wotann 0.5.0

package/dist/sandbox/backends/landlock-linux.js

@@ -0,0 +1,284 @@
+/**
+ * Linux Landlock LSM sandbox backend.
+ *
+ * Landlock is a kernel-level Mandatory Access Control mechanism (Linux
+ * 5.13+, with extended ABI in 5.19, 6.1, and 6.7). It lets unprivileged
+ * processes restrict themselves and their children — perfect for
+ * sandboxing without root/capabilities.
+ *
+ * This backend prefers an external CLI helper named `landlock-restrict`
+ * (a Rust binary widely available; see github.com/landlock-lsm).
+ * Bindings to the kernel syscall (#444) from Node would require a
+ * native addon (@landlock/landlock-rs) which we do not bundle. When no
+ * helper is available we return an honest stub so the facade can fall
+ * back to docker.
+ *
+ * Kernel feature detection happens via /proc/kernel/security/landlock.
+ * If the path doesn't exist Landlock is not configured in the running
+ * kernel. We never claim "enforced" without that proof.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { validatePolicy, } from "../sandbox-policy.js";
+const LANDLOCK_FEATURE_PATH = "/sys/kernel/security/landlock";
+const BACKEND_NAME = "landlock";
+/**
+ * Detect whether the running kernel has Landlock support enabled.
+ *
+ * Visible for tests.
+ */
+export function detectLandlockSupport(filesystem = { existsSync }) {
+    if (process.platform !== "linux")
+        return false;
+    return filesystem.existsSync(LANDLOCK_FEATURE_PATH);
+}
+// ── Helper-binary discovery ────────────────────────────
+const HELPER_BINARY_NAMES = ["landlock-restrict", "landlock-sandboxer"];
+/**
+ * Try to find an installed Landlock helper binary on $PATH. We use
+ * `which` rather than reaching into PATH ourselves to keep the lookup
+ * portable across distros that handle PATH oddly.
+ */
+async function locateHelperBinary() {
+    for (const name of HELPER_BINARY_NAMES) {
+        const found = await whichBinary(name);
+        if (found)
+            return found;
+    }
+    return null;
+}
+function whichBinary(name) {
+    return new Promise((resolveFn) => {
+        const child = spawn("/usr/bin/which", [name], {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let out = "";
+        child.stdout.on("data", (chunk) => {
+            out += chunk.toString("utf8");
+        });
+        child.on("error", () => resolveFn(null));
+        child.on("exit", (code) => {
+            if (code === 0) {
+                const path = out.trim().split("\n")[0] ?? "";
+                if (path.length > 0 && existsSync(path)) {
+                    resolveFn(path);
+                    return;
+                }
+            }
+            resolveFn(null);
+        });
+    });
+}
+// ── Argument construction ──────────────────────────────
+/**
+ * Build CLI args for `landlock-restrict`. Format mirrors the upstream
+ * tool: `--ro <path>`, `--rw <path>`, `--no-net` etc.
+ *
+ * Visible for tests.
+ */
+export function buildHelperArgs(policy) {
+    const args = [];
+    for (const p of policy.allowedReadPaths) {
+        args.push("--ro", p);
+    }
+    for (const p of policy.allowedWritePaths) {
+        args.push("--rw", p);
+    }
+    switch (policy.network) {
+        case "none":
+            args.push("--no-net");
+            break;
+        case "loopback":
+            args.push("--net-loopback-only");
+            break;
+        case "restricted":
+            // Helper currently only supports loopback or all; restricted is
+            // approximated as loopback-only with the caller responsible for
+            // additional userspace filtering.
