open-multi-agent-kit 0.96.2 → 0.98.0

package/dist/core/sandbox-policy-v2.js

@@ -1,368 +0,0 @@
-/**
- * Lane SA3 - Sandbox Policy V2.
- * allow: SIZE_OK - legacy evaluator; this change only keeps strip-only TypeScript compatibility.
- *
- * Pure fail-closed evaluator that composes path / env / network checks for a
- * sandbox policy. It layers general glob matching (via `minimatch`), realpath
- * normalization (when a resolver is provided), denied-env fail-closed
- * semantics, and IPv4 / IPv6 loopback detection on top of the existing
- * `SandboxPolicy` types. It does not spawn, resolve through the filesystem on
- * its own, or log env values.
- */
-import path from "node:path";
-import { minimatch } from "minimatch";
-/** Exact sensitive environment variable names (do not end in a standard suffix). */
-const SENSITIVE_ENV_EXACT = new Set([
-    "AWS_ACCESS_KEY_ID",
-    "AWS_SECRET_ACCESS_KEY",
-    "AWS_SESSION_TOKEN",
-    "GITHUB_TOKEN",
-    "GH_TOKEN",
-    "GITLAB_TOKEN",
-    "NPM_TOKEN",
-    "NODE_AUTH_TOKEN",
-]);
-/** Sensitive environment variable name suffixes. */
-const SENSITIVE_ENV_REGEX = /(^|_)(API_KEY|API_TOKEN|ACCESS_TOKEN|SECRET|SECRET_KEY|PRIVATE_KEY|PASSWORD|PASSWD|TOKEN)$/i;
-/**
- * Environment variable names that are always denied because they inject code
- * or redirect runtime loader behavior. Denial is fail-closed: presence of any
- * of these names blocks the policy evaluation regardless of value.
- */
-const ENV_DENY_NAMES = new Set([
-    "LD_PRELOAD",
-    "LD_LIBRARY_PATH",
-    "LD_AUDIT",
-    "LD_BIND_NOW",
-    "LD_PROFILE",
-    "DYLD_INSERT_LIBRARIES",
-    "DYLD_LIBRARY_PATH",
-    "DYLD_FALLBACK_LIBRARY_PATH",
-    "NODE_OPTIONS",
-    "NODE_PATH",
-    "NODE_REPL_EXTERNAL_MODULE",
-    "NODE_EXTRA_CA_CERTS",
-    "NODE_TLS_REJECT_UNAUTHORIZED",
-    "PYTHONPATH",
-    "PYTHONHOME",
-    "PYTHONSTARTUP",
-    "PYTHONINSPECT",
-    "PERL5LIB",
-    "PERLLIB",
-    "PERL5OPT",
-    "RUBYLIB",
-    "RUBYOPT",
-    "RUBYPATH",
-    "JAVA_TOOL_OPTIONS",
-    "_JAVA_OPTIONS",
-    "JDK_JAVA_OPTIONS",
-    "MAVEN_OPTS",
-]);
-/**
- * Matches a URL / DSN with embedded userinfo (`scheme://user:pass@host`).
- * Used for value-based denial; only the variable NAME is ever recorded.
- */
-const AUTH_URL_REGEX = /^[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@[^\s/@]/i;
-/** Path patterns that look like credential / key material on disk. */
-const SENSITIVE_PATH_REGEX = /(?:^|[/\\])(?:\.env(?:\..*)?|auth\.json|oauth\.json|\.netrc|\.npmrc|\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:token|private[_-]?key|credential).*)$/i;
-function isSensitiveEnvName(name) {
-    if (SENSITIVE_ENV_EXACT.has(name))
-        return true;
-    return SENSITIVE_ENV_REGEX.test(name);
-}
-function normalizePathValue(value) {
-    const resolved = path.resolve(value);
-    let normalized = resolved.replace(/\\/g, "/");
-    if (normalized.length > 1)
-        normalized = normalized.replace(/\/+$/, "");
-    return normalized;
-}
-function ruleHasGlob(pattern) {
-    return /[*?[\]{}]/.test(pattern);
-}
-function matchesRule(pattern, candidate) {
-    const normPattern = normalizePathValue(pattern);
-    const normCandidate = normalizePathValue(candidate);
-    if (ruleHasGlob(normPattern)) {
-        if (minimatch(normCandidate, normPattern))
-            return true;
-        // also accept recursive prefix form even if the writer omitted `/**`
-        return minimatch(normCandidate, `${normPattern}/**`);
-    }
-    return normCandidate === normPattern || normCandidate.startsWith(`${normPattern}/`);
-}
-function matchesAny(patterns, candidate) {
-    for (const pattern of patterns) {
-        if (matchesRule(pattern, candidate))
-            return { match: true, pattern };
-    }
-    return { match: false };
-}
-function isInsideRoot(root, candidate) {
-    const normRoot = normalizePathValue(root);
-    const normCandidate = normalizePathValue(candidate);
-    return normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);
-}
-function isSensitivePath(value) {
-    return SENSITIVE_PATH_REGEX.test(value.replace(/\\/g, "/"));
-}
-/** True for IPv4 / IPv6 loopback and localhost hostnames. */
-function isLoopbackHost(host) {
-    const h = host
-        .toLowerCase()
-        .replace(/^\[|\]$/g, "")
-        .trim();
-    if (h === "localhost")
-        return true;
-    if (h === "127.0.0.1" || h === "::1" || h === "0:0:0:0:0:0:0:1")
-        return true;
-    if (h === "::ffff:127.0.0.1" || h === "::ffff:7f00:1")
-        return true;
-    if (/^127\./.test(h))
-        return true;
-    return false;
-}
-function normalizeNetworkLoopback(request) {
-    let host = request.host;
-    if (!host && request.url) {
-        try {
-            host = new URL(request.url).hostname;
-        }
-        catch {
-            host = undefined;
-        }
-    }
-    if (host && isLoopbackHost(host)) {
-        return { ...request, host, loopback: true };
-    }
-    return request;
-}
-function hostFromRequest(request) {
-    if (request.host)
-        return request.host.toLowerCase();
-    if (!request.url)
-        return undefined;
-    try {
-        return new URL(request.url).hostname.toLowerCase();
-    }
-    catch {
-        return undefined;
-    }
-}
-function hostMatches(patterns, host) {
-    const h = host.replace(/\.$/, "");
-    for (const raw of patterns) {
-        const p = raw.toLowerCase().replace(/\.$/, "");
-        if (h === p || h.endsWith(`.${p}`))
-            return true;
-    }
-    return false;
-}
-function decideNetworkV2(policy, request) {
-    if (policy.mode === "off")
-        return { allowed: true, rule: "sandbox.off", reason: "Sandbox policy is disabled." };
-    if (request.browser || request.unixSocketPath) {
-        return {
-            allowed: false,
-            rule: "network.socket_or_browser",
-            reason: "Browser and Unix socket access is denied by default.",
-        };
-    }
-    if (policy.network.mode === "none") {
-        return { allowed: false, rule: "network.none", reason: "Network access is disabled by policy." };
-    }
-    if (request.loopback) {
-        if (policy.network.mode === "loopback" ||
