pi-codex-auto-review 0.1.0

package/dist/reviewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer.js","sourceRoot":"","sources":["../src/reviewer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAA0H,MAAM,gBAAgB,CAAC;AACtM,OAAO,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAA4B,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAsB,MAAM,mBAAmB,CAAC;AAMzE,MAAM,OAAO,gBAAgB;IACE;IAA6E;IAA6D;IAAvK,YAA6B,OAA0D,EAAmB,WAA0B,gBAAgB,EAAmB,aAAmC;QAA7K,YAAO,GAAP,OAAO,CAAmD;QAAmB,aAAQ,GAAR,QAAQ,CAAkC;QAAmB,kBAAa,GAAb,aAAa,CAAsB;IAAG,CAAC;IAC9M,KAAK,CAAC,QAAQ,CAAC,OAAsB,EAAE,OAAmD;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9G,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QACzJ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACxH,MAAM,OAAO,GAAoB,EAAC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAwC,CAAC,CAAC,CAAC,EAAE,EAAC,CAAC;QAClP,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,qDAAqD,CAAC,CAAC;YACpN,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE;gBACxF,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;gBAC9H,SAAS,EAAE,WAAW,EAAE,CAAC;aAC1B,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;YACpM,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChH,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,0DAA0D,CAAC,CAAC;YACrM,uFAAuF;YACvF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,EAAC,CAAC,CAAC;YACzG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBAAC,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACvH,OAAO,KAAK,EAAE,CAAC;oBAAC,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,gCAAgC,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAC,CAAC;gBAC1G,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC,CAAC;YAChK,CAAC;QACH,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;IAC9E,CAAC;CACF;AACD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IACrH,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAC3F,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC3T,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC3G,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAClG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACvW,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,oDAAoD,CAAC;IACrO,MAAM,WAAW,GAAG,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5G,OAAO,SAAS,CAAC,EAAC,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,SAAS,EAAqB,CAAC,CAAC;AACpQ,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;IAC1D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzU,OAAO,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAwB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACrG,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAIlC;IACC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3C,IAAI,cAAc,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAChM,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAC,CAAC,EAAC,CAAC;IACnO,MAAM,OAAO,GAAG,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAC,CAAC;IACtI,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;QAChI,2GAA2G;QAC3G,IAAI,aAAa,CAAC,YAAY,CAAC,MAAkD,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iFAAiF,CAAC,CAAC;QACzO,MAAM,OAAO,GAAG;YACd,YAAY,EAAE,MAAM,CAAC,IAAI;YACzB,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;SAC/I,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,IAAI,gBAAgB,CAAC,kBAAkB,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1M,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/I,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjC,6EAA6E;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;YAAC,CAAC;YACpH,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,EAAC,GAAG,MAAM,EAAE,MAAM,EAAC,EAAC,GAAG,OAAO,EAAC,MAAM,EAAC,QAAQ,EAAC,UAAU,EAAC,EAAC,UAAU,EAAC,MAAM,EAAC,kBAAkB,EAAC,SAAS,EAAC,OAAO,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,CAAC,MAAM,EAAC,EAAC,EAAC,CAAC;YAC3L,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,4DAA4D,EAAC,CAAC;YACvO,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,OAAO,EAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAC,CAAC;YAC3I,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAiB,EAAC,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAC,CAAC;QACtH,OAAO,EAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzW,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpG,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC,CAAC,uBAAuB,OAAO,gCAAgC,CAAC;QACnO,OAAO,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAC,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAC,EAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC"}

package/dist/sandbox/broker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/broker.js

@@ -0,0 +1,135 @@
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { StringDecoder } from 'node:string_decoder';
+import { randomUUID } from 'node:crypto';
+import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
+import { GuardError, validateWorkerFrame } from '../contracts.js';
+import { shellQuote, workloadEnvironment } from './config.js';
+let workload, isExecuting = false;
+const cancellation = new AbortController();
+const networkRequests = new Map();
+cancellation.signal.addEventListener('abort', () => { for (const resolve of networkRequests.values())
+    resolve(false); networkRequests.clear(); });
+const send = (frame) => { if (process.connected)
+    process.send?.(frame); };
+function killGroup(signal) {
+    if (!workload?.pid)
+        return;
+    try {
+        process.kill(-workload.pid, signal);
+    }
+    catch (error) {
+        if (error.code !== 'ESRCH')
+            throw error;
+    }
+}
+process.on('disconnect', () => { cancellation.abort(); killGroup('SIGKILL'); void SandboxManager.reset().finally(() => process.exit(1)); });
+process.on('message', raw => {
+    const message = raw;
+    if (message?.type === 'network-response') {
+        const response = raw;
+        if (response.schemaVersion !== 1 || typeof response.requestId !== 'string' || typeof response.isAllowed !== 'boolean') {
+            cancellation.abort();
+            killGroup('SIGKILL');
+            return;
+        }
+        networkRequests.get(response.requestId)?.(response.isAllowed && !cancellation.signal.aborted);
+        networkRequests.delete(response.requestId);
+        return;
+    }
+    if (message?.type === 'cancel') {
+        cancellation.abort();
+        killGroup('SIGTERM');
+        setTimeout(() => killGroup('SIGKILL'), 300).unref();
+        return;
+    }
+    if (message?.type !== 'execute' || isExecuting) {
+        send({ schemaVersion: 1, type: 'error', code: 'INVALID_IPC', message: 'Invalid broker request' });
+        process.exitCode = 1;
+        return;
+    }
+    isExecuting = true;
+    void run(message).catch(error => send({ schemaVersion: 1, type: 'error', code: error.code ?? 'BACKEND_FAILED', message: error.message })).finally(async () => {
+        killGroup('SIGKILL');
+        await SandboxManager.reset();
+        // Wait for IPC delivery before dropping the controller channel.
