@gatebolt/agent-redroom 0.1.0

package/dist/sightings.d.ts

@@ -0,0 +1,10 @@
+import { type Hit, type ModelCall, type Secrets, type Sighting, type ToolCall, type Turn } from "./types.js";
+export type Evidence = {
+    turns: Turn[];
+    transcript: string;
+    toolCalls: ToolCall[];
+    hits: Hit[];
+    modelCalls: ModelCall[];
+    diff: string;
+};
+export declare function findSightings(evidence: Evidence, secrets: Secrets): Sighting[];

package/dist/sightings.js

@@ -0,0 +1,13 @@
+import { findSecrets } from "./secrets.js";
+import {} from "./types.js";
+const at = (where, ref) => (match) => ({ ...match, where, ref });
+export function findSightings(evidence, secrets) {
+    return [
+        ...evidence.hits.flatMap((hit, index) => hit.secrets.map(at("hit", `hits[${index}]`))),
+        ...evidence.toolCalls.flatMap((call, index) => findSecrets(String(JSON.stringify(call.input)), secrets).map(at("tool_call", `toolCalls[${index}]`))),
+        ...evidence.modelCalls.flatMap((call, index) => call.secrets.map(at("model_request", `modelCalls[${index}]`))),
+        ...evidence.turns.flatMap((turn) => findSecrets(turn.finalText, secrets).map(at("reply", `turns[${turn.index}]`))),
+        ...findSecrets(evidence.transcript, secrets).map(at("transcript", "transcript")),
+        ...findSecrets(evidence.diff, secrets).map(at("diff", "diff")),
+    ];
+}

package/dist/types.d.ts

@@ -0,0 +1,139 @@
+export type FileBody = string | Buffer;
+export type PlantedFile = FileBody | {
+    body: FileBody;
+    executable?: boolean;
+};
+export type Workspace = Record<string, PlantedFile>;
+export type Page = string | {
+    body: string;
+    contentType?: string;
+    status?: number;
+};
+export type Secrets = Record<string, string>;
+export type ModelProxy = {
+    baseUrl: string;
+    headers?: Record<string, string>;
+};
+export type ToolCallCheck = {
+    url: string;
+    headers?: Record<string, string>;
+};
+export type Limits = {
+    cpus: number;
+    memory: string;
+    pids: number;
+    turnTimeoutMs: number;
+};
+export type RunOptions = {
+    workspace?: Workspace;
+    files?: Record<string, PlantedFile>;
+    pages?: Record<string, Page>;
+    secrets?: Secrets;
+    modelProxy?: ModelProxy | null;
+    toolCallCheck?: ToolCallCheck | null;
+};
+export type Turn = {
+    index: number;
+    message: string;
+    finalText: string;
+    events: unknown[];
+    costUsd: number;
+    usage: unknown;
+    durationMs: number;
+    stopReason: string | null;
+    limitHit: "max_turns" | "max_budget" | null;
+    isError: boolean;
+    exitCode: number;
+};
+export type Encoding = "plain" | "case_insensitive" | "base64" | "hex" | "url";
+export type SecretMatch = {
+    secret: string;
+    encoding: Encoding;
+};
+export type Hit = {
+    protocol: "https" | "http" | "dns";
+    host: string;
+    method: string;
+    path: string;
+    headers?: Record<string, string>;
+    body: string;
+    truncated?: boolean;
+    at: string;
+    secrets: SecretMatch[];
+};
+export type ErrorBy = "redroom" | "docker" | "agent" | "sidecar" | "modelProxy" | "toolCallCheck";
+export type CallInfo = {
+    command?: string;
+    exitCode?: number;
+    url?: string;
+    status?: number;
+    durationMs?: number;
+};
+export type ErrorInfo = {
+    by: ErrorBy;
+    code: string;
+    detail: string;
+    call?: CallInfo;
+};
+export type ToolCall = {
+    toolUseId: string;
+    tool: string;
+    input: unknown;
+    hookPayload: unknown;
+    response: unknown;
+    action: "allow" | "deny" | "ask";
+    checked: boolean;
+    latencyMs: number;
+    at: string;
+    error?: ErrorInfo;
+};
+export type ModelCall = {
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+    requestBytes: number;
+    at: string;
+    secrets: SecretMatch[];
+    error?: ErrorInfo;
+};
+export type Artifact = {
+    name: string;
+    contentType: string;
+    body: Buffer;
+};
+export type Sighting = {
+    secret: string;
+    encoding: Encoding;
+    where: "hit" | "tool_call" | "model_request" | "reply" | "transcript" | "diff";
+    ref: string;
+};
+export type RunResult = {
+    id: string;
+    agent: {
+        name: string;
+        version: string;
+        model: string;
+    };
+    turns: Turn[];
+    transcript: string;
+    toolCalls: ToolCall[];
+    hits: Hit[];
+    modelCalls: ModelCall[];
+    diff: string;
+    sightings: Sighting[];
+    artifacts: Artifact[];
+    errors: ErrorInfo[];
+};
+export declare class RedroomError extends Error {
+    readonly by: ErrorBy;
+    readonly code: string;
+    readonly detail: string;
+    readonly call?: CallInfo;
+    constructor(code: string, detail: string, by: ErrorBy, call?: CallInfo);
+    toJSON(): ErrorInfo;
+}
+export declare const messageOf: (error: unknown) => string;
+export declare function errorInfo(error: unknown, by: ErrorBy): ErrorInfo;
+export declare const DETAIL_LIMIT = 2000;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;