-            policy.network.mode === "domain-allowlist" ||
-            policy.network.mode === "all-explicit") {
-            return { allowed: true, rule: "network.loopback", reason: "Loopback access is allowed." };
-        }
-        return { allowed: false, rule: "network.loopback_denied", reason: "Loopback access is denied." };
-    }
-    const host = hostFromRequest(request);
-    if (!host)
-        return {
-            allowed: false,
-            rule: "network.unknown_host",
-            reason: "Network host could not be resolved from request.",
-        };
-    if (hostMatches(policy.network.deniedDomains, host)) {
-        return { allowed: false, rule: "network.domain_deny", reason: "Host matches a denied domain." };
-    }
-    if (policy.network.mode === "all-explicit") {
-        return {
-            allowed: true,
-            rule: "network.explicit_all",
-            reason: "Explicit network profile allows outbound host access.",
-        };
-    }
-    if (policy.network.mode === "domain-allowlist" && hostMatches(policy.network.allowedDomains, host)) {
-        return { allowed: true, rule: "network.domain_allow", reason: "Host matches an allowed domain." };
-    }
-    return { allowed: false, rule: "network.domain_not_allowed", reason: "Host is not allowed by network policy." };
-}
-function decidePathV2(policy, request, resolver) {
-    const requested = request.path;
-    const base = (rule, reason, candidate, action, matchedPattern) => ({
-        requestedPath: requested,
-        candidate,
-        kind: request.kind,
-        action,
-        rule,
-        reason,
-        matchedPattern,
-    });
-    const block = (rule, reason, candidate, matchedPattern) => base(rule, reason, candidate, "block", matchedPattern);
-    const allow = (rule, reason, candidate) => base(rule, reason, candidate, "allow");
-    if (requested.includes("\0")) {
-        return block("path.invalid", "Path contains a NUL byte.", requested);
-    }
-    let candidate;
-    let isSymlink = false;
-    if (resolver) {
-        const resolved = resolver(requested);
-        if (resolved.error) {
-            return block("path.resolve_error", resolved.error, requested);
-        }
-        candidate = resolved.realPath ?? resolved.nearestExistingParentRealPath ?? normalizePathValue(requested);
-        isSymlink = resolved.isSymlink === true;
-    }
-    else {
-        candidate = normalizePathValue(requested);
-    }
-    if (isSensitivePath(requested) || isSensitivePath(candidate)) {
-        return block("path.sensitive", "Sensitive credential-like path is denied.", candidate);
-    }
-    if (!isInsideRoot(policy.filesystem.root, candidate)) {
-        return block("path.root_escape", "Resolved path is outside the sandbox root.", candidate);
-    }
-    if (isSymlink && !policy.filesystem.followSymlinks) {
-        return block("path.symlink", "Symlink traversal is denied by policy.", candidate);
-    }
-    if (request.kind === "read") {
-        const denied = matchesAny(policy.filesystem.readDeny, candidate);
-        if (denied.match) {
-            return block("path.read_deny", "Read path matches a deny rule.", candidate, denied.pattern);
-        }
-        const deniedRequested = matchesAny(policy.filesystem.readDeny, requested);
-        if (deniedRequested.match) {
-            return block("path.read_deny", "Read path matches a deny rule.", candidate, deniedRequested.pattern);
-        }
-        if (matchesAny(policy.filesystem.readAllow, candidate).match) {
-            return allow("path.read_allow", "Read path is allowed.", candidate);
-        }
-        return block("path.read_not_allowed", "Read path is not in an allow rule.", candidate);
-    }
-    const denyWriteCandidate = matchesAny(policy.filesystem.denyWrite, candidate);
-    if (denyWriteCandidate.match) {
-        return block("path.deny_write", "Write path matches an unoverrideable denyWrite rule.", candidate, denyWriteCandidate.pattern);
-    }
-    const denyWriteRequested = matchesAny(policy.filesystem.denyWrite, requested);
-    if (denyWriteRequested.match) {
-        return block("path.deny_write", "Write path matches an unoverrideable denyWrite rule.", candidate, denyWriteRequested.pattern);
-    }
-    if (matchesAny(policy.filesystem.writeAllow, candidate).match ||
-        matchesAny(policy.filesystem.tempWrite, candidate).match) {
-        return allow("path.write_allow", "Write path is allowed.", candidate);
-    }
-    return block("path.write_not_allowed", "Write path is not in an allow rule.", candidate);
-}
-function decideEnvV2(env) {
-    const denied = [];
-    for (const [name, value] of Object.entries(env)) {
-        if (value === undefined)
-            continue;
-        if (ENV_DENY_NAMES.has(name)) {
-            denied.push(name);
-            continue;
-        }
-        if (isSensitiveEnvName(name)) {
-            denied.push(name);
-            continue;
-        }
-        if (AUTH_URL_REGEX.test(value)) {
-            // Value-based denial: the value embeds credentials. Record NAME only.
-            denied.push(name);
-        }
-    }
-    if (denied.length > 0) {
-        return {
-            action: "block",
-            rule: "env.denied_pattern",
-            reason: `Environment contains denied variable(s): ${denied.join(", ")}.`,
-            deniedNames: denied,
-        };
-    }
-    return { action: "allow", rule: "env.allow", reason: "No denied environment variables.", deniedNames: [] };
-}
-/**
- * Public: evaluate path / env / network requests against a sandbox policy.
- * Path and env checks are fail-closed. Audit mode downgrades a would-block
- * outcome to confirm; enforce mode keeps it block.
- */
-export function evaluateSandboxPolicyV2(input) {
-    const { policy } = input;
-    const diagnostics = [];
-    const pathDecisions = [];
-    let envDecision;
-    let networkDecision;
-    let worst = "block";
-    if (policy.mode === "off") {
-        return {
-            action: "allow",
-            rule: "sandbox.off",
-            reason: "Sandbox policy is disabled.",
-            diagnostics,
-            pathDecisions,
-        };
-    }
-    // Default to allow and escalate to block on any failed check.
