apex-code 0.0.1-alpha.9 → 0.0.4

package/dist/core/sandbox/full-access.js

@@ -0,0 +1,63 @@
+/**
+ * The explicit opt-out from OS containment.
+ *
+ * ADR 0005 shipped without one on purpose, and its 2026-08-28 amendment records why that
+ * is now a flag rather than an absence: the delegation work removed the reasons people
+ * were reaching for an escape hatch, so the hatch can exist without becoming the default
+ * route around a boundary that could not otherwise be worked with.
+ *
+ * Two rules keep it honest. It is spelled out in full on the command line, never inferred
+ * from settings, so no repository and no saved configuration can turn the boundary off.
+ * And it always announces itself, because a session that silently ran unconfined is
+ * indistinguishable afterwards from one that did not.
+ */
+const BANNER = [
+    "",
+    "  ! OS sandbox disabled for this session (--sandbox danger-full-access).",
+    "",
+    "    Tool calls and every process they spawn run with your full account authority:",
+    "    your home directory, your credentials, and unrestricted network access.",
+    "    The permission gate still applies. It is not a containment boundary.",
+    "",
+].join("\n");
+export function writeFullAccessBanner(stderr) {
+    stderr.write(`${BANNER}\n`);
+}
+/**
+ * Confirm the opt-out interactively, or accept it unprompted where no human could answer.
+ *
+ * A non-interactive session is the case the flag legitimately exists for -- CI that is
+ * already externally sandboxed -- and there is nobody there to type. Prompting anyway
+ * would hang the run rather than protect anything, so the banner carries the weight.
+ */
+export function confirmFullAccess(options) {
+    const input = options.input ?? process.stdin;
+    const output = options.output ?? process.stdout;
+    if (!input.isTTY || !output.isTTY)
+        return Promise.resolve(true);
+    output.write("Run this session with no OS sandbox? [y/N] ");
+    return new Promise((resolve) => {
+        let buffer = "";
+        const finish = (value) => {
+            input.off("data", onData);
+            input.off("error", onError);
+            input.pause();
+            const answer = value.trim().toLowerCase();
+            output.write("\n");
+            resolve(answer === "y" || answer === "yes");
+        };
+        const onData = (chunk) => {
+            buffer += chunk.toString();
+            const newline = buffer.indexOf("\n");
+            if (newline >= 0)
+                finish(buffer.slice(0, newline));
+        };
+        // Anything unreadable declines, because an unanswerable prompt must not be the way
+        // containment gets switched off.
+        const onError = () => finish("");
+        input.on("data", onData);
+        input.on("error", onError);
+        input.resume();
+    });
+}
+//# sourceMappingURL=full-access.js.map

package/dist/core/sandbox/full-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"full-access.js","sourceRoot":"","sources":["../../../src/core/sandbox/full-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,GAAG;IACd,EAAE;IACF,0EAA0E;IAC1E,EAAE;IACF,mFAAmF;IACnF,6EAA6E;IAC7E,0EAA0E;IAC1E,EAAE;CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,qBAAqB,CAAC,MAA2C,EAAQ;IACxF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;AAAA,CAC5B;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAGjC,EAAoB;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;QAAA,CAC5C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAAA,CACnD,CAAC;QACF,mFAAmF;QACnF,iCAAiC;QACjC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,MAAM,EAAE,CAAC;IAAA,CACf,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * The explicit opt-out from OS containment.\n *\n * ADR 0005 shipped without one on purpose, and its 2026-08-28 amendment records why that\n * is now a flag rather than an absence: the delegation work removed the reasons people\n * were reaching for an escape hatch, so the hatch can exist without becoming the default\n * route around a boundary that could not otherwise be worked with.\n *\n * Two rules keep it honest. It is spelled out in full on the command line, never inferred\n * from settings, so no repository and no saved configuration can turn the boundary off.\n * And it always announces itself, because a session that silently ran unconfined is\n * indistinguishable afterwards from one that did not.\n */\n\nconst BANNER = [\n\t\"\",\n\t\"  ! OS sandbox disabled for this session (--sandbox danger-full-access).\",\n\t\"\",\n\t\"    Tool calls and every process they spawn run with your full account authority:\",\n\t\"    your home directory, your credentials, and unrestricted network access.\",\n\t\"    The permission gate still applies. It is not a containment boundary.\",\n\t\"\",\n].join(\"\\n\");\n\nexport function writeFullAccessBanner(stderr: { write(message: string): boolean }): void {\n\tstderr.write(`${BANNER}\\n`);\n}\n\n/**\n * Confirm the opt-out interactively, or accept it unprompted where no human could answer.\n *\n * A non-interactive session is the case the flag legitimately exists for -- CI that is\n * already externally sandboxed -- and there is nobody there to type. Prompting anyway\n * would hang the run rather than protect anything, so the banner carries the weight.\n */\nexport function confirmFullAccess(options: {\n\tinput?: NodeJS.ReadStream;\n\toutput?: NodeJS.WriteStream;\n}): Promise<boolean> {\n\tconst input = options.input ?? process.stdin;\n\tconst output = options.output ?? process.stdout;\n\tif (!input.isTTY || !output.isTTY) return Promise.resolve(true);\n\n\toutput.write(\"Run this session with no OS sandbox? [y/N] \");\n\treturn new Promise((resolve) => {\n\t\tlet buffer = \"\";\n\t\tconst finish = (value: string) => {\n\t\t\tinput.off(\"data\", onData);\n\t\t\tinput.off(\"error\", onError);\n\t\t\tinput.pause();\n\t\t\tconst answer = value.trim().toLowerCase();\n\t\t\toutput.write(\"\\n\");\n\t\t\tresolve(answer === \"y\" || answer === \"yes\");\n\t\t};\n\t\tconst onData = (chunk: Buffer | string) => {\n\t\t\tbuffer += chunk.toString();\n\t\t\tconst newline = buffer.indexOf(\"\\n\");\n\t\t\tif (newline >= 0) finish(buffer.slice(0, newline));\n\t\t};\n\t\t// Anything unreadable declines, because an unanswerable prompt must not be the way\n\t\t// containment gets switched off.\n\t\tconst onError = () => finish(\"\");\n\t\tinput.on(\"data\", onData);\n\t\tinput.on(\"error\", onError);\n\t\tinput.resume();\n\t});\n}\n"]}

package/dist/core/sandbox/git-identity.d.ts

@@ -0,0 +1,57 @@
+export interface HostGitIdentity {
+    readonly name: string;
+    readonly email: string;
+}
+export interface ProjectedGitConfig {
+    readonly directory: string;
+    readonly path: string;
+}
+/**
+ * Read the host's git identity before the sandbox exists to hide it.
+ *
+ * `--global` rather than a plain lookup, because the scope flag is what excludes the
+ * workspace's own `.git/config` by construction rather than by choosing a lucky working
+ * directory. A repository must not be able to decide what the supervisor projects, the
+ * same rule ADR 0016 applies to the network allowlist. Repository scope still works
+ * normally inside the child: the workspace is bind-mounted read-write, so git reads
+ * `.git/config` there itself and it wins over this projection, exactly as it would on the
+ * host.
+ *
+ * System scope (`/etc/gitconfig`) is deliberately not consulted. A machine-wide commit
+ * identity is not a real configuration, and a second `spawnSync` to find one would cost
+ * every launch what it saves nobody.
+ *
+ * Returns undefined unless both keys are present. A name without an email still fails to
+ * author a commit, so projecting half an identity would replace one confusing error with
+ * another.
+ */
+export declare function resolveHostGitIdentity(options?: {
+    /** Injectable only for tests; production uses the supervisor's own environment. */
+    environment?: NodeJS.ProcessEnv;
+    /**
+     * Injectable only for tests, so one can prove repository scope stays excluded even
+     * when the lookup runs from inside a repository.
+     */
+    cwd?: string;
+}): HostGitIdentity | undefined;
+/**
+ * Write a two-key config the child can be pointed at through `GIT_CONFIG_GLOBAL`.
+ *
+ * Synthesized rather than copied. A real `~/.gitconfig` can carry a `credential.helper`
+ * that runs a command, or an `insteadOf` rule rewriting a remote to one carrying a token;
+ * projecting the host file would hand both to the child along with the name we wanted.
+ * Building the file from a resolved identity means it cannot contain anything else.
+ *
+ * The directory is its own, not shared with the credential projection, and `0700` for the
+ * same reason `resolveCredentialChannelPaths` uses one. TMPDIR is deliberately not
+ * honoured: it can point inside the workspace on macOS, which the sandbox may write.
+ */
+export declare function createProjectedGitConfig(identity: HostGitIdentity, options?: {
+    /**
+     * A `credential.helper` value for the child. It names the supervisor-mediated
+     * helper, never a host one: the point is that the child asks over the channel
+     * rather than reading any store itself.
+     */
+    credentialHelper?: string;
+}): ProjectedGitConfig;
+//# sourceMappingURL=git-identity.d.ts.map

