looply-cli 0.0.0-stage → 0.2.0

package/dist/untrusted-exec.js

@@ -0,0 +1,479 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppContainerBackend = exports.HELPER_TIMEOUT_MS = exports.HELPER_SETUP_CEILING_MS = exports.HELPER_KILL_GRACE_MS = exports.PLATFORM_BASE = exports.MAX_CONTAINED_OUTPUT_BYTES = void 0;
+exports.containerName = containerName;
+exports.windowsCommandLine = windowsCommandLine;
+exports.systemEnv = systemEnv;
+exports.systemRoot = systemRoot;
+exports.helperCeilingMs = helperCeilingMs;
+exports.windowsPowerShellEnv = windowsPowerShellEnv;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/**
+ * How much of a contained child's output crosses back into the daemon.
+ *
+ * 🔴 IT WAS UNBOUNDED. `readFileSync(path, 'utf8')` pulled the whole file into
+ * the daemon's heap, so a contained process — project-controlled code, which is
+ * the entire premise of this file — could exhaust the daemon's memory simply by
+ * writing to stdout. The boundary held on authority and leaked on VOLUME.
+ *
+ * Two megabytes, and the derivation rather than the taste: the largest thing a
+ * legitimate gate step produces here is a verbose test run, which is tens of
+ * kilobytes; `tool-protocol.ts` already caps a single file READ at 256 KB; and
+ * this must stay comfortably below the point where a handful of concurrent runs
+ * matters. Generous by two orders of magnitude for real use, and finite.
+ */
+exports.MAX_CONTAINED_OUTPUT_BYTES = 2 * 1024 * 1024;
+/**
+ * A container identity for one project and one trust domain.
+ *
+ * Deterministic so a restart reuses the profile rather than leaking a new one,
+ * and hashed so no part of a path — which the user chose and which may contain
+ * anything — reaches a Windows profile name.
+ */
+function containerName(kind, projectKey) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(projectKey, 'utf8').digest('hex').slice(0, 24);
+    const domain = kind.charAt(0).toUpperCase() + kind.slice(1);
+    return `Looply.${domain}.${digest}`;
+}
+/**
+ * One Windows command line from an executable and its arguments.
+ *
+ * CreateProcess takes a single string, so the arguments have to be joined — and
+ * that join is the place a filename with a space or a quote in it turns into a
+ * second argument. The rules are the ones the C runtime parses back.
+ */
+function windowsCommandLine(exe, argv) {
+    const quote = (s) => {
+        if (s.length > 0 && !/[ \t"]/.test(s))
+            return s;
+        let out = '"';
+        let slashes = 0;
+        for (const ch of s) {
+            if (ch === '\\') {
+                slashes += 1;
+                continue;
+            }
+            if (ch === '"') {
+                out += '\\'.repeat(slashes * 2 + 1) + '"';
+                slashes = 0;
+                continue;
+            }
+            out += '\\'.repeat(slashes) + ch;
+            slashes = 0;
+        }
+        return `${out}${'\\'.repeat(slashes * 2)}"`;
+    };
+    return [exe, ...argv].map(quote).join(' ');
+}
+/**
+ * The caller's environment, plus the one variable Windows cannot start without.
+ *
+ * A custom environment block that omits `SystemRoot` makes CreateProcess fail
+ * with ERROR_ENVVAR_NOT_FOUND (203) — the loader resolves system libraries
+ * through it, so a child without it cannot start at all. That is not a policy
+ * choice a caller should be able to get wrong: it is not a secret, it names a
+ * directory every process on the machine can already see, and the failure it
+ * causes names an environment variable without saying which one.
+ */
+function systemEnv(env) {
+    const out = {};
+    for (const name of exports.PLATFORM_BASE) {
+        const v = process.env[name];
+        if (typeof v === 'string' && v.length > 0)
+            out[name] = v;
+    }
+    // The caller's own variables win, so a domain builder can narrow or replace
+    // any of these deliberately.
+    for (const [k, v] of Object.entries(env)) {
+        if (typeof v === 'string' && v.length > 0)
+            out[k] = v;
+    }
+    return out;
+}
+/**
+ * What Windows needs before a contained process can start at all.
