dodo-mcp 1.0.0

package/dist/services/jobs/jobManager.js

@@ -0,0 +1,398 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DodoError } from '../../errors.js';
+import { buildChildEnv } from '../../security/env.js';
+import { newId } from '../../util/hash.js';
+import { SegmentedSpool } from './spool.js';
+import { INLINE_COMMAND_BYTES, validateExecArgs, validateShellCommand } from './commandInput.js';
+import { resolveTrustedExecutable } from '../../platform/execResolve.js';
+import { shellSpec, shellInvocation, batchInvocation, assertWindowsArgv } from '../../platform/shell.js';
+import { signalOwnedProcess } from '../../platform/processTree.js';
+import { removeWithRetry } from '../../platform/fsRetry.js';
+export class JobManager {
+    wfs;
+    limits;
+    store;
+    jobsDir;
+    extraEnvAllowlist;
+    sandboxWrap;
+    mutations;
+    shutdownPromise;
+    live = new Map();
+    finishedSpools = new Map();
+    exitWaiters = new Map();
+    constructor(wfs, limits, store, jobsDir, extraEnvAllowlist, sandboxWrap) {
+        this.wfs = wfs;
+        this.limits = limits;
+        this.store = store;
+        this.jobsDir = jobsDir;
+        this.extraEnvAllowlist = extraEnvAllowlist;
+        this.sandboxWrap = sandboxWrap;
+    }
+    runningCount() {
+        return this.live.size;
+    }
+    /** Resolve a bare program name on the trusted PATH; path-y programs resolve inside the workspace. */
+    resolveProgram(program, _cwdAbs) {
+        if (program.includes('\0'))
+            throw new DodoError('INVALID_INPUT', 'program contains NUL');
+        if (program.includes('/') || program.includes('\\')) {
+            // Explicit path: must stay inside the workspace (project scripts).
+            const rel = this.wfs.normalizeRel(program.replace(/\\/g, '/'));
+            const resolved = this.wfs.resolve(rel);
+            const st = resolved.stat;
+            if (!st?.isFile())
+                throw new DodoError('NOT_FOUND', `program not found in workspace: ${rel}`);
+            return resolved.abs;
+        }
+        return resolveTrustedExecutable(program, this.wfs.root);
+    }
+    /** The POSIX shell used for `run_command` — a fixed system binary, never from the repo. */
+    shellPath() {
+        return shellSpec(this.wfs.root).executable;
+    }
+    start(req) {
+        this.mutations?.assertCanStart();
+        if (this.shutdownPromise)
+            throw new DodoError('CONFLICT', 'job manager is shutting down');
+        if (this.live.size >= this.limits.jobsConcurrentMax) {
+            throw new DodoError('RESOURCE_LIMIT', `at most ${this.limits.jobsConcurrentMax} concurrent jobs`, { retryable: true });
+        }
+        const cwdResolved = this.wfs.resolve(req.cwdRel === '' ? '.' : req.cwdRel);
+        if (!cwdResolved.stat?.isDirectory())
+            throw new DodoError('PATH_DENIED', 'cwd is not a directory in the workspace');
+        const jobId = newId('job');
+        const jobDir = path.join(this.jobsDir, jobId);
+        let scriptPath;
+        let programAbs;
+        let spawnArgs;
+        let windowsVerbatimArguments = false;
+        let scriptContent = req.program;
+        if (req.shell) {
+            validateShellCommand(req.program, this.limits.commandBytes);
+            const spec = shellSpec(this.wfs.root);
+            spec.executable = this.shellPath();
+            if (spec.kind === 'cmd' || Buffer.byteLength(req.program, 'utf8') > INLINE_COMMAND_BYTES || (process.platform === 'win32' && req.program.length > 12000)) {
+                scriptPath = path.join(jobDir, `command${spec.extension}`);
+            }
+            if (spec.kind === 'cmd')
+                scriptContent = '@echo off\r\nchcp 65001 >nul\r\n' + req.program.replace(/\r?\n/g, '\r\n') + '\r\n';
+            const invocation = shellInvocation(spec, req.program, scriptPath);
+            programAbs = invocation.program;
+            spawnArgs = invocation.args;
+            windowsVerbatimArguments = invocation.windowsVerbatimArguments;
+        }
+        else {
+            validateExecArgs(req.program, req.args);
+            programAbs = this.resolveProgram(req.program, cwdResolved.abs);
+            spawnArgs = req.args;
+            if (process.platform === 'win32') {
+                if (/\.(cmd|bat)$/i.test(programAbs)) {
+                    const invocation = batchInvocation(programAbs, spawnArgs, this.wfs.root);
+                    programAbs = invocation.program;
+                    spawnArgs = invocation.args;
+                    windowsVerbatimArguments = true;
+                }
+                else if (!/\.(exe|com)$/i.test(programAbs))
+                    throw new DodoError('NOT_SUPPORTED', 'Windows exec requires .exe/.com or a guarded .cmd/.bat; use node.exe to run JavaScript files');
+            }
+        }
+        // Optional OS sandbox (macOS seatbelt / Linux bwrap) around the spawn.
