open-multi-agent-kit 0.80.6 → 0.80.8

package/dist/core/sandbox/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../src/core/sandbox/spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA0B,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACN,gBAAgB,EAChB,qBAAqB,GAKrB,MAAM,aAAa,CAAC;AAqBrB,SAAS,UAAU,CAAC,GAAsB,EAA0B;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,QAAQ,CAAC,QAAyB,EAAyB;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,CACvC;AAED,SAAS,cAAc,CACtB,QAAyB,EACzB,KAAiC,EACjC,GAA2B,EACH;IACxB,OAAO;QACN,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG;QACH,OAAO,EAAE,KAAK;KACd,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CAAC,KAAiC,EAAE,GAA2B,EAAqB;IAC3G,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG;QACH,UAAU,EAAE;YACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;YAC5C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU;YAC9C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;YAC5C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;SAC5C;QACD,OAAO,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YACnD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa;SACjD;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiC,EAAyB;IACpG,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACjC,OAAO,cAAc,CACpB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAC7E,KAAK,EACL,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CACrB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GACb,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAmB,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC;QACJ,OAAO;YACN,GAAG,QAAQ;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG;YACH,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;IACH,CAAC;AAAA,CACD","sourcesContent":["import { buildBackendArgv, type SandboxInvocation } from \"./backend.ts\";\nimport { filterSandboxEnv } from \"./env.ts\";\nimport { resolveSandboxPath } from \"./path-resolver.ts\";\nimport {\n\tdecidePathAccess,\n\tdecideSandboxFallback,\n\ttype SandboxBackendStatus,\n\ttype SandboxDecision,\n\ttype SandboxPathResolver,\n\ttype SandboxPolicy,\n} from \"./policy.ts\";\n\nexport interface SandboxedSpawnRequestInput {\n\treadonly argv: readonly string[];\n\treadonly cwd: string;\n\treadonly env: NodeJS.ProcessEnv;\n\treadonly policy: SandboxPolicy;\n\treadonly backend: SandboxBackendStatus;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nexport type SandboxedSpawnRequest =\n\t| (SandboxDecision & { readonly allowed: false })\n\t| (SandboxDecision & {\n\t\t\treadonly allowed: true;\n\t\t\treadonly argv: readonly string[];\n\t\t\treadonly cwd: string;\n\t\t\treadonly env: Record<string, string>;\n\t\t\treadonly wrapped: boolean;\n\t  });\n\nfunction compactEnv(env: NodeJS.ProcessEnv): Record<string, string> {\n\tconst result: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(env)) {\n\t\tif (value !== undefined) result[key] = value;\n\t}\n\treturn result;\n}\n\nfunction denyFrom(decision: SandboxDecision): SandboxedSpawnRequest {\n\treturn { ...decision, allowed: false };\n}\n\nfunction allowUnwrapped(\n\tdecision: SandboxDecision,\n\tinput: SandboxedSpawnRequestInput,\n\tenv: Record<string, string>,\n): SandboxedSpawnRequest {\n\treturn {\n\t\t...decision,\n\t\tallowed: true,\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\twrapped: false,\n\t};\n}\n\nfunction buildInvocation(input: SandboxedSpawnRequestInput, env: Record<string, string>): SandboxInvocation {\n\treturn {\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\tfilesystem: {\n\t\t\troot: input.policy.filesystem.root,\n\t\t\treadAllow: input.policy.filesystem.readAllow,\n\t\t\twriteAllow: input.policy.filesystem.writeAllow,\n\t\t\ttempWrite: input.policy.filesystem.tempWrite,\n\t\t\tdenyWrite: input.policy.filesystem.denyWrite,\n\t\t},\n\t\tnetwork: {\n\t\t\tmode: input.policy.network.mode,\n\t\t\tallowedDomains: input.policy.network.allowedDomains,\n\t\t\tdeniedDomains: input.policy.network.deniedDomains,\n\t\t},\n\t};\n}\n\nexport function buildSandboxedSpawnRequest(input: SandboxedSpawnRequestInput): SandboxedSpawnRequest {\n\tif (input.policy.mode === \"off\") {\n\t\treturn allowUnwrapped(\n\t\t\t{ allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" },\n\t\t\tinput,\n\t\t\tcompactEnv(input.env),\n\t\t);\n\t}\n\n\tconst resolver =\n\t\tinput.resolver ?? ((requestPath: string) => resolveSandboxPath(input.policy.filesystem.root, requestPath));\n\tconst cwdDecision = decidePathAccess(input.policy, { kind: \"read\", path: input.cwd }, resolver);\n\tif (!cwdDecision.allowed) {\n\t\treturn denyFrom(cwdDecision);\n\t}\n\n\tconst env = filterSandboxEnv(input.env);\n\tconst fallback = decideSandboxFallback(input.policy, input.backend);\n\tif (!fallback.allowed || !fallback.allowShell || !fallback.allowExec) {\n\t\treturn denyFrom(fallback);\n\t}\n\tif (!input.backend.backendAvailable) {\n\t\treturn allowUnwrapped(fallback, input, env);\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\t...fallback,\n\t\t\tallowed: true,\n\t\t\targv: buildBackendArgv(input.backend, buildInvocation(input, env)),\n\t\t\tcwd: input.cwd,\n\t\t\tenv,\n\t\t\twrapped: true,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"sandbox.wrap_failed\",\n\t\t\treason: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n"]}

package/dist/core/sandbox-policy-v2.d.ts

@@ -0,0 +1,49 @@
+import type { NetworkAccessRequest, PathAccessKind, SandboxDecision, SandboxPathResolver, SandboxPolicy } from "./sandbox/policy.ts";
+export interface PathAccessRequestV2 {
+    readonly kind: PathAccessKind;
+    readonly path: string;
+}
+export interface PolicyDiagnostic {
+    readonly code: string;
+    readonly message: string;
+    readonly severity: "info" | "warn" | "block";
+}
+export interface PathDecisionV2 {
+    readonly requestedPath: string;
+    readonly candidate: string;
+    readonly kind: PathAccessKind;
+    readonly action: "allow" | "block";
+    readonly rule: string;
+    readonly reason: string;
+    readonly matchedPattern?: string;
+}
+export interface EnvDecisionV2 {
+    readonly action: "allow" | "block";
+    readonly rule: string;
+    readonly reason: string;
+    /** Denied variable NAMES only. Values are never recorded. */
+    readonly deniedNames: readonly string[];
+}
+export interface SandboxPolicyV2Decision {
+    readonly action: "allow" | "confirm" | "block";
+    readonly rule: string;
+    readonly reason: string;
+    readonly diagnostics: readonly PolicyDiagnostic[];
+    readonly pathDecisions: readonly PathDecisionV2[];
+    readonly networkDecision?: SandboxDecision;
+    readonly envDecision?: EnvDecisionV2;
+}
+export interface SandboxPolicyV2Input {
+    readonly policy: SandboxPolicy;
+    readonly pathRequests?: readonly PathAccessRequestV2[];
+    readonly networkRequest?: NetworkAccessRequest;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly resolver?: SandboxPathResolver;
+}
+/**
+ * Public: evaluate path / env / network requests against a sandbox policy.
+ * Path and env checks are fail-closed. Audit mode downgrades a would-block
+ * outcome to confirm; enforce mode keeps it block.
