osagent 0.1.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +73 -0
- package/README.md +153 -0
- package/dist/cli.js +364560 -0
- package/dist/sandbox-macos-permissive-closed.sb +32 -0
- package/dist/sandbox-macos-permissive-open.sb +25 -0
- package/dist/sandbox-macos-permissive-proxied.sb +37 -0
- package/dist/sandbox-macos-restrictive-closed.sb +93 -0
- package/dist/sandbox-macos-restrictive-open.sb +96 -0
- package/dist/sandbox-macos-restrictive-proxied.sb +98 -0
- package/dist/vendor/ripgrep/COPYING +3 -0
- package/dist/vendor/ripgrep/arm64-darwin/rg +0 -0
- package/dist/vendor/ripgrep/arm64-linux/rg +0 -0
- package/dist/vendor/ripgrep/x64-darwin/rg +0 -0
- package/dist/vendor/ripgrep/x64-linux/rg +0 -0
- package/dist/vendor/ripgrep/x64-win32/rg.exe +0 -0
- package/package.json +154 -0
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; allow everything by default
|
|
4
|
+
(allow default)
|
|
5
|
+
|
|
6
|
+
;; deny all writes EXCEPT under specific paths
|
|
7
|
+
(deny file-write*)
|
|
8
|
+
(allow file-write*
|
|
9
|
+
(subpath (param "TARGET_DIR"))
|
|
10
|
+
(subpath (param "TMP_DIR"))
|
|
11
|
+
(subpath (param "CACHE_DIR"))
|
|
12
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
13
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
14
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
15
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
16
|
+
;; Allow writes to included directories from --include-directories
|
|
17
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
18
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
19
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
20
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
21
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
22
|
+
(literal "/dev/stdout")
|
|
23
|
+
(literal "/dev/stderr")
|
|
24
|
+
(literal "/dev/null")
|
|
25
|
+
)
|
|
26
|
+
|
|
27
|
+
;; deny all inbound network traffic EXCEPT on debugger port
|
|
28
|
+
(deny network-inbound)
|
|
29
|
+
(allow network-inbound (local ip "localhost:9229"))
|
|
30
|
+
|
|
31
|
+
;; deny all outbound network traffic
|
|
32
|
+
(deny network-outbound)
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; allow everything by default
|
|
4
|
+
(allow default)
|
|
5
|
+
|
|
6
|
+
;; deny all writes EXCEPT under specific paths
|
|
7
|
+
(deny file-write*)
|
|
8
|
+
(allow file-write*
|
|
9
|
+
(subpath (param "TARGET_DIR"))
|
|
10
|
+
(subpath (param "TMP_DIR"))
|
|
11
|
+
(subpath (param "CACHE_DIR"))
|
|
12
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
13
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
14
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
15
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
16
|
+
;; Allow writes to included directories from --include-directories
|
|
17
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
18
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
19
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
20
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
21
