chainlesschain 0.166.90 → 0.166.91

package/src/lib/process-execution-broker/windows-sandbox.cs

@@ -6,6 +6,8 @@ using System.IO;
 using Microsoft.Win32.SafeHandles;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using System.Runtime.Serialization;
 using System.Runtime.Serialization.Json;
 using System.Text;
@@ -404,6 +406,45 @@ namespace ChainlessChain.WindowsSandbox
         private static extern Int32 DeleteAppContainerProfile(
             string appContainerName);
 
+        [DllImport("FirewallAPI.dll")]
+        private static extern UInt32 NetworkIsolationGetAppContainerConfig(out UInt32 count, out IntPtr sids);
+
+        [DllImport("kernel32.dll")]
+        private static extern IntPtr GetProcessHeap();
+
+        [DllImport("kernel32.dll")]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static extern bool HeapFree(IntPtr heap, UInt32 flags, IntPtr memory);
+
+        private static void AssertNoLoopbackExemption(IntPtr appSid)
+        {
+            UInt32 count;
+            IntPtr entries;
+            UInt32 result = NetworkIsolationGetAppContainerConfig(out count, out entries);
+            if (result != 0) throw new Win32Exception(checked((int)result), "Cannot attest AppContainer loopback exclusions");
+            // SID_AND_ATTRIBUTES contains a pointer and DWORD; x64 tail padding
+            // makes each entry two pointer widths. Free each SID and the array
+            // with the process heap, as documented by this API.
+            int stride = IntPtr.Size == 8 ? 16 : 8;
+            try
+            {
+                if (count > 65536 || (count > 0 && entries == IntPtr.Zero))
+                    throw new InvalidDataException("Invalid AppContainer loopback configuration");
+                for (UInt32 index = 0; index < count; index++)
+                    if (EqualSid(Marshal.ReadIntPtr(entries, checked((int)index * stride)), appSid))
+                        throw new InvalidDataException("Native evaluator SID has a loopback exemption");
+            }
+            finally
+            {
+                if (entries != IntPtr.Zero)
+                {
+                    for (UInt32 index = 0; index < Math.Min(count, 65536U); index++)
+                        HeapFree(GetProcessHeap(), 0, Marshal.ReadIntPtr(entries, checked((int)index * stride)));
+                    HeapFree(GetProcessHeap(), 0, entries);
+                }
+            }
+        }
+
         [DllImport("msvcrt.dll", CallingConvention = CallingConvention.Cdecl)]
         private static extern IntPtr _get_osfhandle(Int32 fileDescriptor);
 
@@ -584,6 +625,13 @@ namespace ChainlessChain.WindowsSandbox
             UInt32 desiredAccess,
             out IntPtr token);
 
+        [DllImport("advapi32.dll", EntryPoint = "SetFileSecurityW", CharSet = CharSet.Unicode, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static extern bool SetFileSecurity(
+            string path,
+            UInt32 securityInformation,
+            byte[] securityDescriptor);
+
         [DllImport("advapi32.dll", SetLastError = true)]
         [return: MarshalAs(UnmanagedType.Bool)]
         private static extern bool CreateRestrictedToken(
@@ -995,7 +1043,7 @@ namespace ChainlessChain.WindowsSandbox
                 "restriction status");
         }
 
-        private static bool TokenHasUnexpectedEnabledPrivileges(IntPtr token)
+        private static bool TokenHasUnexpectedEnabledPrivileges(IntPtr token, bool includeDisabled = false)
         {
             IntPtr privilegesBuffer = IntPtr.Zero;
             try
@@ -1049,11 +1097,11 @@ namespace ChainlessChain.WindowsSandbox
                         privilegeName.ToString(),
                         "SeChangeNotifyPrivilege",
                         StringComparison.Ordinal) &&
-                        (
+                        (includeDisabled || (
                             privilege.Attributes &
                             (
                                 SE_PRIVILEGE_ENABLED |
-                                SE_PRIVILEGE_ENABLED_BY_DEFAULT)) != 0)
+                                SE_PRIVILEGE_ENABLED_BY_DEFAULT)) != 0))
                     {
                         return true;
                     }
@@ -1244,7 +1292,8 @@ namespace ChainlessChain.WindowsSandbox
                         StringComparison.Ordinal))
                     {
                         throw new InvalidDataException(
-                            "Target AppContainer token retained an unexpected privilege");
+                            "Target AppContainer token retained an unexpected privilege: " + privilegeName +
+                            " (attributes=" + privilege.Attributes + ")");
                     }
                 }
                 return SidToString(actualAppContainerSid);
@@ -2102,6 +2151,7 @@ namespace ChainlessChain.WindowsSandbox
             string finalPath,
             FILE_ID_INFO handleIdentity,
             UInt64 handlePathStatFileId,
+            bool allowDirectory,
             out NodeFileIdentityProjection fixedProjection,
             out NodeFileIdentityProjection node22Projection)
         {
@@ -2131,8 +2181,10 @@ namespace ChainlessChain.WindowsSandbox
             }
 
             UInt64 pathStatFileId = unchecked((UInt64)information.FileId);
+            // Evaluator guards also attest directories. Keep the caller's
+            // type restriction consistent across fast and legacy stat paths.
             if (
-                (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 ||
+                (!allowDirectory && (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) ||
                 (information.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0 ||
                 information.VolumeSerialNumber !=
                     handleIdentity.VolumeSerialNumber ||
@@ -2165,13 +2217,14 @@ namespace ChainlessChain.WindowsSandbox
         }
 
         private static LaunchPathFileIdentity ReadLaunchPathFileIdentity(
-            IntPtr handle)
+            IntPtr handle,
+            bool allowDirectory = false)
         {
             BY_HANDLE_FILE_INFORMATION basic;
             if (!GetFileInformationByHandle(handle, out basic))
                 ThrowLastError("GetFileInformationByHandle(launch path)");
             if (
-                (basic.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 ||
+                (!allowDirectory && (basic.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) ||
                 (basic.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
             {
                 throw new InvalidDataException(
@@ -2201,6 +2254,7 @@ namespace ChainlessChain.WindowsSandbox
                     finalPath,
                     fileId,
                     handlePathStatFileId,
+                    allowDirectory,
                     out fixedFastNodeIdentity,
                     out node22FastNodeIdentity);
             }
@@ -3203,6 +3257,248 @@ namespace ChainlessChain.WindowsSandbox
             }
         }
 
