@zhin.js/agent 1.1.2 → 1.1.5

package/lib/security/policy-facade.js

@@ -20,11 +20,150 @@
  * bash-tool 旧链不含 exec-policy，因此 bash 调用方不传 config，exec-policy 层不会激活。
  */
 import { checkMemoryWritePath } from '../memory-layers.js';
-import { checkFileAccess, checkBashCommandSafety, isBlockedDevicePath } from './file-policy.js';
+import { checkFileAccess, checkBashCommandSafety, extractBashReadPaths, isBlockedDevicePath, } from './file-policy.js';
 import { checkBashFilePermission, checkFilePermission, formatFilePermissionMessage, toolRequesterRoleToFileRole, } from './file-role-policy.js';
 import { checkBashSensitiveReadAccess, checkDangerousToolAccess, checkFileToolAccess, checkSensitiveFilePathAccess, toDenyError, toOwnerSignal, } from './dangerous-tool-policy.js';
 import { checkExecPolicyWithOptions } from './exec-policy.js';
 import { resolveToolRequesterRole } from './owner-approve-always-store.js';
+import { checkUrlNetworkAccess, extractUrlsFromCommand, NETWORK_COMMAND_PATTERNS, } from './network-policy.js';
+import { authorizeTurnFileInput } from './turn-file-authority.js';
+/** Generic, execution-domain-neutral policy facade for canonical Turn tools. */
+export async function runTurnToolPolicies(input) {
+    const requesterRole = resolveTurnRequesterRole(input.turn);
+    const networkDecision = checkTurnNetworkPolicy(input);
+    if (networkDecision)
+        return networkDecision;
+    const fileOperation = resolveTurnFileOperation(input.tool.name);
+    let authorizedInput = input.input;
+    if (fileOperation) {
+        const fileAuthority = await authorizeTurnFileInput(input.tool.name, input.input, input.turn.policy.filesystem?.workspaceRoot);
+        if (!fileAuthority.allowed) {
+            return Object.freeze({ status: 'denied', policy: 'workspace-access', reason: fileAuthority.reason });
+        }
+        authorizedInput = fileAuthority.input;
+        const path = stringArgument(authorizedInput, 'path', 'file_path', 'filePath');
+        const permission = checkFilePermission(toolRequesterRoleToFileRole(requesterRole), fileOperation, path);
+        const decision = turnFilePermissionDecision(permission, 'file-permission-matrix', authorizedInput);
+        if (decision)
+            return decision;
+    }
+    if (input.tool.name === 'bash') {
+        const command = stringArgument(input.input, 'command');
+        if (command) {
+            const safety = checkBashCommandSafety(command);
+            if (!safety.safe) {
+                return Object.freeze({
+                    status: 'denied',
+                    policy: 'bash-command-safety',
+                    reason: safety.reason ?? 'unsafe Bash command',
+                });
+            }
+            for (const path of extractBashReadPaths(command)) {
+                const sensitiveRead = checkFilePermission(toolRequesterRoleToFileRole(requesterRole), 'read', path);
+                const decision = turnFilePermissionDecision(sensitiveRead, 'bash-sensitive-read', input.input);
+                if (decision)
+                    return decision;
+            }
+            const permission = checkBashFilePermission(toolRequesterRoleToFileRole(requesterRole), command);
+            const decision = turnFilePermissionDecision(permission, 'bash-file-permission', input.input);
+            if (decision)
+                return decision;
+        }
+    }
+    if (input.tool.approval !== 'never') {
+        return Object.freeze({
+            status: 'approval_required',
+            policy: 'approval',
+            reason: `tool approval policy is ${input.tool.approval}`,
+            input: authorizedInput,
+        });
+    }
+    return Object.freeze({ status: 'allowed', input: authorizedInput });
+}
+function checkTurnNetworkPolicy(input) {
+    const command = input.tool.name === 'bash' ? stringArgument(input.input, 'command') : undefined;
+    const isNetworkCommand = Boolean(command && NETWORK_COMMAND_PATTERNS.some((pattern) => pattern.test(command)));
+    const isNetworkTool = input.tool.name === 'web_fetch' || input.tool.name === 'web_search';
+    if (!isNetworkCommand && !isNetworkTool)
+        return undefined;
+    const policy = input.turn.policy.network;
+    if (!policy?.enabled) {
+        return Object.freeze({
+            status: 'denied',
+            policy: 'network-access',
+            reason: 'Turn has no network authority',
+        });
+    }
+    const urls = input.tool.name === 'web_fetch'
+        ? [stringArgument(input.input, 'url')].filter((value) => Boolean(value))
+        : command
+            ? extractUrlsFromCommand(command)
+            : [];
+    if ((input.tool.name === 'web_fetch' || isNetworkCommand) && urls.length === 0) {
+        return Object.freeze({
+            status: 'denied',
+            policy: 'network-access',
+            reason: 'Network access requires a verifiable absolute URL',
+        });
+    }
+    for (const url of urls) {
+        const decision = checkUrlNetworkAccess(url, {
+            httpsOnly: policy.httpsOnly,
+            allowedDomains: [...(policy.allowedDomains ?? [])],
+        });
+        if (!decision.allowed) {
+            return Object.freeze({
+                status: 'denied',
+                policy: 'network-access',
+                reason: decision.reason ?? 'Network target denied',
