whale-code 6.5.5 → 6.5.6

package/dist/cli/services/ripgrep.js

@@ -4,135 +4,135 @@
  * Tries system `rg` first, then falls back to @vscode/ripgrep package.
  * If neither available, callers fall back to grep/find.
  */
+
 import { execSync, execFileSync } from "child_process";
+
 // ============================================================================
 // RG BINARY DISCOVERY
 // ============================================================================
+
 let rgPathCache = undefined; // undefined = unchecked
+
 function findSystemRg() {
-    try {
-        const path = execSync("which rg", { encoding: "utf-8", timeout: 3000 }).trim();
-        if (path)
-            return path;
-    }
-    catch { /* not on PATH */ }
-    return null;
+  try {
+    const path = execSync("which rg", {
+      encoding: "utf-8",
+      timeout: 3000
+    }).trim();
+    if (path) return path;
+  } catch {/* not on PATH */}
+  return null;
 }
 function findVscodeRg() {
-    try {
-        const rgModule = require("@vscode/ripgrep");
-        if (rgModule?.rgPath)
-            return rgModule.rgPath;
-    }
-    catch { /* package not installed */ }
-    return null;
+  try {
+    const rgModule = require("@vscode/ripgrep");
+    if (rgModule?.rgPath) return rgModule.rgPath;
+  } catch {/* package not installed */}
+  return null;
 }
 export function getRgPath() {
-    if (rgPathCache !== undefined)
-        return rgPathCache;
-    rgPathCache = findSystemRg() || findVscodeRg();
-    return rgPathCache;
+  if (rgPathCache !== undefined) return rgPathCache;
+  rgPathCache = findSystemRg() || findVscodeRg();
+  return rgPathCache;
 }
 export function isRgAvailable() {
-    return getRgPath() !== null;
+  return getRgPath() !== null;
 }
+
+// ============================================================================
+// RIPGREP GREP — content search
+// ============================================================================
+
 export function rgGrep(opts) {
-    const rg = getRgPath();
-    if (!rg)
-        return null;
-    const args = [];
-    // Output mode
-    switch (opts.outputMode) {
-        case "files_with_matches":
-            args.push("-l");
-            break;
-        case "count":
-            args.push("-c");
-            break;
-        case "content":
-            args.push("-n");
-            break;
-        default:
-            args.push("-l");
-            break;
-    }
-    // Case sensitivity
-    if (opts.caseInsensitive)
-        args.push("-i");
-    // Multiline
-    if (opts.multiline) {
-        args.push("-U", "--multiline-dotall");
-    }
-    // Context lines (content mode only)
-    if (opts.outputMode === "content") {
-        if (opts.context)
-            args.push("-C", String(opts.context));
-        if (opts.before)
-            args.push("-B", String(opts.before));
-        if (opts.after)
-            args.push("-A", String(opts.after));
-    }
-    // File type filter
-    if (opts.type)
-        args.push("--type", opts.type);
-    if (opts.glob)
-        args.push("--glob", opts.glob);
-    // Exclusions
-    args.push("--glob", "!node_modules", "--glob", "!.git", "--glob", "!dist");
-    // Pattern and path
-    args.push("--", opts.pattern, opts.path);
-    const limit = opts.headLimit || 200;
-    try {
-        const output = execFileSync(rg, args, {
-            encoding: "utf-8",
-            timeout: 30000,
-            maxBuffer: 2 * 1024 * 1024,
-            stdio: ["pipe", "pipe", "pipe"], // Suppress stderr from leaking to terminal
-        });
-        // Apply head limit
-        const lines = output.split("\n");
-        const limited = lines.slice(0, limit).join("\n");
-        return limited.trim() || null;
-    }
-    catch (err) {
-        // rg exits 1 for "no matches" — that's not an error
-        if (err.status === 1)
-            return null;
