chainlesschain 0.162.143 → 0.162.147

package/src/assets/web-panel/assets/{useFs-DhsLsCr_.js → useFs-BkrT-Zbc.js}

@@ -1 +1 @@
-import{u as d}from"./index-DDGBasj6.js";import{u as c}from"./useShellMode-CgR0wCYM.js";function u({accept:l=""}={}){return new Promise(a=>{if(typeof document>"u"){a({canceled:!0,path:null,content:null});return}const n=document.createElement("input");n.type="file",l&&(n.accept=l),n.style.display="none",document.body.appendChild(n);let o=!1;const i=()=>{n.parentNode&&n.parentNode.removeChild(n)},r=()=>{if(o)return;o=!0;const e=n.files&&n.files[0];if(!e){i(),a({canceled:!0,path:null,content:null});return}const t=new FileReader;t.onload=()=>{i(),a({canceled:!1,path:e.name,size:e.size,content:typeof t.result=="string"?t.result:""})},t.onerror=()=>{i(),a({canceled:!1,path:e.name,size:e.size,content:null,reason:"read_failed"})},t.readAsText(e)};n.addEventListener("change",r),n.click()})}function f(l,{defaultPath:a="download.txt"}={}){if(typeof document>"u")return{canceled:!0,path:null};const n=new Blob([l],{type:"text/plain"}),o=URL.createObjectURL(n),i=document.createElement("a");return i.href=o,i.download=a,document.body.appendChild(i),i.click(),document.body.removeChild(i),URL.revokeObjectURL(o),{canceled:!1,path:a}}function p(l){if(!Array.isArray(l))return"";const a=[];for(const n of l)if(Array.isArray(n.extensions))for(const o of n.extensions)a.push(`.${o.replace(/^\./,"")}`);return a.join(",")}function m(){const l=d();async function a(r={}){if(c().isEmbedded){const e=await l.sendRaw({type:"fs.openDialog",title:r.title,filters:r.filters},6e4);if(e&&e.ok===!1)throw new Error(e.error||"fs.openDialog failed");const t=e?.result??e;return{canceled:!!t.canceled,path:t.path??null,content:t.content??null,size:t.size,reason:t.reason}}return u({accept:p(r.filters)})}async function n(r,e={}){if(typeof r!="string")throw new Error("content must be a string");if(c().isEmbedded){const t=await l.sendRaw({type:"fs.saveDialog",title:e.title,defaultPath:e.defaultPath,filters:e.filters,content:r},6e4);if(t&&t.ok===!1)throw new Error(t.error||"fs.saveDialog failed");const s=t?.result??t;return{canceled:!!s.canceled,path:s.path??null}}return f(r,{defaultPath:e.defaultPath})}async function o(r,e={}){const t=JSON.stringify(r,null,2),s={...e,defaultPath:e.defaultPath||"data.json",filters:e.filters||[{name:"JSON",extensions:["json"]}]};return n(t,s)}async function i(r={}){if(!c().isEmbedded)return{canceled:!0,path:null,initialized:!1,unsupported:!0};const e=await l.sendRaw({type:"fs.openDirectory",title:r.title},6e4);if(e&&e.ok===!1)throw new Error(e.error||"fs.openDirectory failed");const t=e?.result??e;return{canceled:!!t.canceled,path:t.path??null,initialized:!!t.initialized}}return{pickFileText:a,saveText:n,saveJson:o,pickDirectory:i}}export{m as u};
+import{u as d}from"./index-UUMCA2Sq.js";import{u as c}from"./useShellMode-CgR0wCYM.js";function u({accept:l=""}={}){return new Promise(a=>{if(typeof document>"u"){a({canceled:!0,path:null,content:null});return}const n=document.createElement("input");n.type="file",l&&(n.accept=l),n.style.display="none",document.body.appendChild(n);let o=!1;const i=()=>{n.parentNode&&n.parentNode.removeChild(n)},r=()=>{if(o)return;o=!0;const e=n.files&&n.files[0];if(!e){i(),a({canceled:!0,path:null,content:null});return}const t=new FileReader;t.onload=()=>{i(),a({canceled:!1,path:e.name,size:e.size,content:typeof t.result=="string"?t.result:""})},t.onerror=()=>{i(),a({canceled:!1,path:e.name,size:e.size,content:null,reason:"read_failed"})},t.readAsText(e)};n.addEventListener("change",r),n.click()})}function f(l,{defaultPath:a="download.txt"}={}){if(typeof document>"u")return{canceled:!0,path:null};const n=new Blob([l],{type:"text/plain"}),o=URL.createObjectURL(n),i=document.createElement("a");return i.href=o,i.download=a,document.body.appendChild(i),i.click(),document.body.removeChild(i),URL.revokeObjectURL(o),{canceled:!1,path:a}}function p(l){if(!Array.isArray(l))return"";const a=[];for(const n of l)if(Array.isArray(n.extensions))for(const o of n.extensions)a.push(`.${o.replace(/^\./,"")}`);return a.join(",")}function m(){const l=d();async function a(r={}){if(c().isEmbedded){const e=await l.sendRaw({type:"fs.openDialog",title:r.title,filters:r.filters},6e4);if(e&&e.ok===!1)throw new Error(e.error||"fs.openDialog failed");const t=e?.result??e;return{canceled:!!t.canceled,path:t.path??null,content:t.content??null,size:t.size,reason:t.reason}}return u({accept:p(r.filters)})}async function n(r,e={}){if(typeof r!="string")throw new Error("content must be a string");if(c().isEmbedded){const t=await l.sendRaw({type:"fs.saveDialog",title:e.title,defaultPath:e.defaultPath,filters:e.filters,content:r},6e4);if(t&&t.ok===!1)throw new Error(t.error||"fs.saveDialog failed");const s=t?.result??t;return{canceled:!!s.canceled,path:s.path??null}}return f(r,{defaultPath:e.defaultPath})}async function o(r,e={}){const t=JSON.stringify(r,null,2),s={...e,defaultPath:e.defaultPath||"data.json",filters:e.filters||[{name:"JSON",extensions:["json"]}]};return n(t,s)}async function i(r={}){if(!c().isEmbedded)return{canceled:!0,path:null,initialized:!1,unsupported:!0};const e=await l.sendRaw({type:"fs.openDirectory",title:r.title},6e4);if(e&&e.ok===!1)throw new Error(e.error||"fs.openDirectory failed");const t=e?.result??e;return{canceled:!!t.canceled,path:t.path??null,initialized:!!t.initialized}}return{pickFileText:a,saveText:n,saveJson:o,pickDirectory:i}}export{m as u};

package/src/assets/web-panel/assets/{usePersonalDataHub-BXI-FLwS.js → usePersonalDataHub-BwnnnZjU.js}

