open-multi-agent-kit 0.80.5 → 0.80.7

package/dist/core/sandbox/path-resolver.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedSandboxPath } from "./policy.ts";
+export declare function nearestExistingParent(requestPath: string): string | undefined;
+export declare function resolveSandboxPath(root: string, requestPath: string): ResolvedSandboxPath;
+//# sourceMappingURL=path-resolver.d.ts.map

package/dist/core/sandbox/path-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-resolver.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/path-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW7E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,mBAAmB,CA4BzF","sourcesContent":["import { existsSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport type { ResolvedSandboxPath } from \"./policy.ts\";\n\nexport function nearestExistingParent(requestPath: string): string | undefined {\n\tlet current = requestPath;\n\twhile (current !== \"/\" && current !== \"\" && current !== \".\") {\n\t\tif (existsSync(current)) {\n\t\t\treturn realpathSync(current);\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) break;\n\t\tcurrent = parent;\n\t}\n\treturn undefined;\n}\n\nexport function resolveSandboxPath(root: string, requestPath: string): ResolvedSandboxPath {\n\tif (requestPath.includes(\"\\0\")) {\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: false,\n\t\t\terror: \"Path contains a NUL byte.\",\n\t\t};\n\t}\n\n\tconst absolutePath = isAbsolute(requestPath) ? requestPath : resolve(root, requestPath);\n\n\ttry {\n\t\tconst real = realpathSync(absolutePath);\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: true,\n\t\t\trealPath: real,\n\t\t\tnearestExistingParentRealPath: real,\n\t\t\tisSymlink: real !== resolve(absolutePath),\n\t\t};\n\t} catch {\n\t\tconst parent = nearestExistingParent(absolutePath);\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: false,\n\t\t\tnearestExistingParentRealPath: parent,\n\t\t};\n\t}\n}\n"]}

package/dist/core/sandbox/path-resolver.js

@@ -0,0 +1,44 @@
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, resolve } from "node:path";
+export function nearestExistingParent(requestPath) {
+    let current = requestPath;
+    while (current !== "/" && current !== "" && current !== ".") {
+        if (existsSync(current)) {
+            return realpathSync(current);
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return undefined;
+}
+export function resolveSandboxPath(root, requestPath) {
+    if (requestPath.includes("\0")) {
+        return {
+            requestedPath: requestPath,
+            exists: false,
+            error: "Path contains a NUL byte.",
+        };
+    }
+    const absolutePath = isAbsolute(requestPath) ? requestPath : resolve(root, requestPath);
+    try {
+        const real = realpathSync(absolutePath);
+        return {
+            requestedPath: requestPath,
+            exists: true,
+            realPath: real,
+            nearestExistingParentRealPath: real,
+            isSymlink: real !== resolve(absolutePath),
+        };
+    }
+    catch {
+        const parent = nearestExistingParent(absolutePath);
+        return {
+            requestedPath: requestPath,
+            exists: false,
+            nearestExistingParentRealPath: parent,
+        };
+    }
+}
+//# sourceMappingURL=path-resolver.js.map

package/dist/core/sandbox/path-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-resolver.js","sourceRoot":"","sources":["../../../src/core/sandbox/path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzD,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAsB;IAC9E,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAC7D,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM;QAC9B,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,WAAmB,EAAuB;IAC1F,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO;YACN,aAAa,EAAE,WAAW;YAC1B,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,2BAA2B;SAClC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAExF,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO;YACN,aAAa,EAAE,WAAW;YAC1B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,6BAA6B,EAAE,IAAI;YACnC,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,YAAY,CAAC;SACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO;YACN,aAAa,EAAE,WAAW;YAC1B,MAAM,EAAE,KAAK;YACb,6BAA6B,EAAE,MAAM;SACrC,CAAC;IACH,CAAC;AAAA,CACD","sourcesContent":["import { existsSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport type { ResolvedSandboxPath } from \"./policy.ts\";\n\nexport function nearestExistingParent(requestPath: string): string | undefined {\n\tlet current = requestPath;\n\twhile (current !== \"/\" && current !== \"\" && current !== \".\") {\n\t\tif (existsSync(current)) {\n\t\t\treturn realpathSync(current);\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) break;\n\t\tcurrent = parent;\n\t}\n\treturn undefined;\n}\n\nexport function resolveSandboxPath(root: string, requestPath: string): ResolvedSandboxPath {\n\tif (requestPath.includes(\"\\0\")) {\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: false,\n\t\t\terror: \"Path contains a NUL byte.\",\n\t\t};\n\t}\n\n\tconst absolutePath = isAbsolute(requestPath) ? requestPath : resolve(root, requestPath);\n\n\ttry {\n\t\tconst real = realpathSync(absolutePath);\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: true,\n\t\t\trealPath: real,\n\t\t\tnearestExistingParentRealPath: real,\n\t\t\tisSymlink: real !== resolve(absolutePath),\n\t\t};\n\t} catch {\n\t\tconst parent = nearestExistingParent(absolutePath);\n\t\treturn {\n\t\t\trequestedPath: requestPath,\n\t\t\texists: false,\n\t\t\tnearestExistingParentRealPath: parent,\n\t\t};\n\t}\n}\n"]}

package/dist/core/sandbox/policy.d.ts

@@ -0,0 +1,87 @@
+export type SandboxMode = "off" | "audit" | "enforce";
+export type SandboxProfile = "readonly" | "workspace-write" | "dev-server" | "networked";
+export type NetworkMode = "none" | "loopback" | "domain-allowlist" | "all-explicit";
+export type PathAccessKind = "read" | "write";
+export type SandboxPlatform = "linux" | "macos" | "unsupported";
+export interface SandboxPolicy {
+    mode: SandboxMode;
+    profile: SandboxProfile;
+    filesystem: {
+        root: string;
+        readAllow: readonly string[];
+        readDeny: readonly string[];
+        writeAllow: readonly string[];
+        denyWrite: readonly string[];
+        tempWrite: readonly string[];
+        followSymlinks: false;
+    };
+    network: {
+        mode: NetworkMode;
+        allowedDomains: readonly string[];
+        deniedDomains: readonly string[];
+        allowUnixSockets: readonly string[];
+        allowBrowser: false;
+    };
+    process: {
+        allowExec: boolean;
+        allowShell: boolean;
+        allowPrivilege: false;
+    };
+}
+export interface ResolvedSandboxPath {
+    requestedPath: string;
+    exists: boolean;
+    realPath?: string;
+    nearestExistingParentRealPath?: string;
+    isSymlink?: boolean;
+    error?: string;
+}
+export type SandboxPathResolver = (requestPath: string) => ResolvedSandboxPath;
+export interface PathAccessRequest {
+    kind: PathAccessKind;
+    path: string;
+}
+export interface SandboxDecision {
+    allowed: boolean;
+    rule: string;
+    reason: string;
+}
+export interface NetworkAccessRequest {
+    host?: string;
+    url?: string;
+    unixSocketPath?: string;
+    browser?: boolean;
+    loopback?: boolean;
+}
+export interface SandboxBackendStatus {
+    platform: SandboxPlatform;
+    backendAvailable: boolean;
+    domainAllowlistAvailable?: boolean;
+}
+export interface SandboxFallbackDecision extends SandboxDecision {
+    allowShell: boolean;
+    allowExec: boolean;
+    allowReadOnlyTools: boolean;
+}
+export declare function decidePathAccess(policy: SandboxPolicy, request: PathAccessRequest, resolver: SandboxPathResolver): SandboxDecision;
+export declare function decideNetworkAccess(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision;
+export declare function decideSandboxFallback(policy: SandboxPolicy, backend: SandboxBackendStatus): SandboxFallbackDecision;
+export declare function mergeSandboxPolicy(base: SandboxPolicy, override: Partial<SandboxPolicy>, options?: {
+    allowBroaden?: boolean;
+}): SandboxPolicy;
+export interface BashSpawnPreflightContext {
+    command: string;
+    cwd: string;
+}
+export interface BashSpawnPreflightDecision extends SandboxDecision {
+    allowShell: boolean;
+}
+/**
+ * Final pure preflight for a local bash spawn. Combines the backend-availability
+ * fallback (deny shell when an OS sandbox backend is missing under enforce mode)
+ * with a working-directory containment check (deny when cwd resolves outside the
+ * sandbox root). This helper does not itself wrap the process in an OS sandbox; it
+ * only decides whether the spawn may proceed.
