@kafca/agentdock 0.1.61 → 0.1.63

package/dist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.js

@@ -0,0 +1,792 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateNetworkAddress = exports.AnthropicSandboxRunner = exports.buildSandboxConfig = exports.SandboxUnavailableError = exports.PRIVATE_NETWORK_DENY_HOSTS = void 0;
+exports.buildSandboxRuntimeConfig = buildSandboxRuntimeConfig;
+exports.createAnthropicSandboxRunner = createAnthropicSandboxRunner;
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:dns/promises");
+const node_fs_1 = require("node:fs");
+const node_net_1 = require("node:net");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const node_crypto_1 = require("node:crypto");
+/**
+ * Explicit hostnames are kept in the runtime deny list because Sandbox Runtime
+ * evaluates its allow/deny rules before its request hook.  The request hook
+ * below additionally rejects all RFC1918/link-local/loopback IPs, including
+ * addresses not represented by these finite host rules.
+ */
+exports.PRIVATE_NETWORK_DENY_HOSTS = [
+    'localhost',
+    'localhost.localdomain',
+    'ip6-localhost',
+    'ip6-loopback',
+    '127.0.0.1',
+    '127.0.0.2',
+    '127.255.255.255',
+    '0.0.0.0',
+    '::1',
+    '[::1]',
+    '169.254.169.254',
+    '169.254.170.2',
+    '10.0.0.1',
+    '10.255.255.254',
+    '172.16.0.1',
+    '172.31.255.254',
+    '192.168.0.1',
+    '192.168.255.254',
+    '100.64.0.1',
+    '100.127.255.254',
+    '192.0.0.1',
+    '192.0.2.1',
+    '198.18.0.1',
+    '198.51.100.1',
+    '203.0.113.1',
+    'metadata.google.internal',
+];
+const CAPABILITY_ORDER = ['sandbox_unavailable', 'bwrap', 'socat', 'rg', 'seccomp', 'network.namespace', 'sandbox_runtime', 'apparmor.userns'];
+const DEFAULT_WRITE_DENY_PATHS = [
+    '/tmp/claude',
+    '/private/tmp/claude',
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.npm/_logs'),
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.claude/debug'),
+];
+const CONTROLLED_TEMP_ROOT = (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-automation-runs');
+const MAX_NETWORK_AUDIT_ENTRIES = 100;
+let managerOperation = Promise.resolve();
+async function withManagerLock(operation) {
+    const previous = managerOperation;
+    let release;
+    managerOperation = new Promise((resolveRelease) => { release = resolveRelease; });
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+    }
+}
+class SandboxUnavailableError extends Error {
+    missing;
+    code = 'sandbox_unavailable';
+    constructor(missing) {
+        super(`sandbox_unavailable${missing.length > 0 ? `: ${missing.join(', ')}` : ''}`);
+        this.missing = missing;
+        this.name = 'SandboxUnavailableError';
+    }
+}
+exports.SandboxUnavailableError = SandboxUnavailableError;
+/**
+ * Build the native runtime policy from one script invocation.  Keeping this
+ * pure makes the security policy testable without starting proxy processes.
+ */
+function buildSandboxRuntimeConfig(input) {
+    const cwd = input.cwd || input.workspacePath || process.cwd();
+    const packagePath = absolutePath(input.packagePath || input.packageRoot || cwd);
+    const tempRoot = absolutePath(input.tempRoot || CONTROLLED_TEMP_ROOT);
+    assertSafeTempRoot(tempRoot);
+    const tempPath = absolutePath(input.tempDir || input.tempPath || input.temporaryDirectory || (0, node_path_1.join)(tempRoot, 'run'));
+    assertContainedPath(tempPath, tempRoot, 'tempDir');
+    const mode = resolveNetworkMode(input);
+    const manifestCapabilities = input.manifest?.capabilities;
+    const allowedReadDirs = uniqueAbsolutePaths([
+        ...(input.allowedReadDirs || []),
+        ...(manifestCapabilities?.allowedReadDirs || []),
+    ]);
+    const explicitDenyRead = uniqueAbsolutePaths(input.denyRead || []);
+    const interpreterPath = input.interpreterPath ? absolutePath(input.interpreterPath) : process.execPath;
+    const allowRead = uniqueAbsolutePaths([packagePath, tempPath, interpreterPath, (0, node_path_1.dirname)(interpreterPath), ...allowedReadDirs])
+        .filter((path) => !explicitDenyRead.some((deny) => path === deny || path.startsWith(`${deny}${node_path_1.sep}`) || deny.startsWith(`${path}${node_path_1.sep}`)));
+    const systemTemp = (0, node_path_1.resolve)((0, node_os_1.tmpdir)());
+    const broadReadDeny = [cwd, (0, node_os_1.homedir)(), (0, node_path_1.dirname)(packagePath), ...(input.userDataPath ? [absolutePath(input.userDataPath)] : [])]
+        .filter((path) => path !== node_path_1.sep && path !== systemTemp && !systemTemp.startsWith(`${path}${node_path_1.sep}`));
+    if ((0, node_path_1.dirname)(cwd) !== node_path_1.sep && (0, node_path_1.dirname)(cwd) !== systemTemp && !systemTemp.startsWith(`${(0, node_path_1.dirname)(cwd)}${node_path_1.sep}`))
+        broadReadDeny.push((0, node_path_1.dirname)(cwd));
+    const denyRead = uniqueAbsolutePaths([
+        // ASRT uses deny-then-allow semantics. Keep workspace/user data denied,
+        // then carve out only the immutable package and declared read roots.