+            });
+        }
+    }
+    return undefined;
+}
+function turnFilePermissionDecision(permission, policy, input) {
+    if (!permission.allowed) {
+        return Object.freeze({
+            status: 'denied',
+            policy,
+            reason: permission.reason ?? `file ${permission.operation} denied`,
+        });
+    }
+    if (permission.needsConfirmation || permission.needsOwnerConfirmation) {
+        return Object.freeze({
+            status: 'approval_required',
+            policy,
+            reason: permission.reason ?? `file ${permission.operation} requires approval`,
+            input,
+        });
+    }
+    return undefined;
+}
+function resolveTurnFileOperation(toolName) {
+    if (toolName === 'write_file')
+        return 'create';
+    if (toolName === 'edit_file')
+        return 'update';
+    if (toolName === 'read_file' || toolName === 'list_dir' || toolName === 'glob'
+        || toolName === 'grep' || toolName === 'analyze_media')
+        return 'read';
+    return undefined;
+}
+function resolveTurnRequesterRole(turn) {
+    if (turn.principal.roles.includes('master'))
+        return 'master';
+    if (turn.principal.roles.includes('trusted'))
+        return 'trusted';
+    return 'other';
+}
+function stringArgument(input, ...names) {
+    for (const name of names) {
+        const value = input[name];
+        if (typeof value === 'string' && value.trim())
+            return value;
+    }
+    return undefined;
+}
 const FILE_TOOL_NAMES = new Set(['read_file', 'list_dir', 'glob', 'grep', 'write_file', 'edit_file']);
 const DANGEROUS_TOOL_NAMES = new Set(['write_file', 'edit_file', 'web_fetch']);
 const WRITE_OPERATIONS = new Set(['create', 'update', 'delete']);
@@ -52,15 +191,44 @@ function fromDangerousDecision(d) {
         payload: d,
     };
 }
+/** 是否为 checkMemoryWritePath 已放行的记忆写路径（session 任意；global/platform 仅 master） */
+function isPermittedMemoryToolWrite(input) {
+    const filePath = input.rawFilePath ?? input.filePath;
+    if (!filePath || !isWriteAccess(input))
+        return false;
+    const decision = checkMemoryWritePath(filePath, input.commMessage);
+    return decision.scope !== 'none' && decision.allowed;
+}
 function sortByPriority(layers) {
     return layers.sort((a, b) => a.priority - b.priority);
 }
 const TOOL_POLICIES = sortByPriority([
+    {
+        name: 'network-access',
+        priority: 5,
+        applies: (input) => Boolean(input.networkPolicy && input.networkUrl),
+        check: (input) => {
+            const result = checkUrlNetworkAccess(input.networkUrl, {
+                httpsOnly: input.networkPolicy.httpsOnly,
+                allowedDomains: [...(input.networkPolicy.allowedDomains ?? [])],
+            });
+            return { allowed: result.allowed, reason: result.reason, payload: result };
+        },
+    },
     {
         name: 'role-gate',
         priority: 10,
         applies: (input) => FILE_TOOL_NAMES.has(input.toolName),
-        check: (input) => fromDangerousDecision(checkFileToolAccess(input.toolName, input.commMessage)),
+        check: (input) => {
+            // 与 checkMemoryWritePath 对齐：会话记忆写对任意角色放行（避免矩阵/危险工具层先拒）
+            if (isPermittedMemoryToolWrite(input)) {
+                const role = input.commMessage
+                    ? resolveToolRequesterRole(input.hostPlugin ?? null, input.commMessage)
+                    : 'unknown';
+                return { allowed: true, role };
+            }
+            return fromDangerousDecision(checkFileToolAccess(input.toolName, input.commMessage));
+        },
     },
     {
         name: 'bash-command-safety',
@@ -75,7 +243,15 @@ const TOOL_POLICIES = sortByPriority([
         name: 'dangerous-tool-approval',
         priority: 20,
         applies: (input) => DANGEROUS_TOOL_NAMES.has(input.toolName),
-        check: (input) => fromDangerousDecision(checkDangerousToolAccess(input.toolName, input.commMessage)),
+        check: (input) => {
+            if (isPermittedMemoryToolWrite(input)) {
+                const role = input.commMessage
+                    ? resolveToolRequesterRole(input.hostPlugin ?? null, input.commMessage)
+                    : 'unknown';
+                return { allowed: true, role };
+            }
+            return fromDangerousDecision(checkDangerousToolAccess(input.toolName, input.commMessage));
+        },
     },
     {
         name: 'bash-sensitive-read',
@@ -91,6 +267,17 @@ const TOOL_POLICIES = sortByPriority([
             const operation = resolveFileOperation(input);
             const roleGate = prior.find((r) => r.policy === 'role-gate');
             const requesterRole = roleGate?.decision.role ?? 'unknown';
+            if (isPermittedMemoryToolWrite(input)) {
+                return {
+                    allowed: true,
+                    role: requesterRole,
+                    payload: {
+                        allowed: true,
+                        role: toolRequesterRoleToFileRole(requesterRole),
+                        operation,
+                    },
+                };
+            }
             const fileRole = toolRequesterRoleToFileRole(requesterRole);
             const permResult = checkFilePermission(fileRole, operation, input.rawFilePath ?? input.filePath);
             return {

