nova-terminal-ai 0.3.4

package/dist/packages/core/src/security/ApprovalManager.js

@@ -0,0 +1,122 @@
+// ============================================================================
+// ApprovalManager - Manages tool approval workflow
+// ============================================================================
+import { ApprovalError } from '../types/errors.js';
+export class ApprovalManager {
+    mode;
+    autoApproveLowRisk;
+    alwaysRequireApproval;
+    neverRequireApproval;
+    rules;
+    pendingRequests = new Map();
+    handler = null;
+    constructor(options) {
+        this.mode = options.defaultMode;
+        this.autoApproveLowRisk = options.autoApproveLowRisk ?? false;
+        this.alwaysRequireApproval = new Set(options.alwaysRequireApproval || []);
+        this.neverRequireApproval = new Set(options.neverRequireApproval || []);
+        this.rules = options.rules || [];
+    }
+    /** Set the approval handler (UI callback) */
+    setHandler(handler) {
+        this.handler = handler;
+    }
+    /** Update the approval mode */
+    setMode(mode) {
+        this.mode = mode;
+    }
+    /** Get the current approval mode */
+    getMode() {
+        return this.mode;
+    }
+    /** Check if a tool call requires approval */
+    requiresApproval(toolName, toolInput, toolDefinition) {
+        // YOLO mode: never require approval
+        if (this.mode === 'yolo')
+            return false;
+        // Never-approve list
+        if (this.neverRequireApproval.has(toolName))
+            return false;
+        // Always-approve list
+        if (this.alwaysRequireApproval.has(toolName))
+            return true;
+        // Check custom rules
+        for (const rule of this.rules) {
+            if (this.matchPattern(toolName, rule.toolPattern)) {
+                if (rule.conditions) {
+                    const matchesAll = Object.entries(rule.conditions).every(([field, check]) => check(toolInput[field]));
+                    if (matchesAll) {
+                        return rule.requireApproval;
+                    }
+                }
+                else {
+                    return rule.requireApproval;
+                }
+            }
+        }
+        // Tool definition check
+        if (toolDefinition) {
+            if (typeof toolDefinition.requiresApproval === 'boolean') {
+                return toolDefinition.requiresApproval;
+            }
+            return toolDefinition.requiresApproval(toolInput, this.mode);
+        }
+        // Default: require approval in plan mode, skip for low risk in accepting_edits
+        if (this.mode === 'plan')
+            return true;
+        if (this.mode === 'accepting_edits')
+            return false;
+        if (this.mode === 'smart')
+            return true; // Smart mode asks for important ops
+        // Default mode: require approval for high/critical risk tools
+        return true;
+    }
+    /** Get the effective risk level for a tool call */
+    getRiskLevel(toolName, toolInput, toolDefinition) {
+        // Check custom rules for risk override
+        for (const rule of this.rules) {
+            if (rule.riskOverride && this.matchPattern(toolName, rule.toolPattern)) {
+                return rule.riskOverride;
+            }
+        }
+        return toolDefinition?.riskLevel || 'medium';
+    }
+    /** Request user approval for a tool call */
+    async requestApproval(request) {
+        if (!this.handler) {
+            // No handler set, auto-approve based on mode
+            if (this.mode === 'yolo' || (this.autoApproveLowRisk && request.risk === 'low')) {
+                return { requestId: request.id, approved: true };
+            }
+            throw new ApprovalError('No approval handler configured and approval is required');
+        }
+        this.pendingRequests.set(request.id, request);
+        try {
+            const response = await this.handler(request);
+            if (!response.requestId) {
+                response.requestId = request.id;
+            }
+            return response;
+        }
+        finally {
+            this.pendingRequests.delete(request.id);
+        }
+    }
+    /** Get pending approval requests */
+    getPendingRequests() {
+        return Array.from(this.pendingRequests.values());
+    }
+    /** Cancel a pending request */
+    cancelRequest(requestId) {
+        this.pendingRequests.delete(requestId);
+    }
+    /** Simple glob pattern matching */
+    matchPattern(name, pattern) {
+        const regexStr = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*')
+            .replace(/\?/g, '.');
+        return new RegExp(`^${regexStr}$`).test(name);
+    }
+}
+//# sourceMappingURL=ApprovalManager.js.map