+        ...broadReadDeny,
+        ...explicitDenyRead,
+    ]);
+    // Keep every request on the callback path. A non-empty ASRT allowlist would
+    // short-circuit the callback for matching hosts and reintroduce DNS/private
+    // destination bypasses.
+    const allowedDomains = [];
+    const deniedDomains = mode === 'none'
+        ? ['*']
+        : [...exports.PRIVATE_NETWORK_DENY_HOSTS];
+    return {
+        network: {
+            // Public mode intentionally leaves the allowlist empty and delegates
+            // each host to the ask callback. This keeps numeric private addresses
+            // and DNS aliases on the same callback path as HTTPS CONNECT/SOCKS.
+            allowedDomains,
+            deniedDomains: [...deniedDomains],
+            strictAllowlist: mode === 'none',
+            allowLocalBinding: false,
+            allowUnixSockets: [],
+            filterRequest: async (request) => {
+                const host = new URL(request.url).hostname;
+                if (await isPrivateOrLocalHost(host)) {
+                    return { action: 'deny', reason: 'private or localhost egress is not permitted' };
+                }
+                return { action: 'allow' };
+            },
+        },
+        filesystem: {
+            // The staged package is readable but never writable.  `allowWrite` is
+            // intentionally a singleton: no cwd/package/config writes are allowed.
+            denyRead,
+            allowRead,
+            allowWrite: [tempPath],
+            denyWrite: [packagePath, ...DEFAULT_WRITE_DENY_PATHS],
+            allowGitConfig: false,
+        },
+        allowPty: false,
+    };
+}
+/** Alias kept small and discoverable for callers that name the policy a sandbox config. */
+exports.buildSandboxConfig = buildSandboxRuntimeConfig;
+class AnthropicSandboxRunner {
+    platform;
+    commandExists;
+    managerOverride;
+    appArmorUsernsRestricted;
+    probeInitialization;
+    tempRoot;
+    managerPromise;
+    probePromise;
+    initialized = false;
+    constructor(options = {}) {
+        this.platform = normalizePlatform(options.platform || process.platform);
+        this.commandExists = options.commandExists || defaultCommandExists;
+        this.managerOverride = options.manager;
+        this.appArmorUsernsRestricted = options.appArmorUsernsRestricted;
+        this.probeInitialization = options.probeInitialization !== false;
+        this.tempRoot = absolutePath(options.tempRoot || CONTROLLED_TEMP_ROOT);
+        assertSafeTempRoot(this.tempRoot);
+        (0, node_fs_1.mkdirSync)(this.tempRoot, { recursive: true });
+    }
+    async probe() {
+        if (!this.probePromise) {
+            this.probePromise = withManagerLock(() => this.probeInternal()).then((result) => {
+                // Do not permanently cache a transient initialization/reset failure;
+                // a later diagnostics/run call must be able to recover.
+                if (!result.available)
+                    this.probePromise = undefined;
+                return result;
+            });
+        }
+        return this.probePromise;
+    }
+    async run(input) {
+        const capability = await this.probe();
+        if (!capability.available)
+            throw new SandboxUnavailableError(capability.missing);
+        return withManagerLock(() => this.runLocked(input));
+    }
+    async runLocked(input) {
+        const suppliedTempPath = input.tempDir || input.tempPath || input.temporaryDirectory;
+        const tempPath = absolutePath(suppliedTempPath || (0, node_path_1.join)(this.tempRoot, `run-${(0, node_crypto_1.randomUUID)()}`));
+        const ownsTempPath = !suppliedTempPath;
+        assertContainedPath(tempPath, this.tempRoot, 'tempDir');
+        (0, node_fs_1.mkdirSync)(tempPath, { recursive: true });
+        const effectiveInput = { ...input, tempDir: tempPath, tempRoot: this.tempRoot };
+        const manager = await this.getManager();
+        const config = buildSandboxRuntimeConfig(effectiveInput);
+        const networkAudit = [];
+        // SandboxManager is a process-global singleton. Always tear down any
+        // previous owner before applying this invocation's filesystem policy.
