@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/sandbox/bash.js

@@ -0,0 +1,190 @@
+/**
+ * Bash-tool sandbox wiring: decides whether a bash command runs
+ * sandboxed, and provides the spawnHook that wraps the command with the OS
+ * sandbox (srt) while pi's local exec backend keeps owning process
+ * lifecycle, timeout, and abort handling.
+ *
+ * The wrap uses pi's BashToolOptions.spawnHook (command/cwd/env rewrite
+ * before spawn) rather than replacing BashOperations wholesale — pi's
+ * battle-tested exec backend stays in charge; only the command string and
+ * proxy env change. user_bash (! commands) routes through the same wrap.
+ *
+ `dangerouslyDisableSandbox` mirrors Claude Code's bash tool parameter: the
+ * model may set it when it has evidence a sandbox restriction caused a
+ * failure; the parameter NEVER skips the permission gate (gate.ts routes the
+ * retry through the normal execPolicy/Guardian flow) — it only skips the OS
+ * wrap, and only when sandbox.allowUnsandboxedCommands is true.
+ *
+ * Child-process stdio-grace handling derived from pi-sandbox (MIT,
+ * carderne/pi-sandbox src/sandbox-runtime.ts) — not needed here because pi's
+ * local backend owns the child; the reference is credited for the operational
+ * lessons (process-group kill, stdio release).
+ */
+import { existsSync } from "node:fs";
+function stripLeadingSafeEnvVars(command) {
+    // Best-effort normalization for excludedCommands matching (not a security
+    // boundary — the permission gate is). Strips leading VAR=val pairs whose
+    // name can't affect binary resolution.
+    const SAFE = /^[A-Z_][A-Z0-9_]*=(?:[A-Za-z0-9_@./:+~-]+|"[^"\n]*"|'[^'\n]*')/;
+    let out = command.trimStart();
+    for (;;) {
+        const m = out.match(SAFE);
+        if (!m)
+            return out;
+        out = out.slice(m[0].length).trimStart();
+    }
+}
+function commandSegments(command) {
+    // Split on shell separators for excludedCommands matching against compound
+    // commands. Deliberately naive (no quote-awareness beyond the safe-env
+    // strip): excludedCommands is a convenience, never a security boundary.
+    // & (background) joins ;, &&, ||, | — a compound rider must not smuggle an
+    // excluded command's segment past the match.
+    return command
+        .split(/(?:\n|&&|\|\||;|\||&)/)
+        .map((s) => stripLeadingSafeEnvVars(s).trim())
+        .filter(Boolean);
+}
+function matchesExcludedPattern(pattern, candidate) {
+    if (pattern.endsWith(":*")) {
+        const prefix = pattern.slice(0, -2);
+        return candidate === prefix || candidate.startsWith(prefix + " ");
+    }
+    return candidate === pattern;
+}
+/**
+ * Does an excludedCommands pattern match any segment of the command?
+ * (Compound-aware: "echo hi && docker ps" must not ride an "echo:*" exclude.)
+ */
+export function commandHasExcludedSegment(command, excludedPatterns) {
+    if (excludedPatterns.length === 0)
+        return false;
+    const segments = commandSegments(command);
+    return segments.some((seg) => excludedPatterns.some((p) => matchesExcludedPattern(p, seg)));
+}
+/**
+ * Should this bash tool call run inside the OS sandbox?
+ * Pure — reads the decision inputs, no I/O.
+ */
+export function shouldUseSandbox(input, manager, settings) {
+    if (!manager.initialized)
+        return false;
+    if (!input.command)
+        return false;
+    if (input.dangerouslyDisableSandbox && settings.allowUnsandboxedCommands !== false)
+        return false;
+    if (commandHasExcludedSegment(input.command, settings.excludedCommands ?? []))
+        return false;
+    return true;
+}
+/**
+ * Build the spawnHook that wraps the command with the sandbox. The hook is
+ * async-ignoring by design: spawnHook is sync in pi's interface, so the
+ * command wrap must already be resolved — use preWrappedCommand() below to
+ * pre-wrap and stash, or build the hook from a pre-wrapped string.