+        let sandboxed = null;
+        if (this.sandboxWrap) {
+            const wrapped = this.sandboxWrap(programAbs, spawnArgs, {
+                allowNetwork: req.network ?? true, requested: req.sandbox, windowsVerbatimArguments,
+                ...(scriptPath ? { privateScript: scriptPath } : {}),
+                readablePaths: req.sandboxReadablePaths ?? [], writablePaths: req.sandboxWritablePaths ?? [],
+            });
+            if (wrapped) {
+                programAbs = wrapped.program;
+                spawnArgs = wrapped.args;
+                sandboxed = wrapped.kind;
+                windowsVerbatimArguments = wrapped.windowsVerbatimArguments ?? windowsVerbatimArguments;
+            }
+        }
+        if (process.platform === 'win32')
+            assertWindowsArgv(programAbs, spawnArgs, windowsVerbatimArguments);
+        const timeoutMs = Math.min(req.timeoutMs ?? this.limits.jobWallTimeoutDefaultMs, this.limits.jobWallTimeoutMaxMs);
+        const stdout = new SegmentedSpool(jobDir, 'stdout', this.limits.jobLogBytesPerJob);
+        const stderr = new SegmentedSpool(jobDir, 'stderr', this.limits.jobLogBytesPerJob);
+        const env = buildChildEnv({ parentEnv: process.env, workspaceRoot: this.wfs.root, extraAllowlist: this.extraEnvAllowlist });
+        // Record ownership before launching: a failed state write must not leave
+        // an untracked process or a private source file behind.
+        this.store.createJob({
+            id: jobId, workspaceId: req.workspaceId, epoch: req.epoch,
+            principal: req.principal, kind: req.kind,
+            program: req.shell ? programAbs : req.program, args: spawnArgs,
+            cwd: cwdResolved.rel, recipeId: req.recipeId ?? null, timeoutMs,
+        });
+        const releaseMutation = this.mutations?.retainJob();
+        let child;
+        let scriptCreated = false;
+        try {
+            if (scriptPath !== undefined) {
+                // Source never enters native argv or the workspace. Keep stdin free
+                // for job_input. Exclusive private files are removed when jobs close.
+                fs.writeFileSync(scriptPath, scriptContent, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+                scriptCreated = true;
+            }
+            child = spawn(programAbs, spawnArgs, {
+                cwd: cwdResolved.abs,
+                env,
+                shell: false,
+                detached: process.platform !== 'win32', // Windows cancellation uses the live owned tree
+                windowsHide: true,
+                windowsVerbatimArguments,
+                stdio: [req.stdin === false ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            releaseMutation?.();
+            if (scriptCreated && scriptPath)
+                fs.rmSync(scriptPath, { force: true });
+            stdout.close();
+            stderr.close();
+            this.store.updateJob(jobId, { status: 'failed_to_start', endedAt: Date.now() });
+            if (err.code === 'E2BIG')
+                throw new DodoError('RESOURCE_LIMIT', 'native argv/environment exceeds the OS limit; save code/data to files and pass short paths');
+            throw new DodoError('INTERNAL_ERROR', `spawn failed: ${err.message}`);
+        }
+        child.once('close', () => releaseMutation?.());
+        child.once('error', () => releaseMutation?.());
+        const liveJob = { child, stdout, stderr, timeout: undefined, stdinOpen: req.stdin !== false, scriptPath };
+        this.live.set(jobId, liveJob);
+        // A process may close stdin before an asynchronous write is flushed.
+        // EPIPE on that optional input channel must never crash the MCP server.