+        try {
+            await manager.reset?.();
+            const mode = resolveNetworkMode(effectiveInput);
+            const allowedDomains = effectiveInput.allowedDomains ?? effectiveInput.manifest?.capabilities?.allowedDomains ?? [];
+            await manager.initialize(config, async ({ host, port }) => {
+                const allowed = mode !== 'none' && !(await isPrivateOrLocalHost(host))
+                    && (mode !== 'restricted' || allowedDomains.some((pattern) => matchesDomain(host, pattern)));
+                if (networkAudit.length < MAX_NETWORK_AUDIT_ENTRIES) {
+                    networkAudit.push({ host: sanitizeAuditHost(host), ...(port === undefined ? {} : { port }), allowed, timestamp: new Date().toISOString() });
+                }
+                return allowed;
+            }, false);
+            this.initialized = true;
+        }
+        catch (error) {
+            this.initialized = false;
+            if (ownsTempPath)
+                (0, node_fs_1.rmSync)(tempPath, { recursive: true, force: true });
+            throw new SandboxUnavailableError(['sandbox_runtime']);
+        }
+        try {
+            if (manager.waitForNetworkInitialization) {
+                const ready = await manager.waitForNetworkInitialization();
+                if (!ready)
+                    throw new SandboxUnavailableError(['sandbox_runtime']);
+            }
+            // The wrapped command is deliberately scoped to this method.  It is
+            // never returned, logged, or attached to SandboxRunResult.
+            if (!manager.wrapWithSandboxArgv)
+                throw new SandboxUnavailableError(['sandbox_runtime']);
+            const tempEnvKeys = ['TMPDIR', 'TMP', 'TEMP', 'CLAUDE_CODE_TMPDIR', 'CLAUDE_TMPDIR'];
+            const previousTempEnv = Object.fromEntries(tempEnvKeys.map((key) => [key, process.env[key]]));
+            for (const key of tempEnvKeys)
+                process.env[key] = tempPath;
+            let wrapped;
+            try {
+                wrapped = await manager.wrapWithSandboxArgv(effectiveInput.command);
+            }
+            finally {
+                for (const key of tempEnvKeys) {
+                    if (previousTempEnv[key] === undefined)
+                        delete process.env[key];
+                    else
+                        process.env[key] = previousTempEnv[key];
+                }
+            }
+            const result = await spawnWrappedCommand(wrapped, effectiveInput);
+            return { ...result, ...(networkAudit.length === 0 ? {} : { networkAudit }) };
+        }
+        finally {
+            manager.cleanupAfterCommand?.();
+            try {
+                await manager.reset?.();
+            }
+            finally {
+                this.initialized = false;
+                if (ownsTempPath)
+                    (0, node_fs_1.rmSync)(tempPath, { recursive: true, force: true });
+            }
+        }
+    }
+    async probeInternal() {
+        const missing = new Set();
+        const unverified = new Set();
+        if (this.platform === 'windows') {
+            return { available: false, platform: this.platform, missing: ['sandbox_unavailable'] };
+        }
+        const manager = await this.getManager().catch(() => undefined);
+        if (!manager)
+            missing.add('sandbox_runtime');
+        if (manager?.isSupportedPlatform && !manager.isSupportedPlatform())
+            missing.add('sandbox_unavailable');
+        if (this.platform === 'linux') {
+            try {
+                const deps = manager?.checkDependencies?.() || { errors: [], warnings: [] };
+                addDependencyNames(missing, [...deps.errors, ...deps.warnings]);
+            }
+            catch {
+                missing.add('sandbox_runtime');
+            }
+        }
+        else {
+            if (!this.commandExists('sandbox-exec'))
+                missing.add('sandbox-exec');
+            if (!this.commandExists('rg'))
+                missing.add('rg');
+        }
+        const behaviorBlockers = this.platform === 'linux'
+            ? ['sandbox_runtime', 'sandbox_unavailable', 'bwrap', 'socat', 'rg']
+            : ['sandbox_runtime', 'sandbox_unavailable', 'sandbox-exec'];
+        const behaviorBlocked = behaviorBlockers.some((capability) => missing.has(capability));
+        const markLinuxBehaviorUnverified = () => {
+            // An earlier failure prevents the only authoritative behavior proof.