@@ -1 +1 @@
-import{u as f}from"./index-DDGBasj6.js";function d(n){if(!n)return n;if(n.error)throw new Error(n.error);return n.result!==void 0?n.result:n}function p(n,t,a,e,r){return typeof n.onMessage!="function"||typeof n.sendRaw!="function"?n.sendRaw({type:t,...a},r).then(d):new Promise((u,s)=>{const l=typeof crypto<"u"&&crypto.randomUUID?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`,w=`${t}.event`,g=`${t}.end`;let c=!1,y=()=>{};const o=(i,b)=>{if(!c){c=!0,clearTimeout(m);try{y()}catch{}i(b)}},m=setTimeout(()=>{o(s,new Error(`stream timeout (${r}ms): ${t}`))},r),h=n.onMessage(i=>{if(!(c||!i)&&!(i.id!==l&&i.requestId!==l)){if(i.type===w){if(typeof e=="function")try{e(i.event||i)}catch{}return}if(i.type===g){o(u,d(i));return}i.type==="error"&&o(s,new Error(i.message||"stream error"))}});y=typeof h=="function"?h:()=>{},Promise.resolve(n.sendRaw({id:l,type:t,...a},r)).catch(()=>{})})}function D(){const n=f(),t=(a,e={},r=3e4)=>n.sendRaw({type:a,...e},r).then(d);return{async health(){return await t("personal-data-hub.health",{},8e3)},async stats(){return await t("personal-data-hub.stats",{},8e3)},async listAdapters(){return await t("personal-data-hub.list-adapters",{},5e3)},async pickFile(a={}){try{const e=await n.sendRaw({type:"fs.openDialog",title:a.title,filters:a.filters},6e4),r=e&&e.result!==void 0?e.result:e;return r&&r.ok&&typeof r.filePath=="string"?r.filePath:null}catch{return null}},async adapterReadiness(a){return await t("personal-data-hub.adapter-readiness",Number.isInteger(a)?{timeoutMs:a}:{},15e3)},async syncAdapter(a,e={}){return await t("personal-data-hub.sync-adapter",{name:a,options:e},12e4)},async syncAll(a={}){return await t("personal-data-hub.sync-all",{options:a},6e5)},async registerMock({name:a="mock",count:e=20,seed:r=1}={}){return await t("personal-data-hub.register-mock",{name:a,count:e,seed:r})},async unregister(a){return await t("personal-data-hub.unregister",{name:a})},async ask(a,e={}){return await t("personal-data-hub.ask",{question:a,options:e},18e4)},async queryEvents(a={}){return await t("personal-data-hub.query-events",a,1e4)},async recentAudit(a={}){return await t("personal-data-hub.recent-audit",a,1e4)},async searchEvents(a={}){return await t("personal-data-hub.search-events",a,15e3)},async facetCounts(a={}){return await t("personal-data-hub.facet-counts",a,1e4)},async testEmailAuth(a){return await t("personal-data-hub.test-email-auth",{account:a},3e4)},async registerEmail(a,e={}){return await t("personal-data-hub.register-email",{account:a,opts:e},15e3)},async unregisterEmail(a){return await t("personal-data-hub.unregister-email",{email:a},5e3)},async listEmailAccounts(){return await t("personal-data-hub.list-email-accounts",{},5e3)},async eventDetail(a){return await t("personal-data-hub.event-detail",{eventId:a},5e3)},async syncAdapterStream(a,e={},r){return await p(n,"personal-data-hub.sync-adapter-stream",{name:a,options:e},r,6e5)},async syncAllStream(a={},e){return await p(n,"personal-data-hub.sync-all-stream",{options:a},e,9e5)},async registerAlipay(a,e={}){return await t("personal-data-hub.register-alipay",{account:a,opts:e},15e3)},async unregisterAlipay(a){return await t("personal-data-hub.unregister-alipay",{email:a},5e3)},async listAlipayAccounts(){return await t("personal-data-hub.list-alipay-accounts",{},5e3)},async importAlipayBill({zipPath:a,csvPath:e,zipPassword:r}={}){return await t("personal-data-hub.import-alipay-bill",{zipPath:a,csvPath:e,zipPassword:r},3e5)},async reviewQueueList(a=50){return await t("personal-data-hub.review-queue-list",{limit:a},5e3)},async reviewDecision(a,e){return await t("personal-data-hub.review-decision",{reviewId:a,decision:e},5e3)},async manualMerge(a,e){return await t("personal-data-hub.manual-merge",{aId:a,bId:e},5e3)},async manualUnmerge(a){return await t("personal-data-hub.manual-unmerge",{personId:a},5e3)},async resolverDrain(a=50){return await t("personal-data-hub.resolver-drain",{limit:a},18e4)},async resolverStats(){return await t("personal-data-hub.resolver-stats",{},5e3)},async skillsList(){return await t("personal-data-hub.skills-list",{},5e3)},async runSkill(a,e={}){return await t("personal-data-hub.run-skill",{name:a,options:e},12e4)},async openAichatLogin(a,e={}){return await t("personal-data-hub.aichat-open-login",{vendor:a,opts:e},1e4)},async probeAichatCookies(a,e){return await t("personal-data-hub.aichat-probe-cookies",{vendor:a,cookieHeader:e},1e4)},async registerAichatVendor(a,e,r={}){return await t("personal-data-hub.aichat-register-vendor",{vendor:a,cookies:e,opts:r},3e4)},async rotateAichatLogin(a){return await t("personal-data-hub.aichat-rotate-login",{vendor:a},1e4)},async listAichatAccounts(){return await t("personal-data-hub.list-aichat-accounts",{},5e3)},async unregisterAichat(a){return await t("personal-data-hub.unregister-aichat",{vendor:a},5e3)},async aichatHealthCheckOnce(){return await t("personal-data-hub.aichat-health-check-once",{},3e4)},async probeWechatEnv(){return await t("personal-data-hub.wechat-env-probe",{},15e3)},async registerWechat({account:a,dbPath:e,wechatDataPath:r,fridaOpts:u,keyProviderOverride:s}={}){return await t("personal-data-hub.register-wechat",{account:a,dbPath:e,wechatDataPath:r,fridaOpts:u,keyProviderOverride:s},45e3)},async listWechatAccounts(){return await t("personal-data-hub.list-wechat-accounts",{},5e3)},async unregisterWechat(a){return await t("personal-data-hub.unregister-wechat",{uin:a},5e3)},async bilibiliAdbSync(a={}){return await t("personal-data-hub.bilibili-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},12e4)},async bilibiliAdbDoctor(){return await t("personal-data-hub.bilibili-adb-doctor",{},15e3)},async weiboAdbSync(a={}){return await t("personal-data-hub.weibo-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)},async xhsAdbSync(a={}){return await t("personal-data-hub.xhs-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)},async toutiaoAdbSync(a={}){return await t("personal-data-hub.toutiao-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},9e4)},async kuaishouAdbSync(a={}){return await t("personal-data-hub.kuaishou-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},12e4)},async bridgeDoctor(){return await t("personal-data-hub.bridge-doctor",{},6e4)},async douyinAdbSync(a={}){return await t("personal-data-hub.douyin-adb-sync",{uid:a.uid,limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)}}}export{D as u};
