atabey-shared 0.0.37 → 0.1.1-beta

package/dist/sandbox-fs.js

@@ -8,8 +8,9 @@
  */
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { AtomicFileLock } from "./file-lock.js";
-import { resolveSandboxRuntimeConfig, runInSandbox, SandboxRequiredError, } from "./sandbox-runtime.js";
+import { resolveSandboxRuntimeConfig, SandboxRequiredError, } from "./sandbox-runtime.js";
 /**
  * Normalize user path to a project-relative POSIX path.
  * Absolute paths are accepted only if they resolve inside projectRoot.
@@ -59,10 +60,6 @@ export function assertSafeRelativePath(userPath, projectRoot) {
     }
     return parts.join("/");
 }
-function shellSingleQuote(s) {
-    // Safe for sh single-quoted strings
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
 function createLock(projectRoot) {
     return new AtomicFileLock({
         projectRoot,
@@ -77,7 +74,7 @@ function hostWriteAtomic(absolutePath, content) {
         fs.mkdirSync(dir, { recursive: true });
     }
     // Write exact bytes (callers decide trailing newline — patch/replace need fidelity)
-    const tempPath = `${absolutePath}.${Math.random().toString(36).slice(2, 9)}.tmp`;
+    const tempPath = `${absolutePath}.${crypto.randomBytes(6).toString("hex")}.tmp`;
     try {
         fs.writeFileSync(tempPath, content, "utf8");
         fs.renameSync(tempPath, absolutePath);
@@ -92,57 +89,53 @@ function hostWriteAtomic(absolutePath, content) {
     }
 }
 /**
- * Write file content under project root using the active sandbox runtime.
+ * Reject writes whose real (symlink-resolved) path escapes the project root.
+ * Lexical checks alone are defeated by a symlink inside the project that
+ * points at e.g. ~/.ssh/authorized_keys.
+ */
+function assertRealPathInsideRoot(absolutePath, root) {
+    const realRoot = fs.existsSync(root) ? fs.realpathSync(root) : root;
+    let probe = absolutePath;
+    while (probe !== path.dirname(probe)) {
+        if (fs.existsSync(probe)) {
+            const real = fs.realpathSync(probe) + absolutePath.slice(probe.length);
+            if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
+                throw new Error(`[SANDBOX_FS] Symlink escape denied: "${absolutePath}"`);
+            }
+            return;
+        }
+        probe = path.dirname(probe);
+    }
+}
+/**
+ * Write file content under project root using the active local sandbox runtime.
  */
 export async function writeFileInSandbox(projectRoot, userPath, content, options) {
     const root = path.resolve(projectRoot);
     const relativePath = assertSafeRelativePath(userPath, root);
     const absolutePath = path.resolve(root, relativePath);
-    // Belt-and-suspenders: stay inside root
     if (!absolutePath.startsWith(root + path.sep) && absolutePath !== root) {
         throw new Error(`[SANDBOX_FS] Resolved path escapes project root: "${userPath}"`);
     }
+    assertRealPathInsideRoot(absolutePath, root);
     const cfg = resolveSandboxRuntimeConfig(root, options?.timeoutMs);
     if (cfg.required && cfg.effectiveMode === "none") {
-        throw new SandboxRequiredError("[SANDBOX_REQUIRED] File write blocked: no sandbox isolation available. " +
-            "Set ATABEY_SANDBOX_RUNTIME=container (Podman/Docker) or uid, or disable ATABEY_SANDBOX_REQUIRED.");
+        throw new SandboxRequiredError("[SANDBOX_REQUIRED] File write blocked: no OS sandbox isolation available. " +
+            "Set ATABEY_SANDBOX_RUNTIME=seatbelt or uid, or disable ATABEY_SANDBOX_REQUIRED.");
     }
     const owner = options?.ownerId || process.env.ATABEY_ACTIVE_AGENT || "mcp-writer";
     const lock = createLock(root);
-    const posixRel = relativePath.split(path.sep).join("/");
     return lock.withLock(relativePath, owner, async () => {
-        if (cfg.effectiveMode === "container" && cfg.engine !== "none") {
-            const dir = path.posix.dirname(posixRel);
-            const script = dir === "."
