botmux 3.5.0 → 3.5.2

package/dist/dashboard/bot-payload.d.ts

@@ -30,6 +30,11 @@ export declare function botDefaultsPayload(bot: DashboardBotDescriptor, j?: any,
     autoboundChatCount: any;
     brandLabel: any;
     sandbox: boolean;
+    sandboxPaths: {
+        readWrite: any;
+        readOnly: any;
+        deny: any;
+    } | null;
     readIsolation: boolean;
     readIsolationSupported: boolean;
     backendType: any;

package/dist/dashboard/bot-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bot-payload.d.ts","sourceRoot":"","sources":["../../src/dashboard/bot-payload.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,sBAAsB;;;;;EAO5D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEtF"}
+{"version":3,"file":"bot-payload.d.ts","sourceRoot":"","sources":["../../src/dashboard/bot-payload.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,sBAAsB;;;;;EAO5D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuEtF"}

package/dist/dashboard/bot-payload.js

@@ -35,6 +35,13 @@ export function botDefaultsPayload(bot, j, error) {
         autoboundChatCount: j?.autoboundChatCount ?? 0,
         brandLabel: j?.brandLabel ?? null,
         sandbox: j?.sandbox === true,
+        sandboxPaths: (j?.sandboxPaths && typeof j.sandboxPaths === 'object' && !Array.isArray(j.sandboxPaths))
+            ? {
+                readWrite: Array.isArray(j.sandboxPaths.readWrite) ? j.sandboxPaths.readWrite.filter((x) => typeof x === 'string') : [],
+                readOnly: Array.isArray(j.sandboxPaths.readOnly) ? j.sandboxPaths.readOnly.filter((x) => typeof x === 'string') : [],
+                deny: Array.isArray(j.sandboxPaths.deny) ? j.sandboxPaths.deny.filter((x) => typeof x === 'string') : [],
+            }
+            : null,
         readIsolation: j?.readIsolation === true,
         readIsolationSupported: j?.readIsolationSupported === true,
         backendType: typeof j?.backendType === 'string' ? j.backendType : null,

package/dist/dashboard/bot-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"bot-payload.js","sourceRoot":"","sources":["../../src/dashboard/bot-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AACrH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAW/D,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAA2B,EAAE,CAAO,EAAE,KAAc;IACrF,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,wDAAwD;QACxD,qDAAqD;QACrD,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,IAAI;QACP,8CAA8C;QAC9C,iDAAiD;QACjD,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,aAAa,EAAE,CAAC,EAAE,aAAa;QAC/B,iBAAiB,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;QACxF,6BAA6B,EAAE,CAAC,EAAE,6BAA6B,KAAK,IAAI;QACxE,kBAAkB,EAAE,CAAC,EAAE,kBAAkB,IAAI,CAAC;QAC9C,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI;QACjC,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI;QAC5B,aAAa,EAAE,CAAC,EAAE,aAAa,KAAK,IAAI;QACxC,sBAAsB,EAAE,CAAC,EAAE,sBAAsB,KAAK,IAAI;QAC1D,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,oBAAoB,EAAE,CAAC,EAAE,oBAAoB,KAAK,IAAI;QACtD,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,KAAK,IAAI;QACpD,kBAAkB,EAAE,CAAC,EAAE,kBAAkB,KAAK,IAAI;QAClD,0BAA0B,EAAE,CAAC,EAAE,0BAA0B,KAAK,IAAI;QAClE,WAAW,EAAE,CAAC,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,CAAC,EAAE,eAAe,KAAK,KAAK;QAC7C,oBAAoB,EAAE,CAAC,EAAE,oBAAoB,KAAK,IAAI;QACtD,0BAA0B,EAAE,OAAO,CAAC,EAAE,0BAA0B,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE;QACjH,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,KAAK,IAAI;QACpD,YAAY,EAAE,CAAC,EAAE,YAAY;eACxB,qCAAqC,CAAC,CAAC,EAAE,eAAe,CAAC;eACzD,wBAAwB,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,WAAW,IAAI,CAAC,EAAE,qBAAqB,KAAK,QAAQ,IAAI,CAAC,EAAE,qBAAqB,KAAK,YAAY,CAAC;YACrJ,CAAC,CAAC,CAAC,CAAC,qBAAqB;YACzB,CAAC,CAAC,MAAM;QACV,uBAAuB,EAAE,CAAC,CAAC,EAAE,uBAAuB,KAAK,OAAO,IAAI,CAAC,EAAE,uBAAuB,KAAK,OAAO,IAAI,CAAC,EAAE,uBAAuB,KAAK,SAAS,CAAC;YACrJ,CAAC,CAAC,CAAC,CAAC,uBAAuB;YAC3B,CAAC,CAAC,QAAQ;QACZ,cAAc,EAAE,CAAC,EAAE,cAAc,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACnG,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,KAAK,IAAI;QACxD,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,KAAK,KAAK;QACzD,wBAAwB,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAClD,cAAc,EAAE,CAAC,CAAC,EAAE,cAAc,KAAK,QAAQ,IAAI,CAAC,EAAE,cAAc,KAAK,QAAQ,IAAI,CAAC,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC3I,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,QAAQ,IAAI,CAAC,EAAE,qBAAqB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ;QACzI,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,SAAS,IAAI,CAAC,EAAE,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM;QAC3I,cAAc,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC/E,mBAAmB,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3F,oBAAoB,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC9F,mBAAmB,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3F,eAAe,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QAChF,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC5C,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3D,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACpE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bot-payload.js","sourceRoot":"","sources":["../../src/dashboard/bot-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AACrH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAW/D,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAA2B,EAAE,CAAO,EAAE,KAAc;IACrF,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,wDAAwD;QACxD,qDAAqD;QACrD,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,IAAI;QACP,8CAA8C;QAC9C,iDAAiD;QACjD,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,aAAa,EAAE,CAAC,EAAE,aAAa;QAC/B,iBAAiB,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;QACxF,6BAA6B,EAAE,CAAC,EAAE,6BAA6B,KAAK,IAAI;QACxE,kBAAkB,EAAE,CAAC,EAAE,kBAAkB,IAAI,CAAC;QAC9C,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI;QACjC,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI;QAC5B,YAAY,EAAE,CAAC,CAAC,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACrG,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;gBAChI,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC7H,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;aAClH;YACH,CAAC,CAAC,IAAI;QACR,aAAa,EAAE,CAAC,EAAE,aAAa,KAAK,IAAI;QACxC,sBAAsB,EAAE,CAAC,EAAE,sBAAsB,KAAK,IAAI;QAC1D,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACtE,oBAAoB,EAAE,CAAC,EAAE,oBAAoB,KAAK,IAAI;QACtD,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,KAAK,IAAI;QACpD,kBAAkB,EAAE,CAAC,EAAE,kBAAkB,KAAK,IAAI;QAClD,0BAA0B,EAAE,CAAC,EAAE,0BAA0B,KAAK,IAAI;QAClE,WAAW,EAAE,CAAC,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,CAAC,EAAE,eAAe,KAAK,KAAK;QAC7C,oBAAoB,EAAE,CAAC,EAAE,oBAAoB,KAAK,IAAI;QACtD,0BAA0B,EAAE,OAAO,CAAC,EAAE,0BAA0B,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE;QACjH,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,KAAK,IAAI;QACpD,YAAY,EAAE,CAAC,EAAE,YAAY;eACxB,qCAAqC,CAAC,CAAC,EAAE,eAAe,CAAC;eACzD,wBAAwB,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,WAAW,IAAI,CAAC,EAAE,qBAAqB,KAAK,QAAQ,IAAI,CAAC,EAAE,qBAAqB,KAAK,YAAY,CAAC;YACrJ,CAAC,CAAC,CAAC,CAAC,qBAAqB;YACzB,CAAC,CAAC,MAAM;QACV,uBAAuB,EAAE,CAAC,CAAC,EAAE,uBAAuB,KAAK,OAAO,IAAI,CAAC,EAAE,uBAAuB,KAAK,OAAO,IAAI,CAAC,EAAE,uBAAuB,KAAK,SAAS,CAAC;YACrJ,CAAC,CAAC,CAAC,CAAC,uBAAuB;YAC3B,CAAC,CAAC,QAAQ;QACZ,cAAc,EAAE,CAAC,EAAE,cAAc,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACnG,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,KAAK,IAAI;QACxD,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,KAAK,KAAK;QACzD,wBAAwB,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAClD,cAAc,EAAE,CAAC,CAAC,EAAE,cAAc,KAAK,QAAQ,IAAI,CAAC,EAAE,cAAc,KAAK,QAAQ,IAAI,CAAC,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC3I,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,QAAQ,IAAI,CAAC,EAAE,qBAAqB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ;QACzI,qBAAqB,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,SAAS,IAAI,CAAC,EAAE,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM;QAC3I,cAAc,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC/E,mBAAmB,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3F,oBAAoB,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC9F,mBAAmB,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3F,eAAe,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QAChF,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC5C,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3D,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACpE,CAAC;AACJ,CAAC"}

