apex-code 0.0.1-alpha.8 → 0.0.4

package/dist/core/sandbox/macos-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macos-backend.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/macos-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAa,MAAM,oBAAoB,CAAC;AAKtD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AA6ED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,cAAc,CAoJ9F","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { mkdirSync, realpathSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface MacosSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/**\n\t * Injectable only so violation attribution can be tested off macOS; production\n\t * spawns `sandbox-exec` directly. Without this the decision about what counts as a\n\t * violation would be verifiable only on a macOS host.\n\t */\n\tspawnChild?: typeof spawn;\n}\n\nfunction sandboxExecExists(command: string): boolean {\n\t// sandbox-exec has no --version flag; a real, minimal profile run is the\n\t// standard existence-and-basic-functionality probe (see the 2b.5 prototype's\n\t// own positive control).\n\tconst result = spawnSync(command, [\"-p\", \"(version 1)(allow default)\", \"/usr/bin/true\"], {\n\t\tstdio: \"ignore\",\n\t\ttimeout: 2_000,\n\t});\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\n/**\n * Unlike Linux's bwrap (which needs each mount ancestor declared for its bind-mount\n * tree), Seatbelt's `subpath` is recursive from a single root, so only the directory\n * containing each path is needed -- no ancestor walk. Each directory is resolved to\n * its real (symlink-free) path: Seatbelt canonicalizes the path it actually checks\n * against a `subpath` rule (confirmed empirically -- a rule built from an\n * unresolved symlinked path, e.g. Homebrew's own layout, silently never matches).\n */\nfunction readOnlyDirectories(paths: readonly string[]): string[] {\n\tconst directories = paths.map((path) => dirname(resolve(path)));\n\tconst canonical = directories.map((directory) => {\n\t\ttry {\n\t\t\treturn realpathSync(directory);\n\t\t} catch {\n\t\t\treturn directory;\n\t\t}\n\t});\n\treturn [...new Set(canonical)];\n}\n\n/**\n * Canonicalize a channel socket path for a Seatbelt literal. Only the directory can be\n * resolved -- the socket file need not exist yet when the profile is written -- and the\n * same symlink rule as `readOnlyDirectories` applies: Seatbelt matches the canonical\n * path, so an unresolved one silently never matches.\n */\nfunction canonicalSocketPath(path: string): string {\n\tconst directory = dirname(resolve(path));\n\ttry {\n\t\treturn join(realpathSync(directory), basename(path));\n\t} catch {\n\t\treturn join(directory, basename(path));\n\t}\n}\n\n/** Seatbelt refuses through the blocked call's own errno text, not a wrapper message. */\nconst DENIAL_EVIDENCE = /Operation not permitted|Permission denied|EPERM|EACCES/i;\n\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | \"unknown\" | undefined {\n\t// Confirmed empirically (2b.5 prototype): unlike Linux's bwrap, macOS Seatbelt\n\t// denials surface through the launched command's own generic \"Operation not\n\t// permitted\"/EPERM text for filesystem AND network refusals alike -- there is no\n\t// macOS-specific phrase equivalent to Linux's distinct \"Network is unreachable\".\n\t// Only sandbox-exec's own wrapper-level exec refusal (a sign our own profile\n\t// forgot to allow a binary, not a policy decision) is unambiguous from stderr\n\t// text. Anything else that still shows a refusal stays \"unknown\";\n\t// network-proxy.ts's own precise per-request recording is the reliable \"network\"\n\t// signal on this platform.\n\tif (/execvp\\(\\) of .* failed: Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (DENIAL_EVIDENCE.test(stderr)) return \"unknown\";\n\t// No refusal in evidence. The coarseness above is about telling filesystem from\n\t// network, not about telling a denial from an ordinary failure -- a non-zero exit\n\t// on its own says nothing about the boundary, and reporting it as a violation\n\t// sends the reader looking for a refusal that never happened.\n\treturn undefined;\n}\n\n/**\n * macOS's platform adapter. Seatbelt (`sandbox-exec`) allows reads broadly except\n * the invoking account's home directory, denies writes outside the workspace, and\n * denies network outside the sandbox proxy's exact loopback port -- narrower than\n * the wildcard `localhost:*` pattern some other sandboxes use. This mirrors Linux's\n * actual posture (`--ro-bind / /` plus a hidden `/home`) rather than the narrower\n * read-allowlist this design started with, which broke ordinary process startup.\n */\nexport function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"darwin\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on macOS only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? sandboxExecExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\n\tif (!hasCommand(\"sandbox-exec\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"sandbox-exec (Seatbelt) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\t// Same reasoning as readOnlyDirectories: on macOS the workspace itself can\n\t\t\t// be reached through a symlink (e.g. os.tmpdir()'s /var -> /private/var),\n\t\t\t// and Seatbelt's subpath match is against the canonical path, not the one\n\t\t\t// the caller happened to spell. Resolve once, use everywhere below.\n\t\t\tconst workspace = realpathSync(launch.policy.workspace);\n\t\t\tconst stateDirectory = join(workspace, \".apex-code\", \"sandbox-state\");\n\t\t\tmkdirSync(stateDirectory, { recursive: true });\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\ttcpHost: \"127.0.0.1\",\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t});\n\t\t\tconst proxyPort = proxy.port as number;\n\n\t\t\t// Seatbelt cannot remap a path, so the child connects to the channel socket at\n\t\t\t// its host path, and the profile allows outbound to exactly that one socket.\n\t\t\tconst credentialChannelSocket = launch.credentialChannel\n\t\t\t\t? canonicalSocketPath(launch.credentialChannel.hostSocketPath)\n\t\t\t\t: undefined;\n\n\t\t\tconst readOnlyDirs = readOnlyDirectories([process.execPath, launch.command, ...(launch.readOnlyPaths ?? [])]);\n\t\t\tconst readOnlyFiles = (launch.readOnlyFiles ?? []).map((path) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn realpathSync(path);\n\t\t\t\t} catch {\n\t\t\t\t\treturn resolve(path);\n\t\t\t\t}\n\t\t\t});\n\t\t\tlet userHome: string | undefined;\n\t\t\ttry {\n\t\t\t\tuserHome = realpathSync(homedir());\n\t\t\t} catch {\n\t\t\t\tuserHome = homedir();\n\t\t\t}\n\n\t\t\tconst profileLines = [\n\t\t\t\t\"(version 1)\",\n\t\t\t\t// bsd.sb's baseline is broader than Linux's opt-in bind-mount model --\n\t\t\t\t// a real gap this design accepts, documented in the spec's fourth\n\t\t\t\t// amendment -- but it is the only combination the 2b.5 prototype found\n\t\t\t\t// that lets a normal Unix child process (dyld, /bin/sh) actually start.\n\t\t\t\t'(import \"bsd.sb\")',\n\t\t\t\t\"(allow process-exec*)\",\n\t\t\t\t// Separate from process-exec* -- confirmed empirically: a shell that\n\t\t\t\t// forks a child shell (e.g. `sh -c 'a' && sh -c 'b'`) failed with\n\t\t\t\t// \"fork: Operation not permitted\" without this, even with exec allowed.\n\t\t\t\t\"(allow process-fork)\",\n\t\t\t\t// Matches Linux's actual posture (bwrap's `--ro-bind / /`): broad read,\n\t\t\t\t// narrow write. A read-only allowlist alone (this design's first cut)\n\t\t\t\t// breaks ordinary process startup -- confirmed empirically, getcwd()\n\t\t\t\t// itself needs to traverse the workspace's ancestor directories, which\n\t\t\t\t// no read rule scoped only to the workspace or runtime paths covers.\n\t\t\t\t\"(allow file-read*)\",\n\t\t\t\t'(deny file-read* (subpath (param \"USER_HOME\")))',\n\t\t\t\t...readOnlyDirs.map((_, index) => `(allow file-read* (subpath (param \"RO_${index}\")))`),\n\t\t\t\t...readOnlyFiles.map((_, index) => `(allow file-read* (subpath (param \"RO_FILE_${index}\")))`),\n\t\t\t\t'(allow file-read* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny file-write*)\",\n\t\t\t\t'(allow file-write* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny network*)\",\n\t\t\t\t'(allow network-outbound (remote ip (param \"PROXY_ADDR\")))',\n\t\t\t\t...(credentialChannelSocket\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${credentialChannelSocket}\")))`]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t\tconst profilePath = join(stateDirectory, \"profile.sb\");\n\t\t\twriteFileSync(profilePath, profileLines.join(\"\\n\"));\n\n\t\t\tconst params: string[] = [\"-D\", `USER_HOME=${userHome}`];\n\t\t\treadOnlyDirs.forEach((dir, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_${index}=${dir}`);\n\t\t\t});\n\t\t\treadOnlyFiles.forEach((file, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_FILE_${index}=${file}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `WORKSPACE=${workspace}`);\n\t\t\tparams.push(\"-D\", `PROXY_ADDR=localhost:${proxyPort}`);\n\n\t\t\tconst spawnSandboxExec = options?.spawnChild ?? spawn;\n\t\t\tconst child = spawnSandboxExec(\n\t\t\t\t\"sandbox-exec\",\n\t\t\t\t[\"-f\", profilePath, ...params, \"--\", launch.command, ...launch.args],\n\t\t\t\t{\n\t\t\t\t\tcwd: workspace,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.environment,\n\t\t\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\tHTTP_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\tHTTPS_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t},\n\t\t\t\t\tstdio: [\"inherit\", \"inherit\", \"pipe\"],\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\tstderr += chunk;\n\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t});\n\t\t\tconst exitCode = await waitForExit(child);\n\t\t\tawait proxy?.close();\n\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\tif (kind) {\n\t\t\t\tviolationStore?.add({\n\t\t\t\t\tkind,\n\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn exitCode;\n\t\t},\n\t\tasync close() {\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"macos-backend.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/macos-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAa,MAAM,oBAAoB,CAAC;AAOtD,OAAO,EAEN,KAAK,wBAAwB,EAI7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,iBAAiB,CAAC;AAQrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B,qFAAqF;IACrF,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAClC;AA+FD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,cAAc,CA8O9F","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { typeScriptSourceConfigFiles } from \"../extensions/source-runtime.ts\";\nimport { createCommandEscalationApprover, createCredentialReleaser, createHostApprover } from \"./host-approval.ts\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport {\n\tCOMMAND_ESCALATION_SOCKET_VARIABLE,\n\ttype CommandEscalationRequest,\n\ttype CommandEscalationResult,\n\tcreateCommandEscalationProxy,\n\tresolveCommandEscalationChannelPaths,\n} from \"./rpc/command-proxy.ts\";\nimport {\n\tfillHostGitCredential,\n\tGIT_CREDENTIAL_SOCKET_VARIABLE,\n\tresolveGitCredentialChannelPaths,\n\twriteGitCredentialHelper,\n} from \"./rpc/git-credential-helper.ts\";\nimport { createGitCredentialProxy, type GitCredentialProxy } from \"./rpc/git-credential-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport {\n\tcreateTerminalHandoff,\n\tTERMINAL_HANDOFF_ACK_PATH_VARIABLE,\n\tTERMINAL_HANDOFF_PATH_VARIABLE,\n\ttype TerminalHandoff,\n} from \"./terminal-handoff.ts\";\nimport { publishTerminalSize, TERMINAL_SIZE_PATH_VARIABLE } from \"./terminal-size.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface MacosSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/**\n\t * Injectable only so violation attribution can be tested off macOS; production\n\t * spawns `sandbox-exec` directly. Without this the decision about what counts as a\n\t * violation would be verifiable only on a macOS host.\n\t */\n\tspawnChild?: typeof spawn;\n\t/** Injectable only for tests, which have no terminal to approve an escalation at. */\n\trequestCommandEscalation?: (request: CommandEscalationRequest) => Promise<boolean>;\n\t/** Retained for source compatibility; launch state is now required on each launch. */\n\tsupervisorStateDirectory?: string;\n}\n\nconst ESCALATION_OUTPUT_LIMIT = 64 * 1024;\n\nfunction seatbeltParameter(value: string): string {\n\treturn value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll(\"\\n\", \"\\\\n\").replaceAll('\"', '\\\\\"');\n}\n\nfunction appendBounded(current: string, chunk: string, limit = ESCALATION_OUTPUT_LIMIT): string {\n\tif (current.length >= limit) return current;\n\treturn current + chunk.slice(0, limit - current.length);\n}\n\nfunction sandboxExecExists(command: string): boolean {\n\t// sandbox-exec has no --version flag; a real, minimal profile run is the\n\t// standard existence-and-basic-functionality probe (see the 2b.5 prototype's\n\t// own positive control).