+        [DataContract]
+        public sealed class EvaluatorPathSpec
+        {
+            [DataMember] public string path { get; set; }
+            [DataMember] public string dev { get; set; }
+            [DataMember] public string ino { get; set; }
+            [DataMember] public long bytes { get; set; }
+            [DataMember] public string sha256 { get; set; }
+        }
+
+        [DataContract]
+        public sealed class NativeEvaluatorSpec
+        {
+            [DataMember] public int version { get; set; }
+            [DataMember] public string root { get; set; }
+            [DataMember] public string workspace { get; set; }
+            [DataMember] public string control { get; set; }
+            [DataMember] public string scratch { get; set; }
+            [DataMember] public string check { get; set; }
+            [DataMember] public int wallTimeMs { get; set; }
+            [DataMember] public string manifestDigest { get; set; }
+            [DataMember] public EvaluatorPathSpec runtime { get; set; }
+            [DataMember] public EvaluatorPathSpec[] directories { get; set; }
+            [DataMember] public EvaluatorPathSpec[] files { get; set; }
+        }
+
+        private static bool SameEvaluatorPath(string left, string right)
+        {
+            return String.Equals(Path.GetFullPath(left), Path.GetFullPath(right), StringComparison.OrdinalIgnoreCase);
+        }
+
+        private static IntPtr HoldEvaluatorPath(string file, bool directory, List<IntPtr> guards)
+        {
+            ValidateExistingLocalPath(file, "Native evaluator path", false);
+            SECURITY_ATTRIBUTES attributes = new SECURITY_ATTRIBUTES();
+            attributes.nLength = checked((UInt32)Marshal.SizeOf(typeof(SECURITY_ATTRIBUTES)));
+            // Directory handles block rename/deletion; read-only file handles
+            // block writes and deletion for the complete target Job lifetime.
+            IntPtr handle = CreateFile(file, directory ? FILE_READ_ATTRIBUTES : GENERIC_READ,
+                directory ? FILE_SHARE_READ | FILE_SHARE_WRITE : FILE_SHARE_READ,
+                ref attributes, OPEN_EXISTING, directory ? 0x02200000U : 0x00200000U, IntPtr.Zero);
+            if (IsInvalidHandle(handle)) ThrowLastError("CreateFile(native evaluator guard)");
+            guards.Add(handle);
+            return handle;
+        }
+
+        private static void VerifyEvaluatorPath(EvaluatorPathSpec expected, IntPtr handle, bool directory)
+        {
+            LaunchPathFileIdentity actual = ReadLaunchPathFileIdentity(handle, directory);
+            UInt64 device, inode;
+            if (!UInt64.TryParse(expected.dev, out device) || !UInt64.TryParse(expected.ino, out inode) ||
+                !MatchesExpectedNodeFileIdentity(actual, device, inode) ||
+                !SameEvaluatorPath(NormalizeFinalPath(actual.FinalPath), expected.path) ||
+                (((actual.Attributes & FILE_ATTRIBUTE_DIRECTORY) != 0) != directory))
+                throw new InvalidDataException("Native evaluator path identity changed");
+            if (directory) return;
+            if (actual.Links != 1 || actual.Bytes != (UInt64)expected.bytes || !IsLowercaseSha256(expected.sha256))
+                throw new InvalidDataException("Native evaluator file identity or link count changed");
+            using (SafeFileHandle safe = new SafeFileHandle(handle, false))
+            using (FileStream stream = new FileStream(safe, FileAccess.Read))
+            using (SHA256 algorithm = SHA256.Create())
+            {
+                string digest = BitConverter.ToString(algorithm.ComputeHash(stream)).Replace("-", "").ToLowerInvariant();
+                if (digest != expected.sha256) throw new InvalidDataException("Native evaluator file digest changed");
+            }
+        }
+
+        private static void PrepareNativeEvaluator(NativeEvaluatorSpec spec, string application,
+            string[] arguments, string workingDirectory, string appSid, int wallTimeMs,
+            List<IntPtr> guards, ref bool rootAttested)
+        {
+            if (spec.version != 1 || !IsLowercaseSha256(spec.manifestDigest) || spec.runtime == null ||
+                spec.directories == null || spec.directories.Length < 4 || spec.directories.Length > 128 ||
+                spec.files == null || spec.files.Length < 2 || spec.files.Length > 65 ||
+                wallTimeMs < 1 || spec.wallTimeMs != wallTimeMs || String.IsNullOrWhiteSpace(appSid))
+                throw new InvalidDataException("Native evaluator manifest is incomplete");
+            string root = NormalizeLocalDosPath(spec.root, null, "Native evaluator stage");
+            string expectedParent = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Temp");
+            if (!SameEvaluatorPath(Path.GetDirectoryName(root), expectedParent) ||
+                !System.Text.RegularExpressions.Regex.IsMatch(Path.GetFileName(root), "^cc-native-evaluator-[A-Za-z0-9_-]{6}$") ||
+                !SameEvaluatorPath(spec.workspace, Path.Combine(root, "workspace")) ||
+                !SameEvaluatorPath(spec.control, Path.Combine(root, "control")) ||
+                !SameEvaluatorPath(spec.scratch, Path.Combine(root, "scratch")) ||
+                !SameEvaluatorPath(spec.check, Path.Combine(spec.control, "check.cjs")) ||
+                !SameEvaluatorPath(spec.runtime.path, Path.Combine(spec.control, "node.exe")) ||
+                !SameEvaluatorPath(application, spec.runtime.path) || arguments.Length != 5 ||
+                arguments[0] != "--preserve-symlinks" || arguments[1] != "--preserve-symlinks-main" ||
+                !SameEvaluatorPath(arguments[2], spec.check) || !SameEvaluatorPath(arguments[3], spec.workspace) ||
+                !SameEvaluatorPath(arguments[4], spec.scratch) || !SameEvaluatorPath(workingDirectory, spec.scratch) ||
+                !SameEvaluatorPath(spec.directories[0].path, root))
+                throw new InvalidDataException("Native evaluator launch or private stage binding changed");
+            string ancestor = Path.GetPathRoot(root);
+            foreach (string part in root.Substring(ancestor.Length).Split(Path.DirectorySeparatorChar))
+            {
+                ancestor = Path.Combine(ancestor, part);
+                if (!SameEvaluatorPath(ancestor, root)) HoldEvaluatorPath(ancestor, true, guards);
+            }
+            HashSet<string> expected = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+            {
+                string full = Path.GetFullPath(directory.path);
+                if ((!SameEvaluatorPath(full, root) && !full.StartsWith(root + "\\", StringComparison.OrdinalIgnoreCase)) || !expected.Add(full))
+                    throw new InvalidDataException("Native evaluator directory is outside the private stage or duplicated");
+                VerifyEvaluatorPath(directory, HoldEvaluatorPath(full, true, guards), true);
+                if (SameEvaluatorPath(full, root)) rootAttested = true;
+            }
+            long total = 0;
+            foreach (EvaluatorPathSpec file in spec.files)
+            {
+                string full = Path.GetFullPath(file.path);
+                if ((!full.StartsWith(spec.workspace + "\\", StringComparison.OrdinalIgnoreCase) && !SameEvaluatorPath(full, spec.check)) ||
+                    !expected.Add(full) || file.bytes < 0 || file.bytes > 1024 * 1024)
+                    throw new InvalidDataException("Native evaluator file is outside its read-only roots or exceeds bounds");
+                total = checked(total + file.bytes);
+                if (total > 8 * 1024 * 1024) throw new InvalidDataException("Native evaluator tree exceeds byte bound");