-        // rg exits 2 for actual errors (permission denied etc.) — don't throw, return null
-        if (err.status === 2)
-            return null;
-        throw err;
-    }
+  const rg = getRgPath();
+  if (!rg) return null;
+  const args = [];
+
+  // Output mode
+  switch (opts.outputMode) {
+    case "files_with_matches":
+      args.push("-l");
+      break;
+    case "count":
+      args.push("-c");
+      break;
+    case "content":
+      args.push("-n");
+      break;
+    default:
+      args.push("-l");
+      break;
+  }
+
+  // Case sensitivity
+  if (opts.caseInsensitive) args.push("-i");
+
+  // Multiline
+  if (opts.multiline) {
+    args.push("-U", "--multiline-dotall");
+  }
+
+  // Context lines (content mode only)
+  if (opts.outputMode === "content") {
+    if (opts.context) args.push("-C", String(opts.context));
+    if (opts.before) args.push("-B", String(opts.before));
+    if (opts.after) args.push("-A", String(opts.after));
+  }
+
+  // File type filter
+  if (opts.type) args.push("--type", opts.type);
+  if (opts.glob) args.push("--glob", opts.glob);
+
+  // Exclusions
+  args.push("--glob", "!node_modules", "--glob", "!.git", "--glob", "!dist");
+
+  // Pattern and path
+  args.push("--", opts.pattern, opts.path);
+  const limit = opts.headLimit || 200;
+  try {
+    const output = execFileSync(rg, args, {
+      encoding: "utf-8",
+      timeout: 30000,
+      maxBuffer: 2 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"] // Suppress stderr from leaking to terminal
+    });
+
+    // Apply head limit
+    const lines = output.split("\n");
+    const limited = lines.slice(0, limit).join("\n");
+    return limited.trim() || null;
+  } catch (err) {
+    // rg exits 1 for "no matches" — that's not an error
+    if (err.status === 1) return null;
+    // rg exits 2 for actual errors (permission denied etc.) — don't throw, return null
+    if (err.status === 2) return null;
+    throw err;
+  }
 }
+
+// ============================================================================
+// RIPGREP GLOB — fast file finding
+// ============================================================================
+
 export function rgGlob(opts) {
-    const rg = getRgPath();
-    if (!rg)
-        return null;
-    const args = [
-        "--files",
-        "--glob", opts.pattern,
-        "--glob", "!node_modules",
-        "--glob", "!.git",
-        "--glob", "!dist",
-        opts.path,
-    ];
-    const limit = opts.headLimit || 200;
-    try {
-        const output = execFileSync(rg, args, {
-            encoding: "utf-8",
-            timeout: 10000,
-            maxBuffer: 2 * 1024 * 1024,
-            stdio: ["pipe", "pipe", "pipe"], // Suppress stderr from leaking to terminal
-        });
-        const files = output.trim().split("\n").filter(Boolean);
-        const limited = files.slice(0, limit);
-        return limited.length > 0 ? limited.join("\n") : null;
-    }
-    catch (err) {
-        if (err.status === 1)
-            return null;
-        if (err.status === 2)
-            return null; // Permission errors etc.
-        throw err;
-    }
+  const rg = getRgPath();
+  if (!rg) return null;
+  const args = ["--files", "--glob", opts.pattern, "--glob", "!node_modules", "--glob", "!.git", "--glob", "!dist", opts.path];
+  const limit = opts.headLimit || 200;
+  try {
+    const output = execFileSync(rg, args, {
+      encoding: "utf-8",
+      timeout: 10000,
+      maxBuffer: 2 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"] // Suppress stderr from leaking to terminal
+    });
+    const files = output.trim().split("\n").filter(Boolean);
+    const limited = files.slice(0, limit);
+    return limited.length > 0 ? limited.join("\n") : null;
+  } catch (err) {
+    if (err.status === 1) return null;
+    if (err.status === 2) return null; // Permission errors etc.
