approval-md 0.1.0 → 0.3.0

package/dist/src/core/sandbox.d.ts

@@ -0,0 +1,371 @@
+/**
+ * The egress sandbox (APRV-193): the room an allowed command runs in.
+ *
+ * ## What this is for
+ *
+ * Arbitrary code execution is capability-complete. The gate classifies a
+ * command by its TEXT, and `npm test` runs whatever the agent wrote a minute
+ * ago, so for laundered exec the text has stopped describing the effect. No
+ * classifier over shell strings can close that, and `core/child-env.ts`
+ * (APRV-205) closed only half of it: the child no longer inherits the session's
+ * credentials, and it still inherits the session's network.
+ *
+ * This module removes the network. It does not try to predict what the code
+ * will do; it takes away what the code would need. Where APRV-205 starves the
+ * child of secrets, this starves it of a place to send them.
+ *
+ * ## The shape, and why it is this shape
+ *
+ * A NETWORK-ONLY sandbox, with one filesystem exception. The filesystem is left
+ * alone because the gate's own IPC is a FILE: `src/daemon/` opens no socket, it
+ * polls `.approval/log/events.jsonl`. So denying egress costs the gate nothing
+ * and needs no plumbing to stay reachable, and the "one door" other agent
+ * sandboxes build an egress proxy for already exists as an append to a file.
+ * That is the single largest simplification available here, and it is why the
+ * default profile denies the network, denies reads of the credential material
+ * beside the log, and touches nothing else.
+ *
+ * Loopback is denied WITH the rest. There is no gate socket to except: the
+ * daemon is a file reader. The one thing loopback costs is a test suite that
+ * starts its own localhost server, which is what {@link EgressAllowance.loopback}
+ * is for, and that allowance is an operator's decision recorded where it is
+ * used (`docs/sandboxed-exec.md` has the survey).
+ *
+ * ## The mechanism, and what is verified rather than assumed
+ *
+ * macOS only in this build: `/usr/bin/sandbox-exec` with a Sandbox Profile
+ * Language (SBPL) profile. It ships with every macOS, needs no privilege and no
+ * daemon, and every macOS agent sandbox in the field uses it. Linux
+ * (`bwrap --unshare-net`, `unshare --net`) is a stated follow-up rather than a
+ * silent omission: {@link detectSandbox} reports `supported: false` there and
+ * says so, and `docs/sandboxed-exec.md` carries the gap.
+ *
+ * Three Seatbelt behaviours are measured, not assumed. Each of them, got wrong,
+ * ships a profile that silently protects nothing, which is the worst artifact
+ * this design could produce:
+ *
+ * 1. `network-outbound` covers AF_UNIX connects as well as AF_INET. A bare
+ *    `(deny network-outbound)` kills local IPC — DNS's mDNSResponder socket
+ *    included — and the process dies before it can do anything. The unix
+ *    exception is mandatory.
+ * 2. `subpath` and `literal` filters match the kernel's RESOLVED path. On macOS
+ *    `/tmp` is a symlink to `/private/tmp`, so a profile naming `/tmp/x` denies
+ *    NOTHING. Every path is realpath-resolved before it is written into a
+ *    profile, and `tests/sandbox.test.ts` pins the unresolved spelling as the
+ *    no-op it is.
+ * 3. `sandbox-exec` execs through `execvp`, so a PATH lookup still happens
+ *    inside the wrapper — but a lookup that FAILS exits 71 (EX_OSERR), which
+ *    would be recorded as the child's own exit code. So {@link resolveExecutable}
+ *    does the lookup first and a command that cannot be found is never wrapped:
+ *    it reaches `spawnSync` unwrapped and fails as ENOENT exactly as it does
+ *    today.
+ *
+ * ## What it does not claim
+ *
+ * A sandboxed child can still WRITE files, including files a later unsandboxed
+ * process will run. That is the same laundering one step removed, and it is why
+ * `APPROVAL_HOOK_REQUIRE_SANDBOX` (which makes the hook insist that every
+ * code-running command wear the room) matters more than any single wrapper. It
+ * would be closed properly by running the whole SESSION under the profile,
+ * which this build cannot do: an agent harness needs the model API, and denying
+ * egress denies exactly that. A session-wide sandbox needs an allowlist
+ * reaching one host, which Seatbelt cannot express by hostname and which the
+ * prior art solves with a local proxy.