+ *
+ * Found by bisection, not by taste. A block with only `SystemRoot` fails, and
+ * so does one with `SystemRoot`, `windir`, `SystemDrive`, `PATH`, `PATHEXT` and
+ * `ComSpec` — CreateProcess answers ERROR_ENVVAR_NOT_FOUND (203), which says a
+ * required variable is missing without saying which. Adding the profile and
+ * AppData roots is what makes it launch: an AppContainer REDIRECTS AppData, so
+ * the loader needs those roots to resolve the container's own storage.
+ *
+ * None of these is a secret. They name directories every process on the machine
+ * can already see, and none of them carries a credential — which is the whole
+ * distinction this file is built on. Anything that does carry one is supplied
+ * per-domain by the caller, or not at all.
+ */
+exports.PLATFORM_BASE = [
+    'SystemRoot',
+    'windir',
+    'SystemDrive',
+    'PATH',
+    'PATHEXT',
+    'ComSpec',
+    'NUMBER_OF_PROCESSORS',
+    'PROCESSOR_ARCHITECTURE',
+    'OS',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'ALLUSERSPROFILE',
+    'ProgramData',
+    'ProgramFiles',
+    'TEMP',
+    'TMP',
+];
+/** Where the source-controlled helper lives, relative to the built CLI. */
+/**
+ * The Windows system root, as an ABSOLUTE path or not at all.
+ *
+ * ⚠️ `?? 'C:\Windows'` WAS NOT ENOUGH, TWICE OVER.
+ *
+ * First: in a single-quoted TypeScript string `\W` is not an escape, so
+ * `'C:\Windows'` is the RELATIVE path `C:Windows` — `join` then yields
+ * `C:Windows\System32\…`, resolved against whatever the working directory
+ * happens to be. Measured, not assumed: `path.isAbsolute('C:\Windows')` is
+ * false. That is why the fallback here is spelled with `join`, not a literal.
+ *
+ * Second, and still open until this existed: `??` falls through on `undefined`
+ * and `null` ONLY. An EMPTY `SystemRoot` — `SystemRoot=` in the environment, or
+ * an allowlist that copied the name but not the value — passed straight
+ * through, and `join('', 'System32')` is `System32`: relative again, and this
+ * time resolved against the CHILD's working directory, which for a contained
+ * agent is the project worktree. A `System32\taskkill.exe` planted there would
+ * be found first. It is the `gitBinary` hole spelled with an environment
+ * variable instead of a bare command name.
+ *
+ * ⚠️ SO IT CHECKS THE VALUE, NOT ITS PRESENCE. A system root that is not
+ * absolute is not a system root, whatever the environment says. Five call
+ * sites used to spell this two different ways; they all ask here now.
+ *
+ * 🔴 ABSOLUTE BY WINDOWS' RULES, NOT THE HOST'S. `isAbsolute` from `node:path`
+ * answers for the platform the process is on, and on a POSIX host it reports
+ * `D:\Windows` — and the `C:\Windows` fallback itself — as RELATIVE. So every
+ * value failed the guard and the fallback was returned in a spelling that then
+ * failed its own test. The value this function deals in is a Windows path
+ * whatever host is asking about it, so it is judged and built with `win32`,
+ * which answers the same on both platforms. Still not a literal, for the
+ * escaping reason above.
+ */
+function systemRoot(env = process.env) {
+    const declared = env['SystemRoot'];
+    return declared !== undefined && declared !== '' && node_path_1.win32.isAbsolute(declared)
+        ? declared
+        : node_path_1.win32.join('C:', 'Windows');
+}
+/**
+ * The interpreter, by absolute path rather than by PATH lookup.
+ *
+ * PowerShell lives in a SUBDIRECTORY of System32, so a process whose PATH was
+ * deliberately narrowed — which is every process Looply builds an environment
+ * for — cannot resolve the bare name. The tool bridge is exactly that case: it
+ * is trusted code, but it is launched by the provider transport and inherits
+ * the transport's minimal PATH, and the failure it produced was an unreadable
+ * "containment unavailable" rather than anything about containment.
+ */
+function powershellPath() {
+    const win = systemRoot();
+    return (0, node_path_1.join)(win, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+function helperPath() {
+    // `dist/` sits beside `win/` in the published package and in the workspace.
+    return (0, node_path_1.join)(__dirname, '..', 'win', 'appcontainer.ps1');
+}
+/**
+ * How long the containment helper may take to answer, in total.
