shellx-cli 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/LICENSE +202 -0
  2. package/README.md +310 -0
  3. package/bundle/assets/shellx-linux-x86_64-1.1.9.zip +0 -0
  4. package/bundle/assets/shellx-macos-aarch64-1.1.9.zip +0 -0
  5. package/bundle/assets/shellx-macos-x86_64-1.1.9.zip +0 -0
  6. package/bundle/assets/shellx-win-x64-1.1.9.zip +0 -0
  7. package/bundle/assets/shellx-win-x86-1.1.9.zip +0 -0
  8. package/bundle/assets/shellx.apk +0 -0
  9. package/bundle/sandbox-macos-permissive-closed.sb +32 -0
  10. package/bundle/sandbox-macos-permissive-open.sb +25 -0
  11. package/bundle/sandbox-macos-permissive-proxied.sb +37 -0
  12. package/bundle/sandbox-macos-restrictive-closed.sb +93 -0
  13. package/bundle/sandbox-macos-restrictive-open.sb +96 -0
  14. package/bundle/sandbox-macos-restrictive-proxied.sb +98 -0
  15. package/bundle/shellx.js +340613 -0
  16. package/package.json +108 -0
package/bundle/sandbox-macos-restrictive-closed.sb ADDED
@@ -0,0 +1,93 @@
1
+ (version 1)
2
+
3
+ ;; deny everything by default
4
+ (deny default)
5
+
6
+ ;; allow reading files from anywhere on host
7
+ (allow file-read*)
8
+
9
+ ;; allow exec/fork (children inherit policy)
10
+ (allow process-exec)
11
+ (allow process-fork)
12
+
13
+ ;; allow signals to self, e.g. SIGPIPE on write to closed pipe
14
+ (allow signal (target self))
15
+
16
+ ;; allow read access to specific information about system
17
+ ;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
18
+ (allow sysctl-read
19
+ (sysctl-name "hw.activecpu")
20
+ (sysctl-name "hw.busfrequency_compat")
21
+ (sysctl-name "hw.byteorder")
22
+ (sysctl-name "hw.cacheconfig")
23
+ (sysctl-name "hw.cachelinesize_compat")
24
+ (sysctl-name "hw.cpufamily")
25
+ (sysctl-name "hw.cpufrequency_compat")
26
+ (sysctl-name "hw.cputype")
27
+ (sysctl-name "hw.l1dcachesize_compat")
28
+ (sysctl-name "hw.l1icachesize_compat")
29
+ (sysctl-name "hw.l2cachesize_compat")
30
+ (sysctl-name "hw.l3cachesize_compat")
31
+ (sysctl-name "hw.logicalcpu_max")
32
+ (sysctl-name "hw.machine")
33
+ (sysctl-name "hw.ncpu")
34
+ (sysctl-name "hw.nperflevels")
35
+ (sysctl-name "hw.optional.arm.FEAT_BF16")
36
+ (sysctl-name "hw.optional.arm.FEAT_DotProd")
37
+ (sysctl-name "hw.optional.arm.FEAT_FCMA")
38
+ (sysctl-name "hw.optional.arm.FEAT_FHM")
39
+ (sysctl-name "hw.optional.arm.FEAT_FP16")
40
+ (sysctl-name "hw.optional.arm.FEAT_I8MM")
41
+ (sysctl-name "hw.optional.arm.FEAT_JSCVT")
42
+ (sysctl-name "hw.optional.arm.FEAT_LSE")
43
+ (sysctl-name "hw.optional.arm.FEAT_RDM")
44
+ (sysctl-name "hw.optional.arm.FEAT_SHA512")
45
+ (sysctl-name "hw.optional.armv8_2_sha512")
46
+ (sysctl-name "hw.packages")
47
+ (sysctl-name "hw.pagesize_compat")
48
+ (sysctl-name "hw.physicalcpu_max")
49
+ (sysctl-name "hw.tbfrequency_compat")
50
+ (sysctl-name "hw.vectorunit")
51
+ (sysctl-name "kern.hostname")
52
+ (sysctl-name "kern.maxfilesperproc")
53
+ (sysctl-name "kern.osproductversion")
54
+ (sysctl-name "kern.osrelease")
55
