opencode-swarm 7.144.4 → 7.144.6

package/dist/cli/index-zy7f84cs.js

@@ -0,0 +1,1210 @@
+// @bun
+import {
+  init_logger,
+  warn
+} from "./index-zgwm4ryv.js";
+import {
+  __esm,
+  __export,
+  __require,
+  __toCommonJS
+} from "./index-a76rekgs.js";
+
+// src/sandbox/executors/bubblewrap.ts
+var exports_bubblewrap = {};
+__export(exports_bubblewrap, {
+  BubblewrapSandboxExecutor: () => BubblewrapSandboxExecutor
+});
+var init_bubblewrap = __esm(() => {
+  init_bubblewrap_executor();
+});
+
+// src/sandbox/macos/sandbox-exec-executor.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdtempSync, writeFileSync } from "fs";
+import * as os from "os";
+import * as path from "path";
+function resolveBinary(absolutePath, bareName) {
+  try {
+    if (_internals.exists(absolutePath)) {
+      return absolutePath;
+    }
+  } catch {}
+  return bareName;
+}
+function resolveSandboxExecBinary() {
+  return resolveBinary(SANDBOX_EXEC_ABSOLUTE, "sandbox-exec");
+}
+function resolveProbeTargetBinary() {
+  return resolveBinary(TRUE_ABSOLUTE, "true");
+}
+function buildProbeProfile(tempDir) {
+  return `(version 1)
+(allow default)
+(deny file-write*)
+(allow file-write* (subpath "${sbplEscapePath(tempDir)}"))
+(setenv SWARM_SANDBOX_PROBE "1")
+(unsetenv SWARM_SANDBOX_PROBE)`;
+}
+function probeSandboxExec() {
+  try {
+    const binary = resolveSandboxExecBinary();
+    const target = resolveProbeTargetBinary();
+    const profile = buildProbeProfile(os.tmpdir());
+    const result = _internals.spawnSync(binary, ["-p", profile, target], {
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.error) {
+      const code = result.error.code;
+      if (code && SANDBOX_UNAVAILABLE_CODES.has(code)) {
+        warn(`Sandbox disabled: sandbox-exec error (${code}). Falling through to tool-layer enforcement.`);
+        return false;
+      }
+      warn(`Sandbox disabled: spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
+      return false;
+    }
+    return result.status === 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
+    return false;
+  }
+}
+function probeSandboxExecMemoized() {
+  const now = Date.now();
+  if (_probeMemo && now < _probeMemo.expiresAt) {
+    return _probeMemo.result;
+  }
+  const result = _internals.probeSandboxExec();
+  _probeMemo = {
+    result,
+    expiresAt: result ? Number.POSITIVE_INFINITY : now + PROBE_FAILURE_TTL_MS
+  };
+  return result;
+}
+function resetProbeMemo() {
+  _probeMemo = undefined;
+}
+function shellEscape(s) {
+  return s.replace(/'/g, "'\\''");
+}
+function sbplEscapePath(path2) {
+  const withoutControlChars = path2.split("").filter((ch) => {
+    const cp = ch.codePointAt(0);
+    return cp >= 32 && cp !== 127;
+  }).join("");
+  return withoutControlChars.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+}
+function buildSandboxProfile(scopePaths, tempDir, envOverrides) {
+  const rwPaths = [...scopePaths];
+  if (tempDir) {
+    rwPaths.push(tempDir);
+  }
+  const rwAllowLines = rwPaths.map((p) => `(allow file-write* (subpath "${sbplEscapePath(p)}"))`).join(`
+`);
+  const envLines = [];
+  if (envOverrides) {
+    for (const [key, value] of Object.entries(envOverrides)) {
+      if (!isValidEnvKey(key)) {
+        continue;
+      }
+      if (value === null) {
+        envLines.push(`(unsetenv ${key})`);
+      } else {
+        const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+        envLines.push(`(setenv ${key} "${escaped}")`);
+      }
+    }
+  }
+  const profile = `(version 1)
+(allow default)
+(allow file-read* (subpath "/usr"))
+(allow file-read* (subpath "/bin"))
+(allow file-read* (subpath "/sbin"))
+(allow file-read* (subpath "/lib"))
+(allow file-read* (subpath "/lib64"))
+(deny file-write*)
+${rwAllowLines}
+${envLines.join(`
+`)}`;
+  return profile;
+}
+
+class MacOSSandboxExecutor {
+  mechanism = "sandbox-exec";
+  _scopePaths;
+  _tempDir;
+  _available;
+  _disabledReason;
+  constructor(scopePaths = [], tempDir) {
+    if (process.platform !== "darwin") {
+      throw new Error("MacOSSandboxExecutor not yet implemented");
+    }
+    this._scopePaths = scopePaths;
+    this._tempDir = tempDir;
+    this._available = false;
+    this._disabledReason = null;
+    try {
+      if (!_internals.probeSandboxExecMemoized()) {
+        this._disabledReason = "sandbox-exec not available or not functional";
+        warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+      } else {
+        this._available = true;
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this._disabledReason = `constructor threw: ${message}`;
+      this._available = false;
+      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+    }
+  }
+  isAvailable() {
+    return this._available;