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
22
|
+
(literal "/dev/stdout")
|
|
23
|
+
(literal "/dev/stderr")
|
|
24
|
+
(literal "/dev/null")
|
|
25
|
+
)
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; allow everything by default
|
|
4
|
+
(allow default)
|
|
5
|
+
|
|
6
|
+
;; deny all writes EXCEPT under specific paths
|
|
7
|
+
(deny file-write*)
|
|
8
|
+
(allow file-write*
|
|
9
|
+
(subpath (param "TARGET_DIR"))
|
|
10
|
+
(subpath (param "TMP_DIR"))
|
|
11
|
+
(subpath (param "CACHE_DIR"))
|
|
12
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
13
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
14
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
15
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
16
|
+
;; Allow writes to included directories from --include-directories
|
|
17
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
18
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
19
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
20
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
21
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
22
|
+
(literal "/dev/stdout")
|
|
23
|
+
(literal "/dev/stderr")
|
|
24
|
+
(literal "/dev/null")
|
|
25
|
+
)
|
|
26
|
+
|
|
27
|
+
;; deny all inbound network traffic EXCEPT on debugger port
|
|
28
|
+
(deny network-inbound)
|
|
29
|
+
(allow network-inbound (local ip "localhost:9229"))
|
|
30
|
+
|
|
31
|
+
;; deny all outbound network traffic EXCEPT through proxy on localhost:8877
|
|
32
|
+
;; set `OSA_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
|
|
33
|
+
;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
|
|
34
|
+
(deny network-outbound)
|
|
35
|
+
(allow network-outbound (remote tcp "localhost:8877"))
|
|
36
|
+
|
|
37
|
+
(allow network-bind (local ip "*:*"))
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; deny everything by default
|
|
4
|
+
(deny default)
|
|
5
|
+
|
|
6
|
+
;; allow reading files from anywhere on host
|
|
7
|
+
(allow file-read*)
|
|
8
|
+
|
|
9
|
+
;; allow exec/fork (children inherit policy)
|
|
10
|
+
(allow process-exec)
|
|
11
|
+
(allow process-fork)
|
|
12
|
+
|
|
13
|
+
;; allow signals to self, e.g. SIGPIPE on write to closed pipe
|
|
14
|
+
(allow signal (target self))
|
|
15
|
+
|
|
16
|
+
;; allow read access to specific information about system
|
|
17
|
+
;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
|
|
18
|
+
(allow sysctl-read
|
|
19
|
+
(sysctl-name "hw.activecpu")
|
|
20
|
+
(sysctl-name "hw.busfrequency_compat")
|
|
21
|
+
(sysctl-name "hw.byteorder")
|
|
22
|
+
(sysctl-name "hw.cacheconfig")
|
|
23
|
+
(sysctl-name "hw.cachelinesize_compat")
|
|
24
|
+
(sysctl-name "hw.cpufamily")
|
|
25
|
+
(sysctl-name "hw.cpufrequency_compat")
|
|
26
|
+
(sysctl-name "hw.cputype")
|
|
27
|
+
(sysctl-name "hw.l1dcachesize_compat")
|
|
28
|
+
(sysctl-name "hw.l1icachesize_compat")
|
|
29
|
+
(sysctl-name "hw.l2cachesize_compat")
|
|
30
|
+
(sysctl-name "hw.l3cachesize_compat")
|
|
31
|
+
(sysctl-name "hw.logicalcpu_max")
|
|
32
|
+
(sysctl-name "hw.machine")
|
|
33
|
+
