frely-cli 0.23.0 → 0.23.2

package/dist/runtime/process-tree.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-tree.js","sourceRoot":"","sources":["../../src/runtime/process-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAmB;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAClE,IAAI,SAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACjG,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CACjD,QAAQ,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EACjC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACxD,GAAG,EAAE,CAAC,OAAO,EAAE,CAChB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjH,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,6GAA6G;AAC7G,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,6GAA6G;AAC7G,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAAkC;IAAyB;IAAhF,YAAqB,QAAuB,EAAW,MAAc,EAAW,MAAc,EAAE,IAAa;QAC3G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrK,KAAK,CAAC,kCAAkC,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAF3H,aAAQ,GAAR,QAAQ,CAAe;QAAW,WAAM,GAAN,MAAM,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;IAG9F,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,GAAW,EAAE,GAAsB,EAAE,SAAiB,EAAE,QAAgB,EAAE,MAAoB;IAC7I,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClI,MAAM,MAAM,GAAa,EAAE,EAAE,MAAM,GAAa,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,OAAO,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,yDAAyD,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3G,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,IAAY,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,QAAQ;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;;YAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,KAAK,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;iBACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBACrI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAmB,EAAE,SAAiB;IAC/D,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,IAAI,SAAS,4BAA4B,CAAC,CAAC,CAAC;QACzG,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"process-tree.js","sourceRoot":"","sources":["../../src/runtime/process-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAmB;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAClE,IAAI,SAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACjG,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CACjD,QAAQ,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EACjC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACxD,GAAG,EAAE,CAAC,OAAO,EAAE,CAChB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjH,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,6GAA6G;AAC7G,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,6GAA6G;AAC7G,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAAkC;IAAyB;IAAhF,YAAqB,QAAuB,EAAW,MAAc,EAAW,MAAc,EAAE,IAAa;QAC3G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrK,KAAK,CAAC,kCAAkC,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAF3H,aAAQ,GAAR,QAAQ,CAAe;QAAW,WAAM,GAAN,MAAM,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;IAG9F,CAAC;CACF;AASD,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,GAAW,EAAE,GAAsB,EAAE,SAAiB,EAAE,QAAgB,EAAE,MAAoB,EAAE,UAA2B,EAAE;IAC5K,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClI,MAAM,MAAM,GAAa,EAAE,EAAE,MAAM,GAAa,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,OAAO,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,yDAAyD,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3G,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,IAAY,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,QAAQ;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;;YAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,KAAK,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACrF,+GAA+G;gBAC/G,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;iBACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBACrI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAmB,EAAE,SAAiB;IAC/D,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,gIAAgI;QAChI,8GAA8G;QAC9G,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,MAAM,EAAE,CAAC;;YAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,IAAI,SAAS,4BAA4B,CAAC,CAAC,CAAC;QACzG,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/sandbox-proxy.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The user's own HTTP(S) proxy (Clash and the like) as the upstream of the command sandbox's proxy.
+ *
+ * srt gives sandboxed commands its own proxy and dials the network from the CLI process. A user who reaches the internet only through
+ * a local proxy has that setting in their shell, which a background service never sees, so downloads inside the sandbox fail. The
+ * address is taken, first match wins, from: the value saved with `frely sandbox proxy <url>`, the proxy variables of this process,
+ * and on macOS the system proxy (`scutil --proxy`). The user's own proxy settings are only read, never changed.
+ *
+ * srt 0.0.77 (`network.parentProxy`) takes `{ http, https, noProxy }`, accepts http:// and https:// proxy URLs only (a bare host:port
+ * counts as http), always bypasses loopback destinations, and reads the value once, when the sandbox starts.
