shennian 0.3.86 → 0.4.0

package/dist/src/agents/config-status.js

@@ -1,226 +1 @@
-// @arch docs/features/agent-provider-config.md
-// @test src/__tests__/agent-config-status.test.ts
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { readLatestUserEnv } from '../agent-env.js';
-import { loadConfig, resolveShennianPath } from '../config/index.js';
-const MANAGED_CONFIG_PATH = resolveShennianPath('agent-provider-config.json');
-const TOKEN_SUFFIX_LENGTH = 4;
-function isConfigurableAgent(agent) {
-    return agent === 'codex' || agent === 'claude' || agent === 'pi';
-}
-const AGENT_ENV_KEYS = {
-    codex: {
-        baseUrl: ['OPENAI_BASE_URL', 'OPENAI_API_BASE', 'OPENAI_API_URL'],
-        token: ['OPENAI_API_KEY', 'OPENAI_TOKEN'],
-    },
-    claude: {
-        baseUrl: ['ANTHROPIC_BASE_URL', 'ANTHROPIC_API_URL'],
-        token: ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'],
-    },
-    pi: {
-        baseUrl: ['DASHSCOPE_BASE_URL', 'DASHSCOPE_API_BASE', 'DASHSCOPE_API_URL'],
-        token: ['DASHSCOPE_API_KEY', 'DASHSCOPE_TOKEN'],
-    },
-};
-export function getManagedAgentProviderConfig(agent) {
-    return loadManagedConfig().configs[agent];
-}
-export function upsertManagedAgentProviderConfig(input) {
-    const file = loadManagedConfig();
-    const existing = file.configs[input.agent];
-    const record = {
-        agent: input.agent,
-        baseUrl: input.baseUrl?.trim() || existing?.baseUrl,
-        token: input.token?.trim() || existing?.token,
-        updatedAt: new Date().toISOString(),
-    };
-    file.configs[input.agent] = record;
-    saveManagedConfig(file);
-    return record;
-}
-export function deleteManagedAgentProviderConfig(agent) {
-    const file = loadManagedConfig();
-    delete file.configs[agent];
-    saveManagedConfig(file);
-}
-export function buildManagedAgentEnv(agent) {
-    if (!isConfigurableAgent(agent))
-        return {};
-    const config = getManagedAgentProviderConfig(agent);
-    if (!config)
-        return {};
-    if (agent === 'codex') {
-        return compactEnv({
-            OPENAI_BASE_URL: config.baseUrl,
-            OPENAI_API_KEY: config.token,
-        });
-    }
-    if (agent === 'claude') {
-        return compactEnv({
-            ANTHROPIC_BASE_URL: config.baseUrl,
-            ANTHROPIC_API_KEY: config.token,
-        });
-    }
-    return compactEnv({
-        DASHSCOPE_BASE_URL: config.baseUrl,
-        DASHSCOPE_API_KEY: config.token,
-    });
-}
-export function getAgentConfigSummary(agent, env = readLatestUserEnv()) {
-    if (!isConfigurableAgent(agent))
-        return undefined;
-    const managed = getManagedAgentProviderConfig(agent);
-    if (managed?.token || managed?.baseUrl) {
-        return toSummary({
-            agent,
-            source: 'shennian',
-            status: managed.token ? 'managed' : 'missing',
-            baseUrl: managed.baseUrl,
-            token: managed.token,
-            tokenPresent: !!managed.token,
-        });
-    }
-    const envConfig = detectFromEnv(agent, env);
-    if (envConfig.tokenPresent || envConfig.baseUrl) {
-        return toSummary({
-            agent,
-            source: 'env',
-            status: envConfig.tokenPresent ? 'detected' : 'missing',
-            baseUrl: envConfig.baseUrl,
-            token: envConfig.token,
-            tokenPresent: envConfig.tokenPresent,
-        });
-    }
-    const fileConfig = detectFromKnownConfigFiles(agent);
-    if (fileConfig.tokenPresent || fileConfig.baseUrl) {
-        return toSummary({
-            agent,
-            source: 'config-file',
-            status: fileConfig.tokenPresent ? 'detected' : 'missing',
-            baseUrl: fileConfig.baseUrl,
-            token: fileConfig.token,
-            tokenPresent: fileConfig.tokenPresent,
-        });
-    }
-    return toSummary({
-        agent,
-        source: 'unknown',
-        status: 'missing',
-        tokenPresent: false,
-    });
-}
-function loadManagedConfig() {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(MANAGED_CONFIG_PATH, 'utf-8'));
-        return { configs: parsed.configs ?? {} };
-    }
-    catch {
-        return { configs: {} };
-    }
-}
-function saveManagedConfig(file) {
-    fs.mkdirSync(path.dirname(MANAGED_CONFIG_PATH), { recursive: true });
-    fs.writeFileSync(MANAGED_CONFIG_PATH, JSON.stringify(file, null, 2), { mode: 0o600 });
-    try {
-        fs.chmodSync(MANAGED_CONFIG_PATH, 0o600);
-    }
-    catch {
-        // Best effort on filesystems without POSIX modes.
