openrod 0.0.0 → 0.1.0

package/server/terminal.js

@@ -0,0 +1,173 @@
+import { identityContext } from './security.js'
+// Browser terminals. xterm.js runs in the page, a WebSocket ends here, and the
+// gateway's interactive exec sits behind it: the same RPC that
+// `openshell sandbox exec --tty` uses, so nothing new reaches the sandbox.
+//
+// A page first POSTs for a ticket, then opens the socket with it. Browsers
+// cannot add the console's header to a WebSocket handshake, so the ticket
+// carries the same-origin proof instead: it is issued to a checked mutation,
+// used once, and expires after a minute.
+import { STATUS_CODES } from 'node:http'
+import { randomUUID } from 'node:crypto'
+import { WebSocketServer } from 'ws'
+import { defaultSession, isSession, projectOf, sessionArgv, persistentSessionArgv, persistentTerminals } from '../src/lib/sandbox-session.js'
+import { contextKey, gateway, sandboxView } from './gateway.js'
+
+const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+const NAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/
+const ID = /^[0-9a-f-]{36}$/
+export const TERMINAL_PATH = '/api/os/terminal'
+const TICKET_TTL_MS = 60_000
+// Output waiting for a slow page before reading from the sandbox pauses.
+const BUFFER_LIMIT = 4 * 1024 * 1024
+
+// A terminal dimension from the page: a small positive integer, or the fallback.
+export const dimension = (value, fallback) => (Number.isInteger(value) && value > 0 && value <= 1000 ? value : fallback)
+
+// What to run for a request, from the gateway's record and the page's choice.
+// The page may ask for a shell or any agent the console launches; anything
+// else is refused before a ticket exists.
+export function planSession(sandbox, input = {}) {
+  if (sandbox.phase !== 'ready') throw fail('This sandbox is not running.', 409)
+  const session = input.session == null || input.session === '' ? defaultSession(sandbox) : input.session
+  if (!isSession(session)) throw fail('Unknown session.')
+  const project = projectOf(sandbox)
+  return {
+    name: sandbox.name,
+    session,
+    argv: sessionArgv(session),
+    workdir: project ? `/sandbox/${project}` : '',
+    cols: dimension(input.cols, 80),
+    rows: dimension(input.rows, 24),
+  }
+}
+
+// Single-use tickets with a short life. The clock is injectable for tests.
+export function createTickets({ ttl = TICKET_TTL_MS, now = Date.now } = {}) {
+  const tickets = new Map()
+  return {
+    issue(plan) {
+      const ticket = randomUUID()
+      tickets.set(ticket, { ...plan, expires: now() + ttl })
+      setTimeout(() => tickets.delete(ticket), ttl).unref?.()
+      return ticket
+    },
+    claim(ticket, principal) {
+      const plan = ID.test(ticket ?? '') ? tickets.get(ticket) : undefined
+      if (!plan) return null
+      tickets.delete(ticket)
+      return plan.expires > now() && plan.principal === principal ? plan : null
+    },
+    get size() { return tickets.size },
+  }
+}
+
+const tickets = createTickets()
+
+export async function terminalRoute(method, parts, input) {
+  if (method === 'POST' && parts[0] === 'sandboxes' && parts.length === 3 && NAME.test(parts[1]) && parts[2] === 'terminal-session') {
+    const { client, target, workspace, workspaceScope } = await gateway()
+    const sandbox = { ...sandboxView((await client.raw.getSandbox({ name: parts[1], workspaceScope })).sandbox), workspace }
+    const plan = { ...planSession(sandbox, input ?? {}), gateway: target.name, workspace }
+    if (persistentTerminals(target, sandbox) && !input?.setupLogin) plan.argv = persistentSessionArgv(plan.session)
+    if (input?.setupLogin) {
+      const { getSetupStore } = await import('./setups.js')
+      const { executeInstaller } = await import('./setup-deployment.js')
+      const setup = await getSetupStore().get(input.setupLogin)
+      const item = setup.items.find(i => i.id === input.mcp)
+      plan.argv = setupLoginArgv(item, setup.id, plan.session)
+      const probe = await executeInstaller(client, sandbox, setup, ['codex'], 'probe')
+      if (!probe.installed || !probe.targets.includes('codex') || !probe.items.includes(item.id) || probe.revision !== setup.revision) throw fail('Enable this Setup for Codex in the sandbox first.', 409)
+      plan.argv = setupLoginArgv(item, setup.id, plan.session, probe.mcpNames?.codex?.[item.id])
+      const help = await client.sandbox.exec(sandbox.name, ['codex', 'mcp', 'login', '--help'], {workspace,noLoginShell:true,timeoutSecs:10})
+      if (!help.stdout.toString().includes('--no-browser')) throw fail('Update Codex in this image to a version with MCP --no-browser sign-in.',409)
+      plan.workdir = '/sandbox'
+    }
+    return { ticket: tickets.issue({ ...plan, principal: identityContext.getStore()?.uid }), session: plan.session }
+  }
+  return undefined
+}
+
+function refuse(socket, status) {
+  socket.write(`HTTP/1.1 ${status} ${STATUS_CODES[status]}\r\nConnection: close\r\n\r\n`)
+  socket.destroy()
+}
+
+const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 })
+
+// Handles the console's own upgrade requests and leaves every other one (Vite's
+// HMR socket) alone. `isLocal` is the same check the HTTP routes apply.
+export function terminalUpgrade(req, socket, head, isLocal, principal, allowContext = () => true) {
+  const url = new URL(req.url ?? '/', 'http://local')
+  if (url.pathname !== TERMINAL_PATH) return false
+  if (!isLocal(req)) { refuse(socket, 403); return true }
+  const plan = tickets.claim(url.searchParams.get('ticket'), principal)
+  if (!plan || plan.principal !== principal) { refuse(socket, 403); return true }
+  const requestedContext = url.searchParams.get('context')
+  if (!allowContext(plan) || (requestedContext != null && requestedContext !== contextKey(plan))) { refuse(socket, 409); return true }
+  wss.handleUpgrade(req, socket, head, (ws) => { run(ws, plan).catch(() => { try { ws.close(1011) } catch {} }) })
+  return true
+}
+
+// Frames from the page: binary is keyboard input, text is a control message.
+export function controlOf(data, isBinary) {
+  if (isBinary) return { type: 'stdin', data }
+  let message
+  try { message = JSON.parse(data.toString()) } catch { return null }
+  if (message?.type === 'resize') return { type: 'resize', cols: dimension(message.cols, 0), rows: dimension(message.rows, 0) }
+  return null
+}
+
+async function run(ws, plan) {
+  const send = (message) => { if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(message)) }
+  const { client } = await gateway(plan)
+  let session
+  try {
+    session = await client.sandbox.execInteractive(plan.name, plan.argv, {
+      workspace: plan.workspace,
+      tty: true, cols: plan.cols, rows: plan.rows, workdir: plan.workdir,
+      environment: { TERM: 'xterm-256color', COLORTERM: 'truecolor' },
+    })
+  } catch (error) {
+    send({ type: 'error', message: error.message })
+    ws.close(1011)
+    return
+  }
+  const running = () => session.exitCode === undefined
+  // The tab may have closed while the exec was starting; a program that
+  // prints nothing would otherwise keep the exec alive with nobody attached.
+  if (ws.readyState !== ws.OPEN) { session.cancel(); return }
+  ws.on('message', (data, isBinary) => {
+    const frame = controlOf(data, isBinary)
+    if (!frame || !running()) return
+    try {
+      if (frame.type === 'stdin') session.write(data)
+      else if (frame.cols && frame.rows) session.resize(frame.cols, frame.rows)
+    } catch { /* input raced the exit */ }
+  })
+  ws.on('close', () => { if (running()) session.cancel() })
+  send({ type: 'ready' })
+  const ping = setInterval(() => { if (ws.readyState === ws.OPEN) ws.ping() }, 30_000)
+  try {
+    for await (const event of session.output) {
+      if (ws.readyState !== ws.OPEN) break
+      if (event.type === 'exit') { send({ type: 'exit', exitCode: event.exitCode }); break }
+      ws.send(event.data, { binary: true })
+      while (ws.bufferedAmount > BUFFER_LIMIT && ws.readyState === ws.OPEN) await new Promise((resolve) => setTimeout(resolve, 20))
+    }
+    if (ws.readyState === ws.OPEN) ws.close(1000)
+  } catch (error) {
+    send({ type: 'error', message: error.message })
+    if (ws.readyState === ws.OPEN) ws.close(1011)
+  } finally {
+    clearInterval(ping)
+    if (running()) session.cancel()
+  }
+}
+
+// Fixed argv only: neither the browser nor imported configuration supplies a shell command.
+export function setupLoginArgv(item, setupId, session, installedName) {
+  if (session !== 'codex' || !/^[a-f0-9]{24}$/.test(setupId) || !item?.config?.url || !/^[a-zA-Z0-9-]{1,100}$/.test(item.id) || item.disabled || item.issues?.length || item.credentialRef) throw fail('Choose an installed remote MCP for Codex sign-in.')
+  if (installedName !== undefined && !/^[a-zA-Z0-9_][a-zA-Z0-9_-]{0,99}$/.test(installedName)) throw fail('Invalid installed MCP name.')
+  return ['codex', 'mcp', 'login', '--no-browser', installedName ?? `os-${setupId.slice(0,8)}-${item.id.slice(0,8)}`]
+}