-    worst = "allow";
-    if (input.env) {
-        envDecision = decideEnvV2(input.env);
-        if (envDecision.action === "block") {
-            worst = "block";
-            diagnostics.push({
-                code: envDecision.rule,
-                message: `Denied env name(s): ${envDecision.deniedNames.join(", ")}`,
-                severity: "block",
-            });
-        }
-    }
-    for (const request of input.pathRequests ?? []) {
-        const decision = decidePathV2(policy, request, input.resolver);
-        pathDecisions.push(decision);
-        if (decision.action === "block") {
-            worst = "block";
-            diagnostics.push({ code: decision.rule, message: decision.reason, severity: "block" });
-        }
-    }
-    if (input.networkRequest) {
-        const normalized = normalizeNetworkLoopback(input.networkRequest);
-        networkDecision = decideNetworkV2(policy, normalized);
-        if (!networkDecision.allowed) {
-            worst = "block";
-            diagnostics.push({ code: networkDecision.rule, message: networkDecision.reason, severity: "block" });
-        }
-    }
-    let action;
-    let rule;
-    let reason;
-    if (worst === "allow") {
-        action = "allow";
-        rule = "policy.composite_allow";
-        reason = "All sandbox checks passed.";
-    }
-    else if (policy.mode === "audit") {
-        action = "confirm";
-        rule = "policy.audit_block";
-        reason = "Audit mode: a would-block check is downgraded to confirm.";
-    }
-    else {
-        action = "block";
-        rule = "policy.block";
-        reason = "One or more sandbox checks blocked the request.";
-    }
-    return { action, rule, reason, diagnostics, pathDecisions, networkDecision, envDecision };
-}
-//# sourceMappingURL=sandbox-policy-v2.js.map

package/dist/core/sandbox-policy-v2.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-policy-v2.js","sourceRoot":"","sources":["../../src/core/sandbox-policy-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAStC,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC3C,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,UAAU;IACV,cAAc;IACd,WAAW;IACX,iBAAiB;CACjB,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,mBAAmB,GACxB,6FAA6F,CAAC;AAE/F;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACtC,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,cAAc;IACd,WAAW;IACX,2BAA2B;IAC3B,qBAAqB;IACrB,8BAA8B;IAC9B,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,eAAe;IACf,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,YAAY;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E,sEAAsE;AACtE,MAAM,oBAAoB,GACzB,wKAAwK,CAAC;AAiD1K,SAAS,kBAAkB,CAAC,IAAY,EAAW;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACtC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAU;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,WAAW,CAAC,OAAe,EAAW;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAAA,CACjC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,SAAiB,EAAW;IACjE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,qEAAqE;QACrE,OAAO,SAAS,CAAC,aAAa,EAAE,GAAG,WAAW,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,aAAa,KAAK,WAAW,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;AAAA,CACpF;AAED,SAAS,UAAU,CAAC,QAA2B,EAAE,SAAiB,EAAwC;IACzG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAW;IAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAAA,CAC9E;AAED,SAAS,eAAe,CAAC,KAAa,EAAW;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAAA,CAC5D;AAED,6DAA6D;AAC7D,SAAS,cAAc,CAAC,IAAY,EAAW;IAC9C,MAAM,CAAC,GAAG,IAAI;SACZ,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,wBAAwB,CAAC,OAA6B,EAAwB;IACtF,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,GAAG,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,eAAe,CAAC,OAA6B,EAAsB;IAC3E,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,WAAW,CAAC,QAA2B,EAAE,IAAY,EAAW;IACxE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,eAAe,CAAC,MAAqB,EAAE,OAA6B,EAAmB;IAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAChH,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,sDAAsD;SAC9D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,IACC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YAClC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,EACrC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO;YACN,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,uDAAuD;SAC/D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;AAAA,CAChH;AAED,SAAS,YAAY,CACpB,MAAqB,EACrB,OAA4B,EAC5B,QAAyC,EACxB;IACjB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,CACZ,IAAY,EACZ,MAAc,EACd,SAAiB,EACjB,MAAyB,EACzB,cAAuB,EACN,EAAE,CAAC,CAAC;QACrB,aAAa,EAAE,SAAS;QACxB,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,IAAI;QACJ,MAAM;QACN,cAAc;KACd,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,cAAuB,EAAkB,EAAE,CAC1G,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAkB,EAAE,CACjF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAExC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,cAAc,EAAE,2BAA2B,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,6BAA6B,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzG,SAAS,GAAG,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,CAAC;SAAM,CAAC;QACP,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,kBAAkB,EAAE,4CAA4C,EAAE,SAAS,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,cAAc,EAAE,wCAAwC,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,KAAK,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,KAAK,CACX,iBAAiB,EACjB,sDAAsD,EACtD,SAAS,EACT,kBAAkB,CAAC,OAAO,CAC1B,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,KAAK,CACX,iBAAiB,EACjB,sDAAsD,EACtD,SAAS,EACT,kBAAkB,CAAC,OAAO,CAC1B,CAAC;IACH,CAAC;IACD,IACC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK;QACzD,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,EACvD,CAAC;QACF,OAAO,KAAK,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,SAAS,CAAC,CAAC;AAAA,CACzF;AAED,SAAS,WAAW,CAAC,GAAiD,EAAiB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACV,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACV,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,sEAAsE;YACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACxE,WAAW,EAAE,MAAM;SACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAAA,CAC3G;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA2B,EAA2B;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,IAAI,WAAsC,CAAC;IAC3C,IAAI,eAA4C,CAAC;IACjD,IAAI,KAAK,GAAsB,OAAO,CAAC;IAEvC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,6BAA6B;YACrC,WAAW;YACX,aAAa;SACb,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,GAAG,OAAO,CAAC;IAEhB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,OAAO,EAAE,uBAAuB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpE,QAAQ,EAAE,OAAO;aACjB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/D,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClE,eAAe,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,GAAG,OAAO,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;IACF,CAAC;IAED,IAAI,MAAqC,CAAC;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,wBAAwB,CAAC;QAChC,MAAM,GAAG,4BAA4B,CAAC;IACvC,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,GAAG,oBAAoB,CAAC;QAC5B,MAAM,GAAG,2DAA2D,CAAC;IACtE,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,cAAc,CAAC;QACtB,MAAM,GAAG,iDAAiD,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1F","sourcesContent":["/**\n * Lane SA3 - Sandbox Policy V2.