@xyit/wellspring 0.0.0-stage → 1.1.0

package/dist/sandbox/backends/bwrap.js

@@ -0,0 +1,197 @@
+/*
+ * Linux bwrap 后端。
+ * 由 bwrap 提供 mount / PID / network namespace；Node permission model 作为第二层。
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+const SYSTEM_DIRS = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/lib32"];
+/** 沙箱内挂载 Node 运行时的目录 */
+export const NODE_ROOT = "/opt/wellspring";
+function existingSystemDirs() {
+    return SYSTEM_DIRS.filter((dir) => existsSync(dir));
+}
+/**
+ * 找到当前 node 的安装前缀。
+ *
+ * 只 bind 单个 node 二进制会丢掉同目录的 npm/npx（npm 在 lib/node_modules/npm 里），
+ * 所以优先把整个前缀挂到 /opt/wellspring；找不到 npm 的发行版才退回裸二进制。
+ */
+export function resolveNodeRuntime(execPath = process.execPath, exists = existsSync) {
+    const prefix = resolve(dirname(execPath), "..");
+    const hasNpm = exists(join(prefix, "bin", "npm")) ||
+        exists(join(prefix, "lib", "node_modules", "npm")) ||
+        exists(join(prefix, "share", "nodejs", "npm"));
+    if (hasNpm) {
+        return {
+            prefix,
+            nodePath: `${NODE_ROOT}/bin/node`,
+            pathEntry: `${NODE_ROOT}/bin`,
+        };
+    }
+    return {
+        prefix: null,
+        nodePath: `${NODE_ROOT}/node`,
+        pathEntry: NODE_ROOT,
+    };
+}
+function nodeRuntimeMount(runtime, execPath) {
+    if (runtime.prefix !== null) {
+        return ["--dir", NODE_ROOT, "--ro-bind", runtime.prefix, NODE_ROOT];
+    }
+    return ["--dir", NODE_ROOT, "--ro-bind", execPath, `${NODE_ROOT}/node`];
+}
+function insideWorkspace(workspaceDir, cwd) {
+    const root = resolve(workspaceDir);
+    const target = resolve(cwd);
+    if (target !== root && !target.startsWith(`${root}${sep}`)) {
+        throw new Error(`cwd 不在 workspace 内：${cwd}`);
+    }
+    const rel = relative(root, target);
+    return rel === "" ? "/workspace" : `/workspace/${rel.split(sep).join("/")}`;
+}
+/** 纯函数，方便单测 */
+export function buildBwrapLaunch(input) {
+    const args = [
+        "--unshare-all",
+        "--die-with-parent",
+        "--new-session",
+        "--clearenv",
+        "--cap-drop",
+        "ALL",
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--tmpfs",
+        "/tmp",
+    ];
+    if (input.network === true) {
+        args.push("--share-net");
+    }
+    for (const dir of existingSystemDirs()) {
+        args.push("--ro-bind-try", dir, dir);
+    }
+    // DNS、CA 证书与用户解析
+    args.push("--ro-bind-try", "/etc", "/etc");
+    // systemd-resolved 的 resolv.conf 指向 /run；先建目标目录再尝试绑定
+    if (existsSync("/run/systemd/resolve")) {
+        args.push("--dir", "/run", "--dir", "/run/systemd", "--dir", "/run/systemd/resolve");
+        args.push("--ro-bind-try", "/run/systemd/resolve", "/run/systemd/resolve");
+    }
+    const nodeRuntime = resolveNodeRuntime();
+    args.push(...nodeRuntimeMount(nodeRuntime, process.execPath));
+    const workspaceBind = input.access === "workspace-write" ? "--bind" : "--ro-bind";
+    args.push(workspaceBind, resolve(input.workspaceDir), "/workspace");
+    args.push("--bind", resolve(input.scratchDir), "/scratch");
+    args.push("--chdir", insideWorkspace(input.workspaceDir, input.cwd));
+    const env = { ...input.env };
+    env["PATH"] = `${nodeRuntime.pathEntry}:${env["PATH"] ?? "/usr/bin:/bin"}`;
+    /*
+     * 不再限制 RLIMIT_AS（虚拟地址空间会直接打死 V8 / JVM / Go）。
+     * 物理内存由 SandboxManager 挂 cgroup v2 memory.max；这里只留 V8 堆上限，
+     * 且对所有命令生效，npx / npm 派生的 node 子进程也能继承。
+     */
+    env["NODE_OPTIONS"] =
+        `${env["NODE_OPTIONS"] ?? ""} --max-old-space-size=${input.limits.memoryMB}`.trim();
+    for (const [key, value] of Object.entries(env)) {
+        args.push("--setenv", key, value);
+    }
+    args.push("--");
+    // prlimit 自身在 /usr/bin；只留文件描述符与进程数上限，超时交给 supervisor 的 wall timeout
+    const prlimitArgs = ["--nofile=256", `--nproc=${input.limits.pids}`];
+    args.push("/usr/bin/prlimit", ...prlimitArgs, "--", input.command, ...input.argv);
+    return {
+        command: "bwrap",
+        args,
+        cwd: resolve(input.workspaceDir),
+        env: { ...input.env },
+    };
+}
+/** 纯函数：插件 profile 的 bwrap launch spec */
+export function buildBwrapPluginLaunch(input) {
+    const args = [
+        "--unshare-all",
+        "--die-with-parent",
+        "--new-session",
+        "--clearenv",
+        "--cap-drop",
+        "ALL",
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--tmpfs",
+        "/tmp",
+    ];
+    for (const dir of existingSystemDirs()) {
+        args.push("--ro-bind-try", dir, dir);
+    }
+    const nodeRuntime = resolveNodeRuntime();
+    args.push(...nodeRuntimeMount(nodeRuntime, process.execPath));
+    args.push("--ro-bind", resolve(input.pluginDir), "/plugin");
+    args.push("--ro-bind", resolve(input.hostSdkDir), "/host");
+    args.push("--chdir", "/plugin");
+    const env = { ...input.env };
+    env["PATH"] = `${nodeRuntime.pathEntry}:${env["PATH"] ?? "/usr/bin:/bin"}`;
+    env["NODE_OPTIONS"] =
+        `${env["NODE_OPTIONS"] ?? ""} --max-old-space-size=${input.limits.memoryMB}`.trim();
+    for (const [key, value] of Object.entries(env)) {
+        args.push("--setenv", key, value);
+    }
+    args.push("--");
+    args.push("/usr/bin/prlimit", "--nofile=256", `--nproc=${input.limits.pids}`, "--", nodeRuntime.nodePath, "--permission", "--allow-fs-read=/plugin", "--allow-fs-read=/host", "/host/src/sandbox/plugin-host.ts");
+    return {
+        command: "bwrap",
+        args,
+        cwd: resolve(input.pluginDir),
+        env: { ...input.env },
+    };
+}
+export class BwrapBackend {
+    name = "bwrap";
+    async probe() {
+        if (!existsSync("/usr/bin/bwrap")) {
+            return {
+                available: false,
+                backend: this.name,
+                reason: "找不到 bwrap",
+                version: null,
+            };
+        }
+        const result = spawnSync("bwrap", [
+            "--unshare-all",
+            "--die-with-parent",
+            "--ro-bind",
+            "/",
+            "/",
+            "--dev",
+            "/dev",
+            "--proc",
+            "/proc",
+            "--",
+            "/bin/true",
+        ], { timeout: 3_000, encoding: "utf8" });
+        if (result.status !== 0) {
+            return {
+                available: false,
+                backend: this.name,
+                reason: (result.stderr ?? "").trim() || "bwrap 无法创建 namespace",
+                version: null,
+            };
+        }
+        return {
+            available: true,
+            backend: this.name,
+            reason: null,
+            version: null,
+        };
+    }
+    buildAgentLaunch(input) {
+        return buildBwrapLaunch(input);
+    }
+    buildPluginLaunch(input) {
+        return buildBwrapPluginLaunch(input);
+    }
+}
+//# sourceMappingURL=bwrap.js.map