-    }
-}
-function compactEnv(env) {
-    const compacted = {};
-    for (const [key, value] of Object.entries(env)) {
-        if (value)
-            compacted[key] = value;
-    }
-    return compacted;
-}
-function detectFromEnv(agent, env) {
-    const keys = AGENT_ENV_KEYS[agent];
-    const baseUrl = firstEnv(env, keys.baseUrl);
-    const token = firstEnv(env, keys.token);
-    return { baseUrl, token, tokenPresent: !!token };
-}
-function firstEnv(env, keys) {
-    for (const key of keys) {
-        const value = env[key]?.trim();
-        if (value)
-            return value;
-    }
-    return undefined;
-}
-function detectFromKnownConfigFiles(agent) {
-    const home = os.homedir();
-    if (agent === 'pi') {
-        const config = loadConfig();
-        const token = config.apiKeys?.dashscope?.trim();
-        if (token)
-            return { token, tokenPresent: true };
-    }
-    const candidates = agent === 'codex'
-        ? [path.join(home, '.codex', 'config.toml'), path.join(home, '.codex', 'auth.json')]
-        : agent === 'claude'
-            ? [path.join(home, '.claude', 'settings.json'), path.join(home, '.claude.json')]
-            : [path.join(home, '.dashscope', 'config.json')];
-    for (const file of candidates) {
-        const text = readSmallTextFile(file);
-        if (!text)
-            continue;
-        const token = extractTokenLikeValue(text, agent);
-        const baseUrl = extractBaseUrl(text);
-        if (token || baseUrl)
-            return { token, baseUrl, tokenPresent: !!token };
-    }
-    return { tokenPresent: false };
-}
-function readSmallTextFile(file) {
-    try {
-        const stat = fs.statSync(file);
-        if (!stat.isFile() || stat.size > 1024 * 1024)
-            return null;
-        return fs.readFileSync(file, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-}
-function extractBaseUrl(text) {
-    const match = text.match(/(?:base_url|baseURL|api_url|apiUrl|ANTHROPIC_BASE_URL|OPENAI_BASE_URL|DASHSCOPE_BASE_URL)["'\s:=]+([^"'\s,}]+)/i);
-    return match?.[1]?.trim();
-}
-function extractTokenLikeValue(text, agent) {
-    const prefix = agent === 'claude' ? 'sk-ant-' : agent === 'pi' ? 'sk-' : 'sk-';
-    const direct = text.match(new RegExp(`${prefix.replace(/-/g, '\\-')}[A-Za-z0-9_\\-]{8,}`));
-    if (direct?.[0])
-        return direct[0];
-    const keyMatch = text.match(/(?:api[_-]?key|auth[_-]?token|token|dashscope)["'\s:=]+([A-Za-z0-9_\-.]{12,})/i);
-    return keyMatch?.[1]?.trim();
-}
-function toSummary(input) {
-    return {
-        status: input.status,
-        source: input.source,
-        tokenPresent: input.tokenPresent,
-        ...(input.baseUrl ? { baseUrlHost: formatBaseUrlHost(input.baseUrl) } : {}),
-        ...(input.token ? { tokenHint: maskToken(input.token) } : {}),
-        updatedAt: new Date().toISOString(),
-    };
-}
-export function maskToken(token) {
-    const trimmed = token.trim();
-    if (!trimmed)
-        return '';
-    const suffix = trimmed.slice(-TOKEN_SUFFIX_LENGTH);
-    return `••••${suffix}`;
-}
-function formatBaseUrlHost(baseUrl) {
-    try {
