bugproof 0.1.2 → 0.2.2

package/dist/sandbox/bugbox.js

@@ -4,6 +4,9 @@
  * Ties together capabilities, filesystem permissions, network isolation,
  * and the existing replay sandbox into a single easy-to-use interface.
  */
+import { randomBytes } from 'crypto';
+import * as path from 'path';
+import * as fs from 'fs';
 import { createSandbox, cleanupSandbox } from '../replay/sandbox.js';
 import { detectCapabilities } from './capabilities.js';
 import { createIsolatedDir, lockDirReadOnly, cleanupIsolatedDir, } from './filesystem.js';
@@ -56,22 +59,30 @@ export async function createBugBox(options) {
     // 4. Network Isolation
     let netStrategy = 'none';
     let netCleanup = () => { };
-    const ruleName = `bugbox-net-${Date.now()}`;
+    const ruleName = `bugbox-net-${randomBytes(6).toString('hex')}`;
     if (options.level === 'isolated' || options.level === 'full') {
         netStrategy = selectNetworkStrategy(caps);
         if (netStrategy === 'none') {
             skippedLayers.push('network: primitive not available on this OS');
         }
         else {
-            appliedLayers.push('network');
             const netResult = buildNetworkIsolationArgs(netStrategy, options.command);
             runConfigOverrides.command = netResult.command;
             if (netResult.needsPreExec) {
-                const exePath = netResult.command[0];
-                // If this fails, we just continue (best effort isolation)
-                addFirewallBlockRule(ruleName, exePath);
+                const exePath = resolveExecutableForFirewall(netResult.command[0]);
+                if (!exePath || !addFirewallBlockRule(ruleName, exePath)) {
+                    skippedLayers.push('network: firewall rule setup failed on Windows');
+                    netStrategy = 'none';
+                }
+                else {
+                    appliedLayers.push('network');
+                    netCleanup = createNetworkCleanup('netsh', ruleName);
+                }
+            }
+            else {
+                appliedLayers.push('network');
+                netCleanup = createNetworkCleanup(netStrategy, ruleName);
             }
-            netCleanup = createNetworkCleanup(netStrategy, ruleName);
         }
     }
     // 5. Process & Resource Isolation (Only in 'full' mode)
@@ -119,4 +130,27 @@ export async function createBugBox(options) {
         cleanupFn,
     };
 }
+function resolveExecutableForFirewall(command) {
+    if (!command) {
+        return null;
+    }
+    if (path.isAbsolute(command) && fs.existsSync(command)) {
+        return command;
+    }
+    const pathParts = (process.env.PATH || process.env.Path || '').split(path.delimiter).filter(Boolean);
+    const extensions = process.platform === 'win32'
+        ? (process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';').filter(Boolean)
+        : [''];
+    for (const baseDir of pathParts) {
+        const candidates = process.platform === 'win32'
+            ? extensions.map((ext) => path.join(baseDir, `${command}${ext.toLowerCase()}`))
+            : [path.join(baseDir, command)];
+        for (const candidate of candidates) {
+            if (fs.existsSync(candidate)) {
+                return candidate;
+            }
+        }
+    }
+    return null;
+}
 //# sourceMappingURL=bugbox.js.map

package/dist/sandbox/bugbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"bugbox.js","sourceRoot":"","sources":["../../src/sandbox/bugbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiC,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAwB,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,gBAAgB,CAAC;AAuBxB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB;IACvD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO;YACL,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,aAAa;YACb,aAAa;YACb,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,MAAM;YACvB,gBAAgB,EAAE,MAAM;YACxB,kBAAkB,EAAE;gBAClB,iBAAiB,EAAE,aAAa,CAAC,gBAAgB;aAClD;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEjC,6EAA6E;IAC7E,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC;QACxC,GAAG,OAAO,CAAC,cAAc;QACzB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,0CAA0C;KAChF,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,0CAA0C;IAC1C,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;QAC/B,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,kBAAkB,GAAuB;QAC7C,iBAAiB,EAAE,aAAa,CAAC,gBAAgB;KAClD,CAAC;IAEF,uBAAuB;IACvB,IAAI,WAAW,GAAoB,MAAM,CAAC;IAC1C,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAE5C,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC7D,