daycare-cli 0.0.0-canary.f57680e

package/dist/sandbox/sandboxAppsDenyPathsBuild.js

@@ -0,0 +1,44 @@
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * Builds app-directory deny paths for sandbox runtime policies.
+ * Expects: permissions.workingDir is absolute and normalized.
+ */
+export function sandboxAppsDenyPathsBuild(permissions) {
+    const context = sandboxAppsContextResolve(permissions.workingDir);
+    if (!context) {
+        return [path.resolve(permissions.workingDir, "apps")];
+    }
+    let entries = [];
+    try {
+        entries = fs.readdirSync(context.appsRoot, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter((entry) => entry.isDirectory() && entry.name !== context.appId)
+        .map((entry) => path.join(context.appsRoot, entry.name));
+}
+function sandboxAppsContextResolve(workingDir) {
+    const resolved = path.resolve(workingDir);
+    const segments = resolved.split(path.sep).filter((entry) => entry.length > 0);
+    for (let index = 0; index < segments.length; index += 1) {
+        if (segments[index] !== "apps") {
+            continue;
+        }
+        const appId = segments[index + 1];
+        const marker = segments[index + 2];
+        if (!appId || marker !== "data") {
+            continue;
+        }
+        const rootSegments = segments.slice(0, index);
+        const workspaceRoot = path.join(path.parse(resolved).root, ...rootSegments);
+        return {
+            appsRoot: path.join(workspaceRoot, "apps"),
+            appId
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=sandboxAppsDenyPathsBuild.js.map

package/dist/sandbox/sandboxAppsDenyPathsBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxAppsDenyPathsBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxAppsDenyPathsBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAA+B;IACvE,MAAM,OAAO,GAAG,yBAAyB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,GAAqB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;QAC5E,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;YAC1C,KAAK;SACN,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sandbox/sandboxCanRead.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Resolves a read target against the current read allowlist.
+ * Expects: target is an absolute path.
+ */
+export declare function sandboxCanRead(permissions: SessionPermissions, target: string): Promise<string>;
+//# sourceMappingURL=sandboxCanRead.d.ts.map

package/dist/sandbox/sandboxCanRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanRead.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/sandbox/sandboxCanRead.js

@@ -0,0 +1,18 @@
+import path from "node:path";
+import { pathResolveSecure } from "../engine/permissions/pathResolveSecure.js";
+import { sandboxAppsAccessCheck } from "./sandboxAppsAccessCheck.js";
+/**
+ * Resolves a read target against the current read allowlist.
+ * Expects: target is an absolute path.
+ */
+export async function sandboxCanRead(permissions, target) {
+    // Tool-level reads are always allowed across the filesystem.
+    const allowedDirs = [path.parse(target).root];
+    const result = await pathResolveSecure(allowedDirs, target);
+    const access = sandboxAppsAccessCheck(permissions, result.realPath);
+    if (!access.allowed) {
+        throw new Error(access.reason ?? "Read access denied.");
+    }
+    return result.realPath;
+}
+//# sourceMappingURL=sandboxCanRead.js.map

package/dist/sandbox/sandboxCanRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanRead.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAA+B,EAC/B,MAAc;IAEd,6DAA6D;IAC7D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/dist/sandbox/sandboxCanRead.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxCanRead.spec.d.ts.map

package/dist/sandbox/sandboxCanRead.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanRead.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxCanRead.spec.js

