@zgsm/costrict-cli 0.21.0-nightly.20251213.977248e09

package/dist/src/utils/relaunch.test.js

@@ -0,0 +1,273 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { vi, describe, it, expect, beforeEach, afterEach, } from 'vitest';
+import { EventEmitter } from 'node:events';
+import { RELAUNCH_EXIT_CODE } from './processUtils.js';
+import { spawn } from 'node:child_process';
+vi.mock('node:child_process', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        spawn: vi.fn(),
+    };
+});
+const mockedSpawn = vi.mocked(spawn);
+// Import the functions initially
+import { relaunchAppInChildProcess, relaunchOnExitCode } from './relaunch.js';
+describe('relaunchOnExitCode', () => {
+    let processExitSpy;
+    let consoleErrorSpy;
+    let stdinResumeSpy;
+    beforeEach(() => {
+        processExitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+            throw new Error('PROCESS_EXIT_CALLED');
+        });
+        consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        stdinResumeSpy = vi
+            .spyOn(process.stdin, 'resume')
+            .mockImplementation(() => process.stdin);
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        processExitSpy.mockRestore();
+        consoleErrorSpy.mockRestore();
+        stdinResumeSpy.mockRestore();
+    });
+    it('should exit with non-RELAUNCH_EXIT_CODE', async () => {
+        const runner = vi.fn().mockResolvedValue(0);
+        await expect(relaunchOnExitCode(runner)).rejects.toThrow('PROCESS_EXIT_CALLED');
+        expect(runner).toHaveBeenCalledTimes(1);
+        expect(processExitSpy).toHaveBeenCalledWith(0);
+    });
+    it('should continue running when RELAUNCH_EXIT_CODE is returned', async () => {
+        let callCount = 0;
+        const runner = vi.fn().mockImplementation(async () => {
+            callCount++;
+            if (callCount === 1)
+                return RELAUNCH_EXIT_CODE;
+            if (callCount === 2)
+                return RELAUNCH_EXIT_CODE;
+            return 0; // Exit on third call
+        });
+        await expect(relaunchOnExitCode(runner)).rejects.toThrow('PROCESS_EXIT_CALLED');
+        expect(runner).toHaveBeenCalledTimes(3);
+        expect(processExitSpy).toHaveBeenCalledWith(0);
+    });
+    it('should handle runner errors', async () => {
+        const error = new Error('Runner failed');
+        const runner = vi.fn().mockRejectedValue(error);
+        await expect(relaunchOnExitCode(runner)).rejects.toThrow('PROCESS_EXIT_CALLED');
+        expect(runner).toHaveBeenCalledTimes(1);
+        expect(consoleErrorSpy).toHaveBeenCalledWith('Fatal error: Failed to relaunch the CLI process.', error);
+        expect(stdinResumeSpy).toHaveBeenCalled();
+        expect(processExitSpy).toHaveBeenCalledWith(1);
+    });
+});
+describe('relaunchAppInChildProcess', () => {
+    let processExitSpy;
+    let consoleErrorSpy;
+    let stdinPauseSpy;
+    let stdinResumeSpy;
+    // Store original values to restore later
+    const originalEnv = { ...process.env };
+    const originalExecArgv = [...process.execArgv];
+    const originalArgv = [...process.argv];
+    const originalExecPath = process.execPath;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        process.env = { ...originalEnv };
+        delete process.env['GEMINI_CLI_NO_RELAUNCH'];
+        process.execArgv = [...originalExecArgv];
+        process.argv = [...originalArgv];
+        process.execPath = '/usr/bin/node';
+        processExitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+            throw new Error('PROCESS_EXIT_CALLED');
+        });
+        consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        stdinPauseSpy = vi
+            .spyOn(process.stdin, 'pause')