+ */
+export declare function evaluateSandboxPolicyV2(input: SandboxPolicyV2Input): SandboxPolicyV2Decision;
+//# sourceMappingURL=sandbox-policy-v2.d.ts.map

package/dist/core/sandbox-policy-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy-v2.d.ts","sourceRoot":"","sources":["../../src/core/sandbox-policy-v2.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACX,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,MAAM,qBAAqB,CAAC;AA+D7B,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAuQD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,CAqE5F","sourcesContent":["/**\n * Lane SA3 - Sandbox Policy V2.\n * allow: SIZE_OK - legacy evaluator; this change only keeps strip-only TypeScript compatibility.\n *\n * Pure fail-closed evaluator that composes path / env / network checks for a\n * sandbox policy. It layers general glob matching (via `minimatch`), realpath\n * normalization (when a resolver is provided), denied-env fail-closed\n * semantics, and IPv4 / IPv6 loopback detection on top of the existing\n * `SandboxPolicy` types. It does not spawn, resolve through the filesystem on\n * its own, or log env values.\n */\nimport path from \"node:path\";\nimport { minimatch } from \"minimatch\";\nimport type {\n\tNetworkAccessRequest,\n\tPathAccessKind,\n\tSandboxDecision,\n\tSandboxPathResolver,\n\tSandboxPolicy,\n} from \"./sandbox/policy.ts\";\n\n/** Exact sensitive environment variable names (do not end in a standard suffix). */\nconst SENSITIVE_ENV_EXACT = new Set<string>([\n\t\"AWS_ACCESS_KEY_ID\",\n\t\"AWS_SECRET_ACCESS_KEY\",\n\t\"AWS_SESSION_TOKEN\",\n\t\"GITHUB_TOKEN\",\n\t\"GH_TOKEN\",\n\t\"GITLAB_TOKEN\",\n\t\"NPM_TOKEN\",\n\t\"NODE_AUTH_TOKEN\",\n]);\n\n/** Sensitive environment variable name suffixes. */\nconst SENSITIVE_ENV_REGEX =\n\t/(^|_)(API_KEY|API_TOKEN|ACCESS_TOKEN|SECRET|SECRET_KEY|PRIVATE_KEY|PASSWORD|PASSWD|TOKEN)$/i;\n\n/**\n * Environment variable names that are always denied because they inject code\n * or redirect runtime loader behavior. Denial is fail-closed: presence of any\n * of these names blocks the policy evaluation regardless of value.\n */\nconst ENV_DENY_NAMES = new Set<string>([\n\t\"LD_PRELOAD\",\n\t\"LD_LIBRARY_PATH\",\n\t\"LD_AUDIT\",\n\t\"LD_BIND_NOW\",\n\t\"LD_PROFILE\",\n\t\"DYLD_INSERT_LIBRARIES\",\n\t\"DYLD_LIBRARY_PATH\",\n\t\"DYLD_FALLBACK_LIBRARY_PATH\",\n\t\"NODE_OPTIONS\",\n\t\"NODE_PATH\",\n\t\"NODE_REPL_EXTERNAL_MODULE\",\n\t\"NODE_EXTRA_CA_CERTS\",\n\t\"NODE_TLS_REJECT_UNAUTHORIZED\",\n\t\"PYTHONPATH\",\n\t\"PYTHONHOME\",\n\t\"PYTHONSTARTUP\",\n\t\"PYTHONINSPECT\",\n\t\"PERL5LIB\",\n\t\"PERLLIB\",\n\t\"PERL5OPT\",\n\t\"RUBYLIB\",\n\t\"RUBYOPT\",\n\t\"RUBYPATH\",\n\t\"JAVA_TOOL_OPTIONS\",\n\t\"_JAVA_OPTIONS\",\n\t\"JDK_JAVA_OPTIONS\",\n\t\"MAVEN_OPTS\",\n]);\n\n/**\n * Matches a URL / DSN with embedded userinfo (`scheme://user:pass@host`).\n * Used for value-based denial; only the variable NAME is ever recorded.\n */\nconst AUTH_URL_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\/[^\\s/@:]+:[^\\s/@]+@[^\\s/@]/i;\n\n/** Path patterns that look like credential / key material on disk. */\nconst SENSITIVE_PATH_REGEX =\n\t/(?:^|[/\\\\])(?:\\.env(?:\\..*)?|auth\\.json|oauth\\.json|\\.netrc|\\.npmrc|\\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:token|private[_-]?key|credential).*)$/i;\n\nexport interface PathAccessRequestV2 {\n\treadonly kind: PathAccessKind;\n\treadonly path: string;\n}\n\nexport interface PolicyDiagnostic {\n\treadonly code: string;\n\treadonly message: string;\n\treadonly severity: \"info\" | \"warn\" | \"block\";\n}\n\nexport interface PathDecisionV2 {\n\treadonly requestedPath: string;\n\treadonly candidate: string;\n\treadonly kind: PathAccessKind;\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly matchedPattern?: string;\n}\n\nexport interface EnvDecisionV2 {\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\t/** Denied variable NAMES only. Values are never recorded. */\n\treadonly deniedNames: readonly string[];\n}\n\nexport interface SandboxPolicyV2Decision {\n\treadonly action: \"allow\" | \"confirm\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly diagnostics: readonly PolicyDiagnostic[];\n\treadonly pathDecisions: readonly PathDecisionV2[];\n\treadonly networkDecision?: SandboxDecision;\n\treadonly envDecision?: EnvDecisionV2;\n}\n\nexport interface SandboxPolicyV2Input {\n\treadonly policy: SandboxPolicy;\n\treadonly pathRequests?: readonly PathAccessRequestV2[];\n\treadonly networkRequest?: NetworkAccessRequest;\n\treadonly env?: Readonly<Record<string, string | undefined>>;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nfunction isSensitiveEnvName(name: string): boolean {\n\tif (SENSITIVE_ENV_EXACT.has(name)) return true;\n\treturn SENSITIVE_ENV_REGEX.test(name);\n}\n\nfunction normalizePathValue(value: string): string {\n\tconst resolved = path.resolve(value);\n\tlet normalized = resolved.replace(/\\\\/g, \"/\");\n\tif (normalized.length > 1) normalized = normalized.replace(/\\/+$/, \"\");\n\treturn normalized;\n}\n\nfunction ruleHasGlob(pattern: string): boolean {\n\treturn /[*?[\\]{}]/.test(pattern);\n}\n\nfunction matchesRule(pattern: string, candidate: string): boolean {\n\tconst normPattern = normalizePathValue(pattern);\n\tconst normCandidate = normalizePathValue(candidate);\n\tif (ruleHasGlob(normPattern)) {\n\t\tif (minimatch(normCandidate, normPattern)) return true;\n\t\t// also accept recursive prefix form even if the writer omitted `/**`\n\t\treturn minimatch(normCandidate, `${normPattern}/**`);\n\t}\n\treturn normCandidate === normPattern || normCandidate.startsWith(`${normPattern}/`);\n}\n\nfunction matchesAny(patterns: readonly string[], candidate: string): { match: boolean; pattern?: string } {\n\tfor (const pattern of patterns) {\n\t\tif (matchesRule(pattern, candidate)) return { match: true, pattern };\n\t}\n\treturn { match: false };\n}\n\nfunction isInsideRoot(root: string, candidate: string): boolean {\n\tconst normRoot = normalizePathValue(root);\n\tconst normCandidate = normalizePathValue(candidate);\n\treturn normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);\n}\n\nfunction isSensitivePath(value: string): boolean {\n\treturn SENSITIVE_PATH_REGEX.test(value.replace(/\\\\/g, \"/\"));\n}\n\n/** True for IPv4 / IPv6 loopback and localhost hostnames. */\nfunction isLoopbackHost(host: string): boolean {\n\tconst h = host\n\t\t.toLowerCase()\n\t\t.replace(/^\\[|\\]$/g, \"\")\n\t\t.trim();\n\tif (h === \"localhost\") return true;\n\tif (h === \"127.0.0.1\" || h === \"::1\" || h === \"0:0:0:0:0:0:0:1\") return true;\n\tif (h === \"::ffff:127.0.0.1\" || h === \"::ffff:7f00:1\") return true;\n\tif (/^127\\./.test(h)) return true;\n\treturn false;\n}\n\nfunction normalizeNetworkLoopback(request: NetworkAccessRequest): NetworkAccessRequest {\n\tlet host = request.host;\n\tif (!host && request.url) {\n\t\ttry {\n\t\t\thost = new URL(request.url).hostname;\n\t\t} catch {\n\t\t\thost = undefined;\n\t\t}\n\t}\n\tif (host && isLoopbackHost(host)) {\n\t\treturn { ...request, host, loopback: true };\n\t}\n\treturn request;\n}\n\nfunction hostFromRequest(request: NetworkAccessRequest): string | undefined {\n\tif (request.host) return request.host.toLowerCase();\n\tif (!request.url) return undefined;\n\ttry {\n\t\treturn new URL(request.url).hostname.toLowerCase();\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hostMatches(patterns: readonly string[], host: string): boolean {\n\tconst h = host.replace(/\\.$/, \"\");\n\tfor (const raw of patterns) {\n\t\tconst p = raw.toLowerCase().replace(/\\.$/, \"\");\n\t\tif (h === p || h.endsWith(`.${p}`)) return true;\n\t}\n\treturn false;\n}\n\nfunction decideNetworkV2(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision {\n\tif (policy.mode === \"off\") return { allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" };\n\tif (request.browser || request.unixSocketPath) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.socket_or_browser\",\n\t\t\treason: \"Browser and Unix socket access is denied by default.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"none\") {\n\t\treturn { allowed: false, rule: \"network.none\", reason: \"Network access is disabled by policy.