fss-link 1.0.49 → 1.0.51

package/dist/utils/installationInfo.test.ts

@@ -1,315 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { getInstallationInfo, PackageManager } from './installationInfo.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as childProcess from 'child_process';
-import { isGitRepository } from 'fss-link-core';
-
-vi.mock('fss-link-core', () => ({
-  isGitRepository: vi.fn(),
-}));
-
-vi.mock('fs', async (importOriginal) => {
-  const actualFs = await importOriginal<typeof fs>();
-  return {
-    ...actualFs,
-    realpathSync: vi.fn(),
-    existsSync: vi.fn(),
-  };
-});
-
-vi.mock('child_process', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('child_process')>();
-  return {
-    ...actual,
-    execSync: vi.fn(),
-  };
-});
-
-const mockedIsGitRepository = vi.mocked(isGitRepository);
-const mockedRealPathSync = vi.mocked(fs.realpathSync);
-const mockedExistsSync = vi.mocked(fs.existsSync);
-const mockedExecSync = vi.mocked(childProcess.execSync);
-
-describe('getInstallationInfo', () => {
-  const projectRoot = '/path/to/project';
-  let originalArgv: string[];
-
-  beforeEach(() => {
-    vi.resetAllMocks();
-    originalArgv = [...process.argv];
-    // Mock process.cwd() for isGitRepository
-    vi.spyOn(process, 'cwd').mockReturnValue(projectRoot);
-  });
-
-  afterEach(() => {
-    process.argv = originalArgv;
-  });
-
-  it('should return UNKNOWN when cliPath is not available', () => {
-    process.argv[1] = '';
-    const info = getInstallationInfo(projectRoot, false);
-    expect(info.packageManager).toBe(PackageManager.UNKNOWN);
-  });
-
-  it('should return UNKNOWN and log error if realpathSync fails', () => {
-    const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    process.argv[1] = '/path/to/cli';
-    const error = new Error('realpath failed');
-    mockedRealPathSync.mockImplementation(() => {
-      throw error;
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.UNKNOWN);
-    expect(consoleSpy).toHaveBeenCalledWith(error);
-    consoleSpy.mockRestore();
-  });
-
-  it('should detect running from a local git clone', () => {
-    process.argv[1] = `${projectRoot}/packages/cli/dist/index.js`;
-    mockedRealPathSync.mockReturnValue(
-      `${projectRoot}/packages/cli/dist/index.js`,
-    );
-    mockedIsGitRepository.mockReturnValue(true);
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.UNKNOWN);
-    expect(info.isGlobal).toBe(false);
-    expect(info.updateMessage).toBe(
-      'Running from a local git clone. Please update with "git pull".',
-    );
-  });
-
-  it('should detect running via npx', () => {
-    const npxPath = `/Users/test/.npm/_npx/12345/bin/gemini`;
-    process.argv[1] = npxPath;
-    mockedRealPathSync.mockReturnValue(npxPath);
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.NPX);
-    expect(info.isGlobal).toBe(false);
-    expect(info.updateMessage).toBe('Running via npx, update not applicable.');
-  });
-
-  it('should detect running via pnpx', () => {
-    const pnpxPath = `/Users/test/.pnpm/_pnpx/12345/bin/gemini`;
-    process.argv[1] = pnpxPath;
-    mockedRealPathSync.mockReturnValue(pnpxPath);
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.PNPX);
-    expect(info.isGlobal).toBe(false);
-    expect(info.updateMessage).toBe('Running via pnpx, update not applicable.');
-  });
-
-  it('should detect running via bunx', () => {
-    const bunxPath = `/Users/test/.bun/install/cache/12345/bin/gemini`;
-    process.argv[1] = bunxPath;
-    mockedRealPathSync.mockReturnValue(bunxPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.BUNX);
-    expect(info.isGlobal).toBe(false);
-    expect(info.updateMessage).toBe('Running via bunx, update not applicable.');
-  });
-
-  it('should detect Homebrew installation via execSync', () => {
-    Object.defineProperty(process, 'platform', {
-      value: 'darwin',
-    });
-    const cliPath = '/usr/local/bin/gemini';
-    process.argv[1] = cliPath;
-    mockedRealPathSync.mockReturnValue(cliPath);
-    mockedExecSync.mockReturnValue(Buffer.from('gemini-cli')); // Simulate successful command
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(mockedExecSync).toHaveBeenCalledWith(
-      'brew list -1 | grep -q "^fss-link$"',
-      { stdio: 'ignore' },
-    );
-    expect(info.packageManager).toBe(PackageManager.HOMEBREW);
-    expect(info.isGlobal).toBe(true);
-    expect(info.updateMessage).toContain('brew upgrade');
-  });
-
-  it('should fall through if brew command fails', () => {
-    Object.defineProperty(process, 'platform', {
-      value: 'darwin',
-    });
-    const cliPath = '/usr/local/bin/gemini';
-    process.argv[1] = cliPath;
-    mockedRealPathSync.mockReturnValue(cliPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(mockedExecSync).toHaveBeenCalledWith(
-      'brew list -1 | grep -q "^fss-link$"',
-      { stdio: 'ignore' },
-    );
-    // Should fall back to default global npm
-    expect(info.packageManager).toBe(PackageManager.NPM);