package/lib/security/policy-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAA0B,MAAM,iCAAiC,CAAC;AA6DnG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;KAChH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;KACzG;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,iEAAiE;YACjE,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;gBACnC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC;gBAC/D,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CACjG;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAA0B,MAAM,iCAAiC,CAAC;AACnG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAmElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7F,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAC1F,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,MAAM,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;oBACvE,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;oBACvE,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;KACzG;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,iEAAiE;YACjE,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;gBACnC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC;gBAC/D,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CACjG;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/security/sandbox.d.ts

@@ -10,6 +10,7 @@
  * - 环境变量清理
  * - 网络隔离（可选）
  */
+import { type GenerationStoreContext } from '@zhin.js/plugin-runtime';
 export interface SandboxConfig {
     /** 是否启用沙箱 */
     enabled: boolean;
@@ -92,14 +93,8 @@ export declare class Sandbox {
      */
     getConfig(): SandboxConfig;
 }
-/**
- * 获取全局沙箱实例
- */
 export declare function getSandbox(): Sandbox;
-/**
- * 初始化沙箱
- */
-export declare function initSandbox(config: Partial<SandboxConfig>): Sandbox;
+export declare function provideSandbox(context: GenerationStoreContext, config: Partial<SandboxConfig>): Sandbox;
 /** 重置全局沙箱（用于测试隔离） */
 export declare function resetSandbox(): void;
 /**