+ */
+export interface UpstreamProxy {
+    http?: string;
+    https?: string;
+    noProxy?: string;
+}
+export declare function sandboxSettingsPath(env?: NodeJS.ProcessEnv): string;
+/** A proxy URL srt can use: http(s) scheme, or no scheme at all. Credentials in the URL are kept (srt sends them to the proxy). */
+export declare function usableProxyUrl(value: string | undefined): string | undefined;
+/** The value `frely sandbox proxy` saved, or undefined. */
+export declare function readSavedProxy(path?: string): UpstreamProxy | undefined;
+/** Save (or with `undefined` remove) the proxy to use for the sandbox. Takes effect when the MCP service restarts. */
+export declare function saveProxy(proxy: {
+    url: string;
+    noProxy?: string;
+} | undefined, path?: string): Promise<void>;
+/** The proxy variables of a process, including ALL_PROXY when it is an http(s) proxy (srt reads only HTTP_PROXY / HTTPS_PROXY itself). */
+export declare function proxyFromEnv(env: NodeJS.ProcessEnv): UpstreamProxy | undefined;
+/** The HTTP/HTTPS proxy of the macOS network settings, from the text of `scutil --proxy`. SOCKS and auto-config (PAC) entries are ignored. */
+export declare function parseScutilProxy(text: string): UpstreamProxy | undefined;
+/** The upstream proxy for the sandbox: saved value, then this process's environment, then (macOS) the system proxy. */
+export declare function resolveUpstreamProxy(options?: {
+    saved?: UpstreamProxy | undefined;
+    env?: NodeJS.ProcessEnv;
+    platform?: string;
+    system?: () => UpstreamProxy | undefined;
+}): UpstreamProxy | undefined;
+/** `frely sandbox proxy [<url> [--no-proxy <list>] | --clear]`: show, save or remove the proxy used by the command sandbox. */
+export declare function runSandboxProxyCommand(args: readonly string[], write: (text: string) => void): Promise<void>;

package/dist/runtime/sandbox-proxy.js

@@ -0,0 +1,134 @@
+import { execFileSync } from "node:child_process";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const SETTINGS_FILE = "sandbox.json";
+export function sandboxSettingsPath(env = process.env) {
+    return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "frely", SETTINGS_FILE);
+}
+/** A proxy URL srt can use: http(s) scheme, or no scheme at all. Credentials in the URL are kept (srt sends them to the proxy). */
+export function usableProxyUrl(value) {
+    const text = value?.trim();
+    if (!text)
+        return undefined;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//iu.test(text) ? text : `http://${text}`;
+    try {
+        const url = new URL(withScheme);
+        return (url.protocol === "http:" || url.protocol === "https:") && url.hostname ? text : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The value `frely sandbox proxy` saved, or undefined. */
+export function readSavedProxy(path = sandboxSettingsPath()) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8")).proxy;
+        const url = typeof value?.url === "string" ? usableProxyUrl(value.url) : undefined;
+        if (!url)
+            return undefined;
+        return { http: url, https: url, ...(typeof value?.noProxy === "string" && value.noProxy.trim() ? { noProxy: value.noProxy.trim() } : {}) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Save (or with `undefined` remove) the proxy to use for the sandbox. Takes effect when the MCP service restarts. */
+export async function saveProxy(proxy, path = sandboxSettingsPath()) {
+    if (!proxy) {
+        await rm(path, { force: true });
+        return;
+    }
+    const url = usableProxyUrl(proxy.url);
+    if (!url)
+        throw new Error("The proxy must be an http:// or https:// URL (or host:port). SOCKS proxies are not supported by the sandbox.");
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify({ proxy: { url, ...(proxy.noProxy?.trim() ? { noProxy: proxy.noProxy.trim() } : {}) } }, null, 2)}\n`, { mode: 0o600 });
+    await rename(temporary, path);
+}
+/** The proxy variables of a process, including ALL_PROXY when it is an http(s) proxy (srt reads only HTTP_PROXY / HTTPS_PROXY itself). */
+export function proxyFromEnv(env) {
+    const pick = (...names) => names.map((name) => usableProxyUrl(env[name])).find((value) => value !== undefined);
+    const all = pick("ALL_PROXY", "all_proxy");
+    const http = pick("HTTP_PROXY", "http_proxy") ?? all;
+    const https = pick("HTTPS_PROXY", "https_proxy") ?? all ?? http;
+    if (!http && !https)
+        return undefined;
+    const noProxy = (env.NO_PROXY ?? env.no_proxy ?? "").trim();
+    return { ...(http ? { http } : {}), ...(https ? { https } : {}), ...(noProxy ? { noProxy } : {}) };
+}
+/** The HTTP/HTTPS proxy of the macOS network settings, from the text of `scutil --proxy`. SOCKS and auto-config (PAC) entries are ignored. */
+export function parseScutilProxy(text) {
+    const field = (name) => new RegExp(`^\\s*${name}\\s*:\\s*(.+?)\\s*$`, "mu").exec(text)?.[1];
+    const endpoint = (prefix) => {
+        const host = field(`${prefix}Proxy`);
+        const port = field(`${prefix}Port`);
+        return field(`${prefix}Enable`) === "1" && host && port ? usableProxyUrl(`http://${host.includes(":") ? `[${host}]` : host}:${port}`) : undefined;
+    };
+    const http = endpoint("HTTP");
+    const https = endpoint("HTTPS");
+    if (!http && !https)
+        return undefined;
+    const exceptions = /ExceptionsList\s*:\s*<array>\s*\{([^}]*)\}/u.exec(text)?.[1];