@@ -0,0 +1,70 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { sandboxCanRead } from "./sandboxCanRead.js";
+describe("sandboxCanRead", () => {
+    let workingDir;
+    let outsideDir;
+    let outsideFile;
+    let appFile;
+    let otherAppFile;
+    beforeEach(async () => {
+        workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-read-workspace-"));
+        outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-read-outside-"));
+        outsideFile = path.join(outsideDir, "outside.txt");
+        await fs.writeFile(outsideFile, "outside-content", "utf8");
+        appFile = path.join(workingDir, "apps", "my-app", "APP.md");
+        otherAppFile = path.join(workingDir, "apps", "other-app", "APP.md");
+        await fs.mkdir(path.dirname(appFile), { recursive: true });
+        await fs.mkdir(path.dirname(otherAppFile), { recursive: true });
+        await fs.writeFile(appFile, "app manifest", "utf8");
+        await fs.writeFile(otherAppFile, "other app manifest", "utf8");
+    });
+    afterEach(async () => {
+        await fs.rm(workingDir, { recursive: true, force: true });
+        await fs.rm(outsideDir, { recursive: true, force: true });
+    });
+    it("allows reading any absolute path when readDirs is empty", async () => {
+        const permissions = buildPermissions(workingDir, [], []);
+        const result = await sandboxCanRead(permissions, outsideFile);
+        expect(result).toBe(await fs.realpath(outsideFile));
+    });
+    it("allows reading any absolute path when readDirs are configured", async () => {
+        const permissions = buildPermissions(workingDir, [workingDir], []);
+        const result = await sandboxCanRead(permissions, outsideFile);
+        expect(result).toBe(await fs.realpath(outsideFile));
+    });
+    it("ignores write grants for read access checks", async () => {
+        const permissions = buildPermissions(workingDir, [workingDir], [outsideFile]);
+        const result = await sandboxCanRead(permissions, outsideFile);
+        expect(result).toBe(await fs.realpath(outsideFile));
+    });
+    it("denies non-app agents from reading app directories", async () => {
+        const permissions = buildPermissions(workingDir, [workingDir], [workingDir]);
+        await expect(sandboxCanRead(permissions, appFile)).rejects.toThrow("App directories are not accessible from non-app agents.");
+    });
+    it("allows app agents to read their own app directory", async () => {
+        const appDataDir = path.join(workingDir, "apps", "my-app", "data");
+        await fs.mkdir(appDataDir, { recursive: true });
+        const permissions = buildPermissions(appDataDir, [workingDir], [appDataDir]);
+        const result = await sandboxCanRead(permissions, appFile);
+        expect(result).toBe(await fs.realpath(appFile));
+    });
+    it("denies app agents from reading other app directories", async () => {
+        const appDataDir = path.join(workingDir, "apps", "my-app", "data");
+        await fs.mkdir(appDataDir, { recursive: true });
+        const permissions = buildPermissions(appDataDir, [workingDir], [appDataDir]);
+        await expect(sandboxCanRead(permissions, otherAppFile)).rejects.toThrow("App agents can only access their own app directory.");
+    });
+});
+function buildPermissions(workingDir, readDirs, writeDirs) {
+    return {
+        workingDir: path.resolve(workingDir),
+        readDirs: readDirs.map((entry) => path.resolve(entry)),
+        writeDirs: writeDirs.map((entry) => path.resolve(entry)),
+        network: false,
+        events: false
+    };
+}
+//# sourceMappingURL=sandboxCanRead.spec.js.map

package/dist/sandbox/sandboxCanRead.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanRead.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,WAAmB,CAAC;IACxB,IAAI,OAAe,CAAC;IACpB,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QACrF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACnF,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE7E,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAChE,yDAAyD,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE7E,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CACvB,UAAkB,EAClB,QAAkB,EAClB,SAAmB;IAEnB,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxCanWrite.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Resolves a write target against the current write allowlist.
+ * Expects: target is an absolute path.
+ */
+export declare function sandboxCanWrite(permissions: SessionPermissions, target: string): Promise<string>;
+//# sourceMappingURL=sandboxCanWrite.d.ts.map

package/dist/sandbox/sandboxCanWrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanWrite.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/sandbox/sandboxCanWrite.js

@@ -0,0 +1,16 @@
+import { pathResolveSecure } from "../engine/permissions/pathResolveSecure.js";
+import { sandboxAppsAccessCheck } from "./sandboxAppsAccessCheck.js";
+/**
+ * Resolves a write target against the current write allowlist.
+ * Expects: target is an absolute path.
+ */
+export async function sandboxCanWrite(permissions, target) {
+    const allowedDirs = [...permissions.writeDirs];
+    const result = await pathResolveSecure(allowedDirs, target);
+    const access = sandboxAppsAccessCheck(permissions, result.realPath);
+    if (!access.allowed) {
+        throw new Error(access.reason ?? "Write access denied.");
+    }
+    return result.realPath;
+}
+//# sourceMappingURL=sandboxCanWrite.js.map

package/dist/sandbox/sandboxCanWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanWrite.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA+B,EAC/B,MAAc;IAEd,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/dist/sandbox/sandboxCanWrite.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxCanWrite.spec.d.ts.map

package/dist/sandbox/sandboxCanWrite.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanWrite.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxCanWrite.spec.js

