nawabari 0.2.0 → 0.4.1

package/dist/domain/sandbox-launcher.js

@@ -0,0 +1,679 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { DomainError, failure, success } from "./errors.js";
+const SANDBOX_HOME = "/home/nawabari";
+const SANDBOX_CONFIG_HOME = `${SANDBOX_HOME}/.config`;
+const SANDBOX_LOCAL_HOME = `${SANDBOX_HOME}/.local`;
+const SANDBOX_CACHE_HOME = `${SANDBOX_HOME}/.cache`;
+const SANDBOX_SHARED_HOME = `${SANDBOX_HOME}/.nawabari`;
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 1_024 * 1_024;
+function topologyError(message, details) {
+    return failure(new DomainError("SANDBOX_TOPOLOGY_INVALID", message, details));
+}
+function isWithin(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function canonicalPath(candidate, label) {
+    if (!path.isAbsolute(candidate) || candidate.includes("\0")) {
+        return topologyError(`${label} must be an absolute path without NUL bytes.`, { label, path: candidate });
+    }
+    try {
+        const normalized = path.normalize(candidate);
+        const resolved = fs.realpathSync.native(candidate);
+        if (resolved !== normalized) {
+            return topologyError(`${label} must not resolve through an unproven symlink.`, {
+                label,
+                path: candidate,
+                resolved,
+            });
+        }
+        return success(resolved);
+    }
+    catch (error) {
+        return topologyError(`${label} does not exist or cannot be canonicalized.`, {
+            label,
+            path: candidate,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        });
+    }
+}
+function preparePrivateDirectory(candidate, repository, label) {
+    if (!isWithin(repository, candidate) || candidate === repository) {
+        return topologyError(`${label} must be a private directory below the authoritative repository.`, {
+            label,
+            path: candidate,
+            repository,
+        });
+    }
+    let existingAncestor = candidate;
+    while (!fs.existsSync(existingAncestor)) {
+        const parent = path.dirname(existingAncestor);
+        if (parent === existingAncestor) {
+            return topologyError(`${label} has no canonicalizable parent.`, { label, path: candidate });
+        }
+        existingAncestor = parent;
+    }
+    try {
+        const resolvedAncestor = fs.realpathSync.native(existingAncestor);
+        if (!isWithin(repository, resolvedAncestor)) {
+            return topologyError(`${label} would traverse outside the authoritative repository.`, {
+                label,
+                path: candidate,
+                existing_ancestor: existingAncestor,
+                resolved_ancestor: resolvedAncestor,
+                repository,
+            });
+        }
+    }
+    catch (error) {
+        return topologyError(`${label} has an unresolvable parent.`, {
+            label,
+            path: candidate,
+            existing_ancestor: existingAncestor,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        });
+    }
+    try {
+        fs.mkdirSync(candidate, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        return topologyError(`${label} could not be prepared.`, {
+            label,
+            path: candidate,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        });
+    }
+    return canonicalPath(candidate, label);
+}
+function validateTopology(request) {
+    const repository = canonicalPath(request.repository, "repository");
+    if (!repository.ok)
+        return repository;
+    const worktree = canonicalPath(request.worktree, "worktree");
+    if (!worktree.ok)
+        return worktree;
+    if (request.filesystem.owned_worktree !== request.worktree) {
+        return topologyError("The filesystem topology worktree must equal the authoritative session worktree.", {
+            request_worktree: request.worktree,
+            topology_worktree: request.filesystem.owned_worktree,
+        });
+    }
+    const home = preparePrivateDirectory(request.filesystem.home, repository.value, "session home");