+    const noProxy = exceptions ? [...exceptions.matchAll(/^\s*\d+\s*:\s*(.+?)\s*$/gmu)].map((match) => match[1]).join(",") : "";
+    return { ...(http ? { http } : {}), ...(https ? { https } : {}), ...(noProxy ? { noProxy } : {}) };
+}
+function readSystemProxy() {
+    try {
+        return parseScutilProxy(execFileSync("scutil", ["--proxy"], { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The upstream proxy for the sandbox: saved value, then this process's environment, then (macOS) the system proxy. */
+export function resolveUpstreamProxy(options = {}) {
+    const saved = "saved" in options ? options.saved : readSavedProxy();
+    if (saved)
+        return saved;
+    const fromEnv = proxyFromEnv(options.env ?? process.env);
+    if (fromEnv)
+        return fromEnv;
+    return (options.platform ?? process.platform) === "darwin" ? (options.system ?? readSystemProxy)() : undefined;
+}
+/** `frely sandbox proxy [<url> [--no-proxy <list>] | --clear]`: show, save or remove the proxy used by the command sandbox. */
+export async function runSandboxProxyCommand(args, write) {
+    const noProxyIndex = args.indexOf("--no-proxy");
+    const noProxy = noProxyIndex === -1 ? undefined : args[noProxyIndex + 1];
+    if (noProxyIndex !== -1 && !noProxy)
+        throw new Error("--no-proxy needs a comma-separated list.");
+    const rest = noProxyIndex === -1 ? [...args] : args.filter((_, index) => index !== noProxyIndex && index !== noProxyIndex + 1);
+    if (rest.includes("--clear")) {
+        await saveProxy(undefined);
+        write("Saved sandbox proxy removed. Restart the MCP service (frely mcp stop, then frely mcp start) for it to take effect.\n");
+        return;
+    }
+    if (rest.length === 0) {
+        const saved = readSavedProxy();
+        const effective = resolveUpstreamProxy();
+        write(saved ? `Saved sandbox proxy: ${redact(saved.http)}${saved.noProxy ? ` (no proxy for ${saved.noProxy})` : ""}\n` : "No sandbox proxy saved.\n");
+        write(effective ? `In use when the sandbox starts: ${redact(effective.https ?? effective.http)}${saved ? "" : " (from this environment or the system settings)"}\n` : "In use when the sandbox starts: none (direct connections).\n");
+        return;
+    }
+    if (rest.length !== 1)
+        throw new Error("Usage: frely sandbox proxy [<http://host:port> [--no-proxy <list>] | --clear]");
+    await saveProxy({ url: rest[0], ...(noProxy ? { noProxy } : {}) });
+    write(`Sandbox proxy saved: ${redact(rest[0])}. Restart the MCP service (frely mcp stop, then frely mcp start) for it to take effect.\n`);
+}
+/** The proxy URL without its password, for display. */
+function redact(value) {
+    if (!value)
+        return "none";
+    try {
+        const url = new URL(/^[a-z][a-z0-9+.-]*:\/\//iu.test(value) ? value : `http://${value}`);
+        if (url.password)
+            url.password = "***";
+        return url.toString().replace(/\/$/u, "");
+    }
+    catch {
+        return "(invalid)";
+    }
+}
+//# sourceMappingURL=sandbox-proxy.js.map

package/dist/runtime/sandbox-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-proxy.js","sourceRoot":"","sources":["../../src/runtime/sandbox-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAe1C,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACzF,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,OAAe,mBAAmB,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsD,CAAC,KAAK,CAAC;QACjH,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAoD,EAAE,OAAe,mBAAmB,EAAE;IACxH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAC;IAC1I,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrK,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,MAAM,IAAI,GAAG,CAAC,GAAG,KAAe,EAAsB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7I,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC;IAChE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,8IAA8I;AAC9I,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,qBAAqB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,CAAC,MAAwB,EAAsB,EAAE;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,UAAU,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7H,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACzI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,oBAAoB,CAAC,UAAuI,EAAE;IAC5K,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACpE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAuB,EAAE,KAA6B;IACjG,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC;IAC/H,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAC3B,KAAK,CAAC,sHAAsH,CAAC,CAAC;QAC9H,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;QACtJ,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,mCAAmC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iDAAiD,IAAI,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC;QACtO,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACxH,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,2FAA2F,CAAC,CAAC;AAC5I,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CAAC,KAAyB;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACzF,IAAI,GAAG,CAAC,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;QACvC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/runtime/sandbox.d.ts

@@ -1,4 +1,5 @@
 import { type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
+import { type UpstreamProxy } from "./sandbox-proxy.js";
 /**
  * OS-level sandboxing for `run_command` / `start_process`.