+ *
+ * Inbound sockets are not denied, so a child could in principle bind a port and
+ * wait to be contacted; that needs a peer that can reach this machine and is
+ * recorded here as a stated limit rather than an oversight. And the sandbox is
+ * not isolation: it is one capability removed from a process that otherwise has
+ * the ordinary powers of the session.
+ */
+/**
+ * The mechanisms this build knows. One, today.
+ *
+ * A union rather than a string so the Linux follow-up (APRV-193g) is an
+ * addition the compiler finds every site of, rather than a value that quietly
+ * flows through code written for Seatbelt.
+ */
+export declare const SANDBOX_MECHANISMS: readonly ["sandbox-exec"];
+export type SandboxMechanism = (typeof SANDBOX_MECHANISMS)[number];
+/**
+ * What an execution's record says about the room it ran in.
+ *
+ * Written to `execution.started` as `sandbox`, and it is a fact about the
+ * runtime's own behaviour rather than anything a caller asserted: three of the
+ * four values are computed here, and the fourth (`opted-out`) is a flag the
+ * operator typed, which is exactly why it is RECORDED — an opt-out nobody can
+ * see afterwards is an opt-out that costs nothing to take.
+ */
+export declare const SANDBOX_STATES: readonly [
+/** The child ran with outbound network denied. */
+"egress-denied", 
+/** `--no-sandbox` was passed. The child ran with the session's own network. */
+"opted-out", 
+/**
+ * The manual path: a human granted these exact bytes and the grant is the
+ * authority to reach the world. `approval run` on a token is the one door,
+ * and a door that denied egress would not be a door.
+ */
+"granted-egress", 
+/**
+ * This platform has no mechanism in this build (anything but macOS today).
+ * Recorded on every execution so an auditor can see exactly which runs were
+ * unprotected, rather than inferring it from the absence of a field.
+ */
+"unsupported"];
+export type SandboxState = (typeof SANDBOX_STATES)[number];
+/** What the machine can do, probed rather than inferred. */
+export interface SandboxDetection {
+    /** Can a command be run egress-denied here, right now? */
+    readonly available: boolean;
+    /** The mechanism that would be used, or `null`. */
+    readonly mechanism: SandboxMechanism | null;
+    /**
+     * Does this build have a mechanism for this platform AT ALL?
+     *
+     * The distinction from {@link available} is load-bearing and it is the one
+     * place this module is deliberately not maximally strict. `supported: false`
+     * means "nothing was ever written for this platform", which is a known gap
+     * with a follow-up task and a docs row. `supported: true, available: false`
+     * means "the mechanism that should be here did not work", which is a broken
+     * promise, and the callers treat the two differently: the first proceeds and
+     * records `unsupported`, the second refuses to run the command at all.
+     */
+    readonly supported: boolean;
+    /** Can loopback be carved back in? (Seatbelt yes; a Linux netns cannot.) */
+    readonly loopback: boolean;
+    /** Why, when {@link available} is false. Empty otherwise. */
+    readonly reason: string;
+}
+/** What the profile lets through. Everything absent here is denied. */
+export interface EgressAllowance {
+    /**
+     * Allow connections to `localhost:*`.
+     *
+     * Off by default. The gate needs nothing: its IPC is a file. This exists for
+     * the one legitimate case the survey found, a test suite that starts its own
+     * server, and it is a real widening — a loopback port is a port, and anything
+     * listening on one is reachable from inside.
+     */
+    readonly loopback: boolean;
+    /**
+     * Absolute paths whose CONTENTS the child may not read. Resolved before they
+     * reach the profile. Directories deny their whole subtree.
+     */
+    readonly denyRead: readonly string[];
+    /**
+     * WRITE CONFINEMENT (APRV-325.3): the only absolute subtrees the child may
+     * write, or `undefined` for the ordinary egress-only profile.