+        process.disconnect();
+    });
+});
+async function run({ commandId, config, job }) {
+    if (!job || !['shell', 'tool', 'file'].includes(job.kind) || typeof job.cwd !== 'string')
+        throw new GuardError('INVALID_IPC', 'Invalid workload');
+    await SandboxManager.initialize(config, config.network.strictAllowlist === false ? async (destination) => {
+        if (cancellation.signal.aborted || !process.connected || networkRequests.size >= 32)
+            return false;
+        const requestId = randomUUID();
+        return new Promise(resolve => {
+            networkRequests.set(requestId, resolve);
+            process.send?.({ schemaVersion: 1, type: 'network-request', requestId, destination });
+        });
+    } : undefined, false);
+    cancellation.signal.throwIfAborted();
+    if (!SandboxManager.isSandboxingEnabled() || !await SandboxManager.waitForNetworkInitialization())
+        throw new GuardError('BACKEND_UNAVAILABLE', 'Native filesystem/network sandbox is unavailable');
+    if (process.platform === 'linux') {
+        // SRT emits bridge mounts before filesystem masks. Restore only this
+        // invocation's proxy sockets when a restrictive read profile masks /tmp.
+        const sockets = [SandboxManager.getLinuxHttpSocketPath(), SandboxManager.getLinuxSocksSocketPath()].filter((path) => !!path);
+        SandboxManager.updateConfig({ ...config, filesystem: { ...config.filesystem, allowRead: [...(config.filesystem.allowRead ?? []), ...sockets] } });
+    }
+    const command = `${shellQuote(process.execPath)} ${shellQuote(fileURLToPath(new URL('./worker.js', import.meta.url)))}`;
+    const wrapped = await SandboxManager.wrapWithSandboxArgv(command, '/bin/bash', undefined, cancellation.signal, job.cwd, { commandId });
+    cancellation.signal.throwIfAborted();
+    if (!wrapped.argv.length || !wrapped.argv.some(arg => arg.includes('sandbox-exec') || arg.includes('bwrap')))
+        throw new GuardError('BACKEND_UNAVAILABLE', 'Runtime did not return a native isolation command');
+    await new Promise((resolve, reject) => {
+        let buffer = '', stderr = '', hasTerminal = false, parseError;
+        const decoder = new StringDecoder('utf8');
+        workload = spawn(wrapped.argv[0], wrapped.argv.slice(1), { cwd: job.cwd, detached: true, env: { ...workloadEnvironment(job.kind === 'shell' ? job.env : {}), ...wrapped.env }, stdio: ['pipe', 'pipe', 'pipe'] });
+        if (workload.pid && process.connected)
+            process.send?.({ schemaVersion: 1, type: 'workload-started', processGroupId: workload.pid });
+        workload.on('error', reject);
+        workload.stderr?.on('data', data => { stderr = (stderr + data.toString()).slice(-8192); });
+        workload.stdout?.on('data', chunk => {
+            buffer += decoder.write(chunk);
+            if (Buffer.byteLength(buffer, 'utf8') > 32 * 1024 * 1024) {
+                parseError = new GuardError('INVALID_IPC', 'Worker frame exceeds size limit');
+                killGroup('SIGKILL');
+                return;
+            }
+            for (;;) {
+                const end = buffer.indexOf('\n');
+                if (end < 0)
+                    break;
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                try {
+                    if (hasTerminal)
+                        throw new GuardError('INVALID_IPC', 'Duplicate terminal frame');
+                    const frame = validateWorkerFrame(JSON.parse(line));
+                    if (frame.type === 'result' || frame.type === 'error')
+                        hasTerminal = true;
+                    send(frame);
+                }
+                catch (error) {
+                    parseError = error;
+                    killGroup('SIGKILL');
+                }
+            }
+        });
+        workload.once('close', (code) => {
+            buffer += decoder.end();
+            if (parseError)
+                reject(parseError);
+            else if (cancellation.signal.aborted)
+                reject(new GuardError('CANCELLED', 'Workload cancelled'));
+            else if (!hasTerminal || buffer.trim())
+                reject(new GuardError(/sandbox_init|Operation not permitted|bwrap:/.test(stderr) ? 'ENVIRONMENT_BLOCKED' : 'WORKER_FAILED', `Native worker failed (${code}): ${stderr || 'missing IPC result'}`));
+            else
+                resolve();
+        });
+        workload.stdin?.on('error', () => { });
+        workload.stdin?.end(JSON.stringify(job) + '\n');
+    });
+}
+//# sourceMappingURL=broker.js.map