package/server/worker-auth.js

@@ -0,0 +1,18 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+const denied=()=>Object.assign(Error('Worker request rejected'),{status:403})
+export function signWorkerRequest(key,identity,req,now=Date.now()) {
+ const payload=Buffer.from(JSON.stringify({...identity,method:req.method,target:req.url,validUntil:now+30000})).toString('base64url')
+ return `${payload}.${createHmac('sha256',key).update(payload).digest('base64url')}`
+}
+export function verifyWorkerRequest(key,owner,req,now=Date.now()) {
+ const token=req.headers['x-openrod-worker-auth']
+ if(typeof token!=='string'||token.length>5000)throw denied()
+ const [payload,mac,extra]=token.split('.')
+ if(!payload||!mac||extra)throw denied()
+ const expected=createHmac('sha256',key).update(payload).digest(),actual=Buffer.from(mac,'base64url')
+ if(actual.length!==expected.length||!timingSafeEqual(actual,expected))throw denied()
+ let value
+ try{value=JSON.parse(Buffer.from(payload,'base64url').toString())}catch{throw denied()}
+ if(value.uid!==owner||value.method!==req.method||value.target!==req.url||!Number.isFinite(value.validUntil)||value.validUntil<=now||value.validUntil>now+60000||!Number.isFinite(value.expires)||value.expires<=now)throw denied()
+ return {uid:value.uid,email:value.email,org:value.org,role:value.role,expires:value.expires}
+}