package/dist/sandbox/backends/bwrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bwrap.js","sourceRoot":"","sources":["../../../src/sandbox/backends/bwrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAUjE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAE1C,SAAS,kBAAkB;IACvB,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACvD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAC9B,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,MAAM,GAA8B,UAAU;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/C,MAAM,MAAM,GACR,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IAClD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO;YACH,MAAM;YACN,QAAQ,EAAE,GAAG,SAAS,WAAW;YACjC,SAAS,EAAE,GAAG,SAAS,MAAM;SAChC,CAAA;IACL,CAAC;IACD,OAAO;QACH,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,GAAG,SAAS,OAAO;QAC7B,SAAS,EAAE,SAAS;KACvB,CAAA;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0B,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,GAAW;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,eAAe;AACf,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACpD,MAAM,IAAI,GAAa;QACnB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,MAAM;KACT,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,qDAAqD;IACrD,IAAI,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IACjF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAA;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEpE,MAAM,GAAG,GAA2B,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACpD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,CAAA;IAC1E;;;;OAIG;IACH,GAAG,CAAC,cAAc,CAAC;QACf,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACvF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjF,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QAChC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;KACxB,CAAA;AACL,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,sBAAsB,CAAC,KAAwB;IAC3D,MAAM,IAAI,GAAa;QACnB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,MAAM;KACT,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAE/B,MAAM,GAAG,GAA2B,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACpD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,CAAA;IAC1E,GAAG,CAAC,cAAc,CAAC;QACf,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACvF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,IAAI,CAAC,IAAI,CACL,kBAAkB,EAClB,cAAc,EACd,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAC9B,IAAI,EACJ,WAAW,CAAC,QAAQ,EACpB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,kCAAkC,CACrC,CAAA;IAED,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;KACxB,CAAA;AACL,CAAC;AAED,MAAM,OAAO,YAAY;IACZ,IAAI,GAAG,OAAO,CAAA;IAEvB,KAAK,CAAC,KAAK;QACP,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChC,OAAO;gBACH,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,IAAI;aAChB,CAAA;QACL,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CACpB,OAAO,EACP;YACI,eAAe;YACf,mBAAmB;YACnB,WAAW;YACX,GAAG;YACH,GAAG;YACH,OAAO;YACP,MAAM;YACN,QAAQ;YACR,OAAO;YACP,IAAI;YACJ,WAAW;SACd,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvC,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACH,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,sBAAsB;gBAC9D,OAAO,EAAE,IAAI;aAChB,CAAA;QACL,CAAC;QACD,OAAO;YACH,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;SAChB,CAAA;IACL,CAAC;IAED,gBAAgB,CAAC,KAAuB;QACpC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,iBAAiB,CAAC,KAAwB;QACtC,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;CACJ"}

