atabey 0.0.37 → 0.1.0

package/dist/shared/src/modules/sandbox/sandbox-runtime.js

@@ -0,0 +1,282 @@
+/**
+ * Sandbox Runtime — Pure local OS process isolation for agent commands (Zero Docker/Container).
+ *
+ * Modes (ATABEY_SANDBOX_RUNTIME):
+ *   none      — host spawn (allow-list + env scrubbing)
+ *   uid       — host spawn with POSIX uid/gid drop (see sandbox.ts)
+ *   seatbelt  — macOS kernel sandbox (/usr/bin/sandbox-exec) confining writes to projectRoot
+ *               and denying network access by default
+ *   auto      — seatbelt if available on macOS, else uid if configured, else none
+ *
+ * Hardening:
+ *   ATABEY_SANDBOX_REQUIRED=true  → deny execution when isolation is effectively "none"
+ *   ATABEY_SANDBOX_NETWORK=none   → deny outbound/inbound network inside seatbelt (default: none)
+ */
+import { spawn, execFileSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import { applySandboxToSpawnOptions, resolveSandboxIdentity, sandboxSpawn, } from "./sandbox.js";
+import { scrubEnvForSubprocess } from "../security/secrets.js";
+export class SandboxRequiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SandboxRequiredError";
+    }
+}
+export const SEATBELT_BINARY = "/usr/bin/sandbox-exec";
+let cachedEngine = null;
+function envStr(key, fallback) {
+    const v = process.env[key];
+    return v && v.trim() ? v.trim() : fallback;
+}
+function envBool(key, fallback = false) {
+    const v = process.env[key];
+    if (v === undefined)
+        return fallback;
+    return v === "true" || v === "1" || v === "yes";
+}
+let warnedDevUnsandboxed = false;
+export function resolveDefaultSandboxRequired(_mode = "auto") {
+    if (process.env.ATABEY_SANDBOX_REQUIRED !== undefined) {
+        return envBool("ATABEY_SANDBOX_REQUIRED", true);
+    }
+    if (envBool("ATABEY_ALLOW_UNSANDBOXED", false)) {
+        return false;
+    }
+    const profile = (process.env.ATABEY_PROFILE || "").toLowerCase();
+    if (process.env.NODE_ENV === "production" || profile === "enterprise") {
+        return true;
+    }
+    const isTestEnv = Boolean(process.env.VITEST) || process.env.NODE_ENV === "test";
+    if (isTestEnv) {
+        return false;
+    }
+    if (!warnedDevUnsandboxed) {
+        warnedDevUnsandboxed = true;
+        process.stderr.write("[SANDBOX] No isolation enforced (local dev). Set ATABEY_SANDBOX_REQUIRED=true " +
+            "to enforce OS process isolation (seatbelt/uid).\n");
+    }
+    return false;
+}
+/**
+ * Detect available native OS sandbox engine (cached).
+ */
+export function detectOsSandboxEngine() {
+    if (cachedEngine)
+        return cachedEngine;
+    const prefer = envStr("ATABEY_SANDBOX_ENGINE", "auto").toLowerCase();
+    if (prefer === "none") {
+        cachedEngine = "none";
+        return cachedEngine;
+    }
+    try {
+        execFileSync(SEATBELT_BINARY, ["-p", "(version 1)(allow default)", "/usr/bin/true"], {
+            encoding: "utf8",
+            timeout: 3000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        cachedEngine = "seatbelt";
+        return cachedEngine;
+    }
+    catch {
+        cachedEngine = "none";
+        return cachedEngine;
+    }
+}
+/** Test helper */
+export function clearSandboxRuntimeCache() {
+    cachedEngine = null;
+}
+/**
+ * Resolve full runtime configuration for a project.
+ */
+export function resolveSandboxRuntimeConfig(projectRoot, timeoutMs) {
+    const rawMode = envStr("ATABEY_SANDBOX_RUNTIME", "auto").toLowerCase() || "auto";
+    const mode = ["none", "uid", "seatbelt", "auto"].includes(rawMode)
+        ? rawMode
+        : "auto";
+    const engine = detectOsSandboxEngine();
+    const identity = resolveSandboxIdentity();
+    const required = resolveDefaultSandboxRequired(mode);
+    let effectiveMode;
+    if (mode === "none") {
+        effectiveMode = "none";
+    }
+    else if (mode === "uid") {
+        effectiveMode = identity.enabled ? "uid" : "none";
+    }
+    else if (mode === "seatbelt") {
+        effectiveMode = engine === "seatbelt" ? "seatbelt" : "none";
+    }
+    else {
+        // auto: prefer native OS seatbelt, then uid drop, else none
+        if (engine === "seatbelt")
+            effectiveMode = "seatbelt";
+        else if (identity.enabled)
+            effectiveMode = "uid";
+        else
+            effectiveMode = "none";
+    }
+    return {
+        mode,
+        effectiveMode,
+        engine: effectiveMode === "seatbelt" ? "seatbelt" : "none",
+        network: envStr("ATABEY_SANDBOX_NETWORK", "none"),
+        required,
+        projectRoot: path.resolve(projectRoot),
+        timeoutMs: timeoutMs ?? parseInt(process.env.MCP_COMMAND_TIMEOUT_MS || "30000", 10),
+    };
+}
+function isolationLabel(cfg) {
+    if (cfg.effectiveMode === "seatbelt") {
+        return `os/seatbelt network=${cfg.network} root=${cfg.projectRoot}`;
+    }
+    if (cfg.effectiveMode === "uid") {
+        const id = resolveSandboxIdentity();
+        return `uid=${id.uid}${id.gid !== undefined ? ` gid=${id.gid}` : ""}`;
+    }
+    return "none (host process)";