\" };\n\t}\n\tif (request.loopback) {\n\t\tif (\n\t\t\tpolicy.network.mode === \"loopback\" ||\n\t\t\tpolicy.network.mode === \"domain-allowlist\" ||\n\t\t\tpolicy.network.mode === \"all-explicit\"\n\t\t) {\n\t\t\treturn { allowed: true, rule: \"network.loopback\", reason: \"Loopback access is allowed.\" };\n\t\t}\n\t\treturn { allowed: false, rule: \"network.loopback_denied\", reason: \"Loopback access is denied.\" };\n\t}\n\tconst host = hostFromRequest(request);\n\tif (!host)\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.unknown_host\",\n\t\t\treason: \"Network host could not be resolved from request.\",\n\t\t};\n\tif (hostMatches(policy.network.deniedDomains, host)) {\n\t\treturn { allowed: false, rule: \"network.domain_deny\", reason: \"Host matches a denied domain.\" };\n\t}\n\tif (policy.network.mode === \"all-explicit\") {\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trule: \"network.explicit_all\",\n\t\t\treason: \"Explicit network profile allows outbound host access.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"domain-allowlist\" && hostMatches(policy.network.allowedDomains, host)) {\n\t\treturn { allowed: true, rule: \"network.domain_allow\", reason: \"Host matches an allowed domain.\" };\n\t}\n\treturn { allowed: false, rule: \"network.domain_not_allowed\", reason: \"Host is not allowed by network policy.\" };\n}\n\nfunction decidePathV2(\n\tpolicy: SandboxPolicy,\n\trequest: PathAccessRequestV2,\n\tresolver: SandboxPathResolver | undefined,\n): PathDecisionV2 {\n\tconst requested = request.path;\n\tconst base = (\n\t\trule: string,\n\t\treason: string,\n\t\tcandidate: string,\n\t\taction: \"allow\" | \"block\",\n\t\tmatchedPattern?: string,\n\t): PathDecisionV2 => ({\n\t\trequestedPath: requested,\n\t\tcandidate,\n\t\tkind: request.kind,\n\t\taction,\n\t\trule,\n\t\treason,\n\t\tmatchedPattern,\n\t});\n\tconst block = (rule: string, reason: string, candidate: string, matchedPattern?: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"block\", matchedPattern);\n\tconst allow = (rule: string, reason: string, candidate: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"allow\");\n\n\tif (requested.includes(\"\\0\")) {\n\t\treturn block(\"path.invalid\", \"Path contains a NUL byte.\", requested);\n\t}\n\n\tlet candidate: string;\n\tlet isSymlink = false;\n\tif (resolver) {\n\t\tconst resolved = resolver(requested);\n\t\tif (resolved.error) {\n\t\t\treturn block(\"path.resolve_error\", resolved.error, requested);\n\t\t}\n\t\tcandidate = resolved.realPath ?? resolved.nearestExistingParentRealPath ?? normalizePathValue(requested);\n\t\tisSymlink = resolved.isSymlink === true;\n\t} else {\n\t\tcandidate = normalizePathValue(requested);\n\t}\n\n\tif (isSensitivePath(requested) || isSensitivePath(candidate)) {\n\t\treturn block(\"path.sensitive\", \"Sensitive credential-like path is denied.\", candidate);\n\t}\n\n\tif (!isInsideRoot(policy.filesystem.root, candidate)) {\n\t\treturn block(\"path.root_escape\", \"Resolved path is outside the sandbox root.\", candidate);\n\t}\n\n\tif (isSymlink && !policy.filesystem.followSymlinks) {\n\t\treturn block(\"path.symlink\", \"Symlink traversal is denied by policy.\", candidate);\n\t}\n\n\tif (request.kind === \"read\") {\n\t\tconst denied = matchesAny(policy.filesystem.readDeny, candidate);\n\t\tif (denied.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, denied.pattern);\n\t\t}\n\t\tconst deniedRequested = matchesAny(policy.filesystem.readDeny, requested);\n\t\tif (deniedRequested.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, deniedRequested.pattern);\n\t\t}\n\t\tif (matchesAny(policy.filesystem.readAllow, candidate).match) {\n\t\t\treturn allow(\"path.read_allow\", \"Read path is allowed.\", candidate);\n\t\t}\n\t\treturn block(\"path.read_not_allowed\", \"Read path is not in an allow rule.\", candidate);\n\t}\n\n\tconst denyWriteCandidate = matchesAny(policy.filesystem.denyWrite, candidate);\n\tif (denyWriteCandidate.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteCandidate.pattern,\n\t\t);\n\t}\n\tconst denyWriteRequested = matchesAny(policy.filesystem.denyWrite, requested);\n\tif (denyWriteRequested.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteRequested.pattern,\n\t\t);\n\t}\n\tif (\n\t\tmatchesAny(policy.filesystem.writeAllow, candidate).match ||\n\t\tmatchesAny(policy.filesystem.tempWrite, candidate).match\n\t) {\n\t\treturn allow(\"path.write_allow\", \"Write path is allowed.\", candidate);\n\t}\n\treturn block(\"path.write_not_allowed\", \"Write path is not in an allow rule.\", candidate);\n}\n\nfunction decideEnvV2(env: Readonly<Record<string, string | undefined>>): EnvDecisionV2 {\n\tconst denied: string[] = [];\n\tfor (const [name, value] of Object.entries(env)) {\n\t\tif (value === undefined) continue;\n\t\tif (ENV_DENY_NAMES.has(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (isSensitiveEnvName(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (AUTH_URL_REGEX.test(value)) {\n\t\t\t// Value-based denial: the value embeds credentials. Record NAME only.\n\t\t\tdenied.push(name);\n\t\t}\n\t}\n\tif (denied.length > 0) {\n\t\treturn {\n\t\t\taction: \"block\",\n\t\t\trule: \"env.denied_pattern\",\n\t\t\treason: `Environment contains denied variable(s): ${denied.join(\", \")}.`,\n\t\t\tdeniedNames: denied,\n\t\t};\n\t}\n\treturn { action: \"allow\", rule: \"env.allow\", reason: \"No denied environment variables.\", deniedNames: [] };\n}\n\n/**\n * Public: evaluate path / env / network requests against a sandbox policy.\n * Path and env checks are fail-closed. Audit mode downgrades a would-block\n * outcome to confirm; enforce mode keeps it block.\n */\nexport function evaluateSandboxPolicyV2(input: SandboxPolicyV2Input): SandboxPolicyV2Decision {\n\tconst { policy } = input;\n\tconst diagnostics: PolicyDiagnostic[] = [];\n\tconst pathDecisions: PathDecisionV2[] = [];\n\tlet envDecision: EnvDecisionV2 | undefined;\n\tlet networkDecision: SandboxDecision | undefined;\n\tlet worst: \"allow\" | \"block\" = \"block\";\n\n\tif (policy.mode === \"off\") {\n\t\treturn {\n\t\t\taction: \"allow\",\n\t\t\trule: \"sandbox.off\",\n\t\t\treason: \"Sandbox policy is disabled.\",\n\t\t\tdiagnostics,\n\t\t\tpathDecisions,\n\t\t};\n\t}\n\n\t// Default to allow and escalate to block on any failed check.\n\tworst = \"allow\";\n\n\tif (input.env) {\n\t\tenvDecision = decideEnvV2(input.env);\n\t\tif (envDecision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({\n\t\t\t\tcode: envDecision.rule,\n\t\t\t\tmessage: `Denied env name(s): ${envDecision.deniedNames.join(\", \")}`,\n\t\t\t\tseverity: \"block\",\n\t\t\t});\n\t\t}\n\t}\n\n\tfor (const request of input.pathRequests ?? []) {\n\t\tconst decision = decidePathV2(policy, request, input.resolver);\n\t\tpathDecisions.push(decision);\n\t\tif (decision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: decision.rule, message: decision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tif (input.networkRequest) {\n\t\tconst normalized = normalizeNetworkLoopback(input.networkRequest);\n\t\tnetworkDecision = decideNetworkV2(policy, normalized);\n\t\tif (!networkDecision.allowed) {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: networkDecision.rule, message: networkDecision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tlet action: \"allow\" | \"confirm\" | \"block\";\n\tlet rule: string;\n\tlet reason: string;\n\tif (worst === \"allow\") {\n\t\taction = \"allow\";\n\t\trule = \"policy.composite_allow\";\n\t\treason = \"All sandbox checks passed.\";\n\t} else if (policy.mode === \"audit\") {\n\t\taction = \"confirm\";\n\t\trule = \"policy.audit_block\";\n\t\treason = \"Audit mode: a would-block check is downgraded to confirm.\";\n\t} else {\n\t\taction = \"block\";\n\t\trule = \"policy.block\";\n\t\treason = \"One or more sandbox checks blocked the request.\";\n\t}\n\n\treturn { action, rule, reason, diagnostics, pathDecisions, networkDecision, envDecision };\n}\n"]}

package/dist/core/sandbox-policy-v2.js

@@ -0,0 +1,368 @@
+/**
+ * Lane SA3 - Sandbox Policy V2.