package/dist/sandbox/backends/direct.d.ts

@@ -0,0 +1,7 @@
+import type { AgentLaunchInput, LaunchSpec, PluginLaunchInput, SandboxBackend, SandboxBackendStatus } from "../types.js";
+export declare class DirectBackend implements SandboxBackend {
+    readonly name = "direct";
+    probe(): Promise<SandboxBackendStatus>;
+    buildAgentLaunch(input: AgentLaunchInput): LaunchSpec;
+    buildPluginLaunch(input: PluginLaunchInput): LaunchSpec;
+}

package/dist/sandbox/backends/direct.js

@@ -0,0 +1,32 @@
+/*
+ * 无隔离 fallback：仅用于 best-effort / 测试。
+ * 不提供 fs、网络、进程隔离；严格模式禁止使用。
+ */
+export class DirectBackend {
+    name = "direct";
+    async probe() {
+        return {
+            available: true,
+            backend: this.name,
+            reason: null,
+            version: null,
+        };
+    }
+    buildAgentLaunch(input) {
+        return {
+            command: input.command,
+            args: [...input.argv],
+            cwd: input.cwd,
+            env: input.env,
+        };
+    }
+    buildPluginLaunch(input) {
+        return {
+            command: process.execPath,
+            args: [input.runnerPath],
+            cwd: input.pluginDir,
+            env: input.env,
+        };
+    }
+}
+//# sourceMappingURL=direct.js.map

package/dist/sandbox/backends/direct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct.js","sourceRoot":"","sources":["../../../src/sandbox/backends/direct.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,MAAM,OAAO,aAAa;IACb,IAAI,GAAG,QAAQ,CAAA;IAExB,KAAK,CAAC,KAAK;QACP,OAAO;YACH,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;SAChB,CAAA;IACL,CAAC;IAED,gBAAgB,CAAC,KAAuB;QACpC,OAAO;YACH,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;SACjB,CAAA;IACL,CAAC;IAED,iBAAiB,CAAC,KAAwB;QACtC,OAAO;YACH,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YACxB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;SACjB,CAAA;IACL,CAAC;CACJ"}