+ */
+export declare function preflightBashSpawn(policy: SandboxPolicy, backend: SandboxBackendStatus, context: BashSpawnPreflightContext, resolver?: SandboxPathResolver): BashSpawnPreflightDecision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/core/sandbox/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/policy.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,iBAAiB,GAAG,YAAY,GAAG,WAAW,CAAC;AACzF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,kBAAkB,GAAG,cAAc,CAAC;AACpF,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAC9C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,cAAc,EAAE,KAAK,CAAC;KACtB,CAAC;IACF,OAAO,EAAE;QACR,IAAI,EAAE,WAAW,CAAC;QAClB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QACjC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,YAAY,EAAE,KAAK,CAAC;KACpB,CAAC;IACF,OAAO,EAAE;QACR,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;QACpB,cAAc,EAAE,KAAK,CAAC;KACtB,CAAC;CACF;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,mBAAmB,CAAC;AAE/E,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,eAAe,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC/D,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAmDD,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,mBAAmB,GAC3B,eAAe,CA0CjB;AAmBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA2BzG;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,uBAAuB,CA+BnH;AAED,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,EAChC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,aAAa,CA2Cf;AAiCD,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,0BAA2B,SAAQ,eAAe;IAClE,UAAU,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,yBAAyB,EAClC,QAAQ,CAAC,EAAE,mBAAmB,GAC5B,0BAA0B,CAsC5B","sourcesContent":["import path from \"node:path\";\n\nexport type SandboxMode = \"off\" | \"audit\" | \"enforce\";\nexport type SandboxProfile = \"readonly\" | \"workspace-write\" | \"dev-server\" | \"networked\";\nexport type NetworkMode = \"none\" | \"loopback\" | \"domain-allowlist\" | \"all-explicit\";\nexport type PathAccessKind = \"read\" | \"write\";\nexport type SandboxPlatform = \"linux\" | \"macos\" | \"unsupported\";\n\nexport interface SandboxPolicy {\n\tmode: SandboxMode;\n\tprofile: SandboxProfile;\n\tfilesystem: {\n\t\troot: string;\n\t\treadAllow: readonly string[];\n\t\treadDeny: readonly string[];\n\t\twriteAllow: readonly string[];\n\t\tdenyWrite: readonly string[];\n\t\ttempWrite: readonly string[];\n\t\tfollowSymlinks: false;\n\t};\n\tnetwork: {\n\t\tmode: NetworkMode;\n\t\tallowedDomains: readonly string[];\n\t\tdeniedDomains: readonly string[];\n\t\tallowUnixSockets: readonly string[];\n\t\tallowBrowser: false;\n\t};\n\tprocess: {\n\t\tallowExec: boolean;\n\t\tallowShell: boolean;\n\t\tallowPrivilege: false;\n\t};\n}\n\nexport interface ResolvedSandboxPath {\n\trequestedPath: string;\n\texists: boolean;\n\trealPath?: string;\n\tnearestExistingParentRealPath?: string;\n\tisSymlink?: boolean;\n\terror?: string;\n}\n\nexport type SandboxPathResolver = (requestPath: string) => ResolvedSandboxPath;\n\nexport interface PathAccessRequest {\n\tkind: PathAccessKind;\n\tpath: string;\n}\n\nexport interface SandboxDecision {\n\tallowed: boolean;\n\trule: string;\n\treason: string;\n}\n\nexport interface NetworkAccessRequest {\n\thost?: string;\n\turl?: string;\n\tunixSocketPath?: string;\n\tbrowser?: boolean;\n\tloopback?: boolean;\n}\n\nexport interface SandboxBackendStatus {\n\tplatform: SandboxPlatform;\n\tbackendAvailable: boolean;\n\tdomainAllowlistAvailable?: boolean;\n}\n\nexport interface SandboxFallbackDecision extends SandboxDecision {\n\tallowShell: boolean;\n\tallowExec: boolean;\n\tallowReadOnlyTools: boolean;\n}\n\nconst SENSITIVE_PATH_PATTERN =\n\t/(?:^|[/\\\\])(?:\\.env(?:\\..*)?|auth\\.json|oauth\\.json|\\.netrc|\\.npmrc|\\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:secret|token|private[_-]?key|credential).*)$/i;\n\nfunction decision(allowed: boolean, rule: string, reason: string): SandboxDecision {\n\treturn { allowed, rule, reason };\n}\n\nfunction normalize(value: string): string {\n\treturn path\n\t\t.resolve(value)\n\t\t.replace(/\\\\/g, \"/\")\n\t\t.replace(/\\/+$/g, (suffix) => (value === suffix ? \"/\" : \"\"));\n}\n\nfunction isInside(parent: string, child: string): boolean {\n\tconst normalizedParent = normalize(parent);\n\tconst normalizedChild = normalize(child);\n\treturn normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}/`);\n}\n\nfunction isSensitivePath(value: string): boolean {\n\treturn SENSITIVE_PATH_PATTERN.test(value.replace(/\\\\/g, \"/\"));\n}\n\nfunction stripGlobSuffix(pattern: string): string {\n\tif (pattern.endsWith(\"/**\")) return pattern.slice(0, -3);\n\tif (pattern.endsWith(\"/*\")) return pattern.slice(0, -2);\n\treturn pattern;\n}\n\nfunction matchesPattern(pattern: string, candidate: string): boolean {\n\tconst normalizedPattern = normalize(stripGlobSuffix(pattern));\n\tconst normalizedCandidate = normalize(candidate);\n\treturn normalizedCandidate === normalizedPattern || normalizedCandidate.startsWith(`${normalizedPattern}/`);\n}\n\nfunction matchesAny(patterns: readonly string[], candidate: string): boolean {\n\treturn patterns.some((pattern) => matchesPattern(pattern, candidate));\n}\n\nfunction resolvedDecisionPath(resolved: ResolvedSandboxPath): string | undefined {\n\treturn resolved.realPath ?? resolved.nearestExistingParentRealPath;\n}\n\nfunction rootEscaped(policy: SandboxPolicy, resolved: ResolvedSandboxPath): boolean {\n\tconst candidate = resolvedDecisionPath(resolved);\n\treturn candidate === undefined || !isInside(policy.filesystem.root, candidate);\n}\n\nexport function decidePathAccess(\n\tpolicy: SandboxPolicy,\n\trequest: PathAccessRequest,\n\tresolver: SandboxPathResolver,\n): SandboxDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\");\n\t}\n\n\tif (request.path.includes(\"\\0\")) {\n\t\treturn decision(false, \"path.invalid\", \"Path contains a NUL byte.\");\n\t}\n\n\tif (isSensitivePath(request.path)) {\n\t\treturn decision(false, \"path.secret\", \"Sensitive credential-like paths are denied.\");\n\t}\n\n\tconst resolved = resolver(request.path);\n\tif (resolved.error) {\n\t\treturn decision(false, \"path.resolve_error\", resolved.error);\n\t}\n\tif (rootEscaped(policy, resolved)) {\n\t\treturn decision(false, \"path.root_escape\", \"Resolved path is outside the sandbox root.\");\n\t}\n\tif (resolved.isSymlink && !policy.filesystem.followSymlinks) {\n\t\treturn decision(false, \"path.symlink\", \"Symlink traversal is denied by policy.\");\n\t}\n\n\tconst candidate = resolvedDecisionPath(resolved) ?? request.path;\n\tif (request.kind === \"read\") {\n\t\tif (matchesAny(policy.filesystem.readDeny, candidate) || matchesAny(policy.filesystem.readDeny, request.path)) {\n\t\t\treturn decision(false, \"path.read_deny\", \"Read path matches a deny rule.\");\n\t\t}\n\t\tif (!matchesAny(policy.filesystem.readAllow, candidate)) {\n\t\t\treturn decision(false, \"path.read_not_allowed\", \"Read path is not in an allow rule.\");\n\t\t}\n\t\treturn decision(true, \"path.read_allow\", \"Read path is allowed.\");\n\t}\n\n\tif (matchesAny(policy.filesystem.denyWrite, candidate) || matchesAny(policy.filesystem.denyWrite, request.path)) {\n\t\treturn decision(false, \"path.deny_write\", \"Write path matches an unoverrideable denyWrite rule.\");\n\t}\n\tif (matchesAny(policy.filesystem.writeAllow, candidate) || matchesAny(policy.filesystem.tempWrite, candidate)) {\n\t\treturn decision(true, \"path.write_allow\", \"Write path is allowed.\");\n\t}\n\treturn decision(false, \"path.write_not_allowed\", \"Write path is not in an allow rule.\");\n}\n\nfunction hostFromRequest(request: NetworkAccessRequest): string | undefined {\n\tif (request.host) return request.host.toLowerCase();\n\tif (!request.url) return undefined;\n\ttry {\n\t\treturn new URL(request.url).hostname.toLowerCase();\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hostMatches(patterns: readonly string[], host: string): boolean {\n\treturn patterns.some((pattern) => {\n\t\tconst normalized = pattern.toLowerCase();\n\t\treturn host === normalized || host.endsWith(`.${normalized}`);\n\t});\n}\n\nexport function decideNetworkAccess(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision {\n\tif (policy.mode === \"off\") return decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\");\n\tif (request.browser || request.unixSocketPath) {\n\t\treturn decision(false, \"network.socket_or_browser\", \"Browser and Unix socket access is denied by default.\");\n\t}\n\tif (policy.network.mode === \"none\") {\n\t\treturn decision(false, \"network.none\", \"Network access is disabled by policy.\");\n\t}\n\tif (request.loopback) {\n\t\treturn policy.network.mode === \"loopback\" ||\n\t\t\tpolicy.network.mode === \"domain-allowlist\" ||\n\t\t\tpolicy.network.mode === \"all-explicit\"\n\t\t\t? decision(true, \"network.loopback\", \"Loopback access is allowed.\")\n\t\t\t: decision(false, \"network.loopback_denied\", \"Loopback access is denied.\");\n\t}\n\tconst host = hostFromRequest(request);\n\tif (!host) return decision(false, \"network.unknown_host\", \"Network host could not be resolved from request.