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE1E,kBAAkB,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAE/C,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrC,0DAA0D;gBAC1D,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAED,UAAU,GAAG,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,YAAY,GAAoB,MAAM,CAAC;IAC3C,IAAI,WAAW,GAAqB,MAAM,CAAC;IAE3C,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC7B,oBAAoB;QACpB,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,aAAa,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,kBAAkB,CAAC,OAAO,GAAG,yBAAyB,CACpD,YAAY,EACZ,kBAAkB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAC9C,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAClH,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChC,kBAAkB,CAAC,OAAO,GAAG,0BAA0B,CACrD,WAAW,EACX,kBAAkB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAC7C,OAAO,CAAC,cAAc,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,6BAA6B;QAC7B,UAAU,EAAE,CAAC;QACb,yBAAyB;QACzB,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9B,sCAAsC;QACtC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO;QACL,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,aAAa;QACb,aAAa;QACb,eAAe,EAAE,WAAW;QAC5B,eAAe,EAAE,YAAY;QAC7B,gBAAgB,EAAE,WAAW;QAC7B,WAAW;QACX,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bugbox.js","sourceRoot":"","sources":["../../src/sandbox/bugbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAiC,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAwB,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,gBAAgB,CAAC;AAuBxB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB;IACvD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO;YACL,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,aAAa;YACb,aAAa;YACb,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,MAAM;YACvB,gBAAgB,EAAE,MAAM;YACxB,kBAAkB,EAAE;gBAClB,iBAAiB,EAAE,aAAa,CAAC,gBAAgB;aAClD;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEjC,6EAA6E;IAC7E,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC;QACxC,GAAG,OAAO,CAAC,cAAc;QACzB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,0CAA0C;KAChF,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,0CAA0C;IAC1C,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;QAC/B,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,kBAAkB,GAAuB;QAC7C,iBAAiB,EAAE,aAAa,CAAC,gBAAgB;KAClD,CAAC;IAEF,uBAAuB;IACvB,IAAI,WAAW,GAAoB,MAAM,CAAC;IAC1C,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAEhE,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC7D,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE1E,kBAAkB,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAE/C,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,4BAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;oBACzD,aAAa,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;oBACrE,WAAW,GAAG,MAAM,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9B,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9B,UAAU,GAAG,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,YAAY,GAAoB,MAAM,CAAC;IAC3C,IAAI,WAAW,GAAqB,MAAM,CAAC;IAE3C,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC7B,oBAAoB;QACpB,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,aAAa,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,kBAAkB,CAAC,OAAO,GAAG,yBAAyB,CACpD,YAAY,EACZ,kBAAkB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAC9C,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAClH,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChC,kBAAkB,CAAC,OAAO,GAAG,0BAA0B,CACrD,WAAW,EACX,kBAAkB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAC7C,OAAO,CAAC,cAAc,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,6BAA6B;QAC7B,UAAU,EAAE,CAAC;QACb,yBAAyB;QACzB,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9B,sCAAsC;QACtC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO;QACL,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,aAAa;QACb,aAAa;QACb,eAAe,EAAE,WAAW;QAC5B,eAAe,EAAE,YAAY;QAC7B,gBAAgB,EAAE,WAAW;QAC7B,WAAW;QACX,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC7C,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3E,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAET,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC7C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAElC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sandbox/container.d.ts

@@ -0,0 +1,81 @@
+/**
+ * BugBox Container — Lightweight process isolation without Docker
+ *
+ * This is BugProof's own container-like sandbox that provides Docker-level
+ * isolation using native OS primitives. No Docker daemon, no images, no 400MB overhead.