  *
@@ -85,9 +86,43 @@ export declare const SSH_PROXY_PREFIX: string;
  * relay that reads them from the environment. Other platforms keep srt's own setting (Linux uses socat with proxyauth).
  */
 export declare function sshProxyPrefix(platform?: string, helper?: readonly string[]): string;
-export declare function buildSandboxConfig(workspaceRoot: string, allowedGroups?: readonly string[]): SandboxRuntimeConfig;
+export interface SandboxConfigOptions {
+    /** run_command only: the command may write the workspace `.git/config`; the caller then runs the guard in git-config-guard.ts. */
+    allowGitConfig?: boolean;
+    /** The user's own proxy that srt forwards to. Read once when the sandbox starts. */
+    parentProxy?: UpstreamProxy | undefined;
+}
+export declare function buildSandboxConfig(workspaceRoot: string, allowedGroups?: readonly string[], options?: SandboxConfigOptions): SandboxRuntimeConfig;
 /** Plain-words refusal shown to the caller when the sandbox cannot run on this device. */
 export declare function sandboxUnavailableMessage(reason: string): string;
+/** What the sandbox needs to wrap one command: the parts of srt that `wrapSerialized` uses, so tests can stand in for it. */
+export interface WrapManager {
+    updateConfig(config: SandboxRuntimeConfig): void;
+    wrapWithSandbox(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal, options?: {
+        commandId?: string;
+        commandText?: string;
+    }): Promise<string>;
+}
+/**
+ * Wrap one command. Every wrap goes through this queue, one at a time, because a command that may change `.git/config` needs srt's
+ * global `filesystem.allowGitConfig` switched on while it is wrapped. srt bakes that switch into the command's own sandbox profile
+ * (the macOS seatbelt profile string, the Linux bubblewrap arguments) inside `wrapWithSandbox`, and reads it nowhere afterwards, so
+ * switching it back right after the wrap leaves that command's sandbox as it was made and later commands without it. Only the wrap
+ * (milliseconds) is queued; the commands themselves run concurrently.
+ */
+export declare function wrapSerialized(manager: WrapManager, base: SandboxRuntimeConfig, wrap: () => Promise<string>, allowGitConfig: boolean): Promise<string>;
+export interface SandboxedCommand {
+    /** The command to spawn with `shell: true`. */
+    command: string;
+    /** The key under which srt records this command's violations; undefined when the command is not sandboxed. */
+    commandId?: string;
+    /** The command may change `.git/config`: snapshot it before the spawn and run the guard after the exit. */
+    gitConfig: boolean;
+}
+export interface SandboxCommandOptions {
+    /** run_command only: allow writing the workspace `.git/config` (the caller must run the guard). start_process never sets this. */
+    allowGitConfig?: boolean;
+}
 /**
  * Wrap a shell command with sandbox restrictions before it is spawned with
  * `shell: true`. Fails closed: when the sandbox cannot run (unsupported
@@ -96,7 +131,10 @@ export declare function sandboxUnavailableMessage(reason: string): string;
  * is returned unchanged only when the owner turned the sandbox off
  * (`FRELY_SANDBOX=off`) or approved the `unsandboxed` grant for this call.
  */
+export declare function sandboxCommandDetailed(command: string, workspaceRoot: string, allowedGroups?: readonly string[], options?: SandboxCommandOptions): Promise<SandboxedCommand>;
 export declare function sandboxCommand(command: string, workspaceRoot: string, allowedGroups?: readonly string[]): Promise<string>;
+/** The violations srt recorded for one wrapped command (proxy denials always; file and socket denials where srt's log monitor runs). */
+export declare function sandboxViolationLines(commandId: string | undefined): string[];
 /** The group whose unapproved credential path a command names, or `null` for a path no grant can open. */
 type DeniedRead = {
     path: string;
@@ -108,11 +146,17 @@ type DeniedRead = {
  * Text matching only: a script that reads the path itself is still confined by the sandbox, just without this explanation.
  */
 export declare function deniedReadReference(command: string, allowedGroups?: readonly string[]): DeniedRead | undefined;
+/** What the caller knows about a failed command beyond its stderr: srt's recorded violations and the workspace it ran in. */
+export interface DenialContext {
+    violations?: readonly string[];
+    workspaceRoot?: string;
+}
 /**
- * Hint for a failed sandboxed command whose stderr looks like a sandbox denial, so the caller asks the owner for approval
- * (request_permission) instead of giving up on a bare "Operation not permitted".