+    if (!home.ok)
+        return home;
+    const cache = preparePrivateDirectory(request.filesystem.cache, repository.value, "session cache");
+    if (!cache.ok)
+        return cache;
+    const persistentHome = preparePrivateDirectory(request.filesystem.persistent_home, repository.value, "persistent repository home");
+    if (!persistentHome.ok)
+        return persistentHome;
+    const gitMetadata = preparePrivateDirectory(request.filesystem.git_metadata, repository.value, "Git metadata");
+    if (!gitMetadata.ok)
+        return gitMetadata;
+    const gitObjects = canonicalPath(request.filesystem.git_objects, "Git object database");
+    if (!gitObjects.ok)
+        return gitObjects;
+    if (!isWithin(repository.value, gitObjects.value)) {
+        return topologyError("The Git object database escaped the authoritative repository.", {
+            repository: repository.value,
+            git_objects: gitObjects.value,
+        });
+    }
+    if (!isWithin(repository.value, home.value) || !isWithin(repository.value, cache.value)) {
+        return topologyError("Session-private state escaped the authoritative repository.", {
+            repository: repository.value,
+            home: home.value,
+            cache: cache.value,
+        });
+    }
+    return success({
+        repository: repository.value,
+        worktree: worktree.value,
+        home: home.value,
+        cache: cache.value,
+        persistent_home: persistentHome.value,
+        git_metadata: gitMetadata.value,
+        git_objects: gitObjects.value,
+    });
+}
+function pathMatches(candidate, root) {
+    return candidate === root || candidate.startsWith(`${root}${path.sep}`);
+}
+function allowedSystemPath(candidate) {
+    const normalized = path.normalize(candidate);
+    const roots = [
+        "/usr",
+        "/bin",
+        "/lib",
+        "/lib64",
+        "/nix/store",
+        "/run/current-system",
+        "/run/wrappers",
+        "/run/systemd/resolve",
+        "/run/NetworkManager",
+        "/mnt/wsl",
+        "/etc/profiles",
+        "/etc/alternatives",
+        "/etc/ssl",
+        "/etc/pki",
+        "/etc/ca-certificates",
+    ];
+    if (roots.some((root) => pathMatches(normalized, root)))
+        return true;
+    return new Set(["/etc/passwd", "/etc/group", "/etc/nsswitch.conf", "/etc/hosts", "/etc/resolv.conf"]).has(normalized);
+}
+function allowedRuntimePath(candidate) {
+    const normalized = path.normalize(candidate);
+    return (normalized === "/dev" ||
+        normalized === "/proc" ||
+        normalized === "/tmp" ||
+        pathMatches(normalized, "/nix/store") ||
+        pathMatches(normalized, "/run/current-system") ||
+        pathMatches(normalized, "/run/wrappers") ||
+        pathMatches(normalized, "/etc/profiles"));
+}
+function allowedUserToolPath(candidate, hostHome = process.env.HOME) {
+    const home = hostHome;
+    if (home === undefined || home === null)
+        return null;
+    if (!path.isAbsolute(home) || home.includes("\0"))
+        return null;
+    const normalized = path.normalize(candidate);
+    if (normalized === path.join(home, ".local", "bin"))
+        return "local_bin";
+    if (normalized === path.join(home, ".local", "lib"))
+        return "local_lib";
+    if (normalized === path.join(home, ".local", "share", "pnpm"))
+        return "pnpm_bin";
+    return null;
+}
+function ensureSourcePath(candidate, label) {
+    try {
+        const stat = fs.statSync(candidate);
+        if (!stat.isDirectory() && !stat.isFile()) {
+            return topologyError(`${label} is not a regular file or directory.`, { label, path: candidate });
+        }
+        return success(candidate);
+    }
+    catch (error) {
+        return topologyError(`${label} does not exist.`, {
+            label,
+            path: candidate,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        });
+    }
+}
+function destinationParents(destination) {
+    const parent = path.posix.dirname(destination);
+    if (parent === "/" || parent === ".")