+ *
+ * Generous on purpose. The helper's slow parts are real work, not hangs: a cold
+ * PowerShell start, an `Add-Type` C# compilation, and an inheritable-ACL
+ * propagation that was measured at ~6 s when the 166 MB toolchain mirror is in
+ * the grant set. This is a floor under a wedge, not a performance budget, and a
+ * ceiling that fired during ordinary work would be worse than none.
+ */
+/** How long a killed helper gets to actually die before the answer is sent. */
+exports.HELPER_KILL_GRACE_MS = 5_000;
+exports.HELPER_SETUP_CEILING_MS = 60_000;
+/**
+ * The flat ceiling, for calls that run no contained child.
+ *
+ * `probe` and `remove` do profile work only, so a constant is right for them.
+ * `run` MUST NOT use it — see {@link AppContainerBackend.call}.
+ */
+exports.HELPER_TIMEOUT_MS = exports.HELPER_SETUP_CEILING_MS;
+/**
+ * The ceiling for one helper call, given the child budget that call carries.
+ *
+ * Exported as a pure function because the timer itself has no test seam:
+ * `AppContainerDeps.invoke` short-circuits before the timer is ever created, so
+ * every injected backend bypasses it. This is the part worth pinning — that the
+ * ceiling lands ABOVE `spec.timeoutMs` and never underneath it.
+ */
+function helperCeilingMs(childTimeoutMs = 0) {
+    return exports.HELPER_SETUP_CEILING_MS + childTimeoutMs;
+}
+class AppContainerBackend {
+    deps;
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
+    call(request, childTimeoutMs = 0) {
+        if (this.deps.invoke)
+            return this.deps.invoke(request);
+        const script = this.deps.helper ?? helperPath();
+        /**
+         * 🔴 THE CEILING SITS ABOVE `spec.timeoutMs`, NEVER UNDERNEATH IT.
+         *
+         * The helper's own `WaitForSingleObject(pi.hProcess, timeoutMs)` happens
+         * INSIDE this one call, so a flat constant here silently becomes the real
+         * gate-step budget. The first version of this was 120 s flat, and this
+         * repository's own gate declares `jest` at 900 s and takes 140 s — so
+         * every full test run would have been killed and reported as
+         * "a container could not be made", on a machine where nothing was wrong.
+         * `DEFAULT_TIMEOUT_S` is 600. A ceiling that fires during ordinary work is
+         * worse than no ceiling, and that one did.
+         *
+         * So the ceiling is the caller's own child budget PLUS a floor for the
+         * work that budget does not cover: PowerShell startup, the `Add-Type`
+         * compilation, the ACL grant loop (~6.5 s measured for the 166 MB
+         * toolchain mirror) and the protect loop.
+         */
+        const ceilingMs = helperCeilingMs(childTimeoutMs);
+        let settled = false;
+        return new Promise((resolve) => {
+            // argv, never a shell string: nothing the agent writes can become a
+            // command, because there is no shell to interpret one.
+            const child = (0, node_child_process_1.spawn)(powershellPath(), ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', script], { stdio: ['pipe', 'pipe', 'pipe'], env: windowsPowerShellEnv() });
+            const settle = (reply) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(giveUp);
+                resolve(reply);
+            };
+            const timedOut = {
+                ok: false,
+                stage: 'helper',
+                error: `the containment helper did not answer within ${ceilingMs} ms ` +
+                    `(it was killed; the machine may be unable to make a container)`,
+            };
+            /**
+             * ⚠️ KILL, THEN WAIT FOR `close` — never resolve straight from the timer.
+             *
+             * The contained child inherits the helper's stdout/stderr handles, so
+             * returning the instant PowerShell is signalled races the child's exit:
+             * `run()`'s `rmSync(box)` then THROWS (`ENOTEMPTY`/`EBUSY`; `force` does
+             * not suppress it, it only ignores a path that is not there), and that
+             * throw escapes every try in the round loop. Giving the tree a moment to
+             * actually die is the difference between a bounded containment failure
+             * and a run that ends with no `run.ended` and a stranded item.
+             */
+            const giveUp = setTimeout(() => {
+                if (settled)
+                    return;
+                try {
+                    child.kill();
+                }
+                catch {
+                    // Already gone, or unkillable. The grace timer still answers.