package/dist/sandbox/bridge-state.d.ts

@@ -0,0 +1,13 @@
+import type { Host } from "../api/host/host.js";
+export type BridgeLogLevel = "trace" | "debug" | "info" | "warn" | "error" | "fatal";
+export type BridgeOutputKind = "info" | "warn" | "error" | "print";
+export interface HostBridge {
+    /** 子进程 → 宿主请求（fs、subscribe、getHost snapshot 外的命令等） */
+    request(method: string, params: unknown, timeoutMs?: number): Promise<unknown>;
+    /** 单向事件（log/output/event publish） */
+    notify(method: string, params: unknown): void;
+    getHostSnapshot(): Host;
+    shutdown(): void;
+}
+export declare function setHostBridge(value: HostBridge | null): void;
+export declare function getHostBridge(): HostBridge | null;

package/dist/sandbox/bridge-state.js

@@ -0,0 +1,12 @@
+/*
+ * sandbox child 内的宿主 bridge。
+ * 由 plugin-host runner 安装；宿主进程里为 null，走本地实现。
+ */
+let bridge = null;
+export function setHostBridge(value) {
+    bridge = value;
+}
+export function getHostBridge() {
+    return bridge;
+}
+//# sourceMappingURL=bridge-state.js.map

package/dist/sandbox/bridge-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-state.js","sourceRoot":"","sources":["../../src/sandbox/bridge-state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,IAAI,MAAM,GAAsB,IAAI,CAAA;AAEpC,MAAM,UAAU,aAAa,CAAC,KAAwB;IAClD,MAAM,GAAG,KAAK,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,MAAM,CAAA;AACjB,CAAC"}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./backends/bwrap.js";
+export * from "./backends/direct.js";
+export * from "./manager.js";
+export * from "./supervisor.js";
+export * from "./types.js";

package/dist/sandbox/index.js

@@ -0,0 +1,6 @@
+export * from "./backends/bwrap.js";
+export * from "./backends/direct.js";
+export * from "./manager.js";
+export * from "./supervisor.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA"}

package/dist/sandbox/manager.d.ts

@@ -0,0 +1,8 @@
+import { type AgentCodeRequest, type AgentCodeResult, type SandboxBackendStatus, type AgentCodeTaskHandle, type SandboxManagerOptions } from "./types.js";
+export declare class SandboxManager {
+    #private;
+    constructor(options: SandboxManagerOptions);
+    probe(): Promise<SandboxBackendStatus>;
+    startAgentCode(request: AgentCodeRequest): Promise<AgentCodeTaskHandle>;
+    runAgentCode(request: AgentCodeRequest): Promise<AgentCodeResult>;
+}