+}
+function escapeSbplString(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+/**
+ * Build macOS Seatbelt (`/usr/bin/sandbox-exec`) SBPL profile and argv.
+ * Confines file writes strictly to `projectRoot` and OS temp directories,
+ * and denies network access when `cfg.network === "none"`.
+ */
+export function buildSeatbeltArgs(cfg, command, args) {
+    const resolvedRoot = fs.existsSync(cfg.projectRoot)
+        ? fs.realpathSync(cfg.projectRoot)
+        : path.resolve(cfg.projectRoot);
+    const lexicalRoot = path.resolve(cfg.projectRoot);
+    const allowPaths = new Set([
+        resolvedRoot,
+        lexicalRoot,
+        "/tmp",
+        "/private/tmp",
+        "/var/folders",
+        "/private/var/folders",
+    ]);
+    const subpathRules = [...allowPaths]
+        .map((p) => `(subpath "${escapeSbplString(p)}")`)
+        .join(" ");
+    const netRule = cfg.network === "none" ? "(deny network*)" : "";
+    const profile = [
+        "(version 1)",
+        "(allow default)",
+        netRule,
+        '(deny file-write* (subpath "/"))',
+        `(allow file-write* ${subpathRules} (literal "/dev/null") (literal "/dev/zero") (literal "/dev/tty"))`,
+    ]
+        .filter(Boolean)
+        .join("");
+    return ["-p", profile, command, ...args];
+}
+function collectOutput(child, stdin) {
+    return new Promise((resolve) => {
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (d) => { stdout += d.toString(); });
+        child.stderr?.on("data", (d) => { stderr += d.toString(); });
+        child.on("error", (err) => {
+            stderr += err.message;
+            resolve({ code: 1, stdout, stderr });
+        });
+        child.on("close", (code) => {
+            resolve({ code, stdout, stderr });
+        });
+        if (stdin !== undefined && child.stdin) {
+            child.stdin.end(stdin);
+        }
+        else if (child.stdin) {
+            child.stdin.end();
+        }
+    });
+}
+/**
+ * Run a command under the configured local OS sandbox runtime.
+ */
+export async function runInSandbox(req) {
+    const cfg = resolveSandboxRuntimeConfig(req.projectRoot, req.timeoutMs);
+    const label = isolationLabel(cfg);
+    if (cfg.required && cfg.effectiveMode === "none") {
+        throw new SandboxRequiredError("[SANDBOX_REQUIRED] ATABEY_SANDBOX_REQUIRED=true but no OS isolation is available. " +
+            "Use macOS seatbelt (ATABEY_SANDBOX_RUNTIME=seatbelt) or configure ATABEY_SANDBOX_UID/USER " +
+            "(ATABEY_SANDBOX_RUNTIME=uid), or set ATABEY_SANDBOX_REQUIRED=false for local dev.");
+    }
+    if (!fs.existsSync(cfg.projectRoot)) {
+        throw new Error(`[SANDBOX] Project root does not exist: ${cfg.projectRoot}`);
+    }
+    const stdio = [
+        req.stdin !== undefined ? "pipe" : "ignore",
+        "pipe",
+        "pipe",
+    ];
+    const baseEnv = req.env ?? process.env;
+    const childEnv = envBool("ATABEY_SANDBOX_PASS_ENV", false)
+        ? baseEnv
+        : scrubEnvForSubprocess(baseEnv);
+    if (!envBool("ATABEY_ALLOW_INTERACTIVE", false)) {
+        const nonInteractive = {
+            CI: "true",
+            DEBIAN_FRONTEND: "noninteractive",
+            GIT_TERMINAL_PROMPT: "0",
+            GIT_ASKPASS: "echo",
+            PAGER: "cat",
+            TERM: "dumb",
+            npm_config_yes: "true",
+            PIP_NO_INPUT: "1",
+        };
+        for (const [k, v] of Object.entries(nonInteractive)) {
+            if (childEnv[k] === undefined)
+                childEnv[k] = v;
+        }
+    }
+    if (cfg.effectiveMode === "seatbelt" && cfg.engine === "seatbelt") {
+        const seatbeltArgs = buildSeatbeltArgs(cfg, req.command, req.args);
+        const child = spawn(SEATBELT_BINARY, seatbeltArgs, {
+            cwd: cfg.projectRoot,
+            timeout: cfg.timeoutMs,
+            shell: false,
+            stdio,
+            env: childEnv,
+        });
+        const result = await collectOutput(child, req.stdin);
+        return {
+            ...result,
+            runtime: "seatbelt",
+            engine: "seatbelt",
+            isolationLabel: label,
+        };
+    }
+    const spawnOpts = {
+        cwd: cfg.projectRoot,
+        timeout: cfg.timeoutMs,
+        shell: false,
+        stdio,
+        env: childEnv,
+    };
+    const child = cfg.effectiveMode === "uid"
+        ? sandboxSpawn(req.command, req.args, spawnOpts)
+        : spawn(req.command, req.args, applySandboxToSpawnOptions({ ...spawnOpts, disableSandbox: true }));
+    const result = await collectOutput(child, req.stdin);
+    return {
+        ...result,
+        runtime: cfg.effectiveMode,
+        engine: "none",
+        isolationLabel: label,
+    };
+}
+/**
+ * Diagnostic snapshot for CLI.
+ */
+export function getSandboxRuntimeStatus(projectRoot = process.cwd()) {
+    const config = resolveSandboxRuntimeConfig(projectRoot);
+    return {
+        config,
+        isolationLabel: isolationLabel(config),
+        identity: resolveSandboxIdentity(),
+    };
+}
+//# sourceMappingURL=sandbox-runtime.js.map