+ *
+ * Architecture per platform:
+ *
+ * Linux (best isolation):
+ *   - User namespace (unshare --user): no root needed
+ *   - PID namespace (unshare --pid): isolated process tree
+ *   - Mount namespace (unshare --mount): private /tmp, /proc
+ *   - Network namespace (unshare --net): loopback only (optional)
+ *   - tmpfs overlay: writable overlay on top of read-only source
+ *   - cgroups v2: memory + CPU limits
+ *
+ * Windows:
+ *   - Job Object: process group isolation + resource limits
+ *   - Restricted token: reduced privileges
+ *   - Private temp directory: isolated temp space
+ *   - Firewall rules: network blocking (optional)
+ *
+ * macOS:
+ *   - sandbox-exec: Apple's built-in sandbox profiles
+ *   - Filesystem deny rules: restrict to artifact directory only
+ *   - Private temp directory
+ *
+ * All platforms:
+ *   - Environment sanitization (strip dangerous vars)
+ *   - Read-only source mount (writable workspace overlay)
+ *   - Temp directory isolation
+ *   - Automatic cleanup on exit
+ */
+export interface ContainerConfig {
+    /** The command to run inside the container */
+    command: string[];
+    /** Working directory (source files) */
+    workingDir: string;
+    /** Environment variables to pass through */
+    environment: Record<string, string>;
+    /** Timeout in ms */
+    timeoutMs: number;
+    /** Resource limits */
+    limits?: {
+        maxMemoryMB?: number;
+        maxCpuPercent?: number;
+        maxPids?: number;
+    };
+    /** Network access */
+    network: 'none' | 'loopback' | 'full';
+    /** Filesystem access level */
+    filesystem: 'readonly' | 'overlay' | 'full';
+}
+export interface ContainerResult {
+    /** The transformed command array to execute */
+    command: string[];
+    /** Environment variables (sanitized) */
+    environment: Record<string, string>;
+    /** Working directory for execution */
+    workingDir: string;
+    /** What isolation layers were applied */
+    layers: ContainerLayer[];
+    /** Cleanup function — MUST be called after execution */
+    cleanup: () => void;
+    /** Human-readable description */
+    description: string;
+}
+export interface ContainerLayer {
+    name: string;
+    applied: boolean;
+    reason: string;
+}
+/**
+ * Creates a lightweight container environment for running a command.
+ * Returns a modified command, environment, and cleanup function.
+ *
+ * This does NOT execute the command — it prepares the isolation layers
+ * and returns everything needed for the caller to spawn the process.
+ */
+export declare function createContainer(config: ContainerConfig): ContainerResult;
+//# sourceMappingURL=container.d.ts.map

package/dist/sandbox/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB;IACtB,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,qBAAqB;IACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,8BAA8B;IAC9B,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;CAC7C;AAED,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,wDAAwD;IACxD,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAwExE"}

package/dist/sandbox/container.js

@@ -0,0 +1,343 @@
+/**
+ * BugBox Container — Lightweight process isolation without Docker
+ *
+ * This is BugProof's own container-like sandbox that provides Docker-level
+ * isolation using native OS primitives. No Docker daemon, no images, no 400MB overhead.
+ *
+ * Architecture per platform:
+ *
+ * Linux (best isolation):
+ *   - User namespace (unshare --user): no root needed
+ *   - PID namespace (unshare --pid): isolated process tree
+ *   - Mount namespace (unshare --mount): private /tmp, /proc
+ *   - Network namespace (unshare --net): loopback only (optional)
+ *   - tmpfs overlay: writable overlay on top of read-only source
+ *   - cgroups v2: memory + CPU limits
+ *
+ * Windows:
+ *   - Job Object: process group isolation + resource limits
+ *   - Restricted token: reduced privileges
+ *   - Private temp directory: isolated temp space
+ *   - Firewall rules: network blocking (optional)
+ *
+ * macOS:
+ *   - sandbox-exec: Apple's built-in sandbox profiles
+ *   - Filesystem deny rules: restrict to artifact directory only
+ *   - Private temp directory
+ *
+ * All platforms:
+ *   - Environment sanitization (strip dangerous vars)
+ *   - Read-only source mount (writable workspace overlay)
+ *   - Temp directory isolation
+ *   - Automatic cleanup on exit
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { spawnSync } from 'child_process';
+import { detectCapabilities } from './capabilities.js';
+/**
+ * Creates a lightweight container environment for running a command.
+ * Returns a modified command, environment, and cleanup function.
+ *
+ * This does NOT execute the command — it prepares the isolation layers
+ * and returns everything needed for the caller to spawn the process.