-                ? `cat > ${shellSingleQuote(posixRel)}`
-                : `mkdir -p ${shellSingleQuote(dir)} && cat > ${shellSingleQuote(posixRel)}`;
-            const result = await runInSandbox({
-                command: "sh",
-                args: ["-c", script],
-                projectRoot: root,
-                timeoutMs: options?.timeoutMs ?? cfg.timeoutMs,
-                stdin: content,
-            });
-            if (result.code !== 0) {
-                throw new Error(`[SANDBOX_FS] Container write failed (code ${result.code}): ${result.stderr || result.stdout}`.trim());
-            }
-            return {
-                absolutePath,
-                relativePath,
-                runtime: "container",
-                isolationLabel: result.isolationLabel,
-                bytes: Buffer.byteLength(content, "utf8"),
-            };
-        }
-        // uid | none — host write confined to project root
         hostWriteAtomic(absolutePath, content);
         return {
             absolutePath,
             relativePath,
             runtime: cfg.effectiveMode,
-            isolationLabel: cfg.effectiveMode === "uid"
-                ? "uid host write (project-bound)"
-                : "host write (project-bound)",
+            isolationLabel: cfg.effectiveMode === "seatbelt"
+                ? "seatbelt host write (project-bound)"
+                : cfg.effectiveMode === "uid"
+                    ? "uid host write (project-bound)"
+                    : "host write (project-bound)",
             bytes: Buffer.byteLength(content, "utf8"),
         };
     });

package/dist/sandbox-fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-fs.js","sourceRoot":"","sources":["../src/sandbox-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACH,2BAA2B,EAC3B,YAAY,EACZ,oBAAoB,GAEvB,MAAM,sBAAsB,CAAC;AAU9B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,WAAoB;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IAC/B,oCAAoC;IACpC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACnC,OAAO,IAAI,cAAc,CAAC;QACtB,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;QACpB,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,oFAAoF;IACpF,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACjF,IAAI,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,WAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,OAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,wCAAwC;IACxC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,yEAAyE;YACzE,kGAAkG,CACrG,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACjD,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,MAAM,GACR,GAAG,KAAK,GAAG;gBACP,CAAC,CAAC,SAAS,gBAAgB,CAAC,QAAQ,CAAC,EAAE;gBACvC,CAAC,CAAC,YAAY,gBAAgB,CAAC,GAAG,CAAC,aAAa,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAErF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAC9B,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;gBACpB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC,SAAS;gBAC9C,KAAK,EAAE,OAAO;aACjB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACX,6CAA6C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CACxG,CAAC;YACN,CAAC;YAED,OAAO;gBACH,YAAY;gBACZ,YAAY;gBACZ,OAAO,EAAE,WAAW;gBACpB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;aAC5C,CAAC;QACN,CAAC;QAED,mDAAmD;QACnD,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,OAAO,EAAE,GAAG,CAAC,aAAa;YAC1B,cAAc,EACV,GAAG,CAAC,aAAa,KAAK,KAAK;gBACvB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,4BAA4B;YACtC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;SAC5C,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"sandbox-fs.js","sourceRoot":"","sources":["../src/sandbox-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACH,2BAA2B,EAC3B,oBAAoB,GAEvB,MAAM,sBAAsB,CAAC;AAU9B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,WAAoB;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACnC,OAAO,IAAI,cAAc,CAAC;QACtB,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;QACpB,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,oFAAoF;IACpF,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,YAAoB,EAAE,IAAY;IAChE,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,KAAK,GAAG,YAAY,CAAC;IACzB,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO;QACX,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,WAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,OAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,4EAA4E;YAC5E,iFAAiF,CACpF,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACjD,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,OAAO,EAAE,GAAG,CAAC,aAAa;YAC1B,cAAc,EACV,GAAG,CAAC,aAAa,KAAK,UAAU;gBAC5B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,KAAK;oBACzB,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,4BAA4B;YAC1C,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;SAC5C,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/sandbox-runtime.d.ts

@@ -1,35 +1,25 @@
 /**
- * Sandbox Runtime — Phase 1.1 execution isolation for agent shell commands.
+ * Sandbox Runtime — Pure local OS process isolation for agent commands (Zero Docker/Container).