package/shared/agent-access.js

@@ -0,0 +1,103 @@
+// Built-in agent requirements, composed automatically when launching a built template.
+// Image recipes declare agent IDs; they cannot supply arbitrary network permissions.
+const endpoint = (host, access = 'read-write') => ({ host, ports: [443], protocol: 'rest', access, enforcement: 'enforce' })
+// Script-based CLIs use their interpreter as the kernel executable identity.
+// These rules consequently also cover other code run by that interpreter, but
+// only to the listed destinations. Never substitute an all-hosts allow rule.
+const node = ['/usr/local/bin/node', '/usr/bin/node']
+const google = ['generativelanguage.googleapis.com', 'cloudcode-pa.googleapis.com', 'oauth2.googleapis.com', 'accounts.google.com', 'www.googleapis.com', 'aiplatform.googleapis.com', '*.aiplatform.googleapis.com']
+const codeAssistHosts = new Set(['cloudcode-pa.googleapis.com', 'daily-cloudcode-pa.googleapis.com', 'daily-cloudcode-pa.sandbox.googleapis.com'])
+// These RPCs retrieve arbitrary websites through Google's backend, outside
+// sandbox destination enforcement. The installed CLI's search_web uses the
+// non-streaming generateContent RPC; normal chat uses streamGenerateContent.
+// This blocks those built-in tools, not grounding in arbitrary model bodies.
+const antigravityEndpoint = (host) => ({
+  ...endpoint(host),
+  ...(codeAssistHosts.has(host) ? { deny: ['fetchFromTrawlerCache', 'rewriteUri', 'generateContent'].map(rpc => ({ method: '*', path: `/**:${rpc}*` })) } : {}),
+})
+const modelProviders = ['api.anthropic.com', 'api.openai.com', 'openrouter.ai', 'api.groq.com', 'api.deepseek.com', 'api.mistral.ai', 'api.x.ai', 'generativelanguage.googleapis.com']
+const profile = (name, binaries, hosts) => ({ name, binaries, endpoints: [...new Set(hosts)].map(host => endpoint(host)) })
+// Sources: Gemini CLI code_assist/server.ts and oauth2.ts; NVIDIA provider
+// profiles; kiro.dev/docs/privacy-and-security/firewalls/;
+// cursor.com/docs/enterprise/network-configuration;
+// docs.factory.ai/enterprise/network-and-deployment.
+export const AGENT_ACCESS = {
+  claude: {
+    name: 'Claude Code',
+    binaries: ['/usr/bin/claude', '/usr/local/bin/claude'],
+    endpoints: ['api.anthropic.com', 'platform.claude.com', 'claude.ai'].map(host => endpoint(host)),
+    authentication: 'Attach a Claude credential or sign in with your subscription after connecting.',
+  },
+  opencode: {
+    name: 'OpenCode',
+    // The npm launcher executes this native binary (verified in the built image).
+    binaries: ['/usr/local/lib/node_modules/opencode-ai/bin/opencode.exe', '/usr/local/bin/opencode', '/sandbox/.opencode/bin/opencode'],
+    endpoints: [endpoint('models.opencode.ai', 'read-only'), endpoint('models.dev', 'read-only'), endpoint('opencode.ai'), ...modelProviders.map(host => endpoint(host))],
+    authentication: 'Includes connections for OpenCode’s hosted models. Use /connect for models that require an account. Other model providers need their own network rules and credentials.',
+  },
+  codex: {
+    name: 'Codex',
+    binaries: ['/usr/bin/codex', '/usr/local/bin/codex', '/usr/local/lib/node_modules/@openai/**/codex', '/usr/lib/node_modules/@openai/**/codex'],
+    endpoints: ['api.openai.com', 'auth.openai.com', 'chatgpt.com', 'ab.chatgpt.com'].map(host => endpoint(host)),
+    // Codex's "Sign in with ChatGPT" redirects the host browser to a callback
+    // server inside the sandbox, which the browser cannot reach.
+    authentication: 'Attach a Codex credential, or run codex after connecting and choose “Sign in with Device Code” (ChatGPT plan) or “Provide your own API key”. “Sign in with ChatGPT” can’t complete from a sandbox.',
+  },
+  gemini: profile('Gemini CLI', [...node, '/usr/local/bin/gemini'], google),
+  // Hosts for Pi's built-in /login flows (pi-ai dist/auth/oauth/*.js).
+  pi: {
+    ...profile('Pi', [...node, '/usr/local/bin/pi'], [...modelProviders, ...google, 'platform.claude.com', 'claude.ai', 'auth.openai.com', 'chatgpt.com', 'github.com', 'api.github.com', 'api.githubcopilot.com', '*.githubcopilot.com', 'auth.x.ai', 'auth.kimi.com', 'api.kimi.com', 'auth.meta.com', 'api.meta.ai', 'radius.pi.dev']),