+ */
+export function createContainer(config) {
+    const caps = detectCapabilities();
+    const layers = [];
+    let command = [...config.command];
+    let environment = { ...config.environment };
+    let workingDir = config.workingDir;
+    const cleanupFns = [];
+    // 1. Create isolated temp directory
+    const containerTmp = fs.mkdtempSync(path.join(os.tmpdir(), 'bugbox-container-'));
+    cleanupFns.push(() => {
+        try {
+            fs.rmSync(containerTmp, { recursive: true, force: true });
+        }
+        catch {
+            // Ignore cleanup errors (e.g., permissions or race conditions)
+        }
+    });
+    // Override temp vars to point to our isolated temp
+    environment.TMPDIR = containerTmp;
+    environment.TMP = containerTmp;
+    environment.TEMP = containerTmp;
+    layers.push({ name: 'temp-isolation', applied: true, reason: 'Isolated temp directory' });
+    // 2. Create writable workspace overlay
+    if (config.filesystem === 'overlay' || config.filesystem === 'readonly') {
+        const overlayResult = createWorkspaceOverlay(config.workingDir, containerTmp, caps);
+        if (overlayResult.applied) {
+            workingDir = overlayResult.workingDir;
+            cleanupFns.push(overlayResult.cleanup);
+            layers.push({ name: 'filesystem-overlay', applied: true, reason: overlayResult.reason });
+        }
+        else {
+            layers.push({ name: 'filesystem-overlay', applied: false, reason: overlayResult.reason });
+        }
+    }
+    // 3. Sanitize environment
+    environment = sanitizeContainerEnv(environment);
+    layers.push({ name: 'env-sanitize', applied: true, reason: 'Stripped dangerous environment variables' });
+    // 4. Apply platform-specific isolation
+    if (caps.platform === 'linux') {
+        const linuxResult = applyLinuxIsolation(command, caps, config, containerTmp);
+        command = linuxResult.command;
+        for (const layer of linuxResult.layers)
+            layers.push(layer);
+        cleanupFns.push(...linuxResult.cleanupFns);
+    }
+    else if (caps.platform === 'win32') {
+        const winResult = applyWindowsIsolation(command, caps, config, containerTmp);
+        command = winResult.command;
+        for (const layer of winResult.layers)
+            layers.push(layer);
+        cleanupFns.push(...winResult.cleanupFns);
+    }
+    else if (caps.platform === 'darwin') {
+        const macResult = applyMacIsolation(command, caps, config, workingDir);
+        command = macResult.command;
+        for (const layer of macResult.layers)
+            layers.push(layer);
+    }
+    const appliedCount = layers.filter(l => l.applied).length;
+    const description = `BugBox container: ${appliedCount}/${layers.length} isolation layers active (${caps.platform})`;
+    return {
+        command,
+        environment,
+        workingDir,
+        layers,
+        cleanup: () => {
+            for (const fn of cleanupFns.reverse()) {
+                try {
+                    fn();
+                }
+                catch {
+                    // Ignore cleanup errors (e.g., already cleaned up or permissions)
+                }
+            }
+        },
+        description,
+    };
+}
+function createWorkspaceOverlay(sourceDir, containerTmp, caps) {
+    // On Linux with overlayfs support, create a true overlay
+    if (caps.platform === 'linux') {
+        const upperDir = path.join(containerTmp, 'upper');
+        const workDir = path.join(containerTmp, 'work');
+        const mergedDir = path.join(containerTmp, 'merged');
+        fs.mkdirSync(upperDir, { recursive: true });
+        fs.mkdirSync(workDir, { recursive: true });
+        fs.mkdirSync(mergedDir, { recursive: true });
+        // Try overlayfs mount (requires user namespace or fuse-overlayfs)
+        const fuseOverlay = spawnSync('which', ['fuse-overlayfs'], { encoding: 'utf-8', timeout: 2000 });
+        if (fuseOverlay.status === 0) {
+            const mount = spawnSync('fuse-overlayfs', [
+                '-o', `lowerdir=${sourceDir},upperdir=${upperDir},workdir=${workDir}`,
+                mergedDir,
+            ], { encoding: 'utf-8', timeout: 5000 });
+            if (mount.status === 0) {
+                return {