\n\tconst result = spawnSync(command, [\"-p\", \"(version 1)(allow default)\", \"/usr/bin/true\"], {\n\t\tstdio: \"ignore\",\n\t\ttimeout: 2_000,\n\t});\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\n/**\n * Unlike Linux's bwrap (which needs each mount ancestor declared for its bind-mount\n * tree), Seatbelt's `subpath` is recursive from a single root, so only the directory\n * containing each path is needed -- no ancestor walk. Each directory is resolved to\n * its real (symlink-free) path: Seatbelt canonicalizes the path it actually checks\n * against a `subpath` rule (confirmed empirically -- a rule built from an\n * unresolved symlinked path, e.g. Homebrew's own layout, silently never matches).\n */\nfunction readOnlyDirectories(paths: readonly string[]): string[] {\n\tconst directories = paths.map((path) => {\n\t\tconst resolved = resolve(path);\n\t\ttry {\n\t\t\treturn statSync(resolved).isDirectory() ? resolved : dirname(resolved);\n\t\t} catch {\n\t\t\treturn dirname(resolved);\n\t\t}\n\t});\n\tconst canonical = directories.map((directory) => {\n\t\ttry {\n\t\t\treturn realpathSync(directory);\n\t\t} catch {\n\t\t\treturn directory;\n\t\t}\n\t});\n\treturn [...new Set(canonical)];\n}\n\n/**\n * Canonicalize a channel socket path for a Seatbelt literal. Only the directory can be\n * resolved -- the socket file need not exist yet when the profile is written -- and the\n * same symlink rule as `readOnlyDirectories` applies: Seatbelt matches the canonical\n * path, so an unresolved one silently never matches.\n */\nfunction canonicalSocketPath(path: string): string {\n\tconst directory = dirname(resolve(path));\n\ttry {\n\t\treturn join(realpathSync(directory), basename(path));\n\t} catch {\n\t\treturn join(directory, basename(path));\n\t}\n}\n\n/** Seatbelt refuses through the blocked call's own errno text, not a wrapper message. */\nconst DENIAL_EVIDENCE = /Operation not permitted|Permission denied|EPERM|EACCES/i;\n\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | \"unknown\" | undefined {\n\t// Confirmed empirically (2b.5 prototype): unlike Linux's bwrap, macOS Seatbelt\n\t// denials surface through the launched command's own generic \"Operation not\n\t// permitted\"/EPERM text for filesystem AND network refusals alike -- there is no\n\t// macOS-specific phrase equivalent to Linux's distinct \"Network is unreachable\".\n\t// Only sandbox-exec's own wrapper-level exec refusal (a sign our own profile\n\t// forgot to allow a binary, not a policy decision) is unambiguous from stderr\n\t// text. Anything else that still shows a refusal stays \"unknown\";\n\t// network-proxy.ts's own precise per-request recording is the reliable \"network\"\n\t// signal on this platform.\n\tif (/execvp\\(\\) of .* failed: Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (DENIAL_EVIDENCE.test(stderr)) return \"unknown\";\n\t// No refusal in evidence. The coarseness above is about telling filesystem from\n\t// network, not about telling a denial from an ordinary failure -- a non-zero exit\n\t// on its own says nothing about the boundary, and reporting it as a violation\n\t// sends the reader looking for a refusal that never happened.\n\treturn undefined;\n}\n\n/**\n * macOS's platform adapter. Seatbelt (`sandbox-exec`) allows reads broadly except\n * the invoking account's home directory, denies writes outside the workspace, and\n * denies network outside the sandbox proxy's exact loopback port -- narrower than\n * the wildcard `localhost:*` pattern some other sandboxes use. This mirrors Linux's\n * actual posture (`--ro-bind / /` plus a hidden `/home`) rather than the narrower\n * read-allowlist this design started with, which broke ordinary process startup.\n */\nexport function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"darwin\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on macOS only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? sandboxExecExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\tlet handoff: TerminalHandoff | undefined;\n\tlet gitCredentialProxy: GitCredentialProxy | undefined;\n\tlet gitCredentialDirectory: string | undefined;\n\tlet escalationProxy: Awaited<ReturnType<typeof createCommandEscalationProxy>> | undefined;\n\tlet escalationDirectory: string | undefined;\n\tif (!hasCommand(\"sandbox-exec\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"sandbox-exec (Seatbelt) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\t// Same reasoning as readOnlyDirectories: on macOS the workspace itself can\n\t\t\t// be reached through a symlink (e.g. os.tmpdir()'s /var -> /private/var),\n\t\t\t// and Seatbelt's subpath match is against the canonical path, not the one\n\t\t\t// the caller happened to spell. Resolve once, use everywhere below.\n\t\t\tconst workspace = realpathSync(launch.policy.workspace);\n\t\t\tconst writableRoots = launch.policy.additionalWritableRoots;\n\t\t\tconst stateDirectory = join(workspace, \".apex-code\", \"sandbox-state\");\n\t\t\tmkdirSync(stateDirectory, { recursive: true });\n\t\t\tconst supervisorStateDirectory = launch.supervisorStateDirectory;\n\t\t\tmkdirSync(supervisorStateDirectory, { recursive: true, mode: 0o700 });\n\t\t\tconst acknowledgementPath = join(stateDirectory, \"terminal-handoff-ack\");\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\thandoff = createTerminalHandoff(supervisorStateDirectory, { acknowledgementPath });\n\t\t\t// Both channels are AF_UNIX servers, which Windows has not got. Nothing is lost\n\t\t\t// by skipping them there: ADR 0005 leaves Windows unsupported and this backend\n\t\t\t// reports `unavailable` on any real Windows host. They are reachable here only\n\t\t\t// because the violation-attribution tests run this body off-macOS on purpose,\n\t\t\t// with `spawnChild` injected, and those must keep working on every runner.\n\t\t\tconst unixSocketsAvailable = process.platform !== \"win32\";\n\t\t\tconst gitCredentialPaths = unixSocketsAvailable ? resolveGitCredentialChannelPaths() : undefined;\n\t\t\tgitCredentialDirectory = gitCredentialPaths?.hostSocketDirectory;\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\ttcpHost: \"127.0.0.1\",\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t\t// Undefined without a terminal, which leaves the proxy's own\n\t\t\t\t// deny-without-asking path in place for headless, print, JSON, and RPC.\n\t\t\t\trequestApproval: createHostApprover({ handoff }),\n\t\t\t});\n\t\t\t// After the network proxy, because reachability is its answer to give.\n\t\t\tgitCredentialProxy =\n\t\t\t\tgitCredentialPaths &&\n\t\t\t\t(await createGitCredentialProxy({\n\t\t\t\t\tsocketPath: gitCredentialPaths.hostSocketPath,\n\t\t\t\t\tisHostAllowed: (host) => proxy?.isHostReachable(host) ?? false,\n\t\t\t\t\trequestRelease: createCredentialReleaser({ handoff }),\n\t\t\t\t\t// The supervisor's own environment: this runs outside the boundary and must\n\t\t\t\t\t// resolve against the real host home the child cannot see.\n\t\t\t\t\tfillCredential: (request) => fillHostGitCredential(request, { environment: process.env }),\n\t\t\t\t\tviolationStore,\n\t\t\t\t}));\n\t\t\twriteGitCredentialHelper(supervisorStateDirectory);\n\n\t\t\tconst escalationPaths = unixSocketsAvailable ? resolveCommandEscalationChannelPaths() : undefined;\n\t\t\tescalationDirectory = escalationPaths?.hostSocketDirectory;\n\t\t\t// Seatbelt cannot remap a path, so the child reaches this socket at its host\n\t\t\t// path, exactly as it reaches the credential channel.\n\t\t\tescalationProxy =\n\t\t\t\tescalationPaths &&\n\t\t\t\t(await createCommandEscalationProxy({\n\t\t\t\t\tsocketPath: escalationPaths.hostSocketPath,\n\t\t\t\t\trequestApproval: options?.requestCommandEscalation ?? createCommandEscalationApprover({ handoff }),\n\t\t\t\t\tviolationStore,\n\t\t\t\t\trunEscalated: (request) =>\n\t\t\t\t\t\trunEscalatedCommand({\n\t\t\t\t\t\t\trequest,\n\t\t\t\t\t\t\tlaunch,\n\t\t\t\t\t\t\tworkspace,\n\t\t\t\t\t\t\tsupervisorStateDirectory,\n\t\t\t\t\t\t\tspawnSandboxExec: options?.spawnChild ?? spawn,\n\t\t\t\t\t\t}),\n\t\t\t\t}));\n\t\t\tconst proxyPort = proxy.port as number;\n\n\t\t\t// Seatbelt cannot remap a path, so the child connects to the channel socket at\n\t\t\t// its host path, and the profile allows outbound to exactly that one socket.\n\t\t\tconst credentialChannelSocket = launch.credentialChannel\n\t\t\t\t? canonicalSocketPath(launch.credentialChannel.hostSocketPath)\n\t\t\t\t: undefined;\n\n\t\t\tconst readOnlyDirs = readOnlyDirectories([\n\t\t\t\tprocess.execPath,\n\t\t\t\tlaunch.command,\n\t\t\t\t...(launch.readOnlyPaths ?? []),\n\t\t\t\tsupervisorStateDirectory,\n\t\t\t]);\n\t\t\t// Seatbelt denies the whole home directory before re-allowing named paths,\n\t\t\t// so a `.ts` extension loaded inside the sandbox fails on its tsconfig\n\t\t\t// rather than on anything the extension does. Empty off a source runtime.\n\t\t\tconst readOnlyFiles = [...(launch.readOnlyFiles ?? []), ...typeScriptSourceConfigFiles()].map((path) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn realpathSync(path);\n\t\t\t\t} catch {\n\t\t\t\t\treturn resolve(path);\n\t\t\t\t}\n\t\t\t});\n\t\t\tconst terminalSizePath = join(supervisorStateDirectory, \"terminal-size\");\n\t\t\tconst stopPublishingTerminalSize = publishTerminalSize(terminalSizePath);\n\t\t\tlet userHome: string | undefined;\n\t\t\ttry {\n\t\t\t\tuserHome = realpathSync(homedir());\n\t\t\t} catch {\n\t\t\t\tuserHome = homedir();\n\t\t\t}\n\n\t\t\tconst profileLines = [\n\t\t\t\t\"(version 1)\",\n\t\t\t\t// bsd.sb's baseline is broader than Linux's opt-in bind-mount model --\n\t\t\t\t// a real gap this design accepts, documented in the spec's fourth\n\t\t\t\t// amendment -- but it is the only combination the 2b.5 prototype found\n\t\t\t\t// that lets a normal Unix child process (dyld, /bin/sh) actually start.\n\t\t\t\t'(import \"bsd.sb\")',\n\t\t\t\t\"(allow process-exec*)\",\n\t\t\t\t// Separate from process-exec* -- confirmed empirically: a shell that\n\t\t\t\t// forks a child shell (e.g. `sh -c 'a' && sh -c 'b'`) failed with\n\t\t\t\t// \"fork: Operation not permitted\" without this, even with exec allowed.\n\t\t\t\t\"(allow process-fork)\",\n\t\t\t\t// Matches Linux's actual posture (bwrap's `--ro-bind / /`): broad read,\n\t\t\t\t// narrow write. A read-only allowlist alone (this design's first cut)\n\t\t\t\t// breaks ordinary process startup -- confirmed empirically, getcwd()\n\t\t\t\t// itself needs to traverse the workspace's ancestor directories, which\n\t\t\t\t// no read rule scoped only to the workspace or runtime paths covers.\n\t\t\t\t\"(allow file-read*)\",\n\t\t\t\t'(deny file-read* (subpath (param \"USER_HOME\")))',\n\t\t\t\t...readOnlyDirs.map((_, index) => `(allow file-read* (subpath (param \"RO_${index}\")))`),\n\t\t\t\t...readOnlyFiles.map((_, index) => `(allow file-read* (subpath (param \"RO_FILE_${index}\")))`),\n\t\t\t\t'(allow file-read* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny file-write*)\",\n\t\t\t\t'(allow file-write* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t// Each extra root is allowed exactly as the workspace is, and only ever from\n\t\t\t\t// an argv-parsed flag: a repository that could name its own writable root\n\t\t\t\t// would be granting itself authority (ADR 0016).\n\t\t\t\t...writableRoots.map((_, index) => `(allow file-read* (subpath (param \"RW_${index}\")))`),\n\t\t\t\t...writableRoots.map((_, index) => `(allow file-write* (subpath (param \"RW_${index}\")))`),\n\t\t\t\t\"(deny network*)\",\n\t\t\t\t'(allow network-outbound (remote ip (param \"PROXY_ADDR\")))',\n\t\t\t\t...(credentialChannelSocket\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${credentialChannelSocket}\")))`]\n\t\t\t\t\t: []),\n\t\t\t\t...(gitCredentialPaths\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${gitCredentialPaths.hostSocketPath}\")))`]\n\t\t\t\t\t: []),\n\t\t\t\t...(escalationPaths\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${escalationPaths.hostSocketPath}\")))`]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t\tconst profilePath = join(supervisorStateDirectory, \"profile.sb\");\n\t\t\twriteFileSync(profilePath, profileLines.join(\"\\n\"));\n\n\t\t\tconst params: string[] = [\"-D\", `USER_HOME=${userHome}`];\n\t\t\treadOnlyDirs.forEach((dir, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_${index}=${dir}`);\n\t\t\t});\n\t\t\treadOnlyFiles.forEach((file, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_FILE_${index}=${file}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `WORKSPACE=${workspace}`);\n\t\t\twritableRoots.forEach((root, index) => {\n\t\t\t\tparams.push(\"-D\", `RW_${index}=${root}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `PROXY_ADDR=localhost:${proxyPort}`);\n\n\t\t\tconst spawnSandboxExec = options?.spawnChild ?? spawn;\n\t\t\tconst child = spawnSandboxExec(\n\t\t\t\t\"sandbox-exec\",\n\t\t\t\t[\"-f\", profilePath, ...params, \"--\", launch.command, ...launch.args],\n\t\t\t\t{\n\t\t\t\t\tcwd: workspace,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.environment,\n\t\t\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\tHTTP_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\tHTTPS_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\t[TERMINAL_HANDOFF_PATH_VARIABLE]: supervisorStateDirectory,\n\t\t\t\t\t\t[TERMINAL_HANDOFF_ACK_PATH_VARIABLE]: acknowledgementPath,\n\t\t\t\t\t\t[TERMINAL_SIZE_PATH_VARIABLE]: terminalSizePath,\n\t\t\t\t\t\t...