+ *
+ * In practice we pre-wrap in tool_call (async, where we can await the wrap)
+ * by mutating event.input.command to the wrapped string, and the spawnHook
+ * only injects proxy env. That keeps a single code path for tool calls.
+ */
+/**
+ * Env additions every sandboxed process needs (srt injects proxy vars into
+ * the WRAPPED command's env; the spawnHook passes them through).
+ */
+export function sandboxSpawnEnv(manager) {
+    const env = {};
+    // Node >= 22.21 / >= 24: make undici honor proxy env vars, so fetch() in
+    // sandboxed node processes routes through the srt proxy like curl/git do.
+    const [major, minor] = process.versions.node.split(".").map(Number);
+    if ((major === 22 && minor >= 21) || major >= 24) {
+        env.NODE_USE_ENV_PROXY = "1";
+    }
+    return env;
+}
+/**
+ * spawnHook for the sandboxed bash tool: injects proxy-support env vars.
+ * The command itself was already wrapped (pre-wrap in tool_call, async).
+ */
+export function makeSandboxSpawnHook(manager) {
+    const extraEnv = sandboxSpawnEnv(manager);
+    return (ctx) => ({
+        ...ctx,
+        env: { ...ctx.env, ...extraEnv },
+    });
+}
+/**
+ * Wrap a raw command for OS-sandboxed execution. Returns the original string
+ * when the manager is not initialized (fail-open to plain execution — the
+ * permission gate still ran; the sandbox simply is not active).
+ */
+export async function preWrappedCommand(manager, command, binShell) {
+    if (!manager.initialized)
+        return command;
+    return manager.wrapWithSandbox(command, binShell);
+}
+/**
+ * Detect "Operation not permitted" style sandbox denials in bash output so
+ * callers (tool_result) can annotate and the model can react. Returns the
+ * offending path when found (pi-sandbox's regex, credited MIT).
+ */
+export function extractBlockedWritePath(output) {
+    const match = output.match(/(?:\/bin\/bash|bash|sh): (?:line \d+: )?(\/[^\s:]+): Operation not permitted/);
+    return match ? match[1] : null;
+}
+/**
+ * Wrap decision for user_bash (! commands): same rules as the tool, minus
+ * the dangerouslyDisableSandbox parameter (users running ! commands are
+ * already the principal, not the model).
+ */
+export function shouldUseSandboxForUserCommand(command, manager, settings) {
+    if (!manager.initialized)
+        return false;
+    if (!command)
+        return false;
+    return !commandHasExcludedSegment(command, settings.excludedCommands ?? []);
+}
+/**
+ * Post-execution violation annotation: annotate a command's combined output
+ * with sandbox violation details when the sandbox is active. Returns the
+ * annotated output (or the original when nothing to annotate).
+ */
+export function annotateCommandOutput(manager, command, output) {
+    if (!manager.initialized)
+        return output;
+    if (!output.includes("Operation not permitted"))
+        return output;
+    return manager.annotateStderrWithSandboxFailures(command, output);
+}
+/** cwd must exist before spawn (guard borrowed from pi's local ops). */
+export function assertSpawnableCwd(cwd) {
+    if (!existsSync(cwd))
+        throw new Error(`Working directory does not exist: ${cwd}`);
+}
+/**
+ * The gate's sandbox auto-allow decision — the production predicate index.ts
+ * wires into registerPermissionGate's sandboxAutoAllow dep. Exported so the
+ * precedence table is pinned by real tests, not mirrored tautologies.
+ *
+ * Declines (returns false): non-bash tools, autoAllow disabled by setting,
+ * manager not initialized, empty command, and — critically —
+ * dangerouslyDisableSandbox retries that will run UNSANDBOXED (they must pay
+ * the normal permission price; only strict-mode-forced sandboxing rides the
+ * auto-allow). Otherwise: shouldUseSandbox's decision (excludedCommands
+ * included — an excluded command runs unsandboxed through the ordinary flow).