-    expect(info.isGlobal).toBe(true);
-  });
-
-  it('should detect global pnpm installation', () => {
-    const pnpmPath = `/Users/test/.pnpm/global/5/node_modules/.pnpm/some-hash/node_modules/fss-link-core/dist/index.js`;
-    process.argv[1] = pnpmPath;
-    mockedRealPathSync.mockReturnValue(pnpmPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-    expect(info.packageManager).toBe(PackageManager.PNPM);
-    expect(info.isGlobal).toBe(true);
-    expect(info.updateCommand).toBe('pnpm add -g fss-link-core@latest');
-    expect(info.updateMessage).toContain('Attempting to automatically update');
-
-    const infoDisabled = getInstallationInfo(projectRoot, true);
-    expect(infoDisabled.updateMessage).toContain('Please run pnpm add');
-  });
-
-  it('should detect global yarn installation', () => {
-    const yarnPath = `/Users/test/.yarn/global/node_modules/fss-link-core/dist/index.js`;
-    process.argv[1] = yarnPath;
-    mockedRealPathSync.mockReturnValue(yarnPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-    expect(info.packageManager).toBe(PackageManager.YARN);
-    expect(info.isGlobal).toBe(true);
-    expect(info.updateCommand).toBe(
-      'yarn global add fss-link-core@latest',
-    );
-    expect(info.updateMessage).toContain('Attempting to automatically update');
-
-    const infoDisabled = getInstallationInfo(projectRoot, true);
-    expect(infoDisabled.updateMessage).toContain('Please run yarn global add');
-  });
-
-  it('should detect global bun installation', () => {
-    const bunPath = `/Users/test/.bun/bin/gemini`;
-    process.argv[1] = bunPath;
-    mockedRealPathSync.mockReturnValue(bunPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-    expect(info.packageManager).toBe(PackageManager.BUN);
-    expect(info.isGlobal).toBe(true);
-    expect(info.updateCommand).toBe('bun add -g fss-link-core@latest');
-    expect(info.updateMessage).toContain('Attempting to automatically update');
-
-    const infoDisabled = getInstallationInfo(projectRoot, true);
-    expect(infoDisabled.updateMessage).toContain('Please run bun add');
-  });
-
-  it('should detect local installation and identify yarn from lockfile', () => {
-    const localPath = `${projectRoot}/node_modules/.bin/gemini`;
-    process.argv[1] = localPath;
-    mockedRealPathSync.mockReturnValue(localPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-    mockedExistsSync.mockImplementation(
-      (p) => p === path.join(projectRoot, 'yarn.lock'),
-    );
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.YARN);
-    expect(info.isGlobal).toBe(false);
-    expect(info.updateMessage).toContain('Locally installed');
-  });
-
-  it('should detect local installation and identify pnpm from lockfile', () => {
-    const localPath = `${projectRoot}/node_modules/.bin/gemini`;
-    process.argv[1] = localPath;
-    mockedRealPathSync.mockReturnValue(localPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-    mockedExistsSync.mockImplementation(
-      (p) => p === path.join(projectRoot, 'pnpm-lock.yaml'),
-    );
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.PNPM);
-    expect(info.isGlobal).toBe(false);
-  });
-
-  it('should detect local installation and identify bun from lockfile', () => {
-    const localPath = `${projectRoot}/node_modules/.bin/gemini`;
-    process.argv[1] = localPath;
-    mockedRealPathSync.mockReturnValue(localPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-    mockedExistsSync.mockImplementation(
-      (p) => p === path.join(projectRoot, 'bun.lockb'),
-    );
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.BUN);
-    expect(info.isGlobal).toBe(false);
-  });
-
-  it('should default to local npm installation if no lockfile is found', () => {
-    const localPath = `${projectRoot}/node_modules/.bin/gemini`;
-    process.argv[1] = localPath;
-    mockedRealPathSync.mockReturnValue(localPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-    mockedExistsSync.mockReturnValue(false); // No lockfiles
-
-    const info = getInstallationInfo(projectRoot, false);
-
-    expect(info.packageManager).toBe(PackageManager.NPM);
-    expect(info.isGlobal).toBe(false);
-  });
-
-  it('should default to global npm installation for unrecognized paths', () => {
-    const globalPath = `/usr/local/bin/gemini`;
-    process.argv[1] = globalPath;
-    mockedRealPathSync.mockReturnValue(globalPath);
-    mockedExecSync.mockImplementation(() => {
-      throw new Error('Command failed');
-    });
-
-    const info = getInstallationInfo(projectRoot, false);
-    expect(info.packageManager).toBe(PackageManager.NPM);
-    expect(info.isGlobal).toBe(true);
-    expect(info.updateCommand).toBe(
-      'npm install -g fss-link-core@latest',
-    );
-    expect(info.updateMessage).toContain('Attempting to automatically update');
-
-    const infoDisabled = getInstallationInfo(projectRoot, true);
-    expect(infoDisabled.updateMessage).toContain('Please run npm install');
-  });
-});