package/dist/sandbox/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/sandbox/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAA6B,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAoC,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE9D,IAAI,QAAkC,EAAE,WAAW,GAAG,KAAK,CAAC;AAC5D,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsC,CAAC;AACtE,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClJ,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,SAAS;IAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,SAAS,SAAS,CAAC,MAAsB;IACvC,IAAI,CAAC,QAAQ,EAAE,GAAG;QAAE,OAAO;IAC3B,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;AACpI,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5I,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;IAC1B,MAAM,OAAO,GAAG,GAAwF,CAAC;IACzG,IAAI,OAAO,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAwE,CAAC;QAC1F,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9K,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9F,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAC5I,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACpL,WAAW,GAAG,IAAI,CAAC;IACnB,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAG,KAAoB,CAAC,IAAI,IAAI,gBAAgB,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACtL,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;QAC7B,gEAAgE;QAChE,OAAO,CAAC,UAAU,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,KAAK,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAuE;IAChH,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAClJ,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;QACrG,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAClG,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,OAAO,CAAU,OAAO,CAAC,EAAE;YACpC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,SAAS,EAAC,WAAW,EAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtB,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,cAAc,CAAC,4BAA4B,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;IACnM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,sBAAsB,EAAE,EAAE,cAAc,CAAC,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7I,cAAc,CAAC,YAAY,CAAC,EAAC,GAAG,MAAM,EAAE,UAAU,EAAE,EAAC,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,EAAC,EAAC,CAAC,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvI,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;IAC/M,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,WAAW,GAAG,KAAK,EAAE,UAA6B,CAAC;QACjF,MAAM,OAAO,GAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnN,IAAG,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS;YAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,IAAI,EAAC,kBAAkB,EAAC,cAAc,EAAC,QAAQ,CAAC,GAAG,EAAC,CAAC,CAAC;QAC3H,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAClC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAAC,UAAU,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;gBAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzK,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,GAAG,GAAG,CAAC;oBAAE,MAAM;gBACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,IAAI,WAAW;wBAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;oBACjF,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACpD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;wBAAE,WAAW,GAAG,IAAI,CAAC;oBAC1E,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,UAAU,GAAG,KAAc,CAAC;oBAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;YACxE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,CAAC,CAAC;iBAC9B,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC;iBAC3F,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE;gBAAE,MAAM,CAAC,IAAI,UAAU,CAAC,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,EAAE,yBAAyB,IAAI,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;;gBACrO,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox/config.d.ts

@@ -0,0 +1,5 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import { type PermissionDelta, type PermissionProfile, type ExecutionAuthority } from '../contracts.js';
+export declare function shellQuote(text: string): string;
+export declare function workloadEnvironment(caller?: NodeJS.ProcessEnv, ambient?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function nativeConfig(profile: PermissionProfile, delta: PermissionDelta, cwd: string, authority?: ExecutionAuthority): Promise<SandboxRuntimeConfig>;

package/dist/sandbox/config.js

@@ -0,0 +1,91 @@
+import { realpath } from 'node:fs/promises';
+import { basename, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { GuardError, createProfile } from '../contracts.js';
+import { canonicalPath, isWithin } from '../policy/paths.js';
+import { matchesDomain, isNetworkHost, normalizeHost } from '../policy/domains.js';
+import { linuxReadPaths } from './linux-read-paths.js';
+import { runtimeWritePaths } from './runtime-write-paths.js';
+import { seccompRuntime } from './seccomp.js';
+import { assertLiteralNativePaths } from './paths.js';
+export function shellQuote(text) { return `'${text.replace(/'/g, "'\\''")}'`; }