\n * allow: SIZE_OK - legacy evaluator; this change only keeps strip-only TypeScript compatibility.\n *\n * Pure fail-closed evaluator that composes path / env / network checks for a\n * sandbox policy. It layers general glob matching (via `minimatch`), realpath\n * normalization (when a resolver is provided), denied-env fail-closed\n * semantics, and IPv4 / IPv6 loopback detection on top of the existing\n * `SandboxPolicy` types. It does not spawn, resolve through the filesystem on\n * its own, or log env values.\n */\nimport path from \"node:path\";\nimport { minimatch } from \"minimatch\";\nimport type {\n\tNetworkAccessRequest,\n\tPathAccessKind,\n\tSandboxDecision,\n\tSandboxPathResolver,\n\tSandboxPolicy,\n} from \"./sandbox/policy.ts\";\n\n/** Exact sensitive environment variable names (do not end in a standard suffix). */\nconst SENSITIVE_ENV_EXACT = new Set<string>([\n\t\"AWS_ACCESS_KEY_ID\",\n\t\"AWS_SECRET_ACCESS_KEY\",\n\t\"AWS_SESSION_TOKEN\",\n\t\"GITHUB_TOKEN\",\n\t\"GH_TOKEN\",\n\t\"GITLAB_TOKEN\",\n\t\"NPM_TOKEN\",\n\t\"NODE_AUTH_TOKEN\",\n]);\n\n/** Sensitive environment variable name suffixes. */\nconst SENSITIVE_ENV_REGEX =\n\t/(^|_)(API_KEY|API_TOKEN|ACCESS_TOKEN|SECRET|SECRET_KEY|PRIVATE_KEY|PASSWORD|PASSWD|TOKEN)$/i;\n\n/**\n * Environment variable names that are always denied because they inject code\n * or redirect runtime loader behavior. Denial is fail-closed: presence of any\n * of these names blocks the policy evaluation regardless of value.\n */\nconst ENV_DENY_NAMES = new Set<string>([\n\t\"LD_PRELOAD\",\n\t\"LD_LIBRARY_PATH\",\n\t\"LD_AUDIT\",\n\t\"LD_BIND_NOW\",\n\t\"LD_PROFILE\",\n\t\"DYLD_INSERT_LIBRARIES\",\n\t\"DYLD_LIBRARY_PATH\",\n\t\"DYLD_FALLBACK_LIBRARY_PATH\",\n\t\"NODE_OPTIONS\",\n\t\"NODE_PATH\",\n\t\"NODE_REPL_EXTERNAL_MODULE\",\n\t\"NODE_EXTRA_CA_CERTS\",\n\t\"NODE_TLS_REJECT_UNAUTHORIZED\",\n\t\"PYTHONPATH\",\n\t\"PYTHONHOME\",\n\t\"PYTHONSTARTUP\",\n\t\"PYTHONINSPECT\",\n\t\"PERL5LIB\",\n\t\"PERLLIB\",\n\t\"PERL5OPT\",\n\t\"RUBYLIB\",\n\t\"RUBYOPT\",\n\t\"RUBYPATH\",\n\t\"JAVA_TOOL_OPTIONS\",\n\t\"_JAVA_OPTIONS\",\n\t\"JDK_JAVA_OPTIONS\",\n\t\"MAVEN_OPTS\",\n]);\n\n/**\n * Matches a URL / DSN with embedded userinfo (`scheme://user:pass@host`).\n * Used for value-based denial; only the variable NAME is ever recorded.\n */\nconst AUTH_URL_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\/[^\\s/@:]+:[^\\s/@]+@[^\\s/@]/i;\n\n/** Path patterns that look like credential / key material on disk. */\nconst SENSITIVE_PATH_REGEX =\n\t/(?:^|[/\\\\])(?:\\.env(?:\\..*)?|auth\\.json|oauth\\.json|\\.netrc|\\.npmrc|\\.pgpass|credentials|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*(?:token|private[_-]?key|credential).*)$/i;\n\nexport interface PathAccessRequestV2 {\n\treadonly kind: PathAccessKind;\n\treadonly path: string;\n}\n\nexport interface PolicyDiagnostic {\n\treadonly code: string;\n\treadonly message: string;\n\treadonly severity: \"info\" | \"warn\" | \"block\";\n}\n\nexport interface PathDecisionV2 {\n\treadonly requestedPath: string;\n\treadonly candidate: string;\n\treadonly kind: PathAccessKind;\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly matchedPattern?: string;\n}\n\nexport interface EnvDecisionV2 {\n\treadonly action: \"allow\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\t/** Denied variable NAMES only. Values are never recorded. */\n\treadonly deniedNames: readonly string[];\n}\n\nexport interface SandboxPolicyV2Decision {\n\treadonly action: \"allow\" | \"confirm\" | \"block\";\n\treadonly rule: string;\n\treadonly reason: string;\n\treadonly diagnostics: readonly PolicyDiagnostic[];\n\treadonly pathDecisions: readonly PathDecisionV2[];\n\treadonly networkDecision?: SandboxDecision;\n\treadonly envDecision?: EnvDecisionV2;\n}\n\nexport interface SandboxPolicyV2Input {\n\treadonly policy: SandboxPolicy;\n\treadonly pathRequests?: readonly PathAccessRequestV2[];\n\treadonly networkRequest?: NetworkAccessRequest;\n\treadonly env?: Readonly<Record<string, string | undefined>>;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nfunction isSensitiveEnvName(name: string): boolean {\n\tif (SENSITIVE_ENV_EXACT.has(name)) return true;\n\treturn SENSITIVE_ENV_REGEX.test(name);\n}\n\nfunction normalizePathValue(value: string): string {\n\tconst resolved = path.resolve(value);\n\tlet normalized = resolved.replace(/\\\\/g, \"/\");\n\tif (normalized.length > 1) normalized = normalized.replace(/\\/+$/, \"\");\n\treturn normalized;\n}\n\nfunction ruleHasGlob(pattern: string): boolean {\n\treturn /[*?[\\]{}]/.test(pattern);\n}\n\nfunction matchesRule(pattern: string, candidate: string): boolean {\n\tconst normPattern = normalizePathValue(pattern);\n\tconst normCandidate = normalizePathValue(candidate);\n\tif (ruleHasGlob(normPattern)) {\n\t\tif (minimatch(normCandidate, normPattern)) return true;\n\t\t// also accept recursive prefix form even if the writer omitted `/**`\n\t\treturn minimatch(normCandidate, `${normPattern}/**`);\n\t}\n\treturn normCandidate === normPattern || normCandidate.startsWith(`${normPattern}/`);\n}\n\nfunction matchesAny(patterns: readonly string[], candidate: string): { match: boolean; pattern?: string } {\n\tfor (const pattern of patterns) {\n\t\tif (matchesRule(pattern, candidate)) return { match: true, pattern };\n\t}\n\treturn { match: false };\n}\n\nfunction isInsideRoot(root: string, candidate: string): boolean {\n\tconst normRoot = normalizePathValue(root);\n\tconst normCandidate = normalizePathValue(candidate);\n\treturn normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);\n}\n\nfunction isSensitivePath(value: string): boolean {\n\treturn SENSITIVE_PATH_REGEX.test(value.replace(/\\\\/g, \"/\"));\n}\n\n/** True for IPv4 / IPv6 loopback and localhost hostnames. */\nfunction isLoopbackHost(host: string): boolean {\n\tconst h = host\n\t\t.toLowerCase()\n\t\t.replace(/^\\[|\\]$/g, \"\")\n\t\t.trim();\n\tif (h === \"localhost\") return true;\n\tif (h === \"127.0.0.1\" || h === \"::1\" || h === \"0:0:0:0:0:0:0:1\") return true;\n\tif (h === \"::ffff:127.0.0.1\" || h === \"::ffff:7f00:1\") return true;\n\tif (/^127\\./.test(h)) return true;\n\treturn false;\n}\n\nfunction normalizeNetworkLoopback(request: NetworkAccessRequest): NetworkAccessRequest {\n\tlet host = request.host;\n\tif (!host && request.url) {\n\t\ttry {\n\t\t\thost = new URL(request.url).hostname;\n\t\t} catch {\n\t\t\thost = undefined;\n\t\t}\n\t}\n\tif (host && isLoopbackHost(host)) {\n\t\treturn { ...request, host, loopback: true };\n\t}\n\treturn request;\n}\n\nfunction hostFromRequest(request: NetworkAccessRequest): string | undefined {\n\tif (request.host) return request.host.toLowerCase();\n\tif (!request.url) return undefined;\n\ttry {\n\t\treturn new URL(request.url).hostname.toLowerCase();\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hostMatches(patterns: readonly string[], host: string): boolean {\n\tconst h = host.replace(/\\.