+  }
+  disable(reason) {
+    this._disabledReason = reason;
+    this._available = false;
+    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
+  }
+  wrapCommand(command, scopePaths, tempDir, envOverrides) {
+    if (!this._available) {
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    if (!_internals.probeSandboxExecMemoized()) {
+      this._available = false;
+      this._disabledReason = "sandbox-exec became unavailable between calls";
+      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    const temp = tempDir ?? this._tempDir ?? os.tmpdir();
+    const allScopes = [...this._scopePaths, ...scopePaths];
+    const profile = buildSandboxProfile(allScopes, temp, envOverrides);
+    let profilePath;
+    try {
+      const profileDir = mkdtempSync(path.join(os.tmpdir(), "sandbox-"));
+      profilePath = path.join(profileDir, `profile-${process.pid}-${Date.now()}.sb`);
+      writeFileSync(profilePath, profile, { mode: 384 });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      warn(`Sandbox disabled: failed to write profile (${message}). Falling through to tool-layer enforcement.`);
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    const binary = _internals.resolveSandboxExecBinary();
+    const escapedCommand = shellEscape(command);
+    const escapedProfilePath = shellEscape(profilePath);
+    return `${binary} -f '${escapedProfilePath}' bash -c '${escapedCommand}'`;
+  }
+  getEnvOverrides() {
+    return {
+      DYLD_INSERT_LIBRARIES: null,
+      DYLD_LIBRARY_PATH: null,
+      DYLD_FRAMEWORK_PATH: null,
+      DYLD_ROOT_PATH: null,
+      PATH: "/usr/bin:/bin:/usr/sbin:/sbin"
+    };
+  }
+}
+var SANDBOX_UNAVAILABLE_CODES, SANDBOX_EXEC_ABSOLUTE = "/usr/bin/sandbox-exec", TRUE_ABSOLUTE = "/usr/bin/true", PROBE_FAILURE_TTL_MS = 60000, _probeMemo, _internals;
+var init_sandbox_exec_executor = __esm(() => {
+  init_logger();
+  init_executor();
+  SANDBOX_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
+  _internals = {
+    probeSandboxExec,
+    probeSandboxExecMemoized,
+    resetProbeMemo,
+    buildSandboxProfile,
+    buildProbeProfile,
+    resolveSandboxExecBinary,
+    resolveProbeTargetBinary,
+    exists: existsSync,
+    spawnSync
+  };
+});
+
+// src/sandbox/executors/macos.ts
+var exports_macos = {};
+__export(exports_macos, {
+  MacOSSandboxExecutor: () => MacOSSandboxExecutor
+});
+var init_macos = __esm(() => {
+  init_sandbox_exec_executor();
+});
+
+// src/sandbox/win32/edge-cases.ts
+function detectPowerShellEscape(command) {
+  if (process.platform !== "win32")
+    return false;
+  const encodedCommandPattern = /-EncodedCommand/i;
+  if (encodedCommandPattern.test(command)) {
+    return true;
+  }
+  const encodedBase64Pattern = /-Enc(odedCommand)?\s+[A-Za-z0-9+/=]+/i;
+  if (encodedBase64Pattern.test(command)) {
+    return true;
+  }
+  const psExePattern = /powershell\.exe?\s+.*-(?:e(?:n(?:c(?:odedCommand)?)?)?|wmi|remote)/i;
+  if (psExePattern.test(command)) {
+    return true;
+  }
+  const iexPattern = /\biex\b/i;
+  if (iexPattern.test(command)) {
+    return true;
+  }
+  const invokeExpressionPattern = /Invoke-Expression/i;
+  if (invokeExpressionPattern.test(command)) {
+    return true;
+  }
+  const invokeCommandRemotePattern = /Invoke-Command\s+.*-ComputerName/i;
+  if (invokeCommandRemotePattern.test(command)) {
+    return true;
+  }
+  const psCommandPattern = /powershell.*-Command\s+["'].*\$/i;
+  if (psCommandPattern.test(command)) {
+    return true;
+  }
+  const execPolicyPattern = /-ExecutionPolicy\s+(?:Bypass|RemoteSigned|Unrestricted)/i;
+  if (execPolicyPattern.test(command)) {
+    return true;
+  }
+  const noProfilePattern = /-NoProfile\s+-/i;
+  if (noProfilePattern.test(command)) {
+    return true;
+  }
+  const automationPattern = /New-Object\s+.*Management\.Automation/i;
+  if (automationPattern.test(command)) {
+    return true;
+  }
+  const downloadPattern = /\[System\.Net\.(?:WebClient|Http).*\]\.(?:DownloadString|DownloadFile)/i;
+  if (downloadPattern.test(command)) {
+    return true;
+  }
+  const hiddenWindowPattern = /-WindowStyle\s+Hidden/i;
+  if (hiddenWindowPattern.test(command)) {
+    return true;
+  }
+  const scriptInjectionPattern = /\$(?:env|input|host)\b.*\|/i;
+  if (scriptInjectionPattern.test(command)) {
+    return true;
+  }
+  const obfuscatedIexPattern = /IEX|i:eX/i;
+  if (obfuscatedIexPattern.test(command)) {
+    return true;
+  }
+  return false;
+}
+var init_edge_cases = () => {};
+
+// src/sandbox/win32/restricted-environment-executor.ts
+import { Buffer } from "buffer";
+import { spawnSync as spawnSync2 } from "child_process";
+import * as os2 from "os";
+import * as path2 from "path";
+function containsUnsafePathSyntax(value) {