+    authentication: 'Use /login inside Pi. If sign-in ends on a "site can’t be reached" page, copy the full URL from the address bar, paste it into Pi and press Enter.',
+  },
+  aider: profile('Aider', ['/usr/local/bin/aider', '/opt/aider/bin/python*', '/usr/bin/python3*', '/usr/local/bin/python3*'], modelProviders),
+  copilot: profile('GitHub Copilot', [...node, '/usr/local/bin/copilot', '/usr/local/lib/node_modules/@github/**/copilot', '/usr/lib/node_modules/@github/**/copilot'], ['github.com', 'api.github.com', 'api.githubcopilot.com', '*.githubcopilot.com', 'copilot-proxy.githubusercontent.com']),
+  cursor: {
+    ...profile('Cursor', ['/sandbox/.local/bin/cursor-agent', '/sandbox/.local/share/cursor-agent/**', '/usr/local/bin/cursor-agent'], []),
+    endpoints: [
+      ...['cursor.com', 'api2.cursor.sh', 'api3.cursor.sh', '*.cursor.sh', '*.cursorapi.com'].map(host => endpoint(host)),
+      // The nested agent host needs an explicit rule. REST inspection rejects
+      // its TLS ALPN negotiation; keep its encrypted transport intact.
+      { host: 'agentn.global.api5.cursor.sh', ports: [443], protocol: 'tcp', tlsSkip: true },
+    ],
+  },
+  antigravity: {
+    ...profile('Antigravity', ['/sandbox/.local/bin/agy', '/sandbox/.antigravity/**', '/sandbox/.local/share/antigravity/**', '/usr/local/bin/agy', ...node], []),
+    endpoints: [
+      ...[...google, 'antigravity.google', 'daily-cloudcode-pa.googleapis.com', 'daily-cloudcode-pa.sandbox.googleapis.com'].map(antigravityEndpoint),
+      // Sign-in eligibility fetches the Google account's profile picture.
+      endpoint('lh3.googleusercontent.com', 'read-only'),
+    ],
+  },
+  kiro: profile('Kiro', ['/sandbox/.local/bin/kiro-cli', '/sandbox/.local/bin/kiro-cli-chat', '/usr/local/bin/kiro-cli'], ['app.kiro.dev', 'prod.us-east-1.auth.desktop.kiro.dev', 'runtime.us-east-1.kiro.dev', 'runtime.eu-central-1.kiro.dev', 'management.us-east-1.kiro.dev', 'management.eu-central-1.kiro.dev', 'q.us-east-1.amazonaws.com', 'q.eu-central-1.amazonaws.com', 'oidc.us-east-1.amazonaws.com', 'oidc.eu-central-1.amazonaws.com', 'cognito-identity.us-east-1.amazonaws.com', 'view.awsapps.com']),
+  droid: profile('Factory Droid', ['/sandbox/.local/bin/droid', '/sandbox/.factory/bin/**', '/usr/local/bin/droid'], ['factory.ai', '*.factory.ai', ...modelProviders]),
+}
+
+// Image tools chosen as recipe runtimes. VS Code Remote-SSH downloads a server
+// matching the user's VS Code version when it connects, so the image cannot
+// ship it: the sandbox fetches it with curl (or wget), then the server's CLI.
+const download = (host) => ({ host, ports: [443], protocol: 'rest', enforcement: 'enforce', allow: [{ method: 'GET', path: '/**' }] })
+export const TOOL_ACCESS = {
+  vscode: {
+    name: 'VS Code Server',
+    rule: 'tool-vscode-server',
+    binaries: ['/usr/bin/curl', '/usr/bin/wget', '/sandbox/.vscode-server/**'],
+    endpoints: ['update.code.visualstudio.com', 'vscode.download.prss.microsoft.com'].map(download),
+  },
+}
+
+export function agentAccessFor(recipe) {
+  // Only built recipes have known installation locations. An existing image
+  // keeps its policy as chosen; we do not guess what it contains.
+  if (recipe?.source !== 'build') return { profiles: [], unsupported: [] }
+  const ids = [...new Set(recipe.agents ?? [])]
+  return {
+    profiles: [...ids.filter(id => AGENT_ACCESS[id]).map(id => ({ id, rule: `agent-${id}`, ...AGENT_ACCESS[id] })), ...[...new Set(recipe.runtimes ?? [])].filter(id => TOOL_ACCESS[id]).map(id => ({ id, ...TOOL_ACCESS[id] }))],
+    unsupported: ids.filter(id => !AGENT_ACCESS[id]),
+  }
+}
+
+export function agentAccessRules(recipe) {
+  const { profiles, unsupported } = agentAccessFor(recipe)
+  if (unsupported.length) throw new Error(`Automatic network access is not configured for: ${unsupported.join(', ')}. Add a reviewed agent access profile before launching this template.`)
+  return profiles.map(({ rule, binaries, endpoints }) => ({ name: rule, binaries, endpoints }))
+}