(gitCredentialPaths\n\t\t\t\t\t\t\t? { [GIT_CREDENTIAL_SOCKET_VARIABLE]: gitCredentialPaths.childSocketPath }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t...(escalationPaths ? { [COMMAND_ESCALATION_SOCKET_VARIABLE]: escalationPaths.childSocketPath } : {}),\n\t\t\t\t\t},\n\t\t\t\t\tstdio: [\"inherit\", \"inherit\", \"pipe\"],\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\tstderr += chunk;\n\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t});\n\t\t\tconst exitCode = await waitForExit(child);\n\t\t\tstopPublishingTerminalSize();\n\t\t\tawait proxy?.close();\n\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\tif (kind) {\n\t\t\t\tviolationStore?.add({\n\t\t\t\t\tkind,\n\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn exitCode;\n\t\t},\n\t\tasync close() {\n\t\t\thandoff?.stop();\n\t\t\tawait escalationProxy?.close();\n\t\t\tif (escalationDirectory) rmSync(escalationDirectory, { force: true, recursive: true });\n\t\t\tawait gitCredentialProxy?.close();\n\t\t\tif (gitCredentialDirectory) rmSync(gitCredentialDirectory, { force: true, recursive: true });\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n\nasync function runEscalatedCommand(options: {\n\trequest: CommandEscalationRequest;\n\tlaunch: SandboxLaunch;\n\tworkspace: string;\n\tsupervisorStateDirectory: string;\n\tspawnSandboxExec: typeof spawn;\n}): Promise<CommandEscalationResult> {\n\tconst profilePath = join(options.supervisorStateDirectory, `escalation-${process.pid}-${Date.now()}.sb`);\n\tconst writableRoots = [...options.launch.policy.additionalWritableRoots, options.request.writableRoot].map((root) =>\n\t\tresolve(root),\n\t);\n\twriteFileSync(\n\t\tprofilePath,\n\t\t[\n\t\t\t\"(version 1)\",\n\t\t\t'(import \"bsd.sb\")',\n\t\t\t\"(allow process-exec*)\",\n\t\t\t\"(allow process-fork)\",\n\t\t\t\"(allow file-read*)\",\n\t\t\t\"(deny file-write*)\",\n\t\t\t`(allow file-write* (subpath \"${seatbeltParameter(options.workspace)}\"))`,\n\t\t\t...writableRoots.map((root) => `(allow file-write* (subpath \"${seatbeltParameter(root)}\"))`),\n\t\t\t\"(deny network*)\",\n\t\t].join(\"\\n\"),\n\t\t{ mode: 0o600 },\n\t);\n\ttry {\n\t\tconst child = options.spawnSandboxExec(\n\t\t\t\"sandbox-exec\",\n\t\t\t[\"-f\", profilePath, \"--\", \"/bin/sh\", \"-c\", options.request.command],\n\t\t\t{\n\t\t\t\tcwd: options.workspace,\n\t\t\t\tenv: {\n\t\t\t\t\tPATH: options.launch.environment?.PATH,\n\t\t\t\t\tHOME: options.launch.environment?.HOME,\n\t\t\t\t\tTMPDIR: options.launch.environment?.TMPDIR,\n\t\t\t\t},\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t},\n\t\t);\n\t\tlet stdout = \"\";\n\t\tlet stderr = \"\";\n\t\tchild.stdout?.setEncoding(\"utf8\");\n\t\tchild.stdout?.on(\"data\", (chunk: string) => {\n\t\t\tstdout = appendBounded(stdout, chunk);\n\t\t});\n\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\tstderr = appendBounded(stderr, chunk);\n\t\t});\n\t\tconst code = await new Promise<number>((resolveCode) => {\n\t\t\tchild.once(\"error\", () => resolveCode(1));\n\t\t\tchild.once(\"exit\", (exitCode) => resolveCode(exitCode ?? 1));\n\t\t});\n\t\treturn { code, stdout, stderr };\n\t} finally {\n\t\trmSync(profilePath, { force: true });\n\t}\n}\n"]}

package/dist/core/sandbox/macos-backend.js

@@ -1,8 +1,24 @@
 import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
+import { typeScriptSourceConfigFiles } from "../extensions/source-runtime.js";
+import { createCommandEscalationApprover, createCredentialReleaser, createHostApprover } from "./host-approval.js";
 import { createSandboxNetworkProxy } from "./network-proxy.js";
+import { COMMAND_ESCALATION_SOCKET_VARIABLE, createCommandEscalationProxy, resolveCommandEscalationChannelPaths, } from "./rpc/command-proxy.js";
+import { fillHostGitCredential, GIT_CREDENTIAL_SOCKET_VARIABLE, resolveGitCredentialChannelPaths, writeGitCredentialHelper, } from "./rpc/git-credential-helper.js";
+import { createGitCredentialProxy } from "./rpc/git-credential-proxy.js";
+import { createTerminalHandoff, TERMINAL_HANDOFF_ACK_PATH_VARIABLE, TERMINAL_HANDOFF_PATH_VARIABLE, } from "./terminal-handoff.js";
+import { publishTerminalSize, TERMINAL_SIZE_PATH_VARIABLE } from "./terminal-size.js";
+const ESCALATION_OUTPUT_LIMIT = 64 * 1024;
+function seatbeltParameter(value) {
+    return value.replaceAll("\\", "\\\\").replaceAll("\n", "\\n").replaceAll('"', '\\"');
+}
+function appendBounded(current, chunk, limit = ESCALATION_OUTPUT_LIMIT) {
+    if (current.length >= limit)
+        return current;
+    return current + chunk.slice(0, limit - current.length);
+}
 function sandboxExecExists(command) {
     // sandbox-exec has no --version flag; a real, minimal profile run is the
     // standard existence-and-basic-functionality probe (see the 2b.5 prototype's
@@ -28,7 +44,15 @@ function waitForExit(child) {
  * unresolved symlinked path, e.g. Homebrew's own layout, silently never matches).
  */
 function readOnlyDirectories(paths) {
-    const directories = paths.map((path) => dirname(resolve(path)));
+    const directories = paths.map((path) => {
+        const resolved = resolve(path);
+        try {
+            return statSync(resolved).isDirectory() ? resolved : dirname(resolved);
+        }
+        catch {
+            return dirname(resolved);
+        }
+    });
     const canonical = directories.map((directory) => {
         try {
             return realpathSync(directory);
@@ -98,6 +122,11 @@ export function createMacosSandboxBackend(options) {
     const hasCommand = options?.commandExists ?? sandboxExecExists;
     const violationStore = options?.violationStore;
     let proxy;
+    let handoff;
+    let gitCredentialProxy;
+    let gitCredentialDirectory;
+    let escalationProxy;
+    let escalationDirectory;
     if (!hasCommand("sandbox-exec")) {
         return {
             status: { kind: "unavailable", reason: "sandbox-exec (Seatbelt) is required for OS sandboxing." },
@@ -115,22 +144,77 @@ export function createMacosSandboxBackend(options) {
             // and Seatbelt's subpath match is against the canonical path, not the one
             // the caller happened to spell. Resolve once, use everywhere below.
             const workspace = realpathSync(launch.policy.workspace);
+            const writableRoots = launch.policy.additionalWritableRoots;
             const stateDirectory = join(workspace, ".apex-code", "sandbox-state");
             mkdirSync(stateDirectory, { recursive: true });
+            const supervisorStateDirectory = launch.supervisorStateDirectory;
+            mkdirSync(supervisorStateDirectory, { recursive: true, mode: 0o700 });
+            const acknowledgementPath = join(stateDirectory, "terminal-handoff-ack");
             const violationCountBeforeLaunch = violationStore?.totalCount ?? 0;
+            handoff = createTerminalHandoff(supervisorStateDirectory, { acknowledgementPath });
+            // Both channels are AF_UNIX servers, which Windows has not got. Nothing is lost
+            // by skipping them there: ADR 0005 leaves Windows unsupported and this backend
+            // reports `unavailable` on any real Windows host. They are reachable here only
+            // because the violation-attribution tests run this body off-macOS on purpose,
+            // with `spawnChild` injected, and those must keep working on every runner.
+            const unixSocketsAvailable = process.platform !== "win32";
+            const gitCredentialPaths = unixSocketsAvailable ? resolveGitCredentialChannelPaths() : undefined;
+            gitCredentialDirectory = gitCredentialPaths?.hostSocketDirectory;
             proxy = await createSandboxNetworkProxy({
                 tcpHost: "127.0.0.1",
                 allowedHosts: launch.policy.allowedHosts,
                 violationStore,
+                // Undefined without a terminal, which leaves the proxy's own
+                // deny-without-asking path in place for headless, print, JSON, and RPC.
+                requestApproval: createHostApprover({ handoff }),
             });
+            // After the network proxy, because reachability is its answer to give.
+            gitCredentialProxy =
+                gitCredentialPaths &&
+                    (await createGitCredentialProxy({
+                        socketPath: gitCredentialPaths.hostSocketPath,
+                        isHostAllowed: (host) => proxy?.isHostReachable(host) ?? false,
+                        requestRelease: createCredentialReleaser({ handoff }),
+                        // The supervisor's own environment: this runs outside the boundary and must
+                        // resolve against the real host home the child cannot see.
+                        fillCredential: (request) => fillHostGitCredential(request, { environment: process.env }),
+                        violationStore,
+                    }));
+            writeGitCredentialHelper(supervisorStateDirectory);
+            const escalationPaths = unixSocketsAvailable ? resolveCommandEscalationChannelPaths() : undefined;
+            escalationDirectory = escalationPaths?.hostSocketDirectory;
+            // Seatbelt cannot remap a path, so the child reaches this socket at its host
+            // path, exactly as it reaches the credential channel.
+            escalationProxy =
+                escalationPaths &&
+                    (await createCommandEscalationProxy({
+                        socketPath: escalationPaths.hostSocketPath,
+                        requestApproval: options?.requestCommandEscalation ?? createCommandEscalationApprover({ handoff }),
+                        violationStore,
+                        runEscalated: (request) => runEscalatedCommand({
+                            request,
+                            launch,
+                            workspace,
+                            supervisorStateDirectory,
+                            spawnSandboxExec: options?.spawnChild ?? spawn,
+                        }),
+                    }));
             const proxyPort = proxy.port;
             // Seatbelt cannot remap a path, so the child connects to the channel socket at
             // its host path, and the profile allows outbound to exactly that one socket.
             const credentialChannelSocket = launch.credentialChannel
                 ? canonicalSocketPath(launch.credentialChannel.hostSocketPath)
                 : undefined;
-            const readOnlyDirs = readOnlyDirectories([process.execPath, launch.command, ...(launch.readOnlyPaths ?? [])]);
-            const readOnlyFiles = (launch.readOnlyFiles ?? []).map((path) => {
+            const readOnlyDirs = readOnlyDirectories([
+                process.execPath,
+                launch.command,
+                ...(launch.readOnlyPaths ?? []),
+                supervisorStateDirectory,
+            ]);
+            // Seatbelt denies the whole home directory before re-allowing named paths,
+            // so a `.ts` extension loaded inside the sandbox fails on its tsconfig
+            // rather than on anything the extension does. Empty off a source runtime.
+            const readOnlyFiles = [...(launch.readOnlyFiles ?? []), ...typeScriptSourceConfigFiles()].map((path) => {
                 try {
                     return realpathSync(path);
                 }
@@ -138,6 +222,8 @@ export function createMacosSandboxBackend(options) {
                     return resolve(path);
                 }
             });
+            const terminalSizePath = join(supervisorStateDirectory, "terminal-size");
+            const stopPublishingTerminalSize = publishTerminalSize(terminalSizePath);
             let userHome;
             try {
                 userHome = realpathSync(homedir());
@@ -169,13 +255,24 @@ export function createMacosSandboxBackend(options) {
                 '(allow file-read* (subpath (param "WORKSPACE")))',
                 "(deny file-write*)",
                 '(allow file-write* (subpath (param "WORKSPACE")))',
+                // Each extra root is allowed exactly as the workspace is, and only ever from
+                // an argv-parsed flag: a repository that could name its own writable root
+                // would be granting itself authority (ADR 0016).