+            .mockImplementation(() => process.stdin);
+        stdinResumeSpy = vi
+            .spyOn(process.stdin, 'resume')
+            .mockImplementation(() => process.stdin);
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+        process.execArgv = [...originalExecArgv];
+        process.argv = [...originalArgv];
+        process.execPath = originalExecPath;
+        processExitSpy.mockRestore();
+        consoleErrorSpy.mockRestore();
+        stdinPauseSpy.mockRestore();
+        stdinResumeSpy.mockRestore();
+    });
+    describe('when GEMINI_CLI_NO_RELAUNCH is set', () => {
+        it('should return early without spawning a child process', async () => {
+            process.env['GEMINI_CLI_NO_RELAUNCH'] = 'true';
+            await relaunchAppInChildProcess(['--test'], ['--verbose']);
+            expect(mockedSpawn).not.toHaveBeenCalled();
+            expect(processExitSpy).not.toHaveBeenCalled();
+        });
+    });
+    describe('when GEMINI_CLI_NO_RELAUNCH is not set', () => {
+        beforeEach(() => {
+            delete process.env['GEMINI_CLI_NO_RELAUNCH'];
+        });
+        it('should construct correct node arguments from execArgv, additionalNodeArgs, script, additionalScriptArgs, and argv', () => {
+            // Test the argument construction logic directly by extracting it into a testable function
+            // This tests the same logic that's used in relaunchAppInChildProcess
+            // Setup test data to verify argument ordering
+            const mockExecArgv = ['--inspect=9229', '--trace-warnings'];
+            const mockArgv = [
+                '/usr/bin/node',
+                '/path/to/cli.js',
+                'command',
+                '--flag=value',
+                '--verbose',
+            ];
+            const additionalNodeArgs = [
+                '--max-old-space-size=4096',
+                '--experimental-modules',
+            ];
+            const additionalScriptArgs = ['--model', 'gemini-1.5-pro', '--debug'];
+            // Extract the argument construction logic from relaunchAppInChildProcess
+            const script = mockArgv[1];
+            const scriptArgs = mockArgv.slice(2);
+            const nodeArgs = [
+                ...mockExecArgv,
+                ...additionalNodeArgs,
+                script,
+                ...additionalScriptArgs,
+                ...scriptArgs,
+            ];
+            // Verify the argument construction follows the expected pattern:
+            // [...process.execArgv, ...additionalNodeArgs, script, ...additionalScriptArgs, ...scriptArgs]
+            const expectedArgs = [
+                // Original node execution arguments
+                '--inspect=9229',
+                '--trace-warnings',
+                // Additional node arguments passed to function
+                '--max-old-space-size=4096',
+                '--experimental-modules',
+                // The script path
+                '/path/to/cli.js',
+                // Additional script arguments passed to function
+                '--model',
+                'gemini-1.5-pro',
+                '--debug',
+                // Original script arguments (everything after the script in process.argv)
+                'command',
+                '--flag=value',
+                '--verbose',
+            ];
+            expect(nodeArgs).toEqual(expectedArgs);
+        });
+        it('should handle empty additional arguments correctly', () => {
+            // Test edge cases with empty arrays
+            const mockExecArgv = ['--trace-warnings'];
+            const mockArgv = ['/usr/bin/node', '/app/cli.js', 'start'];
+            const additionalNodeArgs = [];
+            const additionalScriptArgs = [];