package/lib/security/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyEH,MAAM,WAAW,aAAa;IAC5B,aAAa;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IACxC,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2CD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAoDD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAgHlH,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAwB;gBAEpC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C,uBAAuB;IACvB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwC1B,mDAAmD;YACrC,WAAW;YAwIX,aAAa;IAoF3B;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B;AAMD;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAGnE;AAED,qBAAqB;AACrB,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAoE7F,MAAM,WAAW,aAAa;IAC5B,aAAa;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IACxC,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2CD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAoDD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA6GlH,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAwB;gBAEpC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C,uBAAuB;IACvB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwC1B,mDAAmD;YACrC,WAAW;YAwIX,aAAa;IAoF3B;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B;AAMD,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAIvG;AAED,qBAAqB;AACrB,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB"}

package/lib/security/sandbox.js

@@ -13,6 +13,8 @@
 import * as child_process from 'node:child_process';
 import * as os from 'node:os';
 import * as fs from 'node:fs';
+import { matchHardBlockedCommand } from './exec-policy.js';
+import { createGenerationStore } from '@zhin.js/plugin-runtime';
 // ── 资源限制包装 ────────────────────────────────────────────────────
 /**
  * 用 ulimit/timeout/nice 包装命令，强制施加资源限制。
@@ -160,6 +162,9 @@ function checkNetworkCommand(command, config) {
 }
 // ── 命令验证 ──────────────────────────────────────────────────────────
 function matchDangerousSandboxCommand(command) {
+    const hardBlocked = matchHardBlockedCommand(command);
+    if (hardBlocked)
+        return hardBlocked;
     const lower = command.toLowerCase();
     if ((lower.includes('curl') || lower.includes('wget')) &&
         lower.includes('|') &&
@@ -171,12 +176,6 @@ function matchDangerousSandboxCommand(command) {
         lower.includes('./')) {
         return '沙箱内禁止执行危险命令模式: curl/wget 下载后直接执行';
     }
-    if (/\b(?:rm|rmdir)\b/.test(lower) && lower.includes('node_modules')) {
-        return '沙箱内禁止执行危险命令模式: 删除 node_modules';
-    }
-    if (lower.includes('find') && lower.includes('node_modules') && lower.includes('-delete')) {
-        return '沙箱内禁止执行危险命令模式: find -delete node_modules';
-    }
     if (lower.includes('eval(') || lower.includes('exec(')) {
         return '沙箱内禁止执行危险命令模式: eval/exec';
     }
@@ -501,26 +500,18 @@ export class Sandbox {
     }
 }
 // ── 全局沙箱实例 ──────────────────────────────────────────────────────
-let globalSandbox = null;
-/**
- * 获取全局沙箱实例
- */
+const sandboxStore = createGenerationStore('zhin.agent.sandbox');
 export function getSandbox() {
-    if (!globalSandbox) {
-        globalSandbox = new Sandbox();
-    }
-    return globalSandbox;
+    return sandboxStore.tryUse() ?? new Sandbox();
 }
-/**
- * 初始化沙箱
- */
-export function initSandbox(config) {
-    globalSandbox = new Sandbox(config);
-    return globalSandbox;
+export function provideSandbox(context, config) {
+    const sandbox = new Sandbox(config);
+    sandboxStore.provide(context, sandbox);
+    return sandbox;
 }
 /** 重置全局沙箱（用于测试隔离） */
 export function resetSandbox() {
-    globalSandbox = null;
+    sandboxStore.clear();
 }
 /**
  * 在沙箱中执行命令