package/dist/core/sandbox/git-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/git-identity.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAChD,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,eAAe,GAAG,SAAS,CAoB9B;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACvC,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE;IACT;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,GACC,kBAAkB,CAUpB","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { chmodSync, mkdtempSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { supervisorTempDirectory } from \"./supervisor-temp.ts\";\n\nexport interface HostGitIdentity {\n\treadonly name: string;\n\treadonly email: string;\n}\n\nexport interface ProjectedGitConfig {\n\treadonly directory: string;\n\treadonly path: string;\n}\n\n/** Long enough for a cold `git` on a slow disk, short enough not to stall every launch. */\nconst RESOLUTION_TIMEOUT_MILLISECONDS = 2_000;\n\n/**\n * Read the host's git identity before the sandbox exists to hide it.\n *\n * `--global` rather than a plain lookup, because the scope flag is what excludes the\n * workspace's own `.git/config` by construction rather than by choosing a lucky working\n * directory. A repository must not be able to decide what the supervisor projects, the\n * same rule ADR 0016 applies to the network allowlist. Repository scope still works\n * normally inside the child: the workspace is bind-mounted read-write, so git reads\n * `.git/config` there itself and it wins over this projection, exactly as it would on the\n * host.\n *\n * System scope (`/etc/gitconfig`) is deliberately not consulted. A machine-wide commit\n * identity is not a real configuration, and a second `spawnSync` to find one would cost\n * every launch what it saves nobody.\n *\n * Returns undefined unless both keys are present. A name without an email still fails to\n * author a commit, so projecting half an identity would replace one confusing error with\n * another.\n */\nexport function resolveHostGitIdentity(options?: {\n\t/** Injectable only for tests; production uses the supervisor's own environment. */\n\tenvironment?: NodeJS.ProcessEnv;\n\t/**\n\t * Injectable only for tests, so one can prove repository scope stays excluded even\n\t * when the lookup runs from inside a repository.\n\t */\n\tcwd?: string;\n}): HostGitIdentity | undefined {\n\tconst result = spawnSync(\"git\", [\"config\", \"--global\", \"--get-regexp\", \"^user\\\\.(name|email)$\"], {\n\t\tcwd: options?.cwd,\n\t\tencoding: \"utf8\",\n\t\tenv: options?.environment ?? process.env,\n\t\ttimeout: RESOLUTION_TIMEOUT_MILLISECONDS,\n\t});\n\tif (result.status !== 0 || typeof result.stdout !== \"string\") return undefined;\n\n\tlet name: string | undefined;\n\tlet email: string | undefined;\n\tfor (const line of result.stdout.split(\"\\n\")) {\n\t\tconst separator = line.indexOf(\" \");\n\t\tif (separator < 0) continue;\n\t\tconst value = line.slice(separator + 1).trim();\n\t\tif (value.length === 0) continue;\n\t\tif (line.slice(0, separator) === \"user.name\") name = value;\n\t\tif (line.slice(0, separator) === \"user.email\") email = value;\n\t}\n\treturn name && email ? { name, email } : undefined;\n}\n\n/** Escape a value for git's config syntax, which reads a quoted string with backslash escapes. */\nfunction quote(value: string): string {\n\treturn `\"${value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"')}\"`;\n}\n\n/**\n * Write a two-key config the child can be pointed at through `GIT_CONFIG_GLOBAL`.\n *\n * Synthesized rather than copied. A real `~/.gitconfig` can carry a `credential.helper`\n * that runs a command, or an `insteadOf` rule rewriting a remote to one carrying a token;\n * projecting the host file would hand both to the child along with the name we wanted.\n * Building the file from a resolved identity means it cannot contain anything else.\n *\n * The directory is its own, not shared with the credential projection, and `0700` for the\n * same reason `resolveCredentialChannelPaths` uses one. TMPDIR is deliberately not\n * honoured: it can point inside the workspace on macOS, which the sandbox may write.\n */\nexport function createProjectedGitConfig(\n\tidentity: HostGitIdentity,\n\toptions?: {\n\t\t/**\n\t\t * A `credential.helper` value for the child. It names the supervisor-mediated\n\t\t * helper, never a host one: the point is that the child asks over the channel\n\t\t * rather than reading any store itself.\n\t\t */\n\t\tcredentialHelper?: string;\n\t},\n): ProjectedGitConfig {\n\tconst directory = mkdtempSync(join(supervisorTempDirectory(), `apex-git-${process.pid}-`), { encoding: \"utf8\" });\n\tchmodSync(directory, 0o700);\n\tconst path = join(directory, \"config\");\n\tconst sections = [`[user]\\n\\tname = ${quote(identity.name)}\\n\\temail = ${quote(identity.email)}\\n`];\n\tif (options?.credentialHelper) {\n\t\tsections.push(`[credential]\\n\\thelper = ${quote(options.credentialHelper)}\\n`);\n\t}\n\twriteFileSync(path, sections.join(\"\"), { mode: 0o600 });\n\treturn { directory, path };\n}\n"]}

package/dist/core/sandbox/git-identity.js

@@ -0,0 +1,78 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { supervisorTempDirectory } from "./supervisor-temp.js";
+/** Long enough for a cold `git` on a slow disk, short enough not to stall every launch. */
+const RESOLUTION_TIMEOUT_MILLISECONDS = 2_000;
+/**
+ * Read the host's git identity before the sandbox exists to hide it.
+ *
+ * `--global` rather than a plain lookup, because the scope flag is what excludes the
+ * workspace's own `.git/config` by construction rather than by choosing a lucky working
+ * directory. A repository must not be able to decide what the supervisor projects, the
+ * same rule ADR 0016 applies to the network allowlist. Repository scope still works
+ * normally inside the child: the workspace is bind-mounted read-write, so git reads
+ * `.git/config` there itself and it wins over this projection, exactly as it would on the
+ * host.
+ *
+ * System scope (`/etc/gitconfig`) is deliberately not consulted. A machine-wide commit
+ * identity is not a real configuration, and a second `spawnSync` to find one would cost
+ * every launch what it saves nobody.
+ *
+ * Returns undefined unless both keys are present. A name without an email still fails to
+ * author a commit, so projecting half an identity would replace one confusing error with
+ * another.
+ */
+export function resolveHostGitIdentity(options) {
+    const result = spawnSync("git", ["config", "--global", "--get-regexp", "^user\\.(name|email)$"], {
+        cwd: options?.cwd,
+        encoding: "utf8",
+        env: options?.environment ?? process.env,
+        timeout: RESOLUTION_TIMEOUT_MILLISECONDS,
+    });
+    if (result.status !== 0 || typeof result.stdout !== "string")
+        return undefined;
+    let name;
+    let email;
+    for (const line of result.stdout.split("\n")) {
+        const separator = line.indexOf(" ");
+        if (separator < 0)
+            continue;
+        const value = line.slice(separator + 1).trim();
+        if (value.length === 0)
+            continue;
+        if (line.slice(0, separator) === "user.name")
+            name = value;
+        if (line.slice(0, separator) === "user.email")
+            email = value;
+    }
+    return name && email ? { name, email } : undefined;
+}
+/** Escape a value for git's config syntax, which reads a quoted string with backslash escapes. */
+function quote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/**
+ * Write a two-key config the child can be pointed at through `GIT_CONFIG_GLOBAL`.
+ *
+ * Synthesized rather than copied. A real `~/.gitconfig` can carry a `credential.helper`
+ * that runs a command, or an `insteadOf` rule rewriting a remote to one carrying a token;
+ * projecting the host file would hand both to the child along with the name we wanted.
+ * Building the file from a resolved identity means it cannot contain anything else.
+ *
+ * The directory is its own, not shared with the credential projection, and `0700` for the
+ * same reason `resolveCredentialChannelPaths` uses one. TMPDIR is deliberately not
+ * honoured: it can point inside the workspace on macOS, which the sandbox may write.
+ */
+export function createProjectedGitConfig(identity, options) {
+    const directory = mkdtempSync(join(supervisorTempDirectory(), `apex-git-${process.pid}-`), { encoding: "utf8" });
+    chmodSync(directory, 0o700);
+    const path = join(directory, "config");
+    const sections = [`[user]\n\tname = ${quote(identity.name)}\n\temail = ${quote(identity.email)}\n`];
+    if (options?.credentialHelper) {
+        sections.push(`[credential]\n\thelper = ${quote(options.credentialHelper)}\n`);
+    }
+    writeFileSync(path, sections.join(""), { mode: 0o600 });
+    return { directory, path };
+}
+//# sourceMappingURL=git-identity.js.map