+ */
+export function sandboxAutoAllowDecision(toolName, params, manager, settings) {
+    if (toolName !== "bash")
+        return false;
+    if (settings.autoAllowBashIfSandboxed === false)
+        return false;
+    if (!manager.initialized)
+        return false;
+    const command = typeof params.command === "string" ? params.command : "";
+    if (!command)
+        return false;
+    const retryUnsandboxed = params.dangerouslyDisableSandbox === true && settings.allowUnsandboxedCommands !== false;
+    if (retryUnsandboxed)
+        return false;
+    return shouldUseSandbox({ command, dangerouslyDisableSandbox: params.dangerouslyDisableSandbox === true }, manager, settings);
+}
+//# sourceMappingURL=bash.js.map

package/dist/extension/sandbox/config.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Sandbox settings schema + layered config load (user + project), shaped after
+ * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
+ * copied verbatim parses and resolves identically.
+ *
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
+ * .yagni-code/config.json (project) — the same pair permissionRules reads,
+ * so one settings file drives both the permission layer and the sandbox.
+ *
+ * Merge semantics (Claude parity): scalars — project wins over user over
+ * defaults; arrays — union + dedupe across sources (lists merge, never
+ * replace). Fail-soft: a malformed file is skipped whole with a warning
+ * (same posture as permissionRules/loadConfig.ts).
+ *
+ * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
+ * allowed by default with denyRead regions + allowRead re-allow; writes are
+ * allow-only (default-deny, /tmp included). Network: proxy-enforced
+ * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
+ * — loopback bypasses the proxy via no_proxy).
+ */
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+export interface SandboxNetworkSettings {
+    allowedDomains?: string[];
+    deniedDomains?: string[];
+    allowUnixSockets?: string[];
+    allowAllUnixSockets?: boolean;
+    allowLocalBinding?: boolean;
+    httpProxyPort?: number;
+    socksProxyPort?: number;
+}
+export interface SandboxFilesystemSettings {
+    allowRead?: string[];
+    denyRead?: string[];
+    allowWrite?: string[];
+    denyWrite?: string[];
+}
+export interface SandboxSettings {
+    enabled?: boolean;
+    /** Sandboxed bash auto-allows (explicit deny/ask rules still win). Default true. */
+    autoAllowBashIfSandboxed?: boolean;
+    /** false = strict mode: dangerouslyDisableSandbox is ignored entirely. Default true. */
+    allowUnsandboxedCommands?: boolean;
+    /** Exit-with-error posture when enabled but deps/platform unavailable. Default false. */
+    failIfUnavailable?: boolean;
+    excludedCommands?: string[];
+    network?: SandboxNetworkSettings;
+    filesystem?: SandboxFilesystemSettings;
+    ignoreViolations?: Record<string, string[]>;
+    enableWeakerNestedSandbox?: boolean;
+    enableWeakerNetworkIsolation?: boolean;
+}
+export interface SandboxConfigDiagnostics {
+    warnings: string[];
+    unknownKeys: string[];
+}
+export interface LoadedSandboxConfig {
+    settings: SandboxSettings;
+    diagnostics: SandboxConfigDiagnostics;
+}
+/**
+ * Read the `sandbox` object from one config file. Returns undefined when the
+ * file is missing, unreadable, malformed, or has no sandbox key. Collects
+ * unknown keys for diagnostics (ignored, never fatal).
+ */
+export declare function readSandboxSettingsFromFile(configPath: string, warnings: string[], unknownKeys: string[]): SandboxSettings | undefined;
+/**
+ * Load + merge sandbox settings from both config files. Scalars: project
+ * beats user; arrays: union. Defaults for scalars land here too (Claude
+ * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
+ * everything else unset/false.