package/shared/antigravity-network-guidance.js

@@ -0,0 +1,9 @@
+// Behavioral guidance only. The gateway policy remains the enforcement boundary.
+export const ANTIGRAVITY_NETWORK_GUIDANCE = `
+## OpenShell website access
+
+Network access is restricted per destination, not globally offline. A denied website or hosted search request does not mean another website is blocked.
+For a user-requested website, call read_url_content for that website. Hosted URL fetch and search services are deliberately blocked because they bypass the sandbox destination policy. read_url_content can fall back to a direct request from this sandbox, where the website policy applies.
+If a request is denied, report that specific destination or service as blocked. On a later request for a different website, try that website independently; do not reuse an earlier denial as evidence that all internet access is unavailable. Do not claim to have fetched current content without a successful tool result.
+Do not use hosted search, external proxies, or other relay services to bypass a blocked destination. Never change network policy to complete a browsing request.
+`

package/shared/group-membership.js

@@ -0,0 +1,33 @@
+export const GROUP_LABEL = 'openshell.console/group'
+export const GROUP_LABEL_PREFIX = 'openshell.console/group-'
+
+// Accept the original single-group format when reading saved state or requests.
+export function groupIds(value) {
+  if (value == null) return []
+  const ids = Array.isArray(value) ? value : [value]
+  if (ids.some((id) => typeof id !== 'string' || !id)) throw new Error('Groups must be a list of group IDs.')
+  return [...new Set(ids)]
+}
+
+export function groupsFromLabels(labels = {}) {
+  const ids = Object.entries(labels).filter(([key, value]) => key.startsWith(GROUP_LABEL_PREFIX) && value === 'true').map(([key]) => key.slice(GROUP_LABEL_PREFIX.length))
+  return ids.length ? ids : groupIds(labels[GROUP_LABEL])
+}
+
+// One label per group avoids the size and character limits of label values.
+export function labelsForGroups(value) {
+  return Object.fromEntries(groupIds(value).map((id) => [`${GROUP_LABEL_PREFIX}${id}`, 'true']))
+}
+
+export function groupsOf(sandbox, members, groups) {
+  const ids = Object.hasOwn(members, sandbox.name) ? groupIds(members[sandbox.name]) : groupsFromLabels(sandbox.labels)
+  return ids.filter((id) => groups.some((g) => g.id === id))
+}
+
+export function changeGroups(current, requested, mode = 'replace') {
+  const ids = groupIds(requested)
+  if (mode === 'add') return groupIds([...groupIds(current), ...ids])
+  if (mode === 'remove') return groupIds(current).filter((id) => !ids.includes(id))
+  if (mode === 'replace') return ids
+  throw new Error('Unknown membership operation.')
+}

package/shared/group-network.js

@@ -0,0 +1,29 @@
+import { groupIds } from './group-membership.js'
+
+// Shared by launch previews and the server. Legacy global/per-sandbox rules
+// remain readable, but do not satisfy the required group policy assignment.
+export function groupNetworkPolicies(policies = [], group) {
+  const ids = groupIds(group)
+  return policies.filter((p) => !p.appliesTo.everyone && p.appliesTo.groups.some((id) => ids.includes(id)))
+}
+
+export function assertPolicyGroup(policy, groups) {
+  const to = policy.appliesTo
+  if (to.everyone || to.sandboxes.length || !to.groups.length) throw new Error('Choose at least one group for this network rule.')
+  if (to.groups.some((id) => !groups.some((g) => g.id === id))) throw new Error('Unknown group.')
+}
+
+export function assertSandboxGroup(group, groups, policies) {
+  const ids = groupIds(group)
+  if (!ids.length) throw new Error('Choose at least one group for this sandbox.')
+  if (ids.some((id) => !groups.some((g) => g.id === id))) throw new Error('Unknown group.')
+  if (!groupNetworkPolicies(policies, group).length) throw new Error('Add a network rule to at least one selected group before creating or updating a sandbox.')
+}
+
+export function assertPolicyCoverage(before, after, memberships) {
+  for (const group of memberships) {
+    if (groupNetworkPolicies(before, group).length && !groupNetworkPolicies(after, group).length) {
+      throw new Error('This is the last network rule inherited by a sandbox. Add another rule or update its groups first.')
+    }
+  }
+}