package/dist/core/sandbox/git-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../../../src/core/sandbox/git-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAY/D,2FAA2F;AAC3F,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAQtC,EAA+B;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,uBAAuB,CAAC,EAAE;QAChG,GAAG,EAAE,OAAO,EAAE,GAAG;QACjB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG;QACxC,OAAO,EAAE,+BAA+B;KACxC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE/E,IAAI,IAAwB,CAAC;IAC7B,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,WAAW;YAAE,IAAI,GAAG,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,YAAY;YAAE,KAAK,GAAG,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACnD;AAED,kGAAkG;AAClG,SAAS,KAAK,CAAC,KAAa,EAAU;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAAA,CAChE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACvC,QAAyB,EACzB,OAOC,EACoB;IACrB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,YAAY,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACjH,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,oBAAoB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpG,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,4BAA4B,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAAA,CAC3B","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { chmodSync, mkdtempSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { supervisorTempDirectory } from \"./supervisor-temp.ts\";\n\nexport interface HostGitIdentity {\n\treadonly name: string;\n\treadonly email: string;\n}\n\nexport interface ProjectedGitConfig {\n\treadonly directory: string;\n\treadonly path: string;\n}\n\n/** Long enough for a cold `git` on a slow disk, short enough not to stall every launch. */\nconst RESOLUTION_TIMEOUT_MILLISECONDS = 2_000;\n\n/**\n * Read the host's git identity before the sandbox exists to hide it.\n *\n * `--global` rather than a plain lookup, because the scope flag is what excludes the\n * workspace's own `.git/config` by construction rather than by choosing a lucky working\n * directory. A repository must not be able to decide what the supervisor projects, the\n * same rule ADR 0016 applies to the network allowlist. Repository scope still works\n * normally inside the child: the workspace is bind-mounted read-write, so git reads\n * `.git/config` there itself and it wins over this projection, exactly as it would on the\n * host.\n *\n * System scope (`/etc/gitconfig`) is deliberately not consulted. A machine-wide commit\n * identity is not a real configuration, and a second `spawnSync` to find one would cost\n * every launch what it saves nobody.\n *\n * Returns undefined unless both keys are present. A name without an email still fails to\n * author a commit, so projecting half an identity would replace one confusing error with\n * another.\n */\nexport function resolveHostGitIdentity(options?: {\n\t/** Injectable only for tests; production uses the supervisor's own environment. */\n\tenvironment?: NodeJS.ProcessEnv;\n\t/**\n\t * Injectable only for tests, so one can prove repository scope stays excluded even\n\t * when the lookup runs from inside a repository.\n\t */\n\tcwd?: string;\n}): HostGitIdentity | undefined {\n\tconst result = spawnSync(\"git\", [\"config\", \"--global\", \"--get-regexp\", \"^user\\\\.(name|email)$\"], {\n\t\tcwd: options?.cwd,\n\t\tencoding: \"utf8\",\n\t\tenv: options?.environment ?? process.env,\n\t\ttimeout: RESOLUTION_TIMEOUT_MILLISECONDS,\n\t});\n\tif (result.status !== 0 || typeof result.stdout !== \"string\") return undefined;\n\n\tlet name: string | undefined;\n\tlet email: string | undefined;\n\tfor (const line of result.stdout.split(\"\\n\")) {\n\t\tconst separator = line.indexOf(\" \");\n\t\tif (separator < 0) continue;\n\t\tconst value = line.slice(separator + 1).trim();\n\t\tif (value.length === 0) continue;\n\t\tif (line.slice(0, separator) === \"user.name\") name = value;\n\t\tif (line.slice(0, separator) === \"user.email\") email = value;\n\t}\n\treturn name && email ? { name, email } : undefined;\n}\n\n/** Escape a value for git's config syntax, which reads a quoted string with backslash escapes. */\nfunction quote(value: string): string {\n\treturn `\"${value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"')}\"`;\n}\n\n/**\n * Write a two-key config the child can be pointed at through `GIT_CONFIG_GLOBAL`.\n *\n * Synthesized rather than copied. A real `~/.gitconfig` can carry a `credential.helper`\n * that runs a command, or an `insteadOf` rule rewriting a remote to one carrying a token;\n * projecting the host file would hand both to the child along with the name we wanted.\n * Building the file from a resolved identity means it cannot contain anything else.\n *\n * The directory is its own, not shared with the credential projection, and `0700` for the\n * same reason `resolveCredentialChannelPaths` uses one. TMPDIR is deliberately not\n * honoured: it can point inside the workspace on macOS, which the sandbox may write.\n */\nexport function createProjectedGitConfig(\n\tidentity: HostGitIdentity,\n\toptions?: {\n\t\t/**\n\t\t * A `credential.helper` value for the child. It names the supervisor-mediated\n\t\t * helper, never a host one: the point is that the child asks over the channel\n\t\t * rather than reading any store itself.\n\t\t */\n\t\tcredentialHelper?: string;\n\t},\n): ProjectedGitConfig {\n\tconst directory = mkdtempSync(join(supervisorTempDirectory(), `apex-git-${process.pid}-`), { encoding: \"utf8\" });\n\tchmodSync(directory, 0o700);\n\tconst path = join(directory, \"config\");\n\tconst sections = [`[user]\\n\\tname = ${quote(identity.name)}\\n\\temail = ${quote(identity.email)}\\n`];\n\tif (options?.credentialHelper) {\n\t\tsections.push(`[credential]\\n\\thelper = ${quote(options.credentialHelper)}\\n`);\n\t}\n\twriteFileSync(path, sections.join(\"\"), { mode: 0o600 });\n\treturn { directory, path };\n}\n"]}

package/dist/core/sandbox/host-approval.d.ts

@@ -0,0 +1,42 @@
+import type { TerminalHandoff } from "./terminal-handoff.ts";
+/**
+ * The supervisor's own approval prompt for one refused host.
+ *
+ * ADR 0023 puts the decision here rather than in the child. An approval asserted from
+ * inside the boundary is indistinguishable, at the supervisor, from one forged by a
+ * postinstall script or a git hook -- the code the boundary exists to contain -- so the
+ * human's answer is read by the side that owns the decision, on a terminal borrowed back
+ * from the child for the duration.
+ *
+ * Returning undefined when there is no terminal is the mechanism, not a fallback. The
+ * proxy's own deny-without-asking path then runs unchanged, so ADR 0005's headless, print,
+ * JSON, and RPC behaviour holds by construction rather than by a mode check that a later
+ * change could forget to make.
+ */
+export interface TerminalPromptOptions {
+    handoff: TerminalHandoff;
+    input?: NodeJS.ReadStream;
+    output?: NodeJS.WriteStream;
+}
+/** Approve one refused host for the rest of the session. */
+export declare function createHostApprover(options: TerminalPromptOptions): ((hostname: string, port: number) => Promise<boolean>) | undefined;
+/**
+ * Release the host's own git credential for one host, for the rest of the session.
+ *
+ * Separate from the host approval above even though both are yes/no, because they are
+ * different grants and conflating them would let approving a push also release a token to
+ * everything else the session later contacts.
+ */
+export declare function createCredentialReleaser(options: TerminalPromptOptions): ((host: string) => Promise<boolean>) | undefined;
+/**
+ * Approve one command to run in a separate child with one extra writable root.
+ *
+ * Unlike a host or a credential, nothing is remembered. A command is not a stable subject
+ * to grant against, and a remembered approval would silently cover the next command that
+ * happened to name the same root.
+ */
+export declare function createCommandEscalationApprover(options: TerminalPromptOptions): ((request: {
+    command: string;
+    writableRoot: string;
+}) => Promise<boolean>) | undefined;
+//# sourceMappingURL=host-approval.d.ts.map

package/dist/core/sandbox/host-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-approval.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/host-approval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;CAC5B;AAyDD,4DAA4D;AAC5D,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,qBAAqB,GAC5B,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAUpE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,qBAAqB,GAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CASlD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE,qBAAqB,GAC5B,CAAC,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAYxF","sourcesContent":["import type { TerminalHandoff } from \"./terminal-handoff.ts\";\n\n/**\n * The supervisor's own approval prompt for one refused host.\n *\n * ADR 0023 puts the decision here rather than in the child. An approval asserted from\n * inside the boundary is indistinguishable, at the supervisor, from one forged by a\n * postinstall script or a git hook -- the code the boundary exists to contain -- so the\n * human's answer is read by the side that owns the decision, on a terminal borrowed back\n * from the child for the duration.\n *\n * Returning undefined when there is no terminal is the mechanism, not a fallback. The\n * proxy's own deny-without-asking path then runs unchanged, so ADR 0005's headless, print,\n * JSON, and RPC behaviour holds by construction rather than by a mode check that a later\n * change could forget to make.\n */\nexport interface TerminalPromptOptions {\n\thandoff: TerminalHandoff;\n\tinput?: NodeJS.ReadStream;\n\toutput?: NodeJS.WriteStream;\n}\n\n/**\n * Build a yes/no prompt the supervisor owns, or nothing at all when there is no terminal.\n *\n * Both sandbox escalations ask the same shape of question and must fail closed the same\n * way, so they share one implementation. Returning undefined rather than a\n * function-that-says-no is deliberate: the caller's own refuse path then runs untouched,\n * which is how ADR 0005's headless behaviour stays correct without a mode check.\n */\nfunction createTerminalPrompt(\n\toptions: TerminalPromptOptions,\n\tcompose: (subject: string) => { question: string; granted: string; refused: string },\n): ((subject: string) => Promise<boolean>) | undefined {\n\tconst input = options.input ?? process.stdin;\n\tconst output = options.output ?? process.stdout;\n\tif (!input.isTTY || !output.isTTY) return undefined;\n\n\tfunction readAnswer(): Promise<string> {\n\t\treturn new Promise((resolve) => {\n\t\t\tlet buffer = \"\";\n\t\t\tconst finish = (value: string) => {\n\t\t\t\tinput.off(\"data\", onData);\n\t\t\t\tinput.off(\"error\", onError);\n\t\t\t\tinput.off(\"end\", onEnd);\n\t\t\t\t// The child had stdin in raw mode and takes it back on resume, so the\n\t\t\t\t// supervisor leaves the stream paused rather than owning it past the answer.\n\t\t\t\tinput.pause();\n\t\t\t\tresolve(value);\n\t\t\t};\n\t\t\tconst onData = (chunk: Buffer | string) => {\n\t\t\t\tbuffer += chunk.toString();\n\t\t\t\tconst newline = buffer.indexOf(\"\\n\");\n\t\t\t\tif (newline >= 0) finish(buffer.slice(0, newline));\n\t\t\t};\n\t\t\t// Anything unreadable declines. Treating an unanswerable prompt as consent would\n\t\t\t// hand the grant to whatever broke the terminal.\n\t\t\tconst onError = () => finish(\"\");\n\t\t\tconst onEnd = () => finish(buffer);\n\t\t\tinput.on(\"data\", onData);\n\t\t\tinput.on(\"error\", onError);\n\t\t\tinput.on(\"end\", onEnd);\n\t\t\tinput.resume();\n\t\t});\n\t}\n\n\treturn (subject: string): Promise<boolean> =>\n\t\toptions.handoff.borrowTerminal(async () => {\n\t\t\tconst text = compose(subject);\n\t\t\toutput.write(`\\n${text.question}`);\n\t\t\tconst answer = (await readAnswer()).trim().toLowerCase();\n\t\t\tconst approved = answer === \"y\" || answer === \"yes\";\n\t\t\toutput.write(`${approved ? text.granted : text.refused}\\n\\n`);\n\t\t\treturn approved;\n\t\t});\n}\n\n/** Approve one refused host for the rest of the session. */\nexport function createHostApprover(\n\toptions: TerminalPromptOptions,\n): ((hostname: string, port: number) => Promise<boolean>) | undefined {\n\tconst prompt = createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked to reach ${subject}, which is not on the network allowlist.\\n` +\n\t\t\t`Allow it for this session only? [y/N] `,\n\t\tgranted: `Allowed ${subject} for this session. Add it to \"network.allowedHosts\" in your global settings to make it permanent.`,\n\t\trefused: `Refused ${subject}.`,\n\t}));\n\tif (!prompt) return undefined;\n\treturn (hostname: string, port: number) => prompt(`${hostname}:${port}`);\n}\n\n/**\n * Release the host's own git credential for one host, for the rest of the session.\n *\n * Separate from the host approval above even though both are yes/no, because they are\n * different grants and conflating them would let approving a push also release a token to\n * everything else the session later contacts.\n */\nexport function createCredentialReleaser(\n\toptions: TerminalPromptOptions,\n): ((host: string) => Promise<boolean>) | undefined {\n\treturn createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked for your git credential for ${subject}.\\n` +\n\t\t\t`It is read from your host credential store and never written into the workspace.\\n` +\n\t\t\t`Release it for this session only? [y/N] `,\n\t\tgranted: `Released the ${subject} credential for this session.`,\n\t\trefused: `Refused the ${subject} credential.`,\n\t}));\n}\n\n/**\n * Approve one command to run in a separate child with one extra writable root.\n *\n * Unlike a host or a credential, nothing is remembered. A command is not a stable subject\n * to grant against, and a remembered approval would silently cover the next command that\n * happened to name the same root.\n */\nexport function createCommandEscalationApprover(\n\toptions: TerminalPromptOptions,\n): ((request: { command: string; writableRoot: string }) => Promise<boolean>) | undefined {\n\tconst prompt = createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked to run a command with write access outside its workspace.\\n\\n` +\n\t\t\t`  ${subject}\\n\\n` +\n\t\t\t`It runs once, in a separate sandbox. The session's own boundary does not change.\\n` +\n\t\t\t`Allow it? [y/N] `,\n\t\tgranted: \"Ran the command once with that root writable.\",\n\t\trefused: \"Refused.\",\n\t}));\n\tif (!prompt) return undefined;\n\treturn (request) => prompt(`${request.command}\\n  (writable: ${request.writableRoot})`);\n}\n"]}