  *
  * Modes (ATABEY_SANDBOX_RUNTIME):
- *   none      — host spawn (legacy; allow-list only)
- *   uid       — host spawn with uid/gid drop (see sandbox.ts)
- *   container — Docker/Podman run with network=none, resource limits, project mount
- *   auto      — container if engine available, else uid if configured, else none
+ *   none      — host spawn (allow-list + env scrubbing)
+ *   uid       — host spawn with POSIX uid/gid drop (see sandbox.ts)
+ *   seatbelt  — macOS kernel sandbox (/usr/bin/sandbox-exec) confining writes to projectRoot
+ *               and denying network access by default
+ *   auto      — seatbelt if available on macOS, else uid if configured, else none
  *
- * Enterprise hardening:
+ * Hardening:
  *   ATABEY_SANDBOX_REQUIRED=true  → deny execution when isolation is effectively "none"
- *
- * Container defaults:
- *   ATABEY_SANDBOX_ENGINE=podman|docker|auto  (prefer podman, then docker)
- *   ATABEY_SANDBOX_IMAGE=node:20-bookworm-slim
- *   ATABEY_SANDBOX_MEMORY=512m
- *   ATABEY_SANDBOX_CPUS=1
- *   ATABEY_SANDBOX_PIDS=256
- *   ATABEY_SANDBOX_NETWORK=none
+ *   ATABEY_SANDBOX_NETWORK=none   → deny outbound/inbound network inside seatbelt (default: none)
  */
 import { resolveSandboxIdentity } from "./sandbox.js";
-export type SandboxRuntimeMode = "none" | "uid" | "container" | "auto";
-export type SandboxEngine = "podman" | "docker" | "none";
+export type SandboxRuntimeMode = "none" | "uid" | "seatbelt" | "auto";
+export type SandboxEngine = "seatbelt" | "none";
 export interface SandboxRuntimeConfig {
     mode: SandboxRuntimeMode;
     /** Resolved effective mode after auto detection. */
-    effectiveMode: "none" | "uid" | "container";
+    effectiveMode: "none" | "uid" | "seatbelt";
     engine: SandboxEngine;
-    image: string;
-    memory: string;
-    cpus: string;
-    pidsLimit: number;
     network: string;
     required: boolean;
     projectRoot: string;
@@ -41,7 +31,7 @@ export interface RunInSandboxRequest {
     projectRoot: string;
     timeoutMs?: number;
     env?: NodeJS.ProcessEnv;
-    /** Optional stdin payload (e.g. file content for container-mediated writes). */
+    /** Optional stdin payload. */
     stdin?: string | Buffer;
 }
 export interface RunInSandboxResult {
@@ -56,10 +46,12 @@ export interface RunInSandboxResult {
 export declare class SandboxRequiredError extends Error {
     constructor(message: string);
 }
+export declare const SEATBELT_BINARY = "/usr/bin/sandbox-exec";
+export declare function resolveDefaultSandboxRequired(_mode?: SandboxRuntimeMode): boolean;
 /**
- * Detect available container engine (cached).
+ * Detect available native OS sandbox engine (cached).
  */
-export declare function detectContainerEngine(): SandboxEngine;
+export declare function detectOsSandboxEngine(): SandboxEngine;
 /** Test helper */
 export declare function clearSandboxRuntimeCache(): void;
 /**
@@ -67,16 +59,17 @@ export declare function clearSandboxRuntimeCache(): void;
  */
 export declare function resolveSandboxRuntimeConfig(projectRoot: string, timeoutMs?: number): SandboxRuntimeConfig;
 /**
- * Build docker/podman argv for an isolated run.
- * Project is mounted at /workspace; command runs with -w /workspace.
+ * Build macOS Seatbelt (`/usr/bin/sandbox-exec`) SBPL profile and argv.
+ * Confines file writes strictly to `projectRoot` and OS temp directories,
+ * and denies network access when `cfg.network === "none"`.
  */
-export declare function buildContainerArgs(cfg: SandboxRuntimeConfig, command: string, args: string[]): string[];
+export declare function buildSeatbeltArgs(cfg: SandboxRuntimeConfig, command: string, args: string[]): string[];
 /**
- * Run a command under the configured sandbox runtime.
+ * Run a command under the configured local OS sandbox runtime.
  */
 export declare function runInSandbox(req: RunInSandboxRequest): Promise<RunInSandboxResult>;
 /**
- * Diagnostic snapshot for dashboard / CLI.
+ * Diagnostic snapshot for CLI.
  */
 export declare function getSandboxRuntimeStatus(projectRoot?: string): {
     config: SandboxRuntimeConfig;

package/dist/sandbox-runtime.js

@@ -1,33 +1,29 @@
 /**
- * Sandbox Runtime — Phase 1.1 execution isolation for agent shell commands.
+ * Sandbox Runtime — Pure local OS process isolation for agent commands (Zero Docker/Container).