(sysctl-name "hw.ncpu")
|
|
34
|
+
(sysctl-name "hw.nperflevels")
|
|
35
|
+
(sysctl-name "hw.optional.arm.FEAT_BF16")
|
|
36
|
+
(sysctl-name "hw.optional.arm.FEAT_DotProd")
|
|
37
|
+
(sysctl-name "hw.optional.arm.FEAT_FCMA")
|
|
38
|
+
(sysctl-name "hw.optional.arm.FEAT_FHM")
|
|
39
|
+
(sysctl-name "hw.optional.arm.FEAT_FP16")
|
|
40
|
+
(sysctl-name "hw.optional.arm.FEAT_I8MM")
|
|
41
|
+
(sysctl-name "hw.optional.arm.FEAT_JSCVT")
|
|
42
|
+
(sysctl-name "hw.optional.arm.FEAT_LSE")
|
|
43
|
+
(sysctl-name "hw.optional.arm.FEAT_RDM")
|
|
44
|
+
(sysctl-name "hw.optional.arm.FEAT_SHA512")
|
|
45
|
+
(sysctl-name "hw.optional.armv8_2_sha512")
|
|
46
|
+
(sysctl-name "hw.packages")
|
|
47
|
+
(sysctl-name "hw.pagesize_compat")
|
|
48
|
+
(sysctl-name "hw.physicalcpu_max")
|
|
49
|
+
(sysctl-name "hw.tbfrequency_compat")
|
|
50
|
+
(sysctl-name "hw.vectorunit")
|
|
51
|
+
(sysctl-name "kern.hostname")
|
|
52
|
+
(sysctl-name "kern.maxfilesperproc")
|
|
53
|
+
(sysctl-name "kern.osproductversion")
|
|
54
|
+
(sysctl-name "kern.osrelease")
|
|
55
|
+
(sysctl-name "kern.ostype")
|
|
56
|
+
(sysctl-name "kern.osvariant_status")
|
|
57
|
+
(sysctl-name "kern.osversion")
|
|
58
|
+
(sysctl-name "kern.secure_kernel")
|
|
59
|
+
(sysctl-name "kern.usrstack64")
|
|
60
|
+
(sysctl-name "kern.version")
|
|
61
|
+
(sysctl-name "sysctl.proc_cputype")
|
|
62
|
+
(sysctl-name-prefix "hw.perflevel")
|
|
63
|
+
)
|
|
64
|
+
|
|
65
|
+
;; allow writes to specific paths
|
|
66
|
+
(allow file-write*
|
|
67
|
+
(subpath (param "TARGET_DIR"))
|
|
68
|
+
(subpath (param "TMP_DIR"))
|
|
69
|
+
(subpath (param "CACHE_DIR"))
|
|
70
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
71
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
72
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
73
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
74
|
+
;; Allow writes to included directories from --include-directories
|
|
75
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
76
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
77
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
78
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
79
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
80
|
+
(literal "/dev/stdout")
|
|
81
|
+
(literal "/dev/stderr")
|
|
82
|
+
(literal "/dev/null")
|
|
83
|
+
)
|
|
84
|
+
|
|
85
|
+
;; allow communication with sysmond for process listing (e.g. for pgrep)
|
|
86
|
+
(allow mach-lookup (global-name "com.apple.sysmond"))
|
|
87
|
+
|
|
88
|
+
;; enable terminal access required by ink
|
|
89
|
+
;; fixes setRawMode EPERM failure (at node:tty:81:24)
|
|
90
|
+
(allow file-ioctl (regex #"^/dev/tty.*"))
|
|
91
|
+
|
|
92
|
+
;; allow inbound network traffic on debugger port
|
|
93
|
+
(allow network-inbound (local ip "localhost:9229"))
|
|
@@ -0,0 +1,96 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; deny everything by default
|
|
4
|
+
(deny default)
|
|
5
|
+
|
|
6
|
+
;; allow reading files from anywhere on host
|
|
7
|
+
(allow file-read*)
|
|
8
|
+
|
|
9
|
+