+     *
+     * This flips the posture for one rule family and one only. The header explains
+     * why the rest of this module is a deny-LIST: a `(deny default)` profile
+     * spends itself re-allowing dyld, the process's own binary and every temporary
+     * directory, and a control that breaks ordinary development is a control that
+     * gets switched off. That reasoning holds for reads and for everything else,
+     * and it does NOT hold for writes in a confined session, where the whole
+     * property being enforced is "this shell cannot change the canonical
+     * workspace". A write deny-list would have to enumerate every path worth
+     * protecting; this names the handful worth writing, so a path nobody thought
+     * of is denied rather than forgotten.
+     *
+     * `/dev` is allowed alongside them, unconditionally. Writes there are process
+     * I/O rather than filesystem state — `/dev/null`, `/dev/stdout`, `/dev/tty`,
+     * the pty a shell needs — and denying them kills the child before it can
+     * demonstrate anything, which is the failure mode point 1 of the header
+     * records for `network-outbound` and unix sockets.
+     *
+     * An EMPTY array is meaningful and is not the same as `undefined`: it denies
+     * every write outside `/dev`. `undefined` emits no write rules at all.
+     */
+    readonly writeAllow?: readonly string[];
+    /**
+     * The READ JAIL (APRV-347): absolute directories the child may read, with
+     * everything else denied.
+     *
+     * Absent or empty leaves the profile exactly as it was — allow-default with a
+     * deny-list — and the bytes are identical to the pre-APRV-347 profile, which
+     * a fixture test pins. That default is deliberate: a deny-default read
+     * profile is a much larger change to what ordinary development can do, and a
+     * control that breaks `npm run build` is a control someone switches off.
+     *
+     * When it IS set, the profile flips to `(deny file-read*)` plus a `subpath`
+     * allow for each of these roots and for the fixed runtime set a process needs
+     * to exist at all (see {@link RUNTIME_READ_PATHS}). `denyRead` still applies
+     * and is emitted AFTER the allows, so a credential file inside an allowed
+     * root stays unreadable: last match wins in SBPL, and the credential denial
+     * must be the last word.
+     */
+    readonly allowRead?: readonly string[];
+}
+/** The default: nothing allowed, nothing denied beyond the network. */
+export declare const DENY_ALL_EGRESS: EgressAllowance;
+/**
+ * What a process must be able to read to exist, regardless of the jail.
+ *
+ * Deliberately a fixed compiled-in list rather than anything a caller supplies:
+ * a jail whose runtime set could be widened by the party under oversight is not
+ * a jail (SPEC.md §11.1, self-reported fields never reduce scrutiny).
+ *
+ * - `/usr/lib`, `/usr/share`, `/System`, `/Library` — dyld, the shared cache,
+ *   ICU data and the frameworks every Mach-O binary links. A profile without
+ *   them kills the process before `main`, which reads as the command failing
+ *   rather than as the sandbox working.
+ * - `/private/var/db/dyld` and `/var/db/dyld` — the dyld shared cache, which
+ *   moved out of `/usr/lib` and is opened by name.
+ * - `/dev` — `/dev/null`, `/dev/urandom`, `/dev/dtracehelper`, the tty.
+ * - `/bin`, `/usr/bin`, `/sbin`, `/usr/sbin`, `/opt/homebrew`, `/usr/local` —
+ *   the interpreters and tools a build shells out to. The node binary's own
+ *   realpath is added separately by {@link runtimeReadRoots}, because a Node
+ *   installed by a version manager lives under the user's home and none of
+ *   these covers it.
+ * - `/etc`, `/private/etc` — `resolv.conf`, `passwd`, the locale tables.
+ *
+ * `node_modules` is NOT here, and that is a stated limit rather than an
+ * oversight: a repository's dependencies live inside the repository, so they
+ * are covered by the gate root being a read root. A project whose dependencies
+ * sit OUTSIDE the root (a pnpm store elsewhere, a linked package) must name
+ * that directory in `read_scope.roots`, which is exactly the widening that key
+ * exists for. docs/sandboxed-exec.md says so beside the survey.