+const AMBIENT_ENV = new Set(['PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TZ', 'TERM']);
+const FORBIDDEN_ENV = /(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API_KEY|AUTH|^AWS_|^AZURE_|^GOOGLE_|^OPENAI_|^ANTHROPIC_|^CODEX_|^SSH_|^GIT_CONFIG|^NODE_|^BASH_ENV$|^ENV$|^DYLD_|^LD_|^JAVA_TOOL_OPTIONS$|^JDK_JAVA_OPTIONS$|^PYTHONPATH$|^PYTHONSTARTUP$|^RUBYOPT$|^PERL5OPT$|PROXY|^NO_PROXY$)/i;
+export function workloadEnvironment(caller = {}, ambient = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(ambient))
+        if (AMBIENT_ENV.has(key) && value !== undefined)
+            env[key] = value;
+    for (const [key, value] of Object.entries(caller)) {
+        if (!FORBIDDEN_ENV.test(key) && !['HOME', 'TMPDIR', 'TMP', 'TEMP', 'NODE_CHANNEL_FD', 'NODE_CHANNEL_SERIALIZATION_MODE', 'PI_GUARD_KERNEL_ARCH'].includes(key) && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key) && typeof value === 'string' && !value.includes('\0'))
+            env[key] = value;
+    }
+    return env;
+}
+export async function nativeConfig(profile, delta, cwd, authority) {
+    createProfile(profile);
+    const resolved = { ...profile };
+    for (const key of ['readRoots', 'writeRoots', 'denyRead', 'denyWrite'])
+        resolved[key] = await Promise.all(profile[key].map(path => canonicalPath(path, cwd)));
+    profile = createProfile(resolved);
+    if (profile.readRoots.some(path => profile.denyRead.some(root => isWithin(path, root))) || profile.writeRoots.some(path => [...profile.denyRead, ...profile.denyWrite].some(root => isWithin(path, root))))
+        throw new GuardError('HARD_DENY', 'An explicit permission root conflicts with an absolute deny');
+    for (const key of ['readPaths', 'writePaths', 'domains'])
+        if (!Array.isArray(delta[key]) || delta[key].some(x => typeof x !== 'string'))
+            throw new GuardError('INVALID_DELTA', 'Invalid permission delta');
+    const reads = await Promise.all(delta.readPaths.map(path => canonicalPath(path, cwd)));
+    const writes = await Promise.all(delta.writePaths.map(path => canonicalPath(path, cwd)));
+    assertLiteralNativePaths([cwd, ...profile.readRoots, ...profile.writeRoots, ...profile.denyRead, ...profile.denyWrite, ...(profile.readOnlyPaths ?? []), ...reads, ...writes]);
+    if (reads.some(path => profile.denyRead.some(root => isWithin(path, root))) || writes.some(path => [...profile.denyRead, ...profile.denyWrite].some(root => isWithin(path, root))))
+        throw new GuardError('HARD_DENY', 'Permission delta targets a protected path');
+    if (delta.domains.some(domain => !isNetworkHost(domain) || profile.deniedDomains.some(pattern => matchesDomain(domain, pattern))))
+        throw new GuardError('HARD_DENY', 'Invalid or denied network domain');
+    const isCommandAuthority = authority?.kind === 'command-rule' || authority?.kind === 'reviewed-command';
+    const baseProtected = await Promise.all((profile.readOnlyPaths ?? []).map(path => canonicalPath(path, cwd)));
+    const lifted = baseProtected.filter(root => writes.some(path => isWithin(path, root)));
+    // Removing a base metadata deny must not expose its siblings through the original workspace root.
+    const writeRoots = isCommandAuthority ? ['/'] : lifted.length ? writes : [...profile.writeRoots, ...writes];
+    const unapprovedDefaults = (await runtimeWritePaths(cwd)).filter(root => !writeRoots.some(path => isWithin(root, path)));
+    if (unapprovedDefaults.some(root => writeRoots.some(path => isWithin(path, root))))
+        throw new GuardError('NATIVE_SCOPE_UNSUPPORTED', 'A nested runtime default write path requires its enclosing directory in the reviewed native scope');
+    const packageRoot = fileURLToPath(new URL('../../', import.meta.url));
+    const nodeRoot = resolve(dirname(await realpath(process.execPath)), '..');
+    const dependencyRoots = [];
+    for (const name of ['@earendil-works/pi-coding-agent', '@anthropic-ai/sandbox-runtime']) {
+        let current = dirname(await realpath(fileURLToPath(import.meta.resolve(name))));
+        let root = current;
+        while (dirname(current) !== current) {
+            if (basename(current) === 'node_modules' || basename(current) === '.pnpm')
+                root = current;
+            current = dirname(current);
+        }
+        dependencyRoots.push(root);
+    }
+    const systemRead = ['/usr', '/bin', '/sbin', '/System', '/Library', '/opt/homebrew', '/private/etc', '/etc', '/dev', '/proc', '/sys', nodeRoot, packageRoot, ...dependencyRoots];
+    const seccomp = seccompRuntime();
+    const config = {
+        ...(seccomp ? { seccomp: { applyPath: seccomp.applyPath } } : {}),
+        filesystem: {
+            // All user data starts unreadable; runtime/assets and the admitted roots are carve-outs.
