/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import os from 'node:os';
import path from 'node:path';
import { sanitizeEnvironment, getSecureSanitizationConfig, } from './environmentSanitization.js';
/**
 * Files that represent the governance or "constitution" of the repository
 * and should be write-protected in any sandbox.
 */
export const GOVERNANCE_FILES = [
    { path: '.gitignore', isDirectory: false },
    { path: '.geminiignore', isDirectory: false },
    { path: '.git', isDirectory: true },
];
/**
 * A no-op implementation of SandboxManager that silently passes commands
 * through while applying environment sanitization.
 */
export class NoopSandboxManager {
    /**
     * Prepares a command by sanitizing the environment and passing through
     * the original program and arguments.
     */
    async prepareCommand(req) {
        const sanitizationConfig = getSecureSanitizationConfig(req.policy?.sanitizationConfig);
        const sanitizedEnv = sanitizeEnvironment(req.env, sanitizationConfig);
        return {
            program: req.command,
            args: req.args,
            env: sanitizedEnv,
        };
    }
}
/**
 * SandboxManager that implements actual sandboxing.
 */
export class LocalSandboxManager {
    async prepareCommand(_req) {
        throw new Error('Tool sandboxing is not yet implemented.');
    }
}
/**
 * Sanitizes an array of paths by deduplicating them and ensuring they are absolute.
 */
export function sanitizePaths(paths) {
    if (!paths)
        return undefined;
    // We use a Map to deduplicate paths based on their normalized,
    // platform-specific identity e.g. handling case-insensitivity on Windows)
    // while preserving the original string casing.
    const uniquePathsMap = new Map();
    for (const p of paths) {
        if (!path.isAbsolute(p)) {
            throw new Error(`Sandbox path must be absolute: ${p}`);
        }
        // Normalize the path (resolves slashes and redundant components)
        let key = path.normalize(p);
        // Windows file systems are case-insensitive, so we lowercase the key for
        // deduplication
        if (os.platform() === 'win32') {
            key = key.toLowerCase();
        }
        if (!uniquePathsMap.has(key)) {
            uniquePathsMap.set(key, p);
        }
    }
    return Array.from(uniquePathsMap.values());
}
export { createSandboxManager } from './sandboxManagerFactory.js';
//# sourceMappingURL=sandboxManager.js.map