svamp-cli 0.2.341 → 0.2.346

package/dist/sandboxDetect-Cdzsj5TC.mjs

@@ -0,0 +1,19 @@
+function isSandboxed() {
+  return process.env.SVAMP_SANDBOXED === "1";
+}
+const SANDBOX_SAFE_SESSION_CMDS = [
+  "set-title",
+  "set-link",
+  "link",
+  "set-project-description",
+  "set-project"
+];
+const SANDBOX_BLOCKED_MSG = `This command is not available in sandboxed sessions. Available commands: ${SANDBOX_SAFE_SESSION_CMDS.join(", ")}`;
+function requireNotSandboxed(commandName) {
+  if (isSandboxed()) {
+    console.error(`${commandName}: ${SANDBOX_BLOCKED_MSG}`);
+    process.exit(1);
+  }
+}
+
+export { SANDBOX_BLOCKED_MSG, SANDBOX_SAFE_SESSION_CMDS, isSandboxed, requireNotSandboxed };

package/dist/{scheduler-B0h2sfGn.mjs → scheduler-BY30ZrB9.mjs}

@@ -1,4 +1,13 @@
-import { f as resolveProjectRoot, E as listWorkflows, F as isWorkflowEnabled, G as workflowSchedules, H as inZone, x as runWorkflow, I as cronMatches } from './run-LHJh7jLy.mjs';
+import { i as inZone, c as cronMatches } from './cron-hHGdb5kU.mjs';
+import { r as resolveProjectRoot } from './store-Bn0ByYev.mjs';
+import { l as listWorkflows, i as isWorkflowEnabled, w as workflowSchedules } from './store-fi0f-ff1.mjs';
+import { r as runWorkflow } from './run-DkjwF-zA.mjs';
+import 'node:fs';
+import 'node:path';
+import 'node:crypto';
+import 'node:child_process';
+import './fileLock-BMPwCrB6.mjs';
+import 'yaml';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -6,20 +15,43 @@ import 'path';
 import 'url';
 import 'child_process';
 import 'crypto';
-import 'node:fs';
-import 'node:path';
-import 'node:crypto';
-import 'node:child_process';
+import './hookSettings-DYMTUgVA.mjs';
+import './types-57J3Re0n.mjs';
+import './securityContext-Cm5UTCuD.mjs';
+import './machineTools-DygM1jXW.mjs';
+import './model-CUHojegn.mjs';
 import 'util';
 import 'http';
 import 'net';
+import './instance-CeHz5C8v.mjs';
+import './serveAuth-DbVLRCRR.mjs';
 import 'node:os';
+import './envFlag-COOuJ3AH.mjs';
+import './claudeAuth-iAerdaMr.mjs';
+import './codexProvider-BtxYc5Rj.mjs';
+import './friendlyName-1UZcyDhu.mjs';
 import 'node:events';
+import './hyphaClient-ybivOjZo.mjs';
+import './sharingNotificationSync-qGIQ-3yf.mjs';
+import './acpBackend-BZ1MJhQV.mjs';
 import '@agentclientprotocol/sdk';
+import './DefaultTransport-vfp78fug.mjs';
+import './wrapCommand-CdNawSaa.mjs';
+import './acpAgentConfig-CObOPlA8.mjs';
+import './codexAppServerBackend-VGsYtbqg.mjs';
 import 'node:util';
 import 'node:readline';
+import './pinnedCodex-XW4qvOAe.mjs';
+import './GeminiTransport-3OkhtFRO.mjs';
+import './KimiTransport-D8n009Tr.mjs';
+import './kimiProvider-DbxODebR.mjs';
+import './kimiSetup-NGsoYB5h.mjs';
+import './detectIsolation-CzoDCEnh.mjs';
 import 'node:fs/promises';
-import 'yaml';
+import './pinnedNono-5ZHb6328.mjs';
+import './bootStatus-DqtNgJch.mjs';
+import './loopVerify-B47sSjxe.mjs';
+import './api-BHjyC0Ph.mjs';
 