@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { sandboxCanWrite } from "./sandboxCanWrite.js";
+describe("sandboxCanWrite", () => {
+    let workingDir;
+    let outsideDir;
+    let appFile;
+    beforeEach(async () => {
+        workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-write-workspace-"));
+        outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-write-outside-"));
+        appFile = path.join(workingDir, "apps", "my-app", "APP.md");
+        await fs.mkdir(path.dirname(appFile), { recursive: true });
+    });
+    afterEach(async () => {
+        await fs.rm(workingDir, { recursive: true, force: true });
+        await fs.rm(outsideDir, { recursive: true, force: true });
+    });
+    it("rejects writing within the workspace when not explicitly granted", async () => {
+        const permissions = buildPermissions(workingDir, []);
+        const target = path.join(workingDir, "nested", "output.txt");
+        await expect(sandboxCanWrite(permissions, target))
+            .rejects
+            .toThrow("Path is outside the allowed directories.");
+    });
+    it("allows writing within explicitly granted write directories", async () => {
+        const permissions = buildPermissions(workingDir, [outsideDir]);
+        const target = path.join(outsideDir, "output.txt");
+        const result = await sandboxCanWrite(permissions, target);
+        expect(result).toBe(path.join(await fs.realpath(outsideDir), "output.txt"));
+    });
+    it("allows writing in workspace when workspace is explicitly granted", async () => {
+        const permissions = buildPermissions(workingDir, [workingDir]);
+        const target = path.join(workingDir, "nested", "output.txt");
+        const result = await sandboxCanWrite(permissions, target);
+        expect(result).toBe(path.join(await fs.realpath(workingDir), "nested", "output.txt"));
+    });
+    it("rejects paths outside the write allowlist", async () => {
+        const permissions = buildPermissions(workingDir, []);
+        const target = path.join(outsideDir, "blocked.txt");
+        await expect(sandboxCanWrite(permissions, target))
+            .rejects
+            .toThrow("Path is outside the allowed directories.");
+    });
+    it("denies non-app agents from writing app directories", async () => {
+        const permissions = buildPermissions(workingDir, [workingDir]);
+        await expect(sandboxCanWrite(permissions, appFile)).rejects.toThrow("App directories are not accessible from non-app agents.");
+    });
+});
+function buildPermissions(workingDir, writeDirs) {
+    return {
+        workingDir: path.resolve(workingDir),
+        readDirs: [],
+        writeDirs: writeDirs.map((entry) => path.resolve(entry)),
+        network: false,
+        events: false
+    };
+}
+//# sourceMappingURL=sandboxCanWrite.spec.js.map

package/dist/sandbox/sandboxCanWrite.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCanWrite.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACtF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;aAC/C,OAAO;aACP,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEpD,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;aAC/C,OAAO;aACP,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjE,yDAAyD,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAmB;IAC/D,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxFilesystemPolicyBuild.d.ts

@@ -0,0 +1,18 @@
+import type { SessionPermissions } from "@/types";
+type SandboxFilesystemPolicyBuildInput = {
+    permissions: SessionPermissions;
+    homeDir?: string;
+    platform?: NodeJS.Platform;
+};
+type SandboxFilesystemPolicy = {
+    denyRead: string[];
+    allowWrite: string[];
+    denyWrite: string[];
+};
+/**
+ * Builds sandbox filesystem policy with a default sensitive-path deny list.
+ * Expects: permissions paths are already absolute and normalized.
+ */
+export declare function sandboxFilesystemPolicyBuild(input: SandboxFilesystemPolicyBuildInput): SandboxFilesystemPolicy;
+export {};
+//# sourceMappingURL=sandboxFilesystemPolicyBuild.d.ts.map

package/dist/sandbox/sandboxFilesystemPolicyBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystemPolicyBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AA6ClD,KAAK,iCAAiC,GAAG;IACvC,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,uBAAuB,CAmCzB"}