package/dist/dashboard/web/bot-defaults-page.d.ts

@@ -38,6 +38,22 @@ export declare function BotAgentSection(props: {
     cliState: CliOptionsState;
     patchBot: PatchBot;
 }): import("react").JSX.Element;
+type SandboxTier = 'readWrite' | 'readOnly' | 'deny';
+type SandboxTiers = {
+    readWrite: string[];
+    readOnly: string[];
+    deny: string[];
+};
+/** Effective access for `path` under the three tiers: DEEPEST (longest-prefix)
+ *  matching rule wins; at equal depth (same path across tiers) the MORE
+ *  RESTRICTIVE tier wins — mirrors fs-policy.ts accessForPath + mergeFsRules so
+ *  the UI's live labels + path tester agree with what the sandbox enforces.
+ *  `home` expands a leading `~` the same way the worker does before matching, so
+ *  recommendation entries like `~/.claude` line up with absolute tree nodes. */
+export declare function effectiveAccess(tiers: SandboxTiers, path: string, home: string): {
+    access: SandboxTier | 'none';
+    rule?: string;
+};
 export declare function CodexAppDisplaySection(props: {
     bot: BotDefaultsRow;
     putCardPref(patch: CardPrefPatch): Promise<JsonResponse>;

package/dist/dashboard/web/bot-defaults-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bot-defaults-page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/web/bot-defaults-page.tsx"],"names":[],"mappings":"AAEA,OAAO,EAYL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAerE,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,KAAK,cAAc,CAAC,KAAK,IAAI,CAAC;AACpH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AAEtD,KAAK,YAAY,GAAG;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC;CACX,CAAC;AAyIF,KAAK,uBAAuB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzE,KAAK,qBAAqB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,OAAO,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC;CACH,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC,GACjG,mBAAmB,GAAG,IAAI,CAc5B;AAqCD,wBAAgB,eAAe,gCAsK9B;AAifD,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,GAAG,EAAE,cAAc,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;CACpB,+BAkOA;AAujBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,+BA8C9H;AAmrCD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,YAAY,CAErE"}
+{"version":3,"file":"bot-defaults-page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/web/bot-defaults-page.tsx"],"names":[],"mappings":"AAEA,OAAO,EAYL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAerE,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,KAAK,cAAc,CAAC,KAAK,IAAI,CAAC;AACpH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AAEtD,KAAK,YAAY,GAAG;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC;CACX,CAAC;AAyIF,KAAK,uBAAuB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzE,KAAK,qBAAqB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,OAAO,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC;CACH,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC,GACjG,mBAAmB,GAAG,IAAI,CAc5B;AAqCD,wBAAgB,eAAe,gCAsK9B;AAkfD,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,GAAG,EAAE,cAAc,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;CACpB,+BAkOA;AAkPD,KAAK,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AACrD,KAAK,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAMhF;;;;;gFAKgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAsBhI;AAskBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,+BA8C9H;AAmrCD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,YAAY,CAErE"}

package/dist/dashboard/web/bot-defaults-page.js

@@ -273,7 +273,7 @@ function BotDefaultsCard(props) {
         return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(Html, { html: botAvatarHtml({ name, larkAppId: bot.larkAppId }) }), _jsxs("div", { className: "bd-profile-id", children: [_jsx("strong", { children: name }), _jsx("code", { children: bot.larkAppId })] })] }), _jsxs("p", { className: "hint-warn-inline", children: ["\u67E5\u8BE2\u5931\u8D25\uFF1A", bot.error] })] }));
     }
     const def = bot.defaultOncall ?? { enabled: false, workingDir: '', since: 0 };