+                ...writableRoots.map((_, index) => `(allow file-read* (subpath (param "RW_${index}")))`),
+                ...writableRoots.map((_, index) => `(allow file-write* (subpath (param "RW_${index}")))`),
                 "(deny network*)",
                 '(allow network-outbound (remote ip (param "PROXY_ADDR")))',
                 ...(credentialChannelSocket
                     ? [`(allow network-outbound (remote unix-socket (literal "${credentialChannelSocket}")))`]
                     : []),
+                ...(gitCredentialPaths
+                    ? [`(allow network-outbound (remote unix-socket (literal "${gitCredentialPaths.hostSocketPath}")))`]
+                    : []),
+                ...(escalationPaths
+                    ? [`(allow network-outbound (remote unix-socket (literal "${escalationPaths.hostSocketPath}")))`]
+                    : []),
             ];
-            const profilePath = join(stateDirectory, "profile.sb");
+            const profilePath = join(supervisorStateDirectory, "profile.sb");
             writeFileSync(profilePath, profileLines.join("\n"));
             const params = ["-D", `USER_HOME=${userHome}`];
             readOnlyDirs.forEach((dir, index) => {
@@ -185,6 +282,9 @@ export function createMacosSandboxBackend(options) {
                 params.push("-D", `RO_FILE_${index}=${file}`);
             });
             params.push("-D", `WORKSPACE=${workspace}`);
+            writableRoots.forEach((root, index) => {
+                params.push("-D", `RW_${index}=${root}`);
+            });
             params.push("-D", `PROXY_ADDR=localhost:${proxyPort}`);
             const spawnSandboxExec = options?.spawnChild ?? spawn;
             const child = spawnSandboxExec("sandbox-exec", ["-f", profilePath, ...params, "--", launch.command, ...launch.args], {
@@ -195,6 +295,13 @@ export function createMacosSandboxBackend(options) {
                     TMPDIR: launch.environment?.TMPDIR ?? stateDirectory,
                     HTTP_PROXY: `http://127.0.0.1:${proxyPort}`,
                     HTTPS_PROXY: `http://127.0.0.1:${proxyPort}`,
+                    [TERMINAL_HANDOFF_PATH_VARIABLE]: supervisorStateDirectory,
+                    [TERMINAL_HANDOFF_ACK_PATH_VARIABLE]: acknowledgementPath,
+                    [TERMINAL_SIZE_PATH_VARIABLE]: terminalSizePath,
+                    ...(gitCredentialPaths
+                        ? { [GIT_CREDENTIAL_SOCKET_VARIABLE]: gitCredentialPaths.childSocketPath }
+                        : {}),
+                    ...(escalationPaths ? { [COMMAND_ESCALATION_SOCKET_VARIABLE]: escalationPaths.childSocketPath } : {}),
                 },
                 stdio: ["inherit", "inherit", "pipe"],
             });
@@ -205,6 +312,7 @@ export function createMacosSandboxBackend(options) {
                 process.stderr.write(chunk);
             });
             const exitCode = await waitForExit(child);
+            stopPublishingTerminalSize();
             await proxy?.close();
             const proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;
             const kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;
@@ -219,8 +327,59 @@ export function createMacosSandboxBackend(options) {
             return exitCode;
         },
         async close() {
+            handoff?.stop();
+            await escalationProxy?.close();
+            if (escalationDirectory)
+                rmSync(escalationDirectory, { force: true, recursive: true });
+            await gitCredentialProxy?.close();
+            if (gitCredentialDirectory)
+                rmSync(gitCredentialDirectory, { force: true, recursive: true });
             await proxy?.close();
         },
     };
 }
+async function runEscalatedCommand(options) {
+    const profilePath = join(options.supervisorStateDirectory, `escalation-${process.pid}-${Date.now()}.sb`);
+    const writableRoots = [...options.launch.policy.additionalWritableRoots, options.request.writableRoot].map((root) => resolve(root));
+    writeFileSync(profilePath, [
+        "(version 1)",
+        '(import "bsd.sb")',
+        "(allow process-exec*)",
+        "(allow process-fork)",
+        "(allow file-read*)",
+        "(deny file-write*)",
+        `(allow file-write* (subpath "${seatbeltParameter(options.workspace)}"))`,
+        ...writableRoots.map((root) => `(allow file-write* (subpath "${seatbeltParameter(root)}"))`),
+        "(deny network*)",
+    ].join("\n"), { mode: 0o600 });
+    try {
+        const child = options.spawnSandboxExec("sandbox-exec", ["-f", profilePath, "--", "/bin/sh", "-c", options.request.command], {
+            cwd: options.workspace,
+            env: {
+                PATH: options.launch.environment?.PATH,
+                HOME: options.launch.environment?.HOME,
+                TMPDIR: options.launch.environment?.TMPDIR,
+            },
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            stdout = appendBounded(stdout, chunk);
+        });
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", (chunk) => {
+            stderr = appendBounded(stderr, chunk);
+        });
+        const code = await new Promise((resolveCode) => {
+            child.once("error", () => resolveCode(1));
+            child.once("exit", (exitCode) => resolveCode(exitCode ?? 1));
+        });
+        return { code, stdout, stderr };
+    }
+    finally {
+        rmSync(profilePath, { force: true });
+    }
+}
 //# sourceMappingURL=macos-backend.js.map

package/dist/core/sandbox/macos-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"macos-backend.js","sourceRoot":"","sources":["../../../src/core/sandbox/macos-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oBAAoB,CAAC;AAiBzF,SAAS,iBAAiB,CAAC,OAAe,EAAW;IACpD,yEAAyE;IACzE,6EAA6E;IAC7E,yBAAyB;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,4BAA4B,EAAE,eAAe,CAAC,EAAE;QACxF,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAAA,CAC3B;AAED,SAAS,WAAW,CAAC,KAA+B,EAAmB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAAA,CACjD,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAAwB,EAAY;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IAAA,CACD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAAA,CAC/B;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAU;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;AAAA,CACD;AAED,yFAAyF;AACzF,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAElF,SAAS,sBAAsB,CAAC,MAAc,EAAoD;IACjG,+EAA+E;IAC/E,4EAA4E;IAC5E,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,iFAAiF;IACjF,2BAA2B;IAC3B,IAAI,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC;IAC1F,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,gFAAgF;IAChF,kFAAkF;IAClF,8EAA8E;IAC9E,8DAA8D;IAC9D,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAoC,EAAkB;IAC/F,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wCAAwC,EAAE;YACjF,KAAK,CAAC,MAAM,GAAG;gBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAAA,CACzD;YACD,KAAK,CAAC,KAAK,GAAG,EAAC,CAAC;SAChB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,iBAAiB,CAAC;IAC/D,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;IAC/C,IAAI,KAAsC,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;YACjG,KAAK,CAAC,MAAM,GAAG;gBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAAA,CACzD;YACD,KAAK,CAAC,KAAK,GAAG,EAAC,CAAC;SAChB,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC5B,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAmB;YACpD,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,oEAAoE;YACpE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;YACtE,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE/C,MAAM,0BAA0B,GAAG,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC;YAEnE,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBACvC,OAAO,EAAE,WAAW;gBACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;gBACxC,cAAc;aACd,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,IAAc,CAAC;YAEvC,+EAA+E;YAC/E,6EAA6E;YAC7E,MAAM,uBAAuB,GAAG,MAAM,CAAC,iBAAiB;gBACvD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAC;YAEb,MAAM,YAAY,GAAG,mBAAmB,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9G,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChE,IAAI,CAAC;oBACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YAAA,CACD,CAAC,CAAC;YACH,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,GAAG,OAAO,EAAE,CAAC;YACtB,CAAC;YAED,MAAM,YAAY,GAAG;gBACpB,aAAa;gBACb,uEAAuE;gBACvE,kEAAkE;gBAClE,uEAAuE;gBACvE,wEAAwE;gBACxE,mBAAmB;gBACnB,uBAAuB;gBACvB,qEAAqE;gBACrE,kEAAkE;gBAClE,wEAAwE;gBACxE,sBAAsB;gBACtB,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,oBAAoB;gBACpB,iDAAiD;gBACjD,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,yCAAyC,KAAK,MAAM,CAAC;gBACvF,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,8CAA8C,KAAK,MAAM,CAAC;gBAC7F,kDAAkD;gBAClD,oBAAoB;gBACpB,mDAAmD;gBACnD,iBAAiB;gBACjB,2DAA2D;gBAC3D,GAAG,CAAC,uBAAuB;oBAC1B,CAAC,CAAC,CAAC,yDAAyD,uBAAuB,MAAM,CAAC;oBAC1F,CAAC,CAAC,EAAE,CAAC;aACN,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YACvD,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAEpD,MAAM,MAAM,GAAa,CAAC,IAAI,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC;YACzD,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;YAAA,CACxC,CAAC,CAAC;YACH,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;YAAA,CAC9C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,SAAS,EAAE,CAAC,CAAC;YAEvD,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,IAAI,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,cAAc,EACd,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EACpE;gBACC,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE;oBACJ,GAAG,MAAM,CAAC,WAAW;oBACrB,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,cAAc;oBAChD,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,IAAI,cAAc;oBACpD,UAAU,EAAE,oBAAoB,SAAS,EAAE;oBAC3C,WAAW,EAAE,oBAAoB,SAAS,EAAE;iBAC5C;gBACD,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;aACrC,CACD,CAAC;YACF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAA,CAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;YACrB,MAAM,8BAA8B,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,0BAA0B,CAAC;YACtG,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,IAAI,IAAI,EAAE,CAAC;gBACV,cAAc,EAAE,GAAG,CAAC;oBACnB,IAAI;oBACJ,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACnD,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACrB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAAA,CAChB;QACD,KAAK,CAAC,KAAK,GAAG;YACb,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QAAA,CACrB;KACD,CAAC;AAAA,CACF","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { mkdirSync, realpathSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface MacosSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/**\n\t * Injectable only so violation attribution can be tested off macOS; production\n\t * spawns `sandbox-exec` directly. Without this the decision about what counts as a\n\t * violation would be verifiable only on a macOS host.\n\t */\n\tspawnChild?: typeof spawn;\n}\n\nfunction sandboxExecExists(command: string): boolean {\n\t// sandbox-exec has no --version flag; a real, minimal profile run is the\n\t// standard existence-and-basic-functionality probe (see the 2b.5 prototype's\n\t// own positive control).\n\tconst result = spawnSync(command, [\"-p\", \"(version 1)(allow default)\", \"/usr/bin/true\"], {\n\t\tstdio: \"ignore\",\n\t\ttimeout: 2_000,\n\t});\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\n/**\n * Unlike Linux's bwrap (which needs each mount ancestor declared for its bind-mount\n * tree), Seatbelt's `subpath` is recursive from a single root, so only the directory\n * containing each path is needed -- no ancestor walk. Each directory is resolved to\n * its real (symlink-free) path: Seatbelt canonicalizes the path it actually checks\n * against a `subpath` rule (confirmed empirically -- a rule built from an\n * unresolved symlinked path, e.g. Homebrew's own layout, silently never matches).\n */\nfunction readOnlyDirectories(paths: readonly string[]): string[] {\n\tconst directories = paths.map((path) => dirname(resolve(path)));\n\tconst canonical = directories.map((directory) => {\n\t\ttry {\n\t\t\treturn realpathSync(directory);\n\t\t} catch {\n\t\t\treturn directory;\n\t\t}\n\t});\n\treturn [...new Set(canonical)];\n}\n\n/**\n * Canonicalize a channel socket path for a Seatbelt literal. Only the directory can be\n * resolved -- the socket file need not exist yet when the profile is written -- and the\n * same symlink rule as `readOnlyDirectories` applies: Seatbelt matches the canonical\n * path, so an unresolved one silently never matches.