+            // Extract the argument construction logic
+            const script = mockArgv[1];
+            const scriptArgs = mockArgv.slice(2);
+            const nodeArgs = [
+                ...mockExecArgv,
+                ...additionalNodeArgs,
+                script,
+                ...additionalScriptArgs,
+                ...scriptArgs,
+            ];
+            const expectedArgs = ['--trace-warnings', '/app/cli.js', 'start'];
+            expect(nodeArgs).toEqual(expectedArgs);
+        });
+        it('should handle complex argument patterns', () => {
+            // Test with various argument types including flags with values, boolean flags, etc.
+            const mockExecArgv = ['--max-old-space-size=8192'];
+            const mockArgv = [
+                '/usr/bin/node',
+                '/cli.js',
+                '--config=/path/to/config.json',
+                '--verbose',
+                'subcommand',
+                '--output',
+                'file.txt',
+            ];
+            const additionalNodeArgs = ['--inspect-brk=9230'];
+            const additionalScriptArgs = ['--model=gpt-4', '--temperature=0.7'];
+            const script = mockArgv[1];
+            const scriptArgs = mockArgv.slice(2);
+            const nodeArgs = [
+                ...mockExecArgv,
+                ...additionalNodeArgs,
+                script,
+                ...additionalScriptArgs,
+                ...scriptArgs,
+            ];
+            const expectedArgs = [
+                '--max-old-space-size=8192',
+                '--inspect-brk=9230',
+                '/cli.js',
+                '--model=gpt-4',
+                '--temperature=0.7',
+                '--config=/path/to/config.json',
+                '--verbose',
+                'subcommand',
+                '--output',
+                'file.txt',
+            ];
+            expect(nodeArgs).toEqual(expectedArgs);
+        });
+        // Note: Additional integration tests for spawn behavior are complex due to module mocking
+        // limitations with ES modules. The core logic is tested in relaunchOnExitCode tests.
+        it('should handle null exit code from child process', async () => {
+            process.argv = ['/usr/bin/node', '/app/cli.js'];
+            const mockChild = createMockChildProcess(0, false); // Don't auto-close
+            mockedSpawn.mockImplementation(() => {
+                // Emit close with null code immediately
+                setImmediate(() => {
+                    mockChild.emit('close', null);
+                });
+                return mockChild;
+            });
+            // Start the relaunch process
+            const promise = relaunchAppInChildProcess([], []);
+            await expect(promise).rejects.toThrow('PROCESS_EXIT_CALLED');
+            // Should default to exit code 1
+            expect(processExitSpy).toHaveBeenCalledWith(1);
+        });
+    });
+});
+/**
+ * Creates a mock child process that emits events asynchronously
+ */
+function createMockChildProcess(exitCode = 0, autoClose = false) {
+    const mockChild = new EventEmitter();
+    Object.assign(mockChild, {
+        stdin: null,
+        stdout: null,
+        stderr: null,
+        stdio: [null, null, null],
+        pid: 12345,
+        killed: false,
+        exitCode: null,
+        signalCode: null,
+        spawnargs: [],
+        spawnfile: '',
+        kill: vi.fn(),
+        send: vi.fn(),
+        disconnect: vi.fn(),
+        unref: vi.fn(),
+        ref: vi.fn(),
+    });
+    if (autoClose) {
+        setImmediate(() => {
+            mockChild.emit('close', exitCode);
+        });
+    }
+    return mockChild;
+}
+//# sourceMappingURL=relaunch.test.js.map