+    throw err;
+  }
 }
+//# sourceMappingURL=ripgrep.js.map

package/dist/cli/services/ripgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ripgrep.js","names":["execSync","execFileSync","rgPathCache","undefined","findSystemRg","path","encoding","timeout","trim","findVscodeRg","rgModule","require","rgPath","getRgPath","isRgAvailable","rgGrep","opts","rg","args","outputMode","push","caseInsensitive","multiline","context","String","before","after","type","glob","pattern","limit","headLimit","output","maxBuffer","stdio","lines","split","limited","slice","join","err","status","rgGlob","files","filter","Boolean","length"],"sources":["../../../src/cli/services/ripgrep.ts"],"sourcesContent":["/**\n * Ripgrep Integration — fast search via `rg` binary\n *\n * Tries system `rg` first, then falls back to @vscode/ripgrep package.\n * If neither available, callers fall back to grep/find.\n */\n\nimport { execSync, execFileSync } from \"child_process\";\n\n// ============================================================================\n// RG BINARY DISCOVERY\n// ============================================================================\n\nlet rgPathCache: string | null | undefined = undefined; // undefined = unchecked\n\nfunction findSystemRg(): string | null {\n  try {\n    const path = execSync(\"which rg\", { encoding: \"utf-8\", timeout: 3000 }).trim();\n    if (path) return path;\n  } catch { /* not on PATH */ }\n  return null;\n}\n\nfunction findVscodeRg(): string | null {\n  try {\n    const rgModule = require(\"@vscode/ripgrep\");\n    if (rgModule?.rgPath) return rgModule.rgPath;\n  } catch { /* package not installed */ }\n  return null;\n}\n\nexport function getRgPath(): string | null {\n  if (rgPathCache !== undefined) return rgPathCache;\n  rgPathCache = findSystemRg() || findVscodeRg();\n  return rgPathCache;\n}\n\nexport function isRgAvailable(): boolean {\n  return getRgPath() !== null;\n}\n\n// ============================================================================\n// RIPGREP GREP — content search\n// ============================================================================\n\nexport interface RgGrepOptions {\n  pattern: string;\n  path: string;\n  outputMode?: \"content\" | \"files_with_matches\" | \"count\";\n  glob?: string;\n  type?: string;\n  caseInsensitive?: boolean;\n  multiline?: boolean;\n  context?: number;\n  before?: number;\n  after?: number;\n  headLimit?: number;\n}\n\nexport function rgGrep(opts: RgGrepOptions): string | null {\n  const rg = getRgPath();\n  if (!rg) return null;\n\n  const args: string[] = [];\n\n  // Output mode\n  switch (opts.outputMode) {\n    case \"files_with_matches\": args.push(\"-l\"); break;\n    case \"count\": args.push(\"-c\"); break;\n    case \"content\": args.push(\"-n\"); break;\n    default: args.push(\"-l\"); break;\n  }\n\n  // Case sensitivity\n  if (opts.caseInsensitive) args.push(\"-i\");\n\n  // Multiline\n  if (opts.multiline) {\n    args.push(\"-U\", \"--multiline-dotall\");\n  }\n\n  // Context lines (content mode only)\n  if (opts.outputMode === \"content\") {\n    if (opts.context) args.push(\"-C\", String(opts.context));\n    if (opts.before) args.push(\"-B\", String(opts.before));\n    if (opts.after) args.push(\"-A\", String(opts.after));\n  }\n\n  // File type filter\n  if (opts.type) args.push(\"--type\", opts.type);\n  