  *
  * Modes (ATABEY_SANDBOX_RUNTIME):
- *   none      — host spawn (legacy; allow-list only)
- *   uid       — host spawn with uid/gid drop (see sandbox.ts)
- *   container — Docker/Podman run with network=none, resource limits, project mount
- *   auto      — container if engine available, else uid if configured, else none
+ *   none      — host spawn (allow-list + env scrubbing)
+ *   uid       — host spawn with POSIX uid/gid drop (see sandbox.ts)
+ *   seatbelt  — macOS kernel sandbox (/usr/bin/sandbox-exec) confining writes to projectRoot
+ *               and denying network access by default
+ *   auto      — seatbelt if available on macOS, else uid if configured, else none
  *
- * Enterprise hardening:
+ * Hardening:
  *   ATABEY_SANDBOX_REQUIRED=true  → deny execution when isolation is effectively "none"
- *
- * Container defaults:
- *   ATABEY_SANDBOX_ENGINE=podman|docker|auto  (prefer podman, then docker)
- *   ATABEY_SANDBOX_IMAGE=node:20-bookworm-slim
- *   ATABEY_SANDBOX_MEMORY=512m
- *   ATABEY_SANDBOX_CPUS=1
- *   ATABEY_SANDBOX_PIDS=256
- *   ATABEY_SANDBOX_NETWORK=none
+ *   ATABEY_SANDBOX_NETWORK=none   → deny outbound/inbound network inside seatbelt (default: none)
  */
 import { spawn, execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import { applySandboxToSpawnOptions, resolveSandboxIdentity, sandboxSpawn, } from "./sandbox.js";
+import { scrubEnvForSubprocess } from "./secrets.js";
 export class SandboxRequiredError extends Error {
     constructor(message) {
         super(message);
         this.name = "SandboxRequiredError";
     }
 }
+export const SEATBELT_BINARY = "/usr/bin/sandbox-exec";
 let cachedEngine = null;
 function envStr(key, fallback) {
     const v = process.env[key];
@@ -39,40 +35,53 @@ function envBool(key, fallback = false) {
         return fallback;
     return v === "true" || v === "1" || v === "yes";
 }
+let warnedDevUnsandboxed = false;
+export function resolveDefaultSandboxRequired(_mode = "auto") {
+    if (process.env.ATABEY_SANDBOX_REQUIRED !== undefined) {
+        return envBool("ATABEY_SANDBOX_REQUIRED", true);
+    }
+    if (envBool("ATABEY_ALLOW_UNSANDBOXED", false)) {
+        return false;
+    }
+    const profile = (process.env.ATABEY_PROFILE || "").toLowerCase();
+    if (process.env.NODE_ENV === "production" || profile === "enterprise") {
+        return true;
+    }
+    const isTestEnv = Boolean(process.env.VITEST) || process.env.NODE_ENV === "test";
+    if (isTestEnv) {
+        return false;
+    }
+    if (!warnedDevUnsandboxed) {
+        warnedDevUnsandboxed = true;
+        process.stderr.write("[SANDBOX] No isolation enforced (local dev). Set ATABEY_SANDBOX_REQUIRED=true " +
+            "to enforce OS process isolation (seatbelt/uid).\n");
+    }
+    return false;
+}
 /**
- * Detect available container engine (cached).
+ * Detect available native OS sandbox engine (cached).
  */
-export function detectContainerEngine() {
+export function detectOsSandboxEngine() {
     if (cachedEngine)
         return cachedEngine;
     const prefer = envStr("ATABEY_SANDBOX_ENGINE", "auto").toLowerCase();
-    const tryEngine = (name) => {
-        try {
-            execFileSync(name, ["--version"], {
-                encoding: "utf8",
-                timeout: 3000,
-                stdio: ["ignore", "pipe", "ignore"],
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    };
-    if (prefer === "podman" || prefer === "docker") {
-        cachedEngine = tryEngine(prefer) ? prefer : "none";
+    if (prefer === "none") {
+        cachedEngine = "none";
         return cachedEngine;
     }
-    if (tryEngine("podman")) {
-        cachedEngine = "podman";
+    try {
+        execFileSync(SEATBELT_BINARY, ["-p", "(version 1)(allow default)", "/usr/bin/true"], {
+            encoding: "utf8",
+            timeout: 3000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        cachedEngine = "seatbelt";
         return cachedEngine;
     }
-    if (tryEngine("docker")) {
-        cachedEngine = "docker";
+    catch {
+        cachedEngine = "none";
         return cachedEngine;
     }
-    cachedEngine = "none";
-    return cachedEngine;
 }
 /** Test helper */
 export function clearSandboxRuntimeCache() {
@@ -82,10 +91,13 @@ export function clearSandboxRuntimeCache() {
  * Resolve full runtime configuration for a project.