package/dist/sandbox/manager.js

@@ -0,0 +1,325 @@
+/*
+ * SandboxManager：选择 backend、准备 workspace/scratch、执行 agent-code、收集 artifact。
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { auditSandbox } from "./audit.js";
+import { BwrapBackend } from "./backends/bwrap.js";
+import { DirectBackend } from "./backends/direct.js";
+import { createSandboxMemoryLimit } from "./memory-limit.js";
+import { startSandboxProcess } from "./supervisor.js";
+import { SandboxExecutionError, SandboxUnavailableError, } from "./types.js";
+const MAX_ARTIFACT_FILES = 32;
+const MAX_ARTIFACT_BYTES = 64 * 1024 * 1024;
+function clampInteger(value, min, max) {
+    return Math.min(max, Math.max(min, Math.trunc(value)));
+}
+function baseEnv() {
+    return {
+        PATH: "/usr/bin:/bin",
+        LANG: "C.UTF-8",
+        LC_ALL: "C.UTF-8",
+        TERM: "dumb",
+    };
+}
+async function ensureDirectory(path) {
+    await mkdir(path, { recursive: true });
+}
+function isInside(root, target) {
+    return target === root || target.startsWith(`${root}${sep}`);
+}
+async function collectArtifacts(scratchDir, sandboxDir) {
+    const source = join(scratchDir, "artifacts");
+    const info = await stat(source).catch(() => null);
+    if (info === null || !info.isDirectory()) {
+        return { artifacts: [], artifactDir: null };
+    }
+    const destination = join(sandboxDir, "artifacts");
+    await ensureDirectory(destination);
+    const collected = [];
+    let total = 0;
+    const entries = await readdir(source, { recursive: true, withFileTypes: true });
+    for (const entry of entries) {
+        if (!entry.isFile() || collected.length >= MAX_ARTIFACT_FILES) {
+            continue;
+        }
+        const parent = entry.parentPath ?? source;
+        const absolute = join(parent, entry.name);
+        const rel = relative(source, absolute);
+        if (rel.startsWith("..") || resolve(absolute) === resolve(source)) {
+            continue;
+        }
+        const fileInfo = await stat(absolute);
+        if (fileInfo.size > MAX_ARTIFACT_BYTES || total + fileInfo.size > MAX_ARTIFACT_BYTES) {
+            continue;
+        }
+        total += fileInfo.size;
+        const data = await readFile(absolute);
+        const sha256 = createHash("sha256").update(data).digest("hex");
+        const target = join(destination, rel);
+        await ensureDirectory(dirname(target));
+        await writeFile(target, data);
+        collected.push({ path: rel.split(sep).join("/"), size: fileInfo.size, sha256 });
+    }
+    return { artifacts: collected, artifactDir: destination };
+}
+export class SandboxManager {
+    #options;
+    #backend;
+    #resolved = null;
+    #memoryLimitWarned = false;
+    #active = 0;
+    #waiters = [];
+    constructor(options) {
+        this.#options = options;
+        this.#backend = options.backend ?? null;
+    }
+    async probe() {
+        if (this.#backend !== null) {
+            return await this.#backend.probe();
+        }
+        if (this.#options.settings.backend === "nsjail") {
+            return {
+                available: false,
+                backend: "nsjail",
+                reason: "nsjail 后端尚未实现",
+                version: null,
+            };
+        }
+        return await new BwrapBackend().probe();
+    }
+    async #resolveBackend(access) {
+        if (access === "danger-full-access") {
+            return new DirectBackend();
+        }
+        if (this.#backend !== null) {
+            return this.#backend;
+        }
+        if (this.#resolved !== null) {
+            return await this.#resolved;
+        }
+        this.#resolved = (async () => {
+            const { settings, logger } = this.#options;
+            if (settings.mode === "off") {
+                throw new SandboxUnavailableError("sandbox.mode = off，Agent 代码执行需要 sandbox");
+            }
+            const preferred = settings.backend;
+            const candidates = [];
+            if (preferred === "auto" || preferred === "bwrap") {
+                candidates.push(new BwrapBackend());
+            }
+            if (preferred === "nsjail") {
+                // nsjail 后端尚未实现，显式报告不可用
+                throw new SandboxUnavailableError("nsjail 后端尚未实现");
+            }
+            for (const candidate of candidates) {
+                const status = await candidate.probe();
+                if (status.available) {
+                    return candidate;
+                }
+                logger?.warn({ backend: candidate.name, reason: status.reason }, "sandbox backend 不可用");
+            }
+            if (settings.mode === "best-effort") {
+                logger?.warn({ backend: "direct" }, "sandbox 降级为 direct（无隔离），仅限开发/受信环境");
+                return new DirectBackend();
+            }
+            throw new SandboxUnavailableError("没有可用的 OS 级 sandbox 后端");
+        })();
+        return await this.#resolved;
+    }
+    async #acquireSlot() {
+        const max = this.#options.settings.maxConcurrent;
+        if (this.#active < max) {
+            this.#active += 1;
+            return;
+        }
+        await new Promise((resolve) => {
+            this.#waiters.push(resolve);
+        });
+        this.#active += 1;
+    }
+    #releaseSlot() {
+        this.#active -= 1;
+        const next = this.#waiters.shift();
+        next?.();
+    }
+    #limits(request) {