+                VerifyEvaluatorPath(file, HoldEvaluatorPath(full, false, guards), false);
+            }
+            if (!expected.Contains(spec.check) || !expected.Contains(spec.workspace) || !expected.Contains(spec.control) || !expected.Contains(spec.scratch))
+                throw new InvalidDataException("Native evaluator manifest omits a required path");
+            if (spec.runtime.bytes < 1 || spec.runtime.bytes > 128 * 1024 * 1024 || !expected.Add(spec.runtime.path))
+                throw new InvalidDataException("Native evaluator runtime exceeds byte bound or duplicates a path");
+            VerifyEvaluatorPath(spec.runtime, HoldEvaluatorPath(application, false, guards), false);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+                foreach (string child in Directory.GetFileSystemEntries(directory.path))
+                    if (!expected.Contains(child)) throw new InvalidDataException("Native evaluator tree has an unlisted entry");
+            if (Directory.GetFileSystemEntries(spec.scratch).Length != 0)
+                throw new InvalidDataException("Native evaluator scratch must start empty");
+            SecurityIdentifier sid = new SecurityIdentifier(appSid);
+            SecurityIdentifier owner = WindowsIdentity.GetCurrent().User;
+            SecurityIdentifier system = new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+            {
+                DirectorySecurity security = new DirectorySecurity();
+                security.SetAccessRuleProtection(true, false);
+                security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl,
+                    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl,
+                    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                bool scratch = SameEvaluatorPath(directory.path, spec.scratch);
+                security.AddAccessRule(new FileSystemAccessRule(sid,
+                    scratch ? FileSystemRights.Modify : FileSystemRights.ReadAndExecute,
+                    scratch ? InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit : InheritanceFlags.None,
+                    PropagationFlags.None, AccessControlType.Allow));
+                SetEvaluatorAccessControl(directory.path, security);
+            }
+            foreach (EvaluatorPathSpec file in spec.files)
+            {
+                FileSecurity security = new FileSecurity();
+                security.SetAccessRuleProtection(true, false);
+                security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(sid, FileSystemRights.ReadAndExecute, AccessControlType.Allow));
+                SetEvaluatorAccessControl(file.path, security);
+            }
+            FileSecurity runtimeSecurity = new FileSecurity();
+            runtimeSecurity.SetAccessRuleProtection(true, false);
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, AccessControlType.Allow));
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl, AccessControlType.Allow));
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(sid, FileSystemRights.ReadAndExecute, AccessControlType.Allow));
+            SetEvaluatorAccessControl(spec.runtime.path, runtimeSecurity);
+        }
+
+        private static void SetEvaluatorAccessControl(string path, FileSystemSecurity security)
+        {
+            // Directory/File.SetAccessControl exist only in .NET Framework.
+            // Persist the same protected DACL through Win32 so the byte-loaded
+            // assembly enforces identical ACLs in Windows PowerShell and pwsh.
+            if (!security.AreAccessRulesProtected)
+                throw new InvalidDataException("Native evaluator DACL must be protected");
+            const UInt32 DACL_SECURITY_INFORMATION = 0x00000004;
+            const UInt32 PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000;
+            if (!SetFileSecurity(path,
+                DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
+                security.GetSecurityDescriptorBinaryForm()))
+                ThrowLastError("SetFileSecurity(native evaluator protected DACL)");
+        }
+
+        // This timer belongs to the native supervisor, not the JavaScript
+        // caller. It also covers a target that stops reading its entry pipe.
+        // The gate prevents a queued callback from touching a closed/reused
+        // Job handle after Dispose. Cleanup still requires an empty-Job fence.
+        private sealed class JobWallTimeWatchdog : IDisposable
+        {
+            private readonly object gate = new object();
+            private readonly IntPtr job;
+            private readonly int milliseconds;
+            private readonly System.Diagnostics.Stopwatch clock;
+            private readonly Timer timer;
+            private bool stopped;
+            private bool expired;
+            private int terminationError;
+
+            public JobWallTimeWatchdog(IntPtr jobHandle, int wallTimeMs)
+            {
+                job = jobHandle;
+                milliseconds = wallTimeMs;
+                clock = System.Diagnostics.Stopwatch.StartNew();
+                timer = new Timer(Expire, null, wallTimeMs, Timeout.Infinite);
+            }
+
+            private void Expire(object state)
+            {
+                lock (gate)
+                {
+                    if (stopped) return;
+                    expired = true;
+                    if (!TerminateJobObject(job, 125))
+                        terminationError = Marshal.GetLastWin32Error();
+                }
+            }
+
+            public UInt32 RemainingMilliseconds
+            {
+                get
+                {
+                    return checked((UInt32)Math.Max(
+                        0L, milliseconds - clock.ElapsedMilliseconds));
+                }
+            }
+
+            public void ThrowIfExpired()
+            {
+                lock (gate)
+                {
+                    if (expired || clock.ElapsedMilliseconds >= milliseconds)
+                        throw new TimeoutException(
+                            "Windows sandbox wall-time limit exceeded" +
+                            (terminationError == 0 ? String.Empty :
+                                " (Job termination error " + terminationError + ")"));
+                }
+            }
+
+            public void Dispose()
+            {
+                lock (gate)
+                {
+                    stopped = true;
+                    timer.Dispose();
+                }
+            }
+        }
+
         public static int Run(
             string application,
             string[] arguments,
@@ -3222,8 +3518,12 @@ namespace ChainlessChain.WindowsSandbox
             LaunchPathLockSpec[] launchPathLockSpecs,
             byte[] entrySnapshotOverride,
             string snapshotTestGateToken,
-            string snapshotTestGateReleasePath)
+            string snapshotTestGateReleasePath,
+            int wallTimeMs = 0,
+            NativeEvaluatorSpec nativeEvaluator = null)
         {
+            if (wallTimeMs < 0 || wallTimeMs > 3600000)
+                throw new ArgumentOutOfRangeException("wallTimeMs");
             targetEnvironment =
                 targetEnvironment ?? CaptureCurrentEnvironment();
             workingDirectory = NormalizeLocalDosPath(
@@ -3290,6 +3590,9 @@ namespace ChainlessChain.WindowsSandbox
             bool targetExited = false;
             int targetExitCode = 125;
             Exception launchError = null;
+            JobWallTimeWatchdog wallTimeWatchdog = null;
+            List<IntPtr> evaluatorGuards = new List<IntPtr>();
+            bool evaluatorRootAttested = false;
 