  */
 export function resolveSandboxRuntimeConfig(projectRoot, timeoutMs) {
-    const mode = (envStr("ATABEY_SANDBOX_RUNTIME", "auto").toLowerCase() || "auto");
-    const engine = detectContainerEngine();
+    const rawMode = envStr("ATABEY_SANDBOX_RUNTIME", "auto").toLowerCase() || "auto";
+    const mode = ["none", "uid", "seatbelt", "auto"].includes(rawMode)
+        ? rawMode
+        : "auto";
+    const engine = detectOsSandboxEngine();
     const identity = resolveSandboxIdentity();
-    const required = envBool("ATABEY_SANDBOX_REQUIRED", false);
+    const required = resolveDefaultSandboxRequired(mode);
     let effectiveMode;
     if (mode === "none") {
         effectiveMode = "none";
@@ -93,26 +105,22 @@ export function resolveSandboxRuntimeConfig(projectRoot, timeoutMs) {
     else if (mode === "uid") {
         effectiveMode = identity.enabled ? "uid" : "none";
     }
-    else if (mode === "container") {
-        effectiveMode = engine !== "none" ? "container" : "none";
+    else if (mode === "seatbelt") {
+        effectiveMode = engine === "seatbelt" ? "seatbelt" : "none";
     }
     else {
-        // auto
-        if (engine !== "none")
-            effectiveMode = "container";
+        // auto: prefer native OS seatbelt, then uid drop, else none
+        if (engine === "seatbelt")
+            effectiveMode = "seatbelt";
         else if (identity.enabled)
             effectiveMode = "uid";
         else
             effectiveMode = "none";
     }
     return {
-        mode: ["none", "uid", "container", "auto"].includes(mode) ? mode : "auto",
+        mode,
         effectiveMode,
-        engine,
-        image: envStr("ATABEY_SANDBOX_IMAGE", "node:20-bookworm-slim"),
-        memory: envStr("ATABEY_SANDBOX_MEMORY", "512m"),
-        cpus: envStr("ATABEY_SANDBOX_CPUS", "1"),
-        pidsLimit: parseInt(envStr("ATABEY_SANDBOX_PIDS", "256"), 10) || 256,
+        engine: effectiveMode === "seatbelt" ? "seatbelt" : "none",
         network: envStr("ATABEY_SANDBOX_NETWORK", "none"),
         required,
         projectRoot: path.resolve(projectRoot),
@@ -120,8 +128,8 @@ export function resolveSandboxRuntimeConfig(projectRoot, timeoutMs) {
     };
 }
 function isolationLabel(cfg) {
-    if (cfg.effectiveMode === "container") {
-        return `container/${cfg.engine} image=${cfg.image} network=${cfg.network} mem=${cfg.memory}`;
+    if (cfg.effectiveMode === "seatbelt") {
+        return `os/seatbelt network=${cfg.network} root=${cfg.projectRoot}`;
     }
     if (cfg.effectiveMode === "uid") {
         const id = resolveSandboxIdentity();
@@ -129,36 +137,41 @@ function isolationLabel(cfg) {
     }
     return "none (host process)";
 }
+function escapeSbplString(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
 /**
- * Build docker/podman argv for an isolated run.
- * Project is mounted at /workspace; command runs with -w /workspace.
+ * Build macOS Seatbelt (`/usr/bin/sandbox-exec`) SBPL profile and argv.
+ * Confines file writes strictly to `projectRoot` and OS temp directories,
+ * and denies network access when `cfg.network === "none"`.