+        return [];
+    const parts = parent.split("/").filter(Boolean);
+    const result = [];
+    let current = "";
+    for (const part of parts) {
+        current += `/${part}`;
+        result.push(current);
+    }
+    return result;
+}
+function addDirectory(args, destination, seen) {
+    for (const parent of destinationParents(destination)) {
+        if (seen.has(parent))
+            continue;
+        seen.add(parent);
+        args.push("--dir", parent);
+    }
+}
+function addReadOnlyBind(args, source, destination, seenDirectories) {
+    addDirectory(args, destination, seenDirectories);
+    args.push("--ro-bind", source, destination);
+}
+function addReadWriteBind(args, source, destination, seenDirectories) {
+    addDirectory(args, destination, seenDirectories);
+    args.push("--bind", source, destination);
+}
+function pathEntriesForEnvironment(request) {
+    const entries = [];
+    const sources = new Set(request.filesystem.runtime_paths);
+    const system = new Set(request.filesystem.system_paths);
+    const tools = new Set(request.filesystem.user_tool_paths);
+    const hostHome = request.filesystem.user_tool_home ?? process.env.HOME;
+    if (tools.has(path.join(hostHome ?? "", ".local", "bin")))
+        entries.push(`${SANDBOX_LOCAL_HOME}/bin`);
+    if (tools.has(path.join(hostHome ?? "", ".local", "share", "pnpm"))) {
+        entries.push(`${SANDBOX_LOCAL_HOME}/share/pnpm`);
+    }
+    if (sources.has("/run/current-system"))
+        entries.push("/run/current-system/sw/bin");
+    if (sources.has("/run/wrappers"))
+        entries.push("/run/wrappers/bin");
+    const profile = [...sources].find((source) => source.startsWith("/etc/profiles/per-user/"));
+    if (profile !== undefined)
+        entries.push(`${profile}/bin`);
+    if (system.has("/usr"))
+        entries.push("/usr/local/bin", "/usr/bin");
+    if (system.has("/bin"))
+        entries.push("/bin");
+    return [...new Set(entries)];
+}
+function validateExecutable(request) {
+    if (!request.enforce) {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "A sandbox launcher cannot execute an advisory request without protected enforcement.", { enforce: false, session_id: request.session_id }));
+    }
+    if (request.sandbox_executable === null || !path.isAbsolute(request.sandbox_executable)) {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "Bubblewrap was not resolved for the protected execution request.", { session_id: request.session_id }));
+    }
+    const checked = ensureSourcePath(request.sandbox_executable, "bubblewrap executable");
+    if (!checked.ok)
+        return checked;
+    try {
+        const stat = fs.statSync(request.sandbox_executable);
+        const resolved = fs.realpathSync.native(request.sandbox_executable);
+        if (!stat.isFile() || (stat.mode & 0o111) === 0) {
+            return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The resolved bubblewrap path is not executable.", {
+                path: request.sandbox_executable,
+            }));
+        }
+        if (!allowedSystemPath(resolved) &&
+            allowedUserToolPath(resolved, request.filesystem.user_tool_home) === null &&
+            !allowedRuntimePath(resolved)) {
+            return topologyError("Bubblewrap resolved outside the fixed runtime profile.", {
+                path: request.sandbox_executable,
+                resolved,
+            });
+        }
+    }
+    catch {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The resolved bubblewrap path cannot be canonicalized.", {
+            path: request.sandbox_executable,
+        }));
+    }
+    return checked;
+}
+function validateProfilePaths(request) {
+    for (const source of request.filesystem.runtime_paths) {
+        if (!allowedRuntimePath(source)) {
+            return topologyError("The runtime path is outside the canonical profile.", { path: source });
+        }
+        if (source === "/dev" || source === "/proc" || source === "/tmp")
+            continue;
+        const checked = ensureSourcePath(source, "runtime path");
+        if (!checked.ok)
+            return checked;
+        try {
+            const resolved = fs.realpathSync.native(source);
+            if (!allowedRuntimePath(resolved)) {
+                return topologyError("The runtime path symlink resolves outside the canonical profile.", {
+                    path: source,
+                    resolved,
+                });
+            }
+        }
+        catch {
+            return topologyError("The runtime path cannot be canonicalized.", { path: source });
+        }
+    }
+    for (const source of request.filesystem.system_paths) {
+        if (!allowedSystemPath(source)) {
+            return topologyError("The system path is outside the canonical profile.", { path: source });
+        }