$/, \"\");\n\tfor (const raw of patterns) {\n\t\tconst p = raw.toLowerCase().replace(/\\.$/, \"\");\n\t\tif (h === p || h.endsWith(`.${p}`)) return true;\n\t}\n\treturn false;\n}\n\nfunction decideNetworkV2(policy: SandboxPolicy, request: NetworkAccessRequest): SandboxDecision {\n\tif (policy.mode === \"off\") return { allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" };\n\tif (request.browser || request.unixSocketPath) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.socket_or_browser\",\n\t\t\treason: \"Browser and Unix socket access is denied by default.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"none\") {\n\t\treturn { allowed: false, rule: \"network.none\", reason: \"Network access is disabled by policy.\" };\n\t}\n\tif (request.loopback) {\n\t\tif (\n\t\t\tpolicy.network.mode === \"loopback\" ||\n\t\t\tpolicy.network.mode === \"domain-allowlist\" ||\n\t\t\tpolicy.network.mode === \"all-explicit\"\n\t\t) {\n\t\t\treturn { allowed: true, rule: \"network.loopback\", reason: \"Loopback access is allowed.\" };\n\t\t}\n\t\treturn { allowed: false, rule: \"network.loopback_denied\", reason: \"Loopback access is denied.\" };\n\t}\n\tconst host = hostFromRequest(request);\n\tif (!host)\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"network.unknown_host\",\n\t\t\treason: \"Network host could not be resolved from request.\",\n\t\t};\n\tif (hostMatches(policy.network.deniedDomains, host)) {\n\t\treturn { allowed: false, rule: \"network.domain_deny\", reason: \"Host matches a denied domain.\" };\n\t}\n\tif (policy.network.mode === \"all-explicit\") {\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trule: \"network.explicit_all\",\n\t\t\treason: \"Explicit network profile allows outbound host access.\",\n\t\t};\n\t}\n\tif (policy.network.mode === \"domain-allowlist\" && hostMatches(policy.network.allowedDomains, host)) {\n\t\treturn { allowed: true, rule: \"network.domain_allow\", reason: \"Host matches an allowed domain.\" };\n\t}\n\treturn { allowed: false, rule: \"network.domain_not_allowed\", reason: \"Host is not allowed by network policy.\" };\n}\n\nfunction decidePathV2(\n\tpolicy: SandboxPolicy,\n\trequest: PathAccessRequestV2,\n\tresolver: SandboxPathResolver | undefined,\n): PathDecisionV2 {\n\tconst requested = request.path;\n\tconst base = (\n\t\trule: string,\n\t\treason: string,\n\t\tcandidate: string,\n\t\taction: \"allow\" | \"block\",\n\t\tmatchedPattern?: string,\n\t): PathDecisionV2 => ({\n\t\trequestedPath: requested,\n\t\tcandidate,\n\t\tkind: request.kind,\n\t\taction,\n\t\trule,\n\t\treason,\n\t\tmatchedPattern,\n\t});\n\tconst block = (rule: string, reason: string, candidate: string, matchedPattern?: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"block\", matchedPattern);\n\tconst allow = (rule: string, reason: string, candidate: string): PathDecisionV2 =>\n\t\tbase(rule, reason, candidate, \"allow\");\n\n\tif (requested.includes(\"\\0\")) {\n\t\treturn block(\"path.invalid\", \"Path contains a NUL byte.\", requested);\n\t}\n\n\tlet candidate: string;\n\tlet isSymlink = false;\n\tif (resolver) {\n\t\tconst resolved = resolver(requested);\n\t\tif (resolved.error) {\n\t\t\treturn block(\"path.resolve_error\", resolved.error, requested);\n\t\t}\n\t\tcandidate = resolved.realPath ?? resolved.nearestExistingParentRealPath ?? normalizePathValue(requested);\n\t\tisSymlink = resolved.isSymlink === true;\n\t} else {\n\t\tcandidate = normalizePathValue(requested);\n\t}\n\n\tif (isSensitivePath(requested) || isSensitivePath(candidate)) {\n\t\treturn block(\"path.sensitive\", \"Sensitive credential-like path is denied.\", candidate);\n\t}\n\n\tif (!isInsideRoot(policy.filesystem.root, candidate)) {\n\t\treturn block(\"path.root_escape\", \"Resolved path is outside the sandbox root.\", candidate);\n\t}\n\n\tif (isSymlink && !policy.filesystem.followSymlinks) {\n\t\treturn block(\"path.symlink\", \"Symlink traversal is denied by policy.\", candidate);\n\t}\n\n\tif (request.kind === \"read\") {\n\t\tconst denied = matchesAny(policy.filesystem.readDeny, candidate);\n\t\tif (denied.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, denied.pattern);\n\t\t}\n\t\tconst deniedRequested = matchesAny(policy.filesystem.readDeny, requested);\n\t\tif (deniedRequested.match) {\n\t\t\treturn block(\"path.read_deny\", \"Read path matches a deny rule.\", candidate, deniedRequested.pattern);\n\t\t}\n\t\tif (matchesAny(policy.filesystem.readAllow, candidate).match) {\n\t\t\treturn allow(\"path.read_allow\", \"Read path is allowed.\", candidate);\n\t\t}\n\t\treturn block(\"path.read_not_allowed\", \"Read path is not in an allow rule.\", candidate);\n\t}\n\n\tconst denyWriteCandidate = matchesAny(policy.filesystem.denyWrite, candidate);\n\tif (denyWriteCandidate.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteCandidate.pattern,\n\t\t);\n\t}\n\tconst denyWriteRequested = matchesAny(policy.filesystem.denyWrite, requested);\n\tif (denyWriteRequested.match) {\n\t\treturn block(\n\t\t\t\"path.deny_write\",\n\t\t\t\"Write path matches an unoverrideable denyWrite rule.\",\n\t\t\tcandidate,\n\t\t\tdenyWriteRequested.pattern,\n\t\t);\n\t}\n\tif (\n\t\tmatchesAny(policy.filesystem.writeAllow, candidate).match ||\n\t\tmatchesAny(policy.filesystem.tempWrite, candidate).match\n\t) {\n\t\treturn allow(\"path.write_allow\", \"Write path is allowed.\", candidate);\n\t}\n\treturn block(\"path.write_not_allowed\", \"Write path is not in an allow rule.\", candidate);\n}\n\nfunction decideEnvV2(env: Readonly<Record<string, string | undefined>>): EnvDecisionV2 {\n\tconst denied: string[] = [];\n\tfor (const [name, value] of Object.entries(env)) {\n\t\tif (value === undefined) continue;\n\t\tif (ENV_DENY_NAMES.has(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (isSensitiveEnvName(name)) {\n\t\t\tdenied.