             try
             {
@@ -3359,6 +3662,19 @@ namespace ChainlessChain.WindowsSandbox
                     }
                     ConfigureAppContainerEnvironment(targetEnvironment);
                 }
+                if (nativeEvaluator != null)
+                {
+                    if (!useAppContainer || nodeIpcFd >= 0 || detached || entrySnapshot != null)
+                        throw new InvalidDataException("Native evaluator requires a synchronous AppContainer launch");
+                    AssertNoLoopbackExemption(appContainerSid);
+                    PrepareNativeEvaluator(nativeEvaluator, application, arguments, workingDirectory,
+                        expectedAppContainerSid, wallTimeMs, evaluatorGuards, ref evaluatorRootAttested);
+                    targetEnvironment = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                    targetEnvironment["SystemRoot"] = Path.GetDirectoryName(Environment.SystemDirectory);
+                    targetEnvironment["WINDIR"] = Path.GetDirectoryName(Environment.SystemDirectory);
+                    targetEnvironment["PATH"] = Path.GetDirectoryName(application);
+                    ConfigureAppContainerEnvironment(targetEnvironment);
+                }
                 environmentBuffer =
                     BuildEnvironmentBlock(targetEnvironment);
 
@@ -3387,8 +3703,12 @@ namespace ChainlessChain.WindowsSandbox
                 // an exact primary-token duplicate instead of filtering again.
                 bool sourceTokenWasFiltered =
                     TokenWasFiltered(sourceToken);
+                // A UAC-filtered token can retain disabled privileges. The
+                // AppContainer attestation requires their removal, not merely
+                // that they are disabled. Compatibility workers retain their
+                // existing enabled-only predicate for nested token support.
                 bool sourceTokenHasUnexpectedEnabledPrivileges =
-                    TokenHasUnexpectedEnabledPrivileges(sourceToken);
+                    TokenHasUnexpectedEnabledPrivileges(sourceToken, useAppContainer);
                 bool sourceTokenHasEnabledAdministratorSid =
                     disableAdministratorSids &&
                     TokenHasEnabledAdministratorSid(sourceToken);
@@ -3627,6 +3947,8 @@ namespace ChainlessChain.WindowsSandbox
                 // atomic handoff; release the stream guards before resume so
                 // target code cannot deadlock on a break owned by the helper.
                 ReleaseLaunchPathLocks(launchPathLocks);
+                if (wallTimeMs > 0)
+                    wallTimeWatchdog = new JobWallTimeWatchdog(job, wallTimeMs);
                 if (ResumeThread(processInfo.hThread) == UInt32.MaxValue)
                 {
                     TerminateProcess(processInfo.hProcess, 125);
@@ -3668,7 +3990,13 @@ namespace ChainlessChain.WindowsSandbox
 
                 UInt32 targetWait = WaitForSingleObject(
                     processInfo.hProcess,
-                    INFINITE);
+                    wallTimeWatchdog == null ? INFINITE :
+                        wallTimeWatchdog.RemainingMilliseconds);
+                if (targetWait == WAIT_TIMEOUT && wallTimeWatchdog != null)
+                    throw new TimeoutException(
+                        "Windows sandbox wall-time limit exceeded");
+                if (wallTimeWatchdog != null)
+                    wallTimeWatchdog.ThrowIfExpired();
                 if (targetWait != WAIT_OBJECT_0)
                     ThrowLastError("WaitForSingleObject(target)");
                 targetExited = true;
@@ -3684,6 +4012,12 @@ namespace ChainlessChain.WindowsSandbox
             finally
             {
                 Exception cleanupError = null;
+                if (wallTimeWatchdog != null)
+                {
+                    wallTimeWatchdog.Dispose();
+                    try { wallTimeWatchdog.ThrowIfExpired(); }
+                    catch (TimeoutException error) { launchError = error; }
+                }
                 if (processInfo.hProcess != IntPtr.Zero && !targetExited)
                     TerminateProcess(processInfo.hProcess, 125);
                 if (job != IntPtr.Zero)
@@ -3742,6 +4076,11 @@ namespace ChainlessChain.WindowsSandbox
                 foreach (IntPtr handle in ownedStandardHandles)
                     CloseHandle(handle);
                 if (limitBuffer != IntPtr.Zero) Marshal.FreeHGlobal(limitBuffer);
+                if (nativeEvaluator != null && !IsInvalidHandle(appContainerSid))
+                {
+                    try { AssertNoLoopbackExemption(appContainerSid); }
+                    catch (Exception error) { cleanupError = error; }
+                }
                 if (!IsInvalidHandle(appContainerSid)) FreeSid(appContainerSid);
                 if (restrictedToken != IntPtr.Zero) CloseHandle(restrictedToken);
                 if (sourceToken != IntPtr.Zero) CloseHandle(sourceToken);
@@ -3776,11 +4115,38 @@ namespace ChainlessChain.WindowsSandbox
                                 launchError,
                                 cleanupError);
                 }
+                if (nativeEvaluator != null && evaluatorRootAttested && cleanupError == null)
+                {
+                    try
+                    {
+                        PublishTargetIdentity(Path.Combine(nativeEvaluator.root, "settlement.json"),
+                            JsonCodec.SerializeObject("manifestDigest", nativeEvaluator.manifestDigest,
+                                "cleanupConfirmed", true, "capabilityCount", 0,
+                                "loopbackExemptionAbsent", true,
+                                "targetPid", processInfo.dwProcessId,
+                                "appContainerSid", expectedAppContainerSid,
+                                "wallTimeMs", wallTimeMs,
+                                "targetExitCode", targetExitCode,
+                                "supervisorUserSidSha256", HashEvaluatorUserSid(),
+                                "executionFailed", launchError != null));
+                    }
+                    catch (Exception error) { launchError = error; }
+                }
+                foreach (IntPtr guard in evaluatorGuards) CloseHandle(guard);
+                evaluatorGuards.Clear();
             }
             if (launchError != null)
                 throw launchError;
             return targetExitCode;
         }
+
+        private static string HashEvaluatorUserSid()
+        {
+            using (WindowsIdentity identity = WindowsIdentity.GetCurrent())
+            using (SHA256 algorithm = SHA256.Create())
+                return BitConverter.ToString(algorithm.ComputeHash(Encoding.UTF8.GetBytes(identity.User.Value)))
+                    .Replace("-", "").ToLowerInvariant();
+        }
     }
 