-        return new URL(baseUrl).host || baseUrl;
-    }
-    catch {
-        return baseUrl.replace(/^https?:\/\//i, '').replace(/\/.*$/, '') || baseUrl;
-    }
-}
+import s from"node:fs";import m from"node:os";import i from"node:path";import{readLatestUserEnv as E}from"../agent-env.js";import{loadConfig as S,resolveShennianPath as g}from"../config/index.js";const c=g("agent-provider-config.json"),U=4;function A(e){return e==="codex"||e==="claude"||e==="pi"}const O={codex:{baseUrl:["OPENAI_BASE_URL","OPENAI_API_BASE","OPENAI_API_URL"],token:["OPENAI_API_KEY","OPENAI_TOKEN"]},claude:{baseUrl:["ANTHROPIC_BASE_URL","ANTHROPIC_API_URL"],token:["ANTHROPIC_API_KEY","ANTHROPIC_AUTH_TOKEN"]},pi:{baseUrl:["DASHSCOPE_BASE_URL","DASHSCOPE_API_BASE","DASHSCOPE_API_URL"],token:["DASHSCOPE_API_KEY","DASHSCOPE_TOKEN"]}};function k(e){return u().configs[e]}function v(e){const n=u(),o=n.configs[e.agent],t={agent:e.agent,baseUrl:e.baseUrl?.trim()||o?.baseUrl,token:e.token?.trim()||o?.token,updatedAt:new Date().toISOString()};return n.configs[e.agent]=t,_(n),t}function B(e){const n=u();delete n.configs[e],_(n)}function K(e){if(!A(e))return{};const n=k(e);return n?l(e==="codex"?{OPENAI_BASE_URL:n.baseUrl,OPENAI_API_KEY:n.token}:e==="claude"?{ANTHROPIC_BASE_URL:n.baseUrl,ANTHROPIC_API_KEY:n.token}:{DASHSCOPE_BASE_URL:n.baseUrl,DASHSCOPE_API_KEY:n.token}):{}}function j(e,n=E()){if(!A(e))return;const o=k(e);if(o?.token||o?.baseUrl)return a({agent:e,source:"shennian",status:o.token?"managed":"missing",baseUrl:o.baseUrl,token:o.token,tokenPresent:!!o.token});const t=I(e,n);if(t.tokenPresent||t.baseUrl)return a({agent:e,source:"env",status:t.tokenPresent?"detected":"missing",baseUrl:t.baseUrl,token:t.token,tokenPresent:t.tokenPresent});const r=p(e);return r.tokenPresent||r.baseUrl?a({agent:e,source:"config-file",status:r.tokenPresent?"detected":"missing",baseUrl:r.baseUrl,token:r.token,tokenPresent:r.tokenPresent}):a({agent:e,source:"unknown",status:"missing",tokenPresent:!1})}function u(){try{return{configs:JSON.parse(s.readFileSync(c,"utf-8")).configs??{}}}catch{return{configs:{}}}}function _(e){s.mkdirSync(i.dirname(c),{recursive:!0}),s.writeFileSync(c,JSON.stringify(e,null,2),{mode:384});try{s.chmodSync(c,384)}catch{}}function l(e){const n={};for(const[o,t]of Object.entries(e))t&&(n[o]=t);return n}function I(e,n){const o=O[e],t=P(n,o.baseUrl),r=P(n,o.token);return{baseUrl:t,token:r,tokenPresent:!!r}}function P(e,n){for(const o of n){const t=e[o]?.trim();if(t)return t}}function p(e){const n=m.homedir();if(e==="pi"){const r=S().apiKeys?.dashscope?.trim();if(r)return{token:r,tokenPresent:!0}}const o=e==="codex"?[i.join(n,".codex","config.toml"),i.join(n,".codex","auth.json")]:e==="claude"?[i.join(n,".claude","settings.json"),i.join(n,".claude.json")]:[i.join(n,".dashscope","config.json")];for(const t of o){const r=C(t);if(!r)continue;const f=N(r,e),d=b(r);if(f||d)return{token:f,baseUrl:d,tokenPresent:!!f}}return{tokenPresent:!1}}function C(e){try{const n=s.statSync(e);return!n.isFile()||n.size>1024*1024?null:s.readFileSync(e,"utf-8")}catch{return null}}function b(e){return e.match(/(?:base_url|baseURL|api_url|apiUrl|ANTHROPIC_BASE_URL|OPENAI_BASE_URL|DASHSCOPE_BASE_URL)["'\s:=]+([^"'\s,}]+)/i)?.