\");\n\tif (hostMatches(policy.network.deniedDomains, host)) {\n\t\treturn decision(false, \"network.domain_deny\", \"Host matches a denied domain.\");\n\t}\n\tif (policy.network.mode === \"all-explicit\") {\n\t\treturn decision(true, \"network.explicit_all\", \"Explicit network profile allows outbound host access.\");\n\t}\n\tif (policy.network.mode === \"domain-allowlist\" && hostMatches(policy.network.allowedDomains, host)) {\n\t\treturn decision(true, \"network.domain_allow\", \"Host matches an allowed domain.\");\n\t}\n\treturn decision(false, \"network.domain_not_allowed\", \"Host is not allowed by network policy.\");\n}\n\nexport function decideSandboxFallback(policy: SandboxPolicy, backend: SandboxBackendStatus): SandboxFallbackDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\"),\n\t\t\tallowShell: true,\n\t\t\tallowExec: true,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\tif (backend.backendAvailable) {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.backend_available\", \"Sandbox backend is available.\"),\n\t\t\tallowShell: policy.process.allowShell,\n\t\t\tallowExec: policy.process.allowExec,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\tif (policy.mode === \"audit\") {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.audit_fallback\", \"Audit mode permits execution without backend.\"),\n\t\t\tallowShell: true,\n\t\t\tallowExec: true,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\treturn {\n\t\t...decision(false, \"sandbox.backend_missing\", \"Enforce mode blocks shell and exec when no backend is available.\"),\n\t\tallowShell: false,\n\t\tallowExec: false,\n\t\tallowReadOnlyTools: true,\n\t};\n}\n\nexport function mergeSandboxPolicy(\n\tbase: SandboxPolicy,\n\toverride: Partial<SandboxPolicy>,\n\toptions: { allowBroaden?: boolean } = {},\n): SandboxPolicy {\n\tconst allowBroaden = options.allowBroaden === true;\n\treturn {\n\t\tmode: override.mode ?? base.mode,\n\t\tprofile: override.profile ?? base.profile,\n\t\tfilesystem: {\n\t\t\troot: override.filesystem?.root ?? base.filesystem.root,\n\t\t\treadAllow: allowBroaden\n\t\t\t\t? (override.filesystem?.readAllow ?? base.filesystem.readAllow)\n\t\t\t\t: intersectOrBase(base.filesystem.readAllow, override.filesystem?.readAllow),\n\t\t\treadDeny: union(base.filesystem.readDeny, override.filesystem?.readDeny),\n\t\t\twriteAllow: allowBroaden\n\t\t\t\t? (override.filesystem?.writeAllow ?? base.filesystem.writeAllow)\n\t\t\t\t: intersectOrBase(base.filesystem.writeAllow, override.filesystem?.writeAllow),\n\t\t\tdenyWrite: union(base.filesystem.denyWrite, override.filesystem?.denyWrite),\n\t\t\ttempWrite: allowBroaden\n\t\t\t\t? (override.filesystem?.tempWrite ?? base.filesystem.tempWrite)\n\t\t\t\t: intersectOrBase(base.filesystem.tempWrite, override.filesystem?.tempWrite),\n\t\t\tfollowSymlinks: false,\n\t\t},\n\t\tnetwork: {\n\t\t\tmode: allowBroaden\n\t\t\t\t? (override.network?.mode ?? base.network.mode)\n\t\t\t\t: narrowNetworkMode(base.network.mode, override.network?.mode),\n\t\t\tallowedDomains: allowBroaden\n\t\t\t\t? (override.network?.allowedDomains ?? base.network.allowedDomains)\n\t\t\t\t: intersectOrBase(base.network.allowedDomains, override.network?.allowedDomains),\n\t\t\tdeniedDomains: union(base.network.deniedDomains, override.network?.deniedDomains),\n\t\t\tallowUnixSockets: allowBroaden\n\t\t\t\t? (override.network?.allowUnixSockets ?? base.network.allowUnixSockets)\n\t\t\t\t: intersectOrBase(base.network.allowUnixSockets, override.network?.allowUnixSockets),\n\t\t\tallowBrowser: false,\n\t\t},\n\t\tprocess: {\n\t\t\tallowExec: allowBroaden\n\t\t\t\t? (override.process?.allowExec ?? base.process.allowExec)\n\t\t\t\t: base.process.allowExec && (override.process?.allowExec ?? true),\n\t\t\tallowShell: allowBroaden\n\t\t\t\t? (override.process?.allowShell ?? base.process.allowShell)\n\t\t\t\t: base.process.allowShell && (override.process?.allowShell ?? true),\n\t\t\tallowPrivilege: false,\n\t\t},\n\t};\n}\n\nfunction union(base: readonly string[], override: readonly string[] | undefined): string[] {\n\treturn [...new Set([...base, ...(override ?? [])])];\n}\n\nfunction intersectOrBase(base: readonly string[], override: readonly string[] | undefined): string[] {\n\tif (override === undefined) return [...base];\n\tconst result: string[] = [];\n\tfor (const candidate of override) {\n\t\tfor (const entry of base) {\n\t\t\tif (normalize(candidate) === normalize(entry)) {\n\t\t\t\tresult.push(candidate);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (matchesPattern(entry, candidate)) {\n\t\t\t\tresult.push(candidate);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (matchesPattern(candidate, entry)) {\n\t\t\t\tresult.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn [...new Set(result)];\n}\n\nfunction narrowNetworkMode(base: NetworkMode, override: NetworkMode | undefined): NetworkMode {\n\tif (override === undefined) return base;\n\tconst rank: Record<NetworkMode, number> = { none: 0, loopback: 1, \"domain-allowlist\": 2, \"all-explicit\": 3 };\n\treturn rank[override] <= rank[base] ? override : base;\n}\n\nexport interface BashSpawnPreflightContext {\n\tcommand: string;\n\tcwd: string;\n}\n\nexport interface BashSpawnPreflightDecision extends SandboxDecision {\n\tallowShell: boolean;\n}\n\n/**\n * Final pure preflight for a local bash spawn. Combines the backend-availability\n * fallback (deny shell when an OS sandbox backend is missing under enforce mode)\n * with a working-directory containment check (deny when cwd resolves outside the\n * sandbox root). This helper does not itself wrap the process in an OS sandbox; it\n * only decides whether the spawn may proceed.\n */\nexport function preflightBashSpawn(\n\tpolicy: SandboxPolicy,\n\tbackend: SandboxBackendStatus,\n\tcontext: BashSpawnPreflightContext,\n\tresolver?: SandboxPathResolver,\n): BashSpawnPreflightDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn { ...decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\"), allowShell: true };\n\t}\n\tif (!policy.process.allowShell) {\n\t\treturn {\n\t\t\t...decision(false, \"process.shell_denied\", \"Shell execution is disabled by policy.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\tconst fallback = decideSandboxFallback(policy, backend);\n\tif (!fallback.allowShell) {\n\t\treturn { ...decision(false, fallback.rule, fallback.reason), allowShell: false };\n\t}\n\tif (context.cwd.includes(\"\\0\")) {\n\t\treturn { ...decision(false, \"cwd.invalid\", \"Working directory contains a NUL byte.\"), allowShell: false };\n\t}\n\tconst resolved = resolver?.(context.cwd);\n\tif (resolved?.error) {\n\t\treturn { ...decision(false, \"cwd.resolve_error\", resolved.error), allowShell: false };\n\t}\n\tif (resolved?.isSymlink) {\n\t\treturn {\n\t\t\t...decision(false, \"cwd.symlink\", \"Working directory is a symlink and traversal is denied.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\tconst candidate = resolved ? (resolvedDecisionPath(resolved) ?? context.cwd) : context.cwd;\n\tif (!isInside(policy.filesystem.root, candidate)) {\n\t\treturn {\n\t\t\t...decision(false, \"cwd.root_escape\", \"Working directory is outside the sandbox root.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\treturn {\n\t\t...decision(true, \"sandbox.shell_preflight_ok\", \"Bash spawn is permitted by sandbox policy.\"),\n\t\tallowShell: true,\n\t};\n}\n"]}

package/dist/core/sandbox/policy.js

@@ -0,0 +1,280 @@
+import path from "node:path";
+const SENSITIVE_PATH_PATTERN = /(?:^|[/\\])(?:\.env(?:\..*)?|auth\.json|oauth\.json|\.netrc|\.npmrc|\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:secret|token|private[_-]?key|credential).*)$/i;
+function decision(allowed, rule, reason) {
+    return { allowed, rule, reason };
+}
+function normalize(value) {
+    return path
+        .resolve(value)
+        .replace(/\\/g, "/")
+        .replace(/\/+$/g, (suffix) => (value === suffix ? "/" : ""));
+}
+function isInside(parent, child) {
+    const normalizedParent = normalize(parent);
+    const normalizedChild = normalize(child);
+    return normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}/`);
+}
+function isSensitivePath(value) {
+    return SENSITIVE_PATH_PATTERN.test(value.replace(/\\/g, "/"));
+}
+function stripGlobSuffix(pattern) {
+    if (pattern.endsWith("/**"))
+        return pattern.slice(0, -3);
+    if (pattern.endsWith("/*"))
+        return pattern.slice(0, -2);
+    return pattern;
+}
+function matchesPattern(pattern, candidate) {
+    const normalizedPattern = normalize(stripGlobSuffix(pattern));
+    const normalizedCandidate = normalize(candidate);
+    return normalizedCandidate === normalizedPattern || normalizedCandidate.startsWith(`${normalizedPattern}/`);
+}
+function matchesAny(patterns, candidate) {
+    return patterns.some((pattern) => matchesPattern(pattern, candidate));
+}
+function resolvedDecisionPath(resolved) {
+    return resolved.realPath ?? resolved.nearestExistingParentRealPath;
+}
+function rootEscaped(policy, resolved) {
+    const candidate = resolvedDecisionPath(resolved);
+    return candidate === undefined || !isInside(policy.filesystem.root, candidate);