+                }
+                const grace = setTimeout(() => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    resolve(timedOut);
+                }, exports.HELPER_KILL_GRACE_MS);
+                child.once('close', () => {
+                    clearTimeout(grace);
+                    if (settled)
+                        return;
+                    settled = true;
+                    resolve(timedOut);
+                });
+            }, ceilingMs);
+            const out = [];
+            const err = [];
+            child.stdout.on('data', (d) => out.push(d.toString('utf8')));
+            child.stderr.on('data', (d) => err.push(d.toString('utf8')));
+            child.on('error', (e) => settle({ ok: false, stage: 'helper', error: `the containment helper could not start (${e.message})` }));
+            child.on('close', () => {
+                const text = out.join('').trim();
+                try {
+                    settle(JSON.parse(text));
+                }
+                catch {
+                    settle({
+                        ok: false,
+                        stage: 'helper',
+                        error: `the containment helper answered nothing readable (${err.join('').trim().slice(0, 300)})`,
+                    });
+                }
+            });
+            child.stdin.end(JSON.stringify(request));
+        });
+    }
+    async probe() {
+        if (process.platform !== 'win32') {
+            return { available: false, backend: 'appcontainer', because: 'AppContainer is a Windows boundary' };
+        }
+        const reply = await this.call({ action: 'probe', profile: containerName('fixture', 'probe') });
+        return reply.ok
+            ? { available: true, backend: 'appcontainer' }
+            : { available: false, backend: 'appcontainer', because: reply.error ?? 'unavailable' };
+    }
+    async run(spec) {
+        if (process.platform !== 'win32') {
+            return {
+                ok: false,
+                reason: 'containment_unavailable',
+                stage: 'platform',
+                because: 'no untrusted-execution boundary is implemented for this platform',
+            };
+        }
+        // Output travels on handles WE open and the child inherits, so the files
+        // never have to be granted to the container — the transport cannot widen
+        // the filesystem policy.
+        const box = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'looply-ue-'));
+        try {
+            const stdoutPath = (0, node_path_1.join)(box, 'out');
+            const stderrPath = (0, node_path_1.join)(box, 'err');
+            let stdinPath = '';
+            if (spec.stdin !== undefined) {
+                stdinPath = (0, node_path_1.join)(box, 'in');
+                (0, node_fs_1.writeFileSync)(stdinPath, spec.stdin, 'utf8');
+            }
+            const reply = await this.call({
+                action: 'run',
+                profile: containerName(spec.kind, spec.projectKey),
+                env: systemEnv(spec.env),
+                executable: spec.executable,
+                commandLine: spec.rawCommandLine ?? windowsCommandLine(spec.executable, spec.argv),
+                cwd: spec.cwd,
+                grants: spec.grants.map((g) => ({ path: g.path, write: g.write === true })),
+                protect: spec.protect ?? [],
+                network: spec.network,
+                stdoutPath,
+                stderrPath,
+                stdinPath,
+                timeoutMs: spec.timeoutMs,
+            }, 
+            // The child's own budget, so the ceiling above lands ABOVE it.
+            spec.timeoutMs);
+            if (!reply.ok) {
+                const stage = reply.stage ?? 'unknown';
+                return {
+                    ok: false,
+                    reason: stage === 'profile' || stage === 'helper' || stage === 'compile' || stage === 'protect'
+                        ? 'containment_unavailable'
+                        : 'containment_launch_failed',
+                    stage,
+                    because: reply.error ?? 'the contained process could not start',
+                };
+            }
+            const read = (p) => {
+                try {
+                    const size = (0, node_fs_1.statSync)(p).size;
+                    if (size <= exports.MAX_CONTAINED_OUTPUT_BYTES) {
+                        const whole = Buffer.alloc(size);
+                        const fd = (0, node_fs_1.openSync)(p, 'r');
+                        try {
+                            (0, node_fs_1.readSync)(fd, whole, 0, size, 0);
+                        }
+                        finally {
+                            (0, node_fs_1.closeSync)(fd);
+                        }
+                        return whole.toString('utf8');
+                    }
+                    /**
+                     * Over the bound: keep the head and the tail, and SAY what was
+                     * dropped. A silent truncation reads as output that simply ended,
+                     * which is exactly how a reader concludes the wrong thing about a
+                     * command that produced far more than it should have.