+            // Keep every unproven isolation capability failed rather than reporting
+            // a misleading green row from absence of evidence.
+            missing.add('apparmor.userns');
+            missing.add('network.namespace');
+            missing.add('seccomp');
+            unverified.add('apparmor.userns');
+            unverified.add('network.namespace');
+            unverified.add('seccomp');
+        };
+        if (this.platform === 'linux' && behaviorBlocked)
+            markLinuxBehaviorUnverified();
+        if (!this.probeInitialization) {
+            missing.add('sandbox_runtime');
+            if (this.platform === 'linux')
+                markLinuxBehaviorUnverified();
+        }
+        if (manager && this.probeInitialization && !behaviorBlocked) {
+            let attempted = false;
+            const probeTempPath = (0, node_path_1.join)(this.tempRoot, `probe-${(0, node_crypto_1.randomUUID)()}`);
+            try {
+                (0, node_fs_1.mkdirSync)(probeTempPath, { recursive: true });
+                const probeConfig = buildSandboxRuntimeConfig({
+                    command: 'true',
+                    cwd: process.cwd(),
+                    packagePath: process.cwd(),
+                    tempRoot: this.tempRoot,
+                    tempDir: probeTempPath,
+                    network: 'none',
+                });
+                attempted = true;
+                await manager.initialize(probeConfig);
+                if (manager.waitForNetworkInitialization && !(await manager.waitForNetworkInitialization())) {
+                    missing.add('sandbox_runtime');
+                    if (this.platform === 'linux')
+                        markLinuxBehaviorUnverified();
+                }
+                else if (!manager.wrapWithSandboxArgv) {
+                    missing.add('sandbox_runtime');
+                    if (this.platform === 'linux')
+                        markLinuxBehaviorUnverified();
+                }
+                else {
+                    const wrapped = await manager.wrapWithSandboxArgv('true');
+                    let result;
+                    try {
+                        result = await spawnWrappedCommand(wrapped, {
+                            command: 'true',
+                            cwd: process.cwd(),
+                            packagePath: process.cwd(),
+                            tempRoot: this.tempRoot,
+                            tempDir: probeTempPath,
+                            network: 'none',
+                            timeoutMs: 5_000,
+                            stdoutBytes: 16_384,
+                            stderrBytes: 16_384,
+                        });
+                    }
+                    finally {
+                        manager.cleanupAfterCommand?.();
+                    }
+                    if (result.exitCode !== 0 || result.signal) {
+                        if (this.platform === 'linux') {
+                            const failure = classifyLinuxBehaviorFailures(result.stderr, this.isAppArmorUsernsRestricted());
+                            for (const capability of failure.missing) {
+                                missing.add(capability);
+                            }
+                            for (const capability of failure.unverified)
+                                unverified.add(capability);
+                        }
+                        else {
+                            missing.add('sandbox_runtime');
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+                if (this.platform === 'linux') {
+                    const failure = classifyLinuxBehaviorFailures(message, this.isAppArmorUsernsRestricted());
+                    for (const capability of failure.missing) {
+                        missing.add(capability);
+                    }
+                    for (const capability of failure.unverified)
+                        unverified.add(capability);
+                }
+                else {
+                    missing.add('sandbox_runtime');
+                }
+            }
+            finally {
+                if (attempted) {
+                    try {
+                        await manager.reset?.();
+                    }
+                    catch {
+                        missing.add('sandbox_runtime');
+                    }
+                }
+                (0, node_fs_1.rmSync)(probeTempPath, { recursive: true, force: true });
+            }
+        }
+        const orderedUnverified = orderCapabilities(unverified);
+        return {
+            available: missing.size === 0,
+            platform: this.platform,
+            missing: orderCapabilities(missing),
+            ...(orderedUnverified.length === 0 ? {} : { unverified: orderedUnverified }),
+        };
+    }
+    isAppArmorUsernsRestricted() {
+        if (typeof this.appArmorUsernsRestricted === 'function')
+            return this.appArmorUsernsRestricted();
+        if (typeof this.appArmorUsernsRestricted === 'boolean')
+            return this.appArmorUsernsRestricted;
+        try {
+            // This value is diagnostic context only. A dedicated AppArmor profile
+            // can grant userns while the global restriction remains enabled, so the
+            // wrapped behavioral probe above is always authoritative.