;; allow exec/fork (children inherit policy)
|
|
10
|
+
(allow process-exec)
|
|
11
|
+
(allow process-fork)
|
|
12
|
+
|
|
13
|
+
;; allow signals to self, e.g. SIGPIPE on write to closed pipe
|
|
14
|
+
(allow signal (target self))
|
|
15
|
+
|
|
16
|
+
;; allow read access to specific information about system
|
|
17
|
+
;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
|
|
18
|
+
(allow sysctl-read
|
|
19
|
+
(sysctl-name "hw.activecpu")
|
|
20
|
+
(sysctl-name "hw.busfrequency_compat")
|
|
21
|
+
(sysctl-name "hw.byteorder")
|
|
22
|
+
(sysctl-name "hw.cacheconfig")
|
|
23
|
+
(sysctl-name "hw.cachelinesize_compat")
|
|
24
|
+
(sysctl-name "hw.cpufamily")
|
|
25
|
+
(sysctl-name "hw.cpufrequency_compat")
|
|
26
|
+
(sysctl-name "hw.cputype")
|
|
27
|
+
(sysctl-name "hw.l1dcachesize_compat")
|
|
28
|
+
(sysctl-name "hw.l1icachesize_compat")
|
|
29
|
+
(sysctl-name "hw.l2cachesize_compat")
|
|
30
|
+
(sysctl-name "hw.l3cachesize_compat")
|
|
31
|
+
(sysctl-name "hw.logicalcpu_max")
|
|
32
|
+
(sysctl-name "hw.machine")
|
|
33
|
+
(sysctl-name "hw.ncpu")
|
|
34
|
+
(sysctl-name "hw.nperflevels")
|
|
35
|
+
(sysctl-name "hw.optional.arm.FEAT_BF16")
|
|
36
|
+
(sysctl-name "hw.optional.arm.FEAT_DotProd")
|
|
37
|
+
(sysctl-name "hw.optional.arm.FEAT_FCMA")
|
|
38
|
+
(sysctl-name "hw.optional.arm.FEAT_FHM")
|
|
39
|
+
(sysctl-name "hw.optional.arm.FEAT_FP16")
|
|
40
|
+
(sysctl-name "hw.optional.arm.FEAT_I8MM")
|
|
41
|
+
(sysctl-name "hw.optional.arm.FEAT_JSCVT")
|
|
42
|
+
(sysctl-name "hw.optional.arm.FEAT_LSE")
|
|
43
|
+
(sysctl-name "hw.optional.arm.FEAT_RDM")
|
|
44
|
+
(sysctl-name "hw.optional.arm.FEAT_SHA512")
|
|
45
|
+
(sysctl-name "hw.optional.armv8_2_sha512")
|
|
46
|
+
(sysctl-name "hw.packages")
|
|
47
|
+
(sysctl-name "hw.pagesize_compat")
|
|
48
|
+
(sysctl-name "hw.physicalcpu_max")
|
|
49
|
+
(sysctl-name "hw.tbfrequency_compat")
|
|
50
|
+
(sysctl-name "hw.vectorunit")
|
|
51
|
+
(sysctl-name "kern.hostname")
|
|
52
|
+
(sysctl-name "kern.maxfilesperproc")
|
|
53
|
+
(sysctl-name "kern.osproductversion")
|
|
54
|
+
(sysctl-name "kern.osrelease")
|
|
55
|
+
(sysctl-name "kern.ostype")
|
|
56
|
+
(sysctl-name "kern.osvariant_status")
|
|
57
|
+
(sysctl-name "kern.osversion")
|
|
58
|
+
(sysctl-name "kern.secure_kernel")
|
|
59
|
+
(sysctl-name "kern.usrstack64")
|
|
60
|
+
(sysctl-name "kern.version")
|
|
61
|
+
(sysctl-name "sysctl.proc_cputype")
|
|
62
|
+
(sysctl-name-prefix "hw.perflevel")
|
|
63
|
+
)
|
|
64
|
+
|
|
65
|
+
;; allow writes to specific paths
|
|
66
|
+
(allow file-write*
|
|
67
|
+
(subpath (param "TARGET_DIR"))
|
|
68
|
+
(subpath (param "TMP_DIR"))
|
|
69
|
+
(subpath (param "CACHE_DIR"))
|
|
70
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
71
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
72
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
73
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
74
|
+
;; Allow writes to included directories from --include-directories
|
|
75
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
76
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