+            denyRead: ['/', ...profile.denyRead],
+            allowRead: await linuxReadPaths([...systemRead, ...(isCommandAuthority ? ['/'] : profile.readRoots), ...reads, ...writes], writeRoots),
+            allowWrite: writeRoots,
+            denyWrite: [...profile.denyWrite, ...profile.denyRead, ...unapprovedDefaults, ...(isCommandAuthority ? [] : baseProtected.filter(root => !lifted.includes(root))), ...dependencyRoots, resolve(packageRoot, 'dist'), resolve(packageRoot, 'node_modules'), resolve(packageRoot, 'package.json'), resolve(packageRoot, 'package-lock.json')],
+            allowGitConfig: isCommandAuthority || writes.some(path => /[/\\]\.git(?:[/\\]config)?$/.test(path)),
+        },
+        network: { allowedDomains: isCommandAuthority ? ['*'] : [...profile.allowedDomains, ...delta.domains.map(normalizeHost)], deniedDomains: [...profile.deniedDomains], strictAllowlist: true, allowAllUnixSockets: false, allowLocalBinding: false },
+        credentials: { files: profile.denyRead.map(path => ({ path, mode: 'deny' })) },
+        enableWeakerNestedSandbox: false,
+        enableWeakerNetworkIsolation: false,
+        allowAppleEvents: false,
+    };
+    if (process.platform === 'linux') {
+        // A missing leaf becomes /dev/null in SRT, unreadable on a nodev mount.
+        // A child deny selects its read-only directory placeholder instead. The
+        // parent deny remains; existing worktree .git files are handled by SRT.
+        config.filesystem.denyWrite.push(...config.filesystem.denyWrite.filter(path => basename(path) === '.git' && !profile.denyRead.some(root => isWithin(path, root))).map(path => resolve(path, 'HEAD')));
+    }
+    assertLiteralNativePaths([...config.filesystem.denyRead, ...(config.filesystem.allowRead ?? []), ...config.filesystem.allowWrite, ...config.filesystem.denyWrite]);
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/sandbox/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/sandbox/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAyE,MAAM,iBAAiB,CAAC;AACnI,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,UAAU,UAAU,CAAC,IAAY,IAAY,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClF,MAAM,aAAa,GAAG,wQAAwQ,CAAC;AAC/R,MAAM,UAAU,mBAAmB,CAAC,SAA4B,EAAE,EAAE,UAA6B,OAAO,CAAC,GAAG;IAC1G,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,KAAsB,EAAE,GAAW,EAAE,SAA8B;IAChI,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,EAAC,GAAG,OAAO,EAAC,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAC,YAAY,EAAC,UAAU,EAAC,WAAW,CAAU;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpK,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6DAA6D,CAAC,CAAC;IAC5S,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAU;QAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACpN,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,wBAAwB,CAAC,CAAC,GAAG,EAAC,GAAG,OAAO,CAAC,SAAS,EAAC,GAAG,OAAO,CAAC,UAAU,EAAC,GAAG,OAAO,CAAC,QAAQ,EAAC,GAAG,OAAO,CAAC,SAAS,EAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAC,GAAG,KAAK,EAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IACxK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IACnQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IACzM,MAAM,kBAAkB,GAAG,SAAS,EAAE,IAAI,KAAK,cAAc,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,CAAC;IACxG,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,kGAAkG;IAClG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;IAC5G,MAAM,kBAAkB,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzH,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,mGAAmG,CAAC,CAAC;IAC1O,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,EAAE,CAAC;QACxF,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO;gBAAE,IAAI,GAAG,OAAO,CAAC;YAC1F,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC;IACjL,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAyB;QACnC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,UAAU,EAAE;YACV,yFAAyF;YACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,MAAM,cAAc,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,EAAE,UAAU,CAAC;YACtI,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;YAC3U,cAAc,EAAE,kBAAkB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACpG;QACD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE;QAClP,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,EAAE;QACvF,yBAAyB,EAAE,KAAK;QAChC,4BAA4B,EAAE,KAAK;QACnC,gBAAgB,EAAE,KAAK;KACxB,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxM,CAAC;IACD,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,EAAC,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAC,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAChK,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sandbox/executor.d.ts