+            return (0, node_fs_1.readFileSync)('/proc/sys/kernel/apparmor_restrict_unprivileged_userns', 'utf8').trim() === '1';
+        }
+        catch {
+            return false;
+        }
+    }
+    async getManager() {
+        if (this.managerOverride)
+            return this.managerOverride;
+        if (!this.managerPromise) {
+            this.managerPromise = importSandboxRuntimeManager();
+        }
+        return this.managerPromise;
+    }
+}
+exports.AnthropicSandboxRunner = AnthropicSandboxRunner;
+function createAnthropicSandboxRunner(options = {}) {
+    return new AnthropicSandboxRunner(options);
+}
+async function importSandboxRuntimeManager() {
+    // TypeScript emits CommonJS for Electron.  A native dynamic import through
+    // Function avoids transpiling this call to require(), since ASRT is ESM.
+    const dynamicImport = new Function('specifier', 'return import(specifier)');
+    const module = await dynamicImport('@anthropic-ai/sandbox-runtime');
+    return module.SandboxManager;
+}
+function resolveNetworkMode(input) {
+    return input.networkMode || input.network || input.manifest?.capabilities?.network || 'none';
+}
+function normalizePlatform(value) {
+    if (value === 'darwin' || value === 'macos')
+        return 'macos';
+    if (value === 'win32' || value === 'windows')
+        return 'windows';
+    if (value === 'linux')
+        return 'linux';
+    return 'windows';
+}
+function absolutePath(path) {
+    if (!(0, node_path_1.isAbsolute)(path))
+        throw new Error('Sandbox paths must be absolute.');
+    return (0, node_path_1.resolve)(path);
+}
+function assertContainedPath(candidate, root, label) {
+    const candidatePath = (0, node_path_1.resolve)(candidate);
+    const rootPath = (0, node_path_1.resolve)(root);
+    const relativePath = (0, node_path_1.relative)(rootPath, candidatePath);
+    if (relativePath === '..' || relativePath.startsWith(`..${node_path_1.sep}`) || (0, node_path_1.isAbsolute)(relativePath)) {
+        throw new Error(`${label} must be inside the controlled temporary root.`);
+    }
+}
+function assertSafeTempRoot(root) {
+    const normalized = (0, node_path_1.resolve)(root);
+    if (normalized === node_path_1.sep || normalized === (0, node_path_1.resolve)((0, node_os_1.tmpdir)()) || normalized === (0, node_path_1.resolve)((0, node_os_1.homedir)())) {
+        throw new Error('tempRoot must be a dedicated, non-broad temporary directory.');
+    }
+}
+function uniqueAbsolutePaths(paths) {
+    return [...new Set(paths.filter(Boolean).map(absolutePath))];
+}
+function addDependencyNames(missing, errors) {
+    for (const error of errors) {
+        const lower = error.toLowerCase();
+        if (lower.includes('bwrap') || lower.includes('bubblewrap'))
+            missing.add('bwrap');
+        if (lower.includes('socat'))
+            missing.add('socat');
+        if (lower.includes('ripgrep') || /\brg\b/.test(lower))
+            missing.add('rg');
+        if (lower.includes('seccomp'))
+            missing.add('seccomp');
+        if (lower.includes('network namespace') || lower.includes('unshare-net'))
+            missing.add('network.namespace');
+        if (lower.includes('unsupported platform'))
+            missing.add('sandbox_unavailable');
+        if (lower.includes('sandbox'))
+            missing.add('sandbox_runtime');
+    }
+}
+function classifyLinuxBehaviorFailures(message, appArmorUsernsRestricted) {
+    const lower = message.toLowerCase();
+    if (lower.includes('seccomp') || lower.includes('apply-seccomp')) {
+        return { missing: ['seccomp'], unverified: [] };
+    }
+    if (lower.includes('unshare-net') || lower.includes('network namespace')) {
+        return { missing: ['network.namespace', 'seccomp'], unverified: ['seccomp'] };
+    }
+    if (lower.includes('apparmor')) {
+        return {
+            missing: ['apparmor.userns', 'network.namespace', 'seccomp'],
+            unverified: ['network.namespace', 'seccomp'],
+        };
+    }
+    if (appArmorUsernsRestricted &&
+        (lower.includes('new namespace') || lower.includes('user namespace') || lower.includes('operation not permitted'))) {
+        return {
+            missing: ['apparmor.userns', 'network.namespace', 'seccomp'],
+            unverified: ['network.namespace', 'seccomp'],