-    return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(BotAvatarControl, { bot: bot, name: name, patchBot: patchBot }), _jsx("div", { className: "bd-profile-main", children: _jsx(BotProfileIdentity, { bot: bot, cli: cli, patchBot: patchBot, meta: (_jsxs(_Fragment, { children: [_jsxs("small", { className: "bd-meta-ok", children: ["\u25CF ", tr('botDefaults.metaOnline')] }), _jsxs("small", { "data-oncall-since": true, children: [tr('botDefaults.lastEnabled'), ": ", fmtSince(def.since ?? 0)] }), _jsx("small", { children: tr('botDefaults.autobound', { count: bot.autoboundChatCount ?? 0 }) })] })) }) })] }), _jsxs("div", { className: "bd-body bd-grid", children: [_jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(BotAgentSection, { bot: bot, sessionFallback: cli, cliState: cliState, patchBot: patchBot }), _jsx(WorkingDirSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), bot.cliId !== 'riff' && _jsx(SandboxSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && _jsx(BackendTypeSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RuntimeEnvironmentSection, { bot: bot, patchBot: patchBot }) }), _jsx("section", { className: "bd-tile", children: _jsx(GrantSection, { bot: bot, patchBot: patchBot }) })] }), _jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(SessionModeSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), _jsx(SubstituteModeSection, { bot: bot, patchBot: patchBot }), _jsx(CrossBotSection, { bot: bot, putCardPref: putCardPref }), _jsx(SessionCapSection, { bot: bot, patchBot: patchBot })] }), _jsxs("section", { className: "bd-tile", children: [_jsx(CardBehaviorSection, { bot: bot, putCardPref: putCardPref }), _jsx(CodexAppDisplaySection, { bot: bot, putCardPref: putCardPref }), _jsx(SummaryTriggerSection, { bot: bot, patchBot: patchBot }), _jsx(BrandSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RoleSection, { bot: bot, patchBot: patchBot }) })] })] })] }));
+    return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(BotAvatarControl, { bot: bot, name: name, patchBot: patchBot }), _jsx("div", { className: "bd-profile-main", children: _jsx(BotProfileIdentity, { bot: bot, cli: cli, patchBot: patchBot, meta: (_jsxs(_Fragment, { children: [_jsxs("small", { className: "bd-meta-ok", children: ["\u25CF ", tr('botDefaults.metaOnline')] }), _jsxs("small", { "data-oncall-since": true, children: [tr('botDefaults.lastEnabled'), ": ", fmtSince(def.since ?? 0)] }), _jsx("small", { children: tr('botDefaults.autobound', { count: bot.autoboundChatCount ?? 0 }) })] })) }) })] }), _jsxs("div", { className: "bd-body bd-grid", children: [_jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(BotAgentSection, { bot: bot, sessionFallback: cli, cliState: cliState, patchBot: patchBot }), _jsx(WorkingDirSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), bot.cliId !== 'riff' && _jsx(SandboxSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && bot.sandbox === true && _jsx(SandboxPathsSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && _jsx(BackendTypeSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RuntimeEnvironmentSection, { bot: bot, patchBot: patchBot }) }), _jsx("section", { className: "bd-tile", children: _jsx(GrantSection, { bot: bot, patchBot: patchBot }) })] }), _jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(SessionModeSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), _jsx(SubstituteModeSection, { bot: bot, patchBot: patchBot }), _jsx(CrossBotSection, { bot: bot, putCardPref: putCardPref }), _jsx(SessionCapSection, { bot: bot, patchBot: patchBot })] }), _jsxs("section", { className: "bd-tile", children: [_jsx(CardBehaviorSection, { bot: bot, putCardPref: putCardPref }), _jsx(CodexAppDisplaySection, { bot: bot, putCardPref: putCardPref }), _jsx(SummaryTriggerSection, { bot: bot, patchBot: patchBot }), _jsx(BrandSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RoleSection, { bot: bot, patchBot: patchBot }) })] })] })] }));
 }
 function RuntimeEnvironmentSection(props) {
     const tr = useT();
@@ -833,14 +833,233 @@ function SandboxSection(props) {
             setBusy(false);
         }
     }
-    // Read isolation rides the SAME toggle: it applies additionally wherever the
-    // CLI + platform can enforce it (claude/codex on macOS/Linux, no wrapper). Show a
-    // capability line so the owner sees whether THIS bot's sandbox also read-isolates
-    // (the "labelled separately" requirement) — best-effort: write protection always
-    // applies; read isolation only where supported.