package/lib/security/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,iEAAiE;AAEjE;;;GAGG;AACH,SAAS,qBAAqB,CAC5B,MAA0E;IAE1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,sCAAsC,CAAC;IAEhF,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,0CAA0C;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,sBAAsB,CAAC,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAElD,qBAAqB;IACrB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sCAAsC,CAAC;IAEtE,uBAAuB;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,WAAW,yCAAyC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,eAAe;IAC9B,CAAC;AACH,CAAC;AAED,gCAAgC;AAChC,SAAS,gBAAgB,CAAC,KAAiC,EAAE,SAAyB,SAAS;IAC7F,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;AACH,CAAC;AAqCD,MAAM,cAAc,GAAkB;IACpC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK,EAAY,OAAO;IACjC,WAAW,EAAE,GAAG,EAAU,SAAS;IACnC,aAAa,EAAE,EAAE,EAAS,MAAM;IAChC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAG,QAAQ;IAC1C,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE;QACd,MAAM;QACN,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,UAAU;QACV,MAAM;QACN,UAAU;QACV,kBAAkB;QAClB,mBAAmB;KACpB;IACD,cAAc,EAAE;QACd,uBAAuB;QACvB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,gCAAgC;QAChC,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,kBAAkB;QAClB,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,iBAAiB;KAClB;CACF,CAAC;AA4BF,mEAAmE;AAEnE;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,YAAY;IACZ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,UAAU;IACV,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,aAAa;YACb,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,SAAS,CAAE,WAAW;YACxB,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iEAAiE;AAEjE,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAA0B,MAAM,qBAAqB,CAAC;AAExF;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,MAAqB;IAErB,OAAO,yBAAyB,CAAC,OAAO,EAAE;QACxC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AAErE,SAAS,4BAA4B,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EACpB,CAAC;QACD,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrE,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3F,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,MAAqB;IAC7D,aAAa;IACb,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,WAAW;QACX,MAAM,mBAAmB,GAAG,+DAA+D,CAAC;QAC5F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,cAAc;YACd,MAAM,YAAY,GAAG;gBACnB,MAAM,CAAC,gBAAgB;gBACvB,WAAW;gBACX,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO,EAAG,WAAW;gBACrB,OAAO;gBACP,QAAQ;aACT,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,oBAAoB,QAAQ,EAAE;iBACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU;QACV,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,oEAAoE;AAEpE,MAAM,OAAO,OAAO;IACV,MAAM,CAAgB;IACtB,gBAAgB,GAAmB,IAAI,CAAC,CAAC,SAAS;IAE1D,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,uBAAuB;IACf,eAAe;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEnC,yBAAyB;QACzB,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC7D,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,OAI9B;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,qBAAqB;QACrB,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,MAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,UAAU,CAAC,MAAM;aAC/B,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC3D,OAAO,eAAe,CAAC,OAAO,EAAE;oBAC9B,GAAG,IAAI,CAAC,MAAM;oBACd,gBAAgB,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;iBACjD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,qBAAqB;YACvB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,mDAAmD;IAC3C,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,OAI1C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,SAAS;QACT,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,4BAA4B;QAC5B,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,aAAa;gBACb,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3E,SAAS,CAAE,WAAW;gBACxB,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,SAAS;QACT,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1E,WAAW;QACX,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,wBAAwB;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;YACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YAEnB,6BAA6B;YAC7B,MAAM,cAAc,GAAG,qBAAqB,CAAC;gBAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,OAAO;gBACP,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;aACzC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;gBAChE,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE;gBACnD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ,EAAE,IAAI,EAAE,oBAAoB;aACrC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAChE,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,0BAA0B;YAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;gBACrC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACd,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;wBAC3C,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;YAExB,gBAAgB;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,aAAa,CAAC,CAAC;gBAE7B,aAAa;gBACb,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,KAAK;wBAAE,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC3C,CAAC;gBAED,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE;wBACb,OAAO,EAAE,CAAC;wBACV,WAAW,EAAE,YAAY,GAAG,IAAI,EAAE,WAAW;qBAC9C;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,aAAa,CAAC,CAAC;gBAE7B,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAI5C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;YAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAClC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE;gBACrC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAChE,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,MAAM,UAAU,GAAG,QAAQ,IAAI,QAAQ,IAAI,OAAO,CAAC;gBAEnD,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,UAAU;oBACtC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;oBACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;oBACjD,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA8B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,mEAAmE;AAEnE,IAAI,aAAa,GAAmB,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAA8B;IACxD,aAAa,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,YAAY;IAC1B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAIvD;IACC,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAA+B,MAAM,yBAAyB,CAAC;AAE7F,