+            args.push("--net-loopback-only");
+            break;
+        case "full":
+            // No network restriction
+            break;
+    }
+    if (policy.allowChildProcesses === false) {
+        args.push("--no-fork");
+    }
+    args.push("--cwd", policy.workingDirectory);
+    args.push("--timeout", String(policy.timeoutSeconds ?? 60));
+    args.push("--memory-mb", String(policy.memoryLimitMb ?? 512));
+    return args;
+}
+export function createLandlockBackend(opts = {}) {
+    const platformOk = process.platform === "linux";
+    const kernelOk = opts.forceAvailable ?? detectLandlockSupport();
+    let cachedBinary = undefined;
+    const resolveBinary = async () => {
+        if (cachedBinary !== undefined)
+            return cachedBinary;
+        if (opts.helperBinary) {
+            cachedBinary = existsSync(opts.helperBinary) ? opts.helperBinary : null;
+            return cachedBinary;
+        }
+        cachedBinary = await locateHelperBinary();
+        return cachedBinary;
+    };
+    const backend = {
+        name: BACKEND_NAME,
+        unavailableReason: !platformOk
+            ? `Landlock is Linux-only; current platform is ${process.platform}`
+            : !kernelOk
+                ? "Linux Landlock LSM not available; kernel 5.13+ with CONFIG_SECURITY_LANDLOCK=y required"
+                : undefined,
+        async isAvailable() {
+            if (!platformOk || !kernelOk)
+                return false;
+            const bin = await resolveBinary();
+            return bin !== null;
+        },
+        async run(command, policy) {
+            if (!platformOk) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: `landlock unavailable: not Linux (${process.platform})`,
+                };
+            }
+            if (!kernelOk) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: "landlock unavailable: kernel 5.13+ with CONFIG_SECURITY_LANDLOCK=y required",
+                };
+            }
+            const validated = validatePolicy(policy);
+            if (!validated.ok) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: `policy validation failed: ${validated.reason}`,
+                };
+            }
+            if (command.length === 0) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: "command must not be empty",
+                };
+            }
+            const helper = await resolveBinary();
+            if (!helper) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: "landlock helper binary not found on PATH (tried landlock-restrict, landlock-sandboxer)",
+                };
+            }
+            return runWithHelper(helper, command, validated.policy);
+        },
+    };
+    return backend;
+}
+async function runWithHelper(helperBinary, command, policy) {
+    const helperArgs = buildHelperArgs(policy);
+    // Final invocation: helper [helperArgs] -- [command...]
+    const args = [...helperArgs, "--", ...command];
+    const env = buildEnv(policy);
+    const timeoutMs = (policy.timeoutSeconds ?? 60) * 1000 + 5000; // grace
+    return runProcess(helperBinary, args, {
+        cwd: policy.workingDirectory,
+        env,
+        timeoutMs,
+    });
+}
+function buildEnv(policy) {
+    const base = {
+        PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+        HOME: policy.workingDirectory,
+        LANG: "C.UTF-8",
+        WOTANN_SANDBOX_ACTIVE: "1",
+    };
+    if (policy.env) {
+        for (const [k, v] of Object.entries(policy.env)) {
+            base[k] = v;
+        }
+    }
+    return base;
+}
+async function runProcess(binary, args, opts) {
+    return new Promise((resolveFn) => {
+        const child = spawn(binary, args, {
+            cwd: opts.cwd,
+            env: opts.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                /* noop */
+            }
+        }, opts.timeoutMs);
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolveFn({
+                ok: false,
+                exitCode: null,
+                stdout,
+                stderr: stderr + (stderr ? "\n" : "") + (err instanceof Error ? err.message : String(err)),
+                timedOut,
+                enforced: false,
+                backend: BACKEND_NAME,
+            });
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            resolveFn({
+                ok: !timedOut && code === 0,
+                exitCode: code,
+                stdout,
+                stderr,
+                timedOut,
+                enforced: !timedOut,
+                backend: BACKEND_NAME,
+            });
+        });
+    });
+}
+//# sourceMappingURL=landlock-linux.js.map