  */
-export function buildContainerArgs(cfg, command, args) {
-    const root = cfg.projectRoot;
-    // Prefer :rw so installs/builds work; network still none by default
-    const mount = `${root}:/workspace:rw`;
-    const argv = [
-        "run",
-        "--rm",
-        "--network", cfg.network,
-        "--memory", cfg.memory,
-        "--cpus", cfg.cpus,
-        "--pids-limit", String(cfg.pidsLimit),
-        "-v", mount,
-        "-w", "/workspace",
-        // Drop ambient capabilities when supported (docker/podman)
-        "--security-opt", "no-new-privileges",
-    ];
-    // Optional: read-only root FS with writable tmp (stronger isolation)
-    if (envBool("ATABEY_SANDBOX_READ_ONLY_ROOT", false)) {
-        argv.push("--read-only", "--tmpfs", "/tmp:rw,noexec,nosuid,size=64m");
-    }
-    // Do not pass host secrets by default — empty env except PATH-ish via image
-    if (!envBool("ATABEY_SANDBOX_PASS_ENV", false)) {
-        argv.push("--env", "HOME=/tmp", "--env", "NPM_CONFIG_UPDATE_NOTIFIER=false");
-    }
-    argv.push(cfg.image, command, ...args);
-    return argv;
+export function buildSeatbeltArgs(cfg, command, args) {
+    const resolvedRoot = fs.existsSync(cfg.projectRoot)
+        ? fs.realpathSync(cfg.projectRoot)
+        : path.resolve(cfg.projectRoot);
+    const lexicalRoot = path.resolve(cfg.projectRoot);
+    const allowPaths = new Set([
+        resolvedRoot,
+        lexicalRoot,
+        "/tmp",
+        "/private/tmp",
+        "/var/folders",
+        "/private/var/folders",
+    ]);
+    const subpathRules = [...allowPaths]
+        .map((p) => `(subpath "${escapeSbplString(p)}")`)
+        .join(" ");
+    const netRule = cfg.network === "none" ? "(deny network*)" : "";
+    const profile = [
+        "(version 1)",
+        "(allow default)",
+        netRule,
+        '(deny file-write* (subpath "/"))',
+        `(allow file-write* ${subpathRules} (literal "/dev/null") (literal "/dev/zero") (literal "/dev/tty"))`,
+    ]
+        .filter(Boolean)
+        .join("");
+    return ["-p", profile, command, ...args];
 }
 function collectOutput(child, stdin) {
     return new Promise((resolve) => {
@@ -182,14 +195,14 @@ function collectOutput(child, stdin) {
     });
 }
 /**
- * Run a command under the configured sandbox runtime.
+ * Run a command under the configured local OS sandbox runtime.
  */
 export async function runInSandbox(req) {
     const cfg = resolveSandboxRuntimeConfig(req.projectRoot, req.timeoutMs);
     const label = isolationLabel(cfg);
     if (cfg.required && cfg.effectiveMode === "none") {
-        throw new SandboxRequiredError("[SANDBOX_REQUIRED] ATABEY_SANDBOX_REQUIRED=true but no isolation is available. " +
-            "Install Podman/Docker (ATABEY_SANDBOX_RUNTIME=container) or configure ATABEY_SANDBOX_UID/USER " +
+        throw new SandboxRequiredError("[SANDBOX_REQUIRED] ATABEY_SANDBOX_REQUIRED=true but no OS isolation is available. " +
+            "Use macOS seatbelt (ATABEY_SANDBOX_RUNTIME=seatbelt) or configure ATABEY_SANDBOX_UID/USER " +
             "(ATABEY_SANDBOX_RUNTIME=uid), or set ATABEY_SANDBOX_REQUIRED=false for local dev.");
     }
     if (!fs.existsSync(cfg.projectRoot)) {
@@ -200,30 +213,49 @@ export async function runInSandbox(req) {
         "pipe",
         "pipe",
     ];
-    if (cfg.effectiveMode === "container" && cfg.engine !== "none") {
-        const containerArgs = buildContainerArgs(cfg, req.command, req.args);
-        const child = spawn(cfg.engine, containerArgs, {
+    const baseEnv = req.env ?? process.env;
+    const childEnv = envBool("ATABEY_SANDBOX_PASS_ENV", false)
+        ? baseEnv
+        : scrubEnvForSubprocess(baseEnv);
+    if (!envBool("ATABEY_ALLOW_INTERACTIVE", false)) {
+        const nonInteractive = {
+            CI: "true",
+            DEBIAN_FRONTEND: "noninteractive",
+            GIT_TERMINAL_PROMPT: "0",
+            GIT_ASKPASS: "echo",
+            PAGER: "cat",
+            TERM: "dumb",
+            npm_config_yes: "true",
+            PIP_NO_INPUT: "1",
+        };
+        for (const [k, v] of Object.entries(nonInteractive)) {
+            if (childEnv[k] === undefined)
+                childEnv[k] = v;
+        }
+    }
+    if (cfg.effectiveMode === "seatbelt" && cfg.engine === "seatbelt") {
+        const seatbeltArgs = buildSeatbeltArgs(cfg, req.command, req.args);
+        const child = spawn(SEATBELT_BINARY, seatbeltArgs, {
             cwd: cfg.projectRoot,
             timeout: cfg.timeoutMs,
             shell: false,
             stdio,
-            env: req.env ?? process.env,
+            env: childEnv,
         });
         const result = await collectOutput(child, req.stdin);
         return {
             ...result,
-            runtime: "container",
-            engine: cfg.engine,
+            runtime: "seatbelt",
+            engine: "seatbelt",
             isolationLabel: label,
         };
     }
-    // uid or none — host spawn (uid options applied when available)
     const spawnOpts = {
         cwd: cfg.projectRoot,
         timeout: cfg.timeoutMs,
         shell: false,
         stdio,
-        env: req.env ?? process.env,
+        env: childEnv,
     };
     const child = cfg.effectiveMode === "uid"
         ? sandboxSpawn(req.command, req.args, spawnOpts)
@@ -237,7 +269,7 @@ export async function runInSandbox(req) {
     };
 }
 /**
- * Diagnostic snapshot for dashboard / CLI.