+ */
+export declare function loadSandboxSettings(opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    stateHomeOverride?: string | null;
+}): LoadedSandboxConfig;
+export interface SandboxRuntimePaths {
+    cwd: string;
+    /** ~/.yagni-code (user `/`-anchor base + protected paths). */
+    userStateHome: string;
+    /** Project root; null outside a repo. */
+    projectRoot: string | null;
+    homeDir?: string;
+}
+export interface SandboxRuntimeMerge {
+    network: SandboxNetworkSettings & {
+        allowedDomains: string[];
+        deniedDomains: string[];
+    };
+    filesystem: SandboxFilesystemSettings & {
+        allowRead: string[];
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+    };
+    /** Permission rules that could not map into sandbox restrictions (surfaced
+     * in diagnostics — never silently dropped). */
+    droppedRules: string[];
+}
+/**
+ * Merge sandbox settings + permission rules into srt's effective filesystem /
+ * network restriction sets. Rule mapping (Claude parity):
+ *   Edit(path) allow  -> allowWrite
+ *   Edit(path) deny   -> denyWrite
+ *   Read(path) deny   -> denyRead
+ *   WebFetch(domain:) allow/deny -> allowedDomains / deniedDomains
+ *
+ * Rule paths use the permission-rule anchors (~/, //, settings-relative /,
+ * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
+ * path semantics (/ = absolute) exactly like Claude's two resolvers.
+ */
+export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths): SandboxRuntimeMerge;
+//# sourceMappingURL=config.d.ts.map

package/dist/extension/sandbox/config.js

@@ -0,0 +1,366 @@
+/**
+ * Sandbox settings schema + layered config load (user + project), shaped after
+ * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
+ * copied verbatim parses and resolves identically.
+ *
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
+ * .yagni-code/config.json (project) — the same pair permissionRules reads,
+ * so one settings file drives both the permission layer and the sandbox.
+ *
+ * Merge semantics (Claude parity): scalars — project wins over user over
+ * defaults; arrays — union + dedupe across sources (lists merge, never
+ * replace). Fail-soft: a malformed file is skipped whole with a warning
+ * (same posture as permissionRules/loadConfig.ts).
+ *
+ * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
+ * allowed by default with denyRead regions + allowRead re-allow; writes are
+ * allow-only (default-deny, /tmp included). Network: proxy-enforced
+ * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
+ * — loopback bypasses the proxy via no_proxy).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { codeStateHome } from "../stateHome.js";
+const KNOWN_TOP_LEVEL_KEYS = new Set([
+    "enabled",
+    "autoAllowBashIfSandboxed",
+    "allowUnsandboxedCommands",
+    "failIfUnavailable",
+    "excludedCommands",
+    "network",
+    "filesystem",
+    "ignoreViolations",
+    "enableWeakerNestedSandbox",
+    "enableWeakerNetworkIsolation",
+]);
+const KNOWN_NETWORK_KEYS = new Set([
+    "allowedDomains",
+    "deniedDomains",
+    "allowUnixSockets",
+    "allowAllUnixSockets",
+    "allowLocalBinding",
+    "httpProxyPort",
+    "socksProxyPort",
+]);
+const KNOWN_FILESYSTEM_KEYS = new Set(["allowRead", "denyRead", "allowWrite", "denyWrite"]);
+const ARRAY_KEYS_BY_SECTION = {
+    "": ["excludedCommands"],
+    network: ["allowedDomains", "deniedDomains", "allowUnixSockets"],
+    filesystem: ["allowRead", "denyRead", "allowWrite", "denyWrite"],
+};
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function stringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string") ? v : undefined;
+}
+/**
+ * Read the `sandbox` object from one config file. Returns undefined when the
+ * file is missing, unreadable, malformed, or has no sandbox key. Collects
+ * unknown keys for diagnostics (ignored, never fatal).