\n */\nfunction canonicalSocketPath(path: string): string {\n\tconst directory = dirname(resolve(path));\n\ttry {\n\t\treturn join(realpathSync(directory), basename(path));\n\t} catch {\n\t\treturn join(directory, basename(path));\n\t}\n}\n\n/** Seatbelt refuses through the blocked call's own errno text, not a wrapper message. */\nconst DENIAL_EVIDENCE = /Operation not permitted|Permission denied|EPERM|EACCES/i;\n\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | \"unknown\" | undefined {\n\t// Confirmed empirically (2b.5 prototype): unlike Linux's bwrap, macOS Seatbelt\n\t// denials surface through the launched command's own generic \"Operation not\n\t// permitted\"/EPERM text for filesystem AND network refusals alike -- there is no\n\t// macOS-specific phrase equivalent to Linux's distinct \"Network is unreachable\".\n\t// Only sandbox-exec's own wrapper-level exec refusal (a sign our own profile\n\t// forgot to allow a binary, not a policy decision) is unambiguous from stderr\n\t// text. Anything else that still shows a refusal stays \"unknown\";\n\t// network-proxy.ts's own precise per-request recording is the reliable \"network\"\n\t// signal on this platform.\n\tif (/execvp\\(\\) of .* failed: Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (DENIAL_EVIDENCE.test(stderr)) return \"unknown\";\n\t// No refusal in evidence. The coarseness above is about telling filesystem from\n\t// network, not about telling a denial from an ordinary failure -- a non-zero exit\n\t// on its own says nothing about the boundary, and reporting it as a violation\n\t// sends the reader looking for a refusal that never happened.\n\treturn undefined;\n}\n\n/**\n * macOS's platform adapter. Seatbelt (`sandbox-exec`) allows reads broadly except\n * the invoking account's home directory, denies writes outside the workspace, and\n * denies network outside the sandbox proxy's exact loopback port -- narrower than\n * the wildcard `localhost:*` pattern some other sandboxes use. This mirrors Linux's\n * actual posture (`--ro-bind / /` plus a hidden `/home`) rather than the narrower\n * read-allowlist this design started with, which broke ordinary process startup.\n */\nexport function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"darwin\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on macOS only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? sandboxExecExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\n\tif (!hasCommand(\"sandbox-exec\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"sandbox-exec (Seatbelt) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\t// Same reasoning as readOnlyDirectories: on macOS the workspace itself can\n\t\t\t// be reached through a symlink (e.g. os.tmpdir()'s /var -> /private/var),\n\t\t\t// and Seatbelt's subpath match is against the canonical path, not the one\n\t\t\t// the caller happened to spell. Resolve once, use everywhere below.\n\t\t\tconst workspace = realpathSync(launch.policy.workspace);\n\t\t\tconst stateDirectory = join(workspace, \".apex-code\", \"sandbox-state\");\n\t\t\tmkdirSync(stateDirectory, { recursive: true });\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\ttcpHost: \"127.0.0.1\",\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t});\n\t\t\tconst proxyPort = proxy.port as number;\n\n\t\t\t// Seatbelt cannot remap a path, so the child connects to the channel socket at\n\t\t\t// its host path, and the profile allows outbound to exactly that one socket.\n\t\t\tconst credentialChannelSocket = launch.credentialChannel\n\t\t\t\t? canonicalSocketPath(launch.credentialChannel.hostSocketPath)\n\t\t\t\t: undefined;\n\n\t\t\tconst readOnlyDirs = readOnlyDirectories([process.execPath, launch.command, ...(launch.readOnlyPaths ?? [])]);\n\t\t\tconst readOnlyFiles = (launch.readOnlyFiles ?? []).map((path) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn realpathSync(path);\n\t\t\t\t} catch {\n\t\t\t\t\treturn resolve(path);\n\t\t\t\t}\n\t\t\t});\n\t\t\tlet userHome: string | undefined;\n\t\t\ttry {\n\t\t\t\tuserHome = realpathSync(homedir());\n\t\t\t} catch {\n\t\t\t\tuserHome = homedir();\n\t\t\t}\n\n\t\t\tconst profileLines = [\n\t\t\t\t\"(version 1)\",\n\t\t\t\t// bsd.sb's baseline is broader than Linux's opt-in bind-mount model --\n\t\t\t\t// a real gap this design accepts, documented in the spec's fourth\n\t\t\t\t// amendment -- but it is the only combination the 2b.5 prototype found\n\t\t\t\t// that lets a normal Unix child process (dyld, /bin/sh) actually start.\n\t\t\t\t'(import \"bsd.sb\")',\n\t\t\t\t\"(allow process-exec*)\",\n\t\t\t\t// Separate from process-exec* -- confirmed empirically: a shell that\n\t\t\t\t// forks a child shell (e.g. `sh -c 'a' && sh -c 'b'`) failed with\n\t\t\t\t// \"fork: Operation not permitted\" without this, even with exec allowed.\n\t\t\t\t\"(allow process-fork)\",\n\t\t\t\t// Matches Linux's actual posture (bwrap's `--ro-bind / /`): broad read,\n\t\t\t\t// narrow write. A read-only allowlist alone (this design's first cut)\n\t\t\t\t// breaks ordinary process startup -- confirmed empirically, getcwd()\n\t\t\t\t// itself needs to traverse the workspace's ancestor directories, which\n\t\t\t\t// no read rule scoped only to the workspace or runtime paths covers.\n\t\t\t\t\"(allow file-read*)\",\n\t\t\t\t'(deny file-read* (subpath (param \"USER_HOME\")))',\n\t\t\t\t...readOnlyDirs.map((_, index) => `(allow file-read* (subpath (param \"RO_${index}\")))`),\n\t\t\t\t...readOnlyFiles.map((_, index) => `(allow file-read* (subpath (param \"RO_FILE_${index}\")))`),\n\t\t\t\t'(allow file-read* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny file-write*)\",\n\t\t\t\t'(allow file-write* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny network*)\",\n\t\t\t\t'(allow network-outbound (remote ip (param \"PROXY_ADDR\")))',\n\t\t\t\t...(credentialChannelSocket\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${credentialChannelSocket}\")))`]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t\tconst profilePath = join(stateDirectory, \"profile.sb\");\n\t\t\twriteFileSync(profilePath, profileLines.join(\"\\n\"));\n\n\t\t\tconst params: string[] = [\"-D\", `USER_HOME=${userHome}`];\n\t\t\treadOnlyDirs.forEach((dir, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_${index}=${dir}`);\n\t\t\t});\n\t\t\treadOnlyFiles.forEach((file, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_FILE_${index}=${file}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `WORKSPACE=${workspace}`);\n\t\t\tparams.push(\"-D\", `PROXY_ADDR=localhost:${proxyPort}`);\n\n\t\t\tconst spawnSandboxExec = options?.spawnChild ?? spawn;\n\t\t\tconst child = spawnSandboxExec(\n\t\t\t\t\"sandbox-exec\",\n\t\t\t\t[\"-f\", profilePath, ...params, \"--\", launch.command, ...launch.args],\n\t\t\t\t{\n\t\t\t\t\tcwd: workspace,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.environment,\n\t\t\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\tHTTP_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\tHTTPS_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t},\n\t\t\t\t\tstdio: [\"inherit\", \"inherit\", \"pipe\"],\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\tstderr += chunk;\n\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t});\n\t\t\tconst exitCode = await waitForExit(child);\n\t\t\tawait proxy?.close();\n\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\tif (kind) {\n\t\t\t\tviolationStore?.add({\n\t\t\t\t\tkind,\n\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn exitCode;\n\t\t},\n\t\tasync close() {\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"macos-backend.js","sourceRoot":"","sources":["../../../src/core/sandbox/macos-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oBAAoB,CAAC;AACzF,OAAO,EACN,kCAAkC,EAGlC,4BAA4B,EAC5B,oCAAoC,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,GACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAA2B,MAAM,+BAA+B,CAAC;AAElG,OAAO,EACN,qBAAqB,EACrB,kCAAkC,EAClC,8BAA8B,GAE9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAoBtF,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,SAAS,iBAAiB,CAAC,KAAa,EAAU;IACjD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAAA,CACrF;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa,EAAE,KAAK,GAAG,uBAAuB,EAAU;IAC/F,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAW;IACpD,yEAAyE;IACzE,6EAA6E;IAC7E,yBAAyB;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,4BAA4B,EAAE,eAAe,CAAC,EAAE;QACxF,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAAA,CAC3B;AAED,SAAS,WAAW,CAAC,KAA+B,EAAmB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAAA,CACjD,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAAwB,EAAY;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC;YACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IAAA,CACD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IAAA,CACD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAAA,CAC/B;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAU;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;AAAA,CACD;AAED,yFAAyF;AACzF,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAElF,SAAS,sBAAsB,CAAC,MAAc,EAAoD;IACjG,+EAA+E;IAC/E,4EAA4E;IAC5E,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,iFAAiF;IACjF,2BAA2B;IAC3B,IAAI,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC;IAC1F,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,gFAAgF;IAChF,kFAAkF;IAClF,8EAA8E;IAC9E,8DAA8D;IAC9D,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAoC,EAAkB;IAC/F,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wCAAwC,EAAE;YACjF,KAAK,CAAC,MAAM,GAAG;gBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAAA,CACzD;YACD,KAAK,CAAC,KAAK,GAAG,EAAC,CAAC;SAChB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,iBAAiB,CAAC;IAC/D,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;IAC/C,IAAI,KAAsC,CAAC;IAC3C,IAAI,OAAoC,CAAC;IACzC,IAAI,kBAAkD,CAAC;IACvD,IAAI,sBAA0C,CAAC;IAC/C,IAAI,eAAqF,CAAC;IAC1F,IAAI,mBAAuC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;YACjG,KAAK,CAAC,MAAM,GAAG;gBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAAA,CACzD;YACD,KAAK,CAAC,KAAK,GAAG,EAAC,CAAC;SAChB,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC5B,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAmB;YACpD,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,oEAAoE;YACpE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC;YAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;YACtE,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;YACjE,SAAS,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,mBAAmB,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;YAEzE,MAAM,0BAA0B,GAAG,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC;YAEnE,OAAO,GAAG,qBAAqB,CAAC,wBAAwB,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnF,gFAAgF;YAChF,+EAA+E;YAC/E,+EAA+E;YAC/E,8EAA8E;YAC9E,2EAA2E;YAC3E,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC1D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACjG,sBAAsB,GAAG,kBAAkB,EAAE,mBAAmB,CAAC;YACjE,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBACvC,OAAO,EAAE,WAAW;gBACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;gBACxC,cAAc;gBACd,6DAA6D;gBAC7D,wEAAwE;gBACxE,eAAe,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,uEAAuE;YACvE,kBAAkB;gBACjB,kBAAkB;oBAClB,CAAC,MAAM,wBAAwB,CAAC;wBAC/B,UAAU,EAAE,kBAAkB,CAAC,cAAc;wBAC7C,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,KAAK;wBAC9D,cAAc,EAAE,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC;wBACrD,4EAA4E;wBAC5E,2DAA2D;wBAC3D,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;wBACzF,cAAc;qBACd,CAAC,CAAC,CAAC;YACL,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;YAEnD,MAAM,eAAe,GAAG,oBAAoB,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,mBAAmB,GAAG,eAAe,EAAE,mBAAmB,CAAC;YAC3D,6EAA6E;YAC7E,sDAAsD;YACtD,eAAe;gBACd,eAAe;oBACf,CAAC,MAAM,4BAA4B,CAAC;wBACnC,UAAU,EAAE,eAAe,CAAC,cAAc;wBAC1C,eAAe,EAAE,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,CAAC,EAAE,OAAO,EAAE,CAAC;wBAClG,cAAc;wBACd,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CACzB,mBAAmB,CAAC;4BACnB,OAAO;4BACP,MAAM;4BACN,SAAS;4BACT,wBAAwB;4BACxB,gBAAgB,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;yBAC9C,CAAC;qBACH,CAAC,CAAC,CAAC;YACL,MAAM,SAAS,GAAG,KAAK,CAAC,IAAc,CAAC;YAEvC,+EAA+E;YAC/E,6EAA6E;YAC7E,MAAM,uBAAuB,GAAG,MAAM,CAAC,iBAAiB;gBACvD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAC;YAEb,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACxC,OAAO,CAAC,QAAQ;gBAChB,MAAM,CAAC,OAAO;gBACd,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;gBAC/B,wBAAwB;aACxB,CAAC