package/dist/shared/src/modules/sandbox/sandbox-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-runtime.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/sandbox/sandbox-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAwC,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACH,0BAA0B,EAC1B,sBAAsB,EACtB,YAAY,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAoC/D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACvC,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEvD,IAAI,YAAY,GAAyB,IAAI,CAAC;AAE9C,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,KAAK;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AACpD,CAAC;AAED,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,6BAA6B,CAAC,QAA4B,MAAM;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IACjF,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxB,oBAAoB,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gFAAgF;YAChF,mDAAmD,CACtD,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACjC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAErE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,CAAC;QACD,YAAY,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,4BAA4B,EAAE,eAAe,CAAC,EAAE;YACjF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,YAAY,GAAG,UAAU,CAAC;QAC1B,OAAO,YAAY,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACL,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,YAAY,CAAC;IACxB,CAAC;AACL,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,wBAAwB;IACpC,YAAY,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAkB;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC;IACjF,MAAM,IAAI,GAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClF,CAAC,CAAE,OAA8B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,aAAoD,CAAC;IACzD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAClB,aAAa,GAAG,MAAM,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,aAAa,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC;SAAM,CAAC;QACJ,4DAA4D;QAC5D,IAAI,MAAM,KAAK,UAAU;YAAE,aAAa,GAAG,UAAU,CAAC;aACjD,IAAI,QAAQ,CAAC,OAAO;YAAE,aAAa,GAAG,KAAK,CAAC;;YAC5C,aAAa,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,OAAO;QACH,IAAI;QACJ,aAAa;QACb,MAAM,EAAE,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;QAC1D,OAAO,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;QACjD,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,EAAE,EAAE,CAAC;KACtF,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,GAAyB;IAC7C,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,uBAAuB,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,WAAW,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;QACpC,OAAO,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAyB,EACzB,OAAe,EACf,IAAc;IAEd,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;QAC/B,YAAY;QACZ,WAAW;QACX,MAAM;QACN,cAAc;QACd,cAAc;QACd,sBAAsB;KACzB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;SAChD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG;QACZ,aAAa;QACb,iBAAiB;QACjB,OAAO;QACP,kCAAkC;QAClC,sBAAsB,YAAY,oEAAoE;KACzG;SACI,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,EAAE,CAAC,CAAC;IAEd,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAClB,KAAmB,EACnB,KAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAwB;IACvD,MAAM,GAAG,GAAG,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,oFAAoF;YACpF,4FAA4F;YAC5F,mFAAmF,CACtF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAA0B;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,MAAM;KACT,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC;QACtD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAsB;YACtC,EAAE,EAAE,MAAM;YACV,eAAe,EAAE,gBAAgB;YACjC,mBAAmB,EAAE,GAAG;YACxB,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,GAAG;SACpB,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE;YAC/C,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,GAAG,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACH,GAAG,MAAM;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,UAAU;YAClB,cAAc,EAAE,KAAK;SACxB,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAAiB;QAC5B,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,SAAS;QACtB,KAAK,EAAE,KAAK;QACZ,KAAK;QACL,GAAG,EAAE,QAAQ;KAChB,CAAC;IAEF,MAAM,KAAK,GACP,GAAG,CAAC,aAAa,KAAK,KAAK;QACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO;QACH,GAAG,MAAM;QACT,OAAO,EAAE,GAAG,CAAC,aAAa;QAC1B,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,KAAK;KACxB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;IAK/D,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO;QACH,MAAM;QACN,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;QACtC,QAAQ,EAAE,sBAAsB,EAAE;KACrC,CAAC;AACN,CAAC"}