+ * allow: SIZE_OK - legacy evaluator; this change only keeps strip-only TypeScript compatibility.
+ *
+ * Pure fail-closed evaluator that composes path / env / network checks for a
+ * sandbox policy. It layers general glob matching (via `minimatch`), realpath
+ * normalization (when a resolver is provided), denied-env fail-closed
+ * semantics, and IPv4 / IPv6 loopback detection on top of the existing
+ * `SandboxPolicy` types. It does not spawn, resolve through the filesystem on
+ * its own, or log env values.
+ */
+import path from "node:path";
+import { minimatch } from "minimatch";
+/** Exact sensitive environment variable names (do not end in a standard suffix). */
+const SENSITIVE_ENV_EXACT = new Set([
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "GITLAB_TOKEN",
+    "NPM_TOKEN",
+    "NODE_AUTH_TOKEN",
+]);
+/** Sensitive environment variable name suffixes. */
+const SENSITIVE_ENV_REGEX = /(^|_)(API_KEY|API_TOKEN|ACCESS_TOKEN|SECRET|SECRET_KEY|PRIVATE_KEY|PASSWORD|PASSWD|TOKEN)$/i;
+/**
+ * Environment variable names that are always denied because they inject code
+ * or redirect runtime loader behavior. Denial is fail-closed: presence of any
+ * of these names blocks the policy evaluation regardless of value.
+ */
+const ENV_DENY_NAMES = new Set([
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "LD_AUDIT",
+    "LD_BIND_NOW",
+    "LD_PROFILE",
+    "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH",
+    "DYLD_FALLBACK_LIBRARY_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "NODE_REPL_EXTERNAL_MODULE",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "PYTHONSTARTUP",
+    "PYTHONINSPECT",
+    "PERL5LIB",
+    "PERLLIB",
+    "PERL5OPT",
+    "RUBYLIB",
+    "RUBYOPT",
+    "RUBYPATH",
+    "JAVA_TOOL_OPTIONS",
+    "_JAVA_OPTIONS",
+    "JDK_JAVA_OPTIONS",
+    "MAVEN_OPTS",
+]);
+/**
+ * Matches a URL / DSN with embedded userinfo (`scheme://user:pass@host`).
+ * Used for value-based denial; only the variable NAME is ever recorded.
+ */
+const AUTH_URL_REGEX = /^[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@[^\s/@]/i;
+/** Path patterns that look like credential / key material on disk. */
+const SENSITIVE_PATH_REGEX = /(?:^|[/\\])(?:\.env(?:\..*)?|auth\.json|oauth\.json|\.netrc|\.npmrc|\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:token|private[_-]?key|credential).*)$/i;
+function isSensitiveEnvName(name) {
+    if (SENSITIVE_ENV_EXACT.has(name))
+        return true;
+    return SENSITIVE_ENV_REGEX.test(name);
+}
+function normalizePathValue(value) {
+    const resolved = path.resolve(value);
+    let normalized = resolved.replace(/\\/g, "/");
+    if (normalized.length > 1)
+        normalized = normalized.replace(/\/+$/, "");
+    return normalized;
+}
+function ruleHasGlob(pattern) {
+    return /[*?[\]{}]/.test(pattern);
+}
+function matchesRule(pattern, candidate) {
+    const normPattern = normalizePathValue(pattern);
+    const normCandidate = normalizePathValue(candidate);
+    if (ruleHasGlob(normPattern)) {
+        if (minimatch(normCandidate, normPattern))
+            return true;
+        // also accept recursive prefix form even if the writer omitted `/**`
+        return minimatch(normCandidate, `${normPattern}/**`);
+    }
+    return normCandidate === normPattern || normCandidate.startsWith(`${normPattern}/`);
+}
+function matchesAny(patterns, candidate) {
+    for (const pattern of patterns) {
+        if (matchesRule(pattern, candidate))
+            return { match: true, pattern };
+    }
+    return { match: false };
+}
+function isInsideRoot(root, candidate) {
+    const normRoot = normalizePathValue(root);
+    const normCandidate = normalizePathValue(candidate);
+    return normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);
+}
+function isSensitivePath(value) {
+    return SENSITIVE_PATH_REGEX.test(value.replace(/\\/g, "/"));
+}
+/** True for IPv4 / IPv6 loopback and localhost hostnames. */
+function isLoopbackHost(host) {
+    const h = host
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "")
+        .trim();
+    if (h === "localhost")
+        return true;
+    if (h === "127.0.0.1" || h === "::1" || h === "0:0:0:0:0:0:0:1")
+        return true;
+    if (h === "::ffff:127.0.0.1" || h === "::ffff:7f00:1")
+        return true;
+    if (/^127\./.test(h))
+        return true;
+    return false;
+}
+function normalizeNetworkLoopback(request) {
+    let host = request.host;
+    if (!host && request.url) {
+        try {
+            host = new URL(request.url).hostname;
+        }
+        catch {
+            host = undefined;
+        }
+    }
+    if (host && isLoopbackHost(host)) {
+        return { ...request, host, loopback: true };
+    }
+    return request;
+}
+function hostFromRequest(request) {
+    if (request.host)
+        return request.host.toLowerCase();
+    if (!request.url)
+        return undefined;
+    try {
+        return new URL(request.url).hostname.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+function hostMatches(patterns, host) {
+    const h = host.replace(/\.$/, "");
+    for (const raw of patterns) {
+        const p = raw.toLowerCase().replace(/\.$/, "");
+        if (h === p || h.endsWith(`.${p}`))
+            return true;
+    }
+    return false;
+}
+function decideNetworkV2(policy, request) {
+    if (policy.mode === "off")
+        return { allowed: true, rule: "sandbox.off", reason: "Sandbox policy is disabled." };
+    if (request.browser || request.unixSocketPath) {
+        return {
+            allowed: false,
+            rule: "network.socket_or_browser",
+            reason: "Browser and Unix socket access is denied by default.",
+        };
+    }
+    if (policy.network.mode === "none") {
+        return { allowed: false, rule: "network.none", reason: "Network access is disabled by policy." };
+    }
+    if (request.loopback) {
+        if (policy.network.mode === "loopback" ||
+            policy.network.mode === "domain-allowlist" ||
+            policy.network.mode === "all-explicit") {
+            return { allowed: true, rule: "network.loopback", reason: "Loopback access is allowed." };
+        }
+        return { allowed: false, rule: "network.loopback_denied", reason: "Loopback access is denied." };
+    }
+    const host = hostFromRequest(request);
+    if (!host)
+        return {
+            allowed: false,
+            rule: "network.unknown_host",
+            reason: "Network host could not be resolved from request.",
+        };
+    if (hostMatches(policy.network.deniedDomains, host)) {
+        return { allowed: false, rule: "network.domain_deny", reason: "Host matches a denied domain." };
+    }
+    if (policy.network.mode === "all-explicit") {
+        return {
+            allowed: true,
+            rule: "network.explicit_all",
+            reason: "Explicit network profile allows outbound host access.",
+        };
+    }
+    if (policy.network.mode === "domain-allowlist" && hostMatches(policy.network.allowedDomains, host)) {
+        return { allowed: true, rule: "network.domain_allow", reason: "Host matches an allowed domain." };
+    }
+    return { allowed: false, rule: "network.domain_not_allowed", reason: "Host is not allowed by network policy." };
+}
+function decidePathV2(policy, request, resolver) {
+    const requested = request.path;
+    const base = (rule, reason, candidate, action, matchedPattern) => ({
+        requestedPath: requested,
+        candidate,
+        kind: request.kind,
+        action,
+        rule,
+        reason,