,CAAC;YACH,2EAA2E;YAC3E,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,2BAA2B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvG,IAAI,CAAC;oBACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YAAA,CACD,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;YACzE,MAAM,0BAA0B,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YACzE,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,GAAG,OAAO,EAAE,CAAC;YACtB,CAAC;YAED,MAAM,YAAY,GAAG;gBACpB,aAAa;gBACb,uEAAuE;gBACvE,kEAAkE;gBAClE,uEAAuE;gBACvE,wEAAwE;gBACxE,mBAAmB;gBACnB,uBAAuB;gBACvB,qEAAqE;gBACrE,kEAAkE;gBAClE,wEAAwE;gBACxE,sBAAsB;gBACtB,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,oBAAoB;gBACpB,iDAAiD;gBACjD,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,yCAAyC,KAAK,MAAM,CAAC;gBACvF,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,8CAA8C,KAAK,MAAM,CAAC;gBAC7F,kDAAkD;gBAClD,oBAAoB;gBACpB,mDAAmD;gBACnD,6EAA6E;gBAC7E,0EAA0E;gBAC1E,iDAAiD;gBACjD,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,yCAAyC,KAAK,MAAM,CAAC;gBACxF,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,0CAA0C,KAAK,MAAM,CAAC;gBACzF,iBAAiB;gBACjB,2DAA2D;gBAC3D,GAAG,CAAC,uBAAuB;oBAC1B,CAAC,CAAC,CAAC,yDAAyD,uBAAuB,MAAM,CAAC;oBAC1F,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,kBAAkB;oBACrB,CAAC,CAAC,CAAC,yDAAyD,kBAAkB,CAAC,cAAc,MAAM,CAAC;oBACpG,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,eAAe;oBAClB,CAAC,CAAC,CAAC,yDAAyD,eAAe,CAAC,cAAc,MAAM,CAAC;oBACjG,CAAC,CAAC,EAAE,CAAC;aACN,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;YACjE,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAEpD,MAAM,MAAM,GAAa,CAAC,IAAI,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC;YACzD,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;YAAA,CACxC,CAAC,CAAC;YACH,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;YAAA,CAC9C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;YAC5C,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;YAAA,CACzC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,SAAS,EAAE,CAAC,CAAC;YAEvD,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,IAAI,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,cAAc,EACd,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EACpE;gBACC,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE;oBACJ,GAAG,MAAM,CAAC,WAAW;oBACrB,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,cAAc;oBAChD,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,IAAI,cAAc;oBACpD,UAAU,EAAE,oBAAoB,SAAS,EAAE;oBAC3C,WAAW,EAAE,oBAAoB,SAAS,EAAE;oBAC5C,CAAC,8BAA8B,CAAC,EAAE,wBAAwB;oBAC1D,CAAC,kCAAkC,CAAC,EAAE,mBAAmB;oBACzD,CAAC,2BAA2B,CAAC,EAAE,gBAAgB;oBAC/C,GAAG,CAAC,kBAAkB;wBACrB,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,EAAE,kBAAkB,CAAC,eAAe,EAAE;wBAC1E,CAAC,CAAC,EAAE,CAAC;oBACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrG;gBACD,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;aACrC,CACD,CAAC;YACF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAA,CAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,0BAA0B,EAAE,CAAC;YAC7B,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;YACrB,MAAM,8BAA8B,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,0BAA0B,CAAC;YACtG,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,IAAI,IAAI,EAAE,CAAC;gBACV,cAAc,EAAE,GAAG,CAAC;oBACnB,IAAI;oBACJ,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACnD,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACrB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAAA,CAChB;QACD,KAAK,CAAC,KAAK,GAAG;YACb,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,MAAM,eAAe,EAAE,KAAK,EAAE,CAAC;YAC/B,IAAI,mBAAmB;gBAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,kBAAkB,EAAE,KAAK,EAAE,CAAC;YAClC,IAAI,sBAAsB;gBAAE,MAAM,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7F,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QAAA,CACrB;KACD,CAAC;AAAA,CACF;AAED,KAAK,UAAU,mBAAmB,CAAC,OAMlC,EAAoC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,cAAc,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzG,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACnH,OAAO,CAAC,IAAI,CAAC,CACb,CAAC;IACF,aAAa,CACZ,WAAW,EACX;QACC,aAAa;QACb,mBAAmB;QACnB,uBAAuB;QACvB,sBAAsB;QACtB,oBAAoB;QACpB,oBAAoB;QACpB,gCAAgC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK;QACzE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5F,iBAAiB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,KAAK,EAAE,CACf,CAAC;IACF,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CACrC,cAAc,EACd,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EACnE;YACC,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE;gBACJ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI;gBACtC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM;aAC1C;YACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACjC,CACD,CAAC;QACF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAA,CACtC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAA,CACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAC7D,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AAAA,CACD","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { typeScriptSourceConfigFiles } from \"../extensions/source-runtime.ts\";\nimport { createCommandEscalationApprover, createCredentialReleaser, createHostApprover } from \"./host-approval.ts\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport {\n\tCOMMAND_ESCALATION_SOCKET_VARIABLE,\n\ttype CommandEscalationRequest,\n\ttype CommandEscalationResult,\n\tcreateCommandEscalationProxy,\n\tresolveCommandEscalationChannelPaths,\n} from \"./rpc/command-proxy.ts\";\nimport {\n\tfillHostGitCredential,\n\tGIT_CREDENTIAL_SOCKET_VARIABLE,\n\tresolveGitCredentialChannelPaths,\n\twriteGitCredentialHelper,\n} from \"./rpc/git-credential-helper.ts\";\nimport { createGitCredentialProxy, type GitCredentialProxy } from \"./rpc/git-credential-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport {\n\tcreateTerminalHandoff,\n\tTERMINAL_HANDOFF_ACK_PATH_VARIABLE,\n\tTERMINAL_HANDOFF_PATH_VARIABLE,\n\ttype TerminalHandoff,\n} from \"./terminal-handoff.ts\";\nimport { publishTerminalSize, TERMINAL_SIZE_PATH_VARIABLE } from \"./terminal-size.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface MacosSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/**\n\t * Injectable only so violation attribution can be tested off macOS; production\n\t * spawns `sandbox-exec` directly. Without this the decision about what counts as a\n\t * violation would be verifiable only on a macOS host.\n\t */\n\tspawnChild?: typeof spawn;\n\t/** Injectable only for tests, which have no terminal to approve an escalation at. */\n\trequestCommandEscalation?: (request: CommandEscalationRequest) => Promise<boolean>;\n\t/** Retained for source compatibility; launch state is now required on each launch. */\n\tsupervisorStateDirectory?: string;\n}\n\nconst ESCALATION_OUTPUT_LIMIT = 64 * 1024;\n\nfunction seatbeltParameter(value: string): string {\n\treturn value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll(\"\\n\", \"\\\\n\").replaceAll('\"', '\\\\\"');\n}\n\nfunction appendBounded(current: string, chunk: string, limit = ESCALATION_OUTPUT_LIMIT): string {\n\tif (current.length >= limit) return current;\n\treturn current + chunk.slice(0, limit - current.length);\n}\n\nfunction sandboxExecExists(command: string): boolean {\n\t// sandbox-exec has no --version flag; a real, minimal profile run is the\n\t// standard existence-and-basic-functionality probe (see the 2b.5 prototype's\n\t// own positive control).\n\tconst result = spawnSync(command, [\"-p\", \"(version 1)(allow default)\", \"/usr/bin/true\"], {\n\t\tstdio: \"ignore\",\n\t\ttimeout: 2_000,\n\t});\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\n/**\n * Unlike Linux's bwrap (which needs each mount ancestor declared for its bind-mount\n * tree), Seatbelt's `subpath` is recursive from a single root, so only the directory\n * containing each path is needed -- no ancestor walk. Each directory is resolved to\n * its real (symlink-free) path: Seatbelt canonicalizes the path it actually checks\n * against a `subpath` rule (confirmed empirically -- a rule built from an\n * unresolved symlinked path, e.g. Homebrew's own layout, silently never matches).\n */\nfunction readOnlyDirectories(paths: readonly string[]): string[] {\n\tconst directories = paths.map((path) => {\n\t\tconst resolved = resolve(path);\n\t\ttry {\n\t\t\treturn statSync(resolved).isDirectory() ? resolved : dirname(resolved);\n\t\t} catch {\n\t\t\treturn dirname(resolved);\n\t\t}\n\t});\n\tconst canonical = directories.map((directory) => {\n\t\ttry {\n\t\t\treturn realpathSync(directory);\n\t\t} catch {\n\t\t\treturn directory;\n\t\t}\n\t});\n\treturn [...new Set(canonical)];\n}\n\n/**\n * Canonicalize a channel socket path for a Seatbelt literal. Only the directory can be\n * resolved -- the socket file need not exist yet when the profile is written -- and the\n * same symlink rule as `readOnlyDirectories` applies: Seatbelt matches the canonical\n * path, so an unresolved one silently never matches.\n */\nfunction canonicalSocketPath(path: string): string {\n\tconst directory = dirname(resolve(path));\n\ttry {\n\t\treturn join(realpathSync(directory), basename(path));\n\t} catch {\n\t\treturn join(directory, basename(path));\n\t}\n}\n\n/** Seatbelt refuses through the blocked call's own errno text, not a wrapper message. */\nconst DENIAL_EVIDENCE = /Operation not permitted|Permission denied|EPERM|EACCES/i;\n\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | \"unknown\" | undefined {\n\t// Confirmed empirically (2b.5 prototype): unlike Linux's bwrap, macOS Seatbelt\n\t// denials surface through the launched command's own generic \"Operation not\n\t// permitted\"/EPERM text for filesystem AND network refusals alike -- there is no\n\t// macOS-specific phrase equivalent to Linux's distinct \"Network is unreachable\".\n\t// Only sandbox-exec's own wrapper-level exec refusal (a sign our own profile\n\t// forgot to allow a binary, not a policy decision) is unambiguous from stderr\n\t// text. Anything else that still shows a refusal stays \"unknown\";\n\t// network-proxy.ts's own precise per-request recording is the reliable \"network\"\n\t// signal on this platform.\n\tif (/execvp\\(\\) of .* failed: Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (DENIAL_EVIDENCE.test(stderr)) return \"unknown\";\n\t// No refusal in evidence. The coarseness above is about telling filesystem from\n\t// network, not about telling a denial from an ordinary failure -- a non-zero exit\n\t// on its own says nothing about the boundary, and reporting it as a violation\n\t// sends the reader looking for a refusal that never happened.\n\treturn undefined;\n}\n\n/**\n * macOS's platform adapter. Seatbelt (`sandbox-exec`) allows reads broadly except\n * the invoking account's home directory, denies writes outside the workspace, and\n * denies network outside the sandbox proxy's exact loopback port -- narrower than\n * the wildcard `localhost:*` pattern some other sandboxes use. This mirrors Linux's\n * actual posture (`--ro-bind / /` plus a hidden `/home`) rather than the narrower\n * read-allowlist this design started with, which broke ordinary process startup.\n */\nexport function createMacosSandboxBackend(options?: MacosSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"darwin\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on macOS only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? sandboxExecExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\tlet handoff: TerminalHandoff | undefined;\n\tlet gitCredentialProxy: GitCredentialProxy | undefined;\n\tlet gitCredentialDirectory: string | undefined;\n\tlet escalationProxy: Awaited<ReturnType<typeof createCommandEscalationProxy>> | undefined;\n\tlet escalationDirectory: string | undefined;\n\tif (!hasCommand(\"sandbox-exec\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"sandbox-exec (Seatbelt) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"macOS sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\t// Same reasoning as readOnlyDirectories: on macOS the workspace itself can\n\t\t\t// be reached through a symlink (e.g. os.tmpdir()'s /var -> /private/var),\n\t\t\t// and Seatbelt's subpath match is against the canonical path, not the one\n\t\t\t// the caller happened to spell. Resolve once, use everywhere below.