package/dist/core/sandbox/host-approval.js

@@ -0,0 +1,99 @@
+/**
+ * Build a yes/no prompt the supervisor owns, or nothing at all when there is no terminal.
+ *
+ * Both sandbox escalations ask the same shape of question and must fail closed the same
+ * way, so they share one implementation. Returning undefined rather than a
+ * function-that-says-no is deliberate: the caller's own refuse path then runs untouched,
+ * which is how ADR 0005's headless behaviour stays correct without a mode check.
+ */
+function createTerminalPrompt(options, compose) {
+    const input = options.input ?? process.stdin;
+    const output = options.output ?? process.stdout;
+    if (!input.isTTY || !output.isTTY)
+        return undefined;
+    function readAnswer() {
+        return new Promise((resolve) => {
+            let buffer = "";
+            const finish = (value) => {
+                input.off("data", onData);
+                input.off("error", onError);
+                input.off("end", onEnd);
+                // The child had stdin in raw mode and takes it back on resume, so the
+                // supervisor leaves the stream paused rather than owning it past the answer.
+                input.pause();
+                resolve(value);
+            };
+            const onData = (chunk) => {
+                buffer += chunk.toString();
+                const newline = buffer.indexOf("\n");
+                if (newline >= 0)
+                    finish(buffer.slice(0, newline));
+            };
+            // Anything unreadable declines. Treating an unanswerable prompt as consent would
+            // hand the grant to whatever broke the terminal.
+            const onError = () => finish("");
+            const onEnd = () => finish(buffer);
+            input.on("data", onData);
+            input.on("error", onError);
+            input.on("end", onEnd);
+            input.resume();
+        });
+    }
+    return (subject) => options.handoff.borrowTerminal(async () => {
+        const text = compose(subject);
+        output.write(`\n${text.question}`);
+        const answer = (await readAnswer()).trim().toLowerCase();
+        const approved = answer === "y" || answer === "yes";
+        output.write(`${approved ? text.granted : text.refused}\n\n`);
+        return approved;
+    });
+}
+/** Approve one refused host for the rest of the session. */
+export function createHostApprover(options) {
+    const prompt = createTerminalPrompt(options, (subject) => ({
+        question: `The sandboxed session asked to reach ${subject}, which is not on the network allowlist.\n` +
+            `Allow it for this session only? [y/N] `,
+        granted: `Allowed ${subject} for this session. Add it to "network.allowedHosts" in your global settings to make it permanent.`,
+        refused: `Refused ${subject}.`,
+    }));
+    if (!prompt)
+        return undefined;
+    return (hostname, port) => prompt(`${hostname}:${port}`);
+}
+/**
+ * Release the host's own git credential for one host, for the rest of the session.
+ *
+ * Separate from the host approval above even though both are yes/no, because they are
+ * different grants and conflating them would let approving a push also release a token to
+ * everything else the session later contacts.
+ */
+export function createCredentialReleaser(options) {
+    return createTerminalPrompt(options, (subject) => ({
+        question: `The sandboxed session asked for your git credential for ${subject}.\n` +
+            `It is read from your host credential store and never written into the workspace.\n` +
+            `Release it for this session only? [y/N] `,
+        granted: `Released the ${subject} credential for this session.`,
+        refused: `Refused the ${subject} credential.`,
+    }));
+}
+/**
+ * Approve one command to run in a separate child with one extra writable root.
+ *
+ * Unlike a host or a credential, nothing is remembered. A command is not a stable subject
+ * to grant against, and a remembered approval would silently cover the next command that
+ * happened to name the same root.
+ */
+export function createCommandEscalationApprover(options) {
+    const prompt = createTerminalPrompt(options, (subject) => ({
+        question: `The sandboxed session asked to run a command with write access outside its workspace.\n\n` +
+            `  ${subject}\n\n` +
+            `It runs once, in a separate sandbox. The session's own boundary does not change.\n` +
+            `Allow it? [y/N] `,
+        granted: "Ran the command once with that root writable.",
+        refused: "Refused.",
+    }));
+    if (!prompt)
+        return undefined;
+    return (request) => prompt(`${request.command}\n  (writable: ${request.writableRoot})`);
+}
+//# sourceMappingURL=host-approval.js.map

