;IAED,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;KACxB,CAAA;AACL,CAAC;AAED,MAAM,OAAO,YAAY;IACZ,IAAI,GAAG,OAAO,CAAA;IAEvB,KAAK,CAAC,KAAK;QACP,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChC,OAAO;gBACH,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,IAAI;aAChB,CAAA;QACL,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CACpB,OAAO,EACP;YACI,eAAe;YACf,mBAAmB;YACnB,WAAW;YACX,GAAG;YACH,GAAG;YACH,OAAO;YACP,MAAM;YACN,QAAQ;YACR,OAAO;YACP,IAAI;YACJ,WAAW;SACd,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvC,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACH,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,sBAAsB;gBAC9D,OAAO,EAAE,IAAI;aAChB,CAAA;QACL,CAAC;QACD,OAAO;YACH,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;SAChB,CAAA;IACL,CAAC;IAED,gBAAgB,CAAC,KAAuB;QACpC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,iBAAiB,CAAC,KAAwB;QACtC,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;CACJ"}

package/dist/sandbox/backends/direct.d.ts

@@ -0,0 +1,7 @@
+import type { AgentLaunchInput, LaunchSpec, PluginLaunchInput, SandboxBackend, SandboxBackendStatus } from "../types.js";
+export declare class DirectBackend implements SandboxBackend {
+    readonly name = "direct";
+    probe(): Promise<SandboxBackendStatus>;
+    buildAgentLaunch(input: AgentLaunchInput): LaunchSpec;
+    buildPluginLaunch(input: PluginLaunchInput): LaunchSpec;
+}