+ *
+ * **The temp roots are not here either**, and that one is load-bearing. They
+ * reach the profile through the CALLER — `resolveReadRoots` puts the session
+ * scratchpad and the system temp root in the effective read scope, so
+ * `approval run` and `approval sandbox` open them and build tooling keeps
+ * working — and a caller that passes narrower roots gets a narrower jail. A
+ * temp root compiled in here would have been a widening no operator could turn
+ * off and no test could demonstrate a denial against, which is how it was
+ * found.
+ */
+export declare const RUNTIME_READ_PATHS: readonly string[];
+/**
+ * The files beside a log that hold credential material, for the profile's
+ * `denyRead`.
+ *
+ * Named individually rather than by denying the whole approval home. The home
+ * also holds the log, the payload store and the queue, and a child that could
+ * not read the log could not read the decision that authorized it. What is
+ * denied is what a laundering script would want: the vault's ciphertext, the
+ * environment source map that says where the secrets come from, and the
+ * per-request private keys that seal tokens.
+ *
+ * This is defence in depth over material that is already encrypted or already
+ * useless without the passphrase — the load-bearing custody control is that
+ * the passphrase is not in the child's environment at all (APRV-205). It is
+ * worth having on the one platform where it costs nothing.
+ */
+export declare function credentialPathsFor(logPath: string): string[];
+/**
+ * Forces the unavailable branch. A STRICTNESS increase in every caller — the
+ * run path refuses and the session launcher refuses — so a forged value cannot
+ * widen anything, which is what keeps it clear of SPEC.md §11.1 invariant 4.
+ */
+export declare const FORCE_UNAVAILABLE_ENV = "APPROVAL_SANDBOX_FORCE_UNAVAILABLE";
+/**
+ * Treat an unsupported platform as a broken promise rather than a known gap:
+ * with this set, a machine with no mechanism refuses instead of proceeding.
+ * The same one-way property holds — it can only ever refuse more.
+ */
+export declare const REQUIRE_SANDBOX_ENV = "APPROVAL_SANDBOX_REQUIRED";
+export interface DetectOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * What this machine can do. Cached for the default call, because every verb
+ * that asks would otherwise spawn a probe per invocation, and the answer cannot
+ * change inside one process.
+ */
+export declare function detectSandbox(options?: DetectOptions): SandboxDetection;
+/** Testing seam: forget the cached probe. Never called by the runtime. */
+export declare function resetSandboxDetection(): void;
+/**
+ * A path as the KERNEL will see it.
+ *
+ * A path that does not exist yet cannot be resolved, so its directory is
+ * resolved and the name re-joined. A profile naming an unresolved path denies
+ * nothing at all and reports no error, which is the failure this function
+ * exists to prevent.
+ */
+export declare function resolveForProfile(path: string): string;
+/**
+ * The SBPL profile.
+ *
+ * `(allow default)` first, then the denial: SBPL takes the LAST matching rule,
+ * so exceptions are written after the deny. This is deliberately a deny-LIST
+ * and not the `(deny default)` posture a true isolation sandbox takes. The
+ * property being enforced is egress, and a deny-default profile spends itself
+ * re-allowing dyld, `/dev/urandom`, the process's own binary and every
+ * temporary directory, which is a different task with a different failure mode
+ * (and a much larger chance of breaking ordinary development, which is how a
+ * control gets switched off).
+ */
+export declare function seatbeltProfile(allowance: EgressAllowance): string;
+/** The argv to spawn, and the temporary directory the caller must remove. */
+export interface WrappedSpawn {
+    readonly command: string;
+    readonly args: string[];
+    /** A directory holding the profile file; remove it once the child is gone. */
+    readonly cleanup: string;
+    /** What the caller records. */
+    readonly mechanism: SandboxMechanism;
+}
+/**
+ * Resolve a command the way `execvp` would, and say when it cannot be found.
+ *
+ * Done HERE rather than left to the wrapper for the reason in the header: an
+ * execvp failure inside `sandbox-exec` exits 71, and 71 recorded as the child's
+ * exit code is a lie about a command that never ran. A command that does not
+ * resolve is returned as `null`, and the caller spawns it unwrapped so the
+ * ENOENT surfaces exactly as it does with no sandbox in the picture.