+        matchedPattern,
+    });
+    const block = (rule, reason, candidate, matchedPattern) => base(rule, reason, candidate, "block", matchedPattern);
+    const allow = (rule, reason, candidate) => base(rule, reason, candidate, "allow");
+    if (requested.includes("\0")) {
+        return block("path.invalid", "Path contains a NUL byte.", requested);
+    }
+    let candidate;
+    let isSymlink = false;
+    if (resolver) {
+        const resolved = resolver(requested);
+        if (resolved.error) {
+            return block("path.resolve_error", resolved.error, requested);
+        }
+        candidate = resolved.realPath ?? resolved.nearestExistingParentRealPath ?? normalizePathValue(requested);
+        isSymlink = resolved.isSymlink === true;
+    }
+    else {
+        candidate = normalizePathValue(requested);
+    }
+    if (isSensitivePath(requested) || isSensitivePath(candidate)) {
+        return block("path.sensitive", "Sensitive credential-like path is denied.", candidate);
+    }
+    if (!isInsideRoot(policy.filesystem.root, candidate)) {
+        return block("path.root_escape", "Resolved path is outside the sandbox root.", candidate);
+    }
+    if (isSymlink && !policy.filesystem.followSymlinks) {
+        return block("path.symlink", "Symlink traversal is denied by policy.", candidate);
+    }
+    if (request.kind === "read") {
+        const denied = matchesAny(policy.filesystem.readDeny, candidate);
+        if (denied.match) {
+            return block("path.read_deny", "Read path matches a deny rule.", candidate, denied.pattern);
+        }
+        const deniedRequested = matchesAny(policy.filesystem.readDeny, requested);
+        if (deniedRequested.match) {
+            return block("path.read_deny", "Read path matches a deny rule.", candidate, deniedRequested.pattern);
+        }
+        if (matchesAny(policy.filesystem.readAllow, candidate).match) {
+            return allow("path.read_allow", "Read path is allowed.", candidate);
+        }
+        return block("path.read_not_allowed", "Read path is not in an allow rule.", candidate);
+    }
+    const denyWriteCandidate = matchesAny(policy.filesystem.denyWrite, candidate);
+    if (denyWriteCandidate.match) {
+        return block("path.deny_write", "Write path matches an unoverrideable denyWrite rule.", candidate, denyWriteCandidate.pattern);
+    }
+    const denyWriteRequested = matchesAny(policy.filesystem.denyWrite, requested);
+    if (denyWriteRequested.match) {
+        return block("path.deny_write", "Write path matches an unoverrideable denyWrite rule.", candidate, denyWriteRequested.pattern);
+    }
+    if (matchesAny(policy.filesystem.writeAllow, candidate).match ||
+        matchesAny(policy.filesystem.tempWrite, candidate).match) {
+        return allow("path.write_allow", "Write path is allowed.", candidate);
+    }
+    return block("path.write_not_allowed", "Write path is not in an allow rule.", candidate);
+}
+function decideEnvV2(env) {
+    const denied = [];
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (ENV_DENY_NAMES.has(name)) {
+            denied.push(name);
+            continue;
+        }
+        if (isSensitiveEnvName(name)) {
+            denied.push(name);
+            continue;
+        }
+        if (AUTH_URL_REGEX.test(value)) {
+            // Value-based denial: the value embeds credentials. Record NAME only.
+            denied.push(name);
+        }
+    }
+    if (denied.length > 0) {
+        return {
+            action: "block",
+            rule: "env.denied_pattern",
+            reason: `Environment contains denied variable(s): ${denied.join(", ")}.`,
+            deniedNames: denied,
+        };
+    }
+    return { action: "allow", rule: "env.allow", reason: "No denied environment variables.", deniedNames: [] };
+}
+/**
+ * Public: evaluate path / env / network requests against a sandbox policy.
+ * Path and env checks are fail-closed. Audit mode downgrades a would-block
+ * outcome to confirm; enforce mode keeps it block.
+ */
+export function evaluateSandboxPolicyV2(input) {
+    const { policy } = input;
+    const diagnostics = [];
+    const pathDecisions = [];
+    let envDecision;
+    let networkDecision;
+    let worst = "block";
+    if (policy.mode === "off") {
+        return {
+            action: "allow",
+            rule: "sandbox.off",
+            reason: "Sandbox policy is disabled.",
+            diagnostics,
+            pathDecisions,
+        };
+    }
+    // Default to allow and escalate to block on any failed check.
+    worst = "allow";
+    if (input.env) {
+        envDecision = decideEnvV2(input.env);
+        if (envDecision.action === "block") {
+            worst = "block";
+            diagnostics.push({
+                code: envDecision.rule,
+                message: `Denied env name(s): ${envDecision.deniedNames.join(", ")}`,
+                severity: "block",
+            });
+        }
+    }
+    for (const request of input.pathRequests ?? []) {
+        const decision = decidePathV2(policy, request, input.resolver);
+        pathDecisions.push(decision);
+        if (decision.action === "block") {
+            worst = "block";
+            diagnostics.push({ code: decision.rule, message: decision.reason, severity: "block" });
+        }
+    }
+    if (input.networkRequest) {
+        const normalized = normalizeNetworkLoopback(input.networkRequest);
+        networkDecision = decideNetworkV2(policy, normalized);
+        if (!networkDecision.allowed) {
+            worst = "block";
+            diagnostics.push({ code: networkDecision.rule, message: networkDecision.reason, severity: "block" });
+        }
+    }
+    let action;
+    let rule;
+    let reason;
+    if (worst === "allow") {
+        action = "allow";
+        rule = "policy.composite_allow";
+        reason = "All sandbox checks passed.";
+    }
+    else if (policy.mode === "audit") {
+        action = "confirm";
+        rule = "policy.audit_block";
+        reason = "Audit mode: a would-block check is downgraded to confirm.";
+    }
+    else {
+        action = "block";
+        rule = "policy.block";
+        reason = "One or more sandbox checks blocked the request.";
+    }
+    return { action, rule, reason, diagnostics, pathDecisions, networkDecision, envDecision };
+}
+//# sourceMappingURL=sandbox-policy-v2.js.map

package/dist/core/sandbox-policy-v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy-v2.js","sourceRoot":"","sources":["../../src/core/sandbox-policy-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAStC,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC3C,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,UAAU;IACV,cAAc;IACd,WAAW;IACX,iBAAiB;CACjB,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,mBAAmB,GACxB,6FAA6F,CAAC;AAE/F;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACtC,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,cAAc;IACd,WAAW;IACX,2BAA2B;IAC3B,qBAAqB;IACrB,8BAA8B;IAC9B,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,eAAe;IACf,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,YAAY;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E,sEAAsE;AACtE,MAAM,oBAAoB,GACzB,wKAAwK,CAAC;AAiD1K,SAAS,kBAAkB,CAAC,IAAY,EAAW;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACtC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAU;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,WAAW,CAAC,OAAe,EAAW;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAAA,CACjC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,SAAiB,EAAW;IACjE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,qEAAqE;QACrE,OAAO,SAAS,CAAC,aAAa,EAAE,GAAG,WAAW,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,aAAa,KAAK,WAAW,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;AAAA,CACpF;AAED,SAAS,UAAU,CAAC,QAA2B,EAAE,SAAiB,EAAwC;IACzG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAW;IAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAAA,CAC9E;AAED,SAAS,eAAe,CAAC,KAAa,EAAW;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAAA,CAC5D;AAED,6DAA6D;AAC7D,SAAS,cAAc,CAAC,IAAY,EAAW;IAC9C,MAAM,CAAC,GAAG,IAAI;SACZ,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,wBAAwB,CAAC,OAA6B,EAAwB;IACtF,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,GAAG,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,eAAe,CAAC,OAA6B,EAAsB;IAC3E,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,WAAW,CAAC,QAA2B,EAAE,IAAY,EAAW;IACxE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,eAAe,CAAC,MAAqB,EAAE,OAA6B,EAAmB;IAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAChH,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,sDAAsD;SAC9D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,IACC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YAClC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,EACrC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO;YACN,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,uDAAuD;SAC/D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;AAAA,CAChH;AAED,SAAS,YAAY,CACpB,MAAqB,EACrB,OAA4B,EAC5B,QAAyC,EACxB;IACjB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,CACZ,IAAY,EACZ,MAAc,EACd,SAAiB,EACjB,MAAyB,EACzB,cAAuB,EACN,EAAE,CAAC,CAAC;QACrB,aAAa,EAAE,SAAS;QACxB,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,IAAI;QACJ,MAAM;QACN,cAAc;KACd,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,cAAuB,EAAkB,EAAE,CAC1G,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAkB,EAAE,CACjF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAExC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,cAAc,EAAE,2BAA2B,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,6BAA6B,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzG,SAAS,GAAG,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,CAAC;SAAM,CAAC;QACP,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,kBAAkB,EAAE,4CAA4C,EAAE,SAAS,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,cAAc,EAAE,wCAAwC,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,KAAK,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,KAAK,CACX,iBAAiB,EACjB,sDAAsD,EACtD,SAAS,EACT,kBAAkB,CAAC,OAAO,CAC1B,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,KAAK,CACX,iBAAiB,EACjB,sDAAsD,EACtD,SAAS,EACT,kBAAkB,CAAC,OAAO,CAC1B,CAAC;IACH,CAAC;IACD,IACC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK;QACzD,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,EACvD,CAAC;QACF,OAAO,KAAK,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,SAAS,CAAC,CAAC;AAAA,CACzF;AAED,SAAS,WAAW,CAAC,GAAiD,EAAiB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACV,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACV,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,sEAAsE;YACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACxE,WAAW,EAAE,MAAM;SACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAAA,CAC3G;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA2B,EAA2B;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,IAAI,WAAsC,CAAC;IAC3C,IAAI,eAA4C,CAAC;IACjD,IAAI,KAAK,GAAsB,OAAO,CAAC;IAEvC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,6BAA6B;YACrC,WAAW;YACX,aAAa;SACb,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,GAAG,OAAO,CAAC;IAEhB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,OAAO,EAAE,uBAAuB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpE,QAAQ,EAAE,OAAO;aACjB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/D,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClE,eAAe,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;IACF,CAAC;IAED,IAAI,MAAqC,CAAC;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,wBAAwB,CAAC;QAChC,MAAM,GAAG,4BAA4B,CAAC;IACvC,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,GAAG,oBAAoB,CAAC;QAC5B,MAAM,GAAG,2DAA2D,CAAC;IACtE,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,cAAc,CAAC;QACtB,MAAM,GAAG,iDAAiD,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1F","sourcesContent":["/**\n * Lane SA3 - Sandbox Policy V2.\n * allow: SIZE_OK - legacy evaluator; this change only keeps strip-only TypeScript compatibility.\n *\n * Pure fail-closed evaluator that composes path / env / network checks for a\n * sandbox policy. It layers general glob matching (via `minimatch`), realpath\n * normalization (when a resolver is provided), denied-env fail-closed\n * semantics, and IPv4 / IPv6 loopback detection on top of the existing\n * `SandboxPolicy` types. It does not spawn, resolve through the filesystem on\n * its own, or log env values.\n */\nimport path from \"node:path\";\nimport { minimatch } from \"minimatch\";\nimport type {\n\tNetworkAccessRequest,\n\tPathAccessKind,\n\tSandboxDecision,\n\tSandboxPathResolver,\n\tSandboxPolicy,\n} from \"./sandbox/policy.ts\";\n\n/** Exact sensitive environment variable names (do not end in a standard suffix). */\nconst SENSITIVE_ENV_EXACT = new Set<string>([\n\t\"AWS_ACCESS_KEY_ID\",\n\t\"AWS_SECRET_ACCESS_KEY\",\n\t\"AWS_SESSION_TOKEN\",\n\t\"GITHUB_TOKEN\",\n\t\"GH_TOKEN\",\n\t\"GITLAB_TOKEN\",\n\t\"NPM_TOKEN\",\n\t\"NODE_AUTH_TOKEN\",\n]);\n\n/** Sensitive environment variable name suffixes. */\nconst SENSITIVE_ENV_REGEX =\n\t/(^|_)(API_KEY|API_TOKEN|ACCESS_TOKEN|SECRET|SECRET_KEY|PRIVATE_KEY|PASSWORD|PASSWD|TOKEN)$/i;\n\n/**\n * Environment variable names that are always denied because they inject code\n * or redirect runtime loader behavior. Denial is fail-closed: presence of any\n * of these names blocks the policy evaluation regardless of value.\n */\nconst ENV_DENY_NAMES = new Set<string>([\n\t\"LD_PRELOAD\",\n\t\"LD_LIBRARY_PATH\",\n\t\"LD_AUDIT\",\n\t\"LD_BIND_NOW\",\n\t\"LD_PROFILE\",\n\t\"DYLD_INSERT_LIBRARIES\",\n\t\"DYLD_LIBRARY_PATH\",\n\t\"DYLD_FALLBACK_LIBRARY_PATH\",\n\t\"NODE_OPTIONS\",\n\t\"NODE_PATH\",\n\t\"NODE_REPL_EXTERNAL_MODULE\",\n\t\"NODE_EXTRA_CA_CERTS\",\n\t\"NODE_TLS_REJECT_UNAUTHORIZED\",\n\t\"PYTHONPATH\",\n\t\"PYTHONHOME\",\n\t\"PYTHONSTARTUP\",\n\t\"PYTHONINSPECT\",\n\t\"PERL5LIB\",\n\t\"PERLLIB\",\n\t\"PERL5OPT\",\n\t\"RUBYLIB\",\n\t\"RUBYOPT\",\n\t\"RUBYPATH\",\n\t\"JAVA_TOOL_OPTIONS\",\n\t\"_JAVA_OPTIONS\",\n\t\"JDK_JAVA_OPTIONS\",\n\t\"MAVEN_OPTS\",\n]);\n\n/**\n * Matches a URL / DSN with embedded userinfo (`scheme://user:pass@host`).\n * Used for value-based denial; only the variable NAME is ever recorded.\n */\nconst AUTH_URL_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\/[^\\s/@:]+:[^\\s/@]+@[^\\s/@]/i;\n\n/** Path patterns that look like credential / key material on disk. */\nconst SENSITIVE_PATH_REGEX =\n\t/(?:^|[/\\\\])(?:\\.env(?:\\..*)?|auth\\.json|oauth\\.json|\\.netrc|\\.npmrc|\\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:token|private[_-]?key|credential).