+        };
+    }
+    if (lower.includes('new namespace') || lower.includes('user namespace') || lower.includes('operation not permitted')) {
+        return {
+            missing: ['apparmor.userns', 'network.namespace', 'seccomp'],
+            unverified: ['network.namespace', 'seccomp'],
+        };
+    }
+    return {
+        missing: ['sandbox_runtime', 'apparmor.userns', 'network.namespace', 'seccomp'],
+        unverified: ['apparmor.userns', 'network.namespace', 'seccomp'],
+    };
+}
+function orderCapabilities(values) {
+    return [...values].sort((left, right) => {
+        const leftIndex = CAPABILITY_ORDER.indexOf(left);
+        const rightIndex = CAPABILITY_ORDER.indexOf(right);
+        return (leftIndex < 0 ? CAPABILITY_ORDER.length : leftIndex) - (rightIndex < 0 ? CAPABILITY_ORDER.length : rightIndex) || left.localeCompare(right);
+    });
+}
+function defaultCommandExists(command) {
+    const pathValue = process.env.PATH || '';
+    return pathValue.split(node_path_1.delimiter).some((directory) => (0, node_fs_1.existsSync)((0, node_path_1.join)(directory, command)));
+}
+async function spawnWrappedCommand(wrapped, input) {
+    if (wrapped.argv.length === 0 || !(0, node_path_1.isAbsolute)(wrapped.argv[0])) {
+        throw new SandboxUnavailableError(['sandbox_runtime']);
+    }
+    const runtimePath = wrapped.env.PATH || '/usr/bin:/bin';
+    const allowedEnv = input.allowedEnv ?? input.manifest?.env ?? [];
+    const inputEnv = Object.fromEntries(Object.entries(input.env || {}).filter(([key]) => allowedEnv.includes(key) && !isProxyEnvKey(key)));
+    const tempPath = absolutePath(input.tempDir || input.tempPath || input.temporaryDirectory || CONTROLLED_TEMP_ROOT);
+    const child = (0, node_child_process_1.spawn)(wrapped.argv[0], wrapped.argv.slice(1), {
+        cwd: input.cwd || input.workspacePath || process.cwd(),
+        env: {
+            ...sanitizeRuntimeEnv(wrapped.env),
+            ...sanitizeRuntimeEnv(inputEnv, allowedEnv),
+            PATH: runtimePath,
+            TMPDIR: tempPath,
+            TMP: tempPath,
+            TEMP: tempPath,
+            CLAUDE_CODE_TMPDIR: tempPath,
+            CLAUDE_TMPDIR: tempPath,
+        },
+        shell: false,
+        // A new process group lets timeout/overflow termination include shell
+        // descendants rather than leaving a detached child running in the sandbox.
+        detached: process.platform !== 'win32',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    if (input.stdin !== undefined)
+        child.stdin?.end(input.stdin, 'utf8');
+    else
+        child.stdin?.end();
+    return collectChildResult(child, input.timeoutMs, input.signal, input);
+}
+function sanitizeRuntimeEnv(runtimeEnv, allowedDataKeys = []) {
+    const result = {};
+    const blocked = new Set(['BASH_ENV', 'ENV', 'SHELLOPTS', 'NODE_OPTIONS', 'LD_PRELOAD', 'LD_LIBRARY_PATH', 'DYLD_INSERT_LIBRARIES', 'DYLD_LIBRARY_PATH', 'PATH']);
+    for (const [key, value] of Object.entries(runtimeEnv)) {
+        if (value === undefined)
+            continue;
+        if (blocked.has(key))
+            continue;
+        if (allowedDataKeys.includes(key) && !blocked.has(key) && !isProxyEnvKey(key)) {
+            result[key] = value;
+        }
+        else if (key === 'PATH' || key === 'HOME' || key === 'USER' || key === 'SHELL' ||
+            key === 'LANG' || key.startsWith('LC_') || key.startsWith('HTTP_PROXY') ||
+            key.startsWith('HTTPS_PROXY') || key.startsWith('ALL_PROXY') ||
+            key.startsWith('http_proxy') || key.startsWith('https_proxy') || key.startsWith('all_proxy') ||
+            key === 'SSL_CERT_FILE' || key === 'GIT_SSL_CAINFO' || key === 'CURL_CA_BUNDLE' ||
+            key === 'REQUESTS_CA_BUNDLE' || key === 'PIP_CERT' || key === 'AWS_CA_BUNDLE' ||
+            key === 'CARGO_HTTP_CAINFO' || key === 'DENO_CERT' || key === 'CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE' ||
+            key === 'CLAUDE_CODE_TMPDIR' || key === 'CLAUDE_TMPDIR' ||
+            key === 'CLAUDE_CODE_HOST_HTTP_PROXY_PORT' || key === 'CLAUDE_CODE_HOST_SOCKS_PROXY_PORT') {
+            result[key] = value;
+        }
+    }
+    // NO_PROXY is intentionally omitted: it would let a script bypass the
+    // mediated proxy and defeat public/private host policy.