if (opts.glob) args.push(\"--glob\", opts.glob);\n\n  // Exclusions\n  args.push(\"--glob\", \"!node_modules\", \"--glob\", \"!.git\", \"--glob\", \"!dist\");\n\n  // Pattern and path\n  args.push(\"--\", opts.pattern, opts.path);\n\n  const limit = opts.headLimit || 200;\n\n  try {\n    const output = execFileSync(rg, args, {\n      encoding: \"utf-8\",\n      timeout: 30000,\n      maxBuffer: 2 * 1024 * 1024,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"], // Suppress stderr from leaking to terminal\n    });\n\n    // Apply head limit\n    const lines = output.split(\"\\n\");\n    const limited = lines.slice(0, limit).join(\"\\n\");\n    return limited.trim() || null;\n  } catch (err: any) {\n    // rg exits 1 for \"no matches\" — that's not an error\n    if (err.status === 1) return null;\n    // rg exits 2 for actual errors (permission denied etc.) — don't throw, return null\n    if (err.status === 2) return null;\n    throw err;\n  }\n}\n\n// ============================================================================\n// RIPGREP GLOB — fast file finding\n// ============================================================================\n\nexport interface RgGlobOptions {\n  pattern: string;\n  path: string;\n  headLimit?: number;\n}\n\nexport function rgGlob(opts: RgGlobOptions): string | null {\n  const rg = getRgPath();\n  if (!rg) return null;\n\n  const args = [\n    \"--files\",\n    \"--glob\", opts.pattern,\n    \"--glob\", \"!node_modules\",\n    \"--glob\", \"!.git\",\n    \"--glob\", \"!dist\",\n    opts.path,\n  ];\n\n  const limit = opts.headLimit || 200;\n\n  try {\n    const output = execFileSync(rg, args, {\n      encoding: \"utf-8\",\n      timeout: 10000,\n      maxBuffer: 2 * 1024 * 1024,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"], // Suppress stderr from leaking to terminal\n    });\n\n    const files = output.trim().split(\"\\n\").filter(Boolean);\n    const limited = files.slice(0, limit);\n    return limited.length > 0 ? limited.join(\"\\n\") : null;\n  } catch (err: any) {\n    if (err.status === 1) return null;\n    if (err.status === 2) return null; // Permission errors etc.\n    throw err;\n  }\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,EAAEC,YAAY,QAAQ,eAAe;;AAEtD;AACA;AACA;;AAEA,IAAIC,WAAsC,GAAGC,SAAS,CAAC,CAAC;;AAExD,SAASC,YAAYA,CAAA,EAAkB;EACrC,IAAI;IACF,MAAMC,IAAI,GAAGL,QAAQ,CAAC,UAAU,EAAE;MAAEM,QAAQ,EAAE,OAAO;MAAEC,OAAO,EAAE;IAAK,CAAC,CAAC,CAACC,IAAI,CAAC,CAAC;IAC9E,IAAIH,IAAI,EAAE,OAAOA,IAAI;EACvB,CAAC,CAAC,MAAM,CAAE;EACV,OAAO,IAAI;AACb;AAEA,SAASI,YAAYA,CAAA,EAAkB;EACrC,IAAI;IACF,MAAMC,QAAQ,GAAGC,OAAO,CAAC,iBAAiB,CAAC;IAC3C,IAAID,QAAQ,EAAEE,MAAM,EAAE,OAAOF,QAAQ,CAACE,MAAM;EAC9C,CAAC,CAAC,MAAM,CAAE;EACV,OAAO,IAAI;AACb;AAEA,OAAO,SAASC,SAASA,CAAA,EAAkB;EACzC,IAAIX,WAAW,KAAKC,SAAS,EAAE,OAAOD,WAAW;EACjDA,WAAW,GAAGE,YAAY,CAAC,CAAC,IAAIK,YAAY,CAAC,CAAC;EAC9C,OAAOP,WAAW;AACpB;AAEA,OAAO,SAASY,aAAaA,CAAA,EAAY;EACvC,OAAOD,SAAS,CAAC,CAAC,KAAK,IAAI;AAC7B;;AAEA;AACA;AACA;;AAgBA,OAAO,SAASE,MAAMA,CAACC,IAAmB,EAAiB;EACzD,MAAMC,EAAE,GAAGJ,SAAS,CAAC,CAAC;EACtB,IAAI,CAACI,EAAE,EAAE,OAAO,IAAI;EAEpB,MAAMC,IAAc,GAAG,EAAE;;EAEzB;EACA,QAAQF,IAAI,CAACG,UAAU;IACrB,KAAK,oBAAoB;MAAED,IAAI,CAACE,IAAI,CAAC,IAAI,CAAC;MAAE;IAC5C,KAAK,OAAO;MAAEF,IAAI,CAACE,IAAI,CAAC,IAAI,CAAC;MAAE;IAC/B,KAAK,SAAS;MAAEF,IAAI,CAACE,IAAI,CAAC,IAAI