+        child.stdin?.on('error', () => { const job = this.live.get(jobId); if (job)
+            job.stdinOpen = false; });
+        child.on('error', (err) => {
+            stderr.write(Buffer.from(`\n[dodo] spawn error: ${err.message}\n`));
+            this.finish(jobId, 'failed_to_start', null, null);
+        });
+        child.once('spawn', () => {
+            this.store.updateJob(jobId, { pid: child.pid ?? null, startedAt: Date.now() });
+        });
+        child.stdout?.on('data', (chunk) => stdout.write(chunk));
+        child.stderr?.on('data', (chunk) => stderr.write(chunk));
+        child.on('exit', (code, signal) => {
+            // Descendants can keep inherited stdio open after the parent exits.
+            // Reclaim the job slot after a bounded drain instead of waiting forever.
+            liveJob.exitDrainTimer = setTimeout(() => {
+                if (!this.live.has(jobId))
+                    return;
+                stderr.write(Buffer.from('\n[dodo] parent exited; inherited output pipes exceeded the 2s drain budget and were closed\n'));
+                child.stdout?.destroy();
+                child.stderr?.destroy();
+                child.stdin?.destroy();
+                const row = this.store.getJob(jobId);
+                if (row?.status === 'running')
+                    this.finish(jobId, 'exited', code, signal);
+                else
+                    this.closeSpools(jobId);
+            }, 2000);
+            liveJob.exitDrainTimer.unref();
+        });
+        child.on('close', (code, signal) => {
+            if (!this.live.has(jobId))
+                return; // an exit-drain/error handler already finalized it
+            const row = this.store.getJob(jobId);
+            if (row && row.status === 'running') {
+                this.finish(jobId, 'exited', code, signal);
+            }
+            else {
+                this.closeSpools(jobId);
+            }
+        });
+        liveJob.timeout = setTimeout(() => {
+            const row = this.store.getJob(jobId);
+            if (row?.status === 'running') {
+                stderr.write(Buffer.from(`\n[dodo] wall timeout after ${timeoutMs} ms; terminating\n`));
+                try {
+                    this.terminate(jobId, 'timed_out');
+                }
+                catch {
+                    stderr.write(Buffer.from('[dodo] termination failed; job is still running and requires owner attention\n'));
+                }
+            }
+        }, timeoutMs);
+        liveJob.timeout.unref();
+        return { jobId, pid: child.pid ?? -1, sandboxed };
+    }
+    /**
+     * Wait until the job's process closes, or `waitMs` elapses. Resolves true
+     * when the job finished within the window. The job keeps running (under its
+     * own wall timeout) if the wait expires — callers then poll job_output.
+     */
+    waitForExit(jobId, waitMs) {
+        if (!this.live.has(jobId))
+            return Promise.resolve(true);
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                const list = this.exitWaiters.get(jobId);
+                if (list) {
+                    const idx = list.indexOf(cb);
+                    if (idx !== -1)
+                        list.splice(idx, 1);
+                }
+                resolve(false);
+            }, waitMs);
+            timer.unref();
+            const cb = () => {
+                clearTimeout(timer);
+                resolve(true);
+            };
+            const list = this.exitWaiters.get(jobId) ?? [];
+            list.push(cb);
+            this.exitWaiters.set(jobId, list);
+        });
+    }
+    finish(jobId, status, exitCode, signal) {
+        const row = this.store.getJob(jobId);
+        if (row && (row.status === 'running' || status === 'failed_to_start')) {
+            this.store.updateJob(jobId, { status, exitCode, signal: signal === null ? null : String(signal), endedAt: Date.now() });
+        }
+        this.closeSpools(jobId);
+    }
+    closeSpools(jobId) {
+        const live = this.live.get(jobId);
+        if (live) {
+            if (live.timeout)
+                clearTimeout(live.timeout);
+            if (live.exitDrainTimer)
+                clearTimeout(live.exitDrainTimer);
+            if (live.scriptPath) {
+                try {
+                    removeWithRetry(live.scriptPath);
+                }
+                catch { /* private crash residue is never executed on restart */ }
+            }
+            live.stdout.close();
+            live.stderr.close();
+            this.live.delete(jobId);
+            this.finishedSpools.set(jobId, { stdout: live.stdout, stderr: live.stderr });
+            this.enforceTotalSpoolBudget();
+        }
+        const waiters = this.exitWaiters.get(jobId);
+        if (waiters) {
+            this.exitWaiters.delete(jobId);
+            for (const w of waiters)
+                w();
+        }
+    }
+    enforceTotalSpoolBudget() {
+        // Drop oldest finished spools beyond the global cap.