     public static class Program
@@ -3791,6 +4157,10 @@ namespace ChainlessChain.WindowsSandbox
         [DataContract]
         public sealed class LaunchSpec
         {
+            [DataMember]
+            public Native.NativeEvaluatorSpec nativeEvaluator { get; set; }
+            [DataMember]
+            public int wallTimeMs { get; set; }
             [DataMember]
             public int cpuSeconds { get; set; }
             [DataMember]
@@ -4159,7 +4529,9 @@ namespace ChainlessChain.WindowsSandbox
                     spec.launchPathLocks,
                     null,
                     spec.snapshotTestGateToken,
-                    spec.snapshotTestGateReleasePath);
+                    spec.snapshotTestGateReleasePath,
+                    spec.wallTimeMs,
+                    spec.nativeEvaluator);
             }
             catch (Exception error)
             {

package/src/assets/web-panel/assets/PdhVaultBrowser-BX7iNvle.js

@@ -1,7 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./ChatBubbleRenderer-CPLynmbb.js","./vendor-Bn1JzzAn.js","./index-DJ2OiRvh.js","./icons-DG5UD-6K.js","./index-Cq93VfoF.css","./ChatBubbleRenderer-gy5SDGw2.css","./OrderTableRenderer-CBcy0szc.js","./OrderTableRenderer-CfrDjSHT.css","./TimelineRenderer-BLGfJIDr.js","./TimelineRenderer-BlTAtkOc.css","./EmailListRenderer-DTq7tU4b.js","./EmailListRenderer-DTPZPx_S.css","./GenericCardRenderer-DNv8GEoq.js","./GenericCardRenderer-o85VDYQS.css"])))=>i.map(i=>d[i]);
-import{E as ue,r as R,b as w,I as g,P as u,J as O,U as v,c,S as C,V as E,_ as M,F as B,Z as se,a0 as le,R as L,K as m,Q as b,W as A,o as J}from"./vendor-Bn1JzzAn.js";import{u as U}from"./usePersonalDataHub-vFGrVDyp.js";import{_ as D,e as F,d as P}from"./index-DJ2OiRvh.js";import{aa as q,ag as Q,M as z,aI as G,v as X,aH as H,aq as K,ac as W,e as de,d as fe,k as pe,ai as me,aA as _e,R as ye}from"./icons-DG5UD-6K.js";import"./useShellMode-CgR0wCYM.js";const I=Object.freeze({q:"",category:null,adapter:null,subtype:null,since:null,until:null}),N=50,Y=300,Z=ue("pdhBrowser",()=>{const r=R({...I}),t=R([]),n=R(null),e=R(!1),o=R(!1),l=R(null),a=R(null),s=R(!1),i=R({byCategory:{},byAdapter:{},bySubtype:{},total:0});let d=0,_=null;const x=w(()=>t.value.length>0),j=w(()=>n.value!=null);function h(S={}){const p={},f=r.value;return f.q&&f.q.trim()&&(p.q=f.q.trim()),f.category&&(p.category=f.category),f.adapter&&(p.adapter=f.adapter),f.subtype&&(p.subtype=f.subtype),Number.isFinite(f.since)&&(p.since=f.since),Number.isFinite(f.until)&&(p.until=f.until),{...p,...S}}async function y(){const S=++d;e.value=!0,l.value=null;const p=U();try{const[f,T]=await Promise.all([p.searchEvents(h({limit:N})),p.facetCounts({...r.value.q&&r.value.q.trim()?{q:r.value.q.trim()}:{},...Number.isFinite(r.value.since)?{since:r.value.since}:{},...Number.isFinite(r.value.until)?{until:r.value.until}:{}})]);if(S!==d)return;t.value=f.rows||[],n.value=f.nextCursor||null,a.value=f.mode||"like",s.value=!!f.shortQuery,i.value={byCategory:T.byCategory||{},byAdapter:T.byAdapter||{},bySubtype:T.bySubtype||{},total:T.total||0}}catch(f){if(S!==d)return;l.value=f&&f.message?f.message:String(f),t.value=[],n.value=null}finally{S===d&&(e.value=!1)}}async function k(){if(!n.value||o.value)return;o.value=!0,l.value=null;const S=U();try{const p=await S.searchEvents(h({cursor:n.value,limit:N}));t.value=t.value.concat(p.rows||[]),n.value=p.nextCursor||null,a.value=p.mode||a.value}catch(p){l.value=p&&p.message?p.message:String(p)}finally{o.value=!1}}function ae(S,p){if(!(S in I))throw new Error(`pdhBrowser.setFilter: unknown key "${S}"`);r.value={...r.value,[S]:p},_&&clearTimeout(_),_=setTimeout(()=>{_=null,y()},Y)}function ie(S){return r.value={...I,...S},_&&(clearTimeout(_),_=null),y()}function ce(){r.value={...I},t.value=[],n.value=null,l.value=null,i.value={byCategory:{},byAdapter:{},bySubtype:{},total:0}}return{filters:r,results:t,cursor:n,isLoading:e,isAppending:o,error:l,mode:a,shortQuery:s,facets:i,hasResults:x,canLoadMore:j,search:y,loadMore:k,setFilter:ae,setFilters:ie,reset:ce,PAGE_SIZE:N,SEARCH_DEBOUNCE_MS:Y}}),ge=Object.freeze(["chat","social","email","shopping","travel","system","ai-chat","other"]),ve=Object.freeze({chat:"社交聊天",social:"内容平台",email:"邮件",shopping:"支付订单",travel:"出行",system:"系统数据","ai-chat":"AI 对话",other:"其他"});function V(r){return ve[r]||r||"未知"}const be=Object.freeze([["wechat","chat"],["messaging-","chat"],["social-","social"],["email-","email"],["shopping-","shopping"],["alipay-","shopping"],["travel-","travel"],["system-data","system"],["browser-","system"],["meeting-","system"],["vscode","system"],["vscodium","system"],["jetbrains-ide","system"],["win-recent","system"],["git-activity","system"],["shell-history","system"],["hbuilderx","system"],["local-files","system"],["cursor","ai-chat"],["claude-code","ai-chat"],["ai-chat-","ai-chat"]]);function $(r){if(typeof r!