+}
+export function decidePathAccess(policy, request, resolver) {
+    if (policy.mode === "off") {
+        return decision(true, "sandbox.off", "Sandbox policy is disabled.");
+    }
+    if (request.path.includes("\0")) {
+        return decision(false, "path.invalid", "Path contains a NUL byte.");
+    }
+    if (isSensitivePath(request.path)) {
+        return decision(false, "path.secret", "Sensitive credential-like paths are denied.");
+    }
+    const resolved = resolver(request.path);
+    if (resolved.error) {
+        return decision(false, "path.resolve_error", resolved.error);
+    }
+    if (rootEscaped(policy, resolved)) {
+        return decision(false, "path.root_escape", "Resolved path is outside the sandbox root.");
+    }
+    if (resolved.isSymlink && !policy.filesystem.followSymlinks) {
+        return decision(false, "path.symlink", "Symlink traversal is denied by policy.");
+    }
+    const candidate = resolvedDecisionPath(resolved) ?? request.path;
+    if (request.kind === "read") {
+        if (matchesAny(policy.filesystem.readDeny, candidate) || matchesAny(policy.filesystem.readDeny, request.path)) {
+            return decision(false, "path.read_deny", "Read path matches a deny rule.");
+        }
+        if (!matchesAny(policy.filesystem.readAllow, candidate)) {
+            return decision(false, "path.read_not_allowed", "Read path is not in an allow rule.");
+        }
+        return decision(true, "path.read_allow", "Read path is allowed.");
+    }
+    if (matchesAny(policy.filesystem.denyWrite, candidate) || matchesAny(policy.filesystem.denyWrite, request.path)) {
+        return decision(false, "path.deny_write", "Write path matches an unoverrideable denyWrite rule.");
+    }
+    if (matchesAny(policy.filesystem.writeAllow, candidate) || matchesAny(policy.filesystem.tempWrite, candidate)) {
+        return decision(true, "path.write_allow", "Write path is allowed.");
+    }
+    return decision(false, "path.write_not_allowed", "Write path is not in an allow rule.");
+}
+function hostFromRequest(request) {
+    if (request.host)
+        return request.host.toLowerCase();
+    if (!request.url)
+        return undefined;
+    try {
+        return new URL(request.url).hostname.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+function hostMatches(patterns, host) {
+    return patterns.some((pattern) => {
+        const normalized = pattern.toLowerCase();
+        return host === normalized || host.endsWith(`.${normalized}`);
+    });
+}
+export function decideNetworkAccess(policy, request) {
+    if (policy.mode === "off")
+        return decision(true, "sandbox.off", "Sandbox policy is disabled.");
+    if (request.browser || request.unixSocketPath) {
+        return decision(false, "network.socket_or_browser", "Browser and Unix socket access is denied by default.");
+    }
+    if (policy.network.mode === "none") {
+        return decision(false, "network.none", "Network access is disabled by policy.");
+    }
+    if (request.loopback) {
+        return policy.network.mode === "loopback" ||
+            policy.network.mode === "domain-allowlist" ||
+            policy.network.mode === "all-explicit"
+            ? decision(true, "network.loopback", "Loopback access is allowed.")
+            : decision(false, "network.loopback_denied", "Loopback access is denied.");
+    }
+    const host = hostFromRequest(request);
+    if (!host)
+        return decision(false, "network.unknown_host", "Network host could not be resolved from request.");
+    if (hostMatches(policy.network.deniedDomains, host)) {
+        return decision(false, "network.domain_deny", "Host matches a denied domain.");
+    }
+    if (policy.network.mode === "all-explicit") {
+        return decision(true, "network.explicit_all", "Explicit network profile allows outbound host access.");
+    }
+    if (policy.network.mode === "domain-allowlist" && hostMatches(policy.network.allowedDomains, host)) {
+        return decision(true, "network.domain_allow", "Host matches an allowed domain.");
+    }
+    return decision(false, "network.domain_not_allowed", "Host is not allowed by network policy.");
+}
+export function decideSandboxFallback(policy, backend) {
+    if (policy.mode === "off") {
+        return {
+            ...decision(true, "sandbox.off", "Sandbox policy is disabled."),
+            allowShell: true,
+            allowExec: true,
+            allowReadOnlyTools: true,
+        };
+    }
+    if (backend.backendAvailable) {
+        return {
+            ...decision(true, "sandbox.backend_available", "Sandbox backend is available."),
+            allowShell: policy.process.allowShell,
+            allowExec: policy.process.allowExec,
+            allowReadOnlyTools: true,
+        };
+    }
+    if (policy.mode === "audit") {
+        return {
+            ...decision(true, "sandbox.audit_fallback", "Audit mode permits execution without backend."),
+            allowShell: true,
+            allowExec: true,
+            allowReadOnlyTools: true,
+        };
+    }
+    return {
+        ...decision(false, "sandbox.backend_missing", "Enforce mode blocks shell and exec when no backend is available."),
+        allowShell: false,
+        allowExec: false,
+        allowReadOnlyTools: true,
+    };
+}
+export function mergeSandboxPolicy(base, override, options = {}) {
+    const allowBroaden = options.allowBroaden === true;
+    return {
+        mode: override.mode ?? base.mode,
+        profile: override.profile ?? base.profile,
+        filesystem: {
+            root: override.filesystem?.root ?? base.filesystem.root,
+            readAllow: allowBroaden
+                ? (override.filesystem?.readAllow ?? base.filesystem.readAllow)
+                : intersectOrBase(base.filesystem.readAllow, override.filesystem?.readAllow),
+            readDeny: union(base.filesystem.readDeny, override.filesystem?.readDeny),
+            writeAllow: allowBroaden
+                ? (override.filesystem?.writeAllow ?? base.filesystem.writeAllow)
+                : intersectOrBase(base.filesystem.writeAllow, override.filesystem?.writeAllow),
+            denyWrite: union(base.filesystem.denyWrite, override.filesystem?.denyWrite),
+            tempWrite: allowBroaden
+                ? (override.filesystem?.tempWrite ?? base.filesystem.tempWrite)
+                : intersectOrBase(base.filesystem.tempWrite, override.filesystem?.tempWrite),
+            followSymlinks: false,
+        },
+        network: {
+            mode: allowBroaden
+                ? (override.network?.mode ?? base.network.mode)
+                : narrowNetworkMode(base.network.mode, override.network?.mode),
+            allowedDomains: allowBroaden
+                ? (override.network?.allowedDomains ?? base.network.allowedDomains)
+                : intersectOrBase(base.network.allowedDomains, override.network?.allowedDomains),
+            deniedDomains: union(base.network.deniedDomains, override.network?.deniedDomains),
+            allowUnixSockets: allowBroaden
+                ? (override.network?.allowUnixSockets ?? base.network.allowUnixSockets)
+                : intersectOrBase(base.network.allowUnixSockets, override.network?.allowUnixSockets),
+            allowBrowser: false,
+        },
+        process: {
+            allowExec: allowBroaden
+                ? (override.process?.allowExec ?? base.process.allowExec)
+                : base.process.allowExec && (override.process?.allowExec ?? true),
+            allowShell: allowBroaden
+                ? (override.process?.allowShell ?? base.process.allowShell)
+                : base.process.allowShell && (override.process?.allowShell ?? true),
+            allowPrivilege: false,
+        },
+    };
+}
+function union(base, override) {
+    return [...new Set([...base, ...(override ?? [])])];
+}
+function intersectOrBase(base, override) {
+    if (override === undefined)
+        return [...base];
+    const result = [];
+    for (const candidate of override) {
+        for (const entry of base) {
+            if (normalize(candidate) === normalize(entry)) {
+                result.push(candidate);
+                continue;
+            }
+            if (matchesPattern(entry, candidate)) {
+                result.push(candidate);
+                continue;
+            }
+            if (matchesPattern(candidate, entry)) {
+                result.push(entry);
+            }
+        }
+    }
+    return [...new Set(result)];
+}
+function narrowNetworkMode(base, override) {
+    if (override === undefined)
+        return base;
+    const rank = { none: 0, loopback: 1, "domain-allowlist": 2, "all-explicit": 3 };
+    return rank[override] <= rank[base] ? override : base;
+}
+/**
+ * Final pure preflight for a local bash spawn. Combines the backend-availability
+ * fallback (deny shell when an OS sandbox backend is missing under enforce mode)
+ * with a working-directory containment check (deny when cwd resolves outside the
+ * sandbox root). This helper does not itself wrap the process in an OS sandbox; it
+ * only decides whether the spawn may proceed.
