daycare-cli 2026.2.12 → 2026.2.22

package/dist/sandbox/sandboxCanWrite.spec.js

@@ -1,21 +1,34 @@
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { sandboxCanWrite } from "./sandboxCanWrite.js";
 describe("sandboxCanWrite", () => {
     let workingDir;
     let outsideDir;
+    let homeDir;
+    let sensitiveFile;
+    let dangerousFile;
+    let dangerousHookFile;
     let appFile;
     beforeEach(async () => {
         workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-write-workspace-"));
         outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-write-outside-"));
+        homeDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-write-home-"));
+        vi.spyOn(os, "homedir").mockReturnValue(homeDir);
+        sensitiveFile = path.join(homeDir, ".ssh", "authorized_keys");
+        dangerousFile = path.join(outsideDir, ".bashrc");
+        dangerousHookFile = path.join(outsideDir, ".git", "hooks", "pre-commit");
+        await fs.mkdir(path.dirname(sensitiveFile), { recursive: true });
+        await fs.mkdir(path.dirname(dangerousHookFile), { recursive: true });
         appFile = path.join(workingDir, "apps", "my-app", "APP.md");
         await fs.mkdir(path.dirname(appFile), { recursive: true });
     });
     afterEach(async () => {
         await fs.rm(workingDir, { recursive: true, force: true });
         await fs.rm(outsideDir, { recursive: true, force: true });
+        await fs.rm(homeDir, { recursive: true, force: true });
+        vi.restoreAllMocks();
     });
     it("rejects writing within the workspace when not explicitly granted", async () => {
         const permissions = buildPermissions(workingDir, []);
@@ -39,6 +52,24 @@ describe("sandboxCanWrite", () => {
         const target = path.join(outsideDir, "blocked.txt");
         await expect(sandboxCanWrite(permissions, target)).rejects.toThrow("Path is outside the allowed directories.");
     });
+    it("denies writing to sensitive paths even when parent is in writeDirs", async () => {
+        const permissions = buildPermissions(workingDir, [homeDir]);
+        await expect(sandboxCanWrite(permissions, sensitiveFile)).rejects.toThrow("Write access denied for sensitive paths.");
+    });
+    it("denies writing dangerous filenames in allowed writeDirs", async () => {
+        const permissions = buildPermissions(workingDir, [outsideDir]);
+        await expect(sandboxCanWrite(permissions, dangerousFile)).rejects.toThrow("Write access denied for dangerous files or directories.");
+    });
+    it("denies writing under dangerous directories in allowed writeDirs", async () => {
+        const permissions = buildPermissions(workingDir, [outsideDir]);
+        await expect(sandboxCanWrite(permissions, dangerousHookFile)).rejects.toThrow("Write access denied for dangerous files or directories.");
+    });
+    it("allows writing regular files in allowed writeDirs", async () => {
+        const permissions = buildPermissions(workingDir, [outsideDir]);
+        const target = path.join(outsideDir, "notes", "output.txt");
+        const result = await sandboxCanWrite(permissions, target);
+        expect(result).toBe(path.join(await fs.realpath(outsideDir), "notes", "output.txt"));
+    });
     it("denies non-app agents from writing app directories", async () => {
         const permissions = buildPermissions(workingDir, [workingDir]);
         await expect(sandboxCanWrite(permissions, appFile)).rejects.toThrow("App directories are not accessible from non-app agents.");

package/dist/sandbox/sandboxCanWrite.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanWrite.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACtF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEpD,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC/D,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAmB;IAC7D,OAAO;QACH,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;KAC3D,CAAC;AACN,CAAC"}
+{"version":3,"file":"sandboxCanWrite.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,aAAqB,CAAC;IAC1B,IAAI,aAAqB,CAAC;IAC1B,IAAI,iBAAyB,CAAC;IAC9B,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACtF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAC9E,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACjD,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC9D,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACjD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,EAAE,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEpD,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,0CAA0C,CAC7C,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACzE,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC/D,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAmB;IAC7D,OAAO;QACH,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;KAC3D,CAAC;AACN,CAAC"}

package/dist/sandbox/sandboxDangerousFileCheck.d.ts

@@ -0,0 +1,11 @@
+type SandboxDangerousFiles = {
+    files: string[];
+    directories: string[];
+};
+/**
+ * Checks whether a target path matches dangerous sandbox-runtime patterns.
+ * Expects: dangerous patterns are relative names, target is absolute or resolvable.
+ */
+export declare function sandboxDangerousFileCheck(target: string, dangerous: SandboxDangerousFiles): boolean;
+export {};
+//# sourceMappingURL=sandboxDangerousFileCheck.d.ts.map