package/dist/src/utils/relaunch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relaunch.test.js","sourceRoot":"","sources":["../../../src/utils/relaunch.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,EAAE,EACF,QAAQ,EACR,EAAE,EACF,MAAM,EACN,UAAU,EACV,SAAS,GAEV,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuC,CAAC;IAC3E,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErC,iCAAiC;AACjC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE9E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,cAA4B,CAAC;IACjC,IAAI,eAA6B,CAAC;IAClC,IAAI,cAA4B,CAAC;IAEjC,UAAU,CAAC,GAAG,EAAE;QACd,cAAc,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACjE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1E,cAAc,GAAG,EAAE;aAChB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;aAC9B,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,CAAC,WAAW,EAAE,CAAC;QAC7B,eAAe,CAAC,WAAW,EAAE,CAAC;QAC9B,cAAc,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE5C,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtD,qBAAqB,CACtB,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACnD,SAAS,EAAE,CAAC;YACZ,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,kBAAkB,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,kBAAkB,CAAC;YAC/C,OAAO,CAAC,CAAC,CAAC,qBAAqB;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtD,qBAAqB,CACtB,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtD,qBAAqB,CACtB,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAC1C,kDAAkD,EAClD,KAAK,CACN,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,cAA4B,CAAC;IACjC,IAAI,eAA6B,CAAC;IAClC,IAAI,aAA2B,CAAC;IAChC,IAAI,cAA4B,CAAC;IAEjC,yCAAyC;IACzC,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,gBAAgB,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE1C,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QAEnB,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAE7C,OAAO,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;QAEnC,cAAc,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACjE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1E,aAAa,GAAG,EAAE;aACf,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;aAC7B,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,cAAc,GAAG,EAAE;aAChB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;aAC9B,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;QAEpC,cAAc,CAAC,WAAW,EAAE,CAAC;QAC7B,eAAe,CAAC,WAAW,EAAE,CAAC;QAC9B,aAAa,CAAC,WAAW,EAAE,CAAC;QAC5B,cAAc,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC;YAE/C,MAAM,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAE3D,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACtD,UAAU,CAAC,GAAG,EAAE;YACd,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mHAAmH,EAAE,GAAG,EAAE;YAC3H,0FAA0F;YAC1F,qEAAqE;YAErE,8CAA8C;YAC9C,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG;gBACf,eAAe;gBACf,iBAAiB;gBACjB,SAAS;gBACT,cAAc;gBACd,WAAW;aACZ,CAAC;YACF,MAAM,kBAAkB,GAAG;gBACzB,2BAA2B;gBAC3B,wBAAwB;aACzB,CAAC;YACF,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAEtE,yEAAyE;YACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAErC,MAAM,QAAQ,GAAG;gBACf,GAAG,YAAY;gBACf,GAAG,kBAAkB;gBACrB,MAAM;gBACN,GAAG,oBAAoB;gBACvB,GAAG,UAAU;aACd,CAAC;YAEF,iEAAiE;YACjE,+FAA+F;YAC/F,MAAM,YAAY,GAAG;gBACnB,oCAAoC;gBACpC,gBAAgB;gBAChB,kBAAkB;gBAClB,+CAA+C;gBAC/C,2BAA2B;gBAC3B,wBAAwB;gBACxB,kBAAkB;gBAClB,iBAAiB;gBACjB,iDAAiD;gBACjD,SAAS;gBACT,gBAAgB;gBAChB,SAAS;gBACT,0EAA0E;gBAC1E,SAAS;gBACT,cAAc;gBACd,WAAW;aACZ,CAAC;YAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,oCAAoC;YACpC,MAAM,YAAY,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,kBAAkB,GAAa,EAAE,CAAC;YACxC,MAAM,oBAAoB,GAAa,EAAE,CAAC;YAE1C,0CAA0C;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAErC,MAAM,QAAQ,GAAG;gBACf,GAAG,YAAY;gBACf,GAAG,kBAAkB;gBACrB,MAAM;gBACN,GAAG,oBAAoB;gBACvB,GAAG,UAAU;aACd,CAAC;YAEF,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,oFAAoF;YACpF,MAAM,YAAY,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG;gBACf,eAAe;gBACf,SAAS;gBACT,+BAA+B;gBAC/B,WAAW;gBACX,YAAY;gBACZ,UAAU;gBACV,UAAU;aACX,CAAC;YACF,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YAEpE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAErC,MAAM,QAAQ,GAAG;gBACf,GAAG,YAAY;gBACf,GAAG,kBAAkB;gBACrB,MAAM;gBACN,GAAG,oBAAoB;gBACvB,GAAG,UAAU;aACd,CAAC;YAEF,MAAM,YAAY,GAAG;gBACnB,2BAA2B;gBAC3B,oBAAoB;gBACpB,SAAS;gBACT,eAAe;gBACf,mBAAmB;gBACnB,+BAA+B;gBAC/B,WAAW;gBACX,YAAY;gBACZ,UAAU;gBACV,UAAU;aACX,CAAC;YAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,0FAA0F;QAC1F,qFAAqF;QAErF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,OAAO,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;YAEhD,MAAM,SAAS,GAAG,sBAAsB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB;YACvE,WAAW,CAAC,kBAAkB,CAAC,GAAG,EAAE;gBAClC,wCAAwC;gBACxC,YAAY,CAAC,GAAG,EAAE;oBAChB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;YAEH,6BAA6B;YAC7B,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAElD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAE7D,gCAAgC;YAChC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,sBAAsB,CAC7B,WAAmB,CAAC,EACpB,YAAqB,KAAK;IAE1B,MAAM,SAAS,GAAG,IAAI,YAAY,EAAkB,CAAC;IAErD,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QACvB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACzB,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;QACnB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;KACb,CAAC,CAAC;IAEH,IAAI,SAAS,EAAE,CAAC;QACd,YAAY,CAAC,GAAG,EAAE;YAChB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/utils/resolvePath.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare function resolvePath(p: string): string;