+                     */
+                    const half = Math.floor(exports.MAX_CONTAINED_OUTPUT_BYTES / 2);
+                    const head = Buffer.alloc(half);
+                    const tail = Buffer.alloc(half);
+                    const fd = (0, node_fs_1.openSync)(p, 'r');
+                    try {
+                        (0, node_fs_1.readSync)(fd, head, 0, half, 0);
+                        (0, node_fs_1.readSync)(fd, tail, 0, half, size - half);
+                    }
+                    finally {
+                        (0, node_fs_1.closeSync)(fd);
+                    }
+                    const dropped = size - half * 2;
+                    return `${head.toString('utf8')}\n… ${dropped} bytes of output dropped: this command produced ${size} bytes, over the ${exports.MAX_CONTAINED_OUTPUT_BYTES}-byte bound …\n${tail.toString('utf8')}`;
+                }
+                catch {
+                    return '';
+                }
+            };
+            return {
+                ok: true,
+                exitCode: reply.exitCode ?? 1,
+                stdout: read(stdoutPath),
+                stderr: read(stderrPath),
+                timedOut: reply.timedOut === true,
+            };
+        }
+        finally {
+            /**
+             * NON-FATAL, AND RETRIED. A contained child that outlived its helper
+             * still holds the inherited handles on `out`/`err`, and Windows then
+             * refuses the directory — `force` does not help, it only ignores a path
+             * that does not exist. A leaked temp directory is a mess; a throw here
+             * escapes every try in the round loop and ends the run with no
+             * `run.ended` and a stranded item.
+             */
+            try {
+                (0, node_fs_1.rmSync)(box, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+            }
+            catch {
+                // Left behind on purpose rather than taking the caller down with it.
+            }
+        }
+    }
+    /** Remove a container profile. Used by tests; production profiles persist. */
+    async remove(kind, projectKey) {
+        const reply = await this.call({ action: 'remove', profile: containerName(kind, projectKey) });
+        return reply.ok;
+    }
+}
+exports.AppContainerBackend = AppContainerBackend;
+/**
+ * The environment Windows PowerShell 5.1 needs, rather than the one it inherited.
+ *
+ * 🔴 POWERSHELL 7 POISONS `PSModulePath` FOR POWERSHELL 5.1. When the daemon is
+ * started from a `pwsh` session, `PSModulePath` carries
+ * `…\PowerShell\7\Modules`, and 5.1 then loads SEVEN's
+ * `Microsoft.PowerShell.Security` on top of its own. The extended type data
+ * collides — "The member AuditToString is already present" — the module fails to
+ * load, `Get-Acl` cannot resolve, and every containment request is refused.
+ *
+ * ⚠️ IT FAILS CLOSED, WHICH IS WHY IT WENT UNNOTICED. Containment refuses rather
+ * than running uncontained, so nothing unsafe happens; the run simply cannot
+ * start, with a message about a PowerShell module that says nothing about
+ * PowerShell versions. Reproduced by launching the same suite from `pwsh`
+ * (5 of 5 red) and from bash (5 of 5 green) on one machine, one commit.
+ *
+ * The variable is REPLACED with 5.1's own default rather than deleted: deleting
+ * it makes 5.1 fall back to a built-in default that omits the machine-wide
+ * module directory, which is a different breakage for anyone relying on it.