+ */
+export declare function resolveExecutable(command: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Build the wrapped spawn for `argv`.
+ *
+ * Writes the profile to a fresh 0600 file under a private directory: the
+ * profile names the paths whose reads are denied, which is not secret, but a
+ * world-writable profile would be a profile another process could rewrite
+ * between this write and the exec.
+ */
+export declare function wrapForSandbox(mechanism: SandboxMechanism, command: string, args: readonly string[], allowance?: EgressAllowance): WrappedSpawn;
+export interface PostureInput {
+    /** `--no-sandbox` was passed. */
+    readonly optedOut: boolean;
+    /**
+     * A human's grant over these exact bytes is in the caller's hand (the manual
+     * path presented a token). The grant IS the authority to reach the world.
+     *
+     * Not a self-report that widens anything: a token that does not verify runs
+     * no command at all, so the loosening is reachable only by holding something
+     * a human minted. SPEC.md §11.1 invariant 4 is about a declaration the
+     * executing party authors; this is a secret it cannot author.
+     */
+    readonly granted: boolean;
+    /** The machine's capability. */
+    readonly detection: SandboxDetection;
+    /** `APPROVAL_SANDBOX_REQUIRED=1` promotes an unsupported platform to a refusal. */
+    readonly requireSupported?: boolean;
+}
+export type SandboxPosture = {
+    readonly kind: "apply";
+    readonly state: "egress-denied";
+    readonly mechanism: SandboxMechanism;
+} | {
+    readonly kind: "skip";
+    readonly state: Exclude<SandboxState, "egress-denied">;
+} | {
+    readonly kind: "refuse";
+    readonly reason: string;
+};
+/**
+ * What to do about the sandbox for one execution.
+ *
+ * Total, pure, and exhaustively testable: it reads a detection and two booleans
+ * and returns one of three answers. The ORDER of the branches is the policy —
+ * a broken mechanism refuses before an opt-out is considered, so `--no-sandbox`
+ * on a machine whose sandbox is broken is still a refusal rather than a way to
+ * turn the noise off.
+ */
+export declare function sandboxPosture(input: PostureInput): SandboxPosture;
+/** Is `APPROVAL_SANDBOX_REQUIRED` set on this environment? */
+export declare function sandboxRequired(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/core/sandbox.js

@@ -125,6 +125,77 @@ export const SANDBOX_STATES = [
 ];
 /** The default: nothing allowed, nothing denied beyond the network. */
 export const DENY_ALL_EGRESS = { loopback: false, denyRead: [] };
+/**
+ * What a process must be able to read to exist, regardless of the jail.
+ *
+ * Deliberately a fixed compiled-in list rather than anything a caller supplies:
+ * a jail whose runtime set could be widened by the party under oversight is not
+ * a jail (SPEC.md §11.1, self-reported fields never reduce scrutiny).
+ *
+ * - `/usr/lib`, `/usr/share`, `/System`, `/Library` — dyld, the shared cache,
+ *   ICU data and the frameworks every Mach-O binary links. A profile without
+ *   them kills the process before `main`, which reads as the command failing
+ *   rather than as the sandbox working.
+ * - `/private/var/db/dyld` and `/var/db/dyld` — the dyld shared cache, which
+ *   moved out of `/usr/lib` and is opened by name.
+ * - `/dev` — `/dev/null`, `/dev/urandom`, `/dev/dtracehelper`, the tty.
+ * - `/bin`, `/usr/bin`, `/sbin`, `/usr/sbin`, `/opt/homebrew`, `/usr/local` —
+ *   the interpreters and tools a build shells out to. The node binary's own
+ *   realpath is added separately by {@link runtimeReadRoots}, because a Node
+ *   installed by a version manager lives under the user's home and none of
+ *   these covers it.
+ * - `/etc`, `/private/etc` — `resolv.conf`, `passwd`, the locale tables.