[1]?.trim()}function N(e,n){const o=n==="claude"?"sk-ant-":"sk-",t=e.match(new RegExp(`${o.replace(/-/g,"\\-")}[A-Za-z0-9_\\-]{8,}`));return t?.[0]?t[0]:e.match(/(?:api[_-]?key|auth[_-]?token|token|dashscope)["'\s:=]+([A-Za-z0-9_\-.]{12,})/i)?.[1]?.trim()}function a(e){return{status:e.status,source:e.source,tokenPresent:e.tokenPresent,...e.baseUrl?{baseUrlHost:R(e.baseUrl)}:{},...e.token?{tokenHint:h(e.token)}:{},updatedAt:new Date().toISOString()}}function h(e){const n=e.trim();return n?`\u2022\u2022\u2022\u2022${n.slice(-U)}`:""}function R(e){try{return new URL(e).host||e}catch{return e.replace(/^https?:\/\//i,"").replace(/\/.*$/,"")||e}}export{K as buildManagedAgentEnv,B as deleteManagedAgentProviderConfig,j as getAgentConfigSummary,k as getManagedAgentProviderConfig,h as maskToken,v as upsertManagedAgentProviderConfig};

package/dist/src/agents/cursor-managed-permissions.js

@@ -1,299 +1,2 @@
-// @arch docs/features/managed-agent-restricted-runtime.md
-// @test src/__tests__/cursor-managed-permissions.test.ts
-import fs from 'node:fs';
-import fsPromises from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { resolveProtectedShennianDirectories } from '../security/managed-agent-credential-paths.js';
-const CURSOR_MANAGED_CONFIG_PREFIX = 'shennian-cursor-managed-';
-const MAX_PROJECT_SANDBOX_CONFIG_BYTES = 1024 * 1024;
-const BASE_SENSITIVE_READ_RULES = [
-    'Read(.env)',
-    'Read(.env.*)',
-    'Read(**/.env)',
-    'Read(**/.env.*)',
-    'Read(*.key)',
-    'Read(**/*.key)',
-    'Read(*.pem)',
-    'Read(**/*.pem)',
-    'Read(~/.shennian/**)',
-    'Read($HOME/.shennian/**)',
-];
-const supportedExternalCapabilities = {
-    // Cursor's shell can request a one-off network permission and retry a
-    // denied command in non-interactive mode. Managed mode therefore keeps the
-    // entire Shell tool disabled; it cannot safely offer command networking.
-    commandNetwork: { allow: false, deny: true },
-    webSearch: { allow: true, deny: true },
-    // Cursor CLI does not expose non-interactive Browser or computer-use
-    // permission switches. Keeping them unavailable is safer than pretending
-    // that MCP/WebFetch rules control the native tools.
-    browser: { allow: false, deny: true },
-    computerUse: { allow: false, deny: true },
-    // Project MCP discovery happens outside the invocation-only config and can
-    // start before a tool permission is evaluated.
-    mcp: { allow: false, deny: false },
-};
-/**
- * Evidence baseline: Cursor Agent 2026.08.31 exposes --sandbox, --mode=ask,
- * CURSOR_CONFIG_DIR, sandbox.json network policy, and CLI permission tokens.
- *
- * The profile is deliberately partial. Real 2026.08.31 probes showed that
- * Read can cross the workspace boundary, and that an allowed Shell can read
- * outside files, write temporary files, and request network access despite a
- * deny policy. Project MCP discovery also lacks a strict invocation-scoped
- * disable switch. Shell is therefore disabled in managed mode.