package/dist/packages/core/src/security/ApprovalManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApprovalManager.js","sourceRoot":"","sources":["../../../../../../core/src/security/ApprovalManager.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAI/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA8BnD,MAAM,OAAO,eAAe;IAClB,IAAI,CAAe;IACnB,kBAAkB,CAAU;IAC5B,qBAAqB,CAAc;IACnC,oBAAoB,CAAc;IAClC,KAAK,CAAiB;IACtB,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,OAAO,GAA2B,IAAI,CAAC;IAE/C,YAAY,OAA+B;QACzC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC9D,IAAI,CAAC,qBAAqB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,6CAA6C;IAC7C,UAAU,CAAC,OAAwB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,+BAA+B;IAC/B,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,6CAA6C;IAC7C,gBAAgB,CACd,QAAgB,EAChB,SAAkC,EAClC,cAA+B;QAE/B,oCAAoC;QACpC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAEvC,qBAAqB;QACrB,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAE1D,sBAAsB;QACtB,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1D,qBAAqB;QACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CACtD,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAC5C,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,OAAO,IAAI,CAAC,eAAe,CAAC;oBAC9B,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,OAAO,cAAc,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,cAAc,CAAC,gBAAgB,CAAC;YACzC,CAAC;YACD,OAAO,cAAc,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QAED,+EAA+E;QAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QAE5E,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,YAAY,CACV,QAAgB,EAChB,SAAkC,EAClC,cAA+B;QAE/B,uCAAuC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,cAAc,EAAE,SAAS,IAAI,QAAQ,CAAC;IAC/C,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,eAAe,CAAC,OAAwB;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,6CAA6C;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,+BAA+B;IAC/B,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,mCAAmC;IAC3B,YAAY,CAAC,IAAY,EAAE,OAAe;QAChD,MAAM,QAAQ,GAAG,OAAO;aACrB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/packages/core/src/security/FileFilter.d.ts

@@ -0,0 +1,47 @@
+export interface FileFilterConfig {
+    /** Glob patterns to ignore */
+    ignorePatterns: string[];
+    /** Patterns to always allow */
+    allowPatterns?: string[];
+    /** Maximum file size in bytes */
+    maxFileSize?: number;
+    /** Maximum batch size for operations */
+    maxBatchSize?: number;
+    /** Forbidden paths (absolute) */
+    forbiddenPaths?: string[];
+    /** Working directory (for relative path resolution) */
+    workingDirectory: string;
+}
+export declare class FileFilter {
+    private ignorePatterns;
+    private allowPatterns;
+    private maxFileSize;
+    private maxBatchSize;
+    private forbiddenPaths;
+    private workingDirectory;
+    constructor(config: FileFilterConfig);
+    /** Check if a file path is allowed */
+    isAllowed(filePath: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /** Check if a file path matches ignore patterns */
+    isIgnored(filePath: string): boolean;
+    /** Check if a file is within size limits */
+    checkFileSize(filePath: string): Promise<{
+        ok: boolean;
+        size?: number;
+        reason?: string;
+    }>;
+    /** Validate a batch of files */
+    validateBatch(filePaths: string[]): {
+        valid: boolean;
+        invalidFiles: string[];
+        reason?: string;
+    };
+    /** Filter a list of file paths, removing ignored and disallowed ones */
+    filterPaths(filePaths: string[]): string[];
+    /** Simple glob matching */
+    private matchGlob;
+}
+//# sourceMappingURL=FileFilter.d.ts.map

package/dist/packages/core/src/security/FileFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileFilter.d.ts","sourceRoot":"","sources":["../../../../../../core/src/security/FileFilter.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,+BAA+B;IAC/B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,aAAa,CAAW;IAChC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,gBAAgB,CAAS;gBAErB,MAAM,EAAE,gBAAgB;IAWpC,sCAAsC;IACtC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAkBlE,mDAAmD;IACnD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAiCpC,4CAA4C;IACtC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB/F,gCAAgC;IAChC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAW/F,wEAAwE;IACxE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAQ1C,2BAA2B;IAC3B,OAAO,CAAC,SAAS;CAOlB"}