+ * Hint for a failed sandboxed command whose output looks like a sandbox denial, so the caller asks for the narrowest approval
+ * (request_permission) instead of giving up on a bare "Operation not permitted" or reaching for `unsandboxed`. It reads srt's
+ * recorded violations, then stderr and the command text. Nothing is guessed beyond that: a denial it cannot place gets the generic hint.
  */
-export declare function sandboxDenialHint(stderr: string, command?: string, exitCode?: number | null, sshConfigReadable?: boolean): string | undefined;
+export declare function sandboxDenialHint(stderr: string, command?: string, exitCode?: number | null, sshConfigReadable?: boolean, context?: DenialContext): string | undefined;
 /** Whether ~/.ssh/config can be read by the CLI process itself (outside the sandbox). */
 export declare function sshConfigReadable(): boolean;
 /** Exposed for tests: resets the module-level init state and the underlying manager. */

package/dist/runtime/sandbox.js

@@ -1,8 +1,11 @@
-import { readFileSync, realpathSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { isAbsolute, join, normalize, parse, sep } from "node:path";
+import { dirname, isAbsolute, join, normalize, parse, sep } from "node:path";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 import { cliLaunchArguments } from "../cli-launch.js";
+import { gitConfigGuardAvailable } from "./git-config-guard.js";
+import { resolveUpstreamProxy } from "./sandbox-proxy.js";
 /**
  * OS-level sandboxing for `run_command` / `start_process`.
  *
@@ -218,7 +221,27 @@ function helperEntry() {
         return process.argv[1] ?? "";
     }
 }
-export function buildSandboxConfig(workspaceRoot, allowedGroups = []) {
+/** A directory `path` inside the workspace, or false when it is missing or only a link (a worktree's `.git` file). */
+const isDirectory = (path) => { try {
+    return statSync(path).isDirectory();
+}
+catch {
+    return false;
+} };
+/**
+ * `.git` paths of the workspace root that srt does not (or no longer) protect on its own. srt derives its `.git/hooks` and `.git/config`
+ * denials from the CLI process's current directory, not from the workspace a command runs in, so they are named here as well.
+ * `.git/hooks` is always denied (hooks run programs outside the sandbox). `.git/config` is denied unless the command may change it
+ * (run_command with the guard in git-config-guard.ts).
+ */
+function gitWriteDenials(workspaceRoot, allowGitConfig) {
+    const dotGit = join(workspaceRoot, ".git");
+    if (!isDirectory(dotGit))
+        return [];
+    return [...(isDirectory(join(dotGit, "hooks")) ? [join(dotGit, "hooks")] : []), ...(allowGitConfig ? [] : [join(dotGit, "config")])];
+}
+export function buildSandboxConfig(workspaceRoot, allowedGroups = [], options = {}) {
+    const allowGitConfig = options.allowGitConfig === true;
     return {
         network: {
             // Left open by default: an empty allowlist would break ordinary
@@ -230,11 +253,13 @@ export function buildSandboxConfig(workspaceRoot, allowedGroups = []) {
             deniedDomains: [],
             // Local dev servers and tests need to listen on and reach loopback ports. srt reads this only when it initializes, so it cannot vary per call.
             allowLocalBinding: true,
+            ...(options.parentProxy ? { parentProxy: options.parentProxy } : {}),
         },
         filesystem: {
             denyRead: sensitiveReadPaths(allowedGroups),
             allowWrite: [workspaceRoot, tmpdir(), ...writablePaths(allowedGroups)],
-            denyWrite: protectedWriteDenials(allowedGroups),
+            denyWrite: [...protectedWriteDenials(allowedGroups), ...gitWriteDenials(workspaceRoot, allowGitConfig)],
+            ...(allowGitConfig ? { allowGitConfig: true } : {}),
         },
     };
 }
@@ -253,6 +278,8 @@ export function sandboxUnavailableMessage(reason) {
         + "or set FRELY_SANDBOX=off on the device.";
 }
 let initialized;
+/** The configuration srt was initialized with: what every command runs under, and what is put back after a git-config wrap. */
+let baseConfig;
 async function ensureInitialized(workspaceRoot) {
     initialized ??= (async () => {
         if (!SandboxManager.isSupportedPlatform()) {
@@ -269,7 +296,9 @@ async function ensureInitialized(workspaceRoot) {
         for (const warning of dependencies.warnings)
             warnOnce(warning);
         try {
-            await SandboxManager.initialize(buildSandboxConfig(workspaceRoot));
+            // The proxy servers keep the upstream proxy they start with, so a changed proxy needs a restart of the service.