,CAAC;MAAE;IACjC;MAASF,IAAI,CAACE,IAAI,CAAC,IAAI,CAAC;MAAE;EAC5B;;EAEA;EACA,IAAIJ,IAAI,CAACK,eAAe,EAAEH,IAAI,CAACE,IAAI,CAAC,IAAI,CAAC;;EAEzC;EACA,IAAIJ,IAAI,CAACM,SAAS,EAAE;IAClBJ,IAAI,CAACE,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC;EACvC;;EAEA;EACA,IAAIJ,IAAI,CAACG,UAAU,KAAK,SAAS,EAAE;IACjC,IAAIH,IAAI,CAACO,OAAO,EAAEL,IAAI,CAACE,IAAI,CAAC,IAAI,EAAEI,MAAM,CAACR,IAAI,CAACO,OAAO,CAAC,CAAC;IACvD,IAAIP,IAAI,CAACS,MAAM,EAAEP,IAAI,CAACE,IAAI,CAAC,IAAI,EAAEI,MAAM,CAACR,IAAI,CAACS,MAAM,CAAC,CAAC;IACrD,IAAIT,IAAI,CAACU,KAAK,EAAER,IAAI,CAACE,IAAI,CAAC,IAAI,EAAEI,MAAM,CAACR,IAAI,CAACU,KAAK,CAAC,CAAC;EACrD;;EAEA;EACA,IAAIV,IAAI,CAACW,IAAI,EAAET,IAAI,CAACE,IAAI,CAAC,QAAQ,EAAEJ,IAAI,CAACW,IAAI,CAAC;EAC7C,IAAIX,IAAI,CAACY,IAAI,EAAEV,IAAI,CAACE,IAAI,CAAC,QAAQ,EAAEJ,IAAI,CAACY,IAAI,CAAC;;EAE7C;EACAV,IAAI,CAACE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;;EAE1E;EACAF,IAAI,CAACE,IAAI,CAAC,IAAI,EAAEJ,IAAI,CAACa,OAAO,EAAEb,IAAI,CAACX,IAAI,CAAC;EAExC,MAAMyB,KAAK,GAAGd,IAAI,CAACe,SAAS,IAAI,GAAG;EAEnC,IAAI;IACF,MAAMC,MAAM,GAAG/B,YAAY,CAACgB,EAAE,EAAEC,IAAI,EAAE;MACpCZ,QAAQ,EAAE,OAAO;MACjBC,OAAO,EAAE,KAAK;MACd0B,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;MAC1BC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAE;IACnC,CAAC,CAAC;;IAEF;IACA,MAAMC,KAAK,GAAGH,MAAM,CAACI,KAAK,CAAC,IAAI,CAAC;IAChC,MAAMC,OAAO,GAAGF,KAAK,CAACG,KAAK,CAAC,CAAC,EAAER,KAAK,CAAC,CAACS,IAAI,CAAC,IAAI,CAAC;IAChD,OAAOF,OAAO,CAAC7B,IAAI,CAAC,CAAC,IAAI,IAAI;EAC/B,CAAC,CAAC,OAAOgC,GAAQ,EAAE;IACjB;IACA,IAAIA,GAAG,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;IACjC;IACA,IAAID,GAAG,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;IACjC,MAAMD,GAAG;EACX;AACF;;AAEA;AACA;AACA;;AAQA,OAAO,SAASE,MAAMA,CAAC1B,IAAmB,EAAiB;EACzD,MAAMC,EAAE,GAAGJ,SAAS,CAAC,CAAC;EACtB,IAAI,CAACI,EAAE,EAAE,OAAO,IAAI;EAEpB,MAAMC,IAAI,GAAG,CACX,SAAS,EACT,QAAQ,EAAEF,IAAI,CAACa,OAAO,EACtB,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjBb,IAAI,CAACX,IAAI,CACV;EAED,MAAMyB,KAAK,GAAGd,IAAI,CAACe,SAAS,IAAI,GAAG;EAEnC,IAAI;IACF,MAAMC,MAAM,GAAG/B,YAAY,CAACgB,EAAE,EAAEC,IAAI,EAAE;MACpCZ,QAAQ,EAAE,OAAO;MACjBC,OAAO,EAAE,KAAK;MACd0B,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;MAC1BC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAE;IACnC,CAAC,CAAC;IAEF,MAAMS,KAAK,GAAGX,MAAM,CAACxB,IAAI,CAAC,CAAC,CAAC4B,KAAK,CAAC,IAAI,CAAC,CAACQ,MAAM,CAACC,OAAO,CAAC;IACvD,MAAMR,OAAO,GAAGM,KAAK,CAACL,KAAK,CAAC,CAAC,EAAER,KAAK,CAAC;IACrC,OAAOO,OAAO,CAACS,MAAM,GAAG,CAAC,GAAGT,OAAO,CAACE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;EACvD,CAAC,CAAC,OAAOC,GAAQ,EAAE;IACjB,IAAIA,GAAG,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;IACjC,IAAID,GAAG,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC;IACnC,MAAMD,GAAG;EACX;AACF","ignoreList":[]}

package/dist/cli/services/sandbox.d.ts

@@ -4,7 +4,7 @@
  * Restricts file writes to:
  *   - Current working directory (cwd)
  *   - /tmp and /private/tmp
- *   - ~/.swagmanager/
+ *   - ~/.whale/
  *   - /dev (for terminal I/O)
  *   - /private/var/folders (macOS temp)
  *

package/dist/cli/services/sandbox.js

@@ -4,94 +4,115 @@
  * Restricts file writes to:
  *   - Current working directory (cwd)
  *   - /tmp and /private/tmp
- *   - ~/.swagmanager/
+ *   - ~/.whale/
  *   - /dev (for terminal I/O)
  *   - /private/var/folders (macOS temp)
  *
  * Allows all reads and network access.