+ */
+export function readSandboxSettingsFromFile(configPath, warnings, unknownKeys) {
+    if (!existsSync(configPath))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+    }
+    catch (err) {
+        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    if (!isPlainObject(parsed) || parsed.sandbox === undefined)
+        return undefined;
+    if (!isPlainObject(parsed.sandbox)) {
+        warnings.push(`sandbox: "sandbox" in ${configPath} must be an object — ignored`);
+        return undefined;
+    }
+    const out = {};
+    const src = parsed.sandbox;
+    for (const [k, v] of Object.entries(src)) {
+        if (k === "network") {
+            if (isPlainObject(v)) {
+                const net = {};
+                for (const [nk, nv] of Object.entries(v)) {
+                    if (!KNOWN_NETWORK_KEYS.has(nk)) {
+                        unknownKeys.push(`network.${nk}`);
+                        continue;
+                    }
+                    if ((nk === "allowAllUnixSockets" || nk === "allowLocalBinding") && typeof nv === "boolean") {
+                        net[nk] = nv;
+                    }
+                    else if ((nk === "httpProxyPort" || nk === "socksProxyPort") && typeof nv === "number") {
+                        net[nk] = nv;
+                    }
+                    else {
+                        const arr = stringArray(nv);
+                        if (arr === undefined) {
+                            warnings.push(`sandbox: network.${nk} has an unsupported value type — ignored`);
+                        }
+                        else {
+                            net[nk] = arr;
+                        }
+                    }
+                }
+                out.network = net;
+            }
+            else {
+                warnings.push(`sandbox: network in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (k === "filesystem") {
+            if (isPlainObject(v)) {
+                const fs = {};
+                for (const [fk, fv] of Object.entries(v)) {
+                    if (!KNOWN_FILESYSTEM_KEYS.has(fk)) {
+                        unknownKeys.push(`filesystem.${fk}`);
+                        continue;
+                    }
+                    const arr = stringArray(fv);
+                    if (arr === undefined) {
+                        warnings.push(`sandbox: filesystem.${fk} has an unsupported value type — ignored`);
+                    }
+                    else {
+                        fs[fk] = arr;
+                    }
+                }
+                out.filesystem = fs;
+            }
+            else {
+                warnings.push(`sandbox: filesystem in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (!KNOWN_TOP_LEVEL_KEYS.has(k)) {
+            unknownKeys.push(k);
+            continue;
+        }
+        if (k === "ignoreViolations") {
+            if (isPlainObject(v)) {
+                const iv = {};
+                for (const [pat, arr] of Object.entries(v)) {
+                    const list = stringArray(arr);
+                    if (list === undefined) {
+                        warnings.push(`sandbox: ignoreViolations["${pat}"] must be a string array — ignored`);
+                    }
+                    else {
+                        iv[pat] = list;
+                    }
+                }
+                out.ignoreViolations = iv;
+            }
+            else {
+                warnings.push(`sandbox: ignoreViolations in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (k === "excludedCommands") {
+            const list = stringArray(v);
+            if (list === undefined)
+                warnings.push(`sandbox: excludedCommands must be a string array — ignored`);
+            else
+                out.excludedCommands = list;
+            continue;
+        }
+        if (typeof v === "boolean")
+            out[k] = v;
+        else
+            warnings.push(`sandbox: ${k} must be a boolean — ignored`);
+    }
+    return out;
+}
+function union(...lists) {
+    const present = lists.filter((l) => Array.isArray(l));
+    if (present.length === 0)
+        return undefined;
+    return [...new Set(present.flat())];
+}
+function mergeNetwork(user, project) {
+    const u = user ?? {};
+    const p = project ?? {};
+    return {
+        allowedDomains: union(u.allowedDomains, p.allowedDomains) ?? [],
+        deniedDomains: union(u.deniedDomains, p.deniedDomains) ?? [],
+        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets),
+        allowAllUnixSockets: p.allowAllUnixSockets ?? u.allowAllUnixSockets,
+        allowLocalBinding: p.allowLocalBinding ?? u.allowLocalBinding,
+        httpProxyPort: p.httpProxyPort ?? u.httpProxyPort,
+        socksProxyPort: p.socksProxyPort ?? u.socksProxyPort,
+    };
+}
+function mergeFilesystem(user, project) {
+    const u = user ?? {};
+    const p = project ?? {};
+    return {
+        allowRead: union(u.allowRead, p.allowRead),
+        denyRead: union(u.denyRead, p.denyRead) ?? [],
+        allowWrite: union(u.allowWrite, p.allowWrite) ?? [],
+        denyWrite: union(u.denyWrite, p.denyWrite) ?? [],
+    };
+}
+/**
+ * Load + merge sandbox settings from both config files. Scalars: project
+ * beats user; arrays: union. Defaults for scalars land here too (Claude
+ * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
+ * everything else unset/false.