package/dist/packages/core/src/security/FileFilter.js

@@ -0,0 +1,111 @@
+// ============================================================================
+// FileFilter - Controls which files can be accessed by tools
+// ============================================================================
+import path from 'node:path';
+import fs from 'node:fs/promises';
+export class FileFilter {
+    ignorePatterns;
+    allowPatterns;
+    maxFileSize;
+    maxBatchSize;
+    forbiddenPaths;
+    workingDirectory;
+    constructor(config) {
+        this.ignorePatterns = config.ignorePatterns;
+        this.allowPatterns = config.allowPatterns || [];
+        this.maxFileSize = config.maxFileSize || 10 * 1024 * 1024; // 10MB
+        this.maxBatchSize = config.maxBatchSize || 100;
+        this.forbiddenPaths = new Set((config.forbiddenPaths || []).map((p) => path.resolve(p)));
+        this.workingDirectory = config.workingDirectory;
+    }
+    /** Check if a file path is allowed */
+    isAllowed(filePath) {
+        const resolved = path.resolve(filePath);
+        // Check forbidden paths
+        for (const forbidden of this.forbiddenPaths) {
+            if (resolved.startsWith(forbidden) || resolved === forbidden) {
+                return { allowed: false, reason: `Path is in forbidden directory: ${forbidden}` };
+            }
+        }
+        // Check if it's within the working directory
+        if (!resolved.startsWith(this.workingDirectory) && !path.isAbsolute(resolved)) {
+            return { allowed: false, reason: `Path is outside the working directory` };
+        }
+        return { allowed: true };
+    }
+    /** Check if a file path matches ignore patterns */
+    isIgnored(filePath) {
+        const normalized = filePath.replace(/\\/g, '/');
+        for (const pattern of this.ignorePatterns) {
+            if (this.matchGlob(normalized, pattern)) {
+                return true;
+            }
+        }
+        // Standard ignores
+        const alwaysIgnore = [
+            'node_modules',
+            '.git',
+            'dist',
+            'build',
+            '.next',
+            '.nuxt',
+            '__pycache__',
+            '.venv',
+            'venv',
+            '.env',
+            '.env.local',
+        ];
+        for (const dir of alwaysIgnore) {
+            if (normalized.includes(`/${dir}/`) || normalized.includes(`\\${dir}\\`)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Check if a file is within size limits */
+    async checkFileSize(filePath) {
+        try {
+            const stat = await fs.stat(filePath);
+            if (stat.size > this.maxFileSize) {
+                return {
+                    ok: false,
+                    size: stat.size,
+                    reason: `File size (${stat.size} bytes) exceeds maximum (${this.maxFileSize} bytes)`,
+                };
+            }
+            return { ok: true, size: stat.size };
+        }
+        catch {
+            return { ok: false, reason: 'Cannot stat file' };
+        }
+    }
+    /** Validate a batch of files */
+    validateBatch(filePaths) {
+        if (filePaths.length > this.maxBatchSize) {
+            return {
+                valid: false,
+                invalidFiles: filePaths.slice(this.maxBatchSize),
+                reason: `Batch size (${filePaths.length}) exceeds maximum (${this.maxBatchSize})`,
+            };
+        }
+        return { valid: false, invalidFiles: [] };
+    }
+    /** Filter a list of file paths, removing ignored and disallowed ones */
+    filterPaths(filePaths) {
+        return filePaths.filter((p) => {
+            const allowed = this.isAllowed(p);
+            if (!allowed.allowed)
+                return false;
+            return !this.isIgnored(p);
+        });
+    }
+    /** Simple glob matching */
+    matchGlob(str, pattern) {
+        const regexStr = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*')
+            .replace(/\?/g, '.');
+        return new RegExp(`^${regexStr}$`).test(str);
+    }
+}
+//# sourceMappingURL=FileFilter.js.map