+        const settings = this.#options.settings;
+        return {
+            timeoutMs: clampInteger(request.timeoutMs ?? settings.defaultTimeoutMs, 100, 600_000),
+            memoryMB: clampInteger(request.memoryMB ?? settings.defaultMemoryMB, 32, 8_192),
+            pids: clampInteger(64, 1, 512),
+            outputLimitBytes: clampInteger(request.outputLimitBytes ?? settings.outputLimitBytes, 1024, 64 * 1024 * 1024),
+        };
+    }
+    async startAgentCode(request) {
+        if (typeof request.command !== "string" || request.command.trim() === "") {
+            throw new SandboxExecutionError("命令不能为空");
+        }
+        if (request.argv.some((item) => typeof item !== "string")) {
+            throw new SandboxExecutionError("argv 必须是字符串数组");
+        }
+        const access = request.access ?? this.#options.settings.access;
+        if (access !== "read-only" &&
+            access !== "workspace-write" &&
+            access !== "danger-full-access") {
+            throw new SandboxExecutionError(`未知 sandbox 权限：${String(access)}`);
+        }
+        const workspaceDir = resolve(request.workspaceDir ?? process.cwd());
+        const cwd = resolve(request.cwd ?? workspaceDir);
+        if (access !== "danger-full-access" && !isInside(workspaceDir, cwd)) {
+            throw new SandboxExecutionError(`cwd 不在 workspace 内：${cwd}`);
+        }
+        const workspaceInfo = await stat(workspaceDir).catch(() => null);
+        if (workspaceInfo === null || !workspaceInfo.isDirectory()) {
+            throw new SandboxExecutionError(`workspace 不存在：${workspaceDir}`);
+        }
+        const cwdInfo = await stat(cwd).catch(() => null);
+        if (cwdInfo === null || !cwdInfo.isDirectory()) {
+            throw new SandboxExecutionError(`cwd 不存在：${cwd}`);
+        }
+        const backend = await this.#resolveBackend(access);
+        await this.#acquireSlot();
+        try {
+            return await this.#startAgentCodeLocked(request, backend, workspaceDir, cwd, access);
+        }
+        catch (error) {
+            this.#releaseSlot();
+            throw error;
+        }
+    }
+    async runAgentCode(request) {
+        const task = await this.startAgentCode(request);
+        return await task.wait();
+    }
+    async #startAgentCodeLocked(request, backend, workspaceDir, cwd, access) {
+        const limits = this.#limits(request);
+        const sandboxId = randomUUID();
+        const sandboxDir = join(this.#options.paths.dataDir, "sandbox", sandboxId);
+        const scratchDir = join(sandboxDir, "scratch");
+        await ensureDirectory(join(scratchDir, "tmp"));
+        await ensureDirectory(join(scratchDir, "artifacts"));
+        const env = baseEnv();
+        if (backend.name === "bwrap") {
+            env["HOME"] = "/scratch";
+            env["TMPDIR"] = "/scratch/tmp";
+            env["SCRATCH"] = "/scratch";
+            env["WORKSPACE"] = "/workspace";
+        }
+        else {
+            env["HOME"] = scratchDir;
+            env["TMPDIR"] = join(scratchDir, "tmp");
+            env["SCRATCH"] = scratchDir;
+            env["WORKSPACE"] = workspaceDir;
+        }
+        const memoryLimit = backend.name === "bwrap"
+            ? await createSandboxMemoryLimit({
+                bytes: limits.memoryMB * 1024 * 1024,
+                timeoutMs: limits.timeoutMs,
+            })
+            : null;
+        if (memoryLimit !== null && !memoryLimit.active && !this.#memoryLimitWarned) {
+            this.#memoryLimitWarned = true;
+            this.#options.logger?.warn({ reason: memoryLimit.reason }, "沙箱物理内存限制不可用，仅保留 V8 堆上限与超时");
+        }
+        let processHandle;
+        try {
+            const baseSpec = backend.buildAgentLaunch({
+                workspaceDir,
+                scratchDir,
+                cwd,
+                access,
+                network: request.network,
+                command: request.command,
+                argv: request.argv,
+                env,
+                limits,
+            });
+            const spec = memoryLimit !== null && memoryLimit.active ? memoryLimit.wrap(baseSpec) : baseSpec;
+            processHandle = startSandboxProcess(spec, limits, {
+                stdin: request.stdin ?? "",
+            });
+        }
+        catch (error) {
+            await memoryLimit?.finish();
+            this.#releaseSlot();
+            throw error;
+        }
+        let finalize = null;
+        const wait = () => {
+            finalize ??= (async () => {
+                try {
+                    const processResult = await processHandle.done;
+                    const memory = await memoryLimit?.finish();
+                    const oomKilled = memory?.oomKilled === true;
+                    const { artifacts, artifactDir } = await collectArtifacts(scratchDir, sandboxDir);
+                    await rm(scratchDir, { recursive: true, force: true });
+                    auditSandbox(this.#options.paths, {
+                        type: "sandbox.agent-code",
+                        sandboxId,
+                        backend: backend.name,
+                        access,
+                        exitCode: processResult.exitCode,
+                        timedOut: processResult.timedOut,
+                        durationMs: processResult.durationMs,
+                        artifacts: artifacts.length,
+                    });