+  return [...value].some((character) => character.charCodeAt(0) < 32 || UNSAFE_PATH_CHARACTERS.has(character));
+}
+function getSafeSystemRoot() {
+  const raw = process.env.SystemRoot;
+  if (typeof raw !== "string" || !/^[A-Za-z]:[\\/]/.test(raw) || containsUnsafePathSyntax(raw.slice(2)) || raw.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
+    return DEFAULT_SYSTEM_ROOT;
+  }
+  const normalized = path2.win32.normalize(raw);
+  return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
+}
+function getWindowsExecutablePaths() {
+  const systemRoot = getSafeSystemRoot();
+  return {
+    systemRoot,
+    cmdExe: path2.win32.join(systemRoot, "System32", "cmd.exe"),
+    powerShellExe: path2.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+  };
+}
+function probeWindowsSandbox() {
+  try {
+    const result = spawnSync2(getWindowsExecutablePaths().cmdExe, ["/d", "/s", "/c", "echo ok"], {
+      cwd: os2.tmpdir(),
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    if (result.error) {
+      const code = result.error.code;
+      if (code && SANDBOX_UNAVAILABLE_CODES2.has(code)) {
+        warn(`Sandbox disabled: spawn error (${code}). Falling through to tool-layer enforcement.`);
+        return false;
+      }
+      warn(`Sandbox disabled: spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
+      return false;
+    }
+    return result.status === 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
+    return false;
+  }
+}
+function psSingleQuoteEscape(s) {
+  return s.replace(/'/g, "''");
+}
+function normalizeInheritedPathEntry(rawEntry) {
+  const entry = rawEntry.trim();
+  if (!/^[A-Za-z]:[\\/]/.test(entry) || containsUnsafePathSyntax(entry.slice(2)) || entry.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
+    return null;
+  }
+  const normalized = path2.win32.normalize(entry);
+  return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
+}
+function getSafeWindowsPath() {
+  const { systemRoot } = getWindowsExecutablePaths();
+  const candidates = [
+    path2.win32.join(systemRoot, "System32"),
+    systemRoot,
+    ...(process.env.PATH ?? "").split(";")
+  ];
+  const seen = new Set;
+  const safeEntries = [];
+  for (const candidate of candidates) {
+    const normalized = normalizeInheritedPathEntry(candidate);
+    if (!normalized)
+      continue;
+    const identity = normalized.toLowerCase();
+    if (seen.has(identity))
+      continue;
+    seen.add(identity);
+    safeEntries.push(normalized);
+  }
+  return safeEntries.join(";");
+}
+function isPowerShellNativeCommand(command) {
+  return /^(?:Remove-Item|rm|del|erase|Copy-Item|cp|copy|Move-Item|mv|move|Rename-Item|ren|New-Item|ni|Get-Item|gi|Get-ChildItem|ls|dir|gci|Get-Content|cat|type|gc|Set-Content|sc|Add-Content|ac|Clear-Content|clc|Test-Path|Resolve-Path|Split-Path|Join-Path|Out-File|Get-Date)\b/i.test(command.trimStart());
+}
+function isSafePsCommandBody(command) {
+  return !/[;&|`$()\r\n]/.test(command);
+}
+function isPathInScopes(command, scopes) {
+  if (scopes.length === 0)
+    return true;
+  const pathPattern = /[A-Za-z]:(?:[^\\/:*?"<>|\r\n]+(?:\\[^\\/:*?"<>|\r\n]+)*)/g;
+  const paths = command.match(pathPattern) || [];
+  if (paths.length === 0)
+    return true;
+  const normalizedPaths = paths.map((p) => path2.win32.resolve(p));
+  const normalizedScopes = scopes.map((s) => s.toLowerCase().replace(/\\+$/, ""));
+  return normalizedPaths.every((p) => {
+    const lower = p.toLowerCase();
+    return normalizedScopes.some((scope) => lower.startsWith(scope));
+  });
+}
+
+class WindowsSandboxExecutor {
+  mechanism = "powershell-wrapper";
+  _scopePaths;
+  _tempDir;
+  _available;
+  _disabled;
+  _disabledReason;
+  constructor(scopePaths = [], tempDir) {
+    this._scopePaths = scopePaths;
+    this._tempDir = tempDir;
+    this._available = false;
+    this._disabled = false;
+    this._disabledReason = null;
+    try {
+      if (!_internals2.probeWindowsSandbox()) {
+        this._available = false;
+        this._disabledReason = "Windows sandbox not available or not functional";
+        warn(`Sandbox unavailable: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+      } else {
+        this._available = true;
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this._available = false;
+      this._disabledReason = `constructor probe threw: ${message}`;
+      warn(`Sandbox unavailable: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+    }
+  }
+  isAvailable() {
+    return this._available && !this._disabled;
+  }
+  disable(reason) {
+    this._disabled = true;
+    this._disabledReason = reason;
+    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
+  }
+  wrapCommand(command, scopePaths, tempDir, envOverrides) {