+        const checked = ensureSourcePath(source, "system path");
+        if (!checked.ok)
+            return checked;
+        try {
+            const resolved = fs.realpathSync.native(source);
+            if (!allowedSystemPath(resolved)) {
+                return topologyError("The system path symlink resolves outside the canonical profile.", {
+                    path: source,
+                    resolved,
+                });
+            }
+        }
+        catch {
+            return topologyError("The system path cannot be canonicalized.", { path: source });
+        }
+    }
+    for (const source of request.filesystem.user_tool_paths) {
+        if (allowedUserToolPath(source, request.filesystem.user_tool_home) === null) {
+            return topologyError("The user-tool path is outside the selected local-tool profile.", { path: source });
+        }
+        const checked = ensureSourcePath(source, "user-tool path");
+        if (!checked.ok)
+            return checked;
+        try {
+            const resolved = fs.realpathSync.native(source);
+            if (allowedUserToolPath(resolved, request.filesystem.user_tool_home) === null) {
+                return topologyError("The user-tool path symlink resolves outside the selected profile.", {
+                    path: source,
+                    resolved,
+                });
+            }
+        }
+        catch {
+            return topologyError("The user-tool path cannot be canonicalized.", { path: source });
+        }
+    }
+    return success(null);
+}
+function worktreeGitDirectory(worktree) {
+    try {
+        const entry = path.join(worktree, ".git");
+        const stat = fs.lstatSync(entry);
+        if (stat.isSymbolicLink())
+            return null;
+        if (stat.isDirectory())
+            return entry;
+        const text = fs.readFileSync(entry, "utf8").trim();
+        if (!text.startsWith("gitdir:"))
+            return null;
+        return path.resolve(worktree, text.slice("gitdir:".length).trim());
+    }
+    catch {
+        return null;
+    }
+}
+function copyIfRegular(source, destination) {
+    try {
+        if (fs.lstatSync(source).isFile())
+            fs.copyFileSync(source, destination);
+    }
+    catch {
+        // Optional Git metadata is intentionally omitted when unavailable.
+    }
+}
+function prepareGitMetadata(request, topology) {
+    try {
+        fs.mkdirSync(topology.git_metadata, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(path.join(topology.git_metadata, "config"), "[core]\n\trepositoryformatversion = 0\n\tbare = false\n", { mode: 0o600 });
+        const admin = worktreeGitDirectory(topology.worktree);
+        if (admin !== null) {
+            copyIfRegular(path.join(admin, "HEAD"), path.join(topology.git_metadata, "HEAD"));
+            copyIfRegular(path.join(admin, "index"), path.join(topology.git_metadata, "index"));
+            let head = "";
+            try {
+                head = fs.readFileSync(path.join(admin, "HEAD"), "utf8").trim();
+            }
+            catch {
+                head = "";
+            }
+            const reference = /^ref:\s+(refs\/heads\/[A-Za-z0-9._/-]+)$/u.exec(head)?.[1];
+            if (reference !== undefined) {
+                if (reference.split("/").some((part) => part === "." || part === "..")) {
+                    return topologyError("The authoritative Git HEAD contains an unsafe ref path.", {
+                        session_id: request.session_id,
+                        reference,
+                    });
+                }
+                const commonDirectory = path.dirname(topology.git_objects);
+                const source = path.join(commonDirectory, reference);
+                const destination = path.join(topology.git_metadata, reference);
+                fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+                copyIfRegular(source, destination);
+            }
+            const commonDirectory = path.dirname(topology.git_objects);
+            copyIfRegular(path.join(commonDirectory, "packed-refs"), path.join(topology.git_metadata, "packed-refs"));
+        }
+        if (!fs.existsSync(path.join(topology.git_metadata, "HEAD"))) {
+            fs.writeFileSync(path.join(topology.git_metadata, "HEAD"), "ref: refs/heads/main\n", { mode: 0o600 });
+        }
+        return success(null);
+    }
+    catch (error) {
+        return topologyError("Session-private Git metadata could not be prepared.", {
+            session_id: request.session_id,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        });
+    }
+}
+/**
+ * Compile one authoritative request into a deterministic bubblewrap argv.
+ * Mounts are derived from fixed topology fields; caller data is used only as
+ * the command and its argv, after the bwrap `--` terminator.