="string"||r.length===0)return"other";for(const[t,n]of be)if(t.endsWith("-")||t==="system-data"){if(r.startsWith(t))return n}else if(r===t)return n;return"other"}const he={__name:"CategorySidebar",props:{selected:{type:String,default:null},facets:{type:Object,default:()=>({byCategory:{},total:0})}},emits:["select"],setup(r,{expose:t}){t();const n=r,e=w(()=>n.facets.total||0),o={chat:W,social:K,email:H,shopping:X,travel:G,system:z,"ai-chat":Q,other:q};function l(i){return o[i]||q}function a(i){return i?{backgroundColor:"#fff",color:"#1677ff"}:{backgroundColor:"#f0f0f0",color:"#666"}}const s={props:n,total:e,ICONS:o,iconFor:l,badgeStyle:a,computed:w,get AppstoreOutlined(){return q},get MessageOutlined(){return W},get PlayCircleOutlined(){return K},get MailOutlined(){return H},get ShoppingOutlined(){return X},get CarOutlined(){return G},get MobileOutlined(){return z},get RobotOutlined(){return Q},get CATEGORIES(){return ge},get categoryLabel(){return V}};return Object.defineProperty(s,"__isScriptSetup",{enumerable:!1,value:!0}),s}},Se={class:"pdh-sidebar"},Oe=["onClick"],we={class:"label"};function Ce(r,t,n,e,o,l){const a=g("a-badge");return u(),O("div",Se,[t[2]||(t[2]=v("div",{class:"sidebar-title"},"数据类型",-1)),v("div",{class:M(["cat-item",{active:n.selected===null}]),onClick:t[0]||(t[0]=s=>r.$emit("select",null))},[c(e.AppstoreOutlined,{class:"icon"}),t[1]||(t[1]=v("span",{class:"label"},"全部",-1)),e.total>0?(u(),C(a,{key:0,count:e.total,"number-style":e.badgeStyle(n.selected===null),"overflow-count":9999},null,8,["count","number-style"])):E("v-if",!0)],2),(u(!0),O(B,null,se(e.CATEGORIES,s=>(u(),O("div",{key:s,class:M(["cat-item",{active:n.selected===s,dim:!n.facets.byCategory[s]}]),onClick:i=>r.$emit("select",s)},[(u(),C(le(e.iconFor(s)),{class:"icon"})),v("span",we,L(e.categoryLabel(s)),1),n.facets.byCategory[s]?(u(),C(a,{key:0,count:n.facets.byCategory[s],"number-style":e.badgeStyle(n.selected===s),"overflow-count":9999},null,8,["count","number-style"])):E("v-if",!0)],10,Oe))),128))])}const ke=D(he,[["render",Ce],["__scopeId","data-v-6b62a22e"],["__file","/tmp/cc-web-panel-lNX50L/repo/packages/web-panel/src/components/pdh/CategorySidebar.vue"]]),Ee={__name:"SearchFilterBar",props:{filters:{type:Object,required:!0},facets:{type:Object,default:()=>({byAdapter:{}})},isLoading:{type:Boolean,default:!1},mode:{type:String,default:null},shortQuery:{type:Boolean,default:!1}},emits:["set-filter","reset"],setup(r,{expose:t,emit:n}){t();const e=r,o=n,l=w(()=>e.filters.category?`在「${e.filters.category}」类目内搜索…`:"搜索关键词（如：支付宝、罗技、Kotlin）…"),a=w(()=>Object.entries(e.facets.byAdapter||{}).sort((y,k)=>k[1]-y[1]).map(([y,k])=>({value:y,label:`${y} (${k})`}))),s=w(()=>!e.filters.since&&!e.filters.until?null:[e.filters.since?new Date(e.filters.since):null,e.filters.until?new Date(e.filters.until):null]),i=w(()=>!!(e.filters.q||e.filters.adapter||e.filters.subtype||e.filters.since||e.filters.until));function d(h){o("set-filter","q",h||"")}function _(h){o("set-filter","q",h||"")}function x(h){if(!h||h.length===0){o("set-filter","since",null),o("set-filter","until",null);return}const[y,k]=h;o("set-filter","since",y?+y:null),o("set-filter","until",k?+k:null)}const j={props:e,emit:o,placeholderText:l,adapterOptions:a,dateRangeValue:s,hasActiveFilters:i,onQInput:d,onSearch:_,onDateChange:x,computed:w,get SearchOutlined(){return pe},get CloseCircleOutlined(){return fe},get InfoCircleOutlined(){return de}};return Object.defineProperty(j,"__isScriptSetup",{enumerable:!1,value:!0}),j}},Re={class:"pdh-filter-bar"},Le={key:1,class:"hint"},xe={key:2,class:"hint"};function je(r,t,n,e,o,l){const a=g("a-input-search"),s=g("a-select"),i=g("a-range-picker"),d=g("a-button");return u(),O("div",Re,[c(a,{value:n.filters.q,placeholder:e.placeholderText,"enter-button":"搜索","allow-clear":"",loading:n.isLoading,style:{flex:"1","max-width":"480px"},"onUpdate:value":e.onQInput,onSearch:e.onSearch},{prefix:m(()=>[c(e.SearchOutlined)]),_:1},8,["value","placeholder","loading"]),c(s,{value:n.filters.adapter,placeholder:"所有 adapter","allow-clear":"",options:e.adapterOptions,style:{width:"200px"},"onUpdate:value":t[0]||(t[0]=_=>r.$emit("set-filter","adapter",_||null))},null,8,["value","options"]),c(i,{value:e.dateRangeValue,placeholder:["开始日期","结束日期"],style:{width:"280px"},"onUpdate:value":e.onDateChange},null,8,["value"]),e.hasActiveFilters?(u(),C(d,{key:0,type:"link",danger:"",onClick:t[1]||(t[1]=_=>r.$emit("reset"))},{icon:m(()=>[c(e.CloseCircleOutlined)]),default:m(()=>[t[2]||(t[2]=b(" 清空筛选 ",-1))]),_:1})):E("v-if",!0),n.shortQuery?