+    delete result.NO_PROXY;
+    delete result.no_proxy;
+    return result;
+}
+function isProxyEnvKey(key) {
+    return key === 'HTTP_PROXY' || key === 'HTTPS_PROXY' || key === 'ALL_PROXY' ||
+        key === 'http_proxy' || key === 'https_proxy' || key === 'all_proxy' ||
+        key === 'NO_PROXY' || key === 'no_proxy';
+}
+function collectChildResult(child, timeoutMs = 30_000, signal, input) {
+    return new Promise((resolveResult) => {
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        let outputLimitExceeded;
+        const terminateTree = () => {
+            if (child.pid && process.platform !== 'win32') {
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                    return;
+                }
+                catch { /* child may have already exited */ }
+            }
+            child.kill('SIGKILL');
+        };
+        const timer = setTimeout(terminateTree, timeoutMs);
+        const abort = () => terminateTree();
+        signal?.addEventListener('abort', abort, { once: true });
+        const stdoutParts = [];
+        const stderrParts = [];
+        let stdoutSize = 0;
+        let stderrSize = 0;
+        const append = (stream, chunk) => {
+            const limit = stream === 'stdout' ? input?.stdoutBytes : input?.stderrBytes;
+            const current = stream === 'stdout' ? stdoutSize : stderrSize;
+            const remaining = limit === undefined ? undefined : limit - current;
+            if (remaining === undefined || remaining >= chunk.byteLength) {
+                if (stream === 'stdout') {
+                    stdoutParts.push(chunk);
+                    stdoutSize += chunk.byteLength;
+                }
+                else {
+                    stderrParts.push(chunk);
+                    stderrSize += chunk.byteLength;
+                }
+                return;
+            }
+            const truncated = truncateUtf8(chunk, Math.max(0, remaining));
+            if (stream === 'stdout') {
+                stdoutParts.push(truncated);
+                stdoutSize += truncated.byteLength;
+            }
+            else {
+                stderrParts.push(truncated);
+                stderrSize += truncated.byteLength;
+            }
+            if (!outputLimitExceeded) {
+                outputLimitExceeded = stream;
+                terminateTree();
+            }
+        };
+        child.stdout?.on('data', (chunk) => append('stdout', chunk));
+        child.stderr?.on('data', (chunk) => append('stderr', chunk));
+        const finish = (exitCode, childSignal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', abort);
+            stdout = Buffer.concat(stdoutParts).toString('utf8');
+            stderr = Buffer.concat(stderrParts).toString('utf8');
+            resolveResult({ exitCode, signal: childSignal, stdout, stderr, ...(outputLimitExceeded ? { outputLimitExceeded } : {}) });
+        };
+        child.once('error', (error) => {
+            stderrParts.push(Buffer.from(error instanceof Error ? error.message : String(error), 'utf8'));
+            finish(null, null);
+        });
+        child.once('exit', (exitCode, childSignal) => {
+            // Retain the normal stdout tail while streams close. If a background
+            // descendant inherited them, tear down the process group shortly after
+            // wrapper exit instead of allowing an orphan to keep the run open.
+            setTimeout(() => {
+                if (settled)
+                    return;
+                let groupAlive = false;
+                if (child.pid && process.platform !== 'win32') {
+                    try {
+                        process.kill(-child.pid, 0);
+                        groupAlive = true;
+                    }
+                    catch { /* group exited; let pipes drain */ }
+                }
+                if (groupAlive) {
+                    terminateTree();
+                    child.stdout?.destroy();
+                    child.stderr?.destroy();
+                    finish(exitCode, childSignal);
+                    return;
+                }
+                // A closed group should normally emit close immediately. Retain tail
+                // output, but still bound a pathological inherited pipe hang.
+                setTimeout(() => {
+                    if (settled)
+                        return;
+                    child.stdout?.destroy();
+                    child.stderr?.destroy();
+                    finish(exitCode, childSignal);
+                }, 1_000);
+            }, 50);
+        });
+        child.once('close', (exitCode, childSignal) => finish(exitCode, childSignal));
+    });
+}
+function truncateUtf8(value, limit) {
+    if (value.byteLength <= limit)
+        return value;
+    // Keep the longest valid UTF-8 prefix. Only the final code point can be
+    // partial, so four attempts cover UTF-8's maximum sequence width while
+    // preserving legitimate U+FFFD characters already present in the stream.