  * Only active on macOS. Linux: passthrough (future work).
  */
+
 import { writeFileSync, unlinkSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
+import { APP_DATA_DIR, SANDBOX_DIR } from "./paths.js";
+
 // ============================================================================
 // SANDBOX PROFILE
 // ============================================================================
+
 function buildSandboxProfile(cwd) {
-    const home = homedir();
-    return `(version 1)
+  const home = homedir();
+  return `(version 1)
 (allow default)
 (deny file-write*)
 (allow file-write* (subpath "${cwd}"))
 (allow file-write* (subpath "/tmp"))
 (allow file-write* (subpath "/private/tmp"))
-(allow file-write* (subpath "${home}/.swagmanager"))
+(allow file-write* (subpath "${APP_DATA_DIR}"))
 (allow file-write* (subpath "/dev"))
 (allow file-write* (subpath "/private/var/folders"))
 `;
 }
+
 // ============================================================================
 // TEMP PROFILE MANAGEMENT
 // ============================================================================
-const SANDBOX_DIR = join(homedir(), ".swagmanager", "sandbox");
+
+// SANDBOX_DIR imported from paths.ts
 let profileCounter = 0;
 function writeTempProfile(profile) {
-    if (!existsSync(SANDBOX_DIR)) {
-        mkdirSync(SANDBOX_DIR, { recursive: true });
-    }
-    const profilePath = join(SANDBOX_DIR, `profile-${process.pid}-${profileCounter++}.sb`);
-    writeFileSync(profilePath, profile, "utf-8");
-    return profilePath;
+  if (!existsSync(SANDBOX_DIR)) {
+    mkdirSync(SANDBOX_DIR, {
+      recursive: true
+    });
+  }
+  const profilePath = join(SANDBOX_DIR, `profile-${process.pid}-${profileCounter++}.sb`);
+  writeFileSync(profilePath, profile, "utf-8");
+  return profilePath;
 }
 function cleanupProfile(profilePath) {
-    try {
-        if (existsSync(profilePath))
-            unlinkSync(profilePath);
-    }
-    catch { /* best effort */ }
+  try {
+    if (existsSync(profilePath)) unlinkSync(profilePath);
+  } catch {/* best effort */}
 }
+
 // ============================================================================
 // SHELL ESCAPING
 // ============================================================================
+
 function shellEscape(s) {
-    // Use single quotes and escape any existing single quotes
-    return "'" + s.replace(/'/g, "'\\''") + "'";
+  // Use single quotes and escape any existing single quotes
+  return "'" + s.replace(/'/g, "'\\''") + "'";
 }
+
 // ============================================================================
 // PUBLIC API
 // ============================================================================
+
 /**
  * Wrap a command with macOS sandbox-exec.
  * Returns the original command unchanged on non-macOS platforms.
  */
 export function sandboxCommand(command, cwd) {
-    if (process.platform !== "darwin") {
-        return { wrapped: command, profilePath: null };
-    }
-    const profile = buildSandboxProfile(cwd);
-    const profilePath = writeTempProfile(profile);
-    const wrapped = `sandbox-exec -f ${shellEscape(profilePath)} /bin/bash -c ${shellEscape(command)}`;
-    return { wrapped, profilePath };
+  if (process.platform !== "darwin") {
+    return {
+      wrapped: command,
+      profilePath: null
+    };
+  }
+  const profile = buildSandboxProfile(cwd);
+  const profilePath = writeTempProfile(profile);
+  const wrapped = `sandbox-exec -f ${shellEscape(profilePath)} /bin/bash -c ${shellEscape(command)}`;
+  return {
+    wrapped,
+    profilePath
+  };
 }
+
 /**
  * Clean up sandbox profile after command execution.
  */
 export function cleanupSandbox(profilePath) {
-    if (profilePath)
-        cleanupProfile(profilePath);
+  if (profilePath) cleanupProfile(profilePath);
 }
+
 /**
  * Check if sandbox-exec is available on this platform.