+    if (!this.isAvailable()) {
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    if (!_internals2.probeWindowsSandbox()) {
+      this._available = false;
+      this._disabledReason = "Windows sandbox became unavailable between calls";
+      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    const temp = tempDir ?? this._tempDir ?? os2.tmpdir();
+    const _allScopes = [...this._scopePaths, ...scopePaths];
+    if (detectPowerShellEscape(command)) {
+      throw new SandboxError("Command contains PowerShell escape patterns", "DETECT_POWERSHELL_ESCAPE");
+    }
+    if (!isPathInScopes(command, _allScopes)) {
+      throw new SandboxError("Command targets paths outside authorized scopes", "PATH_ESCAPE_SCOPE");
+    }
+    if (isPowerShellNativeCommand(command) && !isSafePsCommandBody(command)) {
+      throw new SandboxError("PowerShell-native command body contains unsafe characters", "UNSAFE_PS_COMMAND");
+    }
+    const safePath = getSafeWindowsPath();
+    const { cmdExe, powerShellExe } = getWindowsExecutablePaths();
+    const commandBase64 = Buffer.from(command, "utf8").toString("base64");
+    const escapedTemp = psSingleQuoteEscape(temp);
+    const escapedPath = psSingleQuoteEscape(safePath);
+    const escapedCmdExe = psSingleQuoteEscape(cmdExe);
+    const envOverrideLines = [];
+    if (envOverrides) {
+      for (const [key, value] of Object.entries(envOverrides)) {
+        if (!isValidEnvKey(key)) {
+          continue;
+        }
+        if (value === null) {
+          envOverrideLines.push(`Remove-Item Env:${key} -Force -ErrorAction SilentlyContinue;`);
+        } else {
+          const psEscaped = psSingleQuoteEscape(value);
+          envOverrideLines.push(`$env:${key} = '${psEscaped}';`);
+        }
+      }
+    }
+    const commandExec = isPowerShellNativeCommand(command) ? `Invoke-Expression $command;
+  exit 0;` : `$batchPath = $null;
+  $batchLocationPushed = $false;
+  try {
+    if ($command.Contains([char]13) -or $command.Contains([char]10)) {
+      $batchName = 'opencode-swarm-' + [Guid]::NewGuid().ToString('N') + '.cmd';
+      $batchPath = Join-Path $env:TEMP $batchName;
+      [IO.File]::WriteAllText($batchPath, $command, [Text.UTF8Encoding]::new($false));
+      Push-Location -LiteralPath $env:TEMP;
+      $batchLocationPushed = $true;
+      & '${escapedCmdExe}' /d /v:off /s /c ('call "' + $batchName + '"');
+    } else {
+      & '${escapedCmdExe}' /d /v:off /s /c $command;
+    }
+    $childExitCode = $LASTEXITCODE;
+  } finally {
+    if ($batchLocationPushed) {
+      Pop-Location;
+    }
+    if ($null -ne $batchPath) {
+      Remove-Item -LiteralPath $batchPath -Force -ErrorAction SilentlyContinue;
+    }
+  }
+  if ($null -eq $childExitCode) {
+    throw 'cmd.exe did not report an exit code';
+  }
+  exit [int]$childExitCode;`;
+    const envOverrideBlock = envOverrideLines.length > 0 ? `
+  ${envOverrideLines.join(`
+  `)}` : "";
+    const psScript = `
+$ErrorActionPreference = 'Stop';
+$ProgressPreference = 'SilentlyContinue';
+try {
+  $env:TEMP = '${escapedTemp}';
+  $env:TMP = '${escapedTemp}';
+
+  $env:PATH = '${escapedPath}';
+
+  $dangerousVars = @(
+    'LD_PRELOAD',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FRAMEWORK_PATH',
+    'DYLD_ROOT_PATH',
+    'DYLD_FORCE_FLAT_NAMESPACE'
+  );
+  foreach ($v in $dangerousVars) {
+    if (Test-Path Env:$v) {
+      Remove-Item Env:$v -Force -ErrorAction SilentlyContinue;
+    }
+  }
+  ${envOverrideBlock}
+
+  # Execute the command \u2014 PS-native cmdlets via Invoke-Expression, others via the standard command interpreter
+  $commandBytes = [Convert]::FromBase64String('${commandBase64}');
+  $command = [Text.Encoding]::UTF8.GetString($commandBytes);
+  ${commandExec};
+} catch {
+  [Console]::Error.WriteLine($_.Exception.Message);
+  exit 1;
+}`;
+    const encodedScript = Buffer.from(psScript, "utf16le").toString("base64");
+    const escapedPowerShellExe = psSingleQuoteEscape(powerShellExe);
+    return `& '${escapedPowerShellExe}' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand ${encodedScript}; exit $LASTEXITCODE`;
+  }
+  getEnvOverrides() {
+    return {
+      PATH: getSafeWindowsPath(),
+      TEMP: null,
+      TMP: null,
+      LD_PRELOAD: null,
+      DYLD_INSERT_LIBRARIES: null,
+      DYLD_LIBRARY_PATH: null,
+      DYLD_FRAMEWORK_PATH: null,
+      DYLD_ROOT_PATH: null,
+      DYLD_FORCE_FLAT_NAMESPACE: null
+    };
+  }
+}
+var SANDBOX_UNAVAILABLE_CODES2, DEFAULT_SYSTEM_ROOT = "C:\\Windows", UNSAFE_PATH_CHARACTERS, _internals2;
+var init_restricted_environment_executor = __esm(() => {
+  init_logger();
+  init_executor();
+  init_edge_cases();
+  SANDBOX_UNAVAILABLE_CODES2 = new Set([
+    "ENOENT",
+    "EACCES",
+    "EPERM",