(u(),O("span",Le,[c(e.InfoCircleOutlined),t[3]||(t[3]=b(" 关键词需至少 3 字 (FTS5 trigram 限制) ",-1))])):n.mode==="like"?(u(),O("span",xe,[c(e.InfoCircleOutlined),t[4]||(t[4]=b(" 当前为 LIKE 兜底模式 ",-1))])):E("v-if",!0)])}const Ae=D(Ee,[["render",je],["__scopeId","data-v-d7cce6e9"],["__file","/tmp/cc-web-panel-lNX50L/repo/packages/web-panel/src/components/pdh/SearchFilterBar.vue"]]),Fe={__name:"RendererDispatcher",props:{event:{type:Object,required:!0}},setup(r,{expose:t}){t();const n=A(()=>F(()=>import("./ChatBubbleRenderer-CPLynmbb.js"),__vite__mapDeps([0,1,2,3,4,5]),import.meta.url)),e=A(()=>F(()=>import("./OrderTableRenderer-CBcy0szc.js"),__vite__mapDeps([6,1,2,3,4,7]),import.meta.url)),o=A(()=>F(()=>import("./TimelineRenderer-BLGfJIDr.js"),__vite__mapDeps([8,1,2,3,4,9]),import.meta.url)),l=A(()=>F(()=>import("./EmailListRenderer-DTq7tU4b.js"),__vite__mapDeps([10,1,2,3,4,11]),import.meta.url)),a=A(()=>F(()=>import("./GenericCardRenderer-DNv8GEoq.js"),__vite__mapDeps([12,1,2,3,4,13]),import.meta.url));function s(d){const _=d&&d.source&&d.source.adapter;switch($(_)){case"chat":case"ai-chat":return n;case"shopping":return e;case"travel":return o;case"email":return l;default:return a}}const i={ChatBubbleRenderer:n,OrderTableRenderer:e,TimelineRenderer:o,EmailListRenderer:l,GenericCardRenderer:a,rendererFor:s,defineAsyncComponent:A,get getCategory(){return $}};return Object.defineProperty(i,"__isScriptSetup",{enumerable:!1,value:!0}),i}};function De(r,t,n,e,o,l){return u(),C(le(e.rendererFor(n.event)),{event:n.event},null,8,["event"])}const Te=D(Fe,[["render",De],["__file","/tmp/cc-web-panel-lNX50L/repo/packages/web-panel/src/components/pdh/renderers/RendererDispatcher.vue"]]);function ee(r){return JSON.stringify(r,null,2)}function te(r){return r.map(t=>JSON.stringify(t)).join(`
-`)+`
-`}function ne(r){const n=["id","subtype","occurredAt","occurredAtIso","actor","place","adapter","summary","contentJson","extraJson"].join(","),e=r.map(o=>{const l=Number.isFinite(o.occurredAt)?o.occurredAt:null,a=l?new Date(l).toISOString():"",s=o.source&&o.source.adapter||"",i=o.content&&(o.content.text||o.content.title||o.content.subject)||"";return[o.id||"",o.subtype||"",l!=null?String(l):"",a,o.actor||"",o.place||"",s,i,o.content?JSON.stringify(o.content):"",o.extra?JSON.stringify(o.extra):""].map(Ie).join(",")});return[n,...e].join(`
-`)+`
-`}function Ie(r){const t=String(r??"");return t.includes(",")||t.includes('"')||t.includes(`
-`)||t.includes("\r")?'"'+t.replace(/"/g,'""')+'"':t}function re(r,t,n="application/octet-stream"){if(typeof window>"u"||typeof document>"u")return t;const e=new Blob([r],{type:n}),o=URL.createObjectURL(e),l=document.createElement("a");return l.href=o,l.download=t,document.body.appendChild(l),l.click(),document.body.removeChild(l),setTimeout(()=>URL.revokeObjectURL(o),1e3),t}function oe(r,t=null){const n=new Date,e=n.getFullYear(),o=String(n.getMonth()+1).padStart(2,"0"),l=String(n.getDate()).padStart(2,"0"),a=r==="ndjson"?"ndjson":r,s=t?`-${t}`:"";return`pdh-events-${e}-${o}-${l}${s}.${a}`}const Pe={__name:"ExportDropdown",props:{events:{type:Array,required:!0},category:{type:String,default:null}},setup(r,{expose:t}){t();const n=r,e=w(()=>n.events.length>0),o={json:"application/json;charset=utf-8",ndjson:"application/x-ndjson;charset=utf-8",csv:"text/csv;charset=utf-8"};function l(i){switch(i){case"json":return ee(n.events);case"ndjson":return te(n.events);case"csv":return ne(n.events);default:throw new Error(`unknown format: ${i}`)}}function a({key:i}){try{const d=l(i),_=oe(i,n.category);re(d,_,o[i]),P.success(`已导出 ${n.events.length} 条到 ${_}`)}catch(d){P.error(`导出失败: ${d.message||d}`)}}const s={props:n,hasResults:e,MIME:o,serialize:l,onClick:a,computed:w,get DownloadOutlined(){return _e},get DownOutlined(){return me},get message(){return P},get eventsToJson(){return ee},get eventsToNdjson(){return te},get eventsToCsv(){return ne},get downloadAs(){return re},get suggestFilename(){return oe}};return Object.defineProperty(s,"__isScriptSetup",{enumerable:!1,value:!0}),s}};function qe(r,t,n,e,o,l){const a=g("a-button"),s=g("a-menu-item"),i=g("a-menu"),d=g("a-dropdown");return u(),C(d,{disabled:!e.hasResults},{overlay:m(()=>[c(i,{onClick:e.onClick},{default:m(()=>[c(s,{key:"json"},{default:m(()=>[...t[0]||(t[0]=[b("JSON (.json)",-1)])]),_:1}),c(s,{key:"ndjson"},{default:m(()=>[...t[1]||(t[1]=[b("NDJSON (.ndjson)",-1)])]),_:1}),c(s,{key:"csv"},{default:m(()=>[...t[2]||(t[2]=[b("CSV (.csv)",-1)])]),_:1})]),_:1})]),default:m(()=>[c(a,{disabled:!e.hasResults},{icon:m(()=>[c(e.DownloadOutlined)]),default:m(()=>[b(" 导出 ("+L(n.events.length)+") ",1),c(e.DownOutlined)]),_:1},8,["disabled"])]),_:1},8,["disabled"])}const Ne=D(Pe,[["render",qe],["__file","/tmp/cc-web-panel-lNX50L/repo/packages/web-panel/src/components/pdh/ExportDropdown.vue"]]),Be={__name:"PdhVaultBrowser",setup(r,{expose:t}){t();const n=Z(),e=w(()=>n.filters.q?