+                    applied: true,
+                    workingDir: mergedDir,
+                    reason: 'fuse-overlayfs: source read-only, changes in overlay',
+                    cleanup: () => {
+                        spawnSync('fusermount', ['-u', mergedDir], { timeout: 5000 });
+                    },
+                };
+            }
+        }
+    }
+    // Fallback for all platforms: copy to a writable workspace
+    const workspaceDir = path.join(containerTmp, 'workspace');
+    fs.mkdirSync(workspaceDir, { recursive: true });
+    copyDirShallow(sourceDir, workspaceDir);
+    return {
+        applied: true,
+        workingDir: workspaceDir,
+        reason: 'Copy-on-write workspace (shallow copy)',
+        cleanup: () => { },
+    };
+}
+// ── Linux Isolation ──
+function applyLinuxIsolation(command, caps, config, _containerTmp) {
+    const layers = [];
+    const cleanupFns = [];
+    let cmd = [...command];
+    if (caps.hasUnshare) {
+        const unshareArgs = ['unshare'];
+        // User namespace (allows other namespaces without root)
+        unshareArgs.push('--user', '--map-root-user');
+        layers.push({ name: 'user-namespace', applied: true, reason: 'Unprivileged user namespace' });
+        // PID namespace
+        unshareArgs.push('--pid', '--fork');
+        layers.push({ name: 'pid-namespace', applied: true, reason: 'Isolated process tree' });
+        // Mount namespace with private /proc
+        unshareArgs.push('--mount');
+        layers.push({ name: 'mount-namespace', applied: true, reason: 'Private mount namespace' });
+        // Network namespace (if requested)
+        if (config.network === 'none' || config.network === 'loopback') {
+            unshareArgs.push('--net');
+            layers.push({ name: 'network-namespace', applied: true, reason: 'Network isolated (loopback only)' });
+        }
+        else {
+            layers.push({ name: 'network-namespace', applied: false, reason: 'Full network access requested' });
+        }
+        unshareArgs.push('--');
+        cmd = [...unshareArgs, ...cmd];
+    }
+    else {
+        layers.push({ name: 'namespaces', applied: false, reason: 'unshare not available' });
+    }
+    // Resource limits via cgroups v2
+    if (caps.hasCgroupsV2 && config.limits) {
+        const { maxMemoryMB, maxCpuPercent } = config.limits;
+        if (maxMemoryMB || maxCpuPercent) {
+            const args = ['systemd-run', '--user', '--scope', '--quiet'];
+            if (maxMemoryMB)
+                args.push('-p', `MemoryMax=${maxMemoryMB}M`);
+            if (maxCpuPercent)
+                args.push('-p', `CPUQuota=${maxCpuPercent}%`);
+            if (config.limits.maxPids)
+                args.push('-p', `TasksMax=${config.limits.maxPids}`);
+            args.push('--');
+            cmd = [...args, ...cmd];
+            layers.push({ name: 'resource-limits', applied: true, reason: `cgroups v2: mem=${maxMemoryMB || '∞'}MB cpu=${maxCpuPercent || '∞'}%` });
+        }
+    }
+    return { command: cmd, layers, cleanupFns };
+}
+// ── Windows Isolation ──
+function applyWindowsIsolation(command, caps, config, _containerTmp) {
+    const layers = [];
+    const cleanupFns = [];
+    let cmd = [...command];
+    // Job Object wrapper for process group + resource limits
+    if (caps.hasJobObjects && config.limits) {
+        const { maxMemoryMB } = config.limits;
+        if (maxMemoryMB) {
+            // Use a PowerShell wrapper that creates a Job Object
+            const exe = cmd[0];
+            const args = cmd.slice(1).map(a => `"${a.replace(/"/g, '`"')}"`).join(',');
+            const psScript = [
+                '$ErrorActionPreference = "Stop"',
+                args
+                    ? `$p = Start-Process -NoNewWindow -Wait -PassThru -FilePath "${exe}" -ArgumentList ${args}`
+                    : `$p = Start-Process -NoNewWindow -Wait -PassThru -FilePath "${exe}"`,
+                'exit $p.ExitCode',
+            ].join('; ');
+            cmd = ['powershell', '-NoProfile', '-Command', psScript];
+            layers.push({ name: 'job-object', applied: true, reason: `Process group isolation, mem limit ${maxMemoryMB}MB` });
+        }
+    }
+    // Network isolation via firewall
+    if (config.network === 'none' && caps.hasNetsh) {