package/shared/policy-templates.js

@@ -0,0 +1,79 @@
+// Network additions share the Restricted filesystem baseline. Agent and secret
+// connections are composed separately at launch, regardless of these choices.
+const filesystem = {
+  workdir: true,
+  readOnly: ['/bin', '/usr', '/lib', '/proc', '/dev/urandom', '/etc', '/var/log'],
+  readWrite: ['/tmp', '/dev/null'],
+}
+const https = (host, access = 'read-only') => ({ host, ports: [443], protocol: 'rest', access, enforcement: 'enforce' })
+const gitPrograms = [
+  '/usr/lib/git-core/git-remote-http', '/usr/lib/git-core/git-remote-https',
+  '/usr/libexec/git-core/git-remote-http', '/usr/libexec/git-core/git-remote-https',
+  '/usr/bin/gh', '/usr/local/bin/gh', '/usr/bin/curl', '/usr/local/bin/curl',
+]
+const preset = (id, name, description, rules, kind = 'access') => ({
+  id, name, description, kind, builtin: true, filesystem, landlock: 'best_effort', rules,
+})
+
+export const BUILTIN_TEMPLATES = [
+  // Keep the persisted ID so existing group and API references still resolve.
+  preset('locked-down', 'Restricted',
+    'Workspace and temporary files are writable; system folders are read-only. Includes selected agent connections and attached-secret access. Additional network access must be explicitly allowed.', [], 'baseline'),
+  preset('github-read', 'GitHub - Read',
+    'Clone and fetch repositories, read GitHub API data, and download repository files over HTTPS using Git, gh, or curl. Private repositories require credentials. This addition grants no push or API-write access.', [
+      { name: 'github-access', binaries: gitPrograms, endpoints: [
+        { host: 'github.com', ports: [443], protocol: 'rest', enforcement: 'enforce',
+          allow: [{ method: 'GET', path: '/**' }, { method: 'HEAD', path: '/**' }, { method: 'OPTIONS', path: '/**' }, { method: 'POST', path: '/*/*/git-upload-pack' }],
+          deny: [{ method: '*', path: '/*/*/git-receive-pack' }] },
+        https('api.github.com'), https('codeload.github.com'), https('raw.githubusercontent.com'),
+      ] },
+    ]),
+  preset('github-write', 'GitHub - Read & Write',
+    'Read and push repositories and write GitHub API data, including pull requests, issues, and comments, over HTTPS using Git, gh, or curl. Credentials determine which repositories and actions are available.', [
+      { name: 'github-access', binaries: gitPrograms, endpoints: [
+        https('github.com', 'read-write'), https('api.github.com', 'read-write'),
+        https('codeload.github.com'), https('raw.githubusercontent.com'),
+      ] },
+    ]),
+  preset('python-packages', 'Python - Packages',
+    'Download packages from PyPI and files.pythonhosted.org using Python. No publishing access is added. Other sources and destinations used by install scripts require separate rules.', [
+      { name: 'pypi', binaries: ['/usr/bin/python3*', '/usr/local/bin/python3*', '/usr/local/venv/bin/python*', '/opt/aider/bin/python*'],
+        endpoints: [https('pypi.org'), https('files.pythonhosted.org')] },
+    ]),
+  preset('node-packages', 'Node.js - Packages',
+    'Download packages from registry.npmjs.org using Node.js. No publishing access is added. Git dependencies and destinations used by install scripts require separate rules.', [
+      { name: 'npm', binaries: ['/usr/bin/node', '/usr/local/bin/node'], endpoints: [https('registry.npmjs.org')] },
+    ]),
+]
+
+export const ACCESS_TEMPLATES = BUILTIN_TEMPLATES.filter((template) => template.kind === 'access')
+
+export function normalizeAccessTemplates(ids = [], catalog = BUILTIN_TEMPLATES) {
+  if (!Array.isArray(ids) || ids.length > 16 || ids.some((id) => !catalog.some((template) => template.kind === 'access' && template.id === id))) {
+    throw new Error('Choose valid additional access templates.')
+  }
+  // Write includes read. Never retain the read rule's push denial alongside it.
+  return [...new Set(ids)].filter((id) => id !== 'github-read' || !ids.includes('github-write'))
+}
+
+export function toggleAccessTemplate(ids, id, catalog = BUILTIN_TEMPLATES) {
+  if (ids.includes(id)) return ids.filter((value) => value !== id)
+  const other = id === 'github-read' ? 'github-write' : id === 'github-write' ? 'github-read' : null
+  return normalizeAccessTemplates([...ids.filter((value) => value !== other), id], catalog)
+}
+
+export function composeTemplate(template, additional = [], catalog = BUILTIN_TEMPLATES) {
+  const ids = normalizeAccessTemplates([
+    ...normalizeAccessTemplates(template.accessTemplates, catalog),
+    ...normalizeAccessTemplates(additional, catalog),
+    ...(template.kind === 'access' ? [template.id] : []),
+  ], catalog)
+  const rules = new Map((template.kind === 'access' ? [] : template.rules).map((rule) => [rule.name, rule]))
+  for (const id of ids) {
+    for (const rule of catalog.find((item) => item.id === id).rules) {
+      if (rules.has(rule.name)) throw new Error(`Additional access conflicts with rule "${rule.name}". Edit the saved policy or choose another addition.`)
+      rules.set(rule.name, rule)
+    }
+  }
+  return { ...template, rules: [...rules.values()], accessTemplates: ids }
+}