+    const decoder = new TextDecoder('utf-8', { fatal: true });
+    for (let end = limit; end >= Math.max(0, limit - 3); end -= 1) {
+        try {
+            decoder.decode(value.subarray(0, end));
+            return value.subarray(0, end);
+        }
+        catch { /* try a shorter final boundary */ }
+    }
+    return Buffer.alloc(0);
+}
+async function isPrivateOrLocalHost(host) {
+    const normalized = host.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    if (exports.PRIVATE_NETWORK_DENY_HOSTS.some((entry) => entry.replace(/^\[|\]$/g, '').toLowerCase() === normalized))
+        return true;
+    const ipVersion = (0, node_net_1.isIP)(normalized);
+    if (ipVersion === 4 && isPrivateIpv4(normalized))
+        return true;
+    if (ipVersion === 6 && isPrivateIpv6(normalized))
+        return true;
+    if (ipVersion === 0) {
+        try {
+            const addresses = await (0, promises_1.lookup)(normalized, { all: true, verbatim: true });
+            // 198.18/15 is a reserved benchmark range commonly used by local
+            // network shims for public DNS answers. Direct numeric destinations in
+            // that range remain denied; DNS aliases still deny RFC1918/link-local.
+            return addresses.length === 0 || addresses.some((address) => address.family === 4 ? isPrivateIpv4(address.address, false) : isPrivateIpv6(address.address));
+        }
+        catch {
+            // A transient DNS failure is reported by the proxy and does not turn
+            // into host-side execution: fail closed on resolver errors.
+            return true;
+        }
+    }
+    return false;
+}
+/** Deterministic policy seam used by capability/network tests. */
+exports.isPrivateNetworkAddress = isPrivateOrLocalHost;
+function matchesDomain(host, pattern) {
+    const normalizedHost = host.toLowerCase().replace(/\.$/, '');
+    const normalizedPattern = pattern.toLowerCase().replace(/\.$/, '');
+    return normalizedPattern === '*' || normalizedPattern === normalizedHost ||
+        (normalizedPattern.startsWith('*.') && normalizedHost.endsWith(`.${normalizedPattern.slice(2)}`));
+}
+function sanitizeAuditHost(value) {
+    const host = value.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    return /^[a-z0-9.:-]+$/i.test(host) && !host.includes('..') ? host : 'invalid-host';
+}
+function isPrivateIpv4(address, includeBenchmarkRange = true) {
+    const parts = address.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return true;
+    const value = (((parts[0] * 256 + parts[1]) * 256 + parts[2]) * 256 + parts[3]);
+    const first16 = value >>> 16;
+    return parts[0] === 10 ||
+        (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
+        (parts[0] === 192 && parts[1] === 168) ||
+        parts[0] === 127 ||
+        (parts[0] === 169 && parts[1] === 254) ||
+        (parts[0] === 0) ||
+        (first16 >= 0x6440 && first16 <= 0x647f) ||
+        (parts[0] === 192 && parts[1] === 0) ||
+        (parts[0] === 198 && parts[1] === 51 && parts[2] === 100) ||
+        (parts[0] === 203 && parts[1] === 0 && parts[2] === 113) ||
+        (includeBenchmarkRange && first16 >= 0xc612 && first16 <= 0xc613);
+}
+function isPrivateIpv6(address) {
+    const normalized = address.toLowerCase();
+    if (normalized.startsWith('::ffff:')) {
+        const mapped = normalized.slice('::ffff:'.length);
+        if ((0, node_net_1.isIP)(mapped) === 4)
+            return isPrivateIpv4(mapped);
+        const groups = mapped.split(':');
+        if (groups.length >= 2) {
+            const high = Number.parseInt(groups[groups.length - 2], 16);
+            const low = Number.parseInt(groups[groups.length - 1], 16);
+            if (Number.isInteger(high) && Number.isInteger(low)) {
+                const dotted = `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;
+                return isPrivateIpv4(dotted);
+            }
+        }
+        return true;
+    }
+    return normalized === '::1' || normalized === '::' || normalized.startsWith('fe8') || normalized.startsWith('fe9') || normalized.startsWith('fea') || normalized.startsWith('feb') || normalized.startsWith('fc') || normalized.startsWith('fd');
+}