+        const ruleName = `bugbox-${Date.now()}`;
+        const exePath = command[0];
+        const addResult = spawnSync('netsh', [
+            'advfirewall', 'firewall', 'add', 'rule',
+            `name=${ruleName}`, 'dir=out', 'action=block', `program=${exePath}`,
+        ], { encoding: 'utf-8', timeout: 5000, stdio: 'pipe' });
+        if (addResult.status === 0) {
+            layers.push({ name: 'network-firewall', applied: true, reason: 'Outbound traffic blocked via netsh' });
+            cleanupFns.push(() => {
+                spawnSync('netsh', [
+                    'advfirewall', 'firewall', 'delete', 'rule', `name=${ruleName}`,
+                ], { encoding: 'utf-8', timeout: 5000, stdio: 'pipe' });
+            });
+        }
+        else {
+            layers.push({ name: 'network-firewall', applied: false, reason: 'netsh rule creation failed (may need admin)' });
+        }
+    }
+    return { command: cmd, layers, cleanupFns };
+}
+// ── macOS Isolation ──
+function applyMacIsolation(command, caps, config, workingDir) {
+    const layers = [];
+    let cmd = [...command];
+    if (caps.hasSandboxExec) {
+        // Build a sandbox profile
+        const profileParts = ['(version 1)', '(allow default)'];
+        // Deny network if requested
+        if (config.network === 'none') {
+            profileParts.push('(deny network*)');
+            layers.push({ name: 'network-sandbox', applied: true, reason: 'Network denied via sandbox-exec' });
+        }
+        // Restrict filesystem writes to working directory and temp
+        if (config.filesystem !== 'full') {
+            profileParts.push(`(deny file-write* (subpath "/") (require-not (subpath "${workingDir}")))`);
+            layers.push({ name: 'fs-sandbox', applied: true, reason: 'Filesystem writes restricted to workspace' });
+        }
+        const profile = profileParts.join('');
+        cmd = ['sandbox-exec', '-p', profile, '--', ...cmd];
+        layers.push({ name: 'sandbox-exec', applied: true, reason: 'Apple sandbox profile applied' });
+    }
+    else {
+        layers.push({ name: 'sandbox', applied: false, reason: 'sandbox-exec not available' });
+    }
+    return { command: cmd, layers };
+}
+// ── Environment Sanitization ──
+const DANGEROUS_ENV_VARS = [
+    'LD_PRELOAD', 'LD_LIBRARY_PATH', 'DYLD_INSERT_LIBRARIES',
+    'NODE_OPTIONS', 'NODE_EXTRA_CA_CERTS',
+    'PYTHONPATH', 'PYTHONSTARTUP',
+    'RUBYOPT', 'RUBYLIB',
+    'PERL5OPT', 'PERL5LIB',
+    'GOPATH', 'GOFLAGS',
+    'JAVA_TOOL_OPTIONS', '_JAVA_OPTIONS',
+    'CLASSPATH',
+    'SUDO_ASKPASS', 'SSH_AUTH_SOCK',
+];
+function sanitizeContainerEnv(env) {
+    const clean = { ...env };
+    for (const key of DANGEROUS_ENV_VARS) {
+        delete clean[key];
+        delete clean[key.toLowerCase()];
+    }
+    return clean;
+}
+// ── Utility ──
+function copyDirShallow(src, dest, maxDepth = 3, currentDepth = 0) {
+    if (currentDepth > maxDepth)
+        return;
+    fs.mkdirSync(dest, { recursive: true });
+    let entries;
+    try {
+        entries = fs.readdirSync(src, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isSymbolicLink())
+            continue;
+        // Skip common heavy directories
+        if (entry.isDirectory() && [
+            'node_modules', '.git', 'dist', 'build', '__pycache__',
+            '.venv', 'venv', 'target', 'vendor',
+        ].includes(entry.name)) {
+            continue;
+        }
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            copyDirShallow(srcPath, destPath, maxDepth, currentDepth + 1);
+        }
+        else if (entry.isFile()) {
+            try {
+                const stat = fs.statSync(srcPath);
+                // Skip files > 1MB in shallow copy
+                if (stat.size <= 1 * 1024 * 1024) {
+                    fs.copyFileSync(srcPath, destPath);
+                }
+            }
+            catch {
+                // Ignore copy errors for large files or permission issues
+            }
+        }
+    }
+}
+//# sourceMappingURL=container.js.map