+ */
+export function preflightBashSpawn(policy, backend, context, resolver) {
+    if (policy.mode === "off") {
+        return { ...decision(true, "sandbox.off", "Sandbox policy is disabled."), allowShell: true };
+    }
+    if (!policy.process.allowShell) {
+        return {
+            ...decision(false, "process.shell_denied", "Shell execution is disabled by policy."),
+            allowShell: false,
+        };
+    }
+    const fallback = decideSandboxFallback(policy, backend);
+    if (!fallback.allowShell) {
+        return { ...decision(false, fallback.rule, fallback.reason), allowShell: false };
+    }
+    if (context.cwd.includes("\0")) {
+        return { ...decision(false, "cwd.invalid", "Working directory contains a NUL byte."), allowShell: false };
+    }
+    const resolved = resolver?.(context.cwd);
+    if (resolved?.error) {
+        return { ...decision(false, "cwd.resolve_error", resolved.error), allowShell: false };
+    }
+    if (resolved?.isSymlink) {
+        return {
+            ...decision(false, "cwd.symlink", "Working directory is a symlink and traversal is denied."),
+            allowShell: false,
+        };
+    }
+    const candidate = resolved ? (resolvedDecisionPath(resolved) ?? context.cwd) : context.cwd;
+    if (!isInside(policy.filesystem.root, candidate)) {
+        return {
+            ...decision(false, "cwd.root_escape", "Working directory is outside the sandbox root."),
+            allowShell: false,
+        };
+    }
+    return {
+        ...decision(true, "sandbox.shell_preflight_ok", "Bash spawn is permitted by sandbox policy."),
+        allowShell: true,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/core/sandbox/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/core/sandbox/policy.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AA4E7B,MAAM,sBAAsB,GAC3B,+KAA+K,CAAC;AAEjL,SAAS,QAAQ,CAAC,OAAgB,EAAE,IAAY,EAAE,MAAc,EAAmB;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACjC;AAED,SAAS,SAAS,CAAC,KAAa,EAAU;IACzC,OAAO,IAAI;SACT,OAAO,CAAC,KAAK,CAAC;SACd,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa,EAAW;IACzD,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,eAAe,KAAK,gBAAgB,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAAA,CAClG;AAED,SAAS,eAAe,CAAC,KAAa,EAAW;IAChD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,eAAe,CAAC,OAAe,EAAU;IACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,SAAiB,EAAW;IACpE,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,MAAM,mBAAmB,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,mBAAmB,KAAK,iBAAiB,IAAI,mBAAmB,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,UAAU,CAAC,QAA2B,EAAE,SAAiB,EAAW;IAC5E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAAA,CACtE;AAED,SAAS,oBAAoB,CAAC,QAA6B,EAAsB;IAChF,OAAO,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,6BAA6B,CAAC;AAAA,CACnE;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,QAA6B,EAAW;IACnF,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,CAC/E;AAED,MAAM,UAAU,gBAAgB,CAC/B,MAAqB,EACrB,OAA0B,EAC1B,QAA6B,EACX;IAClB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,6BAA6B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,6CAA6C,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/G,OAAO,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAC,KAAK,EAAE,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjH,OAAO,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/G,OAAO,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,EAAE,wBAAwB,EAAE,qCAAqC,CAAC,CAAC;AAAA,CACxF;AAED,SAAS,eAAe,CAAC,OAA6B,EAAsB;IAC3E,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,WAAW,CAAC,QAA2B,EAAE,IAAY,EAAW;IACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IAAA,CAC9D,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,OAA6B,EAAmB;IAC1G,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,6BAA6B,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,KAAK,EAAE,2BAA2B,EAAE,sDAAsD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,uCAAuC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YACxC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc;YACtC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,6BAA6B,CAAC;YACnE,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;IAC9G,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,KAAK,EAAE,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,uDAAuD,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QACpG,OAAO,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,iCAAiC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,EAAE,4BAA4B,EAAE,wCAAwC,CAAC,CAAC;AAAA,CAC/F;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,OAA6B,EAA2B;IACpH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACN,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,6BAA6B,CAAC;YAC/D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI;SACxB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACN,GAAG,QAAQ,CAAC,IAAI,EAAE,2BAA2B,EAAE,+BAA+B,CAAC;YAC/E,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,kBAAkB,EAAE,IAAI;SACxB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO;YACN,GAAG,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,+CAA+C,CAAC;YAC5F,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI;SACxB,CAAC;IACH,CAAC;IACD,OAAO;QACN,GAAG,QAAQ,CAAC,KAAK,EAAE,yBAAyB,EAAE,kEAAkE,CAAC;QACjH,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,KAAK;QAChB,kBAAkB,EAAE,IAAI;KACxB,CAAC;AAAA,CACF;AAED,MAAM,UAAU,kBAAkB,CACjC,IAAmB,EACnB,QAAgC,EAChC,OAAO,GAA+B,EAAE,EACxB;IAChB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,OAAO;QACN,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAChC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QACzC,UAAU,EAAE;YACX,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI;YACvD,SAAS,EAAE,YAAY;gBACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;YAC7E,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;YACxE,UAAU,EAAE,YAAY;gBACvB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBACjE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;YAC/E,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;YAC3E,SAAS,EAAE,YAAY;gBACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;YAC7E,cAAc,EAAE,KAAK;SACrB;QACD,OAAO,EAAE;YACR,IAAI,EAAE,YAAY;gBACjB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/C,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YAC/D,cAAc,EAAE,YAAY;gBAC3B,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBACnE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;YACjF,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YACjF,gBAAgB,EAAE,YAAY;gBAC7B,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBACvE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;YACrF,YAAY,EAAE,KAAK;SACnB;QACD,OAAO,EAAE;YACR,SAAS,EAAE,YAAY;gBACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;YAClE,UAAU,EAAE,YAAY;gBACvB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;YACpE,cAAc,EAAE,KAAK;SACrB;KACD,CAAC;AAAA,CACF;AAED,SAAS,KAAK,CAAC,IAAuB,EAAE,QAAuC,EAAY;IAC1F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACpD;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,QAAuC,EAAY;IACpG,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,SAAS;YACV,CAAC;YACD,IAAI,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,SAAS;YACV,CAAC;YACD,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAAA,CAC5B;AAED,SAAS,iBAAiB,CAAC,IAAiB,EAAE,QAAiC,EAAe;IAC7F,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,IAAI,GAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAC7G,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACtD;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAqB,EACrB,OAA6B,EAC7B,OAAkC,EAClC,QAA8B,EACD;IAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,6BAA6B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO;YACN,GAAG,QAAQ,CAAC,KAAK,EAAE,sBAAsB,EAAE,wCAAwC,CAAC;YACpF,UAAU,EAAE,KAAK;SACjB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,wCAAwC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;QACzB,OAAO;YACN,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,yDAAyD,CAAC;YAC5F,UAAU,EAAE,KAAK;SACjB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAClD,OAAO;YACN,GAAG,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,gDAAgD,CAAC;YACvF,UAAU,EAAE,KAAK;SACjB,CAAC;IACH,CAAC;IACD,OAAO;QACN,GAAG,QAAQ,CAAC,IAAI,EAAE,4BAA4B,EAAE,4CAA4C,CAAC;QAC7F,UAAU,EAAE,IAAI;KAChB,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\n\nexport