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tif (AUTH_URL_REGEX.test(value)) {\n\t\t\t// Value-based denial: the value embeds credentials. Record NAME only.\n\t\t\tdenied.push(name);\n\t\t}\n\t}\n\tif (denied.length > 0) {\n\t\treturn {\n\t\t\taction: \"block\",\n\t\t\trule: \"env.denied_pattern\",\n\t\t\treason: `Environment contains denied variable(s): ${denied.join(\", \")}.`,\n\t\t\tdeniedNames: denied,\n\t\t};\n\t}\n\treturn { action: \"allow\", rule: \"env.allow\", reason: \"No denied environment variables.\", deniedNames: [] };\n}\n\n/**\n * Public: evaluate path / env / network requests against a sandbox policy.\n * Path and env checks are fail-closed. Audit mode downgrades a would-block\n * outcome to confirm; enforce mode keeps it block.\n */\nexport function evaluateSandboxPolicyV2(input: SandboxPolicyV2Input): SandboxPolicyV2Decision {\n\tconst { policy } = input;\n\tconst diagnostics: PolicyDiagnostic[] = [];\n\tconst pathDecisions: PathDecisionV2[] = [];\n\tlet envDecision: EnvDecisionV2 | undefined;\n\tlet networkDecision: SandboxDecision | undefined;\n\tlet worst: \"allow\" | \"block\" = \"block\";\n\n\tif (policy.mode === \"off\") {\n\t\treturn {\n\t\t\taction: \"allow\",\n\t\t\trule: \"sandbox.off\",\n\t\t\treason: \"Sandbox policy is disabled.\",\n\t\t\tdiagnostics,\n\t\t\tpathDecisions,\n\t\t};\n\t}\n\n\t// Default to allow and escalate to block on any failed check.\n\tworst = \"allow\";\n\n\tif (input.env) {\n\t\tenvDecision = decideEnvV2(input.env);\n\t\tif (envDecision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({\n\t\t\t\tcode: envDecision.rule,\n\t\t\t\tmessage: `Denied env name(s): ${envDecision.deniedNames.join(\", \")}`,\n\t\t\t\tseverity: \"block\",\n\t\t\t});\n\t\t}\n\t}\n\n\tfor (const request of input.pathRequests ?? []) {\n\t\tconst decision = decidePathV2(policy, request, input.resolver);\n\t\tpathDecisions.push(decision);\n\t\tif (decision.action === \"block\") {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: decision.rule, message: decision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tif (input.networkRequest) {\n\t\tconst normalized = normalizeNetworkLoopback(input.networkRequest);\n\t\tnetworkDecision = decideNetworkV2(policy, normalized);\n\t\tif (!networkDecision.allowed) {\n\t\t\tworst = \"block\";\n\t\t\tdiagnostics.push({ code: networkDecision.rule, message: networkDecision.reason, severity: \"block\" });\n\t\t}\n\t}\n\n\tlet action: \"allow\" | \"confirm\" | \"block\";\n\tlet rule: string;\n\tlet reason: string;\n\tif (worst === \"allow\") {\n\t\taction = \"allow\";\n\t\trule = \"policy.composite_allow\";\n\t\treason = \"All sandbox checks passed.\";\n\t} else if (policy.mode === \"audit\") {\n\t\taction = \"confirm\";\n\t\trule = \"policy.audit_block\";\n\t\treason = \"Audit mode: a would-block check is downgraded to confirm.\";\n\t} else {\n\t\taction = \"block\";\n\t\trule = \"policy.block\";\n\t\treason = \"One or more sandbox checks blocked the request.\";\n\t}\n\n\treturn { action, rule, reason, diagnostics, pathDecisions, networkDecision, envDecision };\n}\n"]}

package/dist/core/tools/omp-pure-seams.d.ts

@@ -1,41 +0,0 @@
-/** Error categories raised by the OMP pure-seam loader. */
-export type OmpSeamsErrorCode = "DISABLED" | "VENDOR_NOT_FOUND" | "INVALID_SEAM";
-/** Typed error thrown by {@link loadOmpPureSeams}. */
-export declare class OmpSeamsError extends Error {
-    readonly code: OmpSeamsErrorCode;
-    constructor(code: OmpSeamsErrorCode, message: string);
-}
-/** The validated set of pure oh-my-pi seams (data/proposal-only). */
-export interface OmpPureSeams {
-    planRead(input: unknown): unknown;
-    presentRead(plan: unknown, file: unknown): unknown;
-    planSearch(input: unknown): unknown;
-    presentSearch(plan: unknown, matches: unknown, sourceDigests?: unknown): unknown;
-    parseHashlineProposal(text: string): unknown;
-    hashProposalLine(text: string): Promise<string>;
-    hashProposalSource(text: string): Promise<string>;
-}
-/**
- * Returns true unless the seams feature is explicitly disabled
- * (OMK_OMP_SEAMS === "0"). Enabled by default per ADR-OMP-009.
- * Reads `process.env` when no record is supplied.
- */
-export declare function isOmpSeamsEnabled(env?: Record<string, string | undefined>): boolean;
-/**
- * Walks up from `startDir` (inclusive) looking for a `vendor/oh-my-pi`
- * directory that contains the pure read seam marker file. Returns the absolute
- * vendor directory path, or `undefined` when none is found within the level cap.
- */
-export declare function resolveOmpVendorDir(startDir: string): string | undefined;
-/**
- * Loads and validates the three pure seam modules from the vendored oh-my-pi
- * tree and returns a frozen {@link OmpPureSeams} record. Throws
- * {@link OmpSeamsError} with code DISABLED when the feature is off,
- * VENDOR_NOT_FOUND when the vendor tree cannot be located, or INVALID_SEAM when
- * any expected export is missing or not a function.
- */
-export declare function loadOmpPureSeams(options?: {
-    vendorDir?: string;
-    env?: Record<string, string | undefined>;
-}): Promise<OmpPureSeams>;
-//# sourceMappingURL=omp-pure-seams.d.ts.map

package/dist/core/tools/omp-pure-seams.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"omp-pure-seams.d.ts","sourceRoot":"","sources":["../../../src/core/tools/omp-pure-seams.ts"],"names":[],"mappings":"AAiBA,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEjF,sDAAsD;AACtD,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAEjC,YAAY,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAInD;CACD;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAClC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjF,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAGnF;AAMD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxE;AAwBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,YAAY,CAAC,CAqExB","sourcesContent":["/**\n * Flag-gated loader for the vendored oh-my-pi \"pure\" read/search/hashline seams.\n *\n * These seams are pure data/proposal-only functions (planning + presentation +\n * hashline parsing). They do NOT touch edit/write/file-mutation paths. The\n * loader is enabled by default and opts out via OMK_OMP_SEAMS=0 (ADR-OMP-009);\n * when disabled it throws DISABLED and tool behavior falls back to the\n * pre-seam implementation byte-identically.\n *\n * The file is erasable TypeScript: no `enum`, no parameter properties, no `as`,\n * no non-null assertions, no `any` annotations, and no runtime dependencies\n * beyond the Node.js standard library.