@jphutchins/code-review 0.1.0-alpha.35 → 0.1.0-alpha.36-rc.0

package/dist/index.js

@@ -2736,6 +2736,32 @@ var composeReviewSettings = (opts) => {
   };
 };
 
+// src/sandbox.ts
+var GITHUB_HOSTS = ["api.github.com", "github.com"];
+var deriveModelHost = (apiBaseUrl) => {
+  const host = URL.canParse(apiBaseUrl) ? new URL(apiBaseUrl).hostname : "";
+  if (host === "") {
+    throw new Error(
+      `could not derive the model host from api_base_url ${JSON.stringify(apiBaseUrl)} \u2014 expected a URL like https://api.deepseek.com/anthropic`
+    );
+  }
+  return host;
+};
+var parseExtraEndpoints = (extra) => extra.split(/\s+/).map((token) => token.replace(/:\d+$/, "")).filter((token) => token.length > 0);
+var buildSandboxConfig = (opts) => ({
+  network: {
+    allowedDomains: [
+      .../* @__PURE__ */ new Set([
+        deriveModelHost(opts.apiBaseUrl),
+        ...GITHUB_HOSTS,
+        ...parseExtraEndpoints(opts.extra ?? "")
+      ])
+    ],
+    deniedDomains: []
+  },
+  filesystem: { allowRead: [], denyRead: [], allowWrite: ["/"], denyWrite: [] }
+});
+
 // src/index.ts
 var readJSON = (path) => {
   try {
@@ -4189,6 +4215,37 @@ var awaitCiCmd = defineCommand({
     process.stdout.write(renderCiOutputs(outcome));
   }
 });
+var sandboxConfigCmd = defineCommand({
+  meta: {
+    name: "sandbox-config",
+    description: "Emit the sandbox-runtime (srt) settings that jail the untrusted review agent's egress: allow the model host (derived from api_base_url), the GitHub API/host, and the consumer's extra_endpoints; deny all else; filesystem isolation off"
+  },
+  args: {
+    "api-base-url": {
+      type: "string",
+      description: "The model endpoint the CLI dials (ANTHROPIC_BASE_URL) \u2014 its host is allowlisted",
+      required: true
+    },
+    extra: {
+      type: "string",
+      description: "Whitespace-separated host[:port] list of extra domains to allow (the extra_endpoints input)"
+    },
+    out: {
+      type: "string",
+      description: "Write the settings JSON here instead of stdout"
+    }
+  },
+  run: ({ args }) => {
+    const config = buildSandboxConfig({ apiBaseUrl: args["api-base-url"], extra: args.extra });
+    const json = `${JSON.stringify(config, null, 2)}
+`;
+    if (args.out) {
+      writeFileSync(resolve$1(args.out), json);
+    } else {
+      process.stdout.write(json);
+    }
+  }
+});
 var main = defineCommand({
   meta: {
     name: "code-review",
@@ -4218,7 +4275,8 @@ var main = defineCommand({
     "stop-gate": stopGateCmd,
     "budget-hook": budgetHookCmd,
     "print-settings": printSettingsCmd,
-    deadline: deadlineCmd
+    deadline: deadlineCmd,
+    "sandbox-config": sandboxConfigCmd
   }
 });
 if (!process.env["VITEST"]) {