+ *
+ * `node_modules` is NOT here, and that is a stated limit rather than an
+ * oversight: a repository's dependencies live inside the repository, so they
+ * are covered by the gate root being a read root. A project whose dependencies
+ * sit OUTSIDE the root (a pnpm store elsewhere, a linked package) must name
+ * that directory in `read_scope.roots`, which is exactly the widening that key
+ * exists for. docs/sandboxed-exec.md says so beside the survey.
+ *
+ * **The temp roots are not here either**, and that one is load-bearing. They
+ * reach the profile through the CALLER — `resolveReadRoots` puts the session
+ * scratchpad and the system temp root in the effective read scope, so
+ * `approval run` and `approval sandbox` open them and build tooling keeps
+ * working — and a caller that passes narrower roots gets a narrower jail. A
+ * temp root compiled in here would have been a widening no operator could turn
+ * off and no test could demonstrate a denial against, which is how it was
+ * found.
+ */
+export const RUNTIME_READ_PATHS = [
+    "/usr/lib",
+    "/usr/share",
+    "/System",
+    "/Library",
+    "/private/var/db/dyld",
+    "/var/db/dyld",
+    "/dev",
+    "/bin",
+    "/sbin",
+    "/usr/bin",
+    "/usr/sbin",
+    "/usr/local",
+    "/opt/homebrew",
+    "/etc",
+    "/private/etc",
+];
+/**
+ * The runtime set plus this process's own interpreter.
+ *
+ * `process.execPath` is resolved because a version manager's `node` is usually
+ * a symlink, and a `subpath` rule matches what the KERNEL resolves rather than
+ * what the profile was handed (the lesson APRV-193's design lane paid for).
+ */
+function runtimeReadRoots() {
+    const roots = [...RUNTIME_READ_PATHS];
+    try {
+        roots.push(dirname(realpathSync(process.execPath)));
+    }
+    catch {
+        // A process that cannot resolve its own binary is one the jail cannot help.
+    }
+    return roots;
+}
 // ---------------------------------------------------------------------------
 // The credential material
 // ---------------------------------------------------------------------------
@@ -293,6 +364,39 @@ export function seatbeltProfile(allowance) {
     if (allowance.loopback) {
         lines.push(";; Carve-out: a suite that starts its own localhost server. A real widening.", '(allow network-outbound (remote ip "localhost:*"))');
     }
+    // APRV-347, the read jail. Emitted between the egress rules and the
+    // credential denials, and the ORDER is the policy: SBPL takes the last
+    // matching rule, so the roots open the filesystem and `denyRead` closes the
+    // credential material inside them afterwards. An empty (or absent)
+    // `allowRead` emits nothing at all, which is why a profile built without it
+    // is byte-identical to the profile this function produced before this task.
+    const allowRead = allowance.allowRead ?? [];
+    if (allowRead.length > 0) {
+        lines.push(";; APRV-347: the read jail. Deny-default, then the roots and the fixed", ";; runtime set a process needs to start at all.", "(deny file-read*)");
+        const seen = new Set();
+        for (const path of [...allowRead, ...runtimeReadRoots()]) {
+            const resolved = resolveForProfile(path);
+            if (seen.has(resolved))
+                continue;
+            seen.add(resolved);
+            lines.push(`(allow file-read* (subpath ${sbplString(resolved)}))`);
+        }
+        // The ROOT DIRECTORY needs `file-read*`, not metadata, and this was
+        // measured rather than reasoned: with every other directory a process needs
+        // opened by subpath and `/` allowed for metadata only, `/usr/bin/true`
+        // dies with SIGABRT before `main`. `/` alone, as a literal: it opens the
+        // top-level directory listing and no file in it.
+        lines.push('(allow file-read* (literal "/"))');
+        // `file-read-metadata` on every other ancestor of every allowed root:
+        // resolving a path means stat-ing each directory on the way down, and a
+        // jail that denied that would refuse `/Users/x/dev/muse` for lack of
+        // `/Users`. Metadata leaks a directory's existence, never its contents.