\n */\nimport { existsSync } from \"node:fs\";\nimport { dirname, isAbsolute, join, resolve } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n/** Error categories raised by the OMP pure-seam loader. */\nexport type OmpSeamsErrorCode = \"DISABLED\" | \"VENDOR_NOT_FOUND\" | \"INVALID_SEAM\";\n\n/** Typed error thrown by {@link loadOmpPureSeams}. */\nexport class OmpSeamsError extends Error {\n\treadonly code: OmpSeamsErrorCode;\n\n\tconstructor(code: OmpSeamsErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OmpSeamsError\";\n\t\tthis.code = code;\n\t}\n}\n\n/** The validated set of pure oh-my-pi seams (data/proposal-only). */\nexport interface OmpPureSeams {\n\tplanRead(input: unknown): unknown;\n\tpresentRead(plan: unknown, file: unknown): unknown;\n\tplanSearch(input: unknown): unknown;\n\tpresentSearch(plan: unknown, matches: unknown, sourceDigests?: unknown): unknown;\n\tparseHashlineProposal(text: string): unknown;\n\thashProposalLine(text: string): Promise<string>;\n\thashProposalSource(text: string): Promise<string>;\n}\n\n/**\n * Returns true unless the seams feature is explicitly disabled\n * (OMK_OMP_SEAMS === \"0\"). Enabled by default per ADR-OMP-009.\n * Reads `process.env` when no record is supplied.\n */\nexport function isOmpSeamsEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_OMP_SEAMS !== \"0\";\n}\n\nconst VENDOR_SEGMENT = join(\"vendor\", \"oh-my-pi\");\nconst VENDOR_MARKER = join(VENDOR_SEGMENT, \"packages\", \"coding-agent\", \"src\", \"pure\", \"read.ts\");\nconst MAX_WALK_UP_LEVELS = 8;\n\n/**\n * Walks up from `startDir` (inclusive) looking for a `vendor/oh-my-pi`\n * directory that contains the pure read seam marker file. Returns the absolute\n * vendor directory path, or `undefined` when none is found within the level cap.\n */\nexport function resolveOmpVendorDir(startDir: string): string | undefined {\n\tlet dir = isAbsolute(startDir) ? startDir : resolve(startDir);\n\tfor (let level = 0; level <= MAX_WALK_UP_LEVELS; level += 1) {\n\t\tif (existsSync(join(dir, VENDOR_MARKER))) {\n\t\t\treturn join(dir, VENDOR_SEGMENT);\n\t\t}\n\t\tconst parent = dirname(dir);\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn undefined;\n}\n\n// --- internal narrowing helpers (no `as`; type guards carry the signatures) ---\n\ntype SeamFn = (...args: never[]) => unknown;\ntype SeamAsyncStrFn = (...args: never[]) => Promise<string>;\n\nfunction isSeamFn(member: unknown): member is SeamFn {\n\treturn typeof member === \"function\";\n}\n\nfunction isSeamAsyncStrFn(member: unknown): member is SeamAsyncStrFn {\n\treturn typeof member === \"function\";\n}\n\nfunction expectFn<T extends SeamFn>(member: unknown, guard: (m: unknown) => m is T, name: string): T {\n\tif (guard(member)) return member;\n\tthrow new OmpSeamsError(\"INVALID_SEAM\", `OMP seam missing or non-function: ${name}`);\n}\n\nconst READ_SEAM = join(\"packages\", \"coding-agent\", \"src\", \"pure\", \"read.ts\");\nconst SEARCH_SEAM = join(\"packages\", \"coding-agent\", \"src\", \"pure\", \"search.ts\");\nconst PROPOSAL_SEAM = join(\"packages\", \"hashline\", \"src\", \"proposal.ts\");\n\n/**\n * Loads and validates the three pure seam modules from the vendored oh-my-pi\n * tree and returns a frozen {@link OmpPureSeams} record. Throws\n * {@link OmpSeamsError} with code DISABLED when the feature is off,\n * VENDOR_NOT_FOUND when the vendor tree cannot be located, or INVALID_SEAM when\n * any expected export is missing or not a function.\n */\nexport async function loadOmpPureSeams(options?: {\n\tvendorDir?: string;\n\tenv?: Record<string, string | undefined>;\n}): Promise<OmpPureSeams> {\n\tconst env: Record<string, string | undefined> = options?.env ?? process.env;\n\tif (!isOmpSeamsEnabled(env)) {\n\t\tthrow new OmpSeamsError(\n\t\t\t\"DISABLED\",\n\t\t\t\"OMP pure seams are disabled (OMK_OMP_SEAMS=0; unset or set to any other value to enable).\",\n\t\t);\n\t}\n\n\tlet vendorDir: string | undefined = options?.vendorDir ?? env.OMK_OMP_VENDOR_DIR;\n\tif (!vendorDir) {\n\t\tconst moduleUrl = new URL(\".\", import.meta.url);\n\t\tif (moduleUrl.protocol !== \"file:\") {\n\t\t\tthrow new OmpSeamsError(\n\t\t\t\t\"VENDOR_NOT_FOUND\",\n\t\t\t\t\"OMP vendor dir was not provided and the module is not a file URL.\",\n\t\t\t);\n\t\t}\n\t\tconst found = resolveOmpVendorDir(fileURLToPath(moduleUrl));\n\t\tif (!found) {\n\t\t\tthrow new OmpSeamsError(\n\t\t\t\t\"VENDOR_NOT_FOUND\",\n\t\t\t\t\"OMP vendor dir not found by walking up from the module directory.\",\n\t\t\t);\n\t\t}\n\t\tvendorDir = found;\n\t}\n\tif (!existsSync(vendorDir)) {\n\t\tthrow new OmpSeamsError(\"VENDOR_NOT_FOUND\", `OMP vendor dir does not exist: ${vendorDir}`);\n\t}\n\n\tconst readUrl = pathToFileURL(join(vendorDir, READ_SEAM)).href;\n\tconst searchUrl = pathToFileURL(join(vendorDir, SEARCH_SEAM)).href;\n\tconst proposalUrl = pathToFileURL(join(vendorDir, PROPOSAL_SEAM)).href;\n\n\tconst readMod = await import(readUrl);\n\tconst searchMod = await import(searchUrl);\n\tconst proposalMod = await import(proposalUrl);\n\n\t// Validate every expected member up front so the INVALID_SEAM error lists\n\t// ALL missing/non-function exports, not just the first one encountered.\n\tconst expected: ReadonlyArray<readonly [unknown, string]> = [\n\t\t[readMod.planRead, \"planRead\"],\n\t\t[readMod.presentRead, \"presentRead\"],\n\t\t[searchMod.planSearch, \"planSearch\"],\n\t\t[searchMod.presentSearch, \"presentSearch\"],\n\t\t[proposalMod.parseHashlineProposal, \"parseHashlineProposal\"],\n\t\t[proposalMod.hashProposalLine, \"hashProposalLine\"],\n\t\t[proposalMod.hashProposalSource, \"hashProposalSource\"],\n\t];\n\tconst missing: string[] = [];\n\tfor (const [member, name] of expected) {\n\t\tif (typeof member !== \"function\") missing.push(name);\n\t}\n\tif (missing.length > 0) {\n\t\tthrow new OmpSeamsError(\"INVALID_SEAM\", `OMP seams missing or non-function: ${missing.join(\", \")}`);\n\t}\n\n\tconst rec: OmpPureSeams = {\n\t\tplanRead: expectFn(readMod.planRead, isSeamFn, \"planRead\"),\n\t\tpresentRead: expectFn(readMod.presentRead, isSeamFn, \"presentRead\"),\n\t\tplanSearch: expectFn(searchMod.planSearch, isSeamFn, \"planSearch\"),\n\t\tpresentSearch: expectFn(searchMod.presentSearch, isSeamFn, \"presentSearch\"),\n\t\tparseHashlineProposal: expectFn(proposalMod.parseHashlineProposal, isSeamFn, \"parseHashlineProposal\"),\n\t\thashProposalLine: expectFn(proposalMod.hashProposalLine, isSeamAsyncStrFn, \"hashProposalLine\"),\n\t\thashProposalSource: expectFn(proposalMod.hashProposalSource, isSeamAsyncStrFn, \"hashProposalSource\"),\n\t};\n\tObject.freeze(rec);\n\treturn rec;\n}\n"]}

package/dist/core/tools/omp-pure-seams.js

@@ -1,142 +0,0 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-/**
- * Flag-gated loader for the vendored oh-my-pi "pure" read/search/hashline seams.