package/dist/packages/core/src/security/FileFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileFilter.js","sourceRoot":"","sources":["../../../../../../core/src/security/FileFilter.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6DAA6D;AAC7D,+EAA+E;AAE/E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAiBlC,MAAM,OAAO,UAAU;IACb,cAAc,CAAW;IACzB,aAAa,CAAW;IACxB,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,cAAc,CAAc;IAC5B,gBAAgB,CAAS;IAEjC,YAAY,MAAwB;QAClC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QAClE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAC3B,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAC1D,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED,sCAAsC;IACtC,SAAS,CAAC,QAAgB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,wBAAwB;QACxB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,SAAS,EAAE,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC7E,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,mDAAmD;IACnD,SAAS,CAAC,QAAgB;QACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEhD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,YAAY,GAAG;YACnB,cAAc;YACd,MAAM;YACN,MAAM;YACN,OAAO;YACP,OAAO;YACP,OAAO;YACP,aAAa;YACb,OAAO;YACP,MAAM;YACN,MAAM;YACN,YAAY;SACb,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,cAAc,IAAI,CAAC,IAAI,4BAA4B,IAAI,CAAC,WAAW,SAAS;iBACrF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,SAAmB;QAC/B,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;gBAChD,MAAM,EAAE,eAAe,SAAS,CAAC,MAAM,sBAAsB,IAAI,CAAC,YAAY,GAAG;aAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,WAAW,CAAC,SAAmB;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IACnB,SAAS,CAAC,GAAW,EAAE,OAAe;QAC5C,MAAM,QAAQ,GAAG,OAAO;aACrB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/packages/core/src/security/HookExecutor.d.ts

@@ -0,0 +1,37 @@
+import { EventEmitter } from 'node:events';
+import type { HookConfig, HookResult, HookEvent } from '../types/session.js';
+export interface HookExecutorOptions {
+    /** Default timeout for hook execution (ms) */
+    defaultTimeout?: number;
+    /** Working directory */
+    workingDirectory: string;
+    /** Environment variables */
+    environment?: Record<string, string>;
+    /** Whether hooks are enabled */
+    enabled?: boolean;
+}
+export declare class HookExecutor extends EventEmitter {
+    private hooks;
+    private defaultTimeout;
+    private workingDirectory;
+    private environment;
+    private enabled;
+    constructor(options: HookExecutorOptions);
+    /** Register a hook configuration */
+    register(config: HookConfig): void;
+    /** Register multiple hooks */
+    registerAll(configs: HookConfig[]): void;
+    /** Execute all hooks for a given event */
+    execute(event: HookEvent, context?: Record<string, unknown>): Promise<HookResult[]>;
+    /** Execute a single hook */
+    private executeHook;
+    /** Evaluate a simple condition expression */
+    private evaluateCondition;
+    /** Flatten context object into NOVA_ prefixed env vars */
+    private flattenContext;
+    /** Enable/disable hooks */
+    setEnabled(enabled: boolean): void;
+    /** Get all registered hooks */
+    getHooks(): Map<string, HookConfig[]>;
+}
+//# sourceMappingURL=HookExecutor.d.ts.map

package/dist/packages/core/src/security/HookExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HookExecutor.d.ts","sourceRoot":"","sources":["../../../../../../core/src/security/HookExecutor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG7E,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wBAAwB;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,YAAa,SAAQ,YAAY;IAC5C,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAAU;gBAEb,OAAO,EAAE,mBAAmB;IAQxC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAQlC,8BAA8B;IAC9B,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI;IAMxC,0CAA0C;IACpC,OAAO,CACX,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,UAAU,EAAE,CAAC;IAgCxB,4BAA4B;YACd,WAAW;IA2DzB,6CAA6C;IAC7C,OAAO,CAAC,iBAAiB;IAUzB,0DAA0D;IAC1D,OAAO,CAAC,cAAc;IAStB,2BAA2B;IAC3B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIlC,+BAA+B;IAC/B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;CAGtC"}