+            baseConfig = buildSandboxConfig(workspaceRoot, [], { parentProxy: resolveUpstreamProxy() });
+            await SandboxManager.initialize(structuredClone(baseConfig));
             return { ready: true };
         }
         catch (error) {
@@ -280,6 +309,30 @@ async function ensureInitialized(workspaceRoot) {
     })();
     return initialized;
 }
+let wrapQueue = Promise.resolve();
+/**
+ * Wrap one command. Every wrap goes through this queue, one at a time, because a command that may change `.git/config` needs srt's
+ * global `filesystem.allowGitConfig` switched on while it is wrapped. srt bakes that switch into the command's own sandbox profile
+ * (the macOS seatbelt profile string, the Linux bubblewrap arguments) inside `wrapWithSandbox`, and reads it nowhere afterwards, so
+ * switching it back right after the wrap leaves that command's sandbox as it was made and later commands without it. Only the wrap
+ * (milliseconds) is queued; the commands themselves run concurrently.
+ */
+export function wrapSerialized(manager, base, wrap, allowGitConfig) {
+    const task = async () => {
+        if (!allowGitConfig)
+            return wrap();
+        manager.updateConfig({ ...base, filesystem: { ...base.filesystem, allowGitConfig: true } });
+        try {
+            return await wrap();
+        }
+        finally {
+            manager.updateConfig(base);
+        }
+    };
+    const run = wrapQueue.then(task, task);
+    wrapQueue = run.catch(() => undefined);
+    return run;
+}
 /**
  * Wrap a shell command with sandbox restrictions before it is spawned with
  * `shell: true`. Fails closed: when the sandbox cannot run (unsupported
@@ -288,26 +341,45 @@ async function ensureInitialized(workspaceRoot) {
  * is returned unchanged only when the owner turned the sandbox off
  * (`FRELY_SANDBOX=off`) or approved the `unsandboxed` grant for this call.
  */
-export async function sandboxCommand(command, workspaceRoot, allowedGroups = []) {
+export async function sandboxCommandDetailed(command, workspaceRoot, allowedGroups = [], options = {}) {
     if (isSandboxDisabled())
-        return command;
+        return { command, gitConfig: false };
     // The owner opened raw outbound connections for this call, which the sandbox cannot offer without losing its other limits.
     if (allowedGroups.includes(UNSANDBOXED_GROUP))
-        return command;
+        return { command, gitConfig: false };
     const denied = deniedReadReference(command, allowedGroups);
     if (denied)
         throw new Error(deniedReadMessage(denied));
     const init = await ensureInitialized(workspaceRoot);
-    if (!init.ready)
-        throw new Error(sandboxUnavailableMessage(init.reason));
+    if (!init.ready || !baseConfig)
+        throw new Error(sandboxUnavailableMessage(init.ready ? "sandbox configuration missing" : init.reason));
+    // Without git the guard cannot check the file afterwards, so `.git/config` then stays read-only.
+    const gitConfig = options.allowGitConfig === true && await gitConfigGuardAvailable();
+    const commandId = randomUUID();
+    // initialize() fixed allowWrite to the first workspace that ran a command; give every call its own workspace.
+    const { allowGitConfig: _unused, ...filesystem } = buildSandboxConfig(workspaceRoot, allowedGroups, { allowGitConfig: gitConfig }).filesystem ?? {};
     try {
-        // initialize() fixed allowWrite to the first workspace that ran a command; give every call its own workspace.
-        return await SandboxManager.wrapWithSandbox(sshProxyPrefix() + command, undefined, { filesystem: buildSandboxConfig(workspaceRoot, allowedGroups).filesystem });
+        const wrapped = await wrapSerialized(SandboxManager, baseConfig, () => SandboxManager.wrapWithSandbox(sshProxyPrefix() + command, undefined, { filesystem }, undefined, { commandId, commandText: command }), gitConfig);
+        return { command: wrapped, commandId, gitConfig };
     }
     catch (error) {
         throw new Error(sandboxUnavailableMessage(`wrapping the command failed: ${errorText(error)}`));
     }
 }
+export async function sandboxCommand(command, workspaceRoot, allowedGroups = []) {
+    return (await sandboxCommandDetailed(command, workspaceRoot, allowedGroups)).command;
+}
+/** The violations srt recorded for one wrapped command (proxy denials always; file and socket denials where srt's log monitor runs). */
+export function sandboxViolationLines(commandId) {
+    if (!commandId)
+        return [];
+    try {
+        return SandboxManager.getSandboxViolationStore().getViolationsForCommand(commandId).map((violation) => violation.line);
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * A credential path the command names in its text without an approved grant. The sandbox would only show such a folder as empty
  * (Linux) or fail with a bare "Operation not permitted" (macOS), and a remote client would read that as "the file does not exist".