package/dist/core/sandbox/host-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-approval.js","sourceRoot":"","sources":["../../../src/core/sandbox/host-approval.ts"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC5B,OAA8B,EAC9B,OAAoF,EAC9B;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEpD,SAAS,UAAU,GAAoB;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACxB,sEAAsE;gBACtE,6EAA6E;gBAC7E,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC;YAAA,CACf,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,OAAO,IAAI,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAAA,CACnD,CAAC;YACF,iFAAiF;YACjF,iDAAiD;YACjD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QAAA,CACf,CAAC,CAAC;IAAA,CACH;IAED,OAAO,CAAC,OAAe,EAAoB,EAAE,CAC5C,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAAA,CAChB,CAAC,CAAC;AAAA,CACJ;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CACjC,OAA8B,EACuC;IACrE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,EACP,wCAAwC,OAAO,4CAA4C;YAC3F,wCAAwC;QACzC,OAAO,EAAE,WAAW,OAAO,mGAAmG;QAC9H,OAAO,EAAE,WAAW,OAAO,GAAG;KAC9B,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;AAAA,CACzE;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACvC,OAA8B,EACqB;IACnD,OAAO,oBAAoB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClD,QAAQ,EACP,2DAA2D,OAAO,KAAK;YACvE,oFAAoF;YACpF,0CAA0C;QAC3C,OAAO,EAAE,gBAAgB,OAAO,+BAA+B;QAC/D,OAAO,EAAE,eAAe,OAAO,cAAc;KAC7C,CAAC,CAAC,CAAC;AAAA,CACJ;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC9C,OAA8B,EAC2D;IACzF,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,EACP,2FAA2F;YAC3F,KAAK,OAAO,MAAM;YAClB,oFAAoF;YACpF,kBAAkB;QACnB,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,UAAU;KACnB,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,kBAAkB,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;AAAA,CACxF","sourcesContent":["import type { TerminalHandoff } from \"./terminal-handoff.ts\";\n\n/**\n * The supervisor's own approval prompt for one refused host.\n *\n * ADR 0023 puts the decision here rather than in the child. An approval asserted from\n * inside the boundary is indistinguishable, at the supervisor, from one forged by a\n * postinstall script or a git hook -- the code the boundary exists to contain -- so the\n * human's answer is read by the side that owns the decision, on a terminal borrowed back\n * from the child for the duration.\n *\n * Returning undefined when there is no terminal is the mechanism, not a fallback. The\n * proxy's own deny-without-asking path then runs unchanged, so ADR 0005's headless, print,\n * JSON, and RPC behaviour holds by construction rather than by a mode check that a later\n * change could forget to make.\n */\nexport interface TerminalPromptOptions {\n\thandoff: TerminalHandoff;\n\tinput?: NodeJS.ReadStream;\n\toutput?: NodeJS.WriteStream;\n}\n\n/**\n * Build a yes/no prompt the supervisor owns, or nothing at all when there is no terminal.\n *\n * Both sandbox escalations ask the same shape of question and must fail closed the same\n * way, so they share one implementation. Returning undefined rather than a\n * function-that-says-no is deliberate: the caller's own refuse path then runs untouched,\n * which is how ADR 0005's headless behaviour stays correct without a mode check.\n */\nfunction createTerminalPrompt(\n\toptions: TerminalPromptOptions,\n\tcompose: (subject: string) => { question: string; granted: string; refused: string },\n): ((subject: string) => Promise<boolean>) | undefined {\n\tconst input = options.input ?? process.stdin;\n\tconst output = options.output ?? process.stdout;\n\tif (!input.isTTY || !output.isTTY) return undefined;\n\n\tfunction readAnswer(): Promise<string> {\n\t\treturn new Promise((resolve) => {\n\t\t\tlet buffer = \"\";\n\t\t\tconst finish = (value: string) => {\n\t\t\t\tinput.off(\"data\", onData);\n\t\t\t\tinput.off(\"error\", onError);\n\t\t\t\tinput.off(\"end\", onEnd);\n\t\t\t\t// The child had stdin in raw mode and takes it back on resume, so the\n\t\t\t\t// supervisor leaves the stream paused rather than owning it past the answer.\n\t\t\t\tinput.pause();\n\t\t\t\tresolve(value);\n\t\t\t};\n\t\t\tconst onData = (chunk: Buffer | string) => {\n\t\t\t\tbuffer += chunk.toString();\n\t\t\t\tconst newline = buffer.indexOf(\"\\n\");\n\t\t\t\tif (newline >= 0) finish(buffer.slice(0, newline));\n\t\t\t};\n\t\t\t// Anything unreadable declines. Treating an unanswerable prompt as consent would\n\t\t\t// hand the grant to whatever broke the terminal.\n\t\t\tconst onError = () => finish(\"\");\n\t\t\tconst onEnd = () => finish(buffer);\n\t\t\tinput.on(\"data\", onData);\n\t\t\tinput.on(\"error\", onError);\n\t\t\tinput.on(\"end\", onEnd);\n\t\t\tinput.resume();\n\t\t});\n\t}\n\n\treturn (subject: string): Promise<boolean> =>\n\t\toptions.handoff.borrowTerminal(async () => {\n\t\t\tconst text = compose(subject);\n\t\t\toutput.write(`\\n${text.question}`);\n\t\t\tconst answer = (await readAnswer()).trim().toLowerCase();\n\t\t\tconst approved = answer === \"y\" || answer === \"yes\";\n\t\t\toutput.write(`${approved ? text.granted : text.refused}\\n\\n`);\n\t\t\treturn approved;\n\t\t});\n}\n\n/** Approve one refused host for the rest of the session. */\nexport function createHostApprover(\n\toptions: TerminalPromptOptions,\n): ((hostname: string, port: number) => Promise<boolean>) | undefined {\n\tconst prompt = createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked to reach ${subject}, which is not on the network allowlist.\\n` +\n\t\t\t`Allow it for this session only? [y/N] `,\n\t\tgranted: `Allowed ${subject} for this session. Add it to \"network.allowedHosts\" in your global settings to make it permanent.`,\n\t\trefused: `Refused ${subject}.`,\n\t}));\n\tif (!prompt) return undefined;\n\treturn (hostname: string, port: number) => prompt(`${hostname}:${port}`);\n}\n\n/**\n * Release the host's own git credential for one host, for the rest of the session.\n *\n * Separate from the host approval above even though both are yes/no, because they are\n * different grants and conflating them would let approving a push also release a token to\n * everything else the session later contacts.\n */\nexport function createCredentialReleaser(\n\toptions: TerminalPromptOptions,\n): ((host: string) => Promise<boolean>) | undefined {\n\treturn createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked for your git credential for ${subject}.\\n` +\n\t\t\t`It is read from your host credential store and never written into the workspace.\\n` +\n\t\t\t`Release it for this session only? [y/N] `,\n\t\tgranted: `Released the ${subject} credential for this session.`,\n\t\trefused: `Refused the ${subject} credential.`,\n\t}));\n}\n\n/**\n * Approve one command to run in a separate child with one extra writable root.\n *\n * Unlike a host or a credential, nothing is remembered. A command is not a stable subject\n * to grant against, and a remembered approval would silently cover the next command that\n * happened to name the same root.\n */\nexport function createCommandEscalationApprover(\n\toptions: TerminalPromptOptions,\n): ((request: { command: string; writableRoot: string }) => Promise<boolean>) | undefined {\n\tconst prompt = createTerminalPrompt(options, (subject) => ({\n\t\tquestion:\n\t\t\t`The sandboxed session asked to run a command with write access outside its workspace.\\n\\n` +\n\t\t\t`  ${subject}\\n\\n` +\n\t\t\t`It runs once, in a separate sandbox. The session's own boundary does not change.\\n` +\n\t\t\t`Allow it? [y/N] `,\n\t\tgranted: \"Ran the command once with that root writable.\",\n\t\trefused: \"Refused.\",\n\t}));\n\tif (!prompt) return undefined;\n\treturn (request) => prompt(`${request.command}\\n  (writable: ${request.writableRoot})`);\n}\n"]}

package/dist/core/sandbox/linux-backend.d.ts

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { type CommandEscalationRequest } from "./rpc/command-proxy.ts";
+import { fillHostGitCredential } from "./rpc/git-credential-helper.ts";
 import type { SandboxBackend } from "./supervisor.ts";
 import type { SandboxViolationStore } from "./violations.ts";
 export interface LinuxSandboxBackendOptions {
@@ -8,6 +10,18 @@ export interface LinuxSandboxBackendOptions {
     violationStore?: SandboxViolationStore;
     /** Injectable only to prove crash cleanup in tests; production spawns `bwrap` directly. */
     spawnChild?: typeof spawn;
+    /**
+     * Injectable only for tests, which have no terminal and would otherwise be unable to
+     * exercise a released credential at all. Production builds the releaser from the
+     * terminal handoff, and its absence there is what makes a headless session refuse.
+     */
+    requestGitCredentialRelease?: (host: string) => Promise<boolean>;
+    /** Injectable only for tests; production resolves against the real host store. */
+    fillGitCredential?: typeof fillHostGitCredential;
+    /** Injectable only for tests, which have no terminal to approve an escalation at. */
+    requestCommandEscalation?: (request: CommandEscalationRequest) => Promise<boolean>;
+    /** Retained for source compatibility; launch state is now required on each launch. */
+    supervisorStateDirectory?: string;
 }
 /**
  * Where the supervisor's proxy socket lives on each side of the boundary.