package/dist/sandbox/sandboxDangerousFileCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFileCheck.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFileCheck.ts"],"names":[],"mappings":"AAEA,KAAK,qBAAqB,GAAG;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAYnG"}

package/dist/sandbox/sandboxDangerousFileCheck.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+/**
+ * Checks whether a target path matches dangerous sandbox-runtime patterns.
+ * Expects: dangerous patterns are relative names, target is absolute or resolvable.
+ */
+export function sandboxDangerousFileCheck(target, dangerous) {
+    const resolvedTarget = path.resolve(target);
+    const targetBasename = path.basename(resolvedTarget);
+    if (dangerous.files.some((entry) => entry === targetBasename)) {
+        return true;
+    }
+    const targetSegments = path
+        .normalize(resolvedTarget)
+        .split(path.sep)
+        .filter((entry) => entry.length > 0);
+    return dangerous.directories.some((entry) => hasDirectoryPattern(targetSegments, entry));
+}
+function hasDirectoryPattern(targetSegments, pattern) {
+    const patternSegments = pattern.split(/[\\/]/u).filter((entry) => entry.length > 0);
+    if (patternSegments.length === 0 || patternSegments.length > targetSegments.length) {
+        return false;
+    }
+    for (let index = 0; index <= targetSegments.length - patternSegments.length; index += 1) {
+        let allMatch = true;
+        for (let offset = 0; offset < patternSegments.length; offset += 1) {
+            if (targetSegments[index + offset] !== patternSegments[offset]) {
+                allMatch = false;
+                break;
+            }
+        }
+        if (allMatch) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sandboxDangerousFileCheck.js.map

package/dist/sandbox/sandboxDangerousFileCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFileCheck.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFileCheck.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,SAAgC;IACtF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI;SACtB,SAAS,CAAC,cAAc,CAAC;SACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACf,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAwB,EAAE,OAAe;IAClE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,cAAc,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YAChE,IAAI,cAAc,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACV,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/sandbox/sandboxDangerousFileCheck.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxDangerousFileCheck.spec.d.ts.map

package/dist/sandbox/sandboxDangerousFileCheck.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFileCheck.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFileCheck.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxDangerousFileCheck.spec.js

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { sandboxDangerousFileCheck } from "./sandboxDangerousFileCheck.js";
+const dangerous = {
+    files: [".bashrc", ".gitconfig", ".mcp.json"],
+    directories: [".vscode", ".idea", ".claude/commands", ".git/hooks"]
+};
+describe("sandboxDangerousFileCheck", () => {
+    it("matches dangerous basenames", () => {
+        expect(sandboxDangerousFileCheck("/workspace/.bashrc", dangerous)).toBe(true);
+        expect(sandboxDangerousFileCheck("/workspace/project/.gitconfig", dangerous)).toBe(true);
+    });
+    it("matches dangerous single-segment directories", () => {
+        expect(sandboxDangerousFileCheck("/workspace/project/.vscode/settings.json", dangerous)).toBe(true);
+        expect(sandboxDangerousFileCheck("/workspace/project/.idea/workspace.xml", dangerous)).toBe(true);
+    });
+    it("matches dangerous multi-segment directories", () => {
+        expect(sandboxDangerousFileCheck("/workspace/project/.claude/commands/hello.md", dangerous)).toBe(true);
+        expect(sandboxDangerousFileCheck("/workspace/project/.git/hooks/pre-commit", dangerous)).toBe(true);
+    });
+    it("does not match safe files", () => {
+        expect(sandboxDangerousFileCheck("/workspace/project/src/index.ts", dangerous)).toBe(false);
+        expect(sandboxDangerousFileCheck("/workspace/project/.git/hook/pre-commit", dangerous)).toBe(false);
+    });
+});
+//# sourceMappingURL=sandboxDangerousFileCheck.spec.js.map

package/dist/sandbox/sandboxDangerousFileCheck.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFileCheck.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFileCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,SAAS,GAAG;IACd,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC;IAC7C,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,CAAC;CACtE,CAAC;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,yBAAyB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,yBAAyB,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,yBAAyB,CAAC,0CAA0C,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpG,MAAM,CAAC,yBAAyB,CAAC,wCAAwC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,yBAAyB,CAAC,8CAA8C,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,MAAM,CAAC,yBAAyB,CAAC,0CAA0C,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,yBAAyB,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5F,MAAM,CAAC,yBAAyB,CAAC,yCAAyC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/sandbox/sandboxDangerousFilesBuild.d.ts