+    // The unified fs-policy always provides deny-by-default file read/write
+    // isolation. This capability line is narrower: whether the CLI's global data
+    // root can additionally be redirected into this bot's private BOT_HOME
+    // (claude/codex, no wrapper), keeping CLI credentials/config/history separate
+    // from sibling bots. Keep that distinction explicit in the UI copy.
     const readIsoSupported = bot.readIsolationSupported === true;
     return (_jsxs("section", { className: "bd-section", children: [_jsx("h3", { className: "bd-section-title", children: tr('botDefaults.sectionSandbox') }), _jsx(ToggleRow, { checked: enabled, disabled: busy, dataAction: "toggle-sandbox", title: tr('botDefaults.sandboxToggle'), help: tr('botDefaults.sandboxHelp'), onChange: checked => void toggle(checked) }), _jsx("p", { className: "bd-section-note", "data-read-iso-capability": readIsoSupported ? 'yes' : 'no', children: readIsoSupported ? `＋ ${tr('botDefaults.sandboxReadIsoOn')}` : tr('botDefaults.sandboxReadIsoOff') }), _jsx("div", { className: "actions", children: _jsx(StatusSpan, { status: status, attr: { 'data-sandbox-status': '' } }) })] }));
 }
+/** Restrictiveness ranking — mirrors fs-policy.ts RESTRICTIVENESS so a same-path
+ *  cross-tier conflict resolves the SAME way the sandbox will (deny > ro > rw). */
+const SBX_RESTRICTIVENESS = { readWrite: 0, readOnly: 1, deny: 2 };
+/** Effective access for `path` under the three tiers: DEEPEST (longest-prefix)
+ *  matching rule wins; at equal depth (same path across tiers) the MORE
+ *  RESTRICTIVE tier wins — mirrors fs-policy.ts accessForPath + mergeFsRules so
+ *  the UI's live labels + path tester agree with what the sandbox enforces.
+ *  `home` expands a leading `~` the same way the worker does before matching, so
+ *  recommendation entries like `~/.claude` line up with absolute tree nodes. */
+export function effectiveAccess(tiers, path, home) {
+    const expand = (p) => (p === '~' || p.startsWith('~/')) ? home.replace(/\/+$/, '') + p.slice(1) : p;
+    const norm = (p) => expand(p).replace(/\/+$/, '') || '/';
+    const target = norm(path);
+    const covers = (parent, child) => {
+        const a = norm(parent), b = norm(child);
+        return a === b || b.startsWith(a === '/' ? '/' : a + '/');
+    };
+    const depth = (p) => norm(p) === '/' ? 0 : norm(p).split('/').filter(Boolean).length;
+    let best;
+    const consider = (access, rule) => {
+        if (!covers(rule, target))
+            return;
+        const d = depth(rule);
+        if (!best || d > best.ruleDepth
+            || (d === best.ruleDepth && SBX_RESTRICTIVENESS[access] > SBX_RESTRICTIVENESS[best.access])) {
+            best = { access, ruleDepth: d, rule };
+        }
+    };
+    for (const p of tiers.readWrite)
+        consider('readWrite', p);
+    for (const p of tiers.readOnly)
+        consider('readOnly', p);
+    for (const p of tiers.deny)
+        consider('deny', p);
+    return best ? { access: best.access, rule: best.rule } : { access: 'none' };
+}
+/** Per-CLI recommended sandbox paths — the "Claude recommends adding ~/.claude"
+ *  one-click starters. Keyed by cliId family; falls back to a generic set. */