+    "ENOSPC"
+  ]);
+  UNSAFE_PATH_CHARACTERS = new Set([
+    ":",
+    '"',
+    "'",
+    ";",
+    "&",
+    "|",
+    "<",
+    ">",
+    "^",
+    "%",
+    "!",
+    "?",
+    "*",
+    "`",
+    "$"
+  ]);
+  _internals2 = {
+    probeWindowsSandbox
+  };
+});
+
+// src/sandbox/win32/runner-client.ts
+var exports_runner_client = {};
+__export(exports_runner_client, {
+  probe: () => probe,
+  execute: () => execute,
+  buildDefaultPolicy: () => buildDefaultPolicy,
+  _resetProbeCache: () => _resetProbeCache,
+  _internals: () => _internals3,
+  RUNNER_EXIT_CODES: () => RUNNER_EXIT_CODES
+});
+import { spawn, spawnSync as spawnSync3 } from "child_process";
+import * as fs from "fs";
+import * as os3 from "os";
+import * as path3 from "path";
+import { fileURLToPath } from "url";
+function findRunnerBinary() {
+  const arch = process.arch === "x64" ? "x64" : "arm64";
+  const platform = "win32";
+  const packagePaths = [
+    path3.resolve(_runtimeDir, "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe"),
+    path3.resolve(_runtimeDir, "..", "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe")
+  ];
+  for (const p of packagePaths) {
+    try {
+      if (fs.existsSync(p)) {
+        return p;
+      }
+    } catch {}
+  }
+  try {
+    const result = spawnSync3("where", ["swarm-sandbox-runner.exe"], {
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    if (result.status === 0 && result.stdout?.trim()) {
+      return result.stdout.trim().split(`
+`)[0]?.trim() ?? null;
+    }
+  } catch {}
+  return null;
+}
+function probe() {
+  if (_cachedProbe !== undefined) {
+    return _cachedProbe;
+  }
+  if (process.platform !== "win32") {
+    _cachedProbe = {
+      available: false,
+      mode: "none",
+      capabilities: null,
+      error: "not Windows"
+    };
+    return _cachedProbe;
+  }
+  const binary = _internals3.findRunnerBinary();
+  if (!binary) {
+    _cachedProbe = {
+      available: false,
+      mode: "none",
+      capabilities: null,
+      error: "runner binary not found"
+    };
+    warn("Sandbox runner binary not found \u2014 degrading to weak sandbox");
+    return _cachedProbe;
+  }
+  try {
+    const result = _internals3.spawnRunner(binary, ["--probe"], {
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "pipe"],
+      cwd: os3.tmpdir()
+    });
+    if (result.error) {
+      _cachedProbe = {
+        available: false,
+        mode: "none",
+        capabilities: null,
+        error: `probe spawn error: ${result.error.code ?? result.error.message}`
+      };
+      warn(`Sandbox runner probe failed: ${_cachedProbe.error}`);
+      return _cachedProbe;
+    }
+    if (result.status !== 0) {
+      _cachedProbe = {
+        available: false,
+        mode: "none",
+        capabilities: null,
+        error: `probe exited with code ${result.status}`
+      };
+      warn(`Sandbox runner probe failed: ${_cachedProbe.error}`);
+      return _cachedProbe;
+    }
+    const capabilities = JSON.parse(result.stdout?.trim() ?? "{}");
+    let mode = "none";
+    if (capabilities.app_container_available) {
+      mode = "app-container";
+    } else if (capabilities.restricted_token_available) {
+      mode = "restricted-token";
+    }
+    _cachedProbe = {
+      available: mode !== "none",
+      mode,
+      capabilities
+    };
+    return _cachedProbe;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    _cachedProbe = {
+      available: false,
+      mode: "none",
+      capabilities: null,
+      error: `probe threw: ${msg}`
+    };
+    warn(`Sandbox runner probe threw: ${msg}`);
+    return _cachedProbe;
+  }
+}
+async function execute(command, policy, mode = "auto") {
+  const binary = _internals3.findRunnerBinary();
+  if (!binary) {
+    throw new Error("runner binary not found");
+  }
+  const policyJson = JSON.stringify(policy);
+  const args = ["--policy-stdin", "--mode", mode, "--", ...command];
+  return new Promise((resolve2, reject) => {
+    let proc;
+    const timeout = setTimeout(() => {
+      proc?.kill();
+      reject(new Error("runner execution timeout"));
+    }, policy.wall_clock_timeout_ms + 5000);
+    const unref = timeout.unref;
+    if (typeof unref === "function") {
+      unref.call(timeout);
+    }
+    try {
+      proc = _internals3.spawnAsync(binary, args, {
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"],
+        cwd: policy.workspace_roots[0] ?? os3.tmpdir()
+      });
+    } catch (err) {
+      clearTimeout(timeout);
+      reject(err);
+      return;
+    }
+    proc.stdin?.write(policyJson);
+    proc.stdin?.end();
+    let stdout = "";
+    let stderr = "";
+    const events = [];
+    proc.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr?.on("data", (chunk) => {