- */
-export const CURSOR_MANAGED_RUNTIME_SECURITY = {
-    minimumRuntimeVersion: '2026.08.31',
-    maximumRuntimeVersionExclusive: '2026.09.01',
-    platforms: {
-        darwin: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
-            externalCapabilities: supportedExternalCapabilities,
-            knownGaps: [
-                'fileAccess.workspaceBoundaryUnenforced',
-                'fileAccess.outsideWorkspaceRead',
-                'sandbox.shellDisabled',
-                'externalCapabilities.webSearchToolGranularity',
-                'externalCapabilities.projectMcpStartup',
-            ],
-        },
-        linux: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
-            externalCapabilities: supportedExternalCapabilities,
-            knownGaps: [
-                'fileAccess.workspaceBoundaryUnenforced',
-                'fileAccess.outsideWorkspaceRead',
-                'sandbox.shellDisabled',
-                'externalCapabilities.webSearchToolGranularity',
-                'externalCapabilities.projectMcpStartup',
-            ],
-        },
-        wsl: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
-            externalCapabilities: supportedExternalCapabilities,
-            knownGaps: [
-                'fileAccess.workspaceBoundaryUnenforced',
-                'fileAccess.outsideWorkspaceRead',
-                'sandbox.shellDisabled',
-                'externalCapabilities.webSearchToolGranularity',
-                'externalCapabilities.projectMcpStartup',
-            ],
-        },
-        win32: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
-            externalCapabilities: {
-                commandNetwork: { allow: true, deny: false },
-                webSearch: { allow: true, deny: true },
-                browser: { allow: false, deny: true },
-                computerUse: { allow: false, deny: true },
-                mcp: { allow: true, deny: true },
-            },
-            knownGaps: [
-                'sandbox.nativeWindowsUnverified',
-                'sandbox.shellDisabled',
-                'externalCapabilities.projectMcpStartup',
-            ],
-        },
-    },
-};
-/**
- * Compiles one Cursor invocation policy. The returned JSON is written only to
- * an isolated CURSOR_CONFIG_DIR created for the child process; neither the
- * user's ~/.cursor directory nor the workspace is modified.
- */
-export function compileCursorManagedPermissions(enforcement, resolvedWorkDir) {
-    const workDir = validateResolvedWorkDir(resolvedWorkDir);
-    const policy = enforcement.effectivePolicy;
-    const hostFull = policy.fileAccess === 'host-full';
-    const workspaceReadOnly = policy.fileAccess === 'workspace-read';
-    const sensitiveReadRules = resolveSensitiveReadRules();
-    const sensitiveWriteRules = sensitiveReadRules.map((rule) => rule.replace(/^Read\(/, 'Write('));
-    if (policy.externalCapabilities.commandNetwork) {
-        throw new Error('cursor_managed_command_network_unavailable');
-    }
-    if (policy.externalCapabilities.mcp) {
-        throw new Error('cursor_managed_mcp_isolation_unavailable');
-    }
-    if (policy.externalCapabilities.browser || policy.externalCapabilities.computerUse) {
-        throw new Error('cursor_managed_native_interactive_tool_control_unavailable');
-    }
-    if (enforcement.platform === 'win32' && !hostFull) {
-        throw new Error('cursor_managed_native_windows_sandbox_unavailable');
-    }
-    if (!hostFull)
-        assertProjectSandboxCannotBroadenPolicy(workDir, workspaceReadOnly);
-    const allow = ['Read(**)'];
-    if (!workspaceReadOnly)
-        allow.push('Write(**)');
-    if (policy.externalCapabilities.webSearch)
-        allow.push('WebFetch(*)');
-    if (policy.externalCapabilities.mcp)
-        allow.push('Mcp(*:*)');
-    const deny = [
-        ...sensitiveReadRules,
-        ...sensitiveWriteRules,