+ (sysctl-name "kern.ostype")
56
+ (sysctl-name "kern.osvariant_status")
57
+ (sysctl-name "kern.osversion")
58
+ (sysctl-name "kern.secure_kernel")
59
+ (sysctl-name "kern.usrstack64")
60
+ (sysctl-name "kern.version")
61
+ (sysctl-name "sysctl.proc_cputype")
62
+ (sysctl-name-prefix "hw.perflevel")
63
+ )
64
+
65
+ ;; allow writes to specific paths
66
+ (allow file-write*
67
+ (subpath (param "TARGET_DIR"))
68
+ (subpath (param "TMP_DIR"))
69
+ (subpath (param "CACHE_DIR"))
70
+ (subpath (string-append (param "HOME_DIR") "/.gemini"))
71
+ (subpath (string-append (param "HOME_DIR") "/.npm"))
72
+ (subpath (string-append (param "HOME_DIR") "/.cache"))
73
+ (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
74
+ ;; Allow writes to included directories from --include-directories
75
+ (subpath (param "INCLUDE_DIR_0"))
76
+ (subpath (param "INCLUDE_DIR_1"))
77
+ (subpath (param "INCLUDE_DIR_2"))
78
+ (subpath (param "INCLUDE_DIR_3"))
79
+ (subpath (param "INCLUDE_DIR_4"))
80
+ (literal "/dev/stdout")
81
+ (literal "/dev/stderr")
82
+ (literal "/dev/null")
83
+ )
84
+
85
+ ;; allow communication with sysmond for process listing (e.g. for pgrep)
86
+ (allow mach-lookup (global-name "com.apple.sysmond"))
87
+
88
+ ;; enable terminal access required by ink
89
+ ;; fixes setRawMode EPERM failure (at node:tty:81:24)
90
+ (allow file-ioctl (regex #"^/dev/tty.*"))
91
+
92
+ ;; allow inbound network traffic on debugger port
93
+ (allow network-inbound (local ip "localhost:9229"))
package/bundle/sandbox-macos-restrictive-open.sb ADDED
@@ -0,0 +1,96 @@
1
+ (version 1)
2
+
3
+ ;; deny everything by default
4
+ (deny default)
5
+
6
+ ;; allow reading files from anywhere on host
7
+ (allow file-read*)
8
+
9
+ ;; allow exec/fork (children inherit policy)
10
+ (allow process-exec)
11
+ (allow process-fork)
12
+
13
+ ;; allow signals to self, e.g. SIGPIPE on write to closed pipe
14
+ (allow signal (target self))
15
+
16
+ ;; allow read access to specific information about system
17
+ ;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
18
+ (allow sysctl-read
19
+ (sysctl-name "hw.activecpu")
20
+ (sysctl-name "hw.busfrequency_compat")
21
+ (sysctl-name "hw.byteorder")
22
+ (sysctl-name "hw.cacheconfig")
23
+ (sysctl-name "hw.cachelinesize_compat")
24
+ (sysctl-name "hw.cpufamily")
25
+ (sysctl-name "hw.cpufrequency_compat")
26
+ (sysctl-name "hw.cputype")
27
+ (sysctl-name "hw.l1dcachesize_compat")
28
+ (sysctl-name "hw.l1icachesize_compat")
29
+ (sysctl-name "hw.l2cachesize_compat")
30
+ (sysctl-name "hw.l3cachesize_compat")
31
+ (sysctl-name "hw.logicalcpu_max")
32
+ (sysctl-name "hw.machine")
33
+ (sysctl-name "hw.ncpu")
34
+ (sysctl-name "hw.nperflevels")
35
+ (sysctl-name "hw.optional.arm.FEAT_BF16")
36
+ (sysctl-name "hw.optional.arm.FEAT_DotProd")
37
+ (sysctl-name "hw.optional.arm.FEAT_FCMA")
38
+ (sysctl-name "hw.optional.arm.FEAT_FHM")
39
+ (sysctl-name "hw.optional.arm.FEAT_FP16")
40
+ (sysctl-name "hw.optional.arm.FEAT_I8MM")
41