+import{u as f}from"./index-UUMCA2Sq.js";function d(n){if(!n)return n;if(n.error)throw new Error(n.error);return n.result!==void 0?n.result:n}function p(n,t,a,e,r){return typeof n.onMessage!="function"||typeof n.sendRaw!="function"?n.sendRaw({type:t,...a},r).then(d):new Promise((u,s)=>{const l=typeof crypto<"u"&&crypto.randomUUID?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`,w=`${t}.event`,g=`${t}.end`;let c=!1,y=()=>{};const o=(i,b)=>{if(!c){c=!0,clearTimeout(m);try{y()}catch{}i(b)}},m=setTimeout(()=>{o(s,new Error(`stream timeout (${r}ms): ${t}`))},r),h=n.onMessage(i=>{if(!(c||!i)&&!(i.id!==l&&i.requestId!==l)){if(i.type===w){if(typeof e=="function")try{e(i.event||i)}catch{}return}if(i.type===g){o(u,d(i));return}i.type==="error"&&o(s,new Error(i.message||"stream error"))}});y=typeof h=="function"?h:()=>{},Promise.resolve(n.sendRaw({id:l,type:t,...a},r)).catch(()=>{})})}function D(){const n=f(),t=(a,e={},r=3e4)=>n.sendRaw({type:a,...e},r).then(d);return{async health(){return await t("personal-data-hub.health",{},8e3)},async stats(){return await t("personal-data-hub.stats",{},8e3)},async listAdapters(){return await t("personal-data-hub.list-adapters",{},5e3)},async pickFile(a={}){try{const e=await n.sendRaw({type:"fs.openDialog",title:a.title,filters:a.filters},6e4),r=e&&e.result!==void 0?e.result:e;return r&&r.ok&&typeof r.filePath=="string"?r.filePath:null}catch{return null}},async adapterReadiness(a){return await t("personal-data-hub.adapter-readiness",Number.isInteger(a)?{timeoutMs:a}:{},15e3)},async syncAdapter(a,e={}){return await t("personal-data-hub.sync-adapter",{name:a,options:e},12e4)},async syncAll(a={}){return await t("personal-data-hub.sync-all",{options:a},6e5)},async registerMock({name:a="mock",count:e=20,seed:r=1}={}){return await t("personal-data-hub.register-mock",{name:a,count:e,seed:r})},async unregister(a){return await t("personal-data-hub.unregister",{name:a})},async ask(a,e={}){return await t("personal-data-hub.ask",{question:a,options:e},18e4)},async queryEvents(a={}){return await t("personal-data-hub.query-events",a,1e4)},async recentAudit(a={}){return await t("personal-data-hub.recent-audit",a,1e4)},async searchEvents(a={}){return await t("personal-data-hub.search-events",a,15e3)},async facetCounts(a={}){return await t("personal-data-hub.facet-counts",a,1e4)},async testEmailAuth(a){return await t("personal-data-hub.test-email-auth",{account:a},3e4)},async registerEmail(a,e={}){return await t("personal-data-hub.register-email",{account:a,opts:e},15e3)},async unregisterEmail(a){return await t("personal-data-hub.unregister-email",{email:a},5e3)},async listEmailAccounts(){return await t("personal-data-hub.list-email-accounts",{},5e3)},async eventDetail(a){return await t("personal-data-hub.event-detail",{eventId:a},5e3)},async syncAdapterStream(a,e={},r){return await p(n,"personal-data-hub.sync-adapter-stream",{name:a,options:e},r,6e5)},async syncAllStream(a={},e){return await p(n,"personal-data-hub.sync-all-stream",{options:a},e,9e5)},async registerAlipay(a,e={}){return await t("personal-data-hub.register-alipay",{account:a,opts:e},15e3)},async unregisterAlipay(a){return await t("personal-data-hub.unregister-alipay",{email:a},5e3)},async listAlipayAccounts(){return await t("personal-data-hub.list-alipay-accounts",{},5e3)},async importAlipayBill({zipPath:a,csvPath:e,zipPassword:r}={}){return await t("personal-data-hub.import-alipay-bill",{zipPath:a,csvPath:e,zipPassword:r},3e5)},async reviewQueueList(a=50){return await t("personal-data-hub.review-queue-list",{limit:a},5e3)},async reviewDecision(a,e){return await t("personal-data-hub.review-decision",{reviewId:a,decision:e},5e3)},async manualMerge(a,e){return await t("personal-data-hub.manual-merge",{aId:a,bId:e},5e3)},async manualUnmerge(a){return await t("personal-data-hub.manual-unmerge",{personId:a},5e3)},async resolverDrain(a=50){return await t("personal-data-hub.resolver-drain",{limit:a},18e4)},async resolverStats(){return await t("personal-data-hub.resolver-stats",{},5e3)},async skillsList(){return await t("personal-data-hub.skills-list",{},5e3)},async runSkill(a,e={}){return await t("personal-data-hub.run-skill",{name:a,options:e},12e4)},async openAichatLogin(a,e={}){return await t("personal-data-hub.aichat-open-login",{vendor:a,opts:e},1e4)},async probeAichatCookies(a,e){return await t("personal-data-hub.aichat-probe-cookies",{vendor:a,cookieHeader:e},1e4)},async registerAichatVendor(a,e,r={}){return await t("personal-data-hub.aichat-register-vendor",{vendor:a,cookies:e,opts:r},3e4)},async rotateAichatLogin(a){return await t("personal-data-hub.aichat-rotate-login",{vendor:a},1e4)},async listAichatAccounts(){return await t("personal-data-hub.list-aichat-accounts",{},5e3)},async unregisterAichat(a){return await t("personal-data-hub.unregister-aichat",{vendor:a},5e3)},async aichatHealthCheckOnce(){return await t("personal-data-hub.aichat-health-check-once",{},3e4)},async probeWechatEnv(){return await t("personal-data-hub.wechat-env-probe",{},15e3)},async registerWechat({account:a,dbPath:e,wechatDataPath:r,fridaOpts:u,keyProviderOverride:s}={}){return await t("personal-data-hub.register-wechat",{account:a,dbPath:e,wechatDataPath:r,fridaOpts:u,keyProviderOverride:s},45e3)},async listWechatAccounts(){return await t("personal-data-hub.list-wechat-accounts",{},5e3)},async unregisterWechat(a){return await t("personal-data-hub.unregister-wechat",{uin:a},5e3)},async bilibiliAdbSync(a={}){return await t("personal-data-hub.bilibili-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},12e4)},async bilibiliAdbDoctor(){return await t("personal-data-hub.bilibili-adb-doctor",{},15e3)},async weiboAdbSync(a={}){return await t("personal-data-hub.weibo-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)},async xhsAdbSync(a={}){return await t("personal-data-hub.xhs-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)},async toutiaoAdbSync(a={}){return await t("personal-data-hub.toutiao-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},9e4)},async kuaishouAdbSync(a={}){return await t("personal-data-hub.kuaishou-adb-sync",{limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},12e4)},async bridgeDoctor(){return await t("personal-data-hub.bridge-doctor",{},6e4)},async douyinAdbSync(a={}){return await t("personal-data-hub.douyin-adb-sync",{uid:a.uid,limits:a.limits,stagingDir:a.stagingDir,displayName:a.displayName},6e4)}}}export{D as u};