+        let total = 0;
+        const entries = [...this.finishedSpools.entries()];
+        for (const [, s] of entries)
+            total += s.stdout.totalWritten + s.stderr.totalWritten;
+        while (total > this.limits.jobLogBytesTotal && entries.length > 0) {
+            const [id, s] = entries.shift();
+            total -= s.stdout.totalWritten + s.stderr.totalWritten;
+            s.stdout.removeFiles();
+            s.stderr.removeFiles();
+            this.finishedSpools.delete(id);
+        }
+    }
+    getJobChecked(jobId, workspaceId) {
+        const row = this.store.getJob(jobId);
+        if (!row || row.workspaceId !== workspaceId) {
+            throw new DodoError('JOB_NOT_FOUND', 'unknown jobId', { detail: { jobId } });
+        }
+        return row;
+    }
+    spoolsOf(jobId) {
+        return this.live.get(jobId) ?? this.finishedSpools.get(jobId);
+    }
+    output(jobId, workspaceId, stream, offset, maxBytes) {
+        const row = this.getJobChecked(jobId, workspaceId);
+        const spools = this.spoolsOf(jobId);
+        if (!spools) {
+            return { content: '', nextOffset: offset, truncatedBeforeOffset: 0, endOfStream: true, status: row.status };
+        }
+        const spool = stream === 'stdout' ? spools.stdout : spools.stderr;
+        const res = spool.read(offset, Math.min(maxBytes, this.limits.toolContentBytes));
+        return { ...res, endOfStream: res.endOfStream || row.status !== 'running', status: row.status };
+    }
+    /** Head of a stream (bounded) plus a small tail when it does not fit — for inline command results. */
+    inlineOutput(jobId, workspaceId, stream, maxBytes) {
+        this.getJobChecked(jobId, workspaceId);
+        const spools = this.spoolsOf(jobId);
+        if (!spools)
+            return { content: '', totalBytes: 0, truncated: false };
+        const spool = stream === 'stdout' ? spools.stdout : spools.stderr;
+        const total = spool.totalWritten;
+        const head = spool.read(0, maxBytes);
+        const truncated = head.nextOffset < total;
+        const out = { content: head.content, totalBytes: total, truncated };
+        if (truncated) {
+            const tailBytes = 4096;
+            out.tail = spool.read(Math.max(head.nextOffset, total - tailBytes), tailBytes).content;
+        }
+        return out;
+    }
+    writeInput(jobId, workspaceId, data, closeStdin) {
+        const row = this.getJobChecked(jobId, workspaceId);
+        if (row.status !== 'running')
+            throw new DodoError('JOB_NOT_RUNNING', `job is ${row.status}`);
+        const live = this.live.get(jobId);
+        if (!live || !live.child.stdin || !live.stdinOpen) {
+            throw new DodoError('JOB_NOT_RUNNING', 'job stdin is not available (pipe closed)');
+        }
+        const buf = Buffer.from(data, 'utf8');
+        if (buf.length > 64 * 1024)
+            throw new DodoError('RESOURCE_LIMIT', 'stdin chunk exceeds 64 KiB');
+        if (buf.length > 0)
+            live.child.stdin.write(buf);
+        if (closeStdin) {
+            live.child.stdin.end();
+            live.stdinOpen = false;
+        }
+        return { bytesWritten: buf.length, stdinOpen: live.stdinOpen };
+    }
+    /** TERM → grace → KILL on the process group we own (spec §13). */
+    cancel(jobId, workspaceId, graceMs = 5000) {
+        const row = this.getJobChecked(jobId, workspaceId);
+        if (row.status !== 'running') {
+            return { status: row.status };
+        }
+        const live = this.live.get(jobId);
+        if (!live || live.child.pid === undefined) {
+            // No live handle (e.g. after restart): never signal a stored PID.