-        'Shell(*)',
-        ...(workspaceReadOnly ? ['Write(**)'] : []),
-        ...(!policy.externalCapabilities.webSearch ? ['WebFetch(*)'] : []),
-        ...(!policy.externalCapabilities.mcp ? ['Mcp(*:*)'] : []),
-    ];
-    const networkAllowed = policy.externalCapabilities.commandNetwork;
-    const cliConfig = {
-        version: 1,
-        editor: { vimMode: false },
-        approvalMode: hostFull ? 'unrestricted' : 'allowlist',
-        sandbox: {
-            mode: hostFull ? 'disabled' : 'enabled',
-            networkAccess: networkAllowed ? 'allow_all' : 'user_config_only',
-            readBoundary: hostFull ? 'system' : 'workspace',
-        },
-        permissions: {
-            allow: [...new Set(allow)].sort(),
-            deny: [...new Set(deny)].sort(),
-        },
-        notifications: false,
-        hints: false,
-        suggestNextPrompt: false,
-        attribution: {
-            attributeCommitsToAgent: false,
-            attributePRsToAgent: false,
-        },
-    };
-    const sandboxConfig = {
-        type: hostFull
-            ? 'insecure_none'
-            : workspaceReadOnly
-                ? 'workspace_readonly'
-                : 'workspace_readwrite',
-        additionalReadwritePaths: [],
-        additionalReadonlyPaths: [],
-        disableTmpWrite: true,
-        enableSharedBuildCache: false,
-        networkPolicy: networkAllowed
-            ? { default: 'allow', allow: [], deny: [] }
-            : { default: 'deny', allow: [], deny: ['*'] },
-        networkPolicyStrict: !networkAllowed,
-        readBoundary: hostFull ? 'system' : 'workspace',
-    };
-    return {
-        args: [
-            '--trust',
-            '--workspace',
-            workDir,
-            '--sandbox',
-            hostFull ? 'disabled' : 'enabled',
-            ...(workspaceReadOnly ? ['--mode', 'ask'] : []),
-            ...(policy.externalCapabilities.mcp ? ['--approve-mcps'] : []),
-            ...(hostFull ? ['--force'] : []),
-        ],
-        cliConfig,
-        sandboxConfig,
-    };
-}
-export async function createCursorManagedConfigDirectory(config) {
-    const configDir = await fsPromises.mkdtemp(path.join(os.tmpdir(), CURSOR_MANAGED_CONFIG_PREFIX));
-    try {
-        await fsPromises.chmod(configDir, 0o700);
-        await Promise.all([
-            writePrivateJson(path.join(configDir, 'cli-config.json'), config.cliConfig),
-            writePrivateJson(path.join(configDir, 'sandbox.json'), config.sandboxConfig),
-        ]);
-        return configDir;
-    }
-    catch (error) {
-        await disposeCursorManagedConfigDirectory(configDir).catch(() => { });
-        throw new Error('cursor_managed_config_initialization_failed', { cause: error });
-    }
-}
-export async function disposeCursorManagedConfigDirectory(configDir) {
-    const resolved = path.resolve(configDir);
-    const tempRoot = path.resolve(os.tmpdir());
-    if (path.dirname(resolved) !== tempRoot ||
-        !path.basename(resolved).startsWith(CURSOR_MANAGED_CONFIG_PREFIX)) {
-        throw new Error('cursor_managed_config_cleanup_refused');
-    }
-    await fsPromises.rm(resolved, { recursive: true, force: true });
-}
-function assertProjectSandboxCannotBroadenPolicy(workDir, workspaceReadOnly) {
-    const projectConfigPath = path.join(workDir, '.cursor', 'sandbox.json');
-    if (!fs.existsSync(projectConfigPath))
-        return;
-    let raw;
-    try {
-        const stat = fs.statSync(projectConfigPath);
-        if (!stat.isFile() || stat.size > MAX_PROJECT_SANDBOX_CONFIG_BYTES) {
-            throw new Error('invalid_project_sandbox');
-        }
-        raw = fs.readFileSync(projectConfigPath, 'utf8');
-    }
-    catch (error) {
-        throw new Error('cursor_managed_project_sandbox_unverifiable', { cause: error });
-    }
-    let parsed;
-    try {
-        const value = JSON.parse(raw);