package/dist/sandbox/sandboxFilesystemPolicyBuild.js

@@ -0,0 +1,81 @@
+import os from "node:os";
+import path from "node:path";
+import { sandboxAppsDenyPathsBuild } from "./sandboxAppsDenyPathsBuild.js";
+const COMMON_HOME_RELATIVE_DENY_PATHS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".kube",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/op",
+    ".config/1Password",
+    ".local/share/keyrings",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials"
+];
+const COMMON_SYSTEM_DENY_PATHS = [
+    "/etc/ssh",
+    "/etc/sudoers",
+    "/etc/sudoers.d",
+    "/etc/shadow",
+    "/etc/gshadow",
+    "/etc/ssl/private"
+];
+const DARWIN_HOME_RELATIVE_DENY_PATHS = [
+    "Library/Keychains",
+    "Library/Application Support/iCloud",
+    "Library/Application Support/com.apple.TCC",
+    "Library/Group Containers"
+];
+const DARWIN_SYSTEM_DENY_PATHS = [
+    "/private/etc/ssh",
+    "/private/etc/sudoers",
+    "/private/etc/sudoers.d",
+    "/private/etc/master.passwd"
+];
+const LINUX_SYSTEM_DENY_PATHS = ["/root/.ssh"];
+/**
+ * Builds sandbox filesystem policy with a default sensitive-path deny list.
+ * Expects: permissions paths are already absolute and normalized.
+ */
+export function sandboxFilesystemPolicyBuild(input) {
+    const platform = input.platform ?? process.platform;
+    const homeDir = path.resolve(input.homeDir ?? os.homedir());
+    const allowWrite = dedupeResolvedPaths([
+        ...input.permissions.writeDirs
+    ]);
+    const homeDeny = COMMON_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry));
+    const platformHomeDeny = platform === "darwin"
+        ? DARWIN_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry))
+        : [];
+    const platformSystemDeny = platform === "darwin"
+        ? DARWIN_SYSTEM_DENY_PATHS
+        : platform === "linux"
+            ? LINUX_SYSTEM_DENY_PATHS
+            : [];
+    const denyRead = dedupeResolvedPaths([
+        ...homeDeny,
+        ...platformHomeDeny,
+        ...COMMON_SYSTEM_DENY_PATHS,
+        ...platformSystemDeny,
+        ...sandboxAppsDenyPathsBuild(input.permissions)
+    ]);
+    return {
+        denyRead,
+        allowWrite,
+        // Keep read/write denials aligned to prevent both data exfiltration and tampering.
+        denyWrite: [...denyRead]
+    };
+}
+function dedupeResolvedPaths(values) {
+    const resolved = values
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+        .map((entry) => path.resolve(entry));
+    return Array.from(new Set(resolved));
+}
+//# sourceMappingURL=sandboxFilesystemPolicyBuild.js.map

package/dist/sandbox/sandboxFilesystemPolicyBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystemPolicyBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,+BAA+B,GAAG;IACtC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;CACnB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,kBAAkB;CACnB,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,mBAAmB;IACnB,oCAAoC;IACpC,2CAA2C;IAC3C,0BAA0B;CAC3B,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,kBAAkB;IAClB,sBAAsB;IACtB,wBAAwB;IACxB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,CAAC;AAc/C;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAwC;IAExC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS;KAC/B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAC7B,CAAC;IACF,MAAM,gBAAgB,GACpB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,kBAAkB,GAAG,QAAQ,KAAK,QAAQ;QAC9C,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACnC,GAAG,QAAQ;QACX,GAAG,gBAAgB;QACnB,GAAG,wBAAwB;QAC3B,GAAG,kBAAkB;QACrB,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,UAAU;QACV,mFAAmF;QACnF,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,QAAQ,GAAG,MAAM;SACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/sandbox/sandboxFilesystemPolicyBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxFilesystemPolicyBuild.spec.d.ts.map

package/dist/sandbox/sandboxFilesystemPolicyBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystemPolicyBuild.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxFilesystemPolicyBuild.spec.js

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "vitest";
+import path from "node:path";
+import os from "node:os";
+import { promises as fs } from "node:fs";
+import { sandboxFilesystemPolicyBuild } from "./sandboxFilesystemPolicyBuild.js";
+function basePermissions() {
+    return {
+        workingDir: path.resolve("/workspace"),
+        writeDirs: [path.resolve("/workspace/tmp"), path.resolve("/workspace/tmp")],
+        readDirs: [],
+        network: false,
+        events: false
+    };
+}
+describe("sandboxFilesystemPolicyBuild", () => {
+    it("dedupes writable paths", () => {
+        const result = sandboxFilesystemPolicyBuild({
+            permissions: basePermissions(),
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.allowWrite).toEqual([path.resolve("/workspace/tmp")]);
+    });
+    it("adds linux sensitive deny paths to read and write", () => {
+        const result = sandboxFilesystemPolicyBuild({
+            permissions: basePermissions(),
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.denyRead).toEqual(expect.arrayContaining([
+            path.resolve("/home/alice/.ssh"),
+            path.resolve("/home/alice/.gnupg"),
+            path.resolve("/home/alice/.aws"),
+            path.resolve("/etc/ssh"),
+            path.resolve("/etc/ssl/private"),
+            path.resolve("/root/.ssh")
+        ]));
+        expect(result.denyWrite).toEqual(result.denyRead);
+    });
+    it("adds macOS sensitive deny paths to read and write", () => {
+        const result = sandboxFilesystemPolicyBuild({
+            permissions: basePermissions(),
+            platform: "darwin",
+            homeDir: "/Users/alice"
+        });
+        expect(result.denyRead).toEqual(expect.arrayContaining([
+            path.resolve("/Users/alice/.ssh"),
+            path.resolve("/Users/alice/Library/Keychains"),
+            path.resolve("/Users/alice/Library/Application Support/com.apple.TCC"),
+            path.resolve("/private/etc/ssh")
+        ]));
+        expect(result.denyWrite).toEqual(result.denyRead);
+    });
+    it("denies workspace apps directory for non-app agents", () => {
+        const workingDir = path.resolve("/workspace");
+        const result = sandboxFilesystemPolicyBuild({
+            permissions: {
+                ...basePermissions(),
+                workingDir
+            },
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result.denyRead).toContain(path.resolve("/workspace/apps"));
+        expect(result.denyWrite).toContain(path.resolve("/workspace/apps"));
+    });
+    it("denies sibling app directories for app agents", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "daycare-app-policy-"));
+        try {
+            await fs.mkdir(path.join(workspace, "apps", "my-app", "data"), { recursive: true });
+            await fs.mkdir(path.join(workspace, "apps", "other-app", "data"), { recursive: true });
+            const result = sandboxFilesystemPolicyBuild({
+                permissions: {
+                    ...basePermissions(),
+                    workingDir: path.join(workspace, "apps", "my-app", "data"),
+                    writeDirs: [path.join(workspace, "apps", "my-app", "data")],
+                    readDirs: [workspace]
+                },
+                platform: "linux",
+                homeDir: "/home/alice"
+            });
+            expect(result.denyRead).toContain(path.join(workspace, "apps", "other-app"));
+            expect(result.denyRead).not.toContain(path.join(workspace, "apps", "my-app"));
+        }
+        finally {
+            await fs.rm(workspace, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=sandboxFilesystemPolicyBuild.spec.js.map

package/dist/sandbox/sandboxFilesystemPolicyBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystemPolicyBuild.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,SAAS,eAAe;IACtB,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACtC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3E,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,4BAA4B,CAAC;YAC1C,WAAW,EAAE,eAAe,EAAE;YAC9B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,4BAA4B,CAAC;YAC1C,WAAW,EAAE,eAAe,EAAE;YAC9B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,4BAA4B,CAAC;YAC1C,WAAW,EAAE,eAAe,EAAE;YAC9B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;SACjC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,4BAA4B,CAAC;YAC1C,WAAW,EAAE;gBACX,GAAG,eAAe,EAAE;gBACpB,UAAU;aACX;YACD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,4BAA4B,CAAC;gBAC1C,WAAW,EAAE;oBACX,GAAG,eAAe,EAAE;oBACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAC1D,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAC3D,QAAQ,EAAE,CAAC,SAAS,CAAC;iBACtB;gBACD,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,aAAa;aACvB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sandbox/sandboxHomeRedefine.d.ts