+ */
+export function loadSandboxSettings(opts = {}) {
+    const warnings = [];
+    const unknownKeys = [];
+    const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const userPath = join(stateHome, "config.json");
+    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
+    const userSettings = readSandboxSettingsFromFile(userPath, warnings, unknownKeys);
+    const projectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
+    const settings = {
+        enabled: projectSettings?.enabled ?? userSettings?.enabled ?? false,
+        autoAllowBashIfSandboxed: projectSettings?.autoAllowBashIfSandboxed ?? userSettings?.autoAllowBashIfSandboxed ?? true,
+        allowUnsandboxedCommands: projectSettings?.allowUnsandboxedCommands ?? userSettings?.allowUnsandboxedCommands ?? true,
+        failIfUnavailable: projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
+        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands) ?? [],
+        network: mergeNetwork(userSettings?.network, projectSettings?.network),
+        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem),
+        ignoreViolations: projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
+        enableWeakerNestedSandbox: projectSettings?.enableWeakerNestedSandbox ?? userSettings?.enableWeakerNestedSandbox,
+        enableWeakerNetworkIsolation: projectSettings?.enableWeakerNetworkIsolation ?? userSettings?.enableWeakerNetworkIsolation,
+    };
+    return { settings, diagnostics: { warnings, unknownKeys } };
+}
+function expandHome(p, homeDir) {
+    if (p === "~")
+        return homeDir;
+    if (p.startsWith("~/"))
+        return join(homeDir, p.slice(2));
+    return p;
+}
+function resolveSandboxPath(pattern, base) {
+    const homeDir = base.homeDir ?? homeDirDefault();
+    if (pattern.startsWith("//"))
+        return pattern.slice(1); // absolute from root (Claude legacy)
+    if (pattern.startsWith("/")) {
+        // Claude permission-rule convention: settings-dir-relative. User rules
+        // resolve against ~/.yagni-code, project rules against the project root.
+        return join(base.userStateHome, pattern.slice(1));
+    }
+    return expandHome(pattern, homeDir);
+}
+function resolveSandboxFsPath(pattern, base) {
+    // sandbox.filesystem.* uses STANDARD path semantics (Claude #30067):
+    //   /path  -> absolute (as written)
+    //   //path -> absolute (legacy permission-rule escape, kept for compat)
+    //   ~/path, ./path, path -> expanded / settings-dir-relative
+    const homeDir = base.homeDir ?? homeDirDefault();
+    if (pattern.startsWith("//"))
+        return pattern.slice(1);
+    if (pattern.startsWith("/"))
+        return pattern;
+    return expandHome(pattern, homeDir);
+}
+let homeDirDefault = () => homeDirImpl();
+import { homedir as homeDirImpl } from "node:os";
+function homeDirDefaultFn() { return homeDirImpl(); }
+homeDirDefault = homeDirDefaultFn;
+/**
+ * Merge sandbox settings + permission rules into srt's effective filesystem /
+ * network restriction sets. Rule mapping (Claude parity):
+ *   Edit(path) allow  -> allowWrite
+ *   Edit(path) deny   -> denyWrite
+ *   Read(path) deny   -> denyRead
+ *   WebFetch(domain:) allow/deny -> allowedDomains / deniedDomains
+ *
+ * Rule paths use the permission-rule anchors (~/, //, settings-relative /,
+ * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
+ * path semantics (/ = absolute) exactly like Claude's two resolvers.