+function recommendedTiers(cliId) {
+    const id = (cliId ?? '').toLowerCase();
+    if (id.includes('claude')) {
+        return { labelKey: 'botDefaults.sbxPathsRecommendClaude', tiers: { readWrite: [], readOnly: ['~/.claude'], deny: [] } };
+    }
+    if (id.includes('codex')) {
+        return { labelKey: 'botDefaults.sbxPathsRecommendCodex', tiers: { readWrite: [], readOnly: ['~/.codex'], deny: [] } };
+    }
+    if (id.includes('gemini')) {
+        return { labelKey: 'botDefaults.sbxPathsRecommendGemini', tiers: { readWrite: [], readOnly: ['~/.gemini'], deny: [] } };
+    }
+    return { labelKey: 'botDefaults.sbxPathsRecommendGeneric', tiers: { readWrite: [], readOnly: [], deny: [] } };
+}
+function emptyTiers() { return { readWrite: [], readOnly: [], deny: [] }; }
+function normTiers(t) {
+    if (!t)
+        return emptyTiers();
+    return { readWrite: [...(t.readWrite ?? [])], readOnly: [...(t.readOnly ?? [])], deny: [...(t.deny ?? [])] };
+}
+function tiersEqual(a, b) {
+    const k = (x) => [...x].sort().join('\n');
+    return k(a.readWrite) === k(b.readWrite) && k(a.readOnly) === k(b.readOnly) && k(a.deny) === k(b.deny);
+}
+/** Serialize tiers to the copy-paste text form (one path per line, tier-tagged). */
+function tiersToText(t) {
+    const lines = [];
+    for (const p of t.readWrite)
+        lines.push(`rw  ${p}`);
+    for (const p of t.readOnly)
+        lines.push(`ro  ${p}`);
+    for (const p of t.deny)
+        lines.push(`deny ${p}`);
+    return lines.join('\n');
+}
+/** Parse the copy-paste text form back into tiers. Tolerates `rw`/`readWrite`,
+ *  `ro`/`readOnly`, `deny`/`-`; blank lines and `#` comments are ignored. */
+function textToTiers(text) {
+    const t = emptyTiers();
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = /^(\S+)\s+(.+)$/.exec(line);
+        if (!m)
+            continue;
+        const tag = m[1].toLowerCase();
+        const path = m[2].trim();
+        if (tag === 'rw' || tag === 'readwrite' || tag === 'rw:')
+            t.readWrite.push(path);
+        else if (tag === 'ro' || tag === 'readonly' || tag === 'ro:')
+            t.readOnly.push(path);
+        else if (tag === 'deny' || tag === '-' || tag === 'deny:')
+            t.deny.push(path);
+    }
+    return t;
+}
+function SandboxPathsSection(props) {
+    const tr = useT();
+    const { bot, patchBot } = props;
+    const [tiers, setTiers] = useState(() => normTiers(bot.sandboxPaths));
+    const [text, setText] = useState(() => tiersToText(normTiers(bot.sandboxPaths)));
+    const [textMode, setTextMode] = useState(false);
+    const [status, setStatus] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const [testPath, setTestPath] = useState('');
+    // Lazy directory tree: path → child dir list (undefined = not yet loaded).
+    const [children, setChildren] = useState({});
+    const [expanded, setExpanded] = useState(new Set());
+    const [roots, setRoots] = useState([]);
+    // Canonical $HOME (first fs-list root) — used to expand `~` in tiers/tester
+    // the SAME way the worker does, so recommendation entries (~/.claude) match
+    // absolute tree nodes and effective-access labels are accurate.