package/dist/core/sandbox/linux-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linux-backend.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/linux-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAa,MAAM,oBAAoB,CAAC;AAMtD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,iBAAiB,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAK7D,MAAM,WAAW,0BAA0B;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2FAA2F;IAC3F,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,kBAAkB,GAAE,MAAiB,GAAG;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACxB,CAKA;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,cAAc,CA4L9F","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { randomBytes } from \"node:crypto\";\nimport { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport { publishTerminalSize, TERMINAL_SIZE_PATH_VARIABLE } from \"./terminal-size.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\n/** AF_UNIX `sun_path` is 108 bytes on Linux, including the terminating NUL. */\nconst SUN_PATH_LIMIT = 108;\n\nexport interface LinuxSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/** Injectable only to prove crash cleanup in tests; production spawns `bwrap` directly. */\n\tspawnChild?: typeof spawn;\n}\n\nfunction commandExists(command: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], { stdio: \"ignore\", timeout: 1_000 });\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\nfunction readOnlyMountArguments(path: string, kind: \"directory\" | \"file\" = \"directory\", descriptor = 3): string[] {\n\tconst target = resolve(path);\n\tconst directory = dirname(target);\n\tconst ancestors: string[] = [];\n\tlet current = directory;\n\twhile (current !== \"/\" && current !== \"/home\") {\n\t\tancestors.push(current);\n\t\tcurrent = dirname(current);\n\t}\n\tconst parentArguments = ancestors.reverse().flatMap((ancestor) => [\"--dir\", ancestor]);\n\treturn kind === \"file\"\n\t\t? [...parentArguments, \"--tmpfs\", directory, \"--perms\", \"0400\", \"--file\", String(descriptor), target]\n\t\t: [...parentArguments, \"--ro-bind\", directory, directory];\n}\n\n/**\n * Where the supervisor's proxy socket lives on each side of the boundary.\n *\n * AF_UNIX caps `sun_path` at 108 bytes, so the socket cannot live under the workspace:\n * a deep-but-ordinary project directory exhausts that budget and the sandbox fails to\n * start at all with `listen EINVAL`. The host side therefore gets a short, unique path\n * under the system temp directory, and it is bind-mounted into the child.\n *\n * The child-side path has to sit under `/home`. That is the one writable mount at the\n * point the mountpoint is created — the sandbox root is a read-only bind, so bwrap\n * cannot create a mountpoint at `/run`, `/tmp`, or anywhere else on it.\n */\nexport function resolveProxySocketPaths(temporaryDirectory: string = tmpdir()): {\n\thostSocketPath: string;\n\tchildSocketPath: string;\n} {\n\tconst name = `apex-${process.pid}-${randomBytes(4).toString(\"hex\")}.sock`;\n\t// An unusually long TMPDIR would reintroduce the very limit this avoids.\n\tconst base = join(temporaryDirectory, name).length + 1 > SUN_PATH_LIMIT ? \"/tmp\" : temporaryDirectory;\n\treturn { hostSocketPath: join(base, name), childSocketPath: `/home/${name}` };\n}\n\n/**\n * Classify an unsuccessful child from what its stderr actually evidences, or return\n * undefined when nothing suggests the boundary refused anything.\n *\n * A non-zero exit is not a violation. An invalid API key, a failing test command, or a\n * script exiting 1 are the child's own business, and recording them as sandbox\n * violations blames the boundary for failures it had no part in — which is worse than\n * silence, because it sends whoever reads the output looking for a refusal that never\n * happened. Only Linux's own refusal wording earns a violation here; the proxy records\n * network refusals itself, before this fallback is consulted.\n */\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | undefined {\n\tif (/Read-only file system|Permission denied|Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (/Network is unreachable|ENETUNREACH|EHOSTUNREACH/i.test(stderr)) return \"network\";\n\treturn undefined;\n}\n\n/**\n * Linux's deliberately small platform adapter. The sandbox starts from a read-only\n * host root and bind-mounts only the canonical workspace as writable. `--unshare-net`\n * removes all direct network interfaces for the child and every descendant.\n */\nexport function createLinuxSandboxBackend(options?: LinuxSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"linux\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on Linux only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"Linux sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? commandExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\n\tif (!hasCommand(\"bwrap\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"Bubblewrap (bwrap) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"Linux sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\tconst stateDirectory = join(launch.policy.workspace, \".apex-code\", \"sandbox-state\");\n\t\t\tmkdirSync(stateDirectory, { recursive: true });\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\tconst { hostSocketPath, childSocketPath } = resolveProxySocketPaths();\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\tsocketPath: hostSocketPath,\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t});\n\n\t\t\t// .cjs forces CommonJS regardless of the target workspace's package.json \"type\"\n\t\t\t// field -- a plain .js here would be parsed as ESM under \"type\": \"module\" and\n\t\t\t// crash on `require`, since Node resolves module type from the nearest package.json.\n\t\t\tconst relayScriptPath = join(stateDirectory, \"relay.cjs\");\n\t\t\twriteFileSync(\n\t\t\t\trelayScriptPath,\n\t\t\t\t`\nconst net = require(\"node:net\");\nconst child_process = require(\"node:child_process\");\n\nconst socketPath = process.env.APEX_UDS_PATH;\nconst server = net.createServer((c) => {\n\tconst client = net.connect(socketPath);\n\tc.pipe(client).pipe(c);\n\tc.on(\"error\", () => {});\n\tclient.on(\"error\", () => {});\n});\n\nserver.listen(0, \"127.0.0.1\", () => {\n\tconst port = server.address().port;\n\tconst env = Object.assign({}, process.env, {\n\t\tHTTP_PROXY: \\`http://127.0.0.1:\\${port}\\`,\n\t\tHTTPS_PROXY: \\`http://127.0.0.1:\\${port}\\`\n\t});\n\tconst args = process.argv.slice(2);\n\tconst child = child_process.spawn(args[0], args.slice(1), {\n\t\tstdio: \"inherit\",\n\t\tenv: env,\n\t});\n\tchild.on(\"exit\", (code, signal) => {\n\t\tprocess.exit(code ?? (signal ? 128 : 1));\n\t});\n});\nserver.on(\"error\", (err) => {\n\tconsole.error(\"Relay error:\", err);\n\tprocess.exit(1);\n});\n`.trim(),\n\t\t\t);\n\n\t\t\tconst readOnlyMounts = [process.execPath, launch.command, ...(launch.readOnlyPaths ?? [])].flatMap((path) =>\n\t\t\t\treadOnlyMountArguments(path),\n\t\t\t);\n\t\t\tconst readOnlyFileMounts = (launch.readOnlyFiles ?? []).flatMap((path, index) =>\n\t\t\t\treadOnlyMountArguments(path, \"file\", index + 3),\n\t\t\t);\n\t\t\tconst readOnlyFileDescriptors = (launch.readOnlyFiles ?? []).map((path) => openSync(path, \"r\"));\n\t\t\t// The descriptors above are opened before the child spawns and must be closed\n\t\t\t// on every exit path -- including a spawn/wait rejection -- or a crashed launch\n\t\t\t// leaks an open handle onto a host-owned credential file for the process's life.\n\t\t\t// The workspace is bind-mounted read-write into the sandbox, so a file\n\t\t\t// here is visible at the same absolute path on both sides of it.\n\t\t\tconst terminalSizePath = join(stateDirectory, \"terminal-size\");\n\t\t\tconst stopPublishingTerminalSize = publishTerminalSize(terminalSizePath);\n\t\t\ttry {\n\t\t\t\tconst spawnBwrap = options?.spawnChild ?? spawn;\n\t\t\t\tconst child = spawnBwrap(\n\t\t\t\t\t\"bwrap\",\n\t\t\t\t\t[\n\t\t\t\t\t\t\"--new-session\",\n\t\t\t\t\t\t\"--die-with-parent\",\n\t\t\t\t\t\t\"--unshare-user\",\n\t\t\t\t\t\t\"--unshare-pid\",\n\t\t\t\t\t\t\"--unshare-net\",\n\t\t\t\t\t\t\"--ro-bind\",\n\t\t\t\t\t\t\"/\",\n\t\t\t\t\t\t\"/\",\n\t\t\t\t\t\t\"--tmpfs\",\n\t\t\t\t\t\t\"/home\",\n\t\t\t\t\t\t// Immediately after the /home tmpfs: that is the only writable mount at\n\t\t\t\t\t\t// this point, so it is the only place bwrap can create the mountpoint.\n\t\t\t\t\t\t\"--bind\",\n\t\t\t\t\t\thostSocketPath,\n\t\t\t\t\t\tchildSocketPath,\n\t\t\t\t\t\t// The credential channel socket: same writable-under-/home constraint\n\t\t\t\t\t\t// and same position as the network socket above. Its child-side path\n\t\t\t\t\t\t// is what `APEX_CREDENTIAL_PROXY_PATH` names in the launch environment.\n\t\t\t\t\t\t...(launch.credentialChannel\n\t\t\t\t\t\t\t? [\"--bind\", launch.credentialChannel.hostSocketPath, launch.credentialChannel.childSocketPath]\n\t\t\t\t\t\t\t: []),\n\t\t\t\t\t\t...readOnlyMounts,\n\t\t\t\t\t\t...readOnlyFileMounts,\n\t\t\t\t\t\t\"--bind\",\n\t\t\t\t\t\tlaunch.policy.workspace,\n\t\t\t\t\t\tlaunch.policy.workspace,\n\t\t\t\t\t\t// After the workspace bind: these destinations sit inside it, and an\n\t\t\t\t\t\t// earlier mount would be masked when the workspace is bound over them.\n\t\t\t\t\t\t...