77
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
78
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
79
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
80
|
+
(literal "/dev/stdout")
|
|
81
|
+
(literal "/dev/stderr")
|
|
82
|
+
(literal "/dev/null")
|
|
83
|
+
)
|
|
84
|
+
|
|
85
|
+
;; allow communication with sysmond for process listing (e.g. for pgrep)
|
|
86
|
+
(allow mach-lookup (global-name "com.apple.sysmond"))
|
|
87
|
+
|
|
88
|
+
;; enable terminal access required by ink
|
|
89
|
+
;; fixes setRawMode EPERM failure (at node:tty:81:24)
|
|
90
|
+
(allow file-ioctl (regex #"^/dev/tty.*"))
|
|
91
|
+
|
|
92
|
+
;; allow inbound network traffic on debugger port
|
|
93
|
+
(allow network-inbound (local ip "localhost:9229"))
|
|
94
|
+
|
|
95
|
+
;; allow all outbound network traffic
|
|
96
|
+
(allow network-outbound)
|
|
@@ -0,0 +1,98 @@
|
|
|
1
|
+
(version 1)
|
|
2
|
+
|
|
3
|
+
;; deny everything by default
|
|
4
|
+
(deny default)
|
|
5
|
+
|
|
6
|
+
;; allow reading files from anywhere on host
|
|
7
|
+
(allow file-read*)
|
|
8
|
+
|
|
9
|
+
;; allow exec/fork (children inherit policy)
|
|
10
|
+
(allow process-exec)
|
|
11
|
+
(allow process-fork)
|
|
12
|
+
|
|
13
|
+
;; allow signals to self, e.g. SIGPIPE on write to closed pipe
|
|
14
|
+
(allow signal (target self))
|
|
15
|
+
|
|
16
|
+
;; allow read access to specific information about system
|
|
17
|
+
;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
|
|
18
|
+
(allow sysctl-read
|
|
19
|
+
(sysctl-name "hw.activecpu")
|
|
20
|
+
(sysctl-name "hw.busfrequency_compat")
|
|
21
|
+
(sysctl-name "hw.byteorder")
|
|
22
|
+
(sysctl-name "hw.cacheconfig")
|
|
23
|
+
(sysctl-name "hw.cachelinesize_compat")
|
|
24
|
+
(sysctl-name "hw.cpufamily")
|
|
25
|
+
(sysctl-name "hw.cpufrequency_compat")
|
|
26
|
+
(sysctl-name "hw.cputype")
|
|
27
|
+
(sysctl-name "hw.l1dcachesize_compat")
|
|
28
|
+
(sysctl-name "hw.l1icachesize_compat")
|
|
29
|
+
(sysctl-name "hw.l2cachesize_compat")
|
|
30
|
+
(sysctl-name "hw.l3cachesize_compat")
|
|
31
|
+
(sysctl-name "hw.logicalcpu_max")
|
|
32
|
+
(sysctl-name "hw.machine")
|
|
33
|
+
(sysctl-name "hw.ncpu")
|
|
34
|
+
(sysctl-name "hw.nperflevels")
|
|
35
|
+
(sysctl-name "hw.optional.arm.FEAT_BF16")
|
|
36
|
+
(sysctl-name "hw.optional.arm.FEAT_DotProd")
|
|
37
|
+
(sysctl-name "hw.optional.arm.FEAT_FCMA")
|
|
38
|
+
(sysctl-name "hw.optional.arm.FEAT_FHM")
|
|
39
|
+
(sysctl-name "hw.optional.arm.FEAT_FP16")
|
|
40
|
+
(sysctl-name "hw.optional.arm.FEAT_I8MM")
|
|
41
|
+
(sysctl-name "hw.optional.arm.FEAT_JSCVT")
|
|
42
|
+
(sysctl-name "hw.optional.arm.FEAT_LSE")
|
|
43
|
+
(sysctl-name "hw.optional.arm.FEAT_RDM")
|
|
44
|
+
(sysctl-name "hw.optional.arm.FEAT_SHA512")
|
|
45
|
+
(sysctl-name "hw.optional.armv8_2_sha512")
|
|
46
|
+
(sysctl-name "hw.packages")
|
|
47
|
+
(sysctl-name "hw.pagesize_compat")
|
|
48
|
+
(sysctl-name "hw.physicalcpu_max")
|
|
49
|
+
(sysctl-name "hw.tbfrequency_compat")
|
|
50
|
+
(sysctl-name "hw.vectorunit")
|
|
51
|
+