package/dist/shared/src/modules/sandbox/sandbox.d.ts

@@ -0,0 +1,54 @@
+/**
+ * OS-level subprocess isolation via uid/gid (no Docker required).
+ *
+ * On Unix, child_process.spawn accepts `uid` and `gid`. When configured,
+ * agent-triggered shell commands run as a restricted system user so that
+ * even a hallucinated destructive command hits EACCES / Permission Denied
+ * on protected paths.
+ *
+ * Windows: uid/gid are ignored; isolation is a no-op (allow-list still applies).
+ *
+ * Configuration (any of):
+ *   ATABEY_SANDBOX_UID=501
+ *   ATABEY_SANDBOX_GID=20
+ *   ATABEY_SANDBOX_USER=atabey-sandbox   (resolved via `id -u` / `id -g` when possible)
+ *   ATABEY_SANDBOX_ENABLED=true|false   (default: true when uid/gid resolvable)
+ */
+import { SpawnOptions, ChildProcess } from "child_process";
+export interface SandboxIdentity {
+    uid?: number;
+    gid?: number;
+    user?: string;
+    enabled: boolean;
+    /** Why sandbox is off (for diagnostics). */
+    reason?: string;
+}
+export interface SandboxSpawnOptions extends SpawnOptions {
+    /** Force-disable sandbox for this call. */
+    disableSandbox?: boolean;
+}
+/**
+ * Resolve sandbox identity from env (cached).
+ * Call `clearSandboxIdentityCache()` in tests after env changes.
+ */
+export declare function resolveSandboxIdentity(): SandboxIdentity;
+export declare function clearSandboxIdentityCache(): void;
+/**
+ * Build spawn options with uid/gid when sandbox is active.
+ */
+export declare function applySandboxToSpawnOptions(options?: SandboxSpawnOptions): SpawnOptions;
+/**
+ * spawn() wrapper that applies OS sandbox identity when configured.
+ */
+export declare function sandboxSpawn(command: string, args: readonly string[], options?: SandboxSpawnOptions): ChildProcess;
+/**
+ * Human-readable status for CLI diagnostics.
+ */
+export declare function getSandboxStatus(): {
+    platform: string;
+    identity: SandboxIdentity;
+    processUid: number | null;
+    processGid: number | null;
+};
+/** Default restricted paths agents should not touch even with shell allow-list. */
+export declare const SANDBOX_PROTECTED_HINTS: readonly ["/etc", "/usr", "/bin", "/sbin", "/System", string];