package/src/assets/web-panel/assets/{vnode-CYE0CVkI.js → vnode-SU-N4pum.js}

@@ -1 +1 @@
-import{N as i,h as a,w as l}from"./index-DDGBasj6.js";import{a7 as o,k as g,C as d,F as f,A as p}from"./vendor-BvqAck49.js";function c(e){let r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},t=arguments.length>2&&arguments[2]!==void 0?arguments[2]:!0,s=arguments.length>3&&arguments[3]!==void 0?arguments[3]:!1,u=e;if(Array.isArray(e)&&(u=i(e)[0]),!u)return null;const n=o(u,r,s);return n.props=t?a(a({},n.props),r):n.props,l(typeof n.props.class!="object","class must be string"),n}function V(e){let r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},t=arguments.length>2&&arguments[2]!==void 0?arguments[2]:!0;return e.map(s=>c(s,r,t))}function v(e,r,t){p(o(e,a({},r)),t)}const m=e=>(e||[]).some(r=>g(r)?!(r.type===d||r.type===f&&!m(r.children)):!0)?e:null;function h(e,r,t,s){var u;const n=(u=e[r])===null||u===void 0?void 0:u.call(e,t);return m(n)?n:s?.()}export{h as a,V as b,c,v as t};
+import{N as i,h as a,w as l}from"./index-UUMCA2Sq.js";import{a7 as o,k as g,C as d,F as f,A as p}from"./vendor-BvqAck49.js";function c(e){let r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},t=arguments.length>2&&arguments[2]!==void 0?arguments[2]:!0,s=arguments.length>3&&arguments[3]!==void 0?arguments[3]:!1,u=e;if(Array.isArray(e)&&(u=i(e)[0]),!u)return null;const n=o(u,r,s);return n.props=t?a(a({},n.props),r):n.props,l(typeof n.props.class!="object","class must be string"),n}function V(e){let r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},t=arguments.length>2&&arguments[2]!==void 0?arguments[2]:!0;return e.map(s=>c(s,r,t))}function v(e,r,t){p(o(e,a({},r)),t)}const m=e=>(e||[]).some(r=>g(r)?!(r.type===d||r.type===f&&!m(r.children)):!0)?e:null;function h(e,r,t,s){var u;const n=(u=e[r])===null||u===void 0?void 0:u.call(e,t);return m(n)?n:s?.()}export{h as a,V as b,c,v as t};