@@ -335,18 +407,92 @@ function deniedReadMessage({ path, group }) {
     return `The command was not run: no permission to read ${path}. Frely's command sandbox hides credential folders until the device owner approves access. `
         + `Call request_permission with resource "${group}", the reason and this exact command; it returns a link where the owner approves it with a passkey or authenticator code. Then run the same command again.`;
 }
+const DENIAL_TEXT = /operation not permitted|permission denied|read-only file system|sandbox/iu;
+const DOCKER_SOCKET = /docker\.sock|cannot connect to the docker daemon|docker daemon socket/iu;
+const RAW_TCP_CLIENT = /(?:^|[\s;&|(])(?:psql|pg_dump|pg_restore|mysql|mysqldump|mariadb|redis-cli|mongosh?|nc|ncat|netcat|telnet|sqlcmd|cqlsh|clickhouse-client)(?=\s|$)/u;
+const CONNECTION_FAILURE = /connection refused|econnrefused|network is unreachable|no route to host|could not connect|can't connect|connection timed out|operation not permitted/iu;
+const XPC_DENIAL = /mach-lookup|\bxpc\b|connection invalid|bootstrap_look_up/iu;
+const SEATBELT_NETWORK_DENIAL = /deny(?:\(\d+\))? network-outbound/u;
+/** `~/x` for paths below the home directory, the plain path otherwise. */
+const shortPath = (path) => path === homedir() ? "~" : path.startsWith(homedir() + sep) ? `~/${path.slice(homedir().length + 1)}` : path;
+/** Absolute paths named on the lines of `text` that look like a refused operation. */
+function deniedPaths(lines) {
+    const found = [];
+    for (const line of lines) {
+        if (!/operation not permitted|permission denied|read-only file system|deny(?:\(\d+\))? file-write/iu.test(line))
+            continue;
+        for (const match of line.matchAll(/(?<![\w.~-])(\/[^\s'"`:;,)<>|]+)/gu))
+            found.push(match[1]);
+    }
+    return [...new Set(found)];
+}
+/** The `path:` resource that would open the write `path` for a command, or undefined when no grant can. */
+function writeGrantFor(path, workspaceRoot) {
+    const target = normalize(path);
+    if (workspaceRoot && within(target, normalize(workspaceRoot)))
+        return undefined;
+    if (within(target, normalize(tmpdir())) || /^\/(?:dev|proc|sys)(?:\/|$)/u.test(target))
+        return undefined;
+    // A protected path (a shell start-up file, a credential folder) can only be opened by naming it exactly.
+    const protectedPath = PROTECTED_PATHS.map(expanded).find((item) => within(target, item));
+    const dir = protectedPath ?? dirname(target);
+    // Grant names always use forward slashes, whatever the platform separator is.
+    const grant = `path:${shortPath(dir)}`.replace(/\\/gu, "/");
+    return customWritePath(grant) === undefined ? undefined : grant;
+}
 /**
- * Hint for a failed sandboxed command whose stderr looks like a sandbox denial, so the caller asks the owner for approval
- * (request_permission) instead of giving up on a bare "Operation not permitted".
+ * Hint for a failed sandboxed command whose output looks like a sandbox denial, so the caller asks for the narrowest approval
+ * (request_permission) instead of giving up on a bare "Operation not permitted" or reaching for `unsandboxed`. It reads srt's
+ * recorded violations, then stderr and the command text. Nothing is guessed beyond that: a denial it cannot place gets the generic hint.
  */
-export function sandboxDenialHint(stderr, command, exitCode, sshConfigReadable) {
+export function sandboxDenialHint(stderr, command, exitCode, sshConfigReadable, context = {}) {
     const ssh = command !== undefined ? sshHint(stderr, command, exitCode, sshConfigReadable) : undefined;
     if (ssh)
         return ssh;
-    if (!/operation not permitted|permission denied|read-only file system|sandbox/iu.test(stderr))
+    const violations = context.violations ?? [];
+    const lines = [...stderr.split(/\r?\n/u), ...violations];
+    const text = lines.join("\n");
+    const rawTcp = command !== undefined && RAW_TCP_CLIENT.test(command) && CONNECTION_FAILURE.test(stderr) || violations.some((line) => SEATBELT_NETWORK_DENIAL.test(line));
+    if (!(DENIAL_TEXT.test(text) || DOCKER_SOCKET.test(text) || XPC_DENIAL.test(text) || rawTcp || violations.length > 0))
+        return undefined;
+    const UNSANDBOXED_ASK = `Call request_permission with resource "${UNSANDBOXED_GROUP}", the reason and this exact command; the owner approves it once by default, for just this command. Then run the same command again.`;
+    // The Docker socket is the whole story: nothing narrower opens it, and the config.json / socket directory that show up in the same
+    // output are not something a path: grant can or should open (~/.docker is never opened; /var/run is far too broad).