- *
- * These seams are pure data/proposal-only functions (planning + presentation +
- * hashline parsing). They do NOT touch edit/write/file-mutation paths. The
- * loader is enabled by default and opts out via OMK_OMP_SEAMS=0 (ADR-OMP-009);
- * when disabled it throws DISABLED and tool behavior falls back to the
- * pre-seam implementation byte-identically.
- *
- * The file is erasable TypeScript: no `enum`, no parameter properties, no `as`,
- * no non-null assertions, no `any` annotations, and no runtime dependencies
- * beyond the Node.js standard library.
- */
-import { existsSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-/** Typed error thrown by {@link loadOmpPureSeams}. */
-export class OmpSeamsError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = "OmpSeamsError";
-        this.code = code;
-    }
-}
-/**
- * Returns true unless the seams feature is explicitly disabled
- * (OMK_OMP_SEAMS === "0"). Enabled by default per ADR-OMP-009.
- * Reads `process.env` when no record is supplied.
- */
-export function isOmpSeamsEnabled(env) {
-    const source = env ?? process.env;
-    return source.OMK_OMP_SEAMS !== "0";
-}
-const VENDOR_SEGMENT = join("vendor", "oh-my-pi");
-const VENDOR_MARKER = join(VENDOR_SEGMENT, "packages", "coding-agent", "src", "pure", "read.ts");
-const MAX_WALK_UP_LEVELS = 8;
-/**
- * Walks up from `startDir` (inclusive) looking for a `vendor/oh-my-pi`
- * directory that contains the pure read seam marker file. Returns the absolute
- * vendor directory path, or `undefined` when none is found within the level cap.
- */
-export function resolveOmpVendorDir(startDir) {
-    let dir = isAbsolute(startDir) ? startDir : resolve(startDir);
-    for (let level = 0; level <= MAX_WALK_UP_LEVELS; level += 1) {
-        if (existsSync(join(dir, VENDOR_MARKER))) {
-            return join(dir, VENDOR_SEGMENT);
-        }
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return undefined;
-}
-function isSeamFn(member) {
-    return typeof member === "function";
-}
-function isSeamAsyncStrFn(member) {
-    return typeof member === "function";
-}
-function expectFn(member, guard, name) {
-    if (guard(member))
-        return member;
-    throw new OmpSeamsError("INVALID_SEAM", `OMP seam missing or non-function: ${name}`);
-}
-const READ_SEAM = join("packages", "coding-agent", "src", "pure", "read.ts");
-const SEARCH_SEAM = join("packages", "coding-agent", "src", "pure", "search.ts");
-const PROPOSAL_SEAM = join("packages", "hashline", "src", "proposal.ts");
-/**
- * Loads and validates the three pure seam modules from the vendored oh-my-pi
- * tree and returns a frozen {@link OmpPureSeams} record. Throws
- * {@link OmpSeamsError} with code DISABLED when the feature is off,
- * VENDOR_NOT_FOUND when the vendor tree cannot be located, or INVALID_SEAM when
- * any expected export is missing or not a function.
- */
-export async function loadOmpPureSeams(options) {
-    const env = options?.env ?? process.env;
-    if (!isOmpSeamsEnabled(env)) {
-        throw new OmpSeamsError("DISABLED", "OMP pure seams are disabled (OMK_OMP_SEAMS=0; unset or set to any other value to enable).");
-    }
-    let vendorDir = options?.vendorDir ?? env.OMK_OMP_VENDOR_DIR;
-    if (!vendorDir) {
-        const moduleUrl = new URL(".", import.meta.url);
-        if (moduleUrl.protocol !== "file:") {
-            throw new OmpSeamsError("VENDOR_NOT_FOUND", "OMP vendor dir was not provided and the module is not a file URL.");
-        }
-        const found = resolveOmpVendorDir(fileURLToPath(moduleUrl));
-        if (!found) {
-            throw new OmpSeamsError("VENDOR_NOT_FOUND", "OMP vendor dir not found by walking up from the module directory.");
-        }
-        vendorDir = found;
-    }
-    if (!existsSync(vendorDir)) {
-        throw new OmpSeamsError("VENDOR_NOT_FOUND", `OMP vendor dir does not exist: ${vendorDir}`);
-    }
-    const readUrl = pathToFileURL(join(vendorDir, READ_SEAM)).href;
-    const searchUrl = pathToFileURL(join(vendorDir, SEARCH_SEAM)).href;
-    const proposalUrl = pathToFileURL(join(vendorDir, PROPOSAL_SEAM)).href;
-    const readMod = await import(__rewriteRelativeImportExtension(readUrl));
-    const searchMod = await import(__rewriteRelativeImportExtension(searchUrl));
-    const proposalMod = await import(__rewriteRelativeImportExtension(proposalUrl));
-    // Validate every expected member up front so the INVALID_SEAM error lists
-    // ALL missing/non-function exports, not just the first one encountered.
-    const expected = [
-        [readMod.planRead, "planRead"],
-        [readMod.presentRead, "presentRead"],
-        [searchMod.planSearch, "planSearch"],
-        [searchMod.presentSearch, "presentSearch"],
-        [proposalMod.parseHashlineProposal, "parseHashlineProposal"],
-        [proposalMod.hashProposalLine, "hashProposalLine"],
-        [proposalMod.hashProposalSource, "hashProposalSource"],
-    ];
-    const missing = [];
-    for (const [member, name] of expected) {
-        if (typeof member !== "function")
-            missing.push(name);
-    }
-    if (missing.length > 0) {
-        throw new OmpSeamsError("INVALID_SEAM", `OMP seams missing or non-function: ${missing.join(", ")}`);
-    }
-    const rec = {
-        planRead: expectFn(readMod.planRead, isSeamFn, "planRead"),
-        presentRead: expectFn(readMod.presentRead, isSeamFn, "presentRead"),
-        planSearch: expectFn(searchMod.planSearch, isSeamFn, "planSearch"),
-        presentSearch: expectFn(searchMod.presentSearch, isSeamFn, "presentSearch"),
-        parseHashlineProposal: expectFn(proposalMod.parseHashlineProposal, isSeamFn, "parseHashlineProposal"),
-        hashProposalLine: expectFn(proposalMod.hashProposalLine, isSeamAsyncStrFn, "hashProposalLine"),
-        hashProposalSource: expectFn(proposalMod.hashProposalSource, isSeamAsyncStrFn, "hashProposalSource"),
-    };
-    Object.freeze(rec);
-    return rec;
-}
-//# sourceMappingURL=omp-pure-seams.js.map