+ */
+export function compileSandboxInvocation(request, command) {
+    const executable = validateExecutable(request);
+    if (!executable.ok)
+        return executable;
+    if (command.command.length === 0 || command.command.includes("\0")) {
+        return topologyError("The sandbox command must be non-empty and contain no NUL bytes.", {
+            command: command.command,
+        });
+    }
+    const commandArgs = [...(command.args ?? [])];
+    if (commandArgs.some((argument) => argument.includes("\0"))) {
+        return topologyError("Sandbox command arguments cannot contain NUL bytes.", { session_id: request.session_id });
+    }
+    const topology = validateTopology(request);
+    if (!topology.ok)
+        return topology;
+    const profilePaths = validateProfilePaths(request);
+    if (!profilePaths.ok)
+        return profilePaths;
+    const gitMetadata = prepareGitMetadata(request, topology.value);
+    if (!gitMetadata.ok)
+        return gitMetadata;
+    const pathValue = pathEntriesForEnvironment(request).join(":");
+    const args = [
+        "--die-with-parent",
+        "--new-session",
+        "--unshare-user",
+        "--unshare-pid",
+        "--unshare-ipc",
+        "--unshare-uts",
+        "--disable-userns",
+        "--uid",
+        "0",
+        "--gid",
+        "0",
+        "--cap-drop",
+        "ALL",
+        "--clearenv",
+        "--setenv",
+        "HOME",
+        SANDBOX_HOME,
+        "--setenv",
+        "TMPDIR",
+        "/tmp",
+        "--setenv",
+        "XDG_CONFIG_HOME",
+        SANDBOX_CONFIG_HOME,
+        "--setenv",
+        "XDG_CACHE_HOME",
+        SANDBOX_CACHE_HOME,
+        "--setenv",
+        "XDG_DATA_HOME",
+        `${SANDBOX_LOCAL_HOME}/share`,
+        "--setenv",
+        "USER",
+        "nawabari",
+        "--setenv",
+        "LOGNAME",
+        "nawabari",
+        "--setenv",
+        "NAWABARI_SESSION_ID",
+        request.session_id,
+        "--setenv",
+        "PATH",
+        pathValue,
+        "--setenv",
+        "GIT_DIR",
+        "/nawabari/git",
+        "--setenv",
+        "GIT_WORK_TREE",
+        topology.value.worktree,
+        "--setenv",
+        "GIT_CONFIG_NOSYSTEM",
+        "1",
+        "--setenv",
+        "GIT_CONFIG_GLOBAL",
+        "/dev/null",
+        "--tmpfs",
+        "/",
+        "--dev",
+        "/dev",
+        "--proc",
+        "/proc",
+        "--tmpfs",
+        "/tmp",
+    ];
+    const seenDirectories = new Set();
+    const worktreeDestination = topology.value.worktree;
+    addReadWriteBind(args, topology.value.worktree, worktreeDestination, seenDirectories);
+    addReadWriteBind(args, topology.value.home, SANDBOX_HOME, seenDirectories);
+    addReadWriteBind(args, topology.value.cache, SANDBOX_CACHE_HOME, seenDirectories);
+    addReadWriteBind(args, topology.value.persistent_home, SANDBOX_SHARED_HOME, seenDirectories);
+    addReadWriteBind(args, topology.value.git_metadata, "/nawabari/git", seenDirectories);
+    addReadOnlyBind(args, topology.value.git_objects, "/nawabari/git/objects", seenDirectories);
+    for (const source of request.filesystem.user_tool_paths) {
+        const kind = allowedUserToolPath(source, request.filesystem.user_tool_home);
+        if (kind === "local_bin")
+            addReadOnlyBind(args, source, `${SANDBOX_LOCAL_HOME}/bin`, seenDirectories);
+        if (kind === "local_lib")
+            addReadOnlyBind(args, source, `${SANDBOX_LOCAL_HOME}/lib`, seenDirectories);
+        if (kind === "pnpm_bin") {
+            addReadOnlyBind(args, source, `${SANDBOX_LOCAL_HOME}/share/pnpm`, seenDirectories);
+        }
+    }
+    for (const source of request.filesystem.runtime_paths) {
+        if (source === "/dev" || source === "/proc" || source === "/tmp")
+            continue;
+        addReadOnlyBind(args, source, source, seenDirectories);
+    }
+    for (const source of request.filesystem.system_paths)
+        addReadOnlyBind(args, source, source, seenDirectories);
+    for (const parent of destinationParents(worktreeDestination)) {
+        if (seenDirectories.has(parent))
+            continue;
+        seenDirectories.add(parent);
+        args.push("--dir", parent);
+    }
+    args.push("--chdir", worktreeDestination, "--", command.command, ...commandArgs);
+    const env = {
+        PATH: pathValue,
+        HOME: SANDBOX_HOME,
+        TMPDIR: "/tmp",
+        XDG_CONFIG_HOME: SANDBOX_CONFIG_HOME,
+        XDG_CACHE_HOME: SANDBOX_CACHE_HOME,