 function cronMatchesSafe(expr, date) {
   try {

package/dist/securityContext-Cm5UTCuD.mjs

@@ -0,0 +1,218 @@
+import { existsSync, readFileSync } from 'node:fs';
+
+function loadSecurityContextConfig(filePath) {
+  if (!existsSync(filePath)) {
+    throw new Error(`Security context config file not found: ${filePath}`);
+  }
+  const raw = readFileSync(filePath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid JSON in security context config: ${err.message}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("Security context config must be a JSON object");
+  }
+  if (parsed.default !== void 0) {
+    validateSecurityContext(parsed.default, "default");
+  }
+  if (parsed.users !== void 0) {
+    if (typeof parsed.users !== "object" || parsed.users === null || Array.isArray(parsed.users)) {
+      throw new Error('Security context config "users" must be an object');
+    }
+    for (const [email, ctx] of Object.entries(parsed.users)) {
+      validateSecurityContext(ctx, `users.${email}`);
+    }
+  }
+  return parsed;
+}
+const VALID_ROLES = ["view", "interact", "admin"];
+function validateSecurityContext(ctx, path) {
+  if (typeof ctx !== "object" || ctx === null || Array.isArray(ctx)) {
+    throw new Error(`Security context at "${path}" must be an object`);
+  }
+  if (ctx.role !== void 0 && !VALID_ROLES.includes(ctx.role)) {
+    throw new Error(`Invalid role "${ctx.role}" at "${path}". Must be one of: ${VALID_ROLES.join(", ")}`);
+  }
+  if (ctx.filesystem !== void 0) {
+    validateStringArray(ctx.filesystem.denyRead, `${path}.filesystem.denyRead`);
+    validateStringArray(ctx.filesystem.allowWrite, `${path}.filesystem.allowWrite`);
+    validateStringArray(ctx.filesystem.denyWrite, `${path}.filesystem.denyWrite`);
+  }
+  if (ctx.network !== void 0) {
+    validateStringArray(ctx.network.allowedDomains, `${path}.network.allowedDomains`);
+    validateStringArray(ctx.network.deniedDomains, `${path}.network.deniedDomains`);
+  }
+  if (ctx.denyAllNetwork !== void 0 && typeof ctx.denyAllNetwork !== "boolean") {
+    throw new Error(`"${path}.denyAllNetwork" must be a boolean`);
+  }
+  validateStringArray(ctx.allowedDirectories, `${path}.allowedDirectories`);
+}
+function validateStringArray(arr, path) {
+  if (arr === void 0) return;
+  if (!Array.isArray(arr)) {
+    throw new Error(`"${path}" must be an array`);
+  }
+  for (let i = 0; i < arr.length; i++) {
+    if (typeof arr[i] !== "string") {
+      throw new Error(`"${path}[${i}]" must be a string`);
+    }
+  }
+}
+function dedup(arr) {
+  return [...new Set(arr)];
+}
+function mergeArrays(a, b) {
+  if (!a && !b) return void 0;
+  return dedup([...a || [], ...b || []]);
+}
+function mergeSecurityContexts(base, override) {
+  if (!base && !override) return void 0;
+  if (!base) return override;
+  if (!override) return base;
+  const merged = {};
+  merged.role = override.role ?? base.role;
+  merged.denyAllNetwork = override.denyAllNetwork ?? base.denyAllNetwork;
+  const baseFs = base.filesystem;
+  const overFs = override.filesystem;
+  if (baseFs || overFs) {
+    merged.filesystem = {
+      denyRead: mergeArrays(baseFs?.denyRead, overFs?.denyRead),
+      allowWrite: mergeArrays(baseFs?.allowWrite, overFs?.allowWrite),
+      denyWrite: mergeArrays(baseFs?.denyWrite, overFs?.denyWrite)
+    };
+  }
+  const baseNet = base.network;
+  const overNet = override.network;
+  if (baseNet || overNet) {
+    merged.network = {
+      allowedDomains: mergeArrays(baseNet?.allowedDomains, overNet?.allowedDomains),
+      deniedDomains: mergeArrays(baseNet?.deniedDomains, overNet?.deniedDomains)
+    };
+  }
+  merged.allowedDirectories = mergeArrays(base.allowedDirectories, override.allowedDirectories);
+  return merged;
+}
+function clampSecurityContextToCeiling(ceiling, requested) {
+  if (!ceiling) return void 0;
+  if (!requested) return ceiling;
+  const merged = {};
+  merged.role = ceiling.role;
+  merged.denyAllNetwork = (ceiling.denyAllNetwork ?? false) || (requested.denyAllNetwork ?? false);
+  const cf = ceiling.filesystem;
+  const rf = requested.filesystem;
+  if (cf || rf) {
+    merged.filesystem = {
+      // Grants: ceiling only (caller cannot widen writable paths).
+      allowWrite: cf?.allowWrite ? dedup(cf.allowWrite) : void 0,
+      // Denials: union (caller may add more).
+      denyRead: mergeArrays(cf?.denyRead, rf?.denyRead),
+      denyWrite: mergeArrays(cf?.denyWrite, rf?.denyWrite)
+    };
+  }
+  const cn = ceiling.network;