package/src/assets/web-panel/assets/{zoom-B2-MtXVF.js → zoom-DHScfpTP.js}

@@ -1,4 +1,4 @@
-import{K as o}from"./index-DDGBasj6.js";import{i as f}from"./motion-DgWAtKps.js";const c=new o("antZoomIn",{"0%":{transform:"scale(0.2)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),y=new o("antZoomOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.2)",opacity:0}}),a=new o("antZoomBigIn",{"0%":{transform:"scale(0.8)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),s=new o("antZoomBigOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.8)",opacity:0}}),g=new o("antZoomUpIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 0%"}}),O=new o("antZoomUpOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 0%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0}}),l=new o("antZoomLeftIn",{"0%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"0% 50%"}}),u=new o("antZoomLeftOut",{"0%":{transform:"scale(1)",transformOrigin:"0% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0}}),p=new o("antZoomRightIn",{"0%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"100% 50%"}}),z=new o("antZoomRightOut",{"0%":{transform:"scale(1)",transformOrigin:"100% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0}}),K=new o("antZoomDownIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 100%"}}),w=new o("antZoomDownOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 100%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0}}),I={zoom:{inKeyframes:c,outKeyframes:y},"zoom-big":{inKeyframes:a,outKeyframes:s},"zoom-big-fast":{inKeyframes:a,outKeyframes:s},"zoom-left":{inKeyframes:l,outKeyframes:u},"zoom-right":{inKeyframes:p,outKeyframes:z},"zoom-up":{inKeyframes:g,outKeyframes:O},"zoom-down":{inKeyframes:K,outKeyframes:w}},h=(n,r)=>{const{antCls:m}=n,t=`${m}-${r}`,{inKeyframes:i,outKeyframes:e}=I[r];return[f(t,i,e,r==="zoom-big-fast"?n.motionDurationFast:n.motionDurationMid),{[`
+import{K as o}from"./index-UUMCA2Sq.js";import{i as f}from"./motion-DdrBjRF1.js";const c=new o("antZoomIn",{"0%":{transform:"scale(0.2)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),y=new o("antZoomOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.2)",opacity:0}}),a=new o("antZoomBigIn",{"0%":{transform:"scale(0.8)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),s=new o("antZoomBigOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.8)",opacity:0}}),g=new o("antZoomUpIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 0%"}}),O=new o("antZoomUpOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 0%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0}}),l=new o("antZoomLeftIn",{"0%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"0% 50%"}}),u=new o("antZoomLeftOut",{"0%":{transform:"scale(1)",transformOrigin:"0% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0}}),p=new o("antZoomRightIn",{"0%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"100% 50%"}}),z=new o("antZoomRightOut",{"0%":{transform:"scale(1)",transformOrigin:"100% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0}}),K=new o("antZoomDownIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 100%"}}),w=new o("antZoomDownOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 100%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0}}),I={zoom:{inKeyframes:c,outKeyframes:y},"zoom-big":{inKeyframes:a,outKeyframes:s},"zoom-big-fast":{inKeyframes:a,outKeyframes:s},"zoom-left":{inKeyframes:l,outKeyframes:u},"zoom-right":{inKeyframes:p,outKeyframes:z},"zoom-up":{inKeyframes:g,outKeyframes:O},"zoom-down":{inKeyframes:K,outKeyframes:w}},h=(n,r)=>{const{antCls:m}=n,t=`${m}-${r}`,{inKeyframes:i,outKeyframes:e}=I[r];return[f(t,i,e,r==="zoom-big-fast"?n.motionDurationFast:n.motionDurationMid),{[`
         ${t}-enter,
         ${t}-appear
       `]:{transform:"scale(0)",opacity:0,animationTimingFunction:n.motionEaseOutCirc,"&-prepare":{transform:"none"}},[`${t}-leave`]:{animationTimingFunction:n.motionEaseInOutCirc}}]};export{h as i,c as z};

package/src/assets/web-panel/index.html

@@ -8,7 +8,7 @@
     // Injected by web-ui-server.js at serve time
     window.__CC_CONFIG__ = __CC_CONFIG_PLACEHOLDER__;
   </script>
-  <script type="module" crossorigin src="./assets/index-DDGBasj6.js"></script>
+  <script type="module" crossorigin src="./assets/index-UUMCA2Sq.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-BvqAck49.js">
   <link rel="modulepreload" crossorigin href="./assets/icons-DP3uiYxy.js">
   <link rel="stylesheet" crossorigin href="./assets/index-Cq93VfoF.css">

package/src/auth/npm-auth.js

@@ -0,0 +1,65 @@
+/**
+ * npm authentication utilities (ESM)
+ * Mirrors Claude Code /login /logout behavior
+ * @module auth/npm-auth
+ */
+
+import { execSync } from "child_process";
+import { logger } from "../lib/logger.js";
+
+/**
+ * Check if user is currently logged in to npm
+ * @returns {boolean}
+ */
+export function isLoggedIn() {
+  try {
+    execSync("npm whoami", { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Get current npm username
+ * @returns {string|null}
+ */
+export function getCurrentUser() {
+  try {
+    return execSync("npm whoami", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Run npm login
+ * @returns {Promise<boolean>} success
+ */
+export async function login() {
+  try {
+    logger.info("Running npm login...");
+    execSync("npm login", { stdio: "inherit" });
+    return isLoggedIn();
+  } catch (err) {
+    logger.error(`Login failed: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Run npm logout
+ * @returns {Promise<boolean>} success
+ */
+export async function logout() {
+  try {
+    logger.info("Running npm logout...");
+    execSync("npm logout", { stdio: "inherit" });
+    return !isLoggedIn();
+  } catch (err) {
+    logger.error(`Logout failed: ${err.message}`);
+    return false;
+  }
+}
+
+export default { isLoggedIn, getCurrentUser, login, logout };

package/src/commands/agent.js

@@ -16,6 +16,7 @@ import {
 } from "../runtime/fallback-model.js";
 import { resolveImages, resolveVisionLlm } from "../lib/image-input.js";
 import { loadConfig } from "../lib/config-manager.js";
+import { normalizeAgentSandbox } from "../lib/agent-sandbox.js";
 