package/dist/packages/core/src/security/HookExecutor.js

@@ -0,0 +1,142 @@
+// ============================================================================
+// HookExecutor - Executes lifecycle hooks
+// ============================================================================
+import { spawn } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+export class HookExecutor extends EventEmitter {
+    hooks = new Map();
+    defaultTimeout;
+    workingDirectory;
+    environment;
+    enabled;
+    constructor(options) {
+        super();
+        this.defaultTimeout = options.defaultTimeout || 30000;
+        this.workingDirectory = options.workingDirectory;
+        this.environment = options.environment || {};
+        this.enabled = options.enabled ?? true;
+    }
+    /** Register a hook configuration */
+    register(config) {
+        const event = config.event;
+        if (!this.hooks.has(event)) {
+            this.hooks.set(event, []);
+        }
+        this.hooks.get(event).push(config);
+    }
+    /** Register multiple hooks */
+    registerAll(configs) {
+        for (const config of configs) {
+            this.register(config);
+        }
+    }
+    /** Execute all hooks for a given event */
+    async execute(event, context) {
+        if (!this.enabled)
+            return [];
+        const hooks = this.hooks.get(event) || [];
+        const results = [];
+        for (const hook of hooks) {
+            // Check condition
+            if (hook.condition) {
+                try {
+                    const meets = this.evaluateCondition(hook.condition, context || {});
+                    if (!meets)
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+            }
+            const result = await this.executeHook(hook, context);
+            results.push(result);
+            this.emit('hook_executed', { event, hook, result });
+            // If hook failed, stop chain
+            if (result.exitCode !== 0) {
+                this.emit('hook_failed', { event, hook, result });
+                break;
+            }
+        }
+        return results;
+    }
+    /** Execute a single hook */
+    async executeHook(hook, context) {
+        const timeout = hook.timeout || this.defaultTimeout;
+        const startTime = Date.now();
+        return new Promise((resolve) => {
+            // Build environment with context variables
+            const env = {
+                ...this.environment,
+                NOVA_HOOK_EVENT: hook.event,
+                NOVA_WORKING_DIR: this.workingDirectory,
+                ...(context ? this.flattenContext(context) : {}),
+            };
+            const proc = spawn('sh', ['-c', hook.command], {
+                cwd: this.workingDirectory,
+                env: { ...process.env, ...env },
+                stdio: ['pipe', 'pipe', 'pipe'],
+                windowsHide: true,
+            });
+            let stdout = '';
+            let stderr = '';
+            proc.stdout.on('data', (data) => { stdout += data.toString(); });
+            proc.stderr.on('data', (data) => { stderr += data.toString(); });
+            proc.stdin.end();
+            const timer = setTimeout(() => {
+                proc.kill('SIGKILL');
+                resolve({
+                    exitCode: -1,
+                    stdout,
+                    stderr: stderr || `Hook timed out after ${timeout}ms`,
+                    duration: Date.now() - startTime,
+                });
+            }, timeout);
+            proc.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({
+                    exitCode: code ?? -1,
+                    stdout,
+                    stderr,
+                    duration: Date.now() - startTime,
+                });
+            });
+            proc.on('error', (err) => {
+                clearTimeout(timer);
+                resolve({
+                    exitCode: -1,
+                    stdout: '',
+                    stderr: err.message,
+                    duration: Date.now() - startTime,
+                });
+            });
+        });
+    }
+    /** Evaluate a simple condition expression */
+    evaluateCondition(condition, context) {
+        // Support simple conditions like "tool == write_file" or "risk == critical"
+        const match = condition.match(/^(\w+)\s*==\s*(\w+)$/);
+        if (match) {
+            const [, key, value] = match;
+            return String(context[key]) === value;
+        }
+        return false;
+    }
+    /** Flatten context object into NOVA_ prefixed env vars */
+    flattenContext(context) {
+        const result = {};
+        for (const [key, value] of Object.entries(context)) {
+            const envKey = `NOVA_${key.toUpperCase().replace(/[^A-Z0-9_]/g, '_')}`;
+            result[envKey] = typeof value === 'string' ? value : JSON.stringify(value);
+        }
+        return result;
+    }
+    /** Enable/disable hooks */
+    setEnabled(enabled) {
+        this.enabled = enabled;
+    }
+    /** Get all registered hooks */
+    getHooks() {
+        return new Map(this.hooks);
+    }
+}
+//# sourceMappingURL=HookExecutor.js.map