iEAAiE;AAEjE;;;GAGG;AACH,SAAS,qBAAqB,CAC5B,MAA0E;IAE1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,sCAAsC,CAAC;IAEhF,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,0CAA0C;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,sBAAsB,CAAC,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAElD,qBAAqB;IACrB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sCAAsC,CAAC;IAEtE,uBAAuB;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,WAAW,yCAAyC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,eAAe;IAC9B,CAAC;AACH,CAAC;AAED,gCAAgC;AAChC,SAAS,gBAAgB,CAAC,KAAiC,EAAE,SAAyB,SAAS;IAC7F,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;AACH,CAAC;AAqCD,MAAM,cAAc,GAAkB;IACpC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK,EAAY,OAAO;IACjC,WAAW,EAAE,GAAG,EAAU,SAAS;IACnC,aAAa,EAAE,EAAE,EAAS,MAAM;IAChC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAG,QAAQ;IAC1C,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE;QACd,MAAM;QACN,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,UAAU;QACV,MAAM;QACN,UAAU;QACV,kBAAkB;QAClB,mBAAmB;KACpB;IACD,cAAc,EAAE;QACd,uBAAuB;QACvB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,gCAAgC;QAChC,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,kBAAkB;QAClB,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,iBAAiB;KAClB;CACF,CAAC;AA4BF,mEAAmE;AAEnE;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,YAAY;IACZ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,UAAU;IACV,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,aAAa;YACb,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,SAAS,CAAE,WAAW;YACxB,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iEAAiE;AAEjE,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAA0B,MAAM,qBAAqB,CAAC;AAExF;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,MAAqB;IAErB,OAAO,yBAAyB,CAAC,OAAO,EAAE;QACxC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AAErE,SAAS,4BAA4B,CAAC,OAAe;IACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EACpB,CAAC;QACD,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3F,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,MAAqB;IAC7D,aAAa;IACb,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,WAAW;QACX,MAAM,mBAAmB,GAAG,+DAA+D,CAAC;QAC5F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,cAAc;YACd,MAAM,YAAY,GAAG;gBACnB,MAAM,CAAC,gBAAgB;gBACvB,WAAW;gBACX,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO,EAAG,WAAW;gBACrB,OAAO;gBACP,QAAQ;aACT,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,oBAAoB,QAAQ,EAAE;iBACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU;QACV,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,oEAAoE;AAEpE,MAAM,OAAO,OAAO;IACV,MAAM,CAAgB;IACtB,gBAAgB,GAAmB,IAAI,CAAC,CAAC,SAAS;IAE1D,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,uBAAuB;IACf,eAAe;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEnC,yBAAyB;QACzB,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC7D,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,OAI9B;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,qBAAqB;QACrB,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,MAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,UAAU,CAAC,MAAM;aAC/B,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC3D,OAAO,eAAe,CAAC,OAAO,EAAE;oBAC9B,GAAG,IAAI,CAAC,MAAM;oBACd,gBAAgB,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;iBACjD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,qBAAqB;YACvB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,mDAAmD;IAC3C,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,OAI1C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,SAAS;QACT,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,4BAA4B;QAC5B,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,aAAa;gBACb,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3E,SAAS,CAAE,WAAW;gBACxB,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,SAAS;QACT,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1E,WAAW;QACX,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,wBAAwB;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;YACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YAEnB,6BAA6B;YAC7B,MAAM,cAAc,GAAG,qBAAqB,CAAC;gBAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,OAAO;gBACP,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;aACzC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;gBAChE,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE;gBACnD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ,EAAE,IAAI,EAAE,oBAAoB;aACrC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAChE,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,0BAA0B;YAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;gBACrC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACd,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;wBAC3C,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;YAExB,gBAAgB;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,aAAa,CAAC,CAAC;gBAE7B,aAAa;gBACb,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,KAAK;wBAAE,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC3C,CAAC;gBAED,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE;wBACb,OAAO,EAAE,CAAC;wBACV,WAAW,EAAE,YAAY,GAAG,IAAI,EAAE,WAAW;qBAC9C;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,aAAa,CAAC,CAAC;gBAE7B,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAI5C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;YAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAClC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE;gBACrC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAChE,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,CAAC,CAAC;YAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,MAAM,UAAU,GAAG,QAAQ,IAAI,QAAQ,IAAI,OAAO,CAAC;gBAEnD,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,UAAU;oBACtC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;oBACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;oBACjD,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA8B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,mEAAmE;AAEnE,MAAM,YAAY,GAAG,qBAAqB,CAAU,oBAAoB,CAAC,CAAC;AAE1E,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA+B,EAAE,MAA8B;IAC5F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,YAAY;IAC1B,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAIvD;IACC,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/lib/security/turn-file-authority.d.ts