 /**
  * Resolve + validate `--add-dir` values into absolute, existing, de-duped
@@ -171,6 +172,15 @@ export function registerAgentCommand(program) {
       "--worktree",
       "Run this session in a fresh git worktree (isolated branch; auto-removed when the session changes nothing)",
     )
+    .option(
+      "--sandbox [image]",
+      "Run shell commands in an ephemeral Docker sandbox (network disabled by default)",
+    )
+    .option("--sandbox-network", "Allow network access inside --sandbox")
+    .option(
+      "--bg, --background",
+      "Start as a detached background agent and return its id immediately",
+    )
     .option("--agent-id <id>", "Agent id for scoped memory recall")
     .option("--recall-limit <n>", "Top-K memories to inject into system prompt")
     .option("--recall-query <q>", "Query string for startup memory recall")
@@ -308,7 +318,29 @@ export function registerAgentCommand(program) {
       "--replay-user-messages",
       "Stream-input mode: echo each accepted stdin user message back as a `user` event (transcript/correlation)",
     )
+    .option(
+      "--allow-dangerous-bypass",
+      "Bypass all permission prompts in headless mode (DANGEROUS: auto-approves all tool calls)",
+      false,
+    )
+    .option("-y, --yolo", "Alias for --allow-dangerous-bypass", false)
+    .option(
+      "--dangerously-skip-permissions",
+      "Alias for --allow-dangerous-bypass",
+      false,
+    )
     .action(async (task, options, command) => {
+      const bypassPermissions = !!(
+        options.allowDangerousBypass ||
+        options.yolo ||
+        options.dangerouslySkipPermissions
+      );
+      if (bypassPermissions) {
+        process.env.CC_BYPASS_PERMISSIONS = "1";
+        process.stderr.write(
+          "⚠️  DANGER MODE: All permissions bypassed, no prompts will be shown.\n",
+        );
+      }
       // --safe-mode flag OR CC_SAFE_MODE / CLAUDE_CODE_SAFE_MODE env (Claude-Code
       // 2.1.169 parity): flip every customization kill-switch BEFORE anything
       // loads. Permission rules stay active.
@@ -735,7 +767,62 @@ export function registerAgentCommand(program) {
         if (piped) prompt = piped;
       }
 
+      if (options.bg && !prompt) {
+        process.stderr.write(
+          "--bg requires a task via positional text, -p, or piped stdin.\n",
+        );
+        process.exitCode = 1;
+        return;
+      }
+
       if (prompt) {
+        if (options.bg) {
+          if (options.worktree) {
+            process.stderr.write(
+              "--bg and --worktree cannot be combined yet; create the worktree first and launch the background agent from it.\n",
+            );
+            process.exitCode = 1;
+            return;
+          }
+          const { launchBackgroundAgent } =
+            await import("../lib/background-agent-supervisor.js");
+          const childArgv = process.argv
+            .slice(2)
+            .filter((arg) => arg !== "--bg" && arg !== "--background");
+          const hasSessionArg = childArgv.some(
+            (arg) =>
+              arg === "--session" ||
+              arg === "--resume" ||
+              arg === "--continue" ||
+              arg === "-c",
+          );
+          const sessionId =
+            options.session ||
+            `session-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
+          if (!hasSessionArg) childArgv.push("--session", sessionId);
+          const promptWasPiped =
+            positional.length === 0 &&
+            !(typeof options.print === "string" && options.print.trim());
+          if (promptWasPiped) childArgv.push(prompt);
+          const state = launchBackgroundAgent({
+            argv: childArgv,
+            cwd: process.cwd(),
+            sessionId,
+            title: prompt.slice(0, 100),
+          });
+          if (options.outputFormat === "json") {
+            console.log(JSON.stringify(state));
+          } else {
+            console.log(`Background agent started: ${state.id}`);
+            console.log(`  logs: cc agents logs ${state.id}`);
+            console.log(`  stop: cc agents stop ${state.id}`);
+          }
+          return;
+        }
+        const agentSandbox = normalizeAgentSandbox(options.sandbox, {
+          cwd: process.cwd(),
+          network: options.sandboxNetwork === true,
+        });
         // Resume requested onto a session with no headless (JSONL) transcript?
         // Warn instead of silently starting empty 鈥?headless resume rebuilds
         // from the JSONL store only (DB-only sessions are not replayable here).
@@ -775,6 +862,7 @@ export function registerAgentCommand(program) {
           allowedTools: parseToolList(options.allowedTools),
           disallowedTools: parseToolList(options.disallowedTools),
           additionalDirectories,
+          sandbox: agentSandbox,
           autoCheckpoint,
           maxTurns,
           // commander maps --no-file-refs 鈫?options.fileRefs === false
@@ -884,6 +972,10 @@ export function registerAgentCommand(program) {
         parkOnExit: options.parkOnExit, // false when --no-park-on-exit
         bundlePath: options.bundle || null,
         additionalDirectories,
+        sandbox: normalizeAgentSandbox(options.sandbox, {
+          cwd: process.cwd(),
+          network: options.sandboxNetwork === true,
+        }),
         autoCheckpoint,
         // --vim: start the REPL in vim-mode editing (also CC_VIM=1 or /vim).
         vimMode: options.vim === true,

package/src/commands/agents.js

@@ -22,6 +22,74 @@ export function registerAgentsCommand(program) {
     .command("agents")
     .description("User-defined subagents (.claude/agents/*.md)");
 