-        if (!value || typeof value !== 'object' || Array.isArray(value)) {
-            throw new Error('invalid_project_sandbox');
-        }
-        parsed = value;
-    }
-    catch (error) {
-        throw new Error('cursor_managed_project_sandbox_unverifiable', { cause: error });
-    }
-    if (parsed.type === 'insecure_none') {
-        throw new Error('cursor_managed_project_sandbox_broadens_access');
-    }
-    if (workspaceReadOnly && parsed.type === 'workspace_readwrite') {
-        throw new Error('cursor_managed_project_sandbox_broadens_access');
-    }
-    if (hasConfiguredPaths(parsed.additionalReadwritePaths) || hasConfiguredPaths(parsed.additionalReadonlyPaths)) {
-        throw new Error('cursor_managed_project_sandbox_broadens_access');
-    }
-}
-function hasConfiguredPaths(value) {
-    if (value == null)
-        return false;
-    return !Array.isArray(value) || value.length > 0;
-}
-function normalizeForCursor(value) {
-    return value.replaceAll('\\', '/');
-}
-function resolveSensitiveReadRules() {
-    const shennianDirectories = resolveProtectedShennianDirectories()
-        .map((entry) => normalizeForCursor(path.normalize(entry)))
-        .filter((entry) => path.isAbsolute(entry));
-    return [...new Set([
-            ...BASE_SENSITIVE_READ_RULES,
-            ...shennianDirectories.map((entry) => `Read(${entry}/**)`),
-        ])];
-}
-function validateResolvedWorkDir(value) {
-    const normalized = path.normalize(value.trim());
-    if (!normalized || !path.isAbsolute(normalized)) {
-        throw new Error('cursor_managed_workdir_invalid');
-    }
-    let realPath;
-    try {
-        realPath = fs.realpathSync(normalized);
-    }
-    catch {
-        throw new Error('cursor_managed_workdir_unavailable');
-    }
-    if (path.normalize(realPath) !== normalized) {
-        throw new Error('cursor_managed_workdir_not_realpath');
-    }
-    return normalized;
-}
-async function writePrivateJson(filePath, value) {
-    await fsPromises.writeFile(filePath, `${JSON.stringify(value)}\n`, {
-        encoding: 'utf8',
-        mode: 0o600,
-        flag: 'wx',
-    });
-}
+import l from"node:fs";import c from"node:fs/promises";import u from"node:os";import s from"node:path";import{resolveProtectedShennianDirectories as C}from"../security/managed-agent-credential-paths.js";const f="shennian-cursor-managed-",R=1024*1024,v=["Read(.env)","Read(.env.*)","Read(**/.env)","Read(**/.env.*)","Read(*.key)","Read(**/*.key)","Read(*.pem)","Read(**/*.pem)","Read(~/.shennian/**)","Read($HOME/.shennian/**)"],p={commandNetwork:{allow:!1,deny:!0},webSearch:{allow:!0,deny:!0},browser:{allow:!1,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!1,deny:!1}},U={minimumRuntimeVersion:"2026.08.31",maximumRuntimeVersionExclusive:"2026.09.01",platforms:{darwin:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:p,knownGaps:["fileAccess.workspaceBoundaryUnenforced","fileAccess.outsideWorkspaceRead","sandbox.shellDisabled","externalCapabilities.webSearchToolGranularity","externalCapabilities.projectMcpStartup"]},linux:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:p,knownGaps:["fileAccess.workspaceBoundaryUnenforced","fileAccess.outsideWorkspaceRead","sandbox.shellDisabled","externalCapabilities.webSearchToolGranularity","externalCapabilities.projectMcpStartup"]},wsl:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:p,knownGaps:["fileAccess.workspaceBoundaryUnenforced","fileAccess.outsideWorkspaceRead","sandbox.shellDisabled","externalCapabilities.webSearchToolGranularity","externalCapabilities.projectMcpStartup"]},win32:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:{commandNetwork:{allow:!0,deny:!1},webSearch:{allow:!0,deny:!0},browser:{allow:!1,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},knownGaps:["sandbox.nativeWindowsUnverified","sandbox.shellDisabled","externalCapabilities.projectMcpStartup"]}}};function G(a,e){const