type SandboxMode = \"off\" | \"audit\" | \"enforce\";\nexport type SandboxProfile = \"readonly\" | \"workspace-write\" | \"dev-server\" | \"networked\";\nexport type NetworkMode = \"none\" | \"loopback\" | \"domain-allowlist\" | \"all-explicit\";\nexport type PathAccessKind = \"read\" | \"write\";\nexport type SandboxPlatform = \"linux\" | \"macos\" | \"unsupported\";\n\nexport interface SandboxPolicy {\n\tmode: SandboxMode;\n\tprofile: SandboxProfile;\n\tfilesystem: {\n\t\troot: string;\n\t\treadAllow: readonly string[];\n\t\treadDeny: readonly string[];\n\t\twriteAllow: readonly string[];\n\t\tdenyWrite: readonly string[];\n\t\ttempWrite: readonly string[];\n\t\tfollowSymlinks: false;\n\t};\n\tnetwork: {\n\t\tmode: NetworkMode;\n\t\tallowedDomains: readonly string[];\n\t\tdeniedDomains: readonly string[];\n\t\tallowUnixSockets: readonly string[];\n\t\tallowBrowser: false;\n\t};\n\tprocess: {\n\t\tallowExec: boolean;\n\t\tallowShell: boolean;\n\t\tallowPrivilege: false;\n\t};\n}\n\nexport interface ResolvedSandboxPath {\n\trequestedPath: string;\n\texists: boolean;\n\trealPath?: string;\n\tnearestExistingParentRealPath?: string;\n\tisSymlink?: boolean;\n\terror?: string;\n}\n\nexport type SandboxPathResolver = (requestPath: string) => ResolvedSandboxPath;\n\nexport interface PathAccessRequest {\n\tkind: PathAccessKind;\n\tpath: string;\n}\n\nexport interface SandboxDecision {\n\tallowed: boolean;\n\trule: string;\n\treason: string;\n}\n\nexport interface NetworkAccessRequest {\n\thost?: string;\n\turl?: string;\n\tunixSocketPath?: string;\n\tbrowser?: boolean;\n\tloopback?: boolean;\n}\n\nexport interface SandboxBackendStatus {\n\tplatform: SandboxPlatform;\n\tbackendAvailable: boolean;\n\tdomainAllowlistAvailable?: boolean;\n}\n\nexport interface SandboxFallbackDecision extends SandboxDecision {\n\tallowShell: boolean;\n\tallowExec: boolean;\n\tallowReadOnlyTools: boolean;\n}\n\nconst SENSITIVE_PATH_PATTERN =\n\t/(?:^|[/\\\\])(?:\\.env(?:\\..*)?|auth\\.json|oauth\\.json|\\.netrc|\\.npmrc|\\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:secret|token|private[_-]?key|credential).*)$/i;\n\nfunction decision(allowed: boolean, rule: string, reason: string): SandboxDecision {\n\treturn { allowed, rule, reason };\n}\n\nfunction normalize(value: string): string {\n\treturn path\n\t\t.resolve(value)\n\t\t.replace(/\\\\/g, \"/\")\n\t\t.replace(/\\/+$/g, (suffix) => (value === suffix ? \"/\" : \"\"));\n}\n\nfunction isInside(parent: string, child: string): boolean {\n\tconst normalizedParent = normalize(parent);\n\tconst normalizedChild = normalize(child);\n\treturn normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}/`);\n}\n\nfunction isSensitivePath(value: string): boolean {\n\treturn SENSITIVE_PATH_PATTERN.test(value.replace(/\\\\/g, \"/\"));\n}\n\nfunction stripGlobSuffix(pattern: string): string {\n\tif (pattern.endsWith(\"/**\")) return pattern.slice(0, -3);\n\tif (pattern.endsWith(\"/*\")) return pattern.slice(0, -2);\n\treturn pattern;\n}\n\nfunction matchesPattern(pattern: string, candidate: string): boolean {\n\tconst normalizedPattern = normalize(stripGlobSuffix(pattern));\n\tconst normalizedCandidate = normalize(candidate);\n\treturn normalizedCandidate === normalizedPattern || normalizedCandidate.startsWith(`${normalizedPattern}/`);\n}\n\nfunction matchesAny(patterns: readonly string[], candidate: string): boolean {\n\treturn patterns.some((pattern) => matchesPattern(pattern, candidate));\n}\n\nfunction resolvedDecisionPath(resolved: ResolvedSandboxPath): string | undefined {\n\treturn resolved.realPath ?? resolved.nearestExistingParentRealPath;\n}\n\nfunction rootEscaped(policy: SandboxPolicy, resolved: ResolvedSandboxPath): boolean {\n\tconst candidate = resolvedDecisionPath(resolved);\n\treturn candidate === undefined || !isInside(policy.filesystem.root, candidate);\n}\n\nexport function decidePathAccess(\n\tpolicy: SandboxPolicy,\n\trequest: PathAccessRequest,\n\tresolver: SandboxPathResolver,\n): SandboxDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\");\n\t}\n\n\tif (request.path.includes(\"\\0\")) {\n\t\treturn decision(false, \"path.invalid\", \"Path contains a NUL byte.\");\n\t}\n\n\tif (isSensitivePath(request.path)) {\n\t\treturn decision(false, \"path.secret\", \"Sensitive credential-like paths are denied.\");\n\t}\n\n\tconst resolved = resolver(request.path);\n\tif (resolved.error) {\n\t\treturn decision(false, \"path.resolve_error\", resolved.error);\n\t}\n\tif (rootEscaped(policy, resolved)) {\n\t\treturn decision(false, \"path.root_escape\", \"Resolved path is outside the sandbox root.\");\n\t}\n\tif (resolved.isSymlink && !policy.filesystem.followSymlinks) {\n\t\treturn decision(false, \"path.symlink\", \"Symlink traversal is denied by policy.\");\n\t}\n\n\tconst candidate = resolvedDecisionPath(resolved) ?? request.path;\n\tif (request.kind === \"read\") {\n\t\tif (matchesAny(policy.filesystem.readDeny, candidate) || matchesAny(policy.filesystem.readDeny, request.path)) {\n\t\t\treturn decision(false, \"path.read_deny\", \"Read path matches a deny rule.\");\n\t\t}\n\t\tif (!matchesAny(policy.filesystem.readAllow, candidate)) {\n\t\t\treturn decision(false, \"path.read_not_allowed\", \"Read path is not in an allow rule.\");\n\t\t}\n\t\treturn decision(true, \"path.read_allow\", \"Read path is allowed.\");\n\t}\n\n\tif (matchesAny(policy.filesystem.denyWrite, candidate) || matchesAny(policy.filesystem.denyWrite, request.path)) {\n\t\treturn decision(false, \"path.deny_write\", \"Write path matches an unoverrideable denyWrite rule.\");\n\t}\n\tif (matchesAny(policy.filesystem.writeAllow, candidate) || matchesAny(policy.filesystem.tempWrite, candidate)) {\n\t\treturn decision(true, \"path.write_allow\", \"Write path is allowed.\");\n\t}\n\treturn decision(false, \"path.write_not_allowed\", \"Write path is not in an allow rule.\");\n}\n\nfunction hostFromRequest(request: NetworkAccessRequest): string | undefined {\n\tif (request.host) return request.host.toLowerCase();\n\tif (!request.url) return undefined;\n\ttry {\n\t\treturn new URL(request.url).hostname.toLowerCase();\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hostMatches(patterns: readonly string[], host: string): boolean {\n\treturn patterns.some((pattern) => {\n\t\tconst normalized = pattern.toLowerCase();\n\t\treturn host === normalized || host.endsWith(`.${normalized}`);\n\t});\n}\n\nexport function decideNetworkAccess(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision {\n\tif (policy.mode === \"off\") return decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\");\n\tif (request.browser || request.unixSocketPath) {\n\t\treturn decision(false, \"network.socket_or_browser\", \"Browser and Unix socket access is denied by default.\");\n\t}\n\tif (policy.network.mode === \"none\") {\n\t\treturn decision(false, \"network.none\", \"Network access is disabled by policy.