+  cmd
+    .command("background")
+    .alias("bg")
+    .description("List background agent sessions")
+    .option("--all", "Include completed, failed, stopped and lost sessions")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      const { listBackgroundAgents } =
+        await import("../lib/background-agent-supervisor.js");
+      const sessions = listBackgroundAgents({ all: options.all === true });
+      if (options.json) {
+        console.log(JSON.stringify(sessions, null, 2));
+        return;
+      }
+      if (sessions.length === 0) {
+        logger.log(chalk.gray("No background agents."));
+        return;
+      }
+      for (const session of sessions) {
+        const elapsed = session.endedAt
+          ? session.endedAt - session.startedAt
+          : Date.now() - session.startedAt;
+        logger.log(
+          `${chalk.cyan(session.id)}  ${session.status.padEnd(9)} ${Math.max(0, Math.round(elapsed / 1000))}s  ${session.title || ""}`,
+        );
+        logger.log(chalk.gray(`  pid ${session.pid}  ${session.cwd}`));
+      }
+    });
+
+  cmd
+    .command("logs <id>")
+    .description("Print recent output from a background agent")
+    .option("-n, --lines <n>", "Number of lines", "100")
+    .action(async (id, options) => {
+      try {
+        const { readBackgroundAgentState, readBackgroundAgentLog } =
+          await import("../lib/background-agent-supervisor.js");
+        if (!readBackgroundAgentState(id)) {
+          throw new Error(`Background agent not found: ${id}`);
+        }
+        process.stdout.write(
+          readBackgroundAgentLog(id, { lines: Number(options.lines) }),
+        );
+      } catch (error) {
+        logger.error(chalk.red(error.message));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command("stop <id>")
+    .description("Stop a running background agent")
+    .option("--json", "Output as JSON")
+    .action(async (id, options) => {
+      try {
+        const { stopBackgroundAgent } =
+          await import("../lib/background-agent-supervisor.js");
+        const state = stopBackgroundAgent(id);
+        if (options.json) console.log(JSON.stringify(state, null, 2));
+        else if (state.stopped)
+          logger.log(chalk.green(`Stopped background agent ${id}`));
+        else logger.log(chalk.gray(`${id} is already ${state.status}`));
+      } catch (error) {
+        logger.error(chalk.red(error.message));
+        process.exitCode = 1;
+      }
+    });
+
   // ── list ──────────────────────────────────────────────────────────────
   cmd
     .command("list")

package/src/commands/permissions.js

@@ -53,26 +53,33 @@ export function registerPermissionsCommand(program) {
   cmd
     .command("list")
     .alias("ls")
-    .description("Show the merged permission ruleset and where each rule came from")
+    .description(
+      "Show the merged permission ruleset and where each rule came from",
+    )
     .option("--json", "Output as JSON")
     .option("--settings <file>", "Also merge an explicit settings file")
     .action(async (options) => {
       try {
         const { loadSettings } = await import("../lib/settings-loader.cjs");
-        const { rules, sources, files } = loadSettings({
+        const { rules, sources, files, managed, managedFile } = loadSettings({
           cwd: process.cwd(),
           settingsFile: options.settings,
         });
         if (options.json) {
-          console.log(JSON.stringify({ rules, sources, files }, null, 2));
+          console.log(
+            JSON.stringify(
+              { rules, sources, files, managed, managedFile },
+              null,
+              2,
+            ),
+          );
           return;
         }
-        const total =
-          rules.allow.length + rules.ask.length + rules.deny.length;
+        const total = rules.allow.length + rules.ask.length + rules.deny.length;
         if (total === 0) {
           logger.log(
             chalk.gray(
-              "No permission rules. Add one: cc permissions add deny \"Bash(rm:*)\"\n" +
+              'No permission rules. Add one: cc permissions add deny "Bash(rm:*)"\n' +
                 "(or create .claude/settings.json with a permissions block)",
             ),
           );
@@ -89,6 +96,40 @@ export function registerPermissionsCommand(program) {
         if (files.length) {
           logger.log(chalk.dim(`\nsources: ${files.join(", ")}`));
         }
+        if (managedFile) {
+          logger.log(chalk.yellow(`managed policy: ${managedFile}`));
+          if (managed?.allowManagedPermissionRulesOnly) {
+            logger.log(
+              chalk.yellow("  user/project permission rules disabled"),
+            );
+          }
+          if (
+            managed?.disableBypassPermissionsMode === true ||
+            managed?.disableBypassPermissionsMode === "disable"
+          ) {
+            logger.log(chalk.yellow("  bypassPermissions disabled"));
+          }
+          if (managed?.allowManagedHooksOnly) {
+            logger.log(chalk.yellow("  only managed hooks may run"));
+          }
+          if (managed?.allowManagedMcpServersOnly) {
+            logger.log(
+              chalk.yellow("  only managed-allowed MCP servers may connect"),
+            );
+          }
+          if (managed?.requireSignedPlugins) {
+            logger.log(chalk.yellow("  signed plugin manifests required"));
+          }
+          if (
+            Array.isArray(managed?.allowedPlugins) ||
+            Array.isArray(managed?.deniedPlugins) ||
+            Array.isArray(managed?.blockedMarketplaces)
+          ) {
+            logger.log(
+              chalk.yellow("  managed plugin supply-chain policy active"),
+            );
+          }
+        }
       } catch (err) {
         logger.error(chalk.red(`permissions list failed: ${err.message}`));
         process.exitCode = 1;
@@ -131,7 +172,13 @@ export function registerPermissionsCommand(program) {
         if (options.json) {
           console.log(
             JSON.stringify(
-              { tool: concrete, args: toolArgs, decision, rule: result.rule, source },
+              {
+                tool: concrete,
+                args: toolArgs,
+                decision,
+                rule: result.rule,
+                source,
+              },
               null,
               2,
             ),
@@ -164,14 +211,19 @@ export function registerPermissionsCommand(program) {
   cmd
     .command("add <decision> <rule>")
     .description("Append a rule (allow|ask|deny) to a settings file")
-    .option("--local", "Write to .claude/settings.local.json (personal, gitignored)")
+    .option(
+      "--local",
+      "Write to .claude/settings.local.json (personal, gitignored)",
+    )
     .option("--user", "Write to ~/.claude/settings.json (all projects)")
     .action(async (decision, rule, options) => {
       try {
         const kind = String(decision || "").toLowerCase();
         if (!["allow", "ask", "deny"].includes(kind)) {
           logger.error(
-            chalk.red(`decision must be allow | ask | deny (got "${decision}")`),
+            chalk.red(
+              `decision must be allow | ask | deny (got "${decision}")`,
+            ),
           );
           process.exitCode = 1;
           return;
@@ -188,7 +240,11 @@ export function registerPermissionsCommand(program) {
           return;
         }
 