package/dist/packages/core/src/security/HookExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HookExecutor.js","sourceRoot":"","sources":["../../../../../../core/src/security/HookExecutor.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAe3C,MAAM,OAAO,YAAa,SAAQ,YAAY;IACpC,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IACxC,cAAc,CAAS;IACvB,gBAAgB,CAAS;IACzB,WAAW,CAAyB;IACpC,OAAO,CAAU;IAEzB,YAAY,OAA4B;QACtC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,oCAAoC;IACpC,QAAQ,CAAC,MAAkB;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,8BAA8B;IAC9B,WAAW,CAAC,OAAqB;QAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,OAAO,CACX,KAAgB,EAChB,OAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kBAAkB;YAClB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;oBACpE,IAAI,CAAC,KAAK;wBAAE,SAAS;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAEpD,6BAA6B;YAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4BAA4B;IACpB,KAAK,CAAC,WAAW,CAAC,IAAgB,EAAE,OAAiC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACzC,2CAA2C;YAC3C,MAAM,GAAG,GAA2B;gBAClC,GAAG,IAAI,CAAC,WAAW;gBACnB,eAAe,EAAE,IAAI,CAAC,KAAK;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC;YAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;gBAC7C,GAAG,EAAE,IAAI,CAAC,gBAAgB;gBAC1B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;gBAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAEjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrB,OAAO,CAAC;oBACN,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM;oBACN,MAAM,EAAE,MAAM,IAAI,wBAAwB,OAAO,IAAI;oBACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;oBACpB,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC;oBACN,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,OAAO;oBACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IACrC,iBAAiB,CAAC,SAAiB,EAAE,OAAgC;QAC3E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0DAA0D;IAClD,cAAc,CAAC,OAAgC;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2BAA2B;IAC3B,UAAU,CAAC,OAAgB;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,+BAA+B;IAC/B,QAAQ;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF"}

package/dist/packages/core/src/security/SandboxExecutor.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Sandbox type
+ */
+export type SandboxType = 'none' | 'docker' | 'isolate' | 'bubblewrap';
+/**
+ * Sandbox configuration
+ */
+export interface SandboxConfig {
+    enabled: boolean;
+    type: SandboxType;
+    network: 'none' | 'restricted' | 'full';
+    memory: string;
+    cpu: string;
+    timeout: number;
+    workDir?: string;
+    env?: Record<string, string>;
+    readOnlyPaths?: string[];
+    writablePaths?: string[];
+}
+/**
+ * Execution result
+ */
+export interface ExecutionResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    duration: number;
+    timedOut: boolean;
+}
+/**
+ * Execute commands in an isolated sandbox environment
+ */
+export declare class SandboxExecutor {
+    private config;
+    private dockerAvailable;
+    constructor(config?: Partial<SandboxConfig>);
+    /**
+     * Check if Docker is available
+     */
+    isDockerAvailable(): Promise<boolean>;
+    /**
+     * Get the best available sandbox type
+     */
+    getBestSandboxType(): Promise<SandboxType>;
+    /**
+     * Execute a command in the sandbox
+     */
+    execute(command: string, args?: string[]): Promise<ExecutionResult>;
+    /**
+     * Execute a shell command string
+     */
+    executeShell(shellCommand: string): Promise<ExecutionResult>;
+    /**
+     * Execute command in Docker container
+     */
+    private executeInDocker;
+    /**
+     * Execute command using Bubblewrap (Linux only)
+     */
+    private executeInBubblewrap;
+    /**
+     * Execute command using Isolate (Linux only)
+     */
+    private executeInIsolate;
+    /**
+     * Run a command with timeout
+     */
+    private runCommand;
+    /**
+     * Parse memory string to KB
+     */
+    private parseMemory;
+    /**
+     * Build the sandbox Docker image
+     */
+    buildDockerImage(): Promise<boolean>;
+    /**
+     * Check if sandbox Docker image exists
+     */
+    hasDockerImage(): Promise<boolean>;
+}
+/**
+ * Create a sandbox executor with default configuration
+ */
+export declare function createSandboxExecutor(config?: Partial<SandboxConfig>): SandboxExecutor;
+/**
+ * Check if sandbox is available
+ */
+export declare function isSandboxAvailable(): Promise<boolean>;
+//# sourceMappingURL=SandboxExecutor.d.ts.map

package/dist/packages/core/src/security/SandboxExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxExecutor.d.ts","sourceRoot":"","sources":["../../../../../../core/src/security/SandboxExecutor.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAkBD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,eAAe,CAAwB;gBAEnC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAQ/C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAc3C;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAuBhD;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAuB7E;;OAEG;IACG,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAYlE;;OAEG;YACW,eAAe;IAqD7B;;OAEG;YACW,mBAAmB;IAkCjC;;OAEG;YACW,gBAAgB;IAqC9B;;OAEG;IACH,OAAO,CAAC,UAAU;IAuDlB;;OAEG;IACH,OAAO,CAAC,WAAW;IAmBnB;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAiC1C;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;CAYzC;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,eAAe,CAE1F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAI3D"}