\n\t\t\tconst workspace = realpathSync(launch.policy.workspace);\n\t\t\tconst writableRoots = launch.policy.additionalWritableRoots;\n\t\t\tconst stateDirectory = join(workspace, \".apex-code\", \"sandbox-state\");\n\t\t\tmkdirSync(stateDirectory, { recursive: true });\n\t\t\tconst supervisorStateDirectory = launch.supervisorStateDirectory;\n\t\t\tmkdirSync(supervisorStateDirectory, { recursive: true, mode: 0o700 });\n\t\t\tconst acknowledgementPath = join(stateDirectory, \"terminal-handoff-ack\");\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\thandoff = createTerminalHandoff(supervisorStateDirectory, { acknowledgementPath });\n\t\t\t// Both channels are AF_UNIX servers, which Windows has not got. Nothing is lost\n\t\t\t// by skipping them there: ADR 0005 leaves Windows unsupported and this backend\n\t\t\t// reports `unavailable` on any real Windows host. They are reachable here only\n\t\t\t// because the violation-attribution tests run this body off-macOS on purpose,\n\t\t\t// with `spawnChild` injected, and those must keep working on every runner.\n\t\t\tconst unixSocketsAvailable = process.platform !== \"win32\";\n\t\t\tconst gitCredentialPaths = unixSocketsAvailable ? resolveGitCredentialChannelPaths() : undefined;\n\t\t\tgitCredentialDirectory = gitCredentialPaths?.hostSocketDirectory;\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\ttcpHost: \"127.0.0.1\",\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t\t// Undefined without a terminal, which leaves the proxy's own\n\t\t\t\t// deny-without-asking path in place for headless, print, JSON, and RPC.\n\t\t\t\trequestApproval: createHostApprover({ handoff }),\n\t\t\t});\n\t\t\t// After the network proxy, because reachability is its answer to give.\n\t\t\tgitCredentialProxy =\n\t\t\t\tgitCredentialPaths &&\n\t\t\t\t(await createGitCredentialProxy({\n\t\t\t\t\tsocketPath: gitCredentialPaths.hostSocketPath,\n\t\t\t\t\tisHostAllowed: (host) => proxy?.isHostReachable(host) ?? false,\n\t\t\t\t\trequestRelease: createCredentialReleaser({ handoff }),\n\t\t\t\t\t// The supervisor's own environment: this runs outside the boundary and must\n\t\t\t\t\t// resolve against the real host home the child cannot see.\n\t\t\t\t\tfillCredential: (request) => fillHostGitCredential(request, { environment: process.env }),\n\t\t\t\t\tviolationStore,\n\t\t\t\t}));\n\t\t\twriteGitCredentialHelper(supervisorStateDirectory);\n\n\t\t\tconst escalationPaths = unixSocketsAvailable ? resolveCommandEscalationChannelPaths() : undefined;\n\t\t\tescalationDirectory = escalationPaths?.hostSocketDirectory;\n\t\t\t// Seatbelt cannot remap a path, so the child reaches this socket at its host\n\t\t\t// path, exactly as it reaches the credential channel.\n\t\t\tescalationProxy =\n\t\t\t\tescalationPaths &&\n\t\t\t\t(await createCommandEscalationProxy({\n\t\t\t\t\tsocketPath: escalationPaths.hostSocketPath,\n\t\t\t\t\trequestApproval: options?.requestCommandEscalation ?? createCommandEscalationApprover({ handoff }),\n\t\t\t\t\tviolationStore,\n\t\t\t\t\trunEscalated: (request) =>\n\t\t\t\t\t\trunEscalatedCommand({\n\t\t\t\t\t\t\trequest,\n\t\t\t\t\t\t\tlaunch,\n\t\t\t\t\t\t\tworkspace,\n\t\t\t\t\t\t\tsupervisorStateDirectory,\n\t\t\t\t\t\t\tspawnSandboxExec: options?.spawnChild ?? spawn,\n\t\t\t\t\t\t}),\n\t\t\t\t}));\n\t\t\tconst proxyPort = proxy.port as number;\n\n\t\t\t// Seatbelt cannot remap a path, so the child connects to the channel socket at\n\t\t\t// its host path, and the profile allows outbound to exactly that one socket.\n\t\t\tconst credentialChannelSocket = launch.credentialChannel\n\t\t\t\t? canonicalSocketPath(launch.credentialChannel.hostSocketPath)\n\t\t\t\t: undefined;\n\n\t\t\tconst readOnlyDirs = readOnlyDirectories([\n\t\t\t\tprocess.execPath,\n\t\t\t\tlaunch.command,\n\t\t\t\t...(launch.readOnlyPaths ?? []),\n\t\t\t\tsupervisorStateDirectory,\n\t\t\t]);\n\t\t\t// Seatbelt denies the whole home directory before re-allowing named paths,\n\t\t\t// so a `.ts` extension loaded inside the sandbox fails on its tsconfig\n\t\t\t// rather than on anything the extension does. Empty off a source runtime.\n\t\t\tconst readOnlyFiles = [...(launch.readOnlyFiles ?? []), ...typeScriptSourceConfigFiles()].map((path) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn realpathSync(path);\n\t\t\t\t} catch {\n\t\t\t\t\treturn resolve(path);\n\t\t\t\t}\n\t\t\t});\n\t\t\tconst terminalSizePath = join(supervisorStateDirectory, \"terminal-size\");\n\t\t\tconst stopPublishingTerminalSize = publishTerminalSize(terminalSizePath);\n\t\t\tlet userHome: string | undefined;\n\t\t\ttry {\n\t\t\t\tuserHome = realpathSync(homedir());\n\t\t\t} catch {\n\t\t\t\tuserHome = homedir();\n\t\t\t}\n\n\t\t\tconst profileLines = [\n\t\t\t\t\"(version 1)\",\n\t\t\t\t// bsd.sb's baseline is broader than Linux's opt-in bind-mount model --\n\t\t\t\t// a real gap this design accepts, documented in the spec's fourth\n\t\t\t\t// amendment -- but it is the only combination the 2b.5 prototype found\n\t\t\t\t// that lets a normal Unix child process (dyld, /bin/sh) actually start.\n\t\t\t\t'(import \"bsd.sb\")',\n\t\t\t\t\"(allow process-exec*)\",\n\t\t\t\t// Separate from process-exec* -- confirmed empirically: a shell that\n\t\t\t\t// forks a child shell (e.g. `sh -c 'a' && sh -c 'b'`) failed with\n\t\t\t\t// \"fork: Operation not permitted\" without this, even with exec allowed.\n\t\t\t\t\"(allow process-fork)\",\n\t\t\t\t// Matches Linux's actual posture (bwrap's `--ro-bind / /`): broad read,\n\t\t\t\t// narrow write. A read-only allowlist alone (this design's first cut)\n\t\t\t\t// breaks ordinary process startup -- confirmed empirically, getcwd()\n\t\t\t\t// itself needs to traverse the workspace's ancestor directories, which\n\t\t\t\t// no read rule scoped only to the workspace or runtime paths covers.\n\t\t\t\t\"(allow file-read*)\",\n\t\t\t\t'(deny file-read* (subpath (param \"USER_HOME\")))',\n\t\t\t\t...readOnlyDirs.map((_, index) => `(allow file-read* (subpath (param \"RO_${index}\")))`),\n\t\t\t\t...readOnlyFiles.map((_, index) => `(allow file-read* (subpath (param \"RO_FILE_${index}\")))`),\n\t\t\t\t'(allow file-read* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t\"(deny file-write*)\",\n\t\t\t\t'(allow file-write* (subpath (param \"WORKSPACE\")))',\n\t\t\t\t// Each extra root is allowed exactly as the workspace is, and only ever from\n\t\t\t\t// an argv-parsed flag: a repository that could name its own writable root\n\t\t\t\t// would be granting itself authority (ADR 0016).\n\t\t\t\t...writableRoots.map((_, index) => `(allow file-read* (subpath (param \"RW_${index}\")))`),\n\t\t\t\t...writableRoots.map((_, index) => `(allow file-write* (subpath (param \"RW_${index}\")))`),\n\t\t\t\t\"(deny network*)\",\n\t\t\t\t'(allow network-outbound (remote ip (param \"PROXY_ADDR\")))',\n\t\t\t\t...(credentialChannelSocket\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${credentialChannelSocket}\")))`]\n\t\t\t\t\t: []),\n\t\t\t\t...(gitCredentialPaths\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${gitCredentialPaths.hostSocketPath}\")))`]\n\t\t\t\t\t: []),\n\t\t\t\t...(escalationPaths\n\t\t\t\t\t? [`(allow network-outbound (remote unix-socket (literal \"${escalationPaths.hostSocketPath}\")))`]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t\tconst profilePath = join(supervisorStateDirectory, \"profile.sb\");\n\t\t\twriteFileSync(profilePath, profileLines.join(\"\\n\"));\n\n\t\t\tconst params: string[] = [\"-D\", `USER_HOME=${userHome}`];\n\t\t\treadOnlyDirs.forEach((dir, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_${index}=${dir}`);\n\t\t\t});\n\t\t\treadOnlyFiles.forEach((file, index) => {\n\t\t\t\tparams.push(\"-D\", `RO_FILE_${index}=${file}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `WORKSPACE=${workspace}`);\n\t\t\twritableRoots.forEach((root, index) => {\n\t\t\t\tparams.push(\"-D\", `RW_${index}=${root}`);\n\t\t\t});\n\t\t\tparams.push(\"-D\", `PROXY_ADDR=localhost:${proxyPort}`);\n\n\t\t\tconst spawnSandboxExec = options?.spawnChild ?? spawn;\n\t\t\tconst child = spawnSandboxExec(\n\t\t\t\t\"sandbox-exec\",\n\t\t\t\t[\"-f\", profilePath, ...params, \"--\", launch.command, ...launch.args],\n\t\t\t\t{\n\t\t\t\t\tcwd: workspace,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.environment,\n\t\t\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\tHTTP_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\tHTTPS_PROXY: `http://127.0.0.1:${proxyPort}`,\n\t\t\t\t\t\t[TERMINAL_HANDOFF_PATH_VARIABLE]: supervisorStateDirectory,\n\t\t\t\t\t\t[TERMINAL_HANDOFF_ACK_PATH_VARIABLE]: acknowledgementPath,\n\t\t\t\t\t\t[TERMINAL_SIZE_PATH_VARIABLE]: terminalSizePath,\n\t\t\t\t\t\t...(gitCredentialPaths\n\t\t\t\t\t\t\t? { [GIT_CREDENTIAL_SOCKET_VARIABLE]: gitCredentialPaths.childSocketPath }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t...(escalationPaths ? { [COMMAND_ESCALATION_SOCKET_VARIABLE]: escalationPaths.childSocketPath } : {}),\n\t\t\t\t\t},\n\t\t\t\t\tstdio: [\"inherit\", \"inherit\", \"pipe\"],\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\tstderr += chunk;\n\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t});\n\t\t\tconst exitCode = await waitForExit(child);\n\t\t\tstopPublishingTerminalSize();\n\t\t\tawait proxy?.close();\n\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\tif (kind) {\n\t\t\t\tviolationStore?.add({\n\t\t\t\t\tkind,\n\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn exitCode;\n\t\t},\n\t\tasync close() {\n\t\t\thandoff?.stop();\n\t\t\tawait escalationProxy?.close();\n\t\t\tif (escalationDirectory) rmSync(escalationDirectory, { force: true, recursive: true });\n\t\t\tawait gitCredentialProxy?.close();\n\t\t\tif (gitCredentialDirectory) rmSync(gitCredentialDirectory, { force: true, recursive: true });\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n\nasync function runEscalatedCommand(options: {\n\trequest: CommandEscalationRequest;\n\tlaunch: SandboxLaunch;\n\tworkspace: string;\n\tsupervisorStateDirectory: string;\n\tspawnSandboxExec: typeof spawn;\n}): Promise<CommandEscalationResult> {\n\tconst profilePath = join(options.supervisorStateDirectory, `escalation-${process.pid}-${Date.now()}.sb`);\n\tconst writableRoots = [...options.launch.policy.additionalWritableRoots, options.request.writableRoot].map((root) =>\n\t\tresolve(root),\n\t);\n\twriteFileSync(\n\t\tprofilePath,\n\t\t[\n\t\t\t\"(version 1)\",\n\t\t\t'(import \"bsd.sb\")',\n\t\t\t\"(allow process-exec*)\",\n\t\t\t\"(allow process-fork)\",\n\t\t\t\"(allow file-read*)\",\n\t\t\t\"(deny file-write*)\",\n\t\t\t`(allow file-write* (subpath \"${seatbeltParameter(options.workspace)}\"))`,\n\t\t\t...writableRoots.map((root) => `(allow file-write* (subpath \"${seatbeltParameter(root)}\"))`),\n\t\t\t\"(deny network*)\",\n\t\t].join(\"\\n\"),\n\t\t{ mode: 0o600 },\n\t);\n\ttry {\n\t\tconst child = options.spawnSandboxExec(\n\t\t\t\"sandbox-exec\",\n\t\t\t[\"-f\", profilePath, \"--\", \"/bin/sh\", \"-c\", options.request.command],\n\t\t\t{\n\t\t\t\tcwd: options.workspace,\n\t\t\t\tenv: {\n\t\t\t\t\tPATH: options.launch.environment?.PATH,\n\t\t\t\t\tHOME: options.launch.environment?.HOME,\n\t\t\t\t\tTMPDIR: options.launch.environment?.TMPDIR,\n\t\t\t\t},\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t},\n\t\t);\n\t\tlet stdout = \"\";\n\t\tlet stderr = \"\";\n\t\tchild.stdout?.setEncoding(\"utf8\");\n\t\tchild.stdout?.on(\"data\", (chunk: string) => {\n\t\t\tstdout = appendBounded(stdout, chunk);\n\t\t});\n\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\tstderr = appendBounded(stderr, chunk);\n\t\t});\n\t\tconst code = await new Promise<number>((resolveCode) => {\n\t\t\tchild.once(\"error\", () => resolveCode(1));\n\t\t\tchild.once(\"exit\", (exitCode) => resolveCode(exitCode ?? 1));\n\t\t});\n\t\treturn { code, stdout, stderr };\n\t} finally {\n\t\trmSync(profilePath, { force: true });\n\t}\n}\n"]}

package/dist/core/sandbox/network-proxy.d.ts

@@ -4,11 +4,30 @@ export interface SandboxNetworkProxy {
     readonly server: http.Server;
     /** Set only in TCP-listen mode (`tcpHost`); the ephemeral port the proxy bound. */
     readonly port?: number;
+    /**
+     * Whether this session may reach `hostname` on any port, by configuration or by a
+     * grant the human made this session.
+     *
+     * Exposed so the git credential channel can ask the one component that actually knows,
+     * rather than keeping a second copy of the allowlist that would drift from this one the
+     * first time a host is approved at runtime.
+     */
+    isHostReachable(hostname: string): boolean;
     close(): Promise<void>;
 }
 export declare function createSandboxNetworkProxy(options: {
     allowedHosts: readonly string[];
     violationStore?: SandboxViolationStore;
+    /**
+     * Ask a human whether to permit one refused host for the rest of this session.