+ */
+export function mergeRulesIntoSandbox(settings, rules, base) {
+    const homeDir = base.homeDir ?? homeDirDefault();
+    const allowWrite = new Set([base.cwd, tmpdir()]);
+    const denyWrite = new Set();
+    const denyRead = new Set();
+    const allowRead = new Set();
+    const allowedDomains = new Set(settings.network?.allowedDomains ?? []);
+    const deniedDomains = new Set(settings.network?.deniedDomains ?? []);
+    /** Permission rules that could not map into sandbox restrictions —
+     * surfaced to the caller (diagnostics), never silently dropped. */
+    const droppedRules = [];
+    // Permission rules: user rules resolve /-anchors against the user state
+    // home, project rules against the project root (pathRules semantics).
+    for (const rule of rules) {
+        const anchorBase = {
+            ...base,
+            userStateHome: rule.source === "user" ? base.userStateHome : (base.projectRoot ?? base.userStateHome),
+        };
+        if (rule.toolName === "edit" || rule.toolName === "write") {
+            if (!rule.ruleContent)
+                continue;
+            const p = resolveSandboxPath(rule.ruleContent, anchorBase);
+            if (rule.behavior === "allow")
+                allowWrite.add(p);
+            // ask and deny BOTH deny in the sandbox: an ask rule's contract is
+            // "consult the user for writes here", and sandbox auto-allow would
+            // silently skip that consultation for bash — degrading ask to allow.
+            // denyWrite blocks bash at the OS level; the file tools still honor
+            // ask through the ordinary gate flow.
+            else if (rule.behavior === "deny" || rule.behavior === "ask")
+                denyWrite.add(p);
+        }
+        else if (rule.toolName === "read") {
+            if (!rule.ruleContent)
+                continue;
+            const p = resolveSandboxPath(rule.ruleContent, anchorBase);
+            if (rule.behavior === "deny")
+                denyRead.add(p);
+        }
+        else if (rule.toolName === "web_fetch") {
+            const m = rule.ruleContent?.match(/^domain:(.*)$/);
+            if (!m) {
+                // Non-domain web_fetch rules (bare tool-name form) cannot map into
+                // the network lists — surface instead of silently dropping.
+                droppedRules.push(rule.raw);
+                continue;
+            }
+            const domain = m[1];
+            if (rule.behavior === "allow")
+                allowedDomains.add(domain);
+            else if (rule.behavior === "deny")
+                deniedDomains.add(domain);
+            else if (rule.behavior === "ask")
+                deniedDomains.add(domain); // same ask-wins reasoning
+        }
+    }
+    // sandbox.filesystem.*: standard path semantics (NOT settings-relative).
+    for (const p of settings.filesystem?.allowWrite ?? [])
+        allowWrite.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.denyWrite ?? [])
+        denyWrite.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.denyRead ?? [])
+        denyRead.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.allowRead ?? [])
+        allowRead.add(resolveSandboxFsPath(p, base));
+    // Protected paths: always denyWrite, never exempted (Claude parity + our
+    // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
+    denyWrite.add(join(base.userStateHome, "config.json"));
+    if (base.projectRoot)
+        denyWrite.add(join(base.projectRoot, ".yagni-code", "config.json"));
+    denyWrite.add(base.userStateHome);
+    if (base.projectRoot)
+        denyWrite.add(join(base.projectRoot, ".yagni-code"));
+    return {
+        network: {
+            ...settings.network,
+            allowedDomains: [...allowedDomains],
+            deniedDomains: [...deniedDomains],
+        },
+        filesystem: {
+            allowRead: [...allowRead],
+            denyRead: [...denyRead],
+            allowWrite: [...allowWrite],
+            denyWrite: [...denyWrite],
+        },
+        droppedRules,
+    };
+}
+//# sourceMappingURL=config.js.map