(sysctl-name "kern.hostname")
|
|
52
|
+
(sysctl-name "kern.maxfilesperproc")
|
|
53
|
+
(sysctl-name "kern.osproductversion")
|
|
54
|
+
(sysctl-name "kern.osrelease")
|
|
55
|
+
(sysctl-name "kern.ostype")
|
|
56
|
+
(sysctl-name "kern.osvariant_status")
|
|
57
|
+
(sysctl-name "kern.osversion")
|
|
58
|
+
(sysctl-name "kern.secure_kernel")
|
|
59
|
+
(sysctl-name "kern.usrstack64")
|
|
60
|
+
(sysctl-name "kern.version")
|
|
61
|
+
(sysctl-name "sysctl.proc_cputype")
|
|
62
|
+
(sysctl-name-prefix "hw.perflevel")
|
|
63
|
+
)
|
|
64
|
+
|
|
65
|
+
;; allow writes to specific paths
|
|
66
|
+
(allow file-write*
|
|
67
|
+
(subpath (param "TARGET_DIR"))
|
|
68
|
+
(subpath (param "TMP_DIR"))
|
|
69
|
+
(subpath (param "CACHE_DIR"))
|
|
70
|
+
(subpath (string-append (param "HOME_DIR") "/.OSA"))
|
|
71
|
+
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
|
72
|
+
(subpath (string-append (param "HOME_DIR") "/.cache"))
|
|
73
|
+
(subpath (string-append (param "HOME_DIR") "/.gitconfig"))
|
|
74
|
+
;; Allow writes to included directories from --include-directories
|
|
75
|
+
(subpath (param "INCLUDE_DIR_0"))
|
|
76
|
+
(subpath (param "INCLUDE_DIR_1"))
|
|
77
|
+
(subpath (param "INCLUDE_DIR_2"))
|
|
78
|
+
(subpath (param "INCLUDE_DIR_3"))
|
|
79
|
+
(subpath (param "INCLUDE_DIR_4"))
|
|
80
|
+
(literal "/dev/stdout")
|
|
81
|
+
(literal "/dev/stderr")
|
|
82
|
+
(literal "/dev/null")
|
|
83
|
+
)
|
|
84
|
+
|
|
85
|
+
;; allow communication with sysmond for process listing (e.g. for pgrep)
|
|
86
|
+
(allow mach-lookup (global-name "com.apple.sysmond"))
|
|
87
|
+
|
|
88
|
+
;; enable terminal access required by ink
|
|
89
|
+
;; fixes setRawMode EPERM failure (at node:tty:81:24)
|
|
90
|
+
(allow file-ioctl (regex #"^/dev/tty.*"))
|
|
91
|
+
|
|
92
|
+
;; allow inbound network traffic on debugger port
|
|
93
|
+
(allow network-inbound (local ip "localhost:9229"))
|
|
94
|
+
|
|
95
|
+
;; allow outbound network traffic through proxy on localhost:8877
|
|
96
|
+
;; set `OSA_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
|
|
97
|
+
;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
|
|
98
|
+
(allow network-outbound (remote tcp "localhost:8877"))
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/package.json
ADDED
|
@@ -0,0 +1,154 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "osagent",
|
|
3
|
+
"version": "0.1.11",
|
|
4
|
+
"description": "OS Agent - AI-powered CLI for autonomous coding with Ollama Cloud and Qwen models",
|
|
5
|
+
"author": "Roberto Luna",
|
|
6
|
+
"license": "Apache-2.0",
|
|
7
|
+
"keywords": [
|
|
8
|
+
"ai",
|
|
9
|
+
"cli",
|
|
10
|
+
"agent",
|
|
11
|
+
"ollama",
|
|
12
|
+
"qwen",
|
|
13
|
+
"coding",
|
|
14
|
+
"terminal",
|
|
15
|
+
"autonomous"
|
|
16
|
+
],
|
|
17
|
+
"homepage": "https://github.com/robertohluna/osagent#readme",
|
|
18
|
+
"bugs": {
|
|
19
|
+
"url": "https://github.com/robertohluna/osagent/issues"
|
|
20
|
+
},
|
|
21
|
+
"engines": {
|
|
22
|
+
"node": ">=20.0.0"
|
|
23
|
+
},
|
|
24
|
+
"type": "module",
|
|
25
|
+
"workspaces": [
|
|
26
|
+