+ */
+function windowsPowerShellEnv() {
+    const win = systemRoot();
+    const home = process.env['USERPROFILE'];
+    const psModulePath = [
+        home ? (0, node_path_1.join)(home, 'Documents', 'WindowsPowerShell', 'Modules') : null,
+        (0, node_path_1.join)('C:', 'Program Files', 'WindowsPowerShell', 'Modules'),
+        (0, node_path_1.join)(win, 'System32', 'WindowsPowerShell', 'v1.0', 'Modules'),
+    ]
+        .filter((p) => p !== null)
+        .join(';');
+    return { ...process.env, PSModulePath: psModulePath };
+}
+//# sourceMappingURL=untrusted-exec.js.map

package/dist/untrusted-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-exec.js","sourceRoot":"","sources":["../src/untrusted-exec.ts"],"names":[],"mappings":";;;AA8IA,sCAIC;AASD,gDAqBC;AAYD,8BAYC;AAgFD,gCAKC;AA0DD,0CAEC;AAsPD,oDAWC;AA1lBD,2DAA2C;AAC3C,6CAAyC;AACzC,qCAAsG;AACtG,qCAAiC;AACjC,yCAAwC;AA8BxC;;;;;;;;;;;;;GAaG;AACU,QAAA,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAuF1D;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAmB,EAAE,UAAkB;IACnE,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,IAAuB;IACrE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAChD,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;gBAC1C,OAAO,GAAG,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC;IAC9C,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAC,GAA2B;IACnD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,qBAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,4EAA4E;IAC5E,6BAA6B;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACU,QAAA,aAAa,GAAsB;IAC9C,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,MAAM;IACN,SAAS;IACT,SAAS;IACT,sBAAsB;IACtB,wBAAwB;IACxB,IAAI;IACJ,aAAa;IACb,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,cAAc;IACd,MAAM;IACN,KAAK;CACN,CAAC;AAWF,2EAA2E;AAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAgB,UAAU,CAAC,MAA0C,OAAO,CAAC,GAAG;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,iBAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU;IACjB,4EAA4E;IAC5E,OAAO,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;;;;;GAQG;AACH,+EAA+E;AAClE,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAE7B,QAAA,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,+BAAuB,CAAC;AAEzD;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,cAAc,GAAG,CAAC;IAChD,OAAO,+BAAuB,GAAG,cAAc,CAAC;AAClD,CAAC;AAED,MAAa,mBAAmB;IACD;IAA7B,YAA6B,OAAyB,EAAE;QAA3B,SAAI,GAAJ,IAAI,CAAuB;IAAG,CAAC;IAEpD,IAAI,CAAC,OAAgC,EAAE,cAAc,GAAG,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAChD;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YAC1C,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,KAAK,GAAG,IAAA,0BAAK,EACjB,cAAc,EAAE,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAChF,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,CACjE,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAQ,EAAE;gBAC1C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,QAAQ,GAAgB;gBAC5B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,QAAQ;gBACf,KAAK,EACH,gDAAgD,SAAS,MAAM;oBAC/D,gEAAgE;aACnE,CAAC;YACF;;;;;;;;;;eAUG;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC,EAAE,4BAAoB,CAAC,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,2CAA2C,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CACvG,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,QAAQ;wBACf,KAAK,EAAE,qDAAqD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG;qBACjG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC,EAAE;YACb,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE;YAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAA4B;QACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,kEAAkE;aAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,SAAS,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5B,IAAA,uBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC;gBAClD,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;gBAClF,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU;gBACV,UAAU;gBACV,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,+DAA+D;YAC/D,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;gBACvC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;wBAC7F,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,2BAA2B;oBAC/B,KAAK;oBACL,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,uCAAuC;iBAChE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;gBACjC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC9B,IAAI,IAAI,IAAI,kCAA0B,EAAE,CAAC;wBACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjC,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;wBAC5B,IAAI,CAAC;4BACH,IAAA,kBAAQ,EAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBAClC,CAAC;gCAAS,CAAC;4BACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;wBAChB,CAAC;wBACD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAChC,CAAC;oBACD;;;;;uBAKG;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kCAA0B,GAAG,CAAC,CAAC,CAAC;oBACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChC,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAC5B,IAAI,CAAC;wBACH,IAAA,kBAAQ,EAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBAC/B,IAAA,kBAAQ,EAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;oBAC3C,CAAC;4BAAS,CAAC;wBACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;oBAChB,CAAC;oBACD,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;oBAChC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,OAAO,mDAAmD,IAAI,oBAAoB,kCAA0B,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9L,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;gBACxB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;aAClC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT;;;;;;;eAOG;YACH,IAAI,CAAC;gBACH,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,IAAmB,EAAE,UAAkB;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;CACF;AA9ND,kDA8NC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,oBAAoB;IAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG;QACnB,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,IAAA,gBAAI,EAAC,IAAI,EAAE,eAAe,EAAE,mBAAmB,EAAE,SAAS,CAAC;QAC3D,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC;KAC9D;SACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC"}

package/dist/untrusted-gate.d.ts

@@ -0,0 +1,73 @@
+import { type ToolchainResult } from './toolchain-mirror';
+import type { CommandResult, CommandRunner } from './gate';
+import { type UntrustedExecutionBackend } from './untrusted-exec';
+/**
+ * THE GATE RUNS THE PROJECT'S CODE, SO IT RUNS INSIDE THE BOUNDARY.