+            this.store.updateJob(jobId, { status: 'interrupted_on_restart', endedAt: Date.now() });
+            return { status: 'interrupted_on_restart' };
+        }
+        this.terminate(jobId, 'canceled', graceMs);
+        return { status: 'canceling' };
+    }
+    terminate(jobId, finalStatus, graceMs = 5000) {
+        const live = this.live.get(jobId);
+        if (!live || !live.child.pid)
+            return;
+        signalOwnedProcess(live.child, 'SIGTERM', true);
+        this.store.updateJob(jobId, { status: finalStatus, endedAt: Date.now() });
+        if (process.platform === 'win32')
+            return; // explicitly hard-kill only
+        const killTimer = setTimeout(() => {
+            if (live.child.exitCode === null && live.child.signalCode === null)
+                signalOwnedProcess(live.child, 'SIGKILL', true);
+        }, graceMs);
+        killTimer.unref();
+    }
+    list(workspaceId, limit) {
+        return this.store.listJobs(workspaceId, limit);
+    }
+    /** Graceful shutdown: signal owned groups, bounded wait. */
+    shutdown(graceMs = 3000) {
+        if (!this.shutdownPromise)
+            this.shutdownPromise = (async () => {
+                for (const [jobId] of this.live)
+                    this.terminate(jobId, 'canceled', Math.min(graceMs, 2000));
+                const deadline = Date.now() + graceMs;
+                while (this.live.size > 0 && Date.now() < deadline)
+                    await new Promise((r) => setTimeout(r, 50));
+            })();
+        return this.shutdownPromise;
+    }
+}
+//# sourceMappingURL=jobManager.js.map

package/dist/services/jobs/jobManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobManager.js","sourceRoot":"","sources":["../../../src/services/jobs/jobManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA4D5D,MAAM,OAAO,UAAU;IAQF;IACA;IACA;IACA;IACA;IACA;IAZnB,SAAS,CAAiB;IAClB,eAAe,CAA4B;IAClC,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IAClC,cAAc,GAAG,IAAI,GAAG,EAA8D,CAAC;IACvF,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpE,YACmB,GAAgB,EAChB,MAAc,EACd,KAAY,EACZ,OAAe,EACf,iBAA2B,EAC3B,WAA4B;QAL5B,QAAG,GAAH,GAAG,CAAa;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAO;QACZ,YAAO,GAAP,OAAO,CAAQ;QACf,sBAAiB,GAAjB,iBAAiB,CAAU;QAC3B,gBAAW,GAAX,WAAW,CAAiB;IAC5C,CAAC;IAEJ,YAAY;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,qGAAqG;IACrG,cAAc,CAAC,OAAe,EAAE,OAAe;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,mEAAmE;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,mCAAmC,GAAG,EAAE,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC;QACD,OAAO,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,2FAA2F;IAC3F,SAAS;QACP,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAoB;QACxB,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,eAAe;YAAE,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,iBAAiB,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,yCAAyC,CAAC,CAAC;QACpH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,UAA8B,CAAC;QACnC,IAAI,UAAkB,CAAC;QACvB,IAAI,SAAmB,CAAC;QACxB,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,IAAI,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,oBAAoB,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;gBACzJ,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;gBAAE,aAAa,GAAG,kCAAkC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;YAC7H,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAClE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC;YAAC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;YAAC,wBAAwB,GAAG,UAAU,CAAC,wBAAwB,CAAC;QAC/H,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACxC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/D,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACzE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC;oBAAC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;oBAAC,wBAAwB,GAAG,IAAI,CAAC;gBAChG,CAAC;qBAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,8FAA8F,CAAC,CAAC;YACrL,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE;gBACtD,YAAY,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,wBAAwB;gBACnF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,aAAa,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;aAC7F,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;gBAC7B,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;gBACzB,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;gBACzB,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,wBAAwB,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;QACrG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAE5H,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACnB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK;YACzD,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI;YACxC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS;YAC9D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,SAAS;SAChE,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD,IAAI,KAAmB,CAAC;QACxB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,sEAAsE;gBACtE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3F,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;gBACnC,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,gDAAgD;gBACxF,WAAW,EAAE,IAAI;gBACjB,wBAAwB;gBACxB,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,EAAE,EAAE,CAAC;YACpB,IAAI,aAAa,IAAI,UAAU;gBAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChF,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,4FAA4F,CAAC,CAAC;YACzL,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,UAAU,EAAE,CAAC;QACnH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE9B,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,oEAAoE;YACpE,yEAAyE;YACzE,OAAO,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO;gBAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC,CAAC;gBAC3H,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,GAAG,EAAE,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;;oBACrE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,mDAAmD;YACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,SAAS,oBAAoB,CAAC,CAAC,CAAC;gBACxF,IAAI,CAAC;oBAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAAC,CAAC;gBAC3C,MAAM,CAAC;oBAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC,CAAC;gBAAC,CAAC;YACxH,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAExB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAa,EAAE,MAAc;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC7B,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,GAAG,EAAE;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACd,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAa,EAAE,MAAwB,EAAE,QAAuB,EAAE,MAAsC;QACrH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,iBAAiB,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC;oBAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;YAC9G,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,qDAAqD;QACrD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACpF,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,EAAkE,CAAC;YAChG,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,WAAmB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,WAAmB,EAAE,MAA2B,EAAE,MAAc,EAAE,QAAgB;QAOtG,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAClE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAClG,CAAC;IAED,sGAAsG;IACtG,YAAY,CAAC,KAAa,EAAE,WAAmB,EAAE,MAA2B,EAAE,QAAgB;QAC5F,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1C,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAClF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,UAAmB;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;QAChG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,KAAa,EAAE,WAAmB,EAAE,OAAO,GAAG,IAAI;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1C,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAEO,SAAS,CAAC,KAAa,EAAE,WAAqC,EAAE,OAAO,GAAG,IAAI;QACpF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO;QACrC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,4BAA4B;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACtH,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,WAAmB,EAAE,KAAa;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,GAAG,IAAI;QACrB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC5D,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;gBACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/services/jobs/sandbox.js

@@ -0,0 +1,156 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { DodoError } from '../../errors.js';
+import { findWindowsSandbox, windowsSandboxInvocation } from '../../platform/windowsSandbox.js';
+import { trustedPath } from '../../security/env.js';
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+/**
+ * `trustedPath` drops PATH entries that live inside a workspace root. When
+ * locating the sandbox binary no workspace is known, so pass a root nothing
+ * can live under (a character device has no children): the effect is just
+ * "absolute entries only, with the system default fallback".
+ */
+const NO_WORKSPACE = '/dev/null/no-workspace';
+function isExecutableFile(p) {
+    try {
+        const st = fs.statSync(p);
+        return st.isFile() && (st.mode & 0o111) !== 0;
+    }
+    catch {
+        return false;
+    }
+}
+function findBwrap(env) {
+    for (const dir of trustedPath(env['PATH'], NO_WORKSPACE).split(path.delimiter)) {
+        const candidate = path.join(dir, 'bwrap');
+        if (isExecutableFile(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+export function sandboxAvailability(env = process.env, ownerStateDir, workspaceRoot = process.cwd()) {
+    switch (process.platform) {
+        case 'darwin':
+            if (isExecutableFile(SANDBOX_EXEC))
+                return { available: true, kind: 'macos-seatbelt' };
+            return { available: false, reason: `${SANDBOX_EXEC} is missing or not executable` };
+        case 'linux':
+            if (findBwrap(env) !== undefined)
+                return { available: true, kind: 'linux-bwrap' };
+            return { available: false, reason: 'bwrap (bubblewrap) not found on the trusted PATH' };
+        case 'win32': {
+            const runtime = findWindowsSandbox(workspaceRoot, ownerStateDir);
+            return runtime?.provisioned && runtime.fence !== 'absent' && runtime.validated
+                ? { available: true, kind: 'windows-srt' }
+                : { available: false, reason: 'Windows sandbox needs local setup and a successful confinement probe; run dodo setup --components sandbox' };
+        }
+        default:
+            return { available: false, reason: `no OS sandbox adapter for platform ${process.platform}` };
+    }
+}
+function realpathIfExists(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isWithin(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+function resolveRoot(req) {
+    if (req.workspaceRoot.includes('\0') || !path.isAbsolute(req.workspaceRoot)) {
+        throw new DodoError('INVALID_INPUT', 'workspaceRoot must be an absolute path');
+    }
+    const real = realpathIfExists(req.workspaceRoot);
+    if (real === undefined || !fs.statSync(real).isDirectory()) {
+        throw new DodoError('NOT_FOUND', `workspaceRoot is not an existing directory: ${req.workspaceRoot}`);
+    }
+    return real;
+}
+/** Extra writable paths: must be absolute; realpath'd when they exist, skipped otherwise. */
+function resolveWritable(req) {
+    const out = [];
+    for (const p of req.writablePaths) {
+        if (p.includes('\0') || !path.isAbsolute(p)) {
+            throw new DodoError('INVALID_INPUT', `writable path must be absolute: ${JSON.stringify(p)}`);
+        }
+        const real = realpathIfExists(p);
+        if (real !== undefined && !out.includes(real))
+            out.push(real);
+    }
+    return out;
+}
+/** SBPL string literal: only `"` and `\` need escaping. */
+function sbplString(s) {
+    return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/**
+ * Seatbelt profile: allow everything, then deny all file writes, then re-allow
+ * writes under the workspace, the temp dirs, /dev and each extra writable path.