(launch.readOnlyBinaries ?? []).flatMap(({ source, destination }) => [\n\t\t\t\t\t\t\t\"--ro-bind\",\n\t\t\t\t\t\t\tsource,\n\t\t\t\t\t\t\tdestination,\n\t\t\t\t\t\t]),\n\t\t\t\t\t\t\"--dev\",\n\t\t\t\t\t\t\"/dev\",\n\t\t\t\t\t\t\"--proc\",\n\t\t\t\t\t\t\"/proc\",\n\t\t\t\t\t\t\"--chdir\",\n\t\t\t\t\t\tlaunch.policy.workspace,\n\t\t\t\t\t\t\"--setenv\",\n\t\t\t\t\t\t\"HOME\",\n\t\t\t\t\t\tlaunch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\t\"--setenv\",\n\t\t\t\t\t\t\"TMPDIR\",\n\t\t\t\t\t\tlaunch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\t\"--setenv\",\n\t\t\t\t\t\t\"APEX_UDS_PATH\",\n\t\t\t\t\t\tchildSocketPath,\n\t\t\t\t\t\t\"--setenv\",\n\t\t\t\t\t\tTERMINAL_SIZE_PATH_VARIABLE,\n\t\t\t\t\t\tterminalSizePath,\n\t\t\t\t\t\t\"--\",\n\t\t\t\t\t\tprocess.execPath,\n\t\t\t\t\t\trelayScriptPath,\n\t\t\t\t\t\tlaunch.command,\n\t\t\t\t\t\t...launch.args,\n\t\t\t\t\t],\n\t\t\t\t\t{ env: launch.environment, stdio: [\"inherit\", \"inherit\", \"pipe\", ...readOnlyFileDescriptors] },\n\t\t\t\t);\n\t\t\t\tlet stderr = \"\";\n\t\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\t\tstderr += chunk;\n\t\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t\t});\n\t\t\t\tconst exitCode = await waitForExit(child);\n\t\t\t\tawait proxy?.close();\n\t\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\t\tif (kind) {\n\t\t\t\t\tviolationStore?.add({\n\t\t\t\t\t\tkind,\n\t\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn exitCode;\n\t\t\t} finally {\n\t\t\t\tstopPublishingTerminalSize();\n\t\t\t\tfor (const descriptor of readOnlyFileDescriptors) closeSync(descriptor);\n\t\t\t\t// The socket now lives outside the workspace, so nothing else will ever clean\n\t\t\t\t// it up; leaving it would litter the temp directory once per launch.\n\t\t\t\trmSync(hostSocketPath, { force: true });\n\t\t\t}\n\t\t},\n\t\tasync close() {\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"linux-backend.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/linux-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAa,MAAM,oBAAoB,CAAC;AAQtD,OAAO,EAEN,KAAK,wBAAwB,EAI7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EAIrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,iBAAiB,CAAC;AAQrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAK7D,MAAM,WAAW,0BAA0B;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2FAA2F;IAC3F,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACjD,qFAAqF;IACrF,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,kBAAkB,GAAE,MAAiB,GAAG;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACxB,CAKA;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,cAAc,CA2N9F","sourcesContent":["import { spawn, spawnSync } from \"node:child_process\";\nimport { randomBytes } from \"node:crypto\";\nimport { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { buildBwrapArguments, descriptorBackedReadOnlyPaths } from \"./bwrap-arguments.ts\";\nimport { createCommandEscalationApprover, createCredentialReleaser, createHostApprover } from \"./host-approval.ts\";\nimport { createSandboxNetworkProxy, type SandboxNetworkProxy } from \"./network-proxy.ts\";\nimport {\n\tCOMMAND_ESCALATION_SOCKET_VARIABLE,\n\ttype CommandEscalationRequest,\n\ttype CommandEscalationResult,\n\tcreateCommandEscalationProxy,\n\tresolveCommandEscalationChannelPaths,\n} from \"./rpc/command-proxy.ts\";\nimport {\n\tfillHostGitCredential,\n\tGIT_CREDENTIAL_SOCKET_VARIABLE,\n\tresolveGitCredentialChannelPaths,\n\twriteGitCredentialHelper,\n} from \"./rpc/git-credential-helper.ts\";\nimport { createGitCredentialProxy, type GitCredentialProxy } from \"./rpc/git-credential-proxy.ts\";\nimport type { SandboxBackend, SandboxLaunch } from \"./supervisor.ts\";\nimport {\n\tcreateTerminalHandoff,\n\tTERMINAL_HANDOFF_ACK_PATH_VARIABLE,\n\tTERMINAL_HANDOFF_PATH_VARIABLE,\n\ttype TerminalHandoff,\n} from \"./terminal-handoff.ts\";\nimport { publishTerminalSize, TERMINAL_SIZE_PATH_VARIABLE } from \"./terminal-size.ts\";\nimport type { SandboxViolationStore } from \"./violations.ts\";\n\n/** AF_UNIX `sun_path` is 108 bytes on Linux, including the terminating NUL. */\nconst SUN_PATH_LIMIT = 108;\n\nexport interface LinuxSandboxBackendOptions {\n\t/** Injectable only for preflight tests; production uses the running platform. */\n\tplatform?: NodeJS.Platform;\n\tcommandExists?: (command: string) => boolean;\n\tviolationStore?: SandboxViolationStore;\n\t/** Injectable only to prove crash cleanup in tests; production spawns `bwrap` directly. */\n\tspawnChild?: typeof spawn;\n\t/**\n\t * Injectable only for tests, which have no terminal and would otherwise be unable to\n\t * exercise a released credential at all. Production builds the releaser from the\n\t * terminal handoff, and its absence there is what makes a headless session refuse.\n\t */\n\trequestGitCredentialRelease?: (host: string) => Promise<boolean>;\n\t/** Injectable only for tests; production resolves against the real host store. */\n\tfillGitCredential?: typeof fillHostGitCredential;\n\t/** Injectable only for tests, which have no terminal to approve an escalation at. */\n\trequestCommandEscalation?: (request: CommandEscalationRequest) => Promise<boolean>;\n\t/** Retained for source compatibility; launch state is now required on each launch. */\n\tsupervisorStateDirectory?: string;\n}\n\nfunction commandExists(command: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], { stdio: \"ignore\", timeout: 1_000 });\n\treturn result.status === 0;\n}\n\nfunction waitForExit(child: ReturnType<typeof spawn>): Promise<number> {\n\treturn new Promise((resolve, reject) => {\n\t\tchild.once(\"error\", reject);\n\t\tchild.once(\"exit\", (code) => resolve(code ?? 1));\n\t});\n}\n\n/**\n * Where the supervisor's proxy socket lives on each side of the boundary.\n *\n * AF_UNIX caps `sun_path` at 108 bytes, so the socket cannot live under the workspace:\n * a deep-but-ordinary project directory exhausts that budget and the sandbox fails to\n * start at all with `listen EINVAL`. The host side therefore gets a short, unique path\n * under the system temp directory, and it is bind-mounted into the child.\n *\n * The child-side path has to sit under `/home`. That is the one writable mount at the\n * point the mountpoint is created — the sandbox root is a read-only bind, so bwrap\n * cannot create a mountpoint at `/run`, `/tmp`, or anywhere else on it.\n */\nexport function resolveProxySocketPaths(temporaryDirectory: string = tmpdir()): {\n\thostSocketPath: string;\n\tchildSocketPath: string;\n} {\n\tconst name = `apex-${process.pid}-${randomBytes(4).toString(\"hex\")}.sock`;\n\t// An unusually long TMPDIR would reintroduce the very limit this avoids.\n\tconst base = join(temporaryDirectory, name).length + 1 > SUN_PATH_LIMIT ? \"/tmp\" : temporaryDirectory;\n\treturn { hostSocketPath: join(base, name), childSocketPath: `/home/${name}` };\n}\n\n/**\n * Classify an unsuccessful child from what its stderr actually evidences, or return\n * undefined when nothing suggests the boundary refused anything.\n *\n * A non-zero exit is not a violation. An invalid API key, a failing test command, or a\n * script exiting 1 are the child's own business, and recording them as sandbox\n * violations blames the boundary for failures it had no part in — which is worse than\n * silence, because it sends whoever reads the output looking for a refusal that never\n * happened. Only Linux's own refusal wording earns a violation here; the proxy records\n * network refusals itself, before this fallback is consulted.\n */\nfunction classifySandboxFailure(stderr: string): \"filesystem\" | \"network\" | undefined {\n\tif (/Read-only file system|Permission denied|Operation not permitted/i.test(stderr)) return \"filesystem\";\n\tif (/Network is unreachable|ENETUNREACH|EHOSTUNREACH/i.test(stderr)) return \"network\";\n\treturn undefined;\n}\n\n/**\n * Linux's deliberately small platform adapter. The sandbox starts from a read-only\n * host root and bind-mounts only the canonical workspace as writable. `--unshare-net`\n * removes all direct network interfaces for the child and every descendant.\n */\nexport function createLinuxSandboxBackend(options?: LinuxSandboxBackendOptions): SandboxBackend {\n\tconst platform = options?.platform ?? process.platform;\n\tif (platform !== \"linux\") {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"OS sandbox is supported on Linux only.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"Linux sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\tconst hasCommand = options?.commandExists ?? commandExists;\n\tconst violationStore = options?.violationStore;\n\tlet proxy: SandboxNetworkProxy | undefined;\n\tlet handoff: TerminalHandoff | undefined;\n\tlet gitCredentialProxy: GitCredentialProxy | undefined;\n\tlet gitCredentialDirectory: string | undefined;\n\tlet escalationProxy: Awaited<ReturnType<typeof createCommandEscalationProxy>> | undefined;\n\tlet escalationDirectory: string | undefined;\n\tif (!hasCommand(\"bwrap\")) {\n\t\treturn {\n\t\t\tstatus: { kind: \"unavailable\", reason: \"Bubblewrap (bwrap) is required for OS sandboxing.\" },\n\t\t\tasync launch() {\n\t\t\t\tthrow new Error(\"Linux sandbox backend is unavailable.\");\n\t\t\t},\n\t\t\tasync close() {},\n\t\t};\n\t}\n\treturn {\n\t\tstatus: { kind: \"enforced\" },\n\t\tasync launch(launch: SandboxLaunch): Promise<number> {\n\t\t\tconst supervisorStateDirectory = launch.supervisorStateDirectory;\n\t\t\tmkdirSync(supervisorStateDirectory, { recursive: true, mode: 0o700 });\n\t\t\tconst stateDirectory = launch.policy.workspace;\n\t\t\tconst acknowledgementPath = join(launch.policy.workspace, \".apex-code\", \"sandbox-handoff-ack\");\n\t\t\tmkdirSync(join(launch.policy.workspace, \".apex-code\"), { recursive: true });\n\n\t\t\tconst violationCountBeforeLaunch = violationStore?.totalCount ?? 0;\n\n\t\t\tconst { hostSocketPath, childSocketPath } = resolveProxySocketPaths();\n\t\t\thandoff = createTerminalHandoff(supervisorStateDirectory, { acknowledgementPath });\n\t\t\tconst gitCredentialPaths = resolveGitCredentialChannelPaths();\n\t\t\tgitCredentialDirectory = gitCredentialPaths.hostSocketDirectory;\n\t\t\tproxy = await createSandboxNetworkProxy({\n\t\t\t\tsocketPath: hostSocketPath,\n\t\t\t\tallowedHosts: launch.policy.allowedHosts,\n\t\t\t\tviolationStore,\n\t\t\t\t// Undefined without a terminal, which leaves the proxy's own\n\t\t\t\t// deny-without-asking path in place for headless, print, JSON, and RPC.