@@ -0,0 +1,11 @@
+type SandboxDangerousFiles = {
+    files: string[];
+    directories: string[];
+};
+/**
+ * Builds the dangerous filename and directory patterns used by sandbox-runtime.
+ * Expects: consumers match these values against normalized target paths.
+ */
+export declare function sandboxDangerousFilesBuild(): SandboxDangerousFiles;
+export {};
+//# sourceMappingURL=sandboxDangerousFilesBuild.d.ts.map

package/dist/sandbox/sandboxDangerousFilesBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFilesBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFilesBuild.ts"],"names":[],"mappings":"AAAA,KAAK,qBAAqB,GAAG;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAgBF;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,qBAAqB,CAKlE"}

package/dist/sandbox/sandboxDangerousFilesBuild.js

@@ -0,0 +1,23 @@
+const SANDBOX_RUNTIME_DANGEROUS_FILES = [
+    ".gitconfig",
+    ".gitmodules",
+    ".bashrc",
+    ".bash_profile",
+    ".zshrc",
+    ".zprofile",
+    ".profile",
+    ".ripgreprc",
+    ".mcp.json"
+];
+const SANDBOX_RUNTIME_DANGEROUS_DIRECTORIES = [".vscode", ".idea", ".claude/commands", ".claude/agents", ".git/hooks"];
+/**
+ * Builds the dangerous filename and directory patterns used by sandbox-runtime.
+ * Expects: consumers match these values against normalized target paths.
+ */
+export function sandboxDangerousFilesBuild() {
+    return {
+        files: [...SANDBOX_RUNTIME_DANGEROUS_FILES],
+        directories: [...SANDBOX_RUNTIME_DANGEROUS_DIRECTORIES]
+    };
+}
+//# sourceMappingURL=sandboxDangerousFilesBuild.js.map

package/dist/sandbox/sandboxDangerousFilesBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFilesBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFilesBuild.ts"],"names":[],"mappings":"AAKA,MAAM,+BAA+B,GAAG;IACpC,YAAY;IACZ,aAAa;IACb,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,WAAW;CACd,CAAC;AAEF,MAAM,qCAAqC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAEvH;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACtC,OAAO;QACH,KAAK,EAAE,CAAC,GAAG,+BAA+B,CAAC;QAC3C,WAAW,EAAE,CAAC,GAAG,qCAAqC,CAAC;KAC1D,CAAC;AACN,CAAC"}

package/dist/sandbox/sandboxDangerousFilesBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxDangerousFilesBuild.spec.d.ts.map

package/dist/sandbox/sandboxDangerousFilesBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFilesBuild.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFilesBuild.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxDangerousFilesBuild.spec.js

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { sandboxDangerousFilesBuild } from "./sandboxDangerousFilesBuild.js";
+describe("sandboxDangerousFilesBuild", () => {
+    it("returns the sandbox runtime dangerous file patterns", () => {
+        const result = sandboxDangerousFilesBuild();
+        expect(result.files).toEqual([
+            ".gitconfig",
+            ".gitmodules",
+            ".bashrc",
+            ".bash_profile",
+            ".zshrc",
+            ".zprofile",
+            ".profile",
+            ".ripgreprc",
+            ".mcp.json"
+        ]);
+    });
+    it("returns the sandbox runtime dangerous directory patterns", () => {
+        const result = sandboxDangerousFilesBuild();
+        expect(result.directories).toEqual([".vscode", ".idea", ".claude/commands", ".claude/agents", ".git/hooks"]);
+    });
+    it("returns defensive copies", () => {
+        const result = sandboxDangerousFilesBuild();
+        result.files.push("changed");
+        result.directories.push("changed");
+        const next = sandboxDangerousFilesBuild();
+        expect(next.files).not.toContain("changed");
+        expect(next.directories).not.toContain("changed");
+    });
+});
+//# sourceMappingURL=sandboxDangerousFilesBuild.spec.js.map