*)$/i;\n\nexport interface PathAccessRequestV2 {\n\treadonly kind: PathAccessKind;\n\treadonly path: string;\n}\n\nexport interface PolicyDiagnostic {\n\treadonly code: string;\n\treadonly message: string;\n\treadonly severity: \"info\" | \"warn\" | \"block\";\n}\n\nexport interface PathDecisionV2 {\n\treadonly requestedPath: string;\n\treadonly candidate: string;\n\treadonly kind: PathAccessKind;\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly matchedPattern?: string;\n}\n\nexport interface EnvDecisionV2 {\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\t/** Denied variable NAMES only. Values are never recorded. */\n\treadonly deniedNames: readonly string[];\n}\n\nexport interface SandboxPolicyV2Decision {\n\treadonly action: \"allow\" | \"confirm\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly diagnostics: readonly PolicyDiagnostic[];\n\treadonly pathDecisions: readonly PathDecisionV2[];\n\treadonly networkDecision?: SandboxDecision;\n\treadonly envDecision?: EnvDecisionV2;\n}\n\nexport interface SandboxPolicyV2Input {\n\treadonly policy: SandboxPolicy;\n\treadonly pathRequests?: readonly PathAccessRequestV2[];\n\treadonly networkRequest?: NetworkAccessRequest;\n\treadonly env?: Readonly<Record<string, string | undefined>>;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nfunction isSensitiveEnvName(name: string): boolean {\n\tif (SENSITIVE_ENV_EXACT.has(name)) return true;\n\treturn SENSITIVE_ENV_REGEX.test(name);\n}\n\nfunction normalizePathValue(value: string): string {\n\tconst resolved = path.resolve(value);\n\tlet normalized = resolved.replace(/\\\\/g, \"/\");\n\tif (normalized.length > 1) normalized = normalized.replace(/\\/+$/, \"\");\n\treturn normalized;\n}\n\nfunction ruleHasGlob(pattern: string): boolean {\n\treturn /[*?[\\]{}]/.test(pattern);\n}\n\nfunction matchesRule(pattern: string, candidate: string): boolean {\n\tconst normPattern = normalizePathValue(pattern);\n\tconst normCandidate = normalizePathValue(candidate);\n\tif (ruleHasGlob(normPattern)) {\n\t\tif (minimatch(normCandidate, normPattern)) return true;\n\t\t// also accept recursive prefix form even if the writer omitted `/**`\n\t\treturn minimatch(normCandidate, `${normPattern}/**`);\n\t}\n\treturn normCandidate === normPattern || normCandidate.startsWith(`${normPattern}/`);\n}\n\nfunction matchesAny(patterns: readonly string[], candidate: string): { match: boolean; pattern?: string } {\n\tfor (const pattern of patterns) {\n\t\tif (matchesRule(pattern, candidate)) return { match: true, pattern };\n\t}\n\treturn { match: false };\n}\n\nfunction isInsideRoot(root: string, candidate: string): boolean {\n\tconst normRoot = normalizePathValue(root);\n\tconst normCandidate = normalizePathValue(candidate);\n\treturn normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);\n}\n\nfunction isSensitivePath(value: string): boolean {\n\treturn SENSITIVE_PATH_REGEX.test(value.replace(/\\\\/g, \"/\"));\n}\n\n/** True for IPv4 / IPv6 loopback and localhost hostnames. */\nfunction isLoopbackHost(host: string): boolean {\n\tconst h = host\n\t\t.toLowerCase()\n\t\t.replace(/^\\[|\\]$/g, \"\")\n\t\t.trim();\n\tif (h === \"localhost\") return true;\n\tif (h === \"127.0.0.1\" || h === \"::1\" || h === \"0:0:0:0:0:0:0:1\") return true;\n\tif (h === \"::ffff:127.0.0.1\" || h === \"::ffff:7f00:1\") return true;\n\tif (/^127\\./.test(h)) return true;\n\treturn false;\n}\n\nfunction normalizeNetworkLoopback(request: NetworkAccessRequest): NetworkAccessRequest {\n\tlet host = request.host;\n\tif (!host && request.url) {\n\t\ttry {\n\t\t\thost = new URL(request.url).hostname;\n\t\t} catch {\n\t\t\thost = undefined;\n\t\t}\n\t}\n\tif (host && isLoopbackHost(host)) {\n\t\treturn { ...request, host, loopback: true };\n\t}\n\treturn request;\n}\n\nfunction hostFromRequest(request: NetworkAccessRequest): string | undefined {\n\tif (request.host) return request.host.toLowerCase();\n\tif (!request.url) return undefined;\n\ttry {\n\t\treturn new URL(request.url).hostname.toLowerCase();\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hostMatches(patterns: readonly string[], host: string): boolean {\n\tconst h = host.replace(/\\.$/, \"\");\n\tfor (const raw of patterns) {\n\t\tconst p = raw.toLowerCase().replace(/\\.$/, \"\");\n\t\tif (h === p || h.endsWith(`.${p}`)) return true;\n\t}\n\treturn false;\n}\n\nfunction decideNetworkV2(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision {\n\tif (policy.mode === \"off\") return { allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" };\n\tif (request.browser || request.unixSocketPath) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.socket_or_browser\",\n\t\t\treason: \"Browser and Unix socket access is denied by default.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"none\") {\n\t\treturn { allowed: false, rule: \"network.none\", reason: \"Network access is disabled by policy.\" };\n\t}\n\tif (request.loopback) {\n\t\tif (\n\t\t\tpolicy.network.mode === \"loopback\" ||\n\t\t\tpolicy.network.mode === \"domain-allowlist\" ||\n\t\t\tpolicy.network.mode === \"all-explicit\"\n\t\t) {\n\t\t\treturn { allowed: true, rule: \"network.loopback\", reason: \"Loopback access is allowed.\" };\n\t\t}\n\t\treturn { allowed: false, rule: \"network.loopback_denied\", reason: \"Loopback access is denied.\" };\n\t}\n\tconst host = hostFromRequest(request);\n\tif (!host)\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.unknown_host\",\n\t\t\treason: \"Network host could not be resolved from request.\",\n\t\t};\n\tif (hostMatches(policy.network.deniedDomains, host)) {\n\t\treturn { allowed: false, rule: \"network.domain_deny\", reason: \"Host matches a denied domain.\" };\n\t}\n\tif (policy.network.mode === \"all-explicit\") {\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trule: \"network.explicit_all\",\n\t\t\treason: \"Explicit network profile allows outbound host access.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"domain-allowlist\" && hostMatches(policy.network.allowedDomains, host)) {\n\t\treturn { allowed: true, rule: \"network.domain_allow\", reason: \"Host matches an allowed domain.\" };\n\t}\n\treturn { allowed: false, rule: \"network.domain_not_allowed\", reason: \"Host is not allowed by network policy.\" };\n}\n\nfunction decidePathV2(\n\tpolicy: SandboxPolicy,\n\trequest: PathAccessRequestV2,\n\tresolver: SandboxPathResolver | undefined,\n): PathDecisionV2 {\n\tconst requested = request.path;\n\tconst base = (\n\t\trule: string,\n\t\treason: string,\n\t\tcandidate: string,\n\t\taction: \"allow\" | \"block\",\n\t\tmatchedPattern?: string,\n\t): PathDecisionV2 => ({\n\t\trequestedPath: requested,\n\t\tcandidate,\n\t\tkind: request.kind,\n\t\taction,\n\t\trule,\n\t\treason,\n\t\tmatchedPattern,\n\t});\n\tconst block = (rule: string, reason: string, candidate: string, matchedPattern?: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"block\", matchedPattern);\n\tconst allow = (rule: string, reason: string, candidate: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"allow\");\n\n\tif (requested.includes(\"\\0\")) {\n\t\treturn block(\"path.invalid\", \"Path contains a NUL byte.\", requested);\n\t}\n\n\tlet candidate: string;\n\tlet isSymlink = false;\n\tif (resolver) {\n\t\tconst resolved = resolver(requested);\n\t\tif (resolved.error) {\n\t\t\treturn block(\"path.resolve_error\", resolved.error, requested);\n\t\t}\n\t\tcandidate = resolved.realPath ?? resolved.nearestExistingParentRealPath ?? normalizePathValue(requested);\n\t\tisSymlink = resolved.isSymlink === true;\n\t} else {\n\t\tcandidate = normalizePathValue(requested);\n\t}\n\n\tif (isSensitivePath(requested) || isSensitivePath(candidate)) {\n\t\treturn block(\"path.sensitive\", \"Sensitive credential-like path is denied.\", candidate);\n\t}\n\n\tif (!isInsideRoot(policy.filesystem.root, candidate)) {\n\t\treturn block(\"path.root_escape\", \"Resolved path is outside the sandbox root.\", candidate);\n\t}\n\n\tif (isSymlink && !policy.filesystem.followSymlinks) {\n\t\treturn block(\"path.symlink\", \"Symlink traversal is denied by policy.