+    const [homeRoot, setHomeRoot] = useState('~');
+    const saved = useMemo(() => normTiers(bot.sandboxPaths), [bot.sandboxPaths]);
+    useEffect(() => { setTiers(normTiers(bot.sandboxPaths)); setText(tiersToText(normTiers(bot.sandboxPaths))); }, [bot.sandboxPaths]);
+    const dirty = !tiersEqual(tiers, saved);
+    const loadDir = useCallback(async (path) => {
+        try {
+            const q = path ? `?path=${encodeURIComponent(path)}` : '';
+            const r = await fetch(`/api/fs/list${q}`);
+            const j = await r.json();
+            if (!j.ok)
+                return;
+            if (!path) {
+                setRoots(j.entries.map((e) => ({ name: e.name, path: e.path })));
+                // Backend returns canonical $HOME explicitly (realpath'd) so `~` expansion
+                // here matches the realpath'd child nodes + the worker's sandbox binds.
+                if (typeof j.home === 'string' && j.home.startsWith('/'))
+                    setHomeRoot(j.home);
+            }
+            else
+                setChildren(prev => ({ ...prev, [path]: j.entries.map((e) => ({ name: e.name, path: e.path })) }));
+        }
+        catch { /* listing is best-effort; manual/text entry still works */ }
+    }, []);
+    useEffect(() => { if (!textMode && roots.length === 0)
+        void loadDir(''); }, [textMode, roots.length, loadDir]);
+    // The tier a path is EXPLICITLY set to (undefined = inherits from ancestor).
+    const explicitTier = useCallback((path) => {
+        const n = path.replace(/\/+$/, '') || '/';
+        if (tiers.readWrite.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'readWrite';
+        if (tiers.readOnly.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'readOnly';
+        if (tiers.deny.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'deny';
+        return undefined;
+    }, [tiers]);
+    // Cycle a node: inherit → readWrite → readOnly → deny → inherit.
+    const cycleNode = useCallback((path) => {
+        setStatus(null);
+        const n = path.replace(/\/+$/, '') || '/';
+        const cur = explicitTier(path);
+        const next = cur === undefined ? 'readWrite' : cur === 'readWrite' ? 'readOnly' : cur === 'readOnly' ? 'deny' : undefined;
+        setTiers(prev => {
+            const strip = (arr) => arr.filter(p => (p.replace(/\/+$/, '') || '/') !== n);
+            const t = { readWrite: strip(prev.readWrite), readOnly: strip(prev.readOnly), deny: strip(prev.deny) };
+            if (next)
+                t[next].push(path);
+            setText(tiersToText(t));
+            return t;
+        });
+    }, [explicitTier]);
+    function applyRecommended() {
+        const rec = recommendedTiers(bot.cliId);
+        setStatus(null);
+        setTiers(prev => {
+            const merge = (base, add) => [...new Set([...base, ...add])];
+            const t = {
+                readWrite: merge(prev.readWrite, rec.tiers.readWrite),
+                readOnly: merge(prev.readOnly, rec.tiers.readOnly),
+                deny: merge(prev.deny, rec.tiers.deny),
+            };
+            setText(tiersToText(t));
+            return t;
+        });
+    }
+    function syncFromText(next) {
+        setText(next);
+        setTiers(textToTiers(next));
+        setStatus(null);
+    }
+    async function save() {
+        setBusy(true);
+        setStatus(null);
+        try {
+            const res = await sendJson('PUT', `/api/bots/${encodeURIComponent(bot.larkAppId)}/sandbox-paths`, tiers);
+            if (res.ok && res.body.ok) {
+                setStatus({ text: `✓ ${tr('botDefaults.sbxPathsSaved')}`, ok: true });
+                patchBot(bot.larkAppId, { sandboxPaths: res.body.sandboxPaths ?? { readWrite: [], readOnly: [], deny: [] } });
+            }
+            else {
+                setStatus({ text: `✗ ${responseErrorText(res)}` });
+            }
+        }
+        catch (e) {
+            setStatus({ text: `✗ ${caughtErrorText(e)}` });