+                    this.#options.logger?.info({
+                        sandboxId,
+                        backend: backend.name,
+                        command: basename(request.command),
+                        exitCode: processResult.exitCode,
+                        timedOut: processResult.timedOut,
+                        durationMs: processResult.durationMs,
+                    }, "sandbox agent-code 执行完成");
+                    return {
+                        sandboxId,
+                        backend: backend.name,
+                        access,
+                        exitCode: processResult.exitCode,
+                        signal: processResult.signal,
+                        stdout: processResult.stdout,
+                        stderr: processResult.stderr,
+                        truncated: processResult.truncated,
+                        timedOut: processResult.timedOut,
+                        memoryLimit: memoryLimit?.active === true ? "cgroup" : "none",
+                        memoryLimitReason: memoryLimit !== null && !memoryLimit.active ? memoryLimit.reason : null,
+                        oomKilled,
+                        durationMs: processResult.durationMs,
+                        artifacts,
+                        artifactDir: artifactDir === null
+                            ? null
+                            : backend.name === "bwrap"
+                                ? "/scratch/artifacts"
+                                : artifactDir,
+                        sandboxDir: backend.name === "bwrap" ? "/scratch" : sandboxDir,
+                        hostArtifactDir: artifactDir,
+                        hostSandboxDir: sandboxDir,
+                    };
+                }
+                finally {
+                    this.#releaseSlot();
+                }
+            })();
+            void finalize.catch(() => undefined);
+            return finalize;
+        };
+        return {
+            sandboxId,
+            backend: backend.name,
+            access,
+            get stdout() {
+                return processHandle.stdout;
+            },
+            get stderr() {
+                return processHandle.stderr;
+            },
+            stop(mode) {
+                processHandle.stop(mode);
+            },
+            wait,
+        };
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/sandbox/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/sandbox/manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAI3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,wBAAwB,EAAyB,MAAM,mBAAmB,CAAA;AACnF,OAAO,EAAE,mBAAmB,EAA6B,MAAM,iBAAiB,CAAA;AAChF,OAAO,EACH,qBAAqB,EACrB,uBAAuB,GAU1B,MAAM,YAAY,CAAA;AAEnB,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAS3C,SAAS,YAAY,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,OAAO;IACZ,OAAO;QACH,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,MAAM;KACf,CAAA;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACvC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC1C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC3B,UAAkB,EAClB,UAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACjD,MAAM,eAAe,CAAC,WAAW,CAAC,CAAA;IAClC,MAAM,SAAS,GAAsB,EAAE,CAAA;IACvC,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;YAC5D,SAAQ;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,SAAQ;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,QAAQ,CAAC,IAAI,GAAG,kBAAkB,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;YACnF,SAAQ;QACZ,CAAC;QACD,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAA;QACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACtC,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;AAC7D,CAAC;AAED,MAAM,OAAO,cAAc;IACd,QAAQ,CAAuB;IACxC,QAAQ,CAAuB;IAC/B,SAAS,GAAmC,IAAI,CAAA;IAChD,kBAAkB,GAAG,KAAK,CAAA;IAC1B,OAAO,GAAG,CAAC,CAAA;IACF,QAAQ,GAAsB,EAAE,CAAA;IAEzC,YAAY,OAA8B;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK;QACP,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO;gBACH,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,IAAI;aAChB,CAAA;QACL,CAAC;QACD,OAAO,MAAM,IAAI,YAAY,EAAE,CAAC,KAAK,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAqB;QACvC,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,IAAI,aAAa,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAA;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAA;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,IAA6B,EAAE;YAClD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;YAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAA;YAChF,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAA;YAClC,MAAM,UAAU,GAAqB,EAAE,CAAA;YACvC,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAChD,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC,CAAA;YACvC,CAAC;YACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACzB,wBAAwB;gBACxB,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAA;YACtD,CAAC;YAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAA;gBACtC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACnB,OAAO,SAAS,CAAA;gBACpB,CAAC;gBACD,MAAM,EAAE,IAAI,CACR,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAClD,qBAAqB,CACxB,CAAA;YACL,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,MAAM,EAAE,IAAI,CACR,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,mCAAmC,CACtC,CAAA;gBACD,OAAO,IAAI,aAAa,EAAE,CAAA;YAC9B,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;QAC9