\n\t\t\t\trequestApproval: createHostApprover({ handoff }),\n\t\t\t});\n\t\t\t// After the network proxy, because reachability is its answer to give: the\n\t\t\t// credential channel must never hand out a token for a host this session\n\t\t\t// cannot even open a connection to.\n\t\t\tgitCredentialProxy = await createGitCredentialProxy({\n\t\t\t\tsocketPath: gitCredentialPaths.hostSocketPath,\n\t\t\t\tisHostAllowed: (host) => proxy?.isHostReachable(host) ?? false,\n\t\t\t\trequestRelease: options?.requestGitCredentialRelease ?? createCredentialReleaser({ handoff }),\n\t\t\t\t// The supervisor's own environment, deliberately: this runs outside the\n\t\t\t\t// boundary and must resolve against the real host home, which is exactly\n\t\t\t\t// what the child cannot see.\n\t\t\t\tfillCredential: (request) =>\n\t\t\t\t\t(options?.fillGitCredential ?? fillHostGitCredential)(request, { environment: process.env }),\n\t\t\t\tviolationStore,\n\t\t\t});\n\t\t\twriteGitCredentialHelper(supervisorStateDirectory);\n\n\t\t\tconst escalationPaths = resolveCommandEscalationChannelPaths();\n\t\t\tescalationDirectory = escalationPaths.hostSocketDirectory;\n\n\t\t\t// .cjs forces CommonJS regardless of the target workspace's package.json \"type\"\n\t\t\t// field -- a plain .js here would be parsed as ESM under \"type\": \"module\" and\n\t\t\t// crash on `require`, since Node resolves module type from the nearest package.json.\n\t\t\tconst relayScriptPath = join(supervisorStateDirectory, \"relay.cjs\");\n\t\t\twriteFileSync(\n\t\t\t\trelayScriptPath,\n\t\t\t\t`\nconst net = require(\"node:net\");\nconst child_process = require(\"node:child_process\");\n\nconst socketPath = process.env.APEX_UDS_PATH;\nconst server = net.createServer((c) => {\n\tconst client = net.connect(socketPath);\n\tc.pipe(client).pipe(c);\n\tc.on(\"error\", () => {});\n\tclient.on(\"error\", () => {});\n});\n\nserver.listen(0, \"127.0.0.1\", () => {\n\tconst port = server.address().port;\n\tconst env = Object.assign({}, process.env, {\n\t\tHTTP_PROXY: \\`http://127.0.0.1:\\${port}\\`,\n\t\tHTTPS_PROXY: \\`http://127.0.0.1:\\${port}\\`\n\t});\n\tconst args = process.argv.slice(2);\n\tconst child = child_process.spawn(args[0], args.slice(1), {\n\t\tstdio: \"inherit\",\n\t\tenv: env,\n\t});\n\tchild.on(\"exit\", (code, signal) => {\n\t\tprocess.exit(code ?? (signal ? 128 : 1));\n\t});\n});\nserver.on(\"error\", (err) => {\n\tconsole.error(\"Relay error:\", err);\n\tprocess.exit(1);\n});\n`.trim(),\n\t\t\t);\n\n\t\t\tconst primaryReadOnlyPaths = [\n\t\t\t\tprocess.execPath,\n\t\t\t\tlaunch.command,\n\t\t\t\tsupervisorStateDirectory,\n\t\t\t\t...(launch.readOnlyPaths ?? []),\n\t\t\t];\n\t\t\tconst readOnlyFileDescriptors = [\n\t\t\t\t...descriptorBackedReadOnlyPaths(primaryReadOnlyPaths),\n\t\t\t\t...(launch.readOnlyFiles ?? []),\n\t\t\t].map((path) => openSync(path, \"r\"));\n\t\t\t// The descriptors above are opened before the child spawns and must be closed\n\t\t\t// on every exit path -- including a spawn/wait rejection -- or a crashed launch\n\t\t\t// leaks an open handle onto a host-owned credential file for the process's life.\n\t\t\t// The workspace is bind-mounted read-write into the sandbox, so a file\n\t\t\t// here is visible at the same absolute path on both sides of it.\n\t\t\tconst terminalSizePath = join(supervisorStateDirectory, \"terminal-size\");\n\t\t\tconst stopPublishingTerminalSize = publishTerminalSize(terminalSizePath);\n\n\t\t\t// The second child derives its argv from the same builder as the first, with one\n\t\t\t// extra writable root. Nothing about the original child's namespace changes.\n\t\t\tescalationProxy = await createCommandEscalationProxy({\n\t\t\t\tsocketPath: escalationPaths.hostSocketPath,\n\t\t\t\trequestApproval: options?.requestCommandEscalation ?? createCommandEscalationApprover({ handoff }),\n\t\t\t\tviolationStore,\n\t\t\t\trunEscalated: (request) =>\n\t\t\t\t\trunEscalatedCommand({\n\t\t\t\t\t\trequest,\n\t\t\t\t\t\tlaunch,\n\t\t\t\t\t\tstateDirectory,\n\t\t\t\t\t\tspawnBwrap: options?.spawnChild ?? spawn,\n\t\t\t\t\t}),\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tconst spawnBwrap = options?.spawnChild ?? spawn;\n\t\t\t\tconst child = spawnBwrap(\n\t\t\t\t\t\"bwrap\",\n\t\t\t\t\tbuildBwrapArguments({\n\t\t\t\t\t\tworkspace: launch.policy.workspace,\n\t\t\t\t\t\tadditionalWritableRoots: launch.policy.additionalWritableRoots,\n\t\t\t\t\t\treadOnlyPaths: primaryReadOnlyPaths,\n\t\t\t\t\t\treadOnlyFiles: launch.readOnlyFiles ?? [],\n\t\t\t\t\t\treadOnlyBinaries: launch.readOnlyBinaries ?? [],\n\t\t\t\t\t\tsockets: [\n\t\t\t\t\t\t\t{ hostPath: hostSocketPath, childPath: childSocketPath },\n\t\t\t\t\t\t\t// Its child-side path is what `APEX_CREDENTIAL_PROXY_PATH` names.\n\t\t\t\t\t\t\t...(launch.credentialChannel\n\t\t\t\t\t\t\t\t? [\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\thostPath: launch.credentialChannel.hostSocketPath,\n\t\t\t\t\t\t\t\t\t\t\tchildPath: launch.credentialChannel.childSocketPath,\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t\t: []),\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\thostPath: gitCredentialPaths.hostSocketPath,\n\t\t\t\t\t\t\t\tchildPath: gitCredentialPaths.childSocketPath,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tenvironment: {\n\t\t\t\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t\t\t\t\tAPEX_UDS_PATH: childSocketPath,\n\t\t\t\t\t\t\t[TERMINAL_SIZE_PATH_VARIABLE]: terminalSizePath,\n\t\t\t\t\t\t\t[TERMINAL_HANDOFF_PATH_VARIABLE]: supervisorStateDirectory,\n\t\t\t\t\t\t\t[TERMINAL_HANDOFF_ACK_PATH_VARIABLE]: acknowledgementPath,\n\t\t\t\t\t\t\t[GIT_CREDENTIAL_SOCKET_VARIABLE]: gitCredentialPaths.childSocketPath,\n\t\t\t\t\t\t\t[COMMAND_ESCALATION_SOCKET_VARIABLE]: escalationPaths.childSocketPath,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcommand: process.execPath,\n\t\t\t\t\t\targs: [relayScriptPath, launch.command, ...launch.args],\n\t\t\t\t\t}),\n\t\t\t\t\t{ env: launch.environment, stdio: [\"inherit\", \"inherit\", \"pipe\", ...readOnlyFileDescriptors] },\n\t\t\t\t);\n\t\t\t\tlet stderr = \"\";\n\t\t\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\t\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\t\t\tstderr += chunk;\n\t\t\t\t\tprocess.stderr.write(chunk);\n\t\t\t\t});\n\t\t\t\tconst exitCode = await waitForExit(child);\n\t\t\t\tawait proxy?.close();\n\t\t\t\tconst proxyAlreadyRecordedAViolation = (violationStore?.totalCount ?? 0) > violationCountBeforeLaunch;\n\t\t\t\tconst kind = exitCode !== 0 && !proxyAlreadyRecordedAViolation ? classifySandboxFailure(stderr) : undefined;\n\t\t\t\tif (kind) {\n\t\t\t\t\tviolationStore?.add({\n\t\t\t\t\t\tkind,\n\t\t\t\t\t\tcommand: [launch.command, ...launch.args].join(\" \"),\n\t\t\t\t\t\tdetail: stderr.trim(),\n\t\t\t\t\t\ttimestamp: new Date(),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn exitCode;\n\t\t\t} finally {\n\t\t\t\tstopPublishingTerminalSize();\n\t\t\t\tfor (const descriptor of readOnlyFileDescriptors) closeSync(descriptor);\n\t\t\t\t// The socket now lives outside the workspace, so nothing else will ever clean\n\t\t\t\t// it up; leaving it would litter the temp directory once per launch.\n\t\t\t\trmSync(hostSocketPath, { force: true });\n\t\t\t}\n\t\t},\n\t\tasync close() {\n\t\t\thandoff?.stop();\n\t\t\tawait escalationProxy?.close();\n\t\t\tif (escalationDirectory) rmSync(escalationDirectory, { force: true, recursive: true });\n\t\t\tawait gitCredentialProxy?.close();\n\t\t\tif (gitCredentialDirectory) rmSync(gitCredentialDirectory, { force: true, recursive: true });\n\t\t\tawait proxy?.close();\n\t\t},\n\t};\n}\n\n/**\n * Start one approved command in its own child, with one extra writable root.\n *\n * Deliberately minimal compared with the session child: no network relay, no credential\n * channels, no terminal handoff. An escalated command is a single shell invocation the\n * human just read and approved, not a session, and every channel omitted here is one it\n * cannot reach. Its stdio is captured rather than inherited so the session that asked\n * receives the output instead of the escalated process writing over the TUI.\n */\nasync function runEscalatedCommand(options: {\n\trequest: CommandEscalationRequest;\n\tlaunch: SandboxLaunch;\n\tstateDirectory: string;\n\tspawnBwrap: typeof spawn;\n}): Promise<CommandEscalationResult> {\n\tconst { request, launch, stateDirectory } = options;\n\tconst escalatedReadOnlyPaths = launch.readOnlyPaths ?? [];\n\tconst readOnlyFileDescriptors = [\n\t\t...descriptorBackedReadOnlyPaths(escalatedReadOnlyPaths),\n\t\t...(launch.readOnlyFiles ?? []),\n\t].map((path) => openSync(path, \"r\"));\n\tconst child = options.spawnBwrap(\n\t\t\"bwrap\",\n\t\tbuildBwrapArguments({\n\t\t\tworkspace: launch.policy.workspace,\n\t\t\tadditionalWritableRoots: [...launch.policy.additionalWritableRoots, request.writableRoot],\n\t\t\treadOnlyPaths: escalatedReadOnlyPaths,\n\t\t\treadOnlyFiles: launch.readOnlyFiles ?? [],\n\t\t\treadOnlyBinaries: launch.readOnlyBinaries ?? [],\n\t\t\tsockets: [],\n\t\t\tenvironment: {\n\t\t\t\tHOME: launch.environment?.HOME ?? stateDirectory,\n\t\t\t\tTMPDIR: launch.environment?.TMPDIR ?? stateDirectory,\n\t\t\t},\n\t\t\tcommand: \"/bin/sh\",\n\t\t\targs: [\"-c\", request.command],\n\t\t}),\n\t\t{ stdio: [\"ignore\", \"pipe\", \"pipe\", ...readOnlyFileDescriptors] },\n\t);\n\tlet stdout = \"\";\n\tlet stderr = \"\";\n\ttry {\n\t\tchild.stdout?.setEncoding(\"utf8\");\n\t\tchild.stdout?.on(\"data\", (chunk: string) => {\n\t\t\tstdout += chunk;\n\t\t});\n\t\tchild.stderr?.setEncoding(\"utf8\");\n\t\tchild.stderr?.on(\"data\", (chunk: string) => {\n\t\t\tstderr += chunk;\n\t\t});\n\t\tconst code = await new Promise<number>((resolveCode) => {\n\t\t\tchild.once(\"error\", () => resolveCode(1));\n\t\t\tchild.once(\"exit\", (exitCode) => resolveCode(exitCode ?? 1));\n\t\t});\n\t\treturn { code, stdout, stderr };\n\t} finally {\n\t\tfor (const descriptor of readOnlyFileDescriptors) closeSync(descriptor);\n\t}\n}\n"]}