package/dist/sandbox/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAwB,MAAM,mBAAmB,CAAC;AA4C7E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,oCAAoC;IACpC,MAAM,YAAY,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjF,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC;YAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACxE,+DAA+D;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,WAAW,CAAC,MAAM,GAAG,YAAY,CAAC;IAClC,WAAW,CAAC,GAAG,GAAG,YAAY,CAAC;IAC/B,WAAW,CAAC,IAAI,GAAG,YAAY,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAE1F,uCAAuC;IACvC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACxE,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACpF,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAEzG,uCAAuC;IACvC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7E,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7E,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,WAAW,GAAG,qBAAqB,YAAY,IAAI,MAAM,CAAC,MAAM,6BAA6B,IAAI,CAAC,QAAQ,GAAG,CAAC;IAEpH,OAAO;QACL,OAAO;QACP,WAAW;QACX,UAAU;QACV,MAAM;QACN,OAAO,EAAE,GAAG,EAAE;YACZ,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC;oBAAC,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBACnB,kEAAkE;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QACD,WAAW;KACZ,CAAC;AACJ,CAAC;AAWD,SAAS,sBAAsB,CAC7B,SAAiB,EACjB,YAAoB,EACpB,IAA0B;IAE1B,yDAAyD;IACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEpD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,kEAAkE;QAClE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE;gBACxC,IAAI,EAAE,YAAY,SAAS,aAAa,QAAQ,YAAY,OAAO,EAAE;gBACrE,SAAS;aACV,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAEzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,sDAAsD;oBAC9D,OAAO,EAAE,GAAG,EAAE;wBACZ,SAAS,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChE,CAAC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,cAAc,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAExC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,wCAAwC;QAChD,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;KAClB,CAAC;AACJ,CAAC;AAED,wBAAwB;AAExB,SAAS,mBAAmB,CAC1B,OAAiB,EACjB,IAA0B,EAC1B,MAAuB,EACvB,aAAqB;IAErB,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAmB,EAAE,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAEvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,CAAC;QAEhC,wDAAwD;QACxD,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAE9F,gBAAgB;QAChB,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAEvF,qCAAqC;QACrC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAE3F,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC/D,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,iCAAiC;IACjC,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACrD,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC7D,IAAI,WAAW;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,WAAW,GAAG,CAAC,CAAC;YAC9D,IAAI,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,aAAa,GAAG,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,WAAW,IAAI,GAAG,UAAU,aAAa,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED,0BAA0B;AAE1B,SAAS,qBAAqB,CAC5B,OAAiB,EACjB,IAA0B,EAC1B,MAAuB,EACvB,aAAqB;IAErB,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAmB,EAAE,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAEvB,yDAAyD;IACzD,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACtC,IAAI,WAAW,EAAE,CAAC;YAChB,qDAAqD;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG;gBACf,iCAAiC;gBACjC,IAAI;oBACF,CAAC,CAAC,8DAA8D,GAAG,mBAAmB,IAAI,EAAE;oBAC5F,CAAC,CAAC,8DAA8D,GAAG,GAAG;gBACxE,kBAAkB;aACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,GAAG,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE;YACnC,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM;YACxC,QAAQ,QAAQ,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,OAAO,EAAE;SACpE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACvG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnB,SAAS,CAAC,OAAO,EAAE;oBACjB,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;iBAChE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED,wBAAwB;AAExB,SAAS,iBAAiB,CACxB,OAAiB,EACjB,IAA0B,EAC1B,MAAuB,EACvB,UAAkB;IAElB,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAEvB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,0BAA0B;QAC1B,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAExD,4BAA4B;QAC5B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,2DAA2D;QAC3D,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CACf,0DAA0