+        for (const ancestor of ancestorsOf([...seen])) {
+            if (ancestor === "/")
+                continue;
+            lines.push(`(allow file-read-metadata (literal ${sbplString(ancestor)}))`);
+        }
+    }
     for (const path of allowance.denyRead) {
         const resolved = resolveForProfile(path);
         // `literal` for a file, `subpath` for a directory. Both are emitted for a
@@ -312,8 +416,91 @@ export function seatbeltProfile(allowance) {
         if (!file)
             lines.push(`(deny file-read* (subpath ${sbplString(resolved)}))`);
     }
+    if (allowance.writeAllow !== undefined) {
+        lines.push(";; APRV-325.3: write confinement. Deny-DEFAULT for this rule family only,", ";; so a path nobody thought of is denied rather than forgotten.", "(deny file-write*)", ";; /dev is process I/O, not filesystem state. Denying it kills a shell", ";; before it can do anything, for the reason a bare network-outbound deny does.", '(allow file-write* (subpath "/dev"))');
+        for (const path of allowance.writeAllow) {
+            lines.push(`(allow file-write* (subpath ${sbplString(resolveForProfile(path))}))`);
+        }
+    }
     return `${lines.join("\n")}\n`;
 }
+/**
+ * The read jail, plus the directories the command being run lives in (APRV-347).
+ *
+ * You cannot run a program you may not read. `sandbox-exec` execs the RESOLVED
+ * path, so a `node` or `npm` installed outside the compiled-in runtime set — a
+ * version manager under `~`, a `.local/bin` shim — fails `execvp` with
+ * `Operation not permitted` and exits 71, which reads as the command failing
+ * rather than as the jail working.
+ *
+ * Two directories are opened: the resolved executable's own, and its PARENT.
+ * The parent is what makes a toolchain work rather than merely start: an
+ * interpreter's entry point lives at `<prefix>/bin/<name>` and the library it
+ * immediately requires lives at `<prefix>/lib` or beside it, so opening only
+ * `bin` gets a process that launches and cannot find itself. `npm` resolves to
+ * `…/lib/node_modules/npm/bin/npm-cli.js`, whose parent is the npm package, and
+ * that is the shape this rule is for.
+ *
+ * It is NOT a widening a caller chooses: it is derived from the argv this
+ * function was already given, and it does nothing at all when no jail was
+ * asked for. Anything a command needs BEYOND its own install prefix — a
+ * dependency store elsewhere, a linked package — is the operator's
+ * `read_scope.roots` to declare.
+ */
+function withExecutableRoots(allowance, command) {
+    const jail = allowance.allowRead ?? [];
+    if (jail.length === 0)
+        return allowance;
+    let real = command;
+    try {
+        real = realpathSync(command);
+    }
+    catch {
+        // Not resolvable: the caller already handles a command that is not there.
+    }
+    const own = dirname(real);
+    // `dirname(command)` as well as `dirname(real)`: a PATH entry is usually a
+    // directory of symlinks (`~/.local/bin/npm` -> a version manager's tree), and
+    // traversing the link needs the link's own directory open, not just the
+    // target's. Leaving it out fails `execvp` before the program starts.
+    const roots = [own, dirname(command)];
+    // The prefix, behind a DEPTH FLOOR. `dirname("/bin")` is `/`, and a root of
+    // `/` would open the entire filesystem — a jail that opened everything and
+    // reported nothing, which is the worst failure this file can have. Two
+    // segments, the same floor the hook applies to a scratch root and for the
+    // same reason: a value derived from somewhere else must not be able to name
+    // the root of the disk.
+    const prefix = dirname(own);
+    if (prefix.split("/").filter((segment) => segment.length > 0).length >= 2) {
+        roots.push(prefix);
+    }
+    return { ...allowance, allowRead: [...jail, ...roots] };
+}
+/**
+ * Every proper ancestor directory of these paths, sorted and de-duplicated.
+ *
+ * `subpath` opens a subtree; it says nothing about the directories ABOVE it,
+ * and opening `/Users/carter/dev/muse` is useless if the process may not stat
+ * `/Users`, `/Users/carter` and `/Users/carter/dev` on the way down. Metadata
+ * only: the names of the intermediate directories leak, their contents do not.