+ (sysctl-name "hw.optional.arm.FEAT_JSCVT")
42
+ (sysctl-name "hw.optional.arm.FEAT_LSE")
43
+ (sysctl-name "hw.optional.arm.FEAT_RDM")
44
+ (sysctl-name "hw.optional.arm.FEAT_SHA512")
45
+ (sysctl-name "hw.optional.armv8_2_sha512")
46
+ (sysctl-name "hw.packages")
47
+ (sysctl-name "hw.pagesize_compat")
48
+ (sysctl-name "hw.physicalcpu_max")
49
+ (sysctl-name "hw.tbfrequency_compat")
50
+ (sysctl-name "hw.vectorunit")
51
+ (sysctl-name "kern.hostname")
52
+ (sysctl-name "kern.maxfilesperproc")
53
+ (sysctl-name "kern.osproductversion")
54
+ (sysctl-name "kern.osrelease")
55
+ (sysctl-name "kern.ostype")
56
+ (sysctl-name "kern.osvariant_status")
57
+ (sysctl-name "kern.osversion")
58
+ (sysctl-name "kern.secure_kernel")
59
+ (sysctl-name "kern.usrstack64")
60
+ (sysctl-name "kern.version")
61
+ (sysctl-name "sysctl.proc_cputype")
62
+ (sysctl-name-prefix "hw.perflevel")
63
+ )
64
+
65
+ ;; allow writes to specific paths
66
+ (allow file-write*
67
+ (subpath (param "TARGET_DIR"))
68
+ (subpath (param "TMP_DIR"))
69
+ (subpath (param "CACHE_DIR"))
70
+ (subpath (string-append (param "HOME_DIR") "/.gemini"))
71
+ (subpath (string-append (param "HOME_DIR") "/.npm"))
72
+ (subpath (string-append (param "HOME_DIR") "/.cache"))
73
+ (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
74
+ ;; Allow writes to included directories from --include-directories
75
+ (subpath (param "INCLUDE_DIR_0"))
76
+ (subpath (param "INCLUDE_DIR_1"))
77
+ (subpath (param "INCLUDE_DIR_2"))
78
+ (subpath (param "INCLUDE_DIR_3"))
79
+ (subpath (param "INCLUDE_DIR_4"))
80
+ (literal "/dev/stdout")
81
+ (literal "/dev/stderr")
82
+ (literal "/dev/null")
83
+ )
84
+
85
+ ;; allow communication with sysmond for process listing (e.g. for pgrep)
86
+ (allow mach-lookup (global-name "com.apple.sysmond"))
87
+
88
+ ;; enable terminal access required by ink
89
+ ;; fixes setRawMode EPERM failure (at node:tty:81:24)
90
+ (allow file-ioctl (regex #"^/dev/tty.*"))
91
+
92
+ ;; allow inbound network traffic on debugger port
93
+ (allow network-inbound (local ip "localhost:9229"))
94
+
95
+ ;; allow all outbound network traffic
96
+ (allow network-outbound)
package/bundle/sandbox-macos-restrictive-proxied.sb ADDED
@@ -0,0 +1,98 @@
1
+ (version 1)
2
+
3
+ ;; deny everything by default
4
+ (deny default)
5
+
6
+ ;; allow reading files from anywhere on host
7
+ (allow file-read*)
8
+
9
+ ;; allow exec/fork (children inherit policy)
10
+ (allow process-exec)
11
+ (allow process-fork)
12
+
13
+ ;; allow signals to self, e.g. SIGPIPE on write to closed pipe
14
+ (allow signal (target self))
15
+
16
+ ;; allow read access to specific information about system
17
+ ;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
18
+ (allow sysctl-read
19
+ (sysctl-name "hw.activecpu")
20
+ (sysctl-name "hw.busfrequency_compat")
21
+ (sysctl-name "hw.byteorder")
22
+ (sysctl-name "hw.cacheconfig")
23
+ (sysctl-name "hw.cachelinesize_compat")
24
+ (sysctl-name "hw.cpufamily")
25