+ * Later rules win in SBPL, so the order below is load-bearing.
+ */
+export function seatbeltProfile(req) {
+    const root = resolveRoot(req);
+    const writable = new Set([root, '/private/tmp', '/tmp']);
+    const tmp = realpathIfExists(os.tmpdir());
+    if (tmp !== undefined)
+        writable.add(tmp); // /private/var/folders/<..>/T on macOS
+    writable.add('/dev');
+    for (const p of resolveWritable(req))
+        writable.add(p);
+    const lines = ['(version 1)', '(allow default)', '(deny file-write*)'];
+    for (const p of writable)
+        lines.push(`(allow file-write* (subpath ${sbplString(p)}))`);
+    lines.push(`(allow file-write* (literal ${sbplString('/dev/null')}))`);
+    if (!req.allowNetwork)
+        lines.push('(deny network*)');
+    return `${lines.join('\n')}\n`;
+}
+/**
+ * bubblewrap argv (everything after `bwrap`): the whole tree read-only, with
+ * read-write binds for the workspace, /tmp (plus $TMPDIR when it lives
+ * elsewhere) and each existing extra writable path. Pure — exported so the
+ * shape can be unit-tested on machines without bwrap.
+ */
+export function bwrapArgs(req, program, args) {
+    const root = resolveRoot(req);
+    const argv = ['--ro-bind', '/', '/', '--bind', root, root, '--bind', '/tmp', '/tmp', '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/run'];
+    const binds = new Set();
+    const tmp = realpathIfExists(os.tmpdir());
+    if (tmp !== undefined && !isWithin('/tmp', tmp) && !isWithin(root, tmp))
+        binds.add(tmp);
+    for (const p of resolveWritable(req))
+        binds.add(p);
+    for (const p of binds)
+        argv.push('--bind', p, p);
+    if (!req.allowNetwork)
+        argv.push('--unshare-net');
+    argv.push('--die-with-parent', '--', program, ...args);
+    return argv;
+}
+/** Rewrite a spawn so `program args` runs inside the OS sandbox; throws NOT_SUPPORTED when none is available. */
+export function wrapInSandbox(program, args, req) {
+    const avail = sandboxAvailability(process.env, req.ownerStateDir, req.workspaceRoot);
+    if (!avail.available || avail.kind === undefined) {
+        throw new DodoError('NOT_SUPPORTED', `OS sandbox unavailable: ${avail.reason ?? 'unknown reason'}`, {
+            recovery: process.platform === 'linux'
+                ? 'install bubblewrap (bwrap) and make sure it is on the PATH, or run the job unsandboxed'
+                : 'OS sandboxing needs macOS (sandbox-exec) or Linux (bwrap); otherwise run the job unsandboxed',
+        });
+    }
+    if (avail.kind === 'macos-seatbelt') {
+        const profile = seatbeltProfile(req);
+        return { program: SANDBOX_EXEC, args: ['-p', profile, program, ...args], kind: 'macos-seatbelt', profile };
+    }
+    if (avail.kind === 'windows-srt')
+        return { ...windowsSandboxInvocation(program, args, req), kind: 'windows-srt', windowsVerbatimArguments: false };
+    const bwrap = findBwrap(process.env);
+    if (bwrap === undefined)
+        throw new DodoError('NOT_SUPPORTED', 'OS sandbox unavailable: bwrap vanished from the PATH');
+    return { program: bwrap, args: bwrapArgs(req, program, args), kind: 'linux-bwrap' };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/services/jobs/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/services/jobs/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAmDpD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,SAAS,gBAAgB,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,aAAsB,EAAE,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;IAC7H,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,IAAI,gBAAgB,CAAC,YAAY,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YACvF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,+BAA+B,EAAE,CAAC;QACtF,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAClF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;QAC1F,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YACjE,OAAO,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS;gBAC5E,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;gBAC1C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2GAA2G,EAAE,CAAC;QAChJ,CAAC;QACD;YACE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACtC,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,+CAA+C,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe,CAAC,GAAmB;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,uCAAuC;IACjF,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,OAAe,EAAE,IAAc;IAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAc,EAAE,GAAmB;IAChF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,2BAA2B,KAAK,CAAC,MAAM,IAAI,gBAAgB,EAAE,EAAE;YAClG,QAAQ,EACN,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC1B,CAAC,CAAC,wFAAwF;gBAC1F,CAAC,CAAC,8FAA8F;SACrG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACnJ,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IACtH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACtF,CAAC"}

package/dist/services/jobs/sandboxWiring.js

@@ -0,0 +1,37 @@
+import os from 'node:os';
+import path from 'node:path';
+import { DodoError } from '../../errors.js';
+import { sandboxAvailability, wrapInSandbox } from './sandbox.js';
+export function sandboxWrapperFromConfig(config, workspaceRoot, ownerStateDir) {
+    const mode = config.commandSandbox;
+    const home = os.homedir();
+    // Caches most toolchains need even for "workspace-only" writes.