package/dist/shared/src/modules/sandbox/sandbox.js

@@ -0,0 +1,179 @@
+/**
+ * OS-level subprocess isolation via uid/gid (no Docker required).
+ *
+ * On Unix, child_process.spawn accepts `uid` and `gid`. When configured,
+ * agent-triggered shell commands run as a restricted system user so that
+ * even a hallucinated destructive command hits EACCES / Permission Denied
+ * on protected paths.
+ *
+ * Windows: uid/gid are ignored; isolation is a no-op (allow-list still applies).
+ *
+ * Configuration (any of):
+ *   ATABEY_SANDBOX_UID=501
+ *   ATABEY_SANDBOX_GID=20
+ *   ATABEY_SANDBOX_USER=atabey-sandbox   (resolved via `id -u` / `id -g` when possible)
+ *   ATABEY_SANDBOX_ENABLED=true|false   (default: true when uid/gid resolvable)
+ */
+import { spawn } from "child_process";
+import { execFileSync } from "child_process";
+import os from "os";
+let cachedIdentity = null;
+function parseUint(value) {
+    if (value === undefined || value === "")
+        return undefined;
+    const n = Number.parseInt(value, 10);
+    if (!Number.isFinite(n) || n < 0)
+        return undefined;
+    return n;
+}
+function resolveUserIds(username) {
+    if (process.platform === "win32")
+        return {};
+    try {
+        const uidRaw = execFileSync("id", ["-u", username], {
+            encoding: "utf8",
+            timeout: 2000,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        const gidRaw = execFileSync("id", ["-g", username], {
+            encoding: "utf8",
+            timeout: 2000,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return {
+            uid: parseUint(uidRaw),
+            gid: parseUint(gidRaw),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Resolve sandbox identity from env (cached).
+ * Call `clearSandboxIdentityCache()` in tests after env changes.
+ */
+export function resolveSandboxIdentity() {
+    if (cachedIdentity)
+        return cachedIdentity;
+    if (process.platform === "win32") {
+        cachedIdentity = {
+            enabled: false,
+            reason: "uid/gid isolation is not available on Windows",
+        };
+        return cachedIdentity;
+    }
+    const explicitOff = process.env.ATABEY_SANDBOX_ENABLED === "false" ||
+        process.env.ATABEY_SANDBOX_ENABLED === "0";
+    if (explicitOff) {
+        cachedIdentity = { enabled: false, reason: "ATABEY_SANDBOX_ENABLED=false" };
+        return cachedIdentity;
+    }
+    let uid = parseUint(process.env.ATABEY_SANDBOX_UID);
+    let gid = parseUint(process.env.ATABEY_SANDBOX_GID);
+    const user = process.env.ATABEY_SANDBOX_USER?.trim() || undefined;
+    if (user && (uid === undefined || gid === undefined)) {
+        const resolved = resolveUserIds(user);
+        uid = uid ?? resolved.uid;
+        gid = gid ?? resolved.gid;
+    }
+    // Never drop privileges to root (0) — that would be a no-op or worse
+    if (uid === 0) {
+        cachedIdentity = {
+            enabled: false,
+            reason: "ATABEY_SANDBOX_UID=0 (root) is refused",
+            uid,
+            gid,
+            user,
+        };
+        return cachedIdentity;
+    }
+    if (uid === undefined) {
+        // Optional: if current process is already non-root and no sandbox user
+        // configured, we leave sandbox disabled rather than inventing a user.
+        cachedIdentity = {
+            enabled: false,
+            reason: "No ATABEY_SANDBOX_UID / ATABEY_SANDBOX_USER configured — shell runs as current user",
+            user,
+        };
+        return cachedIdentity;
+    }
+    // Dropping privileges only works if we are root (or have CAP_SETUID).
+    // If we are a normal user with a different target uid, spawn will fail —
+    // detect and warn via reason, still pass options (caller sees Permission error).
+    const canSetUid = typeof process.getuid === "function" && process.getuid() === 0;
+    if (!canSetUid && typeof process.getuid === "function" && process.getuid() !== uid) {
+        cachedIdentity = {
+            enabled: false,
+            uid,
+            gid,
+            user,
+            reason: `Sandbox uid=${uid} requested but process uid=${process.getuid()} is not root; ` +
+                `setuid will fail. Run MCP as root with a dedicated sandbox user, or unset sandbox env.`,
+        };
+        return cachedIdentity;
+    }
+    cachedIdentity = {
+        enabled: true,
+        uid,
+        gid,