n=j(e),o=a.effectivePolicy,t=o.fileAccess==="host-full",r=o.fileAccess==="workspace-read",w=E(),b=w.map(k=>k.replace(/^Read\(/,"Write("));if(o.externalCapabilities.commandNetwork)throw new Error("cursor_managed_command_network_unavailable");if(o.externalCapabilities.mcp)throw new Error("cursor_managed_mcp_isolation_unavailable");if(o.externalCapabilities.browser||o.externalCapabilities.computerUse)throw new Error("cursor_managed_native_interactive_tool_control_unavailable");if(a.platform==="win32"&&!t)throw new Error("cursor_managed_native_windows_sandbox_unavailable");t||S(n,r);const i=["Read(**)"];r||i.push("Write(**)"),o.externalCapabilities.webSearch&&i.push("WebFetch(*)"),o.externalCapabilities.mcp&&i.push("Mcp(*:*)");const h=[...w,...b,"Shell(*)",...r?["Write(**)"]:[],...o.externalCapabilities.webSearch?[]:["WebFetch(*)"],...o.externalCapabilities.mcp?[]:["Mcp(*:*)"]],d=o.externalCapabilities.commandNetwork,y={version:1,editor:{vimMode:!1},approvalMode:t?"unrestricted":"allowlist",sandbox:{mode:t?"disabled":"enabled",networkAccess:d?"allow_all":"user_config_only",readBoundary:t?"system":"workspace"},permissions:{allow:[...new Set(i)].sort(),deny:[...new Set(h)].sort()},notifications:!1,hints:!1,suggestNextPrompt:!1,attribution:{attributeCommitsToAgent:!1,attributePRsToAgent:!1}},x={type:t?"insecure_none":r?"workspace_readonly":"workspace_readwrite",additionalReadwritePaths:[],additionalReadonlyPaths:[],disableTmpWrite:!0,enableSharedBuildCache:!1,networkPolicy:d?{default:"allow",allow:[],deny:[]}:{default:"deny",allow:[],deny:["*"]},networkPolicyStrict:!d,readBoundary:t?"system":"workspace"};return{args:["--trust","--workspace",n,"--sandbox",t?"disabled":"enabled",...r?["--mode","ask"]:[],...o.externalCapabilities.mcp?["--approve-mcps"]:[],...t?["--force"]:[]],cliConfig:y,sandboxConfig:x}}async function T(a){const e=await c.mkdtemp(s.join(u.tmpdir(),f));try{return await c.chmod(e,448),await Promise.all([_(s.join(e,"cli-config.json"),a.cliConfig),_(s.join(e,"sandbox.json"),a.sandboxConfig)]),e}catch(n){throw await g(e).catch(()=>{}),new Error("cursor_managed_config_initialization_failed",{cause:n})}}async function g(a){const e=s.resolve(a),n=s.resolve(u.tmpdir());if(s.dirname(e)!==n||!s.basename(e).startsWith(f))throw new Error("cursor_managed_config_cleanup_refused");await c.rm(e,{recursive:!0,force:!0})}function S(a,e){const n=s.join(a,".cursor","sandbox.json");if(!l.existsSync(n))return;let o;try{const r=l.statSync(n);if(!r.isFile()||r.size>R)throw new Error("invalid_project_sandbox");o=l.readFileSync(n,"utf8")}catch(r){throw new Error("cursor_managed_project_sandbox_unverifiable",{cause:r})}let t;try{const r=JSON.parse(o);if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid_project_sandbox");t=r}catch(r){throw new Error("cursor_managed_project_sandbox_unverifiable",{cause:r})}if(t.type==="insecure_none")throw new Error("cursor_managed_project_sandbox_broadens_access");if(e&&t.type==="workspace_readwrite")throw new Error("cursor_managed_project_sandbox_broadens_access");if(m(t.additionalReadwritePaths)||m(t.additionalReadonlyPaths))throw new Error("cursor_managed_project_sandbox_broadens_access")}function m(a){return a==null?!1:!Array.isArray(a)||a.length>0}function A(a){return a.replaceAll("\\","/")}function E(){const a=C().map(e=>A(s.normalize(e))).filter(e=>s.isAbsolute(e));return[...new Set([...v,...a.map(e=>`Read(${e}/**)`)])]}function j(a){const e=s.normalize(a.trim());if(!e||!s.isAbsolute(e))throw new Error("cursor_managed_workdir_invalid");let n;try{n=l.realpathSync(e)}catch{throw new Error("cursor_managed_workdir_unavailable")}if(s.normalize(n)!==e)throw new Error("cursor_managed_workdir_not_realpath");return e}async function _(a,e){await c.writeFile(a,`${JSON.stringify(e)}
+`,{encoding:"utf8",mode:384,flag:"wx"})}export{U as CURSOR_MANAGED_RUNTIME_SECURITY,G as compileCursorManagedPermissions,T as createCursorManagedConfigDirectory,g as disposeCursorManagedConfigDirectory};