@@ -0,0 +1,20 @@
+import { type ExecutionOptions, type Json, type PermissionDelta, type PermissionProfile, type WorkerJob } from '../contracts.js';
+export interface SandboxExecutor {
+    execute(job: WorkerJob, profile: PermissionProfile, delta: PermissionDelta, options?: ExecutionOptions): Promise<Json>;
+    qualify(profile: PermissionProfile, cwd: string): Promise<void>;
+    close(): Promise<void>;
+}
+export declare class NativeExecutor implements SandboxExecutor {
+    private readonly transport?;
+    private active;
+    private stop;
+    get activeInvocationCount(): number;
+    /** Trusted broker transport, e.g. an enterprise proxy. Never sourced from tool arguments. */
+    constructor(transport?: {
+        socketPath: string;
+        domains: readonly string[];
+    } | undefined);
+    qualify(profile: PermissionProfile, cwd: string): Promise<void>;
+    execute(job: WorkerJob, profile: PermissionProfile, delta?: PermissionDelta, options?: ExecutionOptions): Promise<Json>;
+    close(): Promise<void>;
+}

package/dist/sandbox/executor.js

@@ -0,0 +1,144 @@
+import { fork } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { realpath } from 'node:fs/promises';
+import { GuardError, EMPTY_DELTA, validateWorkerFrame } from '../contracts.js';
+import { nativeConfig, workloadEnvironment } from './config.js';
+import { assertHardLinkBoundaries } from './hard-links.js';
+import { withSignal } from '../signals.js';
+import { matchesDomain, isNetworkHost, normalizeHost } from '../policy/domains.js';
+export class NativeExecutor {
+    transport;
+    active = new Set();
+    stop = new AbortController();
+    get activeInvocationCount() { return this.active.size; }
+    /** Trusted broker transport, e.g. an enterprise proxy. Never sourced from tool arguments. */
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async qualify(profile, cwd) {
+        const data = [];
+        try {
+            const result = await this.execute({ kind: 'shell', command: "printf 'pi-guard-native-ready'", cwd }, profile, EMPTY_DELTA, { timeoutSeconds: 15, onData: chunk => data.push(chunk) });
+            if (result.exitCode !== 0 || Buffer.concat(data).toString() !== 'pi-guard-native-ready')
+                throw new GuardError('ENVIRONMENT_BLOCKED', 'Native permitted-launch control did not succeed');
+        }
+        catch (error) {
+            throw new GuardError('ENVIRONMENT_BLOCKED', `ENVIRONMENT_BLOCKED: native qualification failed: ${error.message}`, { cause: error });
+        }
+    }
+    async execute(job, profile, delta = EMPTY_DELTA, options = {}) {
+        if (!['darwin', 'linux'].includes(process.platform))
+            throw new GuardError('UNSUPPORTED_PLATFORM', 'Native isolation supports only Darwin and Linux');
+        const lifetime = new AbortController();
+        const signal = AbortSignal.any([lifetime.signal, this.stop.signal, ...(options.signal ? [options.signal] : [])]);
+        signal.throwIfAborted();
+        const config = await nativeConfig(profile, delta, job.cwd, options.authority);
+        await assertHardLinkBoundaries(profile, delta, config, signal);
+        if (options.onNetworkRequest)
+            config.network.strictAllowlist = false;
+        if (this.transport)
+            config.network.mitmProxy = { socketPath: await realpath(this.transport.socketPath), domains: [...this.transport.domains] };
+        const timeoutSeconds = options.timeoutSeconds ?? (job.kind === 'shell' ? job.timeoutSeconds : undefined) ?? 120;
+        if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0)
+            throw new GuardError('INVALID_TIMEOUT', 'Execution timeout must be positive seconds');
+        signal.throwIfAborted();
+        const child = fork(fileURLToPath(new URL('./broker.js', import.meta.url)), [], {
+            execArgv: [], serialization: 'json', env: workloadEnvironment(), stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+        });
+        // Broker owns the workload process group and is never itself a workload child.