+        user,
+    };
+    return cachedIdentity;
+}
+export function clearSandboxIdentityCache() {
+    cachedIdentity = null;
+}
+/**
+ * Build spawn options with uid/gid when sandbox is active.
+ */
+export function applySandboxToSpawnOptions(options = {}) {
+    const { disableSandbox, ...rest } = options;
+    if (disableSandbox)
+        return { ...rest };
+    const identity = resolveSandboxIdentity();
+    if (!identity.enabled || identity.uid === undefined) {
+        return { ...rest };
+    }
+    return {
+        ...rest,
+        uid: identity.uid,
+        ...(identity.gid !== undefined ? { gid: identity.gid } : {}),
+    };
+}
+/**
+ * spawn() wrapper that applies OS sandbox identity when configured.
+ */
+export function sandboxSpawn(command, args, options = {}) {
+    const opts = applySandboxToSpawnOptions(options);
+    return spawn(command, args, opts);
+}
+/**
+ * Human-readable status for CLI diagnostics.
+ */
+export function getSandboxStatus() {
+    return {
+        platform: process.platform,
+        identity: resolveSandboxIdentity(),
+        processUid: typeof process.getuid === "function" ? process.getuid() : null,
+        processGid: typeof process.getgid === "function" ? process.getgid() : null,
+    };
+}
+/** Default restricted paths agents should not touch even with shell allow-list. */
+export const SANDBOX_PROTECTED_HINTS = [
+    "/etc",
+    "/usr",
+    "/bin",
+    "/sbin",
+    "/System",
+    pathHomeDotSsh(),
+];
+function pathHomeDotSsh() {
+    try {
+        return `${os.homedir()}/.ssh`;
+    }
+    catch {
+        return "~/.ssh";
+    }
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/shared/src/modules/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAA8B,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,MAAM,IAAI,CAAC;AAgBpB,IAAI,cAAc,GAA2B,IAAI,CAAC;AAElD,SAAS,SAAS,CAAC,KAAyB;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;YAChD,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;YAChD,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACH,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC;SACzB,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IAClC,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,cAAc,GAAG;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+CAA+C;SAC1D,CAAC;QACF,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,MAAM,WAAW,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,OAAO;QAC9C,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QACd,cAAc,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC5E,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,IAAI,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAElE,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,GAAG,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC;QAC1B,GAAG,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACZ,cAAc,GAAG;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,wCAAwC;YAChD,GAAG;YACH,GAAG;YACH,IAAI;SACP,CAAC;QACF,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,uEAAuE;QACvE,sEAAsE;QACtE,cAAc,GAAG;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EACF,qFAAqF;YACzF,IAAI;SACP,CAAC;QACF,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjF,IAAI,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;QACjF,cAAc,GAAG;YACb,OAAO,EAAE,KAAK;YACd,GAAG;YACH,GAAG;YACH,IAAI;YACJ,MAAM,EACF,eAAe,GAAG,8BAA8B,OAAO,CAAC,MAAM,EAAE,gBAAgB;gBAChF,wFAAwF;SAC/F,CAAC;QACF,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,cAAc,GAAG;QACb,OAAO,EAAE,IAAI;QACb,GAAG;QACH,GAAG;QACH,IAAI;KACP,CAAC;IACF,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,cAAc,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA+B,EAAE;IACxE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC5C,IAAI,cAAc;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,OAAO;QACH,GAAG,IAAI;QACP,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CACxB,OAAe,EACf,IAAuB,EACvB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAM5B,OAAO;QACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,sBAAsB,EAAE;QAClC,UAAU,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QAC1E,UAAU,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;KAC7E,CAAC;AACN,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACnC,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT,cAAc,EAAE;CACV,CAAC;AAEX,SAAS,cAAc;IACnB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;AACL,CAAC"}