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    const tierBadge = (a) => a === 'readWrite' ? tr('botDefaults.sbxRw')
+        : a === 'readOnly' ? tr('botDefaults.sbxRo')
+            : a === 'deny' ? tr('botDefaults.sbxDeny')
+                : tr('botDefaults.sbxNone');
+    function TreeNode(props) {
+        const { name, path, depth } = props;
+        const isOpen = expanded.has(path);
+        const explicit = explicitTier(path);
+        const eff = effectiveAccess(tiers, path, homeRoot);
+        const kids = children[path];
+        return (_jsxs("div", { className: "bd-sbx-node", children: [_jsxs("div", { className: "bd-sbx-row", style: { paddingLeft: depth * 16 }, children: [_jsx("span", { className: "bd-sbx-twisty", onClick: () => {
+                                setExpanded(prev => { const s = new Set(prev); s.has(path) ? s.delete(path) : s.add(path); return s; });
+                                if (!kids)
+                                    void loadDir(path);
+                            }, children: isOpen ? '▾' : '▸' }), _jsx("span", { className: "bd-sbx-name", title: path, children: name }), _jsx("button", { type: "button", className: `bd-sbx-state bd-sbx-state-${explicit ?? 'inherit'}`, "data-action": "cycle-sandbox-path", "data-path": path, title: explicit ? undefined : `${tr('botDefaults.sbxInherit')}: ${tierBadge(eff.access)}`, onClick: () => cycleNode(path), children: explicit ? tierBadge(explicit) : `↳ ${tierBadge(eff.access)}` })] }), isOpen && (_jsxs("div", { className: "bd-sbx-kids", children: [kids?.map(c => _jsx(TreeNode, { name: c.name, path: c.path, depth: depth + 1 }, c.path)), kids && kids.length === 0 && (_jsx("div", { className: "bd-sbx-empty", style: { paddingLeft: (depth + 1) * 16 + 20 }, children: tr('botDefaults.sbxNoSubdirs') }))] }))] }));
+    }
+    const testResult = testPath.trim() ? effectiveAccess(tiers, testPath.trim(), homeRoot) : null;
+    return (_jsxs("section", { className: "bd-section", children: [_jsx("h3", { className: "bd-section-title", children: tr('botDefaults.sectionSandboxPaths') }), _jsx("p", { className: "bd-section-note", children: tr('botDefaults.sbxPathsHelp') }), _jsxs("div", { className: "actions", style: { gap: 8, flexWrap: 'wrap' }, children: [_jsx("button", { type: "button", className: "bd-btn", "data-action": "apply-sandbox-recommended", onClick: applyRecommended, children: tr(recommendedTiers(bot.cliId).labelKey) }), _jsx("button", { type: "button", className: "bd-btn", onClick: () => setTextMode(m => !m), children: textMode ? tr('botDefaults.sbxPathsTreeMode') : tr('botDefaults.sbxPathsTextMode') })] }), textMode ? (_jsx("textarea", { className: "bd-sbx-text", "data-field": "sandbox-paths-text", rows: 8, value: text, spellCheck: false, placeholder: 'rw  ~/my-data\nro  ~/reference-repos\ndeny ~/my-data/secrets', onChange: e => syncFromText(e.target.value) })) : (_jsx("div", { className: "bd-sbx-tree", "data-field": "sandbox-paths-tree", children: roots.map(r => _jsx(TreeNode, { name: r.name, path: r.path, depth: 0 }, r.path)) })), _jsxs("div", { className: "bd-sbx-tester", children: [_jsx("input", { className: "bd-sbx-test-input", "data-field": "sandbox-path-test", placeholder: tr('botDefaults.sbxTestPlaceholder'), value: testPath, onChange: e => setTestPath(e.target.value) }), testResult && (_jsxs("span", { className: `bd-sbx-test-out bd-sbx-state-${testResult.access}`, "data-test-access": testResult.access, children: [tierBadge(testResult.access), testResult.rule ? ` ← ${testResult.rule}` : ''] }))] }), _jsxs("div", { className: "actions", children: [_jsx("button", { type: "button", className: "bd-btn bd-btn-primary", "data-action": "save-sandbox-paths", disabled: busy || !dirty, onClick: () => void save(), children: tr('botDefaults.sbxPathsSave') }), _jsx(StatusSpan, { status: status, attr: { 'data-sandbox-paths-status': '' } })] })] }));
+}
 const BACKEND_TYPE_OPTIONS = [
     { value: '', labelKey: 'botDefaults.backendAuto' },
     { value: 'tmux', labelKey: 'botDefaults.backendTmux' },