+      const lines = chunk.toString().split(`
+`);
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+          continue;
+        try {
+          const event = JSON.parse(trimmed);
+          if (event.type) {
+            events.push(event);
+            continue;
+          }
+        } catch {}
+        stderr += `${trimmed}
+`;
+      }
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+    proc.on("close", (code) => {
+      clearTimeout(timeout);
+      const startEvent = events.find((e) => e.type === "start");
+      const runnerMode = startEvent?.mode ?? mode;
+      resolve2({
+        exitCode: code ?? 1,
+        stdout,
+        stderr,
+        events,
+        mode: runnerMode
+      });
+    });
+  });
+}
+function _resetProbeCache() {
+  _cachedProbe = undefined;
+}
+function buildDefaultPolicy(workspaceRoot, runId) {
+  const id = runId ?? `swarm-${crypto.randomUUID?.() ?? Date.now()}`;
+  const appData = process.env.LOCALAPPDATA ?? path3.join(os3.homedir(), "AppData", "Local");
+  const tempRoot = path3.join(appData, "opencode-swarm", "sandbox", id, "temp");
+  return {
+    schema_version: 1,
+    run_id: id,
+    workspace_roots: [workspaceRoot],
+    writable_roots: [workspaceRoot],
+    read_only_subpaths: [".git", ".codex", ".agents", ".swarm"],
+    temp_root: tempRoot,
+    temp_cap_bytes: 524288000,
+    memory_cap_bytes: 2147483648,
+    child_process_cap: 16,
+    wall_clock_timeout_ms: 600000,
+    network_mode: "off",
+    env_allowlist: ["PATH", "TEMP", "TMP", "USERPROFILE", "SYSTEMROOT"],
+    env_overrides: {
+      HTTP_PROXY: "http://127.0.0.1:1",
+      HTTPS_PROXY: "http://127.0.0.1:1"
+    },
+    path_stubs: ["ssh.exe", "curl.exe", "wget.exe", "scp.exe", "sftp.exe"],
+    private_desktop: true,
+    deny_alternate_data_streams: true,
+    deny_unc_paths: true,
+    deny_device_paths: true,
+    deny_symlink_egress: true
+  };
+}
+var _runtimeDir, RUNNER_EXIT_CODES, _cachedProbe, _internals3;
+var init_runner_client = __esm(() => {
+  init_logger();
+  _runtimeDir = fileURLToPath(new URL(".", import.meta.url));
+  RUNNER_EXIT_CODES = {
+    SUCCESS: 0,
+    CHILD_NON_ZERO: 1,
+    POLICY_VIOLATION: 64,
+    QUOTA_EXCEEDED: 65,
+    WALL_CLOCK_TIMEOUT: 66,
+    LAUNCHER_MISCONFIG: 67,
+    OS_API_FAILURE: 68,
+    PROBE_FAILED: 69
+  };
+  _internals3 = {
+    findRunnerBinary,
+    spawnRunner: spawnSync3,
+    spawnAsync: spawn
+  };
+});
+
+// src/sandbox/win32/native-sandbox-executor.ts
+import * as crypto2 from "crypto";
+import * as fs2 from "fs";
+import * as os4 from "os";
+import * as path4 from "path";
+
+class NativeWindowsSandboxExecutor {
+  mechanism;
+  _probeResult;
+  _fallbackExecutor;
+  _strength;
+  _disabled;
+  _disabledReason;
+  constructor(scopePaths = [], tempDir) {
+    this._disabled = false;
+    this._disabledReason = null;
+    this._fallbackExecutor = new WindowsSandboxExecutor(scopePaths, tempDir);
+    this._probeResult = probe();
+    if (this._probeResult.available) {
+      this._strength = "strong";
+      this.mechanism = `native-runner/${this._probeResult.mode}`;
+    } else if (this._fallbackExecutor.isAvailable()) {
+      this._strength = "weak";
+      this.mechanism = "powershell-wrapper";
+      warn(`Native sandbox runner unavailable (${this._probeResult.error ?? "unknown"}); ` + "falling back to PowerShell environment restrictions (weak sandbox)");
+    } else {
+      this._strength = "none";
+      this.mechanism = "none";
+    }
+  }
+  get strength() {
+    if (this._disabled)
+      return "none";
+    return this._strength;
+  }
+  isAvailable() {
+    return !this._disabled && this._strength !== "none";
+  }
+  disable(reason) {
+    this._disabled = true;
+    this._disabledReason = reason;
+    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
+  }
+  wrapCommand(command, scopePaths, tempDir, envOverrides) {
+    if (!this.isAvailable()) {
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    if (this._strength === "strong") {
+      return this._wrapWithRunner(command, scopePaths, tempDir, envOverrides);
+    }
+    return this._fallbackExecutor.wrapCommand(command, scopePaths, tempDir, envOverrides);
+  }
+  _wrapWithRunner(command, scopePaths, tempDir, _envOverrides) {
+    const binary = _internals3.findRunnerBinary();
+    if (!binary) {
+      throw new SandboxError("Runner binary not found", "RUNNER_NOT_FOUND");
+    }
+    const workspaceRoot = scopePaths[0] ?? process.cwd();
+    const runId = `swarm-${crypto2.randomUUID?.() ?? Date.now()}`;
+    const policy = buildDefaultPolicy(workspaceRoot, runId);
+    if (tempDir) {
+      policy.temp_root = tempDir;
+    }
+    policy.workspace_roots = scopePaths.length > 0 ? scopePaths : [workspaceRoot];