@@ -0,0 +1,14 @@
+export type AuthorizedFileInput = Readonly<{
+    allowed: true;
+    input: Readonly<Record<string, unknown>>;
+}> | Readonly<{
+    allowed: false;
+    reason: string;
+}>;
+/**
+ * Resolves one file invocation against its Turn-owned workspace authority.
+ * Existing symlinks and the nearest existing parent are canonicalized before
+ * containment is checked, so execution receives the exact path policy approved.
+ */
+export declare function authorizeTurnFileInput(toolName: string, input: Readonly<Record<string, unknown>>, workspaceRoot: string | undefined): Promise<AuthorizedFileInput>;
+//# sourceMappingURL=turn-file-authority.d.ts.map

package/lib/security/turn-file-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-file-authority.d.ts","sourceRoot":"","sources":["../../src/security/turn-file-authority.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACrE,QAAQ,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAYjD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACxC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAuC9B"}

package/lib/security/turn-file-authority.js

@@ -0,0 +1,101 @@
+import { lstat, readlink, realpath } from 'node:fs/promises';
+import * as path from 'node:path';
+import { checkFileAccess, isBlockedDevicePath } from './file-policy.js';
+const FILE_PATH_ARGUMENTS = Object.freeze({
+    read_file: 'file_path',
+    write_file: 'file_path',
+    edit_file: 'file_path',
+    list_dir: 'path',
+    glob: 'cwd',
+    grep: 'path',
+    analyze_media: 'file_path',
+});
+/**
+ * Resolves one file invocation against its Turn-owned workspace authority.
+ * Existing symlinks and the nearest existing parent are canonicalized before
+ * containment is checked, so execution receives the exact path policy approved.
+ */
+export async function authorizeTurnFileInput(toolName, input, workspaceRoot) {
+    const argument = FILE_PATH_ARGUMENTS[toolName];
+    if (!argument)
+        return Object.freeze({ allowed: true, input });
+    if (!workspaceRoot?.trim()) {
+        return deny('Turn has no filesystem workspace authority');
+    }
+    const rawValue = input[argument];
+    const defaultToWorkspace = (toolName === 'glob' || toolName === 'grep') && rawValue === undefined;
+    if (!defaultToWorkspace && (typeof rawValue !== 'string' || !rawValue.trim())) {
+        return deny(`${argument} is required`);
+    }
+    const rawPath = defaultToWorkspace ? '.' : String(rawValue);
+    if (rawPath === '~' || rawPath.startsWith('~/') || rawPath.startsWith('~\\')) {
+        return deny('Home-relative paths are outside the Turn workspace authority');
+    }
+    try {
+        const canonicalRoot = await realpath(path.resolve(workspaceRoot));
+        const requested = path.isAbsolute(rawPath)
+            ? path.resolve(rawPath)
+            : path.resolve(canonicalRoot, rawPath);
+        const canonicalTarget = await canonicalizeTarget(requested);
+        if (!isWithin(canonicalRoot, canonicalTarget)) {
+            return deny(`Path is outside the authorized workspace: ${rawPath}`);
+        }
+        if (isBlockedDevicePath(canonicalTarget)) {
+            return deny(`Blocked device path: ${rawPath}`);
+        }
+        const access = checkFileAccess(canonicalTarget, canonicalRoot);
+        if (!access.allowed)
+            return deny(access.reason ?? `Sensitive path denied: ${rawPath}`);
+        return Object.freeze({
+            allowed: true,
+            input: Object.freeze({ ...input, [argument]: canonicalTarget }),
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return deny(`Cannot authorize file path: ${message}`);
+    }
+}
+async function canonicalizeTarget(target) {
+    const missing = [];
+    let cursor = target;
+    while (true) {
+        try {
+            const existing = await realpath(cursor);
+            return path.resolve(existing, ...missing.reverse());
+        }
+        catch (error) {
+            if (!isMissingPath(error))
+                throw error;
+            try {
+                const entry = await lstat(cursor);
+                if (entry.isSymbolicLink()) {
+                    const link = await readlink(cursor);
+                    const target = path.resolve(path.dirname(cursor), link);
+                    const canonicalLinkTarget = await canonicalizeTarget(target);
+                    return path.resolve(canonicalLinkTarget, ...missing.reverse());
+                }
+            }
+            catch (linkError) {
+                if (!isMissingPath(linkError))
+                    throw linkError;
+            }
+            const parent = path.dirname(cursor);
+            if (parent === cursor)
+                throw error;
+            missing.push(path.basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+function isWithin(root, target) {
+    const relative = path.relative(root, target);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function isMissingPath(error) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT');
+}
+function deny(reason) {
+    return Object.freeze({ allowed: false, reason });
+}
+//# sourceMappingURL=turn-file-authority.js.map