package/dist/sandbox/sandboxDangerousFilesBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxDangerousFilesBuild.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxDangerousFilesBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACzB,YAAY;YACZ,aAAa;YACb,SAAS;YACT,eAAe;YACf,QAAQ;YACR,WAAW;YACX,UAAU;YACV,YAAY;YACZ,WAAW;SACd,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/sandbox/sandboxFilesystemPolicyBuild.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxFilesystemPolicyBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AA+CA,KAAK,iCAAiC,GAAG;IACrC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iCAAiC,GAAG,uBAAuB,CA4B9G"}
+{"version":3,"file":"sandboxFilesystemPolicyBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AAKA,KAAK,iCAAiC,GAAG;IACrC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iCAAiC,GAAG,uBAAuB,CAmB9G"}

package/dist/sandbox/sandboxFilesystemPolicyBuild.js

@@ -1,59 +1,17 @@
-import os from "node:os";
 import path from "node:path";
 import { sandboxAppsDenyPathsBuild } from "./sandboxAppsDenyPathsBuild.js";
-const COMMON_HOME_RELATIVE_DENY_PATHS = [
-    ".ssh",
-    ".gnupg",
-    ".aws",
-    ".kube",
-    ".docker",
-    ".config/gcloud",
-    ".config/gh",
-    ".config/op",
-    ".config/1Password",
-    ".local/share/keyrings",
-    ".npmrc",
-    ".pypirc",
-    ".netrc",
-    ".git-credentials"
-];
-const COMMON_SYSTEM_DENY_PATHS = [
-    "/etc/ssh",
-    "/etc/sudoers",
-    "/etc/sudoers.d",
-    "/etc/shadow",
-    "/etc/gshadow",
-    "/etc/ssl/private"
-];
-const DARWIN_HOME_RELATIVE_DENY_PATHS = [
-    "Library/Keychains",
-    "Library/Application Support/iCloud",
-    "Library/Application Support/com.apple.TCC",
-    "Library/Group Containers"
-];
-const DARWIN_SYSTEM_DENY_PATHS = [
-    "/private/etc/ssh",
-    "/private/etc/sudoers",
-    "/private/etc/sudoers.d",
-    "/private/etc/master.passwd"
-];
-const LINUX_SYSTEM_DENY_PATHS = ["/root/.ssh"];
+import { sandboxSensitiveDenyPathsBuild } from "./sandboxSensitiveDenyPathsBuild.js";
 /**
  * Builds sandbox filesystem policy with a default sensitive-path deny list.
  * Expects: permissions paths are already absolute and normalized.
  */
 export function sandboxFilesystemPolicyBuild(input) {
-    const platform = input.platform ?? process.platform;
-    const homeDir = path.resolve(input.homeDir ?? os.homedir());
     const allowWrite = dedupeResolvedPaths([...input.writeDirs]);
-    const homeDeny = COMMON_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry));
-    const platformHomeDeny = platform === "darwin" ? DARWIN_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry)) : [];
-    const platformSystemDeny = platform === "darwin" ? DARWIN_SYSTEM_DENY_PATHS : platform === "linux" ? LINUX_SYSTEM_DENY_PATHS : [];
     const denyRead = dedupeResolvedPaths([
-        ...homeDeny,
-        ...platformHomeDeny,
-        ...COMMON_SYSTEM_DENY_PATHS,
-        ...platformSystemDeny,
+        ...sandboxSensitiveDenyPathsBuild({
+            homeDir: input.homeDir,
+            platform: input.platform
+        }),
         ...sandboxAppsDenyPathsBuild({
             workingDir: input.workingDir ?? ""
         })

package/dist/sandbox/sandboxFilesystemPolicyBuild.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxFilesystemPolicyBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,+BAA+B,GAAG;IACpC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;CACrB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,kBAAkB;CACrB,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACpC,mBAAmB;IACnB,oCAAoC;IACpC,2CAA2C;IAC3C,0BAA0B;CAC7B,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,kBAAkB;IAClB,sBAAsB;IACtB,wBAAwB;IACxB,4BAA4B;CAC/B,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,CAAC;AAe/C;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAwC;IACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,MAAM,gBAAgB,GAClB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,kBAAkB,GACpB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACjC,GAAG,QAAQ;QACX,GAAG,gBAAgB;QACnB,GAAG,wBAAwB;QAC3B,GAAG,kBAAkB;QACrB,GAAG,yBAAyB,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;SACrC,CAAC;KACL,CAAC,CAAC;IAEH,OAAO;QACH,QAAQ;QACR,UAAU;QACV,mFAAmF;QACnF,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC;KAC3B,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IACzC,MAAM,QAAQ,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"sandboxFilesystemPolicyBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxFilesystemPolicyBuild.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAerF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAwC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACjC,GAAG,8BAA8B,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC;QACF,GAAG,yBAAyB,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;SACrC,CAAC;KACL,CAAC,CAAC;IAEH,OAAO;QACH,QAAQ;QACR,UAAU;QACV,mFAAmF;QACnF,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC;KAC3B,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IACzC,MAAM,QAAQ,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/sandbox/sandboxPathDenyCheck.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Checks whether a target path is contained in any denied directory path.
+ * Expects: target and denyPaths are absolute or resolvable paths.
+ */
+export declare function sandboxPathDenyCheck(target: string, denyPaths: string[]): boolean;
+//# sourceMappingURL=sandboxPathDenyCheck.d.ts.map