-        const scope = options.user ? "user" : options.local ? "local" : "project";
+        const scope = options.user
+          ? "user"
+          : options.local
+            ? "local"
+            : "project";
         const { addRule } = await import("../lib/settings-loader.cjs");
         const { file, added } = addRule({
           cwd: process.cwd(),

package/src/commands/plugin.js

@@ -5,6 +5,11 @@
 
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
+import {
+  enforcePluginPolicy,
+  loadPluginManagedPolicy,
+  verifyPluginManifest,
+} from "../lib/plugin-security.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   installPlugin,
@@ -90,9 +95,32 @@ export function registerPluginCommand(program) {
     .option("--description <desc>", "Plugin description")
     .option("--author <author>", "Plugin author")
     .option("--manifest <path>", "Plugin manifest file with skill declarations")
+    .option("--source <source>", "Plugin source or marketplace identifier")
+    .option("--sha256 <hex>", "Expected SHA-256 of the manifest")
+    .option("--signature <path>", "Detached Ed25519 signature of the manifest")
+    .option("--public-key <path>", "PEM public key used to verify --signature")
     .option("--json", "Output as JSON")
     .action(async (name, options) => {
       try {
+        const managed = loadPluginManagedPolicy();
+        enforcePluginPolicy(
+          { name, source: options.source, action: "install" },
+          managed,
+        );
+        let verifiedManifest = null;
+        let parsedManifest = null;
+        if (options.manifest || managed?.requireSignedPlugins) {
+          verifiedManifest = verifyPluginManifest({
+            manifestFile: options.manifest,
+            expectedSha256: options.sha256,
+            signatureFile: options.signature,
+            publicKeyFile: options.publicKey,
+            requireSignature: managed?.requireSignedPlugins === true,
+            trustedKeySha256: managed?.trustedPluginKeySha256,
+            requireTrustedKey: managed?.requireSignedPlugins === true,
+          });
+          parsedManifest = JSON.parse(verifiedManifest.bytes.toString("utf8"));
+        }
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
           logger.error("Database not available");
@@ -111,8 +139,9 @@ export function registerPluginCommand(program) {
         if (options.manifest) {
           try {
             const fs = await import("fs");
-            const manifestContent = fs.readFileSync(options.manifest, "utf-8");
-            const manifest = JSON.parse(manifestContent);
+            const manifest =
+              parsedManifest ||
+              JSON.parse(fs.readFileSync(options.manifest, "utf-8"));
             if (manifest.skills && manifest.skills.length > 0) {
               const path = await import("path");
               const pluginPath = path.dirname(path.resolve(options.manifest));
@@ -131,7 +160,17 @@ export function registerPluginCommand(program) {
         if (options.json) {
           console.log(
             JSON.stringify(
-              { ...result, skills: skillResult.installed },
+              {
+                ...result,
+                skills: skillResult.installed,
+                integrity: verifiedManifest
+                  ? {
+                      sha256: verifiedManifest.sha256,
+                      signatureVerified: verifiedManifest.signatureVerified,
+                      publicKeySha256: verifiedManifest.publicKeySha256,
+                    }
+                  : null,
+              },
               null,
               2,
             ),
@@ -205,6 +244,10 @@ export function registerPluginCommand(program) {
     .argument("<name>", "Plugin name")
     .action(async (name) => {
       try {
+        enforcePluginPolicy(
+          { name, action: "enable" },
+          loadPluginManagedPolicy(),
+        );
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
           logger.error("Database not available");
@@ -262,6 +305,10 @@ export function registerPluginCommand(program) {
     .argument("<version>", "New version")
     .action(async (name, version) => {
       try {
+        enforcePluginPolicy(
+          { name, action: "update" },
+          loadPluginManagedPolicy(),
+        );
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
           logger.error("Database not available");

package/src/lib/agent-sandbox.js

@@ -0,0 +1,72 @@
+/** OS-isolated shell execution for the coding agent. */
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
+export const _deps = { spawnSync };
+
+export function normalizeAgentSandbox(value, options = {}) {
+  if (!value) return null;
+  const image =
+    typeof value === "string" && value.trim() && value !== "true"
+      ? value.trim()
+      : DEFAULT_SANDBOX_IMAGE;
+  return {
+    engine: "docker",
+    image,
+    cwd: path.resolve(options.cwd || process.cwd()),
+    network: options.network === true,
+  };
+}
+
+export function executeSandboxedShell(command, sandbox, options = {}) {
+  if (!sandbox || sandbox.engine !== "docker") {
+    throw new Error("A supported agent sandbox configuration is required");
+  }
+  const hostCwd = path.resolve(options.cwd || sandbox.cwd);
+  const args = ["run", "--rm", "--init"];
+  if (!sandbox.network) args.push("--network", "none");
+  args.push("--mount", `type=bind,source=${hostCwd},target=/workspace`);
+  args.push("--workdir", "/workspace");
+  if (process.platform !== "win32" && process.getuid && process.getgid) {
+    args.push("--user", `${process.getuid()}:${process.getgid()}`);
+  }
+  const env = options.env || {};
+  for (const key of ["CLAUDECODE", "CC_SESSION_ID", "CLAUDE_CODE_SESSION_ID"]) {
+    if (env[key] != null) args.push("--env", `${key}=${env[key]}`);
+  }
+  args.push(sandbox.image, "sh", "-lc", String(command || ""));
+  const result = _deps.spawnSync("docker", args, {
+    encoding: "utf8",
+    timeout: options.timeout,
+    maxBuffer: options.maxBuffer,
+    windowsHide: true,
+  });
+  if (result.error) {
+    return {
+      stdout: result.stdout || "",
+      stderr:
+        result.error.code === "ENOENT"
+          ? "Docker is not installed"
+          : result.error.message,
+      exitCode: typeof result.status === "number" ? result.status : 1,
+      failedToStart: true,
+    };
+  }
+  return {
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: typeof result.status === "number" ? result.status : 1,
+    signal: result.signal || null,
+  };
+}
+
+export function sandboxSummary(sandbox) {
+  if (!sandbox) return null;
+  return {
+    engine: sandbox.engine,
+    image: sandbox.image,
+    network: sandbox.network ? "enabled" : "disabled",
+    workspace: "read-write",
+  };
+}