package/dist/sandbox/backends/landlock-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"landlock-linux.js","sourceRoot":"","sources":["../../../src/sandbox/backends/landlock-linux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIL,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqD,EAAE,UAAU,EAAE;IAEnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AACtD,CAAC;AAED,0DAA0D;AAE1D,MAAM,mBAAmB,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAU,CAAC;AAEjF;;;;GAIG;AACH,KAAK,UAAU,kBAAkB;IAC/B,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE;YAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,SAAS,CAAC,IAAI,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,UAAU;YACb,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,YAAY;YACf,gEAAgE;YAChE,gEAAgE;YAChE,kCAAkC;YAClC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,MAAM;YACT,yBAAyB;YACzB,MAAM;IACV,CAAC;IAED,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,UAAU,qBAAqB,CAAC,OAAwB,EAAE;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;IAEhE,IAAI,YAAY,GAA8B,SAAS,CAAC;IAExD,MAAM,aAAa,GAAG,KAAK,IAA4B,EAAE;QACvD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;QACpD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAyB;QACpC,IAAI,EAAE,YAAY;QAClB,iBAAiB,EAAE,CAAC,UAAU;YAC5B,CAAC,CAAC,+CAA+C,OAAO,CAAC,QAAQ,EAAE;YACnE,CAAC,CAAC,CAAC,QAAQ;gBACT,CAAC,CAAC,yFAAyF;gBAC3F,CAAC,CAAC,SAAS;QACf,KAAK,CAAC,WAAW;YACf,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;YAClC,OAAO,GAAG,KAAK,IAAI,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,oCAAoC,OAAO,CAAC,QAAQ,GAAG;iBAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,6EAA6E;iBACtF,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,6BAA6B,SAAS,CAAC,MAAM,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,2BAA2B;iBACpC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EACJ,wFAAwF;iBAC3F,CAAC;YACJ,CAAC;YAED,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,YAAoB,EACpB,OAA0B,EAC1B,MAA2B;IAE3B,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,wDAAwD;IACxD,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;IACvE,OAAO,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;QACpC,GAAG,EAAE,MAAM,CAAC,gBAAgB;QAC5B,GAAG;QACH,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2B;IAC3C,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,MAAM,CAAC,gBAAgB;QAC7B,IAAI,EAAE,SAAS;QACf,qBAAqB,EAAE,GAAG;KAC3B,CAAC;IACF,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,IAAuB,EACvB,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,CAAC;gBACR,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1F,QAAQ;gBACR,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,CAAC;gBACR,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;gBAC3B,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,QAAQ,EAAE,CAAC,QAAQ;gBACnB,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox/backends/seatbelt-macos.d.ts

@@ -0,0 +1,31 @@
+/**
+ * macOS Seatbelt sandbox backend.
+ *
+ * Wraps `/usr/bin/sandbox-exec` (private but stable Apple API). Generates
+ * a Scheme-style profile from a `KernelSandboxPolicy`, writes it to a
+ * temp file, then runs the user command under sandbox-exec.
+ *
+ * Apple has been "deprecating" sandbox-exec since 2017 but every macOS
+ * release continues to ship it because it's the foundation of Mac App
+ * Store sandboxing. We treat it as the reference implementation for the
+ * kernel-sandbox abstraction on Darwin.
+ */
+import { type KernelSandboxBackend, type KernelSandboxPolicy } from "../sandbox-policy.js";
+/**
+ * Generate a Seatbelt profile (Scheme syntax) from a policy.
+ *
+ * Visible for testing. Defaults to deny-all and then opts in the
+ * paths/network the policy allows.
+ */
+export declare function generateSeatbeltProfile(policy: KernelSandboxPolicy): string;
+interface SeatbeltOptions {
+    /** Optional override for the sandbox-exec binary (used in tests). */
+    readonly seatbeltBinary?: string;
+}
+/**
+ * Create a Seatbelt backend. Caller is responsible for checking
+ * `isAvailable()` before relying on it.
+ */
+export declare function createSeatbeltBackend(opts?: SeatbeltOptions): KernelSandboxBackend;
+export {};
+//# sourceMappingURL=seatbelt-macos.d.ts.map

package/dist/sandbox/backends/seatbelt-macos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbelt-macos.d.ts","sourceRoot":"","sources":["../../../src/sandbox/backends/seatbelt-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGzB,MAAM,sBAAsB,CAAC;AAO9B;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAqE3E;AASD,UAAU,eAAe;IACvB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,eAAoB,GAAG,oBAAoB,CA8DtF"}

package/dist/sandbox/backends/seatbelt-macos.js

@@ -0,0 +1,248 @@
+/**
+ * macOS Seatbelt sandbox backend.
+ *
+ * Wraps `/usr/bin/sandbox-exec` (private but stable Apple API). Generates
+ * a Scheme-style profile from a `KernelSandboxPolicy`, writes it to a
+ * temp file, then runs the user command under sandbox-exec.
+ *
+ * Apple has been "deprecating" sandbox-exec since 2017 but every macOS
+ * release continues to ship it because it's the foundation of Mac App
+ * Store sandboxing. We treat it as the reference implementation for the
+ * kernel-sandbox abstraction on Darwin.
+ */
+import { spawn } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { validatePolicy, } from "../sandbox-policy.js";
+const SEATBELT_BINARY = "/usr/bin/sandbox-exec";
+const BACKEND_NAME = "seatbelt";
+// ── Profile generation ────────────────────────────────
+/**
+ * Generate a Seatbelt profile (Scheme syntax) from a policy.
+ *
+ * Visible for testing. Defaults to deny-all and then opts in the
+ * paths/network the policy allows.