+        const seenNetworkRequests = new Set();
+        const task = new Promise((resolve, reject) => {
+            let terminal, error, stderr = '', isTerminal = false, forceTimer, processGroupId;
+            const killOwnedGroup = () => { if (processGroupId)
+                try {
+                    process.kill(-processGroupId, 'SIGKILL');
+                }
+                catch (cause) {
+                    if (cause.code !== 'ESRCH')
+                        error ??= cause;
+                } };
+            const terminate = (cause) => {
+                error ??= cause;
+                if (child.connected)
+                    child.send({ type: 'cancel' });
+                forceTimer ??= setTimeout(() => { killOwnedGroup(); child.kill('SIGKILL'); }, 4000);
+            };
+            const onAbort = () => terminate(new GuardError('CANCELLED', 'Native execution cancelled'));
+            signal.addEventListener('abort', onAbort, { once: true });
+            if (signal.aborted)
+                onAbort();
+            const deadline = setTimeout(() => terminate(new GuardError('TIMEOUT', `Native execution exceeded ${timeoutSeconds} seconds`)), timeoutSeconds * 1000);
+            child.stderr?.on('data', chunk => { stderr = (stderr + chunk.toString()).slice(-8192); });
+            child.on('error', cause => { error ??= cause; });
+            child.on('message', raw => {
+                try {
+                    const control = raw;
+                    if (control.type === 'network-request') {
+                        const requestId = control.requestId, destination = control.destination;
+                        if (control.schemaVersion !== 1 || !requestId || seenNetworkRequests.has(requestId) || !destination || typeof destination.host !== 'string' || !isNetworkHost(destination.host) || destination.port !== undefined && (!Number.isInteger(destination.port) || destination.port < 1 || destination.port > 65535) || isTerminal)
+                            throw new GuardError('INVALID_IPC', 'Invalid network approval request');
+                        seenNetworkRequests.add(requestId);
+                        const request = { host: normalizeHost(destination.host), ...(destination.port !== undefined ? { port: destination.port } : {}) };
+                        const pending = signal.aborted || profile.deniedDomains.some(pattern => matchesDomain(request.host, pattern)) || !options.onNetworkRequest
+                            ? Promise.resolve(false) : withSignal(options.onNetworkRequest(request, signal), signal);
+                        void pending.catch(() => false).then(isAllowed => { if (child.connected)
+                            child.send({ schemaVersion: 1, type: 'network-response', requestId, isAllowed: isAllowed === true && !signal.aborted }); });
+                        return;
+                    }
+                    if (control.type === 'workload-started') {
+                        if (control.schemaVersion !== 1 || !Number.isInteger(control.processGroupId) || control.processGroupId <= 1 || processGroupId || isTerminal)
+                            throw new GuardError('INVALID_IPC', 'Invalid broker process group');
+                        processGroupId = control.processGroupId;
+                        if (error || signal.aborted)
+                            killOwnedGroup();
+                        return;
+                    }
+                    const frame = validateWorkerFrame(raw);
+                    if (isTerminal)
+                        throw new GuardError('INVALID_IPC', 'Worker emitted data after its terminal frame');
+                    if (frame.type === 'data')
+                        options.onData?.(Buffer.from(frame.data, 'base64'));
+                    if (frame.type === 'update')
+                        options.onUpdate?.(frame.result);
+                    if (frame.type === 'result') {
+                        terminal = frame.result;
+                        isTerminal = true;
+                    }
+                    if (frame.type === 'error') {
+                        error ??= new GuardError(frame.code, frame.message);
+                        isTerminal = true;
+                    }
+                }
+                catch (cause) {
+                    terminate(cause);
+                }
+            });
+            child.once('close', () => {
+                if (!isTerminal)
+                    killOwnedGroup();
+                clearTimeout(deadline);
+                if (forceTimer)
+                    clearTimeout(forceTimer);
+                signal.removeEventListener('abort', onAbort);
+                lifetime.abort();
+                if (error)
+                    reject(error);
+                else if (!isTerminal)
+                    reject(new GuardError('WORKER_FAILED', `Worker closed without a result${stderr ? `: ${stderr}` : ''}`));
+                else
+                    resolve(terminal);
+            });
+            child.send({ type: 'execute', commandId: randomUUID(), config, job: { ...job, ...(job.kind === 'shell' ? { env: workloadEnvironment(options.env ?? job.env), timeoutSeconds } : {}) } });
+        });
+        this.active.add(task);
+        try {
+            return await task;
+        }
+        finally {
+            this.active.delete(task);
+        }
+    }
+    async close() { this.stop.abort(); await Promise.allSettled([...this.active]); }
+}
+//# sourceMappingURL=executor.js.map