+ *
+ * A gate step is `npm test`, and npm is not the point — the tests underneath it
+ * are, and the coding agent wrote them. Until now they ran as the daemon, with
+ * its environment, able to read `~/.looply/machine.json` and to edit the state
+ * directory that decides whether the machine may keep working.
+ *
+ * The step keeps its shape. It is still a shell line from `config.yaml`, still
+ * measured by the same timeout, still reported by the same `CommandResult` —
+ * because the shell is no longer the thing being defended against. It runs
+ * inside an AppContainer that was granted the worktree and nothing else, so
+ * what the line says matters much less than where it can reach.
+ *
+ * NO FALLBACK. If the container cannot be made, the step FAILS. A gate that
+ * quietly ran as the daemon because containment was unavailable would be worse
+ * than one that did not run at all: the round would go green having proved
+ * something about a different machine than the one it claimed.
+ */
+export interface UntrustedGateDeps {
+    backend?: UntrustedExecutionBackend;
+    /** Overridable so tests never build against the real toolchain. */
+    toolchain?: () => ToolchainResult;
+    /** Overridable for tests; production reads the platform's own shell. */
+    shell?: string;
+    now?: () => number;
+}
+/**
+ * A {@link CommandRunner} that runs each step contained.
+ *
+ * `projectDir` is both the worktree granted to the container and the cwd the
+ * step runs in, so a step can never be executed against a directory other than
+ * the one it was written for.
+ */
+export declare function makeUntrustedGateRunner(projectDir: string, deps?: UntrustedGateDeps): CommandRunner;
+/**
+ * The step a containment preflight runs.
+ *
+ * A `rem` is cmd.exe's comment: it starts, does nothing and exits 0. What is
+ * being measured is not the command — it is whether a container could be made
+ * to run one in at all.
+ */
+export declare const CONTAINMENT_PREFLIGHT_STEP = "rem looply-containment-preflight";
+/**
+ * ASK WHETHER A CONTAINER CAN ACTUALLY BE MADE, BEFORE PAYING FOR A MODEL TURN.
+ *
+ * `AppContainerBackend.probe()` answers a strictly earlier question. It returns
+ * as soon as a profile can be created or derived, and never reaches the grant,
+ * protect or launch stages — measured on one machine in one script: `probe`
+ * returned ok while a real `run` failed at `grant`, and again at `launch`.
+ * So a green probe does not mean a gate step can run.
+ *
+ * This runs the real thing through the real runner: same backend, same `gate`
+ * profile, same `unavailable` flag, same classification. There is no new
+ * vocabulary and no second code path to keep honest.
+ *
+ * ⚠️ THE GRANT SET IS DELIBERATELY SMALL, and this is not a shortcut. Granting
+ * the toolchain mirror propagates an inheritable ACE across 166 MB — measured at
+ * ~6.5 s against ~0.57 s for the project directory alone — and it proves nothing
+ * the small grant does not. Anyone "making the preflight faithful" by reusing
+ * `untrustedGrants` buys a 10x cost for no signal.
+ *
+ * ⚠️ IT COVERS THE `gate` PROFILE ONLY. The tool bridge uses `kind:'agent'`, a
+ * different profile from a different `CreateAppContainerProfile` call. A machine
+ * that can make neither is caught; one that can make the gate's and not the
+ * agent's is not. Closing that needs a second preflight through the bridge's own
+ * backend seam, and it is not this change.
+ */
+export declare function makeContainmentPreflight(projectDir: string, deps?: UntrustedGateDeps): () => Promise<CommandResult>;
+//# sourceMappingURL=untrusted-gate.d.ts.map

package/dist/untrusted-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-gate.d.ts","sourceRoot":"","sources":["../src/untrusted-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAQ3D,OAAO,EAGL,KAAK,yBAAyB,EAE/B,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,eAAe,CAAC;IAClC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,aAAa,CA8Ff;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,qCAAqC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,MAAM,OAAO,CAAC,aAAa,CAAC,CA0F9B"}