"packages/*"
|
|
27
|
+
],
|
|
28
|
+
"repository": {
|
|
29
|
+
"type": "git",
|
|
30
|
+
"url": "git+https://github.com/robertohluna/osagent.git"
|
|
31
|
+
},
|
|
32
|
+
"config": {
|
|
33
|
+
"sandboxImageUri": "ghcr.io/osagent/osagent:0.1.10"
|
|
34
|
+
},
|
|
35
|
+
"scripts": {
|
|
36
|
+
"start": "cross-env node scripts/start.js",
|
|
37
|
+
"debug": "cross-env DEBUG=1 node --inspect-brk scripts/start.js",
|
|
38
|
+
"auth:npm": "npx OSAgent-artifactregistry-auth",
|
|
39
|
+
"auth:docker": "gcloud auth configure-docker us-west1-docker.pkg.dev",
|
|
40
|
+
"auth": "npm run auth:npm && npm run auth:docker",
|
|
41
|
+
"generate": "node scripts/generate-git-commit-info.js",
|
|
42
|
+
"build": "node scripts/build.js",
|
|
43
|
+
"build-and-start": "npm run build && npm run start",
|
|
44
|
+
"build:vscode": "node scripts/build_vscode_companion.js",
|
|
45
|
+
"build:all": "npm run build && npm run build:sandbox && npm run build:vscode",
|
|
46
|
+
"build:packages": "npm run build --workspaces",
|
|
47
|
+
"build:sandbox": "node scripts/build_sandbox.js",
|
|
48
|
+
"bundle": "npm run generate && node esbuild.config.js && node scripts/copy_bundle_assets.js",
|
|
49
|
+
"test": "npm run test --workspaces --if-present --parallel",
|
|
50
|
+
"test:ci": "npm run test:ci --workspaces --if-present --parallel && npm run test:scripts",
|
|
51
|
+
"test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",
|
|
52
|
+
"test:e2e": "cross-env VERBOSE=true KEEP_OUTPUT=true npm run test:integration:sandbox:none",
|
|
53
|
+
"test:integration:all": "npm run test:integration:sandbox:none && npm run test:integration:sandbox:docker && npm run test:integration:sandbox:podman",
|
|
54
|
+
"test:integration:sandbox:none": "cross-env OSA_SANDBOX=false vitest run --root ./integration-tests",
|
|
55
|
+
"test:integration:sandbox:docker": "cross-env OSA_SANDBOX=docker npm run build:sandbox && OSA_SANDBOX=docker vitest run --root ./integration-tests",
|
|
56
|
+
"test:integration:sandbox:podman": "cross-env OSA_SANDBOX=podman vitest run --root ./integration-tests",
|
|
57
|
+
"test:terminal-bench": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests",
|
|
58
|
+
"test:terminal-bench:oracle": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t 'oracle'",
|
|
59
|
+
"test:terminal-bench:OSA": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t 'OSA'",
|
|
60
|
+
"lint": "eslint . --ext .ts,.tsx && eslint integration-tests",
|
|
61
|
+
"lint:fix": "eslint . --fix && eslint integration-tests --fix",
|
|
62
|
+
"lint:ci": "eslint . --ext .ts,.tsx --max-warnings 0 && eslint integration-tests --max-warnings 0",
|
|
63
|
+
"lint:all": "node scripts/lint.js",
|
|
64
|
+
"format": "prettier --experimental-cli --write .",
|
|
65
|
+
"typecheck": "npm run typecheck --workspaces --if-present",
|
|
66
|
+
"check-i18n": "npm run check-i18n --workspace=packages/cli",
|
|
67
|
+
"preflight": "npm run clean && npm ci && npm run format && npm run lint:ci && npm run build && npm run typecheck && npm run test:ci",
|
|
68
|
+