+ */
+export function generateSeatbeltProfile(policy) {
+    const lines = [];
+    lines.push("(version 1)");
+    lines.push("(deny default)");
+    // Always allow process-fork/exec for the sandbox-exec invocation itself.
+    // Without these the wrapper cannot start the child at all.
+    lines.push("(allow process-fork)");
+    lines.push("(allow process-exec)");
+    lines.push("(allow process-info-pidinfo)");
+    lines.push("(allow process-info-setcontrol)");
+    // Sysctls and basic syscalls a typical CLI needs.
+    lines.push("(allow sysctl-read)");
+    lines.push("(allow file-read-metadata)");
+    lines.push("(allow mach-lookup)");
+    lines.push("(allow signal (target self))");
+    lines.push("(allow ipc-posix-shm)");
+    // Read paths
+    for (const p of policy.allowedReadPaths) {
+        lines.push(`(allow file-read* (subpath "${escapeScheme(p)}"))`);
+    }
+    // /usr, /System, /Library are needed for dyld + frameworks. We treat
+    // these as implicit reads. Without them the child process can't even
+    // load libSystem.
+    for (const p of ["/usr", "/System", "/Library", "/private/var/folders", "/private/tmp", "/dev"]) {
+        lines.push(`(allow file-read* (subpath "${p}"))`);
+    }
+    // Write paths
+    for (const p of policy.allowedWritePaths) {
+        lines.push(`(allow file-write* (subpath "${escapeScheme(p)}"))`);
+    }
+    // /private/var/folders is the macOS tmp dir; allow writes there for
+    // standard library temp behaviour.
+    lines.push(`(allow file-write* (subpath "/private/var/folders"))`);
+    lines.push(`(allow file-write* (subpath "/private/tmp"))`);
+    // Network
+    switch (policy.network) {
+        case "none":
+            // Default-deny already covers this; explicit deny for clarity.
+            lines.push("(deny network*)");
+            break;
+        case "loopback":
+            lines.push('(allow network* (local ip "*:*"))');
+            lines.push('(allow network* (remote ip "localhost:*"))');
+            break;
+        case "restricted":
+            lines.push('(allow network* (local ip "*:*"))');
+            for (const ep of policy.allowedNetworkEndpoints ?? []) {
+                lines.push(`(allow network* (remote ip "${escapeScheme(ep)}"))`);
+            }
+            break;
+        case "full":
+            lines.push("(allow network*)");
+            break;
+    }
+    // Child processes
+    if (policy.allowChildProcesses === false) {
+        // Deny additional fork/exec beyond the immediate child. We can't
+        // reliably block sub-fork on macOS without entitlements, but we
+        // include a comment for auditability.
+        lines.push("; allowChildProcesses=false (advisory; macOS lacks per-descendant block)");
+    }
+    return lines.join("\n");
+}
+function escapeScheme(s) {
+    // Scheme-style strings need backslash-escaping for backslash and quote.
+    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+/**
+ * Create a Seatbelt backend. Caller is responsible for checking
+ * `isAvailable()` before relying on it.
+ */
+export function createSeatbeltBackend(opts = {}) {
+    const binary = opts.seatbeltBinary ?? SEATBELT_BINARY;
+    const available = process.platform === "darwin" && existsSync(binary);
+    const backend = {
+        name: BACKEND_NAME,
+        unavailableReason: available
+            ? undefined
+            : process.platform !== "darwin"
+                ? `Seatbelt is macOS-only; current platform is ${process.platform}`
+                : `sandbox-exec not found at ${binary}`,
+        async isAvailable() {
+            return available;
+        },
+        async run(command, policy) {
+            if (!available) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: process.platform !== "darwin"
+                        ? `seatbelt unavailable: not macOS (${process.platform})`
+                        : `seatbelt unavailable: ${binary} not found`,
+                };
+            }
+            const validated = validatePolicy(policy);
+            if (!validated.ok) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: `policy validation failed: ${validated.reason}`,
+                };
+            }
+            if (command.length === 0) {
+                return {
+                    ok: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: "",
+                    timedOut: false,
+                    enforced: false,
+                    backend: BACKEND_NAME,
+                    reason: "command must not be empty",
+                };
+            }
+            return runSandboxed(binary, command, validated.policy);
+        },
+    };
+    return backend;
+}
+/**
+ * Run a command inside a freshly-built Seatbelt profile.