+ * Diagnostic snapshot for CLI.
  */
 export function getSandboxRuntimeStatus(projectRoot = process.cwd()) {
     const config = resolveSandboxRuntimeConfig(projectRoot);

package/dist/sandbox-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-runtime.js","sourceRoot":"","sources":["../src/sandbox-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAwC,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACH,0BAA0B,EAC1B,sBAAsB,EACtB,YAAY,GACf,MAAM,cAAc,CAAC;AAwCtB,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACvC,CAAC;CACJ;AAED,IAAI,YAAY,GAAyB,IAAI,CAAC;AAE9C,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,KAAK;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACjC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAErE,MAAM,SAAS,GAAG,CAAC,IAAyB,EAAW,EAAE;QACrD,IAAI,CAAC;YACD,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,YAAY,GAAG,QAAQ,CAAC;QACxB,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,YAAY,GAAG,QAAQ,CAAC;QACxB,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,YAAY,GAAG,MAAM,CAAC;IACtB,OAAO,YAAY,CAAC;AACxB,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,wBAAwB;IACpC,YAAY,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAkB;IAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAuB,CAAC;IACtG,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAE3D,IAAI,aAAoD,CAAC;IACzD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAClB,aAAa,GAAG,MAAM,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,aAAa,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;SAAM,CAAC;QACJ,OAAO;QACP,IAAI,MAAM,KAAK,MAAM;YAAE,aAAa,GAAG,WAAW,CAAC;aAC9C,IAAI,QAAQ,CAAC,OAAO;YAAE,aAAa,GAAG,KAAK,CAAC;;YAC5C,aAAa,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,OAAO;QACH,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACzE,aAAa;QACb,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;QAC9D,MAAM,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC;QACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG;QACpE,OAAO,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;QACjD,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,EAAE,EAAE,CAAC;KACtF,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,GAAyB;IAC7C,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,aAAa,GAAG,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,OAAO,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;QACpC,OAAO,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAC9B,GAAyB,EACzB,OAAe,EACf,IAAc;IAEd,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC;IAC7B,oEAAoE;IACpE,MAAM,KAAK,GAAG,GAAG,IAAI,gBAAgB,CAAC;IAEtC,MAAM,IAAI,GAAa;QACnB,KAAK;QACL,MAAM;QACN,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,UAAU,EAAE,GAAG,CAAC,MAAM;QACtB,QAAQ,EAAE,GAAG,CAAC,IAAI;QAClB,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,YAAY;QAClB,2DAA2D;QAC3D,gBAAgB,EAAE,mBAAmB;KACxC,CAAC;IAEF,qEAAqE;IACrE,IAAI,OAAO,CAAC,+BAA+B,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,kCAAkC,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAClB,KAAmB,EACnB,KAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAwB;IACvD,MAAM,GAAG,GAAG,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,iFAAiF;YACjF,gGAAgG;YAChG,mFAAmF,CACtF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAA0B;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,MAAM;KACT,CAAC;IAEF,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE;YAC3C,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACH,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,cAAc,EAAE,KAAK;SACxB,CAAC;IACN,CAAC;IAED,gEAAgE;IAChE,MAAM,SAAS,GAAiB;QAC5B,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,SAAS;QACtB,KAAK,EAAE,KAAK;QACZ,KAAK;QACL,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;KAC9B,CAAC;IAEF,MAAM,KAAK,GACP,GAAG,CAAC,aAAa,KAAK,KAAK;QACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO;QACH,GAAG,MAAM;QACT,OAAO,EAAE,GAAG,CAAC,aAAa;QAC1B,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,KAAK;KACxB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;IAK/D,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO;QACH,MAAM;QACN,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;QACtC,QAAQ,EAAE,sBAAsB,EAAE;KACrC,CAAC;AACN,CAAC"}