package/lib/security/turn-file-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-file-authority.js","sourceRoot":"","sources":["../../src/security/turn-file-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAMxE,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,WAAW;IACvB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,MAAM;IAChB,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,MAAM;IACZ,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,KAAwC,EACxC,aAAiC;IAEjC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC;IAClG,IAAI,CAAC,kBAAkB,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,QAAQ,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,6CAA6C,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;oBACxD,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;oBAAE,MAAM,SAAS,CAAC;YACjD,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/lib/security/turn-network-client.d.ts

@@ -0,0 +1,30 @@
+import type { ToolInvocationPolicy } from '@zhin.js/tool';
+export interface NetworkTextResponse {
+    readonly url: string;
+    readonly status: number;
+    readonly statusText: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: string;
+}
+export interface NetworkRequestOptions {
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly timeoutMs?: number;
+    readonly maxRedirects?: number;
+    readonly maxBytes?: number;
+}
+export interface NetworkTransport {
+    request(url: URL, headers: Readonly<Record<string, string>>, signal: AbortSignal, maxBytes: number): Promise<Omit<NetworkTextResponse, 'url'>>;
+}
+/** Turn-scoped network module: policy, DNS pinning, redirects, timeout, and body limits. */
+export declare class TurnNetworkClient {
+    private readonly policy;
+    private readonly signal;
+    private readonly transport;
+    constructor(policy: ToolInvocationPolicy, signal: AbortSignal, transport?: NetworkTransport);
+    getText(url: string, options?: NetworkRequestOptions): Promise<NetworkTextResponse>;
+}
+export declare class NodeNetworkTransport implements NetworkTransport {
+    request(url: URL, headers: Readonly<Record<string, string>>, signal: AbortSignal, maxBytes: number): Promise<Omit<NetworkTextResponse, 'url'>>;
+}
+export declare function authorizeNetworkUrl(url: string, policy: ToolInvocationPolicy): URL;
+//# sourceMappingURL=turn-network-client.d.ts.map

package/lib/security/turn-network-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-network-client.d.ts","sourceRoot":"","sources":["../../src/security/turn-network-client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAO1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CACL,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC;CAC9C;AAED,4FAA4F;AAC5F,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,WAAW,EACnB,SAAS,GAAE,gBAA6C;IAGrE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAuB9F;AAED,qBAAa,oBAAqB,YAAW,gBAAgB;IACrD,OAAO,CACX,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;CAa7C;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,GAAG,CAUlF"}