\", candidate);\n\t}\n\n\tif (request.kind === \"read\") {\n\t\tconst denied = matchesAny(policy.filesystem.readDeny, candidate);\n\t\tif (denied.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, denied.pattern);\n\t\t}\n\t\tconst deniedRequested = matchesAny(policy.filesystem.readDeny, requested);\n\t\tif (deniedRequested.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, deniedRequested.pattern);\n\t\t}\n\t\tif (matchesAny(policy.filesystem.readAllow, candidate).match) {\n\t\t\treturn allow(\"path.read_allow\", \"Read path is allowed.\", candidate);\n\t\t}\n\t\treturn block(\"path.read_not_allowed\", \"Read path is not in an allow rule.\", candidate);\n\t}\n\n\tconst denyWriteCandidate = matchesAny(policy.filesystem.denyWrite, candidate);\n\tif (denyWriteCandidate.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteCandidate.pattern,\n\t\t);\n\t}\n\tconst denyWriteRequested = matchesAny(policy.filesystem.denyWrite, requested);\n\tif (denyWriteRequested.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteRequested.pattern,\n\t\t);\n\t}\n\tif (\n\t\tmatchesAny(policy.filesystem.writeAllow, candidate).match ||\n\t\tmatchesAny(policy.filesystem.tempWrite, candidate).match\n\t) {\n\t\treturn allow(\"path.write_allow\", \"Write path is allowed.\", candidate);\n\t}\n\treturn block(\"path.write_not_allowed\", \"Write path is not in an allow rule.\", candidate);\n}\n\nfunction decideEnvV2(env: Readonly<Record<string, string | undefined>>): EnvDecisionV2 {\n\tconst denied: string[] = [];\n\tfor (const [name, value] of Object.entries(env)) {\n\t\tif (value === undefined) continue;\n\t\tif (ENV_DENY_NAMES.has(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (isSensitiveEnvName(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (AUTH_URL_REGEX.test(value)) {\n\t\t\t// Value-based denial: the value embeds credentials. Record NAME only.\n\t\t\tdenied.push(name);\n\t\t}\n\t}\n\tif (denied.length > 0) {\n\t\treturn {\n\t\t\taction: \"block\",\n\t\t\trule: \"env.denied_pattern\",\n\t\t\treason: `Environment contains denied variable(s): ${denied.join(\", \")}.`,\n\t\t\tdeniedNames: denied,\n\t\t};\n\t}\n\treturn { action: \"allow\", rule: \"env.allow\", reason: \"No denied environment variables.\", deniedNames: [] };\n}\n\n/**\n * Public: evaluate path / env / network requests against a sandbox policy.\n * Path and env checks are fail-closed. Audit mode downgrades a would-block\n * outcome to confirm; enforce mode keeps it block.\n */\nexport function evaluateSandboxPolicyV2(input: SandboxPolicyV2Input): SandboxPolicyV2Decision {\n\tconst { policy } = input;\n\tconst diagnostics: PolicyDiagnostic[] = [];\n\tconst pathDecisions: PathDecisionV2[] = [];\n\tlet envDecision: EnvDecisionV2 | undefined;\n\tlet networkDecision: SandboxDecision | undefined;\n\tlet worst: \"allow\" | \"block\" = \"block\";\n\n\tif (policy.mode === \"off\") {\n\t\treturn {\n\t\t\taction: \"allow\",\n\t\t\trule: \"sandbox.off\",\n\t\t\treason: \"Sandbox policy is disabled.\",\n\t\t\tdiagnostics,\n\t\t\tpathDecisions,\n\t\t};\n\t}\n\n\t// Default to allow and escalate to block on any failed check.\n\tworst = \"allow\";\n\n\tif (input.env) {\n\t\tenvDecision = decideEnvV2(input.env);\n\t\tif (envDecision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({\n\t\t\t\tcode: envDecision.rule,\n\t\t\t\tmessage: `Denied env name(s): ${envDecision.deniedNames.join(\", \")}`,\n\t\t\t\tseverity: \"block\",\n\t\t\t});\n\t\t}\n\t}\n\n\tfor (const request of input.pathRequests ?? []) {\n\t\tconst decision = decidePathV2(policy, request, input.resolver);\n\t\tpathDecisions.push(decision);\n\t\tif (decision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: decision.rule, message: decision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tif (input.networkRequest) {\n\t\tconst normalized = normalizeNetworkLoopback(input.networkRequest);\n\t\tnetworkDecision = decideNetworkV2(policy, normalized);\n\t\tif (!networkDecision.allowed) {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: networkDecision.rule, message: networkDecision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tlet action: \"allow\" | \"confirm\" | \"block\";\n\tlet rule: string;\n\tlet reason: string;\n\tif (worst === \"allow\") {\n\t\taction = \"allow\";\n\t\trule = \"policy.composite_allow\";\n\t\treason = \"All sandbox checks passed.\";\n\t} else if (policy.mode === \"audit\") {\n\t\taction = \"confirm\";\n\t\trule = \"policy.audit_block\";\n\t\treason = \"Audit mode: a would-block check is downgraded to confirm.\";\n\t} else {\n\t\taction = \"block\";\n\t\trule = \"policy.block\";\n\t\treason = \"One or more sandbox checks blocked the request.\";\n\t}\n\n\treturn { action, rule, reason, diagnostics, pathDecisions, networkDecision, envDecision };\n}\n"]}

package/dist/core/sdk.d.ts

@@ -1,12 +1,14 @@
-import { type ThinkingLevel } from "@earendil-works/omk-agent-core";
-import { type Model } from "@earendil-works/omk-ai";
+import { type ThinkingLevel } from "omk-agent-core";
+import { type Model } from "omk-ai";
 import { AgentSession } from "./agent-session.ts";
 import { AuthStorage } from "./auth-storage.ts";
 import type { LoadExtensionsResult, SessionStartEvent, ToolDefinition } from "./extensions/index.ts";
+import type { LoadoutAccessPolicy } from "./loadout-access-policy.ts";
 import { ModelRegistry } from "./model-registry.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
 import { SessionManager } from "./session-manager.ts";
 import { SettingsManager } from "./settings-manager.ts";
+import type { BashSandboxPreflight } from "./tools/bash.ts";
 import { createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createReadOnlyTools, createReadTool, createWriteTool, withFileMutationQueue } from "./tools/index.ts";
 export interface CreateAgentSessionOptions {
     /** Working directory for project-local discovery. Default: process.cwd() */
@@ -37,7 +39,7 @@ export interface CreateAgentSessionOptions {
     /**
      * Optional allowlist of tool names.
      *
-     * When omitted, pi enables the default built-in tools (read, bash, edit, write)
+     * When omitted, OMK enables the default built-in tools (read, bash, edit, write)
      * and leaves extension/custom tools enabled unless `noTools` changes that default.
      * When provided, only the listed tool names are enabled.
      */
@@ -54,6 +56,15 @@ export interface CreateAgentSessionOptions {
     settingsManager?: SettingsManager;
     /** Session start event metadata for extension runtime startup. */
     sessionStartEvent?: SessionStartEvent;
+    /**
+     * Optional prompt hint used only for opt-in domain routing (`OMK_DOMAIN_ROUTING=1`).
+     * This text only selects a loadout policy and is never sent to the model.
+     */
+    domainRoutingPrompt?: string;
+    /** Optional loadout enforcement policy for SDK-created sessions. */
+    loadoutAccessPolicy?: LoadoutAccessPolicy;
+    /** Trusted sandbox preflight used for built-in local bash execution. */
+    bashSandboxPreflight?: BashSandboxPreflight;
 }
 /** Result from createAgentSession */
 export interface CreateAgentSessionResult {
@@ -79,7 +90,7 @@ export { withFileMutationQueue, createCodingTools, createReadOnlyTools, createRe
  * const { session } = await createAgentSession();
  *
  * // With explicit model
- * import { getModel } from '@earendil-works/omk-ai';
+ * import { getModel } from 'omk-ai';
  * const { session } = await createAgentSession({
  *   model: getModel('anthropic', 'claude-opus-4-5'),
  *   thinkingLevel: 'high',