+{"version":3,"file":"sandbox-runtime.js","sourceRoot":"","sources":["../src/sandbox-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAwC,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACH,0BAA0B,EAC1B,sBAAsB,EACtB,YAAY,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoCrD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACvC,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEvD,IAAI,YAAY,GAAyB,IAAI,CAAC;AAE9C,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,KAAK;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AACpD,CAAC;AAED,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,6BAA6B,CAAC,QAA4B,MAAM;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IACjF,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxB,oBAAoB,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gFAAgF;YAChF,mDAAmD,CACtD,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACjC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAErE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,CAAC;QACD,YAAY,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,4BAA4B,EAAE,eAAe,CAAC,EAAE;YACjF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,YAAY,GAAG,UAAU,CAAC;QAC1B,OAAO,YAAY,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACL,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,YAAY,CAAC;IACxB,CAAC;AACL,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,wBAAwB;IACpC,YAAY,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAkB;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC;IACjF,MAAM,IAAI,GAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClF,CAAC,CAAE,OAA8B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,aAAoD,CAAC;IACzD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAClB,aAAa,GAAG,MAAM,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,aAAa,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC;SAAM,CAAC;QACJ,4DAA4D;QAC5D,IAAI,MAAM,KAAK,UAAU;YAAE,aAAa,GAAG,UAAU,CAAC;aACjD,IAAI,QAAQ,CAAC,OAAO;YAAE,aAAa,GAAG,KAAK,CAAC;;YAC5C,aAAa,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,OAAO;QACH,IAAI;QACJ,aAAa;QACb,MAAM,EAAE,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;QAC1D,OAAO,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;QACjD,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,EAAE,EAAE,CAAC;KACtF,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,GAAyB;IAC7C,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,uBAAuB,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,WAAW,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;QACpC,OAAO,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAyB,EACzB,OAAe,EACf,IAAc;IAEd,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;QAC/B,YAAY;QACZ,WAAW;QACX,MAAM;QACN,cAAc;QACd,cAAc;QACd,sBAAsB;KACzB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;SAChD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG;QACZ,aAAa;QACb,iBAAiB;QACjB,OAAO;QACP,kCAAkC;QAClC,sBAAsB,YAAY,oEAAoE;KACzG;SACI,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,EAAE,CAAC,CAAC;IAEd,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAClB,KAAmB,EACnB,KAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAwB;IACvD,MAAM,GAAG,GAAG,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,oFAAoF;YACpF,4FAA4F;YAC5F,mFAAmF,CACtF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAA0B;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,MAAM;KACT,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC;QACtD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAsB;YACtC,EAAE,EAAE,MAAM;YACV,eAAe,EAAE,gBAAgB;YACjC,mBAAmB,EAAE,GAAG;YACxB,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,GAAG;SACpB,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE;YAC/C,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,GAAG,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACH,GAAG,MAAM;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,UAAU;YAClB,cAAc,EAAE,KAAK;SACxB,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAAiB;QAC5B,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,SAAS;QACtB,KAAK,EAAE,KAAK;QACZ,KAAK;QACL,GAAG,EAAE,QAAQ;KAChB,CAAC;IAEF,MAAM,KAAK,GACP,GAAG,CAAC,aAAa,KAAK,KAAK;QACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO;QACH,GAAG,MAAM;QACT,OAAO,EAAE,GAAG,CAAC,aAAa;QAC1B,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,KAAK;KACxB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;IAK/D,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO;QACH,MAAM;QACN,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;QACtC,QAAQ,EAAE,sBAAsB,EAAE;KACrC,CAAC;AACN,CAAC"}

package/dist/sandbox.d.ts

@@ -42,7 +42,7 @@ export declare function applySandboxToSpawnOptions(options?: SandboxSpawnOptions
  */
 export declare function sandboxSpawn(command: string, args: readonly string[], options?: SandboxSpawnOptions): ChildProcess;
 /**
- * Human-readable status for dashboard / CLI diagnostics.
+ * Human-readable status for CLI diagnostics.
  */
 export declare function getSandboxStatus(): {
     platform: string;