\");\n\t}\n\tif (request.loopback) {\n\t\treturn policy.network.mode === \"loopback\" ||\n\t\t\tpolicy.network.mode === \"domain-allowlist\" ||\n\t\t\tpolicy.network.mode === \"all-explicit\"\n\t\t\t? decision(true, \"network.loopback\", \"Loopback access is allowed.\")\n\t\t\t: decision(false, \"network.loopback_denied\", \"Loopback access is denied.\");\n\t}\n\tconst host = hostFromRequest(request);\n\tif (!host) return decision(false, \"network.unknown_host\", \"Network host could not be resolved from request.\");\n\tif (hostMatches(policy.network.deniedDomains, host)) {\n\t\treturn decision(false, \"network.domain_deny\", \"Host matches a denied domain.\");\n\t}\n\tif (policy.network.mode === \"all-explicit\") {\n\t\treturn decision(true, \"network.explicit_all\", \"Explicit network profile allows outbound host access.\");\n\t}\n\tif (policy.network.mode === \"domain-allowlist\" && hostMatches(policy.network.allowedDomains, host)) {\n\t\treturn decision(true, \"network.domain_allow\", \"Host matches an allowed domain.\");\n\t}\n\treturn decision(false, \"network.domain_not_allowed\", \"Host is not allowed by network policy.\");\n}\n\nexport function decideSandboxFallback(policy: SandboxPolicy, backend: SandboxBackendStatus): SandboxFallbackDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\"),\n\t\t\tallowShell: true,\n\t\t\tallowExec: true,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\tif (backend.backendAvailable) {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.backend_available\", \"Sandbox backend is available.\"),\n\t\t\tallowShell: policy.process.allowShell,\n\t\t\tallowExec: policy.process.allowExec,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\tif (policy.mode === \"audit\") {\n\t\treturn {\n\t\t\t...decision(true, \"sandbox.audit_fallback\", \"Audit mode permits execution without backend.\"),\n\t\t\tallowShell: true,\n\t\t\tallowExec: true,\n\t\t\tallowReadOnlyTools: true,\n\t\t};\n\t}\n\treturn {\n\t\t...decision(false, \"sandbox.backend_missing\", \"Enforce mode blocks shell and exec when no backend is available.\"),\n\t\tallowShell: false,\n\t\tallowExec: false,\n\t\tallowReadOnlyTools: true,\n\t};\n}\n\nexport function mergeSandboxPolicy(\n\tbase: SandboxPolicy,\n\toverride: Partial<SandboxPolicy>,\n\toptions: { allowBroaden?: boolean } = {},\n): SandboxPolicy {\n\tconst allowBroaden = options.allowBroaden === true;\n\treturn {\n\t\tmode: override.mode ?? base.mode,\n\t\tprofile: override.profile ?? base.profile,\n\t\tfilesystem: {\n\t\t\troot: override.filesystem?.root ?? base.filesystem.root,\n\t\t\treadAllow: allowBroaden\n\t\t\t\t? (override.filesystem?.readAllow ?? base.filesystem.readAllow)\n\t\t\t\t: intersectOrBase(base.filesystem.readAllow, override.filesystem?.readAllow),\n\t\t\treadDeny: union(base.filesystem.readDeny, override.filesystem?.readDeny),\n\t\t\twriteAllow: allowBroaden\n\t\t\t\t? (override.filesystem?.writeAllow ?? base.filesystem.writeAllow)\n\t\t\t\t: intersectOrBase(base.filesystem.writeAllow, override.filesystem?.writeAllow),\n\t\t\tdenyWrite: union(base.filesystem.denyWrite, override.filesystem?.denyWrite),\n\t\t\ttempWrite: allowBroaden\n\t\t\t\t? (override.filesystem?.tempWrite ?? base.filesystem.tempWrite)\n\t\t\t\t: intersectOrBase(base.filesystem.tempWrite, override.filesystem?.tempWrite),\n\t\t\tfollowSymlinks: false,\n\t\t},\n\t\tnetwork: {\n\t\t\tmode: allowBroaden\n\t\t\t\t? (override.network?.mode ?? base.network.mode)\n\t\t\t\t: narrowNetworkMode(base.network.mode, override.network?.mode),\n\t\t\tallowedDomains: allowBroaden\n\t\t\t\t? (override.network?.allowedDomains ?? base.network.allowedDomains)\n\t\t\t\t: intersectOrBase(base.network.allowedDomains, override.network?.allowedDomains),\n\t\t\tdeniedDomains: union(base.network.deniedDomains, override.network?.deniedDomains),\n\t\t\tallowUnixSockets: allowBroaden\n\t\t\t\t? (override.network?.allowUnixSockets ?? base.network.allowUnixSockets)\n\t\t\t\t: intersectOrBase(base.network.allowUnixSockets, override.network?.allowUnixSockets),\n\t\t\tallowBrowser: false,\n\t\t},\n\t\tprocess: {\n\t\t\tallowExec: allowBroaden\n\t\t\t\t? (override.process?.allowExec ?? base.process.allowExec)\n\t\t\t\t: base.process.allowExec && (override.process?.allowExec ?? true),\n\t\t\tallowShell: allowBroaden\n\t\t\t\t? (override.process?.allowShell ?? base.process.allowShell)\n\t\t\t\t: base.process.allowShell && (override.process?.allowShell ?? true),\n\t\t\tallowPrivilege: false,\n\t\t},\n\t};\n}\n\nfunction union(base: readonly string[], override: readonly string[] | undefined): string[] {\n\treturn [...new Set([...base, ...(override ?? [])])];\n}\n\nfunction intersectOrBase(base: readonly string[], override: readonly string[] | undefined): string[] {\n\tif (override === undefined) return [...base];\n\tconst result: string[] = [];\n\tfor (const candidate of override) {\n\t\tfor (const entry of base) {\n\t\t\tif (normalize(candidate) === normalize(entry)) {\n\t\t\t\tresult.push(candidate);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (matchesPattern(entry, candidate)) {\n\t\t\t\tresult.push(candidate);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (matchesPattern(candidate, entry)) {\n\t\t\t\tresult.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn [...new Set(result)];\n}\n\nfunction narrowNetworkMode(base: NetworkMode, override: NetworkMode | undefined): NetworkMode {\n\tif (override === undefined) return base;\n\tconst rank: Record<NetworkMode, number> = { none: 0, loopback: 1, \"domain-allowlist\": 2, \"all-explicit\": 3 };\n\treturn rank[override] <= rank[base] ? override : base;\n}\n\nexport interface BashSpawnPreflightContext {\n\tcommand: string;\n\tcwd: string;\n}\n\nexport interface BashSpawnPreflightDecision extends SandboxDecision {\n\tallowShell: boolean;\n}\n\n/**\n * Final pure preflight for a local bash spawn. Combines the backend-availability\n * fallback (deny shell when an OS sandbox backend is missing under enforce mode)\n * with a working-directory containment check (deny when cwd resolves outside the\n * sandbox root). This helper does not itself wrap the process in an OS sandbox; it\n * only decides whether the spawn may proceed.\n */\nexport function preflightBashSpawn(\n\tpolicy: SandboxPolicy,\n\tbackend: SandboxBackendStatus,\n\tcontext: BashSpawnPreflightContext,\n\tresolver?: SandboxPathResolver,\n): BashSpawnPreflightDecision {\n\tif (policy.mode === \"off\") {\n\t\treturn { ...decision(true, \"sandbox.off\", \"Sandbox policy is disabled.\"), allowShell: true };\n\t}\n\tif (!policy.process.allowShell) {\n\t\treturn {\n\t\t\t...decision(false, \"process.shell_denied\", \"Shell execution is disabled by policy.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\tconst fallback = decideSandboxFallback(policy, backend);\n\tif (!fallback.allowShell) {\n\t\treturn { ...decision(false, fallback.rule, fallback.reason), allowShell: false };\n\t}\n\tif (context.cwd.includes(\"\\0\")) {\n\t\treturn { ...decision(false, \"cwd.invalid\", \"Working directory contains a NUL byte.\"), allowShell: false };\n\t}\n\tconst resolved = resolver?.(context.cwd);\n\tif (resolved?.error) {\n\t\treturn { ...decision(false, \"cwd.resolve_error\", resolved.error), allowShell: false };\n\t}\n\tif (resolved?.isSymlink) {\n\t\treturn {\n\t\t\t...decision(false, \"cwd.symlink\", \"Working directory is a symlink and traversal is denied.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\tconst candidate = resolved ? (resolvedDecisionPath(resolved) ?? context.cwd) : context.cwd;\n\tif (!isInside(policy.filesystem.root, candidate)) {\n\t\treturn {\n\t\t\t...decision(false, \"cwd.root_escape\", \"Working directory is outside the sandbox root.\"),\n\t\t\tallowShell: false,\n\t\t};\n\t}\n\treturn {\n\t\t...decision(true, \"sandbox.shell_preflight_ok\", \"Bash spawn is permitted by sandbox policy.\"),\n\t\tallowShell: true,\n\t};\n}\n"]}