package/dist/sandbox/sandboxPathDenyCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAQjF"}

package/dist/sandbox/sandboxPathDenyCheck.js

@@ -0,0 +1,26 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isWithinSecure } from "./pathResolveSecure.js";
+/**
+ * Checks whether a target path is contained in any denied directory path.
+ * Expects: target and denyPaths are absolute or resolvable paths.
+ */
+export function sandboxPathDenyCheck(target, denyPaths) {
+    const resolvedTarget = existingPathResolve(target);
+    for (const denyPath of denyPaths) {
+        if (isWithinSecure(existingPathResolve(denyPath), resolvedTarget)) {
+            return true;
+        }
+    }
+    return false;
+}
+function existingPathResolve(target) {
+    const resolved = path.resolve(target);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+//# sourceMappingURL=sandboxPathDenyCheck.js.map

package/dist/sandbox/sandboxPathDenyCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,SAAmB;IACpE,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;AACL,CAAC"}

package/dist/sandbox/sandboxPathDenyCheck.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxPathDenyCheck.spec.d.ts.map

package/dist/sandbox/sandboxPathDenyCheck.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxPathDenyCheck.spec.js

@@ -0,0 +1,23 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { sandboxPathDenyCheck } from "./sandboxPathDenyCheck.js";
+describe("sandboxPathDenyCheck", () => {
+    it("returns true when target is inside a denied directory", () => {
+        const denied = ["/home/alice/.ssh", "/etc/ssh"];
+        const target = "/home/alice/.ssh/id_rsa";
+        expect(sandboxPathDenyCheck(target, denied)).toBe(true);
+    });
+    it("returns true when target matches a denied directory exactly", () => {
+        const target = path.resolve("/etc/ssh");
+        expect(sandboxPathDenyCheck(target, ["/etc/ssh"])).toBe(true);
+    });
+    it("returns false when target is outside denied directories", () => {
+        const target = "/home/alice/projects/daycare/readme.md";
+        expect(sandboxPathDenyCheck(target, ["/home/alice/.ssh", "/etc/ssh"])).toBe(false);
+    });
+    it("does not treat sibling directory names as contained", () => {
+        const target = "/home/alice/.ssh-backup/id_rsa";
+        expect(sandboxPathDenyCheck(target, ["/home/alice/.ssh"])).toBe(false);
+    });
+});
+//# sourceMappingURL=sandboxPathDenyCheck.spec.js.map

package/dist/sandbox/sandboxPathDenyCheck.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,yBAAyB,CAAC;QAEzC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAExC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,wCAAwC,CAAC;QAExD,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,gCAAgC,CAAC;QAEhD,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.d.ts

@@ -0,0 +1,11 @@
+type SandboxSensitiveDenyPathsBuildInput = {
+    homeDir?: string;
+    platform?: NodeJS.Platform;
+};
+/**
+ * Builds the shared sensitive filesystem deny-list used by sandbox checks.
+ * Expects: homeDir, when provided, is an absolute or resolvable path.
+ */
+export declare function sandboxSensitiveDenyPathsBuild(input?: SandboxSensitiveDenyPathsBuildInput): string[];
+export {};
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.d.ts.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.ts"],"names":[],"mappings":"AAGA,KAAK,mCAAmC,GAAG;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,CAAC;AA4CF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,GAAE,mCAAwC,GAAG,MAAM,EAAE,CAexG"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.js