package/dist/utils/installationInfo.ts

@@ -1,176 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { isGitRepository } from 'fss-link-core';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as childProcess from 'child_process';
-
-export enum PackageManager {
-  NPM = 'npm',
-  YARN = 'yarn',
-  PNPM = 'pnpm',
-  PNPX = 'pnpx',
-  BUN = 'bun',
-  BUNX = 'bunx',
-  HOMEBREW = 'homebrew',
-  NPX = 'npx',
-  UNKNOWN = 'unknown',
-}
-
-export interface InstallationInfo {
-  packageManager: PackageManager;
-  isGlobal: boolean;
-  updateCommand?: string;
-  updateMessage?: string;
-}
-
-export function getInstallationInfo(
-  projectRoot: string,
-  isAutoUpdateDisabled: boolean,
-): InstallationInfo {
-  const cliPath = process.argv[1];
-  if (!cliPath) {
-    return { packageManager: PackageManager.UNKNOWN, isGlobal: false };
-  }
-
-  try {
-    // Normalize path separators to forward slashes for consistent matching.
-    const realPath = fs.realpathSync(cliPath).replace(/\\/g, '/');
-    const normalizedProjectRoot = projectRoot?.replace(/\\/g, '/');
-    const isGit = isGitRepository(process.cwd());
-
-    // Check for local git clone first
-    if (
-      isGit &&
-      normalizedProjectRoot &&
-      realPath.startsWith(normalizedProjectRoot) &&
-      !realPath.includes('/node_modules/')
-    ) {
-      return {
-        packageManager: PackageManager.UNKNOWN, // Not managed by a package manager in this sense
-        isGlobal: false,
-        updateMessage:
-          'Running from a local git clone. Please update with "git pull".',
-      };
-    }
-
-    // Check for npx/pnpx
-    if (realPath.includes('/.npm/_npx') || realPath.includes('/npm/_npx')) {
-      return {
-        packageManager: PackageManager.NPX,
-        isGlobal: false,
-        updateMessage: 'Running via npx, update not applicable.',
-      };
-    }
-    if (realPath.includes('/.pnpm/_pnpx')) {
-      return {
-        packageManager: PackageManager.PNPX,
-        isGlobal: false,
-        updateMessage: 'Running via pnpx, update not applicable.',
-      };
-    }
-
-    // Check for Homebrew
-    if (process.platform === 'darwin') {
-      try {
-        // We do not support homebrew for now, keep forward compatibility for future use
-        childProcess.execSync('brew list -1 | grep -q "^fss-link$"', {
-          stdio: 'ignore',
-        });
-        return {
-          packageManager: PackageManager.HOMEBREW,
-          isGlobal: true,
-          updateMessage:
-            'Installed via Homebrew. Please update with "brew upgrade".',
-        };
-      } catch (_error) {
-        // continue to the next check
-      }
-    }
-
-    // Check for pnpm
-    if (realPath.includes('/.pnpm/global')) {
-      const updateCommand = 'pnpm add -g fss-link@latest';
-      return {
-        packageManager: PackageManager.PNPM,
-        isGlobal: true,
-        updateCommand,
-        updateMessage: isAutoUpdateDisabled
-          ? `Please run ${updateCommand} to update`
-          : 'Installed with pnpm. Attempting to automatically update now...',
-      };