  */
 export function isSandboxAvailable() {
-    if (process.platform !== "darwin")
-        return false;
-    try {
-        const { execSync } = require("child_process");
-        execSync("which sandbox-exec", { stdio: "pipe", timeout: 3000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
+  if (process.platform !== "darwin") return false;
+  try {
+    const {
+      execSync
+    } = require("child_process");
+    execSync("which sandbox-exec", {
+      stdio: "pipe",
+      timeout: 3000
+    });
+    return true;
+  } catch {
+    return false;
+  }
 }
+//# sourceMappingURL=sandbox.js.map

package/dist/cli/services/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","names":["writeFileSync","unlinkSync","existsSync","mkdirSync","join","homedir","APP_DATA_DIR","SANDBOX_DIR","buildSandboxProfile","cwd","home","profileCounter","writeTempProfile","profile","recursive","profilePath","process","pid","cleanupProfile","shellEscape","s","replace","sandboxCommand","command","platform","wrapped","cleanupSandbox","isSandboxAvailable","execSync","require","stdio","timeout"],"sources":["../../../src/cli/services/sandbox.ts"],"sourcesContent":["/**\n * Bash Sandbox — macOS sandbox-exec wrapper for shell commands\n *\n * Restricts file writes to:\n *   - Current working directory (cwd)\n *   - /tmp and /private/tmp\n *   - ~/.whale/\n *   - /dev (for terminal I/O)\n *   - /private/var/folders (macOS temp)\n *\n * Allows all reads and network access.\n * Only active on macOS. Linux: passthrough (future work).\n */\n\nimport { writeFileSync, unlinkSync, existsSync, mkdirSync } from \"fs\";\nimport { join } from \"path\";\nimport { homedir } from \"os\";\nimport { APP_DATA_DIR, SANDBOX_DIR } from \"./paths.js\";\n\n// ============================================================================\n// SANDBOX PROFILE\n// ============================================================================\n\nfunction buildSandboxProfile(cwd: string): string {\n  const home = homedir();\n  return `(version 1)\n(allow default)\n(deny file-write*)\n(allow file-write* (subpath \"${cwd}\"))\n(allow file-write* (subpath \"/tmp\"))\n(allow file-write* (subpath \"/private/tmp\"))\n(allow file-write* (subpath \"${APP_DATA_DIR}\"))\n(allow file-write* (subpath \"/dev\"))\n(allow file-write* (subpath \"/private/var/folders\"))\n`;\n}\n\n// ============================================================================\n// TEMP PROFILE MANAGEMENT\n// ============================================================================\n\n// SANDBOX_DIR imported from paths.ts\nlet profileCounter = 0;\n\nfunction writeTempProfile(profile: string): string {\n  if (!existsSync(SANDBOX_DIR)) {\n    mkdirSync(SANDBOX_DIR, { recursive: true });\n  }\n  const profilePath = join(SANDBOX_DIR, `profile-${process.pid}-${profileCounter++}.sb`);\n  writeFileSync(profilePath, profile, \"utf-8\");\n  return profilePath;\n}\n\nfunction cleanupProfile(profilePath: string): void {\n  try {\n    if (existsSync(profilePath)) unlinkSync(profilePath);\n  } catch { /* best effort */ }\n}\n\n// ============================================================================\n// SHELL ESCAPING\n// ============================================================================\n\nfunction shellEscape(s: string): string {\n  // Use single quotes and escape any existing single quotes\n  return \"'\" + s.replace(/'/g, \"'\\\\''\") + \"'\";\n}\n\n// ============================================================================\n// PUBLIC API\n// ============================================================================\n\n/**\n * Wrap a command with macOS sandbox-exec.