+    policy.writable_roots = policy.workspace_roots;
+    if (_envOverrides) {
+      for (const [key, value] of Object.entries(_envOverrides)) {
+        if (!isValidEnvKey(key))
+          continue;
+        if (typeof value === "string") {
+          policy.env_overrides[key] = value;
+        }
+      }
+    }
+    const policyJson = JSON.stringify(policy);
+    const policyDir = path4.join(os4.tmpdir(), "swarm-sandbox-policies");
+    try {
+      fs2.mkdirSync(policyDir, { recursive: true });
+    } catch {}
+    const policyFile = path4.join(policyDir, `${runId}.json`);
+    fs2.writeFileSync(policyFile, policyJson, "utf-8");
+    const mode = this._probeResult.mode === "none" ? "auto" : this._probeResult.mode;
+    const escapedBinary = binary.includes(" ") ? `"${binary}"` : binary;
+    const escapedPolicyFile = policyFile.includes(" ") ? `"${policyFile}"` : policyFile;
+    const escapedCommand = command.replace(/"/g, "\\\"");
+    return `cmd /c "type ${escapedPolicyFile} | ${escapedBinary} --policy-stdin --mode ${mode} -- ${escapedCommand} & del ${escapedPolicyFile} 2>nul"`;
+  }
+  getEnvOverrides() {
+    if (this._strength === "strong") {
+      return {
+        PATH: null,
+        TEMP: null,
+        TMP: null,
+        LD_PRELOAD: null,
+        DYLD_INSERT_LIBRARIES: null,
+        DYLD_LIBRARY_PATH: null,
+        DYLD_FRAMEWORK_PATH: null,
+        DYLD_ROOT_PATH: null,
+        DYLD_FORCE_FLAT_NAMESPACE: null
+      };
+    }
+    return this._fallbackExecutor.getEnvOverrides();
+  }
+  async executeNative(command, workspaceRoot, runId) {
+    if (this._strength !== "strong") {
+      throw new SandboxError("Native execution requires strong sandbox (runner binary)", "NATIVE_UNAVAILABLE");
+    }
+    const policy = buildDefaultPolicy(workspaceRoot, runId);
+    return execute(command, policy);
+  }
+  get hasNativeRunner() {
+    return this._strength === "strong";
+  }
+  get disabledReason() {
+    return this._disabledReason;
+  }
+  get probeResult() {
+    return this._probeResult;
+  }
+}
+var init_native_sandbox_executor = __esm(() => {
+  init_logger();
+  init_executor();
+  init_restricted_environment_executor();
+  init_runner_client();
+});
+
+// src/sandbox/executors/windows.ts
+var exports_windows = {};
+__export(exports_windows, {
+  WindowsSandboxExecutor: () => NativeWindowsSandboxExecutor,
+  LegacyWindowsSandboxExecutor: () => WindowsSandboxExecutor
+});
+var init_windows = __esm(() => {
+  init_native_sandbox_executor();
+  init_restricted_environment_executor();
+});
+
+// src/sandbox/executor.ts
+function isValidEnvKey(key) {
+  return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key);
+}
+async function getExecutor() {
+  if (_cachedExecutorPromise !== undefined) {
+    return _cachedExecutorPromise;
+  }
+  _cachedExecutorPromise = _createExecutor();
+  return _cachedExecutorPromise;
+}
+async function _createExecutor() {
+  const platform = process.platform;
+  if (platform === "linux") {
+    return _createLinuxExecutor();
+  }
+  if (platform === "darwin") {
+    return _createMacOSExecutor();
+  }
+  if (platform === "win32") {
+    return _createWindowsExecutor();
+  }
+  return null;
+}
+async function _createLinuxExecutor() {
+  const { SandboxCapabilityProbe, isBubblewrapAvailable } = await import("./capability-probe-976tt4ba.js");
+  await new SandboxCapabilityProbe().detect();
+  if (!isBubblewrapAvailable()) {
+    return null;
+  }
+  try {
+    const { BubblewrapSandboxExecutor: BubblewrapSandboxExecutor2 } = (init_bubblewrap(), __toCommonJS(exports_bubblewrap));
+    return new BubblewrapSandboxExecutor2([]);
+  } catch {
+    return null;
+  }
+}
+async function _createMacOSExecutor() {
+  if (!_macosSandboxEnabled) {
+    if (!_hasWarnedMacOSSandboxDisabledByConfig) {
+      _hasWarnedMacOSSandboxDisabledByConfig = true;
+      warn("[sandbox] macOS sandbox-exec is disabled by config (guardrails.sandbox_macos_enabled=false). " + "Enable it only after verifying the production SBPL profile on a real macOS host \u2014 see docs/configuration.md.");
+    }
+    return null;
+  }
+  const { SandboxCapabilityProbe, isSandboxExecAvailable } = await import("./capability-probe-976tt4ba.js");
+  await new SandboxCapabilityProbe().detect();
+  if (!isSandboxExecAvailable()) {
+    return null;
+  }
+  try {
+    const { MacOSSandboxExecutor: MacOSSandboxExecutor2 } = (init_macos(), __toCommonJS(exports_macos));
+    return new MacOSSandboxExecutor2([]);
+  } catch {
+    return null;
+  }
+}
+async function _createWindowsExecutor() {
+  const { SandboxCapabilityProbe, isWindowsSandboxAvailable } = await import("./capability-probe-976tt4ba.js");
+  await new SandboxCapabilityProbe().detect();