@@ -0,0 +1,15 @@
+type SandboxHomeRedefineInput = {
+    env: NodeJS.ProcessEnv;
+    home?: string;
+};
+type SandboxHomeRedefineResult = {
+    env: NodeJS.ProcessEnv;
+    homeDir?: string;
+};
+/**
+ * Redefines home-related environment variables inside the workspace.
+ * Expects: home is absolute and writable when provided.
+ */
+export declare function sandboxHomeRedefine(input: SandboxHomeRedefineInput): Promise<SandboxHomeRedefineResult>;
+export {};
+//# sourceMappingURL=sandboxHomeRedefine.d.ts.map

package/dist/sandbox/sandboxHomeRedefine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxHomeRedefine.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxHomeRedefine.ts"],"names":[],"mappings":"AAGA,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAwDpC"}

package/dist/sandbox/sandboxHomeRedefine.js

@@ -0,0 +1,61 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+/**
+ * Redefines home-related environment variables inside the workspace.
+ * Expects: home is absolute and writable when provided.
+ */
+export async function sandboxHomeRedefine(input) {
+    if (!input.home) {
+        return { env: input.env };
+    }
+    const homeDir = path.resolve(input.home);
+    const xdgConfig = path.join(homeDir, ".config");
+    const xdgCache = path.join(homeDir, ".cache");
+    const xdgData = path.join(homeDir, ".local", "share");
+    const xdgState = path.join(homeDir, ".local", "state");
+    const tempDir = path.join(homeDir, ".tmp");
+    const dirsToEnsure = [
+        homeDir,
+        xdgConfig,
+        xdgCache,
+        xdgData,
+        xdgState,
+        tempDir,
+        path.join(homeDir, ".cargo"),
+        path.join(homeDir, ".rustup"),
+        path.join(homeDir, ".gem"),
+        path.join(homeDir, ".bundle"),
+        path.join(homeDir, ".pub-cache"),
+        path.join(homeDir, ".nuget", "packages"),
+        path.join(homeDir, ".composer"),
+        path.join(homeDir, ".config", "pip")
+    ];
+    await Promise.all(dirsToEnsure.map((target) => fs.mkdir(target, { recursive: true })));
+    return {
+        env: {
+            ...input.env,
+            HOME: homeDir,
+            USERPROFILE: homeDir,
+            XDG_CONFIG_HOME: xdgConfig,
+            XDG_CACHE_HOME: xdgCache,
+            XDG_DATA_HOME: xdgData,
+            XDG_STATE_HOME: xdgState,
+            TMPDIR: tempDir,
+            TMP: tempDir,
+            TEMP: tempDir,
+            CARGO_HOME: path.join(homeDir, ".cargo"),
+            RUSTUP_HOME: path.join(homeDir, ".rustup"),
+            DOTNET_CLI_HOME: homeDir,
+            NUGET_PACKAGES: path.join(homeDir, ".nuget", "packages"),
+            GEM_HOME: path.join(homeDir, ".gem"),
+            BUNDLE_USER_HOME: path.join(homeDir, ".bundle"),
+            PUB_CACHE: path.join(homeDir, ".pub-cache"),
+            COMPOSER_HOME: path.join(homeDir, ".composer"),
+            PIP_CONFIG_FILE: path.join(homeDir, ".config", "pip", "pip.conf"),
+            NPM_CONFIG_USERCONFIG: path.join(homeDir, ".npmrc"),
+            npm_config_userconfig: path.join(homeDir, ".npmrc")
+        },
+        homeDir
+    };
+}
+//# sourceMappingURL=sandboxHomeRedefine.js.map

package/dist/sandbox/sandboxHomeRedefine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxHomeRedefine.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxHomeRedefine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG;QACnB,OAAO;QACP,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,OAAO;QACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;KACrC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,GAAG,EAAE;YACH,GAAG,KAAK,CAAC,GAAG;YACZ,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,eAAe,EAAE,SAAS;YAC1B,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO;YACtB,cAAc,EAAE,QAAQ;YACxB,MAAM,EAAE,OAAO;YACf,GAAG,EAAE,OAAO;YACZ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YACxC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;YAC1C,eAAe,EAAE,OAAO;YACxB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;YACpC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;YAC3C,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YAC9C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC;YACjE,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YACnD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;SACpD;QACD,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxHomeRedefine.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxHomeRedefine.spec.d.ts.map

package/dist/sandbox/sandboxHomeRedefine.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxHomeRedefine.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxHomeRedefine.spec.ts"],"names":[],"mappings":""}