+    if (DOCKER_SOCKET.test(text)) {
+        return `The Docker socket cannot be opened from the Frely command sandbox, and nothing narrower than ${UNSANDBOXED_GROUP} reaches it (a container can mount the whole home directory). ${UNSANDBOXED_ASK}`;
+    }
+    const hints = [];
+    if (/\.git[\\/]hooks\b/u.test(text)) {
+        hints.push("Writing to .git/hooks stays blocked in the Frely command sandbox: hooks run programs outside it, so no approval opens it and request_permission will not help. Ask the user to add or change the hook themselves.");
+    }
+    if (/\.git[\\/]config\b/u.test(text) && DENIAL_TEXT.test(text)) {
+        hints.push("Writing .git/config is allowed in run_command for a .git directory inside the workspace, and never in start_process (run it with run_command instead).");
+    }
+    const groups = [...Object.entries(SENSITIVE_PATH_GROUPS), ["friday-admin", ADMIN_SESSION_PATHS]]
+        .filter(([, paths]) => paths.some((path) => commandNamesPath(text, path))).map(([group]) => group);
+    for (const group of groups) {
+        hints.push(`The Frely command sandbox hides these credential folders until the device owner approves them. Call request_permission with resource "${group}", the reason and this exact command; the owner approves it on the web. Then run the same command again.`);
+    }
+    if (groups.length === 0) {
+        const grants = [...new Set(deniedPaths(lines).flatMap((path) => writeGrantFor(path, context.workspaceRoot) ?? []))];
+        if (grants.length > 0 && !/\.git[\\/]hooks\b/u.test(text)) {
+            hints.push(`The command tried to write outside the workspace and temp directory, which the Frely command sandbox blocks. Call request_permission with ${grants.map((grant) => `resource "${grant}"`).join(" and ")}, the reason and this exact command; the owner approves it on the web. Then run the same command again.`);
+        }
+    }
+    if (rawTcp) {
+        hints.push("The Frely command sandbox only routes HTTP(S) and SOCKS traffic, so a direct TCP connection (database and redis clients, nc) is blocked. "
+            + "Stay in the sandbox: start `frely tunnel <host>:<port>` in the same command and point the client at 127.0.0.1:<port>, for example `frely tunnel db.example.com:5432 & sleep 1; psql -h 127.0.0.1 -p 5432 ...`. "
+            + `If a tunnel cannot work for this client, ${UNSANDBOXED_ASK.replace(/^Call/u, "call")}`);
+    }
+    else if (XPC_DENIAL.test(text)) {
+        hints.push(`The command needs a macOS system service (XPC) that the Frely command sandbox does not open, and only ${UNSANDBOXED_GROUP} reaches it. ${UNSANDBOXED_ASK}`);
+    }
+    if (hints.length > 0)
+        return hints.join(" ");
+    if (!DENIAL_TEXT.test(text))
         return undefined;
     return "This command may have been blocked by the Frely command sandbox (writes only to the workspace and temp directory; credential folders unreadable; only HTTP(S) and ssh reach the network). "
-        + "Call request_permission with the reason and the exact command (a credential group, cache directories, a specific path, or unsandboxed); the owner approves it on the web with a passkey or authenticator code. Then run the same command again.";
+        + `Name what was blocked and ask for the narrowest approval: call request_permission with the reason and the exact command (a credential group, cache directories or a specific path:<dir> first, ${UNSANDBOXED_GROUP} only when nothing narrower fits); the owner approves it on the web with a passkey or authenticator code. Then run the same command again.`;
 }
 const SSH_COMMAND = /(?:^|[\s;&|(])(?:ssh|scp|sftp|git)\s/u;
 const SSH_FAILURE = /proxy refused the tunnel|could not resolve hostname|kex_exchange_identification/iu;
@@ -373,6 +519,8 @@ export function sshConfigReadable() {
 /** Exposed for tests: resets the module-level init state and the underlying manager. */
 export async function resetSandboxForTests() {
     initialized = undefined;
+    baseConfig = undefined;
+    wrapQueue = Promise.resolve();
     warned = false;
     await SandboxManager.reset().catch(() => undefined);
 }