package/shared/secret-fields.js

@@ -0,0 +1,35 @@
+// Uses the installed gateway profile, including its required flags and aliases.
+export function setupIssue(profile) {
+  if (profile.id === 'aws-bedrock') return 'This profile requires an upstream Bedrock bridge. Direct AWS credential authentication is not implemented by this profile; this form cannot configure the bridge.'
+  if ((profile.credentials ?? []).some((c) => c.refresh === true || c.refresh?.strategy)) return 'This profile requires managed credential refresh setup. Configure it with the OpenShell CLI; this form does not yet support its refresh material.'
+  if ((profile.credentials ?? []).some((c) => !c.envVars?.length)) return 'This profile has credentials without environment mappings and cannot be configured in this form.'
+  return null
+}
+export function credentialFields(profile) {
+  return (profile.credentials ?? []).map((c) => ({ ...c, key: c.envVars?.[0], label: c.description || c.name,
+    placeholder: c.name === 'account_id' ? 'Enter account ID' : /token/.test(c.name) ? 'Paste token' : 'Paste API key',
+    inputType: c.name === 'account_id' ? 'text' : 'password' }))
+}
+export function validateSecretCredentials(profile, input) {
+  const issue = setupIssue(profile)
+  if (issue) throw new Error(issue)
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Credentials must be an object.')
+  const definitions = profile.credentials ?? []
+  const allowed = new Set(definitions.flatMap((c) => c.envVars ?? []))
+  const result = {}
+  for (const [key, value] of Object.entries(input)) {
+    if (!allowed.has(key)) throw new Error(`${key} is not a credential of this profile.`)
+    if (typeof value !== 'string') throw new Error(`${key} must be text.`)
+    if (!value) continue
+    if (!value.trim() || value !== value.trim() || /[\r\n\x00]/.test(value)) throw new Error(`${key} contains whitespace or line breaks. Paste only the credential value.`)
+    if (value.length > 8192) throw new Error(`${key} is too long.`)
+    result[key] = value
+  }
+  for (const c of definitions) {
+    const supplied = c.envVars.filter((key) => result[key])
+    if (c.required && !supplied.length) throw new Error(`${c.description || c.name} is required.`)
+    if (new Set(supplied.map((key) => result[key])).size > 1) throw new Error(`Aliases for ${c.name} must contain the same value.`)
+  }
+  if (definitions.length && !Object.keys(result).length) throw new Error('Enter at least one credential.')
+  return result
+}

package/shared/setup-launch.js

@@ -0,0 +1,25 @@
+// Shared presentation/eligibility rules; the server still checks policy and pins.
+export const PACKAGE_PENDING = 'Not downloaded yet. Import downloads this npm package and checks that it starts, in a temporary sandbox.'
+// The legacy prefix keeps Setups saved before PACKAGE_PENDING preparable.
+export const isPackagePending = issue => issue === PACKAGE_PENDING || issue.startsWith('Prepare package')
+export const cannotRun = item => item.kind === 'mcp' && !item.disabled && !item.config && !item.configuration && !item.package
+export function packageRuntimeRequirements(plan) {
+  const host = new Map([['shadcn', 'ui.shadcn.com'], ['@magicuidesign/mcp', 'magicui.design']]).get(plan?.name)
+  return host ? [{ phase: 'runtime', host, port: 443, reason: 'Default component registry this MCP reads from.' }] : []
+}
+export function canPrepareAtLaunch(item) {
+  const retryable = new Set(item.preparationIssues || [])
+  return Boolean(!item.disabled && item.package && !item.artifact && !item.credentialFields?.length && item.issues.every(issue => isPackagePending(issue) || retryable.has(issue)))
+}
+export function launchableItem(item) {
+  return !item.disabled && (!item.issues.length || canPrepareAtLaunch(item))
+}
+export function launchRequirements(item) {
+  const requirements = item.requirements || []
+  return [...requirements, ...packageRuntimeRequirements(item.package).filter(r => !requirements.some(old => old.host === r.host && old.phase === r.phase))]
+}
+
+export function assertPackagesPrepared(setups) {
+  const pending = setups.flatMap(setup => setup.items.filter(canPrepareAtLaunch).map(item => item.name))
+  if (pending.length) throw Object.assign(new Error(`MCP packages are not prepared: ${pending.join(', ')}. Retry creation with automatic preparation, or rebuild the selected image template. No sandbox was created.`), { status: 409 })
+}

package/shared/setup-targets.js

@@ -0,0 +1,11 @@
+import catalog from './setup-targets.json' with { type: 'json' }
+
+export const SETUP_AGENTS = catalog
+export const SETUP_TARGETS = catalog.filter(agent => agent.config && agent.skills)
+export const setupTarget = id => SETUP_TARGETS.find(agent => agent.id === id)
+export const setupTargetsFor = ids => ids.filter(id => Boolean(setupTarget(id)))
+export function validateSetupTargets(targets) {
+  if (!Array.isArray(targets) || !targets.length || targets.length > SETUP_TARGETS.length || new Set(targets).size !== targets.length) throw new Error('Choose one or more supported agents for this Setup.')
+  for (const id of targets) if (!setupTarget(id)) throw new Error(catalog.find(agent => agent.id === id)?.reason || 'Unknown Setup agent.')
+  return targets
+}