+ */
+function ancestorsOf(paths) {
+    const out = new Set();
+    for (const path of paths) {
+        let at = dirname(path);
+        for (let depth = 0; depth < 64; depth += 1) {
+            if (at === "/" || at === "." || at === "")
+                break;
+            out.add(at);
+            const up = dirname(at);
+            if (up === at)
+                break;
+            at = up;
+        }
+    }
+    out.add("/");
+    return [...out].sort();
+}
 /**
  * A path as an SBPL string literal.
  *
@@ -377,7 +564,9 @@ export function wrapForSandbox(mechanism, command, args, allowance = DENY_ALL_EG
     }
     const dir = mkdtempSync(join(realTmpdir(), "approval-sandbox-"));
     const profile = join(dir, "egress-denied.sb");
-    writeFileSync(profile, seatbeltProfile(allowance), { mode: 0o600 });
+    writeFileSync(profile, seatbeltProfile(withExecutableRoots(allowance, command)), {
+        mode: 0o600,
+    });
     return {
         command: SANDBOX_EXEC,
         args: [...profileFlags(profile), command, ...args],

package/dist/src/core/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,cAAc,CAAU,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kDAAkD;IAClD,eAAe;IACf,+EAA+E;IAC/E,WAAW;IACX;;;;OAIG;IACH,gBAAgB;IAChB;;;;OAIG;IACH,aAAa;CACL,CAAC;AA6CX,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,4DAA4D;AAC5D,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,SAAkB;IACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,OAAsB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,qBAAqB,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,WAAW,CAChB,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iDAAiD,EACnI,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC,uDAAuD,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,IAAI,MAAM,GAA4B,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAO,GAAkB,EAAE;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;IAC7E,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,kFAAkF;QAClF,iBAAiB;QACjB,yBAAyB;QACzB,6EAA6E;QAC7E,wEAAwE;QACxE,wCAAwC;KACzC,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,SAAS,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnE,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjG,IAAI,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,6EAA6E;QAC7E,4EAA4E;QAC5E,wCAAwC;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA2B,EAC3B,OAAe,EACf,IAAuB,EACvB,SAAS,GAAoB,eAAe;IAE5C,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC9C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClD,OAAO,EAAE,GAAG;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,cAAc,CAAU,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kDAAkD;IAClD,eAAe;IACf,+EAA+E;IAC/E,WAAW;IACX;;;;OAIG;IACH,gBAAgB;IAChB;;;;OAIG;IACH,aAAa;CACL,CAAC;AAwFX,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,YAAY;IACZ,SAAS;IACT,UAAU;IACV,sBAAsB;IACtB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,cAAc;CACf,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,4DAA4D;AAC5D,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,SAAkB;IACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,OAAsB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,qBAAqB,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,WAAW,CAChB,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iDAAiD,EACnI,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC,uDAAuD,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,IAAI,MAAM,GAA4B,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAO,GAAkB,EAAE;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;IAC7E,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,kFAAkF;QAClF,iBAAiB;QACjB,yBAAyB;QACzB,6EAA6E;QAC7E,wEAAwE;QACxE,wCAAwC;KACzC,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,iDAAiD,EACjD,mBAAmB,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,8BAA8B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,iDAAiD;QACjD,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC/C,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,QAAQ,KAAK,GAAG;gBAAE,SAAS;YAC/B,KAAK,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,SAAS,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,2EAA2E,EAC3E,iEAAiE,EACjE,oBAAoB,EACpB,wEAAwE,EACxE,iFAAiF,EACjF,sCAAsC,CACvC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,mBAAmB,CAAC,SAA0B,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAwB;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM;YACjD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM;YACrB,EAAE,GAAG,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnE,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjG,IAAI,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,6EAA6E;QAC7E,4EAA4E;QAC5E,wCAAwC;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA2B,EAC3B,OAAe,EACf,IAAuB,EACvB,SAAS,GAAoB,eAAe;IAE5C,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC9C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE;QAC/E,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClD,OAAO,EAAE,GAAG;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;AAC1C,CAAC"}