package/dist/shared/src/modules/security/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./pii.js";
+export * from "./secrets.js";
+export * from "./tls.js";
+export * from "./policy-gate.js";
+export * from "./retention.js";

package/dist/shared/src/modules/security/index.js

@@ -0,0 +1,6 @@
+export * from "./pii.js";
+export * from "./secrets.js";
+export * from "./tls.js";
+export * from "./policy-gate.js";
+export * from "./retention.js";
+//# sourceMappingURL=index.js.map

package/dist/shared/src/modules/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC"}

package/dist/shared/src/modules/security/pii.d.ts

@@ -0,0 +1,70 @@
+/**
+ * [PII] Personally Identifiable Information Masking Service
+ *
+ * Detects and masks sensitive data in compliance with KVKK/GDPR.
+ * Used in audit log, logger, storage layers, and MCP middleware.
+ *
+ * Supported patterns:
+ * - Email addresses
+ * - Phone numbers (international, Turkish, US, UK)
+ * - TC Identification number (11 digits)
+ * - API keys / tokens (OpenAI, Anthropic, Google, GitHub, generic)
+ * - Bearer tokens / JWTs
+ * - IP addresses (IPv4, IPv6)
+ * - Credit card numbers (AMEX, Visa, Mastercard, etc.)
+ * - Password / secret fields in structured data
+ * - Bank account / IBAN
+ * - Date of birth / full address patterns
+ * - Custom names (configurable)
+ */
+/**
+ * Mask sensitive data in a text string.
+ */
+export declare function maskText(text: string): string;
+/**
+ * Recursively mask sensitive fields in an object.
+ * Returns a new object with sensitive values redacted.
+ * Strict mode: when true, also masks values in objects even if the key
+ * is not a known sensitive field name (catches data passed to unknown schemas).
+ */
+export declare function maskObject(obj: unknown, depth?: number, strictMode?: boolean): unknown;
+/**
+ * Check if a string contains potential PII.
+ * Useful for warning before sending data to external APIs.
+ */
+export declare function containsPII(text: string): boolean;
+/**
+ * Check if an object contains PII in any of its string values (recursive).
+ */
+export declare function containsPIIInObject(obj: unknown, depth?: number): boolean;
+/**
+ * Data classification levels for audit/log decisions.
+ */
+export type DataClassification = "public" | "internal" | "confidential" | "restricted" | "critical";
+/**
+ * Classify a piece of data based on content analysis.
+ */
+export declare function classifyData(text: string): DataClassification;
+/**
+ * Mask the content field of an MCP tool result.
+ * This is used by the MCP middleware layer to automatically
+ * sanitize all tool outputs before they reach the AI.
+ */
+export declare function maskToolResult(result: {
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+}): {
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+};
+/**
+ * Mask sensitive arguments in an MCP tool call.
+ * This is applied BEFORE the tool handler executes, ensuring
+ * PII never reaches any processing layer unnecessarily.
+ */
+export declare function maskToolArgs(args: Record<string, unknown>): Record<string, unknown>;
+export declare function shouldBypassPiiMaskingForPath(filePath?: string): boolean;