+    // macOS keeps a per-user cache dir next to the temp dir (…/T → …/C); Python/Xcode tooling writes there.
+    const darwinUserCache = path.resolve(os.tmpdir(), '..', 'C');
+    const defaultWritable = [`${home}/.npm`, `${home}/.cache`, `${home}/.yarn`, `${home}/Library/Caches`, `${home}/.cargo/registry`, `${home}/.pnpm-store`, darwinUserCache];
+    return (program, args, opts) => {
+        const wanted = opts.requested ?? mode !== 'off';
+        if (!wanted)
+            return undefined;
+        const avail = sandboxAvailability(process.env, ownerStateDir, workspaceRoot);
+        if (!avail.available) {
+            if (opts.requested === true || mode === 'require') {
+                throw new DodoError('NOT_SUPPORTED', `OS sandbox requested but unavailable: ${avail.reason ?? 'unsupported platform'}`, {
+                    recovery: 'run with sandbox:false, or set commandSandbox to "off"/"prefer" in the global config',
+                });
+            }
+            return undefined; // 'prefer' + unavailable → run unsandboxed (the tool reports sandboxed:false)
+        }
+        const wrapped = wrapInSandbox(program, args, {
+            workspaceRoot,
+            writablePaths: [...defaultWritable, ...config.sandboxWritablePaths, ...(opts.writablePaths ?? [])],
+            readablePaths: opts.readablePaths ?? [],
+            ...(opts.privateScript ? { privateScript: opts.privateScript } : {}),
+            allowNetwork: opts.allowNetwork,
+            ...(ownerStateDir ? { ownerStateDir } : {}),
+            ...(opts.windowsVerbatimArguments !== undefined ? { windowsVerbatimArguments: opts.windowsVerbatimArguments } : {}),
+        });
+        return { program: wrapped.program, args: wrapped.args, kind: wrapped.kind, ...(wrapped.windowsVerbatimArguments !== undefined ? { windowsVerbatimArguments: wrapped.windowsVerbatimArguments } : {}) };
+    };
+}
+//# sourceMappingURL=sandboxWiring.js.map

package/dist/services/jobs/sandboxWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxWiring.js","sourceRoot":"","sources":["../../../src/services/jobs/sandboxWiring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAoBlE,MAAM,UAAU,wBAAwB,CAAC,MAAoB,EAAE,aAAqB,EAAE,aAAsB;IAC1G,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,gEAAgE;IAChE,wGAAwG;IACxG,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,GAAG,IAAI,kBAAkB,EAAE,GAAG,IAAI,cAAc,EAAE,eAAe,CAAC,CAAC;IACzK,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,yCAAyC,KAAK,CAAC,MAAM,IAAI,sBAAsB,EAAE,EAAE;oBACtH,QAAQ,EAAE,sFAAsF;iBACjG,CAAC,CAAC;YACL,CAAC;YACD,OAAO,SAAS,CAAC,CAAC,8EAA8E;QAClG,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;YAC3C,aAAa;YACb,aAAa,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAClG,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpH,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACzM,CAAC,CAAC;AACJ,CAAC"}