`没有匹配 "${n.filters.q}" 的事件 — 试试更短的关键词或换个类目`:n.filters.category?`「${V(n.filters.category)}」类目下还没有数据 — 去采集页同步对应 adapter`:"Vault 里还没有数据 — 去「个人数据中台」页面同步任意 adapter");function o(s){n.filters.category=s,n.search()}function l(s,i){n.setFilter(s,i)}J(()=>{!n.hasResults&&!n.isLoading&&n.search()});const a={store:n,emptyHint:e,onCategorySelect:o,onSetFilter:l,onMounted:J,computed:w,get ReloadOutlined(){return ye},get usePdhBrowserStore(){return Z},get categoryLabel(){return V},CategorySidebar:ke,SearchFilterBar:Ae,RendererDispatcher:Te,ExportDropdown:Ne};return Object.defineProperty(a,"__isScriptSetup",{enumerable:!1,value:!0}),a}},Ve={class:"pdh-browser-page"},Me={class:"page-header"},Je={class:"main-pane"},Ue={class:"results-summary"},Qe={key:0},ze={key:0},Ge={key:1},Xe={class:"loaded-of"},He={class:"results-list"},Ke={key:2,class:"load-more"};function We(r,t,n,e,o,l){const a=g("a-tag"),s=g("a-button"),i=g("a-space"),d=g("a-col"),_=g("a-spin"),x=g("a-alert"),j=g("a-empty"),h=g("a-row");return u(),O("div",Ve,[v("div",Me,[t[6]||(t[6]=v("div",null,[v("h2",{class:"page-title"},"数据浏览器"),v("p",{class:"page-sub"}," Vault 里所有已采集的数据，按类目浏览 / 全文检索 / 时间窗口筛选。 完全离线，不外传。 ")],-1)),c(i,null,{default:m(()=>[e.store.mode==="fts5"?(u(),C(a,{key:0,color:"green"},{default:m(()=>[...t[3]||(t[3]=[b("FTS5 trigram",-1)])]),_:1})):e.store.mode==="like"?(u(),C(a,{key:1,color:"orange"},{default:m(()=>[...t[4]||(t[4]=[b("LIKE 兜底",-1)])]),_:1})):E("v-if",!0),c(e.ExportDropdown,{events:e.store.results,category:e.store.filters.category},null,8,["events","category"]),c(s,{onClick:t[0]||(t[0]=y=>e.store.search()),loading:e.store.isLoading},{icon:m(()=>[c(e.ReloadOutlined)]),default:m(()=>[t[5]||(t[5]=b(" 刷新 ",-1))]),_:1},8,["loading"])]),_:1})]),c(h,{gutter:16,class:"browser-layout"},{default:m(()=>[c(d,{xs:24,sm:24,md:6,lg:5,xl:4},{default:m(()=>[c(e.CategorySidebar,{selected:e.store.filters.category,facets:e.store.facets,onSelect:e.onCategorySelect},null,8,["selected","facets"])]),_:1}),c(d,{xs:24,sm:24,md:18,lg:19,xl:20},{default:m(()=>[v("div",Je,[c(e.SearchFilterBar,{filters:e.store.filters,facets:e.store.facets,"is-loading":e.store.isLoading,mode:e.store.mode,"short-query":e.store.shortQuery,onSetFilter:e.onSetFilter,onReset:t[1]||(t[1]=y=>{e.store.reset(),e.store.search()})},null,8,["filters","facets","is-loading","mode","short-query"]),v("div",Ue,[e.store.isLoading&&e.store.results.length===0?(u(),O("span",Qe,[c(_,{size:"small"}),t[7]||(t[7]=b(" 载入中… ",-1))])):(u(),O(B,{key:1},[v("strong",null,L(e.store.facets.total),1),t[11]||(t[11]=b(" 条事件 ",-1)),e.store.filters.category?(u(),O("span",ze,[t[8]||(t[8]=b(" / 当前类目 ",-1)),v("strong",null,L(e.categoryLabel(e.store.filters.category)),1),v("strong",null,L(e.store.facets.byCategory[e.store.filters.category]||0),1)])):E("v-if",!0),e.store.filters.q?(u(),O("span",Ge,[t[9]||(t[9]=b(' / 关键词 "',-1)),v("em",null,L(e.store.filters.q),1),t[10]||(t[10]=b('"',-1))])):E("v-if",!0),v("span",Xe," / 已显示 "+L(e.store.results.length),1)],64))]),e.store.error?(u(),C(x,{key:0,type:"error","show-icon":"",message:e.store.error,closable:"",style:{margin:"12px 0"}},null,8,["message"])):E("v-if",!0),!e.store.isLoading&&e.store.results.length===0&&!e.store.error?(u(),C(j,{key:1,description:e.emptyHint,style:{"margin-top":"40px"}},null,8,["description"])):E("v-if",!0),v("div",He,[(u(!0),O(B,null,se(e.store.results,(y,k)=>(u(),C(e.RendererDispatcher,{key:`r-${k}-${y.id}`,event:y},null,8,["event"]))),128))]),e.store.canLoadMore?(u(),O("div",Ke,[c(s,{loading:e.store.isAppending,onClick:t[2]||(t[2]=y=>e.store.loadMore()),block:""},{default:m(()=>[...t[12]||(t[12]=[b(" 加载下一页 (50 条) ",-1)])]),_:1},8,["loading"])])):E("v-if",!0)])]),_:1})]),_:1})])}const nt=D(Be,[["render",We],["__scopeId","data-v-0f7c02cd"],["__file","/tmp/cc-web-panel-lNX50L/repo/packages/web-panel/src/views/PdhVaultBrowser.vue"]]);export{nt as default};

package/src/assets/web-panel/assets/devWarning-DlIv9Mbc.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-DJ2OiRvh.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-BC972Grv.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-D2x4GBGm.js";import{a0 as t}from"./index-DJ2OiRvh.js";import"./vendor-Bn1JzzAn.js";import"./index-D2Zb-Kd1.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};

package/src/assets/web-panel/assets/index-CVifyQqL.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-ke9Mk1cx.js";import{a0 as t}from"./index-DJ2OiRvh.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-CD3ziNhu.js";import"./useFlexGapSupport-wBKIYFKX.js";import"./styleChecker-De0Y8g1O.js";import"./index-D2Zb-Kd1.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};