package/dist/core/sandbox/spawn.d.ts

@@ -0,0 +1,20 @@
+import { type SandboxBackendStatus, type SandboxDecision, type SandboxPathResolver, type SandboxPolicy } from "./policy.ts";
+export interface SandboxedSpawnRequestInput {
+    readonly argv: readonly string[];
+    readonly cwd: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly policy: SandboxPolicy;
+    readonly backend: SandboxBackendStatus;
+    readonly resolver?: SandboxPathResolver;
+}
+export type SandboxedSpawnRequest = (SandboxDecision & {
+    readonly allowed: false;
+}) | (SandboxDecision & {
+    readonly allowed: true;
+    readonly argv: readonly string[];
+    readonly cwd: string;
+    readonly env: Record<string, string>;
+    readonly wrapped: boolean;
+});
+export declare function buildSandboxedSpawnRequest(input: SandboxedSpawnRequestInput): SandboxedSpawnRequest;
+//# sourceMappingURL=spawn.d.ts.map

package/dist/core/sandbox/spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/spawn.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,MAAM,qBAAqB,GAC9B,CAAC,eAAe,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,GAC/C,CAAC,eAAe,GAAG;IACnB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CACzB,CAAC,CAAC;AAiDN,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,0BAA0B,GAAG,qBAAqB,CAyCnG","sourcesContent":["import { buildBackendArgv, type SandboxInvocation } from \"./backend.ts\";\nimport { filterSandboxEnv } from \"./env.ts\";\nimport { resolveSandboxPath } from \"./path-resolver.ts\";\nimport {\n\tdecidePathAccess,\n\tdecideSandboxFallback,\n\ttype SandboxBackendStatus,\n\ttype SandboxDecision,\n\ttype SandboxPathResolver,\n\ttype SandboxPolicy,\n} from \"./policy.ts\";\n\nexport interface SandboxedSpawnRequestInput {\n\treadonly argv: readonly string[];\n\treadonly cwd: string;\n\treadonly env: NodeJS.ProcessEnv;\n\treadonly policy: SandboxPolicy;\n\treadonly backend: SandboxBackendStatus;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nexport type SandboxedSpawnRequest =\n\t| (SandboxDecision & { readonly allowed: false })\n\t| (SandboxDecision & {\n\t\t\treadonly allowed: true;\n\t\t\treadonly argv: readonly string[];\n\t\t\treadonly cwd: string;\n\t\t\treadonly env: Record<string, string>;\n\t\t\treadonly wrapped: boolean;\n\t  });\n\nfunction compactEnv(env: NodeJS.ProcessEnv): Record<string, string> {\n\tconst result: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(env)) {\n\t\tif (value !== undefined) result[key] = value;\n\t}\n\treturn result;\n}\n\nfunction denyFrom(decision: SandboxDecision): SandboxedSpawnRequest {\n\treturn { ...decision, allowed: false };\n}\n\nfunction allowUnwrapped(\n\tdecision: SandboxDecision,\n\tinput: SandboxedSpawnRequestInput,\n\tenv: Record<string, string>,\n): SandboxedSpawnRequest {\n\treturn {\n\t\t...decision,\n\t\tallowed: true,\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\twrapped: false,\n\t};\n}\n\nfunction buildInvocation(input: SandboxedSpawnRequestInput, env: Record<string, string>): SandboxInvocation {\n\treturn {\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\tfilesystem: {\n\t\t\troot: input.policy.filesystem.root,\n\t\t\treadAllow: input.policy.filesystem.readAllow,\n\t\t\twriteAllow: input.policy.filesystem.writeAllow,\n\t\t\ttempWrite: input.policy.filesystem.tempWrite,\n\t\t\tdenyWrite: input.policy.filesystem.denyWrite,\n\t\t},\n\t\tnetwork: {\n\t\t\tmode: input.policy.network.mode,\n\t\t\tallowedDomains: input.policy.network.allowedDomains,\n\t\t\tdeniedDomains: input.policy.network.deniedDomains,\n\t\t},\n\t};\n}\n\nexport function buildSandboxedSpawnRequest(input: SandboxedSpawnRequestInput): SandboxedSpawnRequest {\n\tif (input.policy.mode === \"off\") {\n\t\treturn allowUnwrapped(\n\t\t\t{ allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" },\n\t\t\tinput,\n\t\t\tcompactEnv(input.env),\n\t\t);\n\t}\n\n\tconst resolver =\n\t\tinput.resolver ?? ((requestPath: string) => resolveSandboxPath(input.policy.filesystem.root, requestPath));\n\tconst cwdDecision = decidePathAccess(input.policy, { kind: \"read\", path: input.cwd }, resolver);\n\tif (!cwdDecision.allowed) {\n\t\treturn denyFrom(cwdDecision);\n\t}\n\n\tconst env = filterSandboxEnv(input.env);\n\tconst fallback = decideSandboxFallback(input.policy, input.backend);\n\tif (!fallback.allowed || !fallback.allowShell || !fallback.allowExec) {\n\t\treturn denyFrom(fallback);\n\t}\n\tif (!input.backend.backendAvailable) {\n\t\treturn allowUnwrapped(fallback, input, env);\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\t...fallback,\n\t\t\tallowed: true,\n\t\t\targv: buildBackendArgv(input.backend, buildInvocation(input, env)),\n\t\t\tcwd: input.cwd,\n\t\t\tenv,\n\t\t\twrapped: true,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"sandbox.wrap_failed\",\n\t\t\treason: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n"]}

package/dist/core/sandbox/spawn.js

@@ -0,0 +1,80 @@
+import { buildBackendArgv } from "./backend.js";
+import { filterSandboxEnv } from "./env.js";
+import { resolveSandboxPath } from "./path-resolver.js";
+import { decidePathAccess, decideSandboxFallback, } from "./policy.js";
+function compactEnv(env) {
+    const result = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined)
+            result[key] = value;
+    }
+    return result;
+}
+function denyFrom(decision) {
+    return { ...decision, allowed: false };
+}
+function allowUnwrapped(decision, input, env) {
+    return {
+        ...decision,
+        allowed: true,
+        argv: input.argv,
+        cwd: input.cwd,
+        env,
+        wrapped: false,
+    };
+}
+function buildInvocation(input, env) {
+    return {
+        argv: input.argv,
+        cwd: input.cwd,
+        env,
+        filesystem: {
+            root: input.policy.filesystem.root,
+            readAllow: input.policy.filesystem.readAllow,
+            writeAllow: input.policy.filesystem.writeAllow,
+            tempWrite: input.policy.filesystem.tempWrite,
+            denyWrite: input.policy.filesystem.denyWrite,
+        },
+        network: {
+            mode: input.policy.network.mode,
+            allowedDomains: input.policy.network.allowedDomains,
+            deniedDomains: input.policy.network.deniedDomains,
+        },
+    };
+}
+export function buildSandboxedSpawnRequest(input) {
+    if (input.policy.mode === "off") {
+        return allowUnwrapped({ allowed: true, rule: "sandbox.off", reason: "Sandbox policy is disabled." }, input, compactEnv(input.env));
+    }
+    const resolver = input.resolver ?? ((requestPath) => resolveSandboxPath(input.policy.filesystem.root, requestPath));
+    const cwdDecision = decidePathAccess(input.policy, { kind: "read", path: input.cwd }, resolver);
+    if (!cwdDecision.allowed) {
+        return denyFrom(cwdDecision);
+    }
+    const env = filterSandboxEnv(input.env);
+    const fallback = decideSandboxFallback(input.policy, input.backend);
+    if (!fallback.allowed || !fallback.allowShell || !fallback.allowExec) {
+        return denyFrom(fallback);
+    }
+    if (!input.backend.backendAvailable) {
+        return allowUnwrapped(fallback, input, env);
+    }
+    try {
+        return {
+            ...fallback,
+            allowed: true,
+            argv: buildBackendArgv(input.backend, buildInvocation(input, env)),
+            cwd: input.cwd,
+            env,
+            wrapped: true,
+        };
+    }
+    catch (error) {
+        return {
+            allowed: false,
+            rule: "sandbox.wrap_failed",
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=spawn.js.map