-    }
-
-    // Check for yarn
-    if (realPath.includes('/.yarn/global')) {
-      const updateCommand = 'yarn global add fss-link@latest';
-      return {
-        packageManager: PackageManager.YARN,
-        isGlobal: true,
-        updateCommand,
-        updateMessage: isAutoUpdateDisabled
-          ? `Please run ${updateCommand} to update`
-          : 'Installed with yarn. Attempting to automatically update now...',
-      };
-    }
-
-    // Check for bun
-    if (realPath.includes('/.bun/install/cache')) {
-      return {
-        packageManager: PackageManager.BUNX,
-        isGlobal: false,
-        updateMessage: 'Running via bunx, update not applicable.',
-      };
-    }
-    if (realPath.includes('/.bun/bin')) {
-      const updateCommand = 'bun add -g fss-link@latest';
-      return {
-        packageManager: PackageManager.BUN,
-        isGlobal: true,
-        updateCommand,
-        updateMessage: isAutoUpdateDisabled
-          ? `Please run ${updateCommand} to update`
-          : 'Installed with bun. Attempting to automatically update now...',
-      };
-    }
-
-    // Check for local install
-    if (
-      normalizedProjectRoot &&
-      realPath.startsWith(`${normalizedProjectRoot}/node_modules`)
-    ) {
-      let pm = PackageManager.NPM;
-      if (fs.existsSync(path.join(projectRoot, 'yarn.lock'))) {
-        pm = PackageManager.YARN;
-      } else if (fs.existsSync(path.join(projectRoot, 'pnpm-lock.yaml'))) {
-        pm = PackageManager.PNPM;
-      } else if (fs.existsSync(path.join(projectRoot, 'bun.lockb'))) {
-        pm = PackageManager.BUN;
-      }
-      return {
-        packageManager: pm,
-        isGlobal: false,
-        updateMessage:
-          "Locally installed. Please update via your project's package.json.",
-      };
-    }
-
-    // Assume global npm
-    const updateCommand = 'npm install -g fss-link@latest';
-    return {
-      packageManager: PackageManager.NPM,
-      isGlobal: true,
-      updateCommand,
-      updateMessage: isAutoUpdateDisabled
-        ? `Please run ${updateCommand} to update`
-        : 'Installed with npm. Attempting to automatically update now...',
-    };
-  } catch (error) {
-    console.log(error);
-    return { packageManager: PackageManager.UNKNOWN, isGlobal: false };
-  }
-}

package/dist/utils/package.ts

@@ -1,38 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import {
-  readPackageUp,
-  type PackageJson as BasePackageJson,
-} from 'read-package-up';
-import { fileURLToPath } from 'url';
-import path from 'path';
-
-export type PackageJson = BasePackageJson & {
-  config?: {
-    sandboxImageUri?: string;
-  };
-};
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-let packageJson: PackageJson | undefined;
-
-export async function getPackageJson(): Promise<PackageJson | undefined> {
-  if (packageJson) {
-    return packageJson;
-  }
-
-  const result = await readPackageUp({ cwd: __dirname });
-  if (!result) {
-    // TODO: Maybe bubble this up as an error.
-    return;
-  }
-
-  packageJson = result.packageJson;
-  return packageJson;
-}