D,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,MAAM,IAAI,CAAC,SAAS,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAA;QAChD,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;YACjB,OAAM;QACV,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IACrB,CAAC;IAED,YAAY;QACR,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClC,IAAI,EAAE,EAAE,CAAA;IACZ,CAAC;IAED,OAAO,CAAC,OAAyB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAA;QACvC,OAAO;YACH,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC;YACrF,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,CAAC;YAC/E,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC;YAC9B,gBAAgB,EAAE,YAAY,CAC1B,OAAO,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,EACrD,IAAI,EACJ,EAAE,GAAG,IAAI,GAAG,IAAI,CACnB;SACJ,CAAA;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAyB;QAC1C,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAA;QAC9D,IACI,MAAM,KAAK,WAAW;YACtB,MAAM,KAAK,iBAAiB;YAC5B,MAAM,KAAK,oBAAoB,EACjC,CAAC;YACC,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,YAAY,CAAC,CAAA;QAChD,IAAI,MAAM,KAAK,oBAAoB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAChE,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAqB,CAAC,WAAW,GAAG,EAAE,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACzB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,EAAE,CAAA;YACnB,MAAM,KAAK,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAyB;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAC/C,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,OAAyB,EACzB,OAAuB,EACvB,YAAoB,EACpB,GAAW,EACX,MAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC9C,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;QAEpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;QACrB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,CAAA;YACxB,GAAG,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAA;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,UAAU,CAAA;YAC3B,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;QACnC,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,CAAA;YACxB,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,UAAU,CAAA;YAC3B,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;QACnC,CAAC;QAED,MAAM,WAAW,GACb,OAAO,CAAC,IAAI,KAAK,OAAO;YACpB,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC3B,KAAK,EAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI;gBACpC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC9B,CAAC;YACJ,CAAC,CAAC,IAAI,CAAA;QACd,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAA;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CACtB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAC9B,2BAA2B,CAC9B,CAAA;QACL,CAAC;QAED,IAAI,aAAmC,CAAA;QACvC,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACtC,YAAY;gBACZ,UAAU;gBACV,GAAG;gBACH,MAAM;gBACN,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG;gBACH,MAAM;aACT,CAAC,CAAA;YACF,MAAM,IAAI,GACN,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YACtF,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC9C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;aAC7B,CAAC,CAAA;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,WAAW,EAAE,MAAM,EAAE,CAAA;YAC3B,IAAI,CAAC,YAAY,EAAE,CAAA;YACnB,MAAM,KAAK,CAAA;QACf,CAAC;QAED,IAAI,QAAQ,GAAoC,IAAI,CAAA;QACpD,MAAM,IAAI,GAAG,GAA6B,EAAE;YACxC,QAAQ,KAAK,CAAC,KAAK,IAA8B,EAAE;gBAC/C,IAAI,CAAC;oBACD,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,IAAI,CAAA;oBAC9C,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,MAAM,EAAE,CAAA;oBAC1C,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,KAAK,IAAI,CAAA;oBAC5C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CACrD,UAAU,EACV,UAAU,CACb,CAAA;oBACD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBACtD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;wBAC9B,IAAI,EAAE,oBAAoB;wBAC1B,SAAS;wBACT,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,MAAM;wBACN,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,UAAU,EAAE,aAAa,CAAC,UAAU;wBACpC,SAAS,EAAE,SAAS,CAAC,MAAM;qBAC9B,CAAC,CAAA;oBACF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CACtB;wBACI,SAAS;wBACT,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;wBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,UAAU,EAAE,aAAa,CAAC,UAAU;qBACvC,EACD,yBAAyB,CAC5B,CAAA;oBACD,OAAO;wBACH,SAAS;wBACT,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,MAAM;wBACN,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;wBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,WAAW,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;wBAC7D,iBAAiB,EACb,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;wBAC3E,SAAS;wBACT,UAAU,EAAE,aAAa,CAAC,UAAU;wBACpC,SAAS;wBACT,WAAW,EACP,WAAW,KAAK,IAAI;4BAChB,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;gCACxB,CAAC,CAAC,oBAAoB;gCACtB,CAAC,CAAC,WAAW;wBACvB,UAAU,EAAE,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;wBAC9D,eAAe,EAAE,WAAW;wBAC5B,cAAc,EAAE,UAAU;qBAC7B,CAAA;gBACL,CAAC;wBAAS,CAAC;oBACP,IAAI,CAAC,YAAY,EAAE,CAAA;gBACvB,CAAC;YACL,CAAC,CAAC,EAAE,CAAA;YACJ,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACpC,OAAO,QAAQ,CAAA;QACnB,CAAC,CAAA;QAED,OAAO;YACH,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,MAAM;YACN,IAAI,MAAM;gBACN,OAAO,aAAa,CAAC,MAAM,CAAA;YAC/B,CAAC;YACD,IAAI,MAAM;gBACN,OAAO,aAAa,CAAC,MAAM,CAAA;YAC/B,CAAC;YACD,IAAI,CAAC,IAAc;gBACf,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5B,CAAC;YACD,IAAI;SACP,CAAA;IACL,CAAC;CACJ"}