@@ -0,0 +1,63 @@
+import os from "node:os";
+import path from "node:path";
+const COMMON_HOME_RELATIVE_DENY_PATHS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".kube",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/op",
+    ".config/1Password",
+    ".local/share/keyrings",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials"
+];
+const COMMON_SYSTEM_DENY_PATHS = [
+    "/etc/ssh",
+    "/etc/sudoers",
+    "/etc/sudoers.d",
+    "/etc/shadow",
+    "/etc/gshadow",
+    "/etc/ssl/private"
+];
+const DARWIN_HOME_RELATIVE_DENY_PATHS = [
+    "Library/Keychains",
+    "Library/Application Support/iCloud",
+    "Library/Application Support/com.apple.TCC",
+    "Library/Group Containers"
+];
+const DARWIN_SYSTEM_DENY_PATHS = [
+    "/private/etc/ssh",
+    "/private/etc/sudoers",
+    "/private/etc/sudoers.d",
+    "/private/etc/master.passwd"
+];
+const LINUX_SYSTEM_DENY_PATHS = ["/root/.ssh"];
+/**
+ * Builds the shared sensitive filesystem deny-list used by sandbox checks.
+ * Expects: homeDir, when provided, is an absolute or resolvable path.
+ */
+export function sandboxSensitiveDenyPathsBuild(input = {}) {
+    const platform = input.platform ?? process.platform;
+    const homeDir = path.resolve(input.homeDir ?? os.homedir());
+    const platformHomeDeny = platform === "darwin" ? DARWIN_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry)) : [];
+    const platformSystemDeny = platform === "darwin" ? DARWIN_SYSTEM_DENY_PATHS : platform === "linux" ? LINUX_SYSTEM_DENY_PATHS : [];
+    return dedupeResolvedPaths([
+        ...COMMON_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry)),
+        ...platformHomeDeny,
+        ...COMMON_SYSTEM_DENY_PATHS,
+        ...platformSystemDeny
+    ]);
+}
+function dedupeResolvedPaths(values) {
+    const resolved = values
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+        .map((entry) => path.resolve(entry));
+    return Array.from(new Set(resolved));
+}
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.js.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,MAAM,+BAA+B,GAAG;IACpC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;CACrB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,kBAAkB;CACrB,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACpC,mBAAmB;IACnB,oCAAoC;IACpC,2CAA2C;IAC3C,0BAA0B;CAC7B,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,kBAAkB;IAClB,sBAAsB;IACtB,wBAAwB;IACxB,4BAA4B;CAC/B,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA6C,EAAE;IAC1F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5D,MAAM,gBAAgB,GAClB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,kBAAkB,GACpB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,OAAO,mBAAmB,CAAC;QACvB,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/E,GAAG,gBAAgB;QACnB,GAAG,wBAAwB;QAC3B,GAAG,kBAAkB;KACxB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IACzC,MAAM,QAAQ,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.spec.d.ts.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.js

@@ -0,0 +1,52 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { sandboxSensitiveDenyPathsBuild } from "./sandboxSensitiveDenyPathsBuild.js";
+describe("sandboxSensitiveDenyPathsBuild", () => {
+    it("includes common and linux-specific deny paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result).toEqual(expect.arrayContaining([
+            path.resolve("/home/alice/.ssh"),
+            path.resolve("/home/alice/.gnupg"),
+            path.resolve("/home/alice/.config/gh"),
+            path.resolve("/home/alice/.git-credentials"),
+            path.resolve("/etc/ssh"),
+            path.resolve("/etc/sudoers"),
+            path.resolve("/etc/ssl/private"),
+            path.resolve("/root/.ssh")
+        ]));
+    });
+    it("includes common and macOS-specific deny paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "darwin",
+            homeDir: "/Users/alice"
+        });
+        expect(result).toEqual(expect.arrayContaining([
+            path.resolve("/Users/alice/.ssh"),
+            path.resolve("/Users/alice/Library/Keychains"),
+            path.resolve("/Users/alice/Library/Application Support/com.apple.TCC"),
+            path.resolve("/private/etc/master.passwd"),
+            path.resolve("/etc/ssh")
+        ]));
+    });
+    it("does not include platform-specific entries for unsupported platforms", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "win32",
+            homeDir: "/Users/alice"
+        });
+        expect(result).toContain(path.resolve("/Users/alice/.ssh"));
+        expect(result).not.toContain(path.resolve("/Users/alice/Library/Keychains"));
+        expect(result).not.toContain(path.resolve("/root/.ssh"));
+        expect(result).not.toContain(path.resolve("/private/etc/master.passwd"));
+    });
+    it("dedupes resolved paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "linux",
+            homeDir: "/home/alice/."
+        });
+        expect(new Set(result).size).toBe(result.length);
+    });
+});
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.spec.js.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;SAC7B,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;SAC3B,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,eAAe;SAC3B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}