package/dist/sandbox/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/sandbox/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAkG,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/K,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOnF,MAAM,OAAO,cAAc;IAKI;IAJrB,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IACrC,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,qBAAqB,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6FAA6F;IAC7F,YAA6B,SAA8D;QAA9D,cAAS,GAAT,SAAS,CAAqD;IAAG,CAAC;IAC/F,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,GAAW;QACnD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtL,IAAK,MAA6B,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,uBAAuB;gBAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC;QAClN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,qDAAsD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IACrK,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,GAAc,EAAE,OAA0B,EAAE,QAAyB,WAAW,EAAE,UAA4B,EAAE;QAC5H,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,iDAAiD,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,gBAAgB;YAAE,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;QACrE,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/I,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;QAChH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QACnJ,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7E,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC;SAC5G,CAAC,CAAC;QACH,+EAA+E;QAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,QAA0B,EAAE,KAAwB,EAAE,MAAM,GAAG,EAAE,EAAE,UAAU,GAAG,KAAK,EAAE,UAAsC,EAAE,cAAkC,CAAC;YACtK,MAAM,cAAc,GAAG,GAAG,EAAE,GAAG,IAAG,cAAc;gBAAC,IAAG,CAAC;oBAAA,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAC,SAAS,CAAC,CAAC;gBAAA,CAAC;gBAAA,OAAM,KAAK,EAAC,CAAC;oBAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,OAAO;wBAAC,KAAK,KAAG,KAAc,CAAC;gBAAA,CAAC,CAAC,CAAC,CAAC;YACzL,MAAM,SAAS,GAAG,CAAC,KAAY,EAAE,EAAE;gBACjC,KAAK,KAAK,KAAK,CAAC;gBAChB,IAAI,KAAK,CAAC,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,UAAU,KAAK,UAAU,CAAC,GAAG,EAAE,GAAE,cAAc,EAAE,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,EAAE,IAAI,CAAC,CAAC;YACnF,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;YAC3F,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,6BAA6B,cAAc,UAAU,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;YACtJ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACxB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAC,GAA6H,CAAC;oBAC5I,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBACvC,MAAM,SAAS,GAAC,OAAO,CAAC,SAAS,EAAE,WAAW,GAAC,OAAO,CAAC,WAAW,CAAC;wBACnE,IAAI,OAAO,CAAC,aAAa,KAAG,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,KAAG,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,IAAE,WAAW,CAAC,IAAI,GAAC,CAAC,IAAE,WAAW,CAAC,IAAI,GAAC,KAAK,CAAC,IAAI,UAAU;4BAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAC,kCAAkC,CAAC,CAAC;wBACzX,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;wBACnC,MAAM,OAAO,GAAC,EAAC,IAAI,EAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,EAAC,IAAI,EAAC,WAAW,CAAC,IAAI,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC;wBAClH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAA,EAAE,CAAA,aAAa,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;4BACrI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAC,MAAM,CAAC,EAAC,MAAM,CAAC,CAAC;wBACzF,KAAK,OAAO,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA,EAAE,GAAC,IAAG,KAAK,CAAC,SAAS;4BAAC,KAAK,CAAC,IAAI,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,SAAS,EAAC,SAAS,KAAG,IAAI,IAAE,CAAC,MAAM,CAAC,OAAO,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;wBACjL,OAAO;oBACT,CAAC;oBACD,IAAG,OAAO,CAAC,IAAI,KAAG,kBAAkB,EAAC,CAAC;wBACpC,IAAG,OAAO,CAAC,aAAa,KAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAe,IAAI,CAAC,IAAI,cAAc,IAAI,UAAU;4BAAC,MAAM,IAAI,UAAU,CAAC,aAAa,EAAC,8BAA8B,CAAC,CAAC;wBAC7M,cAAc,GAAC,OAAO,CAAC,cAAc,CAAC;wBACtC,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO;4BAAE,cAAc,EAAE,CAAC;wBAC9C,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,UAAU;wBAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;oBACpG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;wBAAE,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;wBAAC,UAAU,GAAG,IAAI,CAAC;oBAAC,CAAC;oBAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAAC,KAAK,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;wBAAC,UAAU,GAAG,IAAI,CAAC;oBAAC,CAAC;gBACzG,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,SAAS,CAAC,KAAc,CAAC,CAAC;gBAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,IAAG,CAAC,UAAU;oBAAC,cAAc,EAAE,CAAC;gBAChC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAAC,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC/G,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBACpB,IAAI,CAAC,UAAU;oBAAE,MAAM,CAAC,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;;oBACzH,OAAO,CAAC,QAAS,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3L,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAClE,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CAChG"}

package/dist/sandbox/hard-links.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import { type PermissionProfile, type PermissionDelta } from '../contracts.js';
+/** Path-based OS sandboxes cannot distinguish names of an inode linked before launch. */
+export declare function assertHardLinkBoundaries(profile: PermissionProfile, delta: PermissionDelta, config: SandboxRuntimeConfig, signal: AbortSignal): Promise<void>;