package/dist/src/utils/resolvePath.js

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+export function resolvePath(p) {
+    if (!p) {
+        return '';
+    }
+    let expandedPath = p;
+    if (p.toLowerCase().startsWith('%userprofile%')) {
+        expandedPath = os.homedir() + p.substring('%userprofile%'.length);
+    }
+    else if (p === '~' || p.startsWith('~/')) {
+        expandedPath = os.homedir() + p.substring(1);
+    }
+    return path.normalize(expandedPath);
+}
+//# sourceMappingURL=resolvePath.js.map

package/dist/src/utils/resolvePath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvePath.js","sourceRoot":"","sources":["../../../src/utils/resolvePath.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,YAAY,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/utils/resolvePath.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/utils/resolvePath.test.js

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { resolvePath } from './resolvePath.js';
+vi.mock('node:os', () => ({
+    homedir: vi.fn(),
+}));
+describe('resolvePath', () => {
+    beforeEach(() => {
+        vi.mocked(os.homedir).mockReturnValue('/home/user');
+    });
+    it.each([
+        ['', ''],
+        ['/foo/bar', path.normalize('/foo/bar')],
+        ['~/foo', path.join('/home/user', 'foo')],
+        ['~', path.normalize('/home/user')],
+        ['%userprofile%/foo', path.join('/home/user', 'foo')],
+        ['%USERPROFILE%/foo', path.join('/home/user', 'foo')],
+    ])('resolvePath(%s) should return %s', (input, expected) => {
+        expect(resolvePath(input)).toBe(expected);
+    });
+    it('should handle path normalization', () => {
+        expect(resolvePath('/foo//bar/../baz')).toBe(path.normalize('/foo/baz'));
+    });
+});
+//# sourceMappingURL=resolvePath.test.js.map

package/dist/src/utils/resolvePath.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvePath.test.js","sourceRoot":"","sources":["../../../src/utils/resolvePath.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;CACjB,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,EAAE,EAAE,EAAE,CAAC;QACR,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;KACtD,CAAC,CAAC,kCAAkC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACzD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/utils/sandbox-macos-permissive-closed.sb

@@ -0,0 +1,32 @@
+(version 1)
+
+;; allow everything by default
+(allow default)
+
+;; deny all writes EXCEPT under specific paths
+(deny file-write*)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+
+;; deny all inbound network traffic EXCEPT on debugger port
+(deny network-inbound)
+(allow network-inbound (local ip "localhost:9229"))
+
+;; deny all outbound network traffic
+(deny network-outbound)

package/dist/src/utils/sandbox-macos-permissive-open.sb

@@ -0,0 +1,27 @@
+(version 1)
+
+;; allow everything by default
+(allow default)
+
+;; deny all writes EXCEPT under specific paths
+(deny file-write*)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+    (literal "/dev/ptmx")
+    (regex #"^/dev/ttys[0-9]*$")
+)

package/dist/src/utils/sandbox-macos-permissive-proxied.sb

@@ -0,0 +1,37 @@
+(version 1)
+
+;; allow everything by default
+(allow default)
+
+;; deny all writes EXCEPT under specific paths
+(deny file-write*)
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+
+;; deny all inbound network traffic EXCEPT on debugger port
+(deny network-inbound)
+(allow network-inbound (local ip "localhost:9229"))
+
+;; deny all outbound network traffic EXCEPT through proxy on localhost:8877
+;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
+;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
+(deny network-outbound)
+(allow network-outbound (remote tcp "localhost:8877"))
+
+(allow network-bind (local ip "*:*"))

package/dist/src/utils/sandbox-macos-restrictive-closed.sb

@@ -0,0 +1,93 @@
+(version 1)
+
+;; deny everything by default
+(deny default)
+
+;; allow reading files from anywhere on host
+(allow file-read*)
+
+;; allow exec/fork (children inherit policy)
+(allow process-exec)
+(allow process-fork)
+
+;; allow signals to self, e.g. SIGPIPE on write to closed pipe
+(allow signal (target self))
+
+;; allow read access to specific information about system
+;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+
+;; allow writes to specific paths
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+
+;; allow communication with sysmond for process listing (e.g. for pgrep)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+
+;; enable terminal access required by ink
+;; fixes setRawMode EPERM failure (at node:tty:81:24)
+(allow file-ioctl (regex #"^/dev/tty.*"))
+
+;; allow inbound network traffic on debugger port
+(allow network-inbound (local ip "localhost:9229"))

package/dist/src/utils/sandbox-macos-restrictive-open.sb

@@ -0,0 +1,96 @@
+(version 1)
+
+;; deny everything by default
+(deny default)
+
+;; allow reading files from anywhere on host
+(allow file-read*)
+
+;; allow exec/fork (children inherit policy)
+(allow process-exec)
+(allow process-fork)
+
+;; allow signals to self, e.g. SIGPIPE on write to closed pipe
+(allow signal (target self))
+
+;; allow read access to specific information about system
+;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+
+;; allow writes to specific paths
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+
+;; allow communication with sysmond for process listing (e.g. for pgrep)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+
+;; enable terminal access required by ink
+;; fixes setRawMode EPERM failure (at node:tty:81:24)
+(allow file-ioctl (regex #"^/dev/tty.*"))
+
+;; allow inbound network traffic on debugger port
+(allow network-inbound (local ip "localhost:9229"))
+
+;; allow all outbound network traffic
+(allow network-outbound)