"prepare": "husky && npm run bundle",
|
|
69
|
+
"prepare:package": "node scripts/prepare-package.js",
|
|
70
|
+
"release:version": "node scripts/version.js",
|
|
71
|
+
"telemetry": "node scripts/telemetry.js",
|
|
72
|
+
"check:lockfile": "node scripts/check-lockfile.js",
|
|
73
|
+
"clean": "node scripts/clean.js",
|
|
74
|
+
"pre-commit": "node scripts/pre-commit.js"
|
|
75
|
+
},
|
|
76
|
+
"overrides": {
|
|
77
|
+
"wrap-ansi": "9.0.2",
|
|
78
|
+
"ansi-regex": "5.0.1",
|
|
79
|
+
"cliui": {
|
|
80
|
+
"wrap-ansi": "7.0.0"
|
|
81
|
+
}
|
|
82
|
+
},
|
|
83
|
+
"bin": {
|
|
84
|
+
"osagent": "dist/cli.js"
|
|
85
|
+
},
|
|
86
|
+
"files": [
|
|
87
|
+
"dist/",
|
|
88
|
+
"README.md",
|
|
89
|
+
"LICENSE"
|
|
90
|
+
],
|
|
91
|
+
"devDependencies": {
|
|
92
|
+
"@types/marked": "^5.0.2",
|
|
93
|
+
"@types/mime-types": "^3.0.1",
|
|
94
|
+
"@types/minimatch": "^5.1.2",
|
|
95
|
+
"@types/mock-fs": "^4.13.4",
|
|
96
|
+
"@types/qrcode-terminal": "^0.12.2",
|
|
97
|
+
"@types/shell-quote": "^1.7.5",
|
|
98
|
+
"@types/uuid": "^10.0.0",
|
|
99
|
+
"@vitest/coverage-v8": "^3.1.1",
|
|
100
|
+
"@vitest/eslint-plugin": "^1.3.4",
|
|
101
|
+
"cross-env": "^7.0.3",
|
|
102
|
+
"esbuild": "^0.25.0",
|
|
103
|
+
"eslint": "^9.24.0",
|
|
104
|
+
"eslint-config-prettier": "^10.1.2",
|
|
105
|
+
"eslint-plugin-import": "^2.31.0",
|
|
106
|
+
"eslint-plugin-license-header": "^0.8.0",
|
|
107
|
+
"eslint-plugin-react": "^7.37.5",
|
|
108
|
+
"eslint-plugin-react-hooks": "^5.2.0",
|
|
109
|
+
"glob": "^10.4.5",
|
|
110
|
+
"globals": "^16.0.0",
|
|
111
|
+
"google-artifactregistry-auth": "^3.4.0",
|
|
112
|
+
"husky": "^9.1.7",
|
|
113
|
+
"json": "^11.0.0",
|
|
114
|
+
"lint-staged": "^16.1.6",
|
|
115
|
+
"memfs": "^4.42.0",
|
|
116
|
+
"mnemonist": "^0.40.3",
|
|
117
|
+
"mock-fs": "^5.5.0",
|
|
118
|
+
"msw": "^2.10.4",
|
|
119
|
+
"npm-run-all": "^4.1.5",
|
|
120
|
+
"prettier": "^3.5.3",
|
|
121
|
+
"react-devtools-core": "^4.28.5",
|
|
122
|
+
"semver": "^7.7.2",
|
|
123
|
+
"strip-ansi": "^7.1.2",
|
|
124
|
+
"tsx": "^4.20.3",
|
|
125
|
+
"typescript-eslint": "^8.30.1",
|
|
126
|
+
"vitest": "^3.2.4",
|
|
127
|
+
"yargs": "^17.7.2"
|
|
128
|
+
},
|
|
129
|
+
"dependencies": {
|
|
130
|
+
"osagent-core": "file:packages/core",
|
|
131
|
+
"@testing-library/dom": "^10.4.1",
|
|
132
|
+
"punycode": "^2.3.1",
|
|
133
|
+
"simple-git": "^3.28.0",
|
|
134
|
+
"tiktoken": "^1.0.21"
|
|
135
|
+
},
|
|
136
|
+
"optionalDependencies": {
|
|
137
|
+
"@lydell/node-pty": "1.1.0",
|
|
138
|
+
"@lydell/node-pty-darwin-arm64": "1.1.0",
|
|
139
|
+
"@lydell/node-pty-darwin-x64": "1.1.0",
|
|
140
|
+
"@lydell/node-pty-linux-x64": "1.1.0",
|
|
141
|
+
"@lydell/node-pty-win32-arm64": "1.1.0",
|
|
142
|
+
"@lydell/node-pty-win32-x64": "1.1.0",
|
|
143
|
+
"node-pty": "^1.0.0"
|
|
144
|
+
},
|
|
145
|
+
"lint-staged": {
|
|
146
|
+
"*.{js,jsx,ts,tsx}": [
|
|
147
|
+
"prettier --write",
|
|
148
|
+
"eslint --fix --max-warnings 0"
|
|
149
|
+
],
|
|
150
|
+
"*.{json,md}": [
|
|
151
|
+
"prettier --write"
|
|
152
|
+
]
|
|
153
|
+
}
|
|
154
|
+
}
|