+ */
+async function runSandboxed(binary, command, policy) {
+    const profile = generateSeatbeltProfile(policy);
+    const dir = mkdtempSync(join(tmpdir(), "wotann-seatbelt-"));
+    const profilePath = join(dir, "profile.sb");
+    try {
+        writeFileSync(profilePath, profile, { mode: 0o600 });
+        const args = ["-f", profilePath, "--", ...command];
+        const env = buildSandboxEnv(policy);
+        const timeoutMs = (policy.timeoutSeconds ?? 60) * 1000;
+        return await runProcess(binary, args, {
+            cwd: policy.workingDirectory,
+            env,
+            timeoutMs,
+        });
+    }
+    finally {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // best effort cleanup
+        }
+    }
+}
+function buildSandboxEnv(policy) {
+    const base = {
+        PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+        HOME: policy.workingDirectory,
+        LANG: "C.UTF-8",
+        WOTANN_SANDBOX_ACTIVE: "1",
+    };
+    if (policy.env) {
+        for (const [k, v] of Object.entries(policy.env)) {
+            base[k] = v;
+        }
+    }
+    return base;
+}
+async function runProcess(binary, args, opts) {
+    return new Promise((resolveFn) => {
+        const child = spawn(binary, args, {
+            cwd: opts.cwd,
+            env: opts.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                /* noop */
+            }
+        }, opts.timeoutMs);
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolveFn({
+                ok: false,
+                exitCode: null,
+                stdout,
+                stderr: stderr + (stderr ? "\n" : "") + (err instanceof Error ? err.message : String(err)),
+                timedOut,
+                enforced: !timedOut,
+                backend: BACKEND_NAME,
+            });
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            resolveFn({
+                ok: !timedOut && code === 0,
+                exitCode: code,
+                stdout,
+                stderr,
+                timedOut,
+                enforced: true,
+                backend: BACKEND_NAME,
+            });
+        });
+    });
+}
+//# sourceMappingURL=seatbelt-macos.js.map

package/dist/sandbox/backends/seatbelt-macos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbelt-macos.js","sourceRoot":"","sources":["../../../src/sandbox/backends/seatbelt-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAIL,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC,yDAAyD;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA2B;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE7B,yEAAyE;IACzE,2DAA2D;IAC3D,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAE9C,kDAAkD;IAClD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAEpC,aAAa;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,qEAAqE;IACrE,qEAAqE;IACrE,kBAAkB;IAClB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,cAAc;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,gCAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,oEAAoE;IACpE,mCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAE3D,UAAU;IACV,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,+DAA+D;YAC/D,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,UAAU;YACb,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACzD,MAAM;QACR,KAAK,YAAY;YACf,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAChD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,uBAAuB,IAAI,EAAE,EAAE,CAAC;gBACtD,KAAK,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YACnE,CAAC;YACD,MAAM;QACR,KAAK,MAAM;YACT,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/B,MAAM;IACV,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QACzC,iEAAiE;QACjE,gEAAgE;QAChE,sCAAsC;QACtC,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,wEAAwE;IACxE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAwB,EAAE;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAyB;QACpC,IAAI,EAAE,YAAY;QAClB,iBAAiB,EAAE,SAAS;YAC1B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAC7B,CAAC,CAAC,+CAA+C,OAAO,CAAC,QAAQ,EAAE;gBACnE,CAAC,CAAC,6BAA6B,MAAM,EAAE;QAC3C,KAAK,CAAC,WAAW;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EACJ,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBAC3B,CAAC,CAAC,oCAAoC,OAAO,CAAC,QAAQ,GAAG;wBACzD,CAAC,CAAC,yBAAyB,MAAM,YAAY;iBAClD,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,6BAA6B,SAAS,CAAC,MAAM,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,2BAA2B;iBACpC,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,OAA0B,EAC1B,MAA2B;IAE3B,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAEvD,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE;YACpC,GAAG,EAAE,MAAM,CAAC,gBAAgB;YAC5B,GAAG;YACH,SAAS;SACV,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAA2B;IAClD,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,MAAM,CAAC,gBAAgB;QAC7B,IAAI,EAAE,SAAS;QACf,qBAAqB,EAAE,GAAG;KAC3B,CAAC;IACF,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,IAAuB,EACvB,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,CAAC;gBACR,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1F,QAAQ;gBACR,QAAQ,EAAE,CAAC,QAAQ;gBACnB,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,CAAC;gBACR,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;gBAC3B,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}