package/dist/utils/readStdin.ts

@@ -1,51 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-export async function readStdin(): Promise<string> {
-  const MAX_STDIN_SIZE = 8 * 1024 * 1024; // 8MB
-  return new Promise((resolve, reject) => {
-    let data = '';
-    let totalSize = 0;
-    process.stdin.setEncoding('utf8');
-
-    const onReadable = () => {
-      let chunk;
-      while ((chunk = process.stdin.read()) !== null) {
-        if (totalSize + chunk.length > MAX_STDIN_SIZE) {
-          const remainingSize = MAX_STDIN_SIZE - totalSize;
-          data += chunk.slice(0, remainingSize);
-          console.warn(
-            `Warning: stdin input truncated to ${MAX_STDIN_SIZE} bytes.`,
-          );
-          process.stdin.destroy(); // Stop reading further
-          break;
-        }
-        data += chunk;
-        totalSize += chunk.length;
-      }
-    };
-
-    const onEnd = () => {
-      cleanup();
-      resolve(data);
-    };
-
-    const onError = (err: Error) => {
-      cleanup();
-      reject(err);
-    };
-
-    const cleanup = () => {
-      process.stdin.removeListener('readable', onReadable);
-      process.stdin.removeListener('end', onEnd);
-      process.stdin.removeListener('error', onError);
-    };
-
-    process.stdin.on('readable', onReadable);
-    process.stdin.on('end', onEnd);
-    process.stdin.on('error', onError);
-  });
-}

package/dist/utils/resolvePath.ts

@@ -1,21 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import * as os from 'os';
-import * as path from 'path';
-
-export function resolvePath(p: string): string {
-  if (!p) {
-    return '';
-  }
-  let expandedPath = p;
-  if (p.toLowerCase().startsWith('%userprofile%')) {
-    expandedPath = os.homedir() + p.substring('%userprofile%'.length);
-  } else if (p === '~' || p.startsWith('~/')) {
-    expandedPath = os.homedir() + p.substring(1);
-  }
-  return path.normalize(expandedPath);
-}

package/dist/utils/sandbox-macos-permissive-closed.sb

@@ -1,32 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.qwen"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    ;; Allow writes to included directories from --include-directories
-    (subpath (param "INCLUDE_DIR_0"))
-    (subpath (param "INCLUDE_DIR_1"))
-    (subpath (param "INCLUDE_DIR_2"))
-    (subpath (param "INCLUDE_DIR_3"))
-    (subpath (param "INCLUDE_DIR_4"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; deny all inbound network traffic EXCEPT on debugger port
-(deny network-inbound)
-(allow network-inbound (local ip "localhost:9229"))
-
-;; deny all outbound network traffic
-(deny network-outbound)

package/dist/utils/sandbox-macos-permissive-open.sb

@@ -1,25 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.qwen"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    ;; Allow writes to included directories from --include-directories
-    (subpath (param "INCLUDE_DIR_0"))
-    (subpath (param "INCLUDE_DIR_1"))
-    (subpath (param "INCLUDE_DIR_2"))
-    (subpath (param "INCLUDE_DIR_3"))
-    (subpath (param "INCLUDE_DIR_4"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)

package/dist/utils/sandbox-macos-permissive-proxied.sb

@@ -1,37 +0,0 @@
-(version 1)
-
-;; allow everything by default
-(allow default)
-
-;; deny all writes EXCEPT under specific paths
-(deny file-write*)
-(allow file-write*
-    (subpath (param "TARGET_DIR"))
-    (subpath (param "TMP_DIR"))
-    (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.qwen"))
-    (subpath (string-append (param "HOME_DIR") "/.npm"))
-    (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
-    ;; Allow writes to included directories from --include-directories
-    (subpath (param "INCLUDE_DIR_0"))
-    (subpath (param "INCLUDE_DIR_1"))
-    (subpath (param "INCLUDE_DIR_2"))
-    (subpath (param "INCLUDE_DIR_3"))
-    (subpath (param "INCLUDE_DIR_4"))
-    (literal "/dev/stdout")
-    (literal "/dev/stderr")
-    (literal "/dev/null")
-)
-
-;; deny all inbound network traffic EXCEPT on debugger port
-(deny network-inbound)
-(allow network-inbound (local ip "localhost:9229"))
-
-;; deny all outbound network traffic EXCEPT through proxy on localhost:8877
-;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
-;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
-(deny network-outbound)
-(allow network-outbound (remote tcp "localhost:8877"))
-
-(allow network-bind (local ip "*:*"))