+     *
+     * Supplied by the supervisor and never by the child: per ADR 0023, an approval
+     * asserted from inside the boundary would be indistinguishable from one forged by
+     * the code the boundary exists to contain. Absent means deny without asking, which
+     * is exactly today's behaviour and what ADR 0005 requires of headless, print,
+     * JSON, and RPC modes.
+     */
+    requestApproval?: (hostname: string, port: number) => Promise<boolean>;
 } & ({
     socketPath: string;
     tcpHost?: undefined;

package/dist/core/sandbox/network-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-proxy.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/network-proxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE;IACR,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACvC,GAAG,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,UAAU,CAAC,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7F,OAAO,CAAC,mBAAmB,CAAC,CAqF9B","sourcesContent":["import { existsSync, unlinkSync } from \"node:fs\";\nimport * as http from \"node:http\";\nimport * as net from \"node:net\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface SandboxNetworkProxy {\n\treadonly server: http.Server;\n\t/** Set only in TCP-listen mode (`tcpHost`); the ephemeral port the proxy bound. */\n\treadonly port?: number;\n\tclose(): Promise<void>;\n}\n\nexport function createSandboxNetworkProxy(\n\toptions: {\n\t\tallowedHosts: readonly string[];\n\t\tviolationStore?: SandboxViolationStore;\n\t} & ({ socketPath: string; tcpHost?: undefined } | { socketPath?: undefined; tcpHost: string }),\n): Promise<SandboxNetworkProxy> {\n\treturn new Promise((resolve, reject) => {\n\t\tconst server = http.createServer((_req, res) => {\n\t\t\tres.writeHead(405, { \"Content-Type\": \"text/plain\" });\n\t\t\tres.end(\"Method Not Allowed\\n\");\n\t\t});\n\n\t\tserver.on(\"connect\", (req, clientSocket, head) => {\n\t\t\tconst match = req.url?.match(/^([^:]+):(\\d+)$/);\n\t\t\tif (!match) {\n\t\t\t\tclientSocket.destroy();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst hostname = match[1];\n\t\t\tconst port = Number.parseInt(match[2], 10);\n\n\t\t\tconst isAllowed =\n\t\t\t\toptions.allowedHosts.includes(hostname) || options.allowedHosts.includes(`${hostname}:${port}`);\n\t\t\tif (!isAllowed) {\n\t\t\t\tclientSocket.write(\"HTTP/1.1 403 Forbidden\\r\\n\\r\\n\");\n\t\t\t\tclientSocket.destroy();\n\t\t\t\toptions.violationStore?.add({\n\t\t\t\t\tkind: \"network\",\n\t\t\t\t\tcommand: `CONNECT ${hostname}:${port}`,\n\t\t\t\t\tdetail: `Host ${hostname} refused by allowlist policy.`,\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst serverSocket = net.connect(Number(port) || 443, hostname, () => {\n\t\t\t\tclientSocket.write(\"HTTP/1.1 200 Connection Established\\r\\n\\r\\n\");\n\t\t\t\tserverSocket.write(head);\n\t\t\t\tserverSocket.pipe(clientSocket);\n\t\t\t\tclientSocket.pipe(serverSocket);\n\t\t\t});\n\n\t\t\tserverSocket.on(\"error\", () => {\n\t\t\t\tif (!clientSocket.destroyed) {\n\t\t\t\t\tclientSocket.write(`HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n`);\n\t\t\t\t\tclientSocket.destroy();\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tclientSocket.on(\"error\", () => {\n\t\t\t\tserverSocket.destroy();\n\t\t\t});\n\t\t});\n\n\t\tserver.on(\"error\", reject);\n\n\t\tif (options.tcpHost !== undefined) {\n\t\t\t// macOS's Seatbelt can permit a specific localhost port directly, so the\n\t\t\t// proxy listens on loopback TCP there instead of a Unix domain socket --\n\t\t\t// no in-child relay process is needed the way Linux's `--unshare-net`\n\t\t\t// requires one.\n\t\t\tserver.listen(0, options.tcpHost, () => {\n\t\t\t\tserver.off(\"error\", reject);\n\t\t\t\tconst address = server.address();\n\t\t\t\tconst port = typeof address === \"object\" && address !== null ? address.port : undefined;\n\t\t\t\tresolve({\n\t\t\t\t\tserver,\n\t\t\t\t\tport,\n\t\t\t\t\tclose: () => new Promise((r) => server.close(() => r())),\n\t\t\t\t});\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\t// A prior sandboxed launch that never called close() (a crash, a SIGKILL)\n\t\t// leaves a stale socket file behind; Node's listen() refuses to bind over\n\t\t// one even though nothing is listening on it.\n\t\tif (existsSync(options.socketPath)) {\n\t\t\tunlinkSync(options.socketPath);\n\t\t}\n\n\t\tserver.listen(options.socketPath, () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tclose: () => new Promise((r) => server.close(() => r())),\n\t\t\t});\n\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"network-proxy.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/network-proxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE;IACR,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE,GAAG,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,UAAU,CAAC,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7F,OAAO,CAAC,mBAAmB,CAAC,CA8J9B","sourcesContent":["import { existsSync, unlinkSync } from \"node:fs\";\nimport * as http from \"node:http\";\nimport * as net from \"node:net\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\nexport interface SandboxNetworkProxy {\n\treadonly server: http.Server;\n\t/** Set only in TCP-listen mode (`tcpHost`); the ephemeral port the proxy bound. */\n\treadonly port?: number;\n\t/**\n\t * Whether this session may reach `hostname` on any port, by configuration or by a\n\t * grant the human made this session.\n\t *\n\t * Exposed so the git credential channel can ask the one component that actually knows,\n\t * rather than keeping a second copy of the allowlist that would drift from this one the\n\t * first time a host is approved at runtime.\n\t */\n\tisHostReachable(hostname: string): boolean;\n\tclose(): Promise<void>;\n}\n\nexport function createSandboxNetworkProxy(\n\toptions: {\n\t\tallowedHosts: readonly string[];\n\t\tviolationStore?: SandboxViolationStore;\n\t\t/**\n\t\t * Ask a human whether to permit one refused host for the rest of this session.\n\t\t *\n\t\t * Supplied by the supervisor and never by the child: per ADR 0023, an approval\n\t\t * asserted from inside the boundary would be indistinguishable from one forged by\n\t\t * the code the boundary exists to contain. Absent means deny without asking, which\n\t\t * is exactly today's behaviour and what ADR 0005 requires of headless, print,\n\t\t * JSON, and RPC modes.\n\t\t */\n\t\trequestApproval?: (hostname: string, port: number) => Promise<boolean>;\n\t} & ({ socketPath: string; tcpHost?: undefined } | { socketPath?: undefined; tcpHost: string }),\n): Promise<SandboxNetworkProxy> {\n\t/** Hosts a human permitted this session. Never persisted; a durable entry is a settings edit. */\n\tconst granted = new Set<string>();\n\t/**\n\t * Approvals currently awaiting an answer, keyed the same way a grant is.\n\t *\n\t * A real prompt takes as long as a human takes to read it, and a refused host usually\n\t * arrives as several near-simultaneous connections. Without this, each one raises its\n\t * own prompt for the same question.\n\t */\n\tconst pending = new Map<string, Promise<boolean>>();\n\n\tfunction isHostReachable(hostname: string): boolean {\n\t\tif (options.allowedHosts.some((entry) => entry === hostname || entry.startsWith(`${hostname}:`))) return true;\n\t\tfor (const grant of granted) {\n\t\t\tif (grant === hostname || grant.startsWith(`${hostname}:`)) return true;\n\t\t}\n\t\treturn false;\n\t}\n\n\tfunction isAllowed(hostname: string, port: number): boolean {\n\t\treturn (\n\t\t\toptions.allowedHosts.includes(hostname) ||\n\t\t\toptions.allowedHosts.includes(`${hostname}:${port}`) ||\n\t\t\tgranted.has(`${hostname}:${port}`)\n\t\t);\n\t}\n\n\tasync function approve(hostname: string, port: number): Promise<boolean> {\n\t\tconst key = `${hostname}:${port}`;\n\t\tif (granted.has(key)) return true;\n\t\tconst inFlight = pending.get(key);\n\t\tif (inFlight) return inFlight;\n\t\t// Declining is deliberately not remembered. A second attempt asks again, because a\n\t\t// cached \"no\" would be indistinguishable to the user from the boundary having\n\t\t// silently stopped asking.\n\t\tconst question = (async () => {\n\t\t\ttry {\n\t\t\t\tconst approved = await (options.requestApproval as (h: string, p: number) => Promise<boolean>)(\n\t\t\t\t\thostname,\n\t\t\t\t\tport,\n\t\t\t\t);\n\t\t\t\tif (approved) granted.add(key);\n\t\t\t\treturn approved;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t} finally {\n\t\t\t\tpending.delete(key);\n\t\t\t}\n\t\t})();\n\t\tpending.set(key, question);\n\t\treturn question;\n\t}\n\n\treturn new Promise((resolve, reject) => {\n\t\tconst server = http.createServer((_req, res) => {\n\t\t\tres.writeHead(405, { \"Content-Type\": \"text/plain\" });\n\t\t\tres.end(\"Method Not Allowed\\n\");\n\t\t});\n\n\t\tserver.on(\"connect\", (req, clientSocket, head) => {\n\t\t\tconst match = req.url?.match(/^([^:]+):(\\d+)$/);\n\t\t\tif (!match) {\n\t\t\t\tclientSocket.destroy();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst hostname = match[1];\n\t\t\tconst port = Number.parseInt(match[2], 10);\n\n\t\t\tfunction refuse(): void {\n\t\t\t\tif (!clientSocket.destroyed) {\n\t\t\t\t\tclientSocket.write(\"HTTP/1.1 403 Forbidden\\r\\n\\r\\n\");\n\t\t\t\t\tclientSocket.destroy();\n\t\t\t\t}\n\t\t\t\toptions.violationStore?.add({\n\t\t\t\t\tkind: \"network\",\n\t\t\t\t\tcommand: `CONNECT ${hostname}:${port}`,\n\t\t\t\t\tdetail: `Host ${hostname} refused by allowlist policy.`,\n\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (!isAllowed(hostname, port)) {\n\t\t\t\tif (!options.requestApproval) {\n\t\t\t\t\trefuse();\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// The client is left waiting on its CONNECT while the human reads the\n\t\t\t\t// prompt, which is what makes an approved host resume the original request\n\t\t\t\t// instead of surfacing as a failure the caller has to retry.\n\t\t\t\tvoid approve(hostname, port).then((approved) => {\n\t\t\t\t\tif (approved) tunnel();\n\t\t\t\t\telse refuse();\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttunnel();\n\n\t\t\tfunction tunnel(): void {\n\t\t\t\tif (clientSocket.destroyed) return;\n\t\t\t\tconst serverSocket = net.connect(Number(port) || 443, hostname, () => {\n\t\t\t\t\tclientSocket.write(\"HTTP/1.1 200 Connection Established\\r\\n\\r\\n\");\n\t\t\t\t\tserverSocket.write(head);\n\t\t\t\t\tserverSocket.pipe(clientSocket);\n\t\t\t\t\tclientSocket.pipe(serverSocket);\n\t\t\t\t});\n\n\t\t\t\tserverSocket.on(\"error\", () => {\n\t\t\t\t\tif (!clientSocket.destroyed) {\n\t\t\t\t\t\tclientSocket.write(`HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n`);\n\t\t\t\t\t\tclientSocket.destroy();\n\t\t\t\t\t}\n\t\t\t\t});\n\n\t\t\t\tclientSocket.on(\"error\", () => {\n\t\t\t\t\tserverSocket.destroy();\n\t\t\t\t});\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", reject);\n\n\t\tif (options.tcpHost !== undefined) {\n\t\t\t// macOS's Seatbelt can permit a specific localhost port directly, so the\n\t\t\t// proxy listens on loopback TCP there instead of a Unix domain socket --\n\t\t\t// no in-child relay process is needed the way Linux's `--unshare-net`\n\t\t\t// requires one.\n\t\t\tserver.listen(0, options.tcpHost, () => {\n\t\t\t\tserver.off(\"error\", reject);\n\t\t\t\tconst address = server.address();\n\t\t\t\tconst port = typeof address === \"object\" && address !== null ? address.port : undefined;\n\t\t\t\tresolve({\n\t\t\t\t\tserver,\n\t\t\t\t\tport,\n\t\t\t\t\tisHostReachable,\n\t\t\t\t\tclose: () => new Promise((r) => server.close(() => r())),\n\t\t\t\t});\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\t// A prior sandboxed launch that never called close() (a crash, a SIGKILL)\n\t\t// leaves a stale socket file behind; Node's listen() refuses to bind over\n\t\t// one even though nothing is listening on it.\n\t\tif (existsSync(options.socketPath)) {\n\t\t\tunlinkSync(options.socketPath);\n\t\t}\n\n\t\tserver.listen(options.socketPath, () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tisHostReachable,\n\t\t\t\tclose: () => new Promise((r) => server.close(() => r())),\n\t\t\t});\n\t\t});\n\t});\n}\n"]}