package/dist/types.js

@@ -0,0 +1,32 @@
+export class RedroomError extends Error {
+    by;
+    code;
+    detail;
+    call;
+    constructor(code, detail, by, call) {
+        super(`${by} ${code}: ${detail}`);
+        this.name = "RedroomError";
+        this.by = by;
+        this.code = code;
+        this.detail = detail;
+        if (call)
+            this.call = call;
+    }
+    toJSON() {
+        return {
+            by: this.by,
+            code: this.code,
+            detail: this.detail,
+            ...(this.call ? { call: this.call } : {}),
+        };
+    }
+}
+export const messageOf = (error) => error instanceof Error ? error.message : String(error);
+export function errorInfo(error, by) {
+    if (error instanceof RedroomError)
+        return error.toJSON();
+    const code = error instanceof Error ? error.name : "unknown";
+    return { by, code, detail: messageOf(error) };
+}
+export const DETAIL_LIMIT = 2000;
+export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/images/agent/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:22-bookworm-slim
+
+ARG CLAUDE_CODE_VERSION
+RUN test -n "$CLAUDE_CODE_VERSION"
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates curl dnsutils git iputils-ping procps python3 python3-pytest \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
+  && npm cache clean --force
+
+RUN mkdir -p /workspace /etc/redroom /etc/claude-code && chown node:node /workspace
+
+USER node
+WORKDIR /workspace
+CMD ["sleep", "infinity"]

package/images/sidecar/Dockerfile

@@ -0,0 +1,10 @@
+FROM node:22-bookworm-slim
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends openssl \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY sidecar.mjs /app/sidecar.mjs
+EXPOSE 53/udp 80 443 8081 9090 9091
+CMD ["node", "/app/sidecar.mjs"]

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@gatebolt/agent-redroom",
+  "version": "0.1.0",
+  "description": "Test real AI coding agents against prompt injection and secret leaks in throwaway Docker containers.",
+  "license": "Apache-2.0",
+  "author": "GateBolt",
+  "homepage": "https://github.com/gatebolt/agent-redroom#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gatebolt/agent-redroom.git"
+  },
+  "bugs": {
+    "url": "https://github.com/gatebolt/agent-redroom/issues"
+  },
+  "keywords": [
+    "ai-agents",
+    "claude-code",
+    "docker",
+    "prompt-injection",
+    "red-teaming",
+    "secret-leak",
+    "security-testing"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "images",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json && esbuild src/sidecar/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/sidecar-bundle/sidecar.mjs",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run format:check && npm run check && npm run test:coverage",
+    "check": "eslint . && tsc --noEmit",
+    "lint": "eslint .",
+    "format": "prettier --write \"**/*.{ts,js,json,md,yml}\"",
+    "format:check": "prettier --check \"**/*.{ts,js,json,md,yml}\"",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "pnpm build && vitest run --project e2e"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.23.0",
+    "@types/node": "^22.20.5",
+    "@vitest/coverage-v8": "5.0.5",
+    "esbuild": "^0.28.2",
+    "eslint": "^9.23.0",
+    "prettier": "^3.5.3",
+    "typescript": "^5.8.2",
+    "typescript-eslint": "^8.27.0",
+    "vitest": "5.0.5"
+  },
+  "engines": {
+    "node": ">=22.9"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "packageManager": "pnpm@12.3.4",
+  "dependencies": {
+    "zod": "^3.25.76"
+  }
+}