+        XDG_DATA_HOME: `${SANDBOX_LOCAL_HOME}/share`,
+        USER: "nawabari",
+        LOGNAME: "nawabari",
+        NAWABARI_SESSION_ID: request.session_id,
+    };
+    return success({ executable: executable.value, args, cwd: topology.value.worktree, env });
+}
+function boundedOutput(chunks, bytes, maxBytes, value) {
+    const text = typeof value === "string" ? value : value.toString("utf8");
+    const textBytes = Buffer.byteLength(text, "utf8");
+    const remaining = maxBytes - bytes;
+    if (remaining <= 0)
+        return { bytes, exceeded: textBytes > 0 };
+    if (textBytes <= remaining) {
+        chunks.push(text);
+        return { bytes: bytes + textBytes, exceeded: false };
+    }
+    const bounded = Buffer.from(text).subarray(0, remaining).toString("utf8");
+    chunks.push(bounded);
+    return { bytes: maxBytes, exceeded: true };
+}
+/** Execute the compiled invocation with shell execution disabled and no fallback path. */
+export function runSandboxedCommand(request, command, options = {}) {
+    const invocation = compileSandboxInvocation(request, command);
+    if (!invocation.ok)
+        return Promise.resolve(invocation);
+    const timeoutMs = options.timeout_ms ?? DEFAULT_TIMEOUT_MS;
+    const maxOutputBytes = options.max_output_bytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        !Number.isSafeInteger(maxOutputBytes) ||
+        maxOutputBytes < 1) {
+        return Promise.resolve(failure(new DomainError("INVALID_ARGUMENT", "Sandbox execution limits must be positive safe integers.", {
+            timeout_ms: timeoutMs,
+            max_output_bytes: maxOutputBytes,
+        })));
+    }
+    const started = Date.now();
+    let child;
+    try {
+        child = spawn(invocation.value.executable, [...invocation.value.args], {
+            cwd: invocation.value.cwd,
+            env: { ...invocation.value.env },
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        return Promise.resolve(failure(new DomainError("SANDBOX_EXECUTION_FAILED", "Bubblewrap could not be started.", {
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        })));
+    }
+    return new Promise((resolve) => {
+        const stdout = [];
+        const stderr = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let timedOut = false;
+        let outputExceeded = false;
+        let spawnError = null;
+        let settled = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGKILL");
+        }, timeoutMs);
+        const finish = (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (spawnError !== null) {
+                resolve(failure(new DomainError("SANDBOX_EXECUTION_FAILED", "Bubblewrap failed before the command could run.", {
+                    reason: spawnError.message.slice(0, 200),
+                })));
+                return;
+            }
+            if (timedOut) {
+                resolve(failure(new DomainError("SANDBOX_EXECUTION_TIMEOUT", "The sandboxed command exceeded its execution timeout.", {
+                    timeout_ms: timeoutMs,
+                })));
+                return;
+            }
+            if (outputExceeded) {
+                resolve(failure(new DomainError("SANDBOX_OUTPUT_LIMIT", "The sandboxed command exceeded its output limit.", {
+                    max_output_bytes: maxOutputBytes,
+                })));
+                return;
+            }
+            resolve(success({
+                exit_code: code,
+                signal,
+                stdout: stdout.join(""),
+                stderr: stderr.join(""),
+                duration_ms: Date.now() - started,
+            }));
+        };
+        child.stdout?.on("data", (value) => {
+            const collected = boundedOutput(stdout, stdoutBytes, maxOutputBytes, value);
+            stdoutBytes = collected.bytes;
+            if (collected.exceeded) {
+                outputExceeded = true;
+                child.kill("SIGKILL");
+            }
+        });
+        child.stderr?.on("data", (value) => {
+            const collected = boundedOutput(stderr, stderrBytes, maxOutputBytes, value);
+            stderrBytes = collected.bytes;
+            if (collected.exceeded) {
+                outputExceeded = true;
+                child.kill("SIGKILL");
+            }
+        });
+        child.on("error", (error) => {
+            spawnError = error;
+        });
+        child.on("close", (code, signal) => finish(code, signal));
+    });
+}
+//# sourceMappingURL=sandbox-launcher.js.map