+  const rn = requested.network;
+  if (cn || rn) {
+    merged.network = {
+      allowedDomains: cn?.allowedDomains ? dedup(cn.allowedDomains) : void 0,
+      deniedDomains: mergeArrays(cn?.deniedDomains, rn?.deniedDomains)
+    };
+  }
+  merged.allowedDirectories = ceiling.allowedDirectories ? dedup(ceiling.allowedDirectories) : void 0;
+  return merged;
+}
+function resolveSecurityContext(config, userEmail) {
+  if (!config) return void 0;
+  const defaultCtx = config.default;
+  let userCtx;
+  if (userEmail && config.users) {
+    const emailLower = userEmail.toLowerCase();
+    for (const [key, ctx] of Object.entries(config.users)) {
+      if (key.toLowerCase() === emailLower) {
+        userCtx = ctx;
+        break;
+      }
+    }
+  }
+  return mergeSecurityContexts(defaultCtx, userCtx);
+}
+function buildSecurityContextFromFlags(flags) {
+  const ctx = {};
+  if (flags.denyRead?.length || flags.allowWrite?.length) {
+    ctx.filesystem = {};
+    if (flags.denyRead?.length) ctx.filesystem.denyRead = flags.denyRead;
+    if (flags.allowWrite?.length) ctx.filesystem.allowWrite = flags.allowWrite;
+  }
+  if (flags.denyNetwork) {
+    ctx.denyAllNetwork = true;
+  }
+  if (flags.allowDomain?.length) {
+    ctx.network = { allowedDomains: flags.allowDomain };
+  }
+  return ctx;
+}
+function unenforceableRules(method, context) {
+  const unsupported = [];
+  const fs = context.filesystem;
+  if (fs?.denyRead?.length) unsupported.push("filesystem.denyRead");
+  if (fs?.denyWrite?.length) unsupported.push("filesystem.denyWrite");
+  if (context.network?.deniedDomains?.length) unsupported.push("network.deniedDomains");
+  if (method === "docker" || method === "podman") {
+    if (fs?.allowWrite?.length) unsupported.push("filesystem.allowWrite");
+    if (context.network?.allowedDomains?.length) unsupported.push("network.allowedDomains");
+  }
+  return unsupported;
+}
+function describeUnenforceable(method, context) {
+  const unsupported = unenforceableRules(method, context);
+  if (!unsupported.length) return null;
+  return `securityContext: ${unsupported.join(", ")} is NOT ENFORCED by the "${method}" sandbox \u2014 these rules are accepted but have no effect (#0878). ` + (method === "nono" ? `nono is allow-list based and the workspace is granted via --allow-cwd, so a deny rule for a path inside the workspace does nothing. allowedDirectories and filesystem.allowWrite do NOT help \u2014 they GRANT additional paths on top of that. The only confinement that works today is to keep the sensitive path OUTSIDE the session workspace.` : `The container backend maps only allowedDirectories and denyAllNetwork. Use those, or run the machine under the nono sandbox.`);
+}
+function applySecurityContext(baseConfig, context) {
+  const warning = describeUnenforceable(baseConfig.method, context);
+  if (warning) console.warn(`[security] ${warning}`);
+  const config = { ...baseConfig };
+  if (config.method === "nono") {
+    const nonoConfig = { ...config.nonoConfig };
+    if (context.filesystem?.allowWrite) {
+      nonoConfig.allowDirs = dedup([
+        ...nonoConfig.allowDirs || [],
+        ...context.filesystem.allowWrite
+      ]);
+    }
+    if (context.allowedDirectories) {
+      nonoConfig.allowDirs = dedup([
+        ...nonoConfig.allowDirs || [],
+        ...context.allowedDirectories
+      ]);
+    }
+    if (context.denyAllNetwork) {
+      nonoConfig.netBlock = true;
+      nonoConfig.proxyAllow = [];
+    }
+    if (!context.denyAllNetwork && context.network?.allowedDomains) {
+      nonoConfig.proxyAllow = dedup([
+        ...nonoConfig.proxyAllow || [],
+        ...context.network.allowedDomains
+      ]);
+    }
+    config.nonoConfig = nonoConfig;
+  } else if (config.method === "docker" || config.method === "podman") {
+    const containerConfig = { ...config.containerConfig };
+    if (context.denyAllNetwork) {
+      containerConfig.networkMode = "none";
+    }
+    if (context.allowedDirectories) {
+      const extraMounts = [...containerConfig.extraMounts || []];
+      for (const dir of context.allowedDirectories) {
+        extraMounts.push(`${dir}:${dir}`);
+      }
+      containerConfig.extraMounts = dedup(extraMounts);
+    }
+    config.containerConfig = containerConfig;
+  }
+  return config;
+}
+
+export { applySecurityContext, buildSecurityContextFromFlags, clampSecurityContextToCeiling, describeUnenforceable, loadSecurityContextConfig, mergeSecurityContexts, resolveSecurityContext };