+ (sysctl-name "hw.cpufrequency_compat")
26
+ (sysctl-name "hw.cputype")
27
+ (sysctl-name "hw.l1dcachesize_compat")
28
+ (sysctl-name "hw.l1icachesize_compat")
29
+ (sysctl-name "hw.l2cachesize_compat")
30
+ (sysctl-name "hw.l3cachesize_compat")
31
+ (sysctl-name "hw.logicalcpu_max")
32
+ (sysctl-name "hw.machine")
33
+ (sysctl-name "hw.ncpu")
34
+ (sysctl-name "hw.nperflevels")
35
+ (sysctl-name "hw.optional.arm.FEAT_BF16")
36
+ (sysctl-name "hw.optional.arm.FEAT_DotProd")
37
+ (sysctl-name "hw.optional.arm.FEAT_FCMA")
38
+ (sysctl-name "hw.optional.arm.FEAT_FHM")
39
+ (sysctl-name "hw.optional.arm.FEAT_FP16")
40
+ (sysctl-name "hw.optional.arm.FEAT_I8MM")
41
+ (sysctl-name "hw.optional.arm.FEAT_JSCVT")
42
+ (sysctl-name "hw.optional.arm.FEAT_LSE")
43
+ (sysctl-name "hw.optional.arm.FEAT_RDM")
44
+ (sysctl-name "hw.optional.arm.FEAT_SHA512")
45
+ (sysctl-name "hw.optional.armv8_2_sha512")
46
+ (sysctl-name "hw.packages")
47
+ (sysctl-name "hw.pagesize_compat")
48
+ (sysctl-name "hw.physicalcpu_max")
49
+ (sysctl-name "hw.tbfrequency_compat")
50
+ (sysctl-name "hw.vectorunit")
51
+ (sysctl-name "kern.hostname")
52
+ (sysctl-name "kern.maxfilesperproc")
53
+ (sysctl-name "kern.osproductversion")
54
+ (sysctl-name "kern.osrelease")
55
+ (sysctl-name "kern.ostype")
56
+ (sysctl-name "kern.osvariant_status")
57
+ (sysctl-name "kern.osversion")
58
+ (sysctl-name "kern.secure_kernel")
59
+ (sysctl-name "kern.usrstack64")
60
+ (sysctl-name "kern.version")
61
+ (sysctl-name "sysctl.proc_cputype")
62
+ (sysctl-name-prefix "hw.perflevel")
63
+ )
64
+
65
+ ;; allow writes to specific paths
66
+ (allow file-write*
67
+ (subpath (param "TARGET_DIR"))
68
+ (subpath (param "TMP_DIR"))
69
+ (subpath (param "CACHE_DIR"))
70
+ (subpath (string-append (param "HOME_DIR") "/.gemini"))
71
+ (subpath (string-append (param "HOME_DIR") "/.npm"))
72
+ (subpath (string-append (param "HOME_DIR") "/.cache"))
73
+ (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
74
+ ;; Allow writes to included directories from --include-directories
75
+ (subpath (param "INCLUDE_DIR_0"))
76
+ (subpath (param "INCLUDE_DIR_1"))
77
+ (subpath (param "INCLUDE_DIR_2"))
78
+ (subpath (param "INCLUDE_DIR_3"))
79
+ (subpath (param "INCLUDE_DIR_4"))
80
+ (literal "/dev/stdout")
81
+ (literal "/dev/stderr")
82
+ (literal "/dev/null")
83
+ )
84
+
85
+ ;; allow communication with sysmond for process listing (e.g. for pgrep)
86
+ (allow mach-lookup (global-name "com.apple.sysmond"))
87
+
88
+ ;; enable terminal access required by ink
89
+ ;; fixes setRawMode EPERM failure (at node:tty:81:24)
90
+ (allow file-ioctl (regex #"^/dev/tty.*"))
91
+
92
+ ;; allow inbound network traffic on debugger port
93
+ (allow network-inbound (local ip "localhost:9229"))
94
+
95
+ ;; allow outbound network traffic through proxy on localhost:8877
96
+ ;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
97
+ ;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
98
+ (allow network-outbound (remote tcp "localhost:8877"))