package/shared/setup-targets.json

@@ -0,0 +1,12 @@
+[
+  { "id": "claude", "name": "Claude Code", "command": "claude", "config": ".claude.json", "key": "mcpServers", "format": "claude", "skills": ".claude/skills" },
+  { "id": "codex", "name": "Codex", "command": "codex", "config": ".codex/config.toml", "key": "mcp_servers", "format": "codex", "skills": ".agents/skills", "extraSkillRoots": [".codex/skills"] },
+  { "id": "opencode", "name": "OpenCode", "command": "opencode", "config": ".config/opencode/opencode.json", "alternateConfig": ".config/opencode/opencode.jsonc", "key": "mcp", "format": "opencode", "skills": ".config/opencode/skills", "extraSkillRoots": [".claude/skills", ".agents/skills"] },
+  { "id": "pi", "name": "Pi", "command": "pi", "config": ".pi/agent/mcp.json", "key": "mcpServers", "format": "json", "skills": ".pi/agent/skills", "extraSkillRoots": [".agents/skills"], "note": "Requires a Pi version with built-in MCP support; MCP extensions can override it." },
+  { "id": "cursor", "name": "Cursor", "command": "cursor-agent", "config": ".cursor/mcp.json", "key": "mcpServers", "format": "json", "skills": ".cursor/skills" },
+  { "id": "antigravity", "name": "Antigravity CLI", "command": "agy", "config": ".gemini/config/mcp_config.json", "key": "mcpServers", "format": "antigravity", "skills": ".gemini/config/skills" },
+  { "id": "copilot", "name": "GitHub Copilot", "command": "copilot", "config": ".copilot/mcp-config.json", "key": "mcpServers", "format": "copilot", "skills": ".copilot/skills" },
+  { "id": "kiro", "name": "Kiro CLI", "command": "kiro-cli", "config": ".kiro/settings/mcp.json", "key": "mcpServers", "format": "json", "skills": ".kiro/skills" },
+  { "id": "droid", "name": "Factory Droid", "command": "droid", "config": ".factory/mcp.json", "key": "mcpServers", "format": "droid", "skills": ".factory/skills" },
+  { "id": "aider", "name": "Aider", "command": "aider", "reason": "Aider has no supported native MCP or SKILL.md setup integration. Choose another agent to use this Setup." }
+]

package/src/lib/activity-export.js

@@ -0,0 +1,52 @@
+import { activityRow } from './activity-inventory.js'
+
+// Pinned contract: https://github.com/ocsf/ocsf-schema/tree/v1.4.0
+// Base Event is deliberately used: shorthand lacks the evidence required to
+// faithfully populate specialized network/process/authentication classes.
+export const OCSF_VERSION = '1.4.0'
+export function toOCSF(event) {
+  const sourceTime = Date.parse(event.at)
+  const receivedTime = Date.parse(event.receivedAt)
+  if (!Number.isFinite(sourceTime) && !Number.isFinite(receivedTime)) throw new Error('OCSF export requires an event or collection timestamp')
+  const severity = { INFO: 1, INFORMATIONAL: 1, LOW: 2, MED: 3, MEDIUM: 3, HIGH: 4, CRITICAL: 5, FATAL: 6 }[String(event.severity).toUpperCase()] ?? 0
+  const action = event.action || event.method
+  return {
+    category_uid: 0, class_uid: 0, activity_id: action ? 99 : 0, type_uid: action ? 99 : 0,
+    ...(action ? { activity_name: action } : {}),
+    severity_id: severity,
+    time: Number.isFinite(sourceTime) ? sourceTime : receivedTime,
+    metadata: {
+      version: OCSF_VERSION,
+      product: { name: 'OpenRod', vendor_name: 'OpenRod' },
+      ...(event.id ? { uid: event.id } : {}),
+      ...(Number.isFinite(receivedTime) ? { logged_time: receivedTime } : {}),
+      ...(event.correlationId ? { correlation_uid: event.correlationId } : {}),
+    },
+    ...(event.message ? { message: event.message } : {}),
+    status_id: event.outcome === 'success' ? 1 : event.outcome === 'failure' ? 2 : 0,
+    raw_data: JSON.stringify(event.original ?? event),
+    unmapped: { openshell: event, time_basis: Number.isFinite(sourceTime) ? 'source_event' : 'collection_time; source timestamp unavailable' },
+  }
+}
+export function exportEvent(event, format = 'json', columns) {
+  if (!Array.isArray(columns)) return format === 'ocsf' ? toOCSF(event) : event
+  const values = activityRow(event).values
+  const selected = Object.fromEntries(columns.filter((key) => Object.hasOwn(values, key)).map((key) => [key, values[key]]))
+  if (format !== 'ocsf') return selected
+  const base = toOCSF(event)
+  return {
+    category_uid: 0, class_uid: 0,
+    activity_id: columns.includes('action') ? base.activity_id : 0,
+    type_uid: columns.includes('action') ? base.type_uid : 0,
+    ...(columns.includes('action') && base.activity_name ? { activity_name: base.activity_name } : {}),
+    severity_id: columns.includes('severity') ? base.severity_id : 0,
+    time: base.time,
+    metadata: { version: OCSF_VERSION, product: base.metadata.product },
+    unmapped: { openshell: selected, time_basis: base.unmapped.time_basis },
+  }
+}
+export function exportDocument(events, context, format = 'json') {
+  const selected = events.map((event) => exportEvent(event, format, context?.columns))
+  if (format === 'ocsf') return selected
+  return { exportedAt: new Date().toISOString(), context, events: selected }
+}