+  if (!isWindowsSandboxAvailable()) {
+    return null;
+  }
+  try {
+    const { WindowsSandboxExecutor: WindowsSandboxExecutor2 } = (init_windows(), __toCommonJS(exports_windows));
+    return new WindowsSandboxExecutor2([]);
+  } catch {
+    return null;
+  }
+}
+var SandboxError, _cachedExecutorPromise, _macosSandboxEnabled = false, _hasWarnedMacOSSandboxDisabledByConfig = false;
+var init_executor = __esm(() => {
+  init_logger();
+  SandboxError = class SandboxError extends Error {
+    code;
+    constructor(message, code) {
+      super(message);
+      this.code = code;
+      this.name = "SandboxError";
+    }
+  };
+});
+
+// src/sandbox/linux/bubblewrap-executor.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+function resolveBwrapBinary() {
+  try {
+    if (existsSync3(BWRAP_ABSOLUTE)) {
+      return BWRAP_ABSOLUTE;
+    }
+  } catch {}
+  return "bwrap";
+}
+function probeBwrap() {
+  try {
+    const binary = _internals4.resolveBwrapBinary();
+    const result = spawnSync4(binary, ["--version"], {
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    if (result.error) {
+      const code = result.error.code;
+      if (code && BWRAP_UNAVAILABLE_CODES.has(code)) {
+        warn(`Sandbox disabled: bwrap error (${code}). Falling through to tool-layer enforcement.`);
+        return false;
+      }
+      warn(`Sandbox disabled: bwrap spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
+      return false;
+    }
+    return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
+    return false;
+  }
+}
+function shellEscape2(s) {
+  return s.replace(/'/g, "'\\''");
+}
+
+class BubblewrapSandboxExecutor {
+  mechanism = "Bubblewrap";
+  _scopePaths;
+  _tempDir;
+  _available;
+  _disabledReason;
+  constructor(scopePaths = [], tempDir) {
+    this._scopePaths = scopePaths;
+    this._tempDir = tempDir;
+    this._available = false;
+    this._disabledReason = null;
+    try {
+      if (!_internals4.probeBwrap()) {
+        this._disabledReason = "bwrap not available or not functional";
+        warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+      } else {
+        this._available = true;
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this._disabledReason = `constructor threw: ${message}`;
+      this._available = false;
+      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
+    }
+  }
+  isAvailable() {
+    return this._available;
+  }
+  disable(reason) {
+    this._available = false;
+    this._disabledReason = reason;
+    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
+  }
+  wrapCommand(command, scopePaths, tempDir, envOverrides) {
+    if (!this._available) {
+      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
+    }
+    const temp = tempDir ?? this._tempDir ?? "/tmp";
+    const allScopes = [...this._scopePaths, ...scopePaths];
+    const bindArgs = allScopes.flatMap((p) => [
+      "--bind",
+      `'${shellEscape2(p)}'`,
+      `'${shellEscape2(p)}'`
+    ]);
+    const envArgs = [];
+    if (envOverrides) {
+      for (const [key, value] of Object.entries(envOverrides)) {
+        if (!isValidEnvKey(key)) {
+          continue;
+        }
+        if (value === null) {
+          envArgs.push("--unsetenv", key);
+        } else {
+          envArgs.push("--setenv", key, `'${shellEscape2(value)}'`);
+        }
+      }
+    }
+    const args = [
+      "--unshare-user",
+      "--unshare-net",
+      "--unshare-ipc",
+      "--die-with-parent",
+      "--new-session",
+      "--cap-drop",
+      "ALL",
+      ...bindArgs,
+      "--dev",
+      "/dev",
+      "--size",
+      String(TMPFS_SIZE_BYTES),
+      "--tmpfs",
+      `'${shellEscape2(temp)}'`,
+      "--ro-bind",
+      "/etc",
+      "/etc",
+      "--ro-bind",
+      "/usr",
+      "/usr",
+      "--ro-bind",
+      "/lib",
+      "/lib",
+      "--ro-bind",
+      "/lib64",
+      "/lib64",
+      "--proc",
+      "/proc",
+      "--unshare-pid",
+      ...envArgs,
+      "--",
+      "bash",
+      "-c",
+      `'${shellEscape2(command)}'`
+    ];
+    const binary = _internals4.resolveBwrapBinary();
+    return `${binary} ${args.join(" ")}`;
+  }
+  getEnvOverrides() {
+    return {};
+  }
+}
+var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, BWRAP_ABSOLUTE = "/usr/bin/bwrap", TMPFS_SIZE_BYTES = 524288000, _internals4;
+var init_bubblewrap_executor = __esm(() => {
+  init_logger();
+  init_executor();
+  BWRAP_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
+  _internals4 = {
+    probeBwrap,
+    resolveBwrapBinary
+  };
+});
+
+export { _internals4 as _internals, init_bubblewrap_executor, _internals as _internals1, init_sandbox_exec_executor, exports_runner_client, init_runner_client, isValidEnvKey, getExecutor, init_executor };