\n * Returns the original command unchanged on non-macOS platforms.\n */\nexport function sandboxCommand(command: string, cwd: string): { wrapped: string; profilePath: string | null } {\n  if (process.platform !== \"darwin\") {\n    return { wrapped: command, profilePath: null };\n  }\n\n  const profile = buildSandboxProfile(cwd);\n  const profilePath = writeTempProfile(profile);\n\n  const wrapped = `sandbox-exec -f ${shellEscape(profilePath)} /bin/bash -c ${shellEscape(command)}`;\n\n  return { wrapped, profilePath };\n}\n\n/**\n * Clean up sandbox profile after command execution.\n */\nexport function cleanupSandbox(profilePath: string | null): void {\n  if (profilePath) cleanupProfile(profilePath);\n}\n\n/**\n * Check if sandbox-exec is available on this platform.\n */\nexport function isSandboxAvailable(): boolean {\n  if (process.platform !== \"darwin\") return false;\n  try {\n    const { execSync } = require(\"child_process\");\n    execSync(\"which sandbox-exec\", { stdio: \"pipe\", timeout: 3000 });\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,aAAa,EAAEC,UAAU,EAAEC,UAAU,EAAEC,SAAS,QAAQ,IAAI;AACrE,SAASC,IAAI,QAAQ,MAAM;AAC3B,SAASC,OAAO,QAAQ,IAAI;AAC5B,SAASC,YAAY,EAAEC,WAAW,QAAQ,YAAY;;AAEtD;AACA;AACA;;AAEA,SAASC,mBAAmBA,CAACC,GAAW,EAAU;EAChD,MAAMC,IAAI,GAAGL,OAAO,CAAC,CAAC;EACtB,OAAO;AACT;AACA;AACA,+BAA+BI,GAAG;AAClC;AACA;AACA,+BAA+BH,YAAY;AAC3C;AACA;AACA,CAAC;AACD;;AAEA;AACA;AACA;;AAEA;AACA,IAAIK,cAAc,GAAG,CAAC;AAEtB,SAASC,gBAAgBA,CAACC,OAAe,EAAU;EACjD,IAAI,CAACX,UAAU,CAACK,WAAW,CAAC,EAAE;IAC5BJ,SAAS,CAACI,WAAW,EAAE;MAAEO,SAAS,EAAE;IAAK,CAAC,CAAC;EAC7C;EACA,MAAMC,WAAW,GAAGX,IAAI,CAACG,WAAW,EAAE,WAAWS,OAAO,CAACC,GAAG,IAAIN,cAAc,EAAE,KAAK,CAAC;EACtFX,aAAa,CAACe,WAAW,EAAEF,OAAO,EAAE,OAAO,CAAC;EAC5C,OAAOE,WAAW;AACpB;AAEA,SAASG,cAAcA,CAACH,WAAmB,EAAQ;EACjD,IAAI;IACF,IAAIb,UAAU,CAACa,WAAW,CAAC,EAAEd,UAAU,CAACc,WAAW,CAAC;EACtD,CAAC,CAAC,MAAM,CAAE;AACZ;;AAEA;AACA;AACA;;AAEA,SAASI,WAAWA,CAACC,CAAS,EAAU;EACtC;EACA,OAAO,GAAG,GAAGA,CAAC,CAACC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG;AAC7C;;AAEA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAACC,OAAe,EAAEd,GAAW,EAAmD;EAC5G,IAAIO,OAAO,CAACQ,QAAQ,KAAK,QAAQ,EAAE;IACjC,OAAO;MAAEC,OAAO,EAAEF,OAAO;MAAER,WAAW,EAAE;IAAK,CAAC;EAChD;EAEA,MAAMF,OAAO,GAAGL,mBAAmB,CAACC,GAAG,CAAC;EACxC,MAAMM,WAAW,GAAGH,gBAAgB,CAACC,OAAO,CAAC;EAE7C,MAAMY,OAAO,GAAG,mBAAmBN,WAAW,CAACJ,WAAW,CAAC,iBAAiBI,WAAW,CAACI,OAAO,CAAC,EAAE;EAElG,OAAO;IAAEE,OAAO;IAAEV;EAAY,CAAC;AACjC;;AAEA;AACA;AACA;AACA,OAAO,SAASW,cAAcA,CAACX,WAA0B,EAAQ;EAC/D,IAAIA,WAAW,EAAEG,cAAc,CAACH,WAAW,CAAC;AAC9C;;AAEA;AACA;AACA;AACA,OAAO,SAASY,kBAAkBA,CAAA,EAAY;EAC5C,IAAIX,OAAO,CAACQ,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;EAC/C,IAAI;IACF,MAAM;MAAEI;IAAS,CAAC,GAAGC,OAAO,CAAC,eAAe,CAAC;IAC7CD,QAAQ,CAAC,oBAAoB,EAAE;MAAEE,KAAK,EAAE,MAAM;MAAEC,OAAO,EAAE;IAAK,CAAC,CAAC;IAChE,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF","ignoreList":[]}