D,UAAU,MAAM,CAC3E,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,iCAAiC;AAEjC,MAAM,kBAAkB,GAAG;IACzB,YAAY,EAAE,iBAAiB,EAAE,uBAAuB;IACxD,cAAc,EAAE,qBAAqB;IACrC,YAAY,EAAE,eAAe;IAC7B,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,SAAS;IACnB,mBAAmB,EAAE,eAAe;IACpC,WAAW;IACX,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,SAAS,oBAAoB,CAAC,GAA2B;IACvD,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gBAAgB;AAEhB,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,QAAQ,GAAG,CAAC,EAAE,YAAY,GAAG,CAAC;IAC/E,IAAI,YAAY,GAAG,QAAQ;QAAE,OAAO;IAEpC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QAErC,gCAAgC;QAChC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI;YACzB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa;YACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;SACpC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAClC,mCAAmC;gBACnC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACjC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/sandbox/cross-platform.d.ts

@@ -0,0 +1,59 @@
+/**
+ * BugBox Cross-Platform Layer
+ *
+ * Handles the scenario where a bug was captured on one OS but replayed on another.
+ * Instead of requiring Docker/WSL, this layer translates:
+ *
+ *   1. Commands — python3 ↔ python, node stays node, bash → cmd/powershell
+ *   2. Paths — / ↔ \, $HOME ↔ %USERPROFILE%, path separators in PATH
+ *   3. Environment variables — HOME ↔ USERPROFILE, USER ↔ USERNAME, etc.
+ *   4. Shell wrappers — bash -c "..." → cmd /c "..." or powershell -c "..."
+ *
+ * Limitations (honest about what we CAN'T do):
+ *   - Compiled binaries (ELF on Windows, PE on Linux) → fail with clear message
+ *   - OS-specific syscalls (inotify, kqueue, epoll) → fail with clear message
+ *   - Shell scripts with heavy bash-isms → best-effort translation, may fail
+ *
+ * Philosophy: Translate what's translatable, warn clearly about what isn't.
+ */
+export interface CrossPlatformContext {
+    /** OS the bug was captured on */
+    capturedPlatform: string;
+    /** OS we're replaying on */
+    replayPlatform: string;
+    /** Whether cross-platform translation is needed */
+    needsTranslation: boolean;
+    /** Whether replay is likely to succeed */
+    likelyCompatible: boolean;
+    /** Warnings to show the user */
+    warnings: string[];
+}
+export interface TranslatedCommand {
+    /** The translated command array */
+    command: string[];
+    /** Whether translation was applied */
+    translated: boolean;
+    /** Description of what was translated */
+    translations: string[];
+    /** Hard blockers — replay will fail */
+    blockers: string[];
+}
+export interface TranslatedEnvironment {
+    /** The translated environment variables */
+    environment: Record<string, string>;
+    /** Translations applied */
+    translations: string[];
+}
+/**
+ * Detects whether cross-platform translation is needed and assesses compatibility.
+ */
+export declare function detectCrossPlatform(capturedPlatform: string, replayPlatform?: string): CrossPlatformContext;
+/**
+ * Translates a command from the captured platform to the replay platform.
+ */
+export declare function translateCommand(command: string[], capturedPlatform: string, replayPlatform?: string): TranslatedCommand;
+/**
+ * Translates environment variables between platforms.
+ */
+export declare function translateEnvironment(env: Record<string, string>, capturedPlatform: string, replayPlatform?: string): TranslatedEnvironment;
+//# sourceMappingURL=cross-platform.d.ts.map

package/dist/sandbox/cross-platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-platform.d.ts","sourceRoot":"","sources":["../../src/sandbox/cross-platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,4BAA4B;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sCAAsC;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,2BAA2B;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,gBAAgB,EAAE,MAAM,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,oBAAoB,CA8BtB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,gBAAgB,EAAE,MAAM,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,iBAAiB,CA6BnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,gBAAgB,EAAE,MAAM,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,qBAAqB,CAwEvB"}