@kitman-sh/cli 0.10.70 → 0.10.72

package/dist/{chunk-8w7d269h.js → chunk-g8b2z9jn.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./chunk-1rry0tsn.js";
+import"./chunk-pyt2zrwc.js";
 import {
   HERDR_CORE_GENERATION2,
   HERDR_CORE_INSTALL_COMMAND2,
@@ -12,9 +12,9 @@ import {
   herdrCoreLayer2,
   herdrCoreTransportLayer2,
   updateHerdrCore2
-} from "./chunk-x7g0rzqj.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-030xsst1.js";
+import"./chunk-7672g0fj.js";
+import"./chunk-vrt08dk9.js";
 export {
   HERDR_CORE_GENERATION2 as HERDR_CORE_GENERATION,
   HERDR_CORE_INSTALL_COMMAND2 as HERDR_CORE_INSTALL_COMMAND,

package/dist/chunk-gngg8j56.js

@@ -0,0 +1,202 @@
+// @bun
+import {
+  getOrUndefined,
+  flatMap,
+  toArray,
+  decodeUnknownOption,
+  optionalKey,
+  String4,
+  Struct,
+  Record,
+  ArraySchema,
+  decodeJsonStringOption,
+  encodeUnknownJsonStringSync
+} from "./chunk-vrt08dk9.js";
+import {
+  replaceSecretReferences,
+  secretReferencesIn
+} from "./chunk-se79jbha.js";
+
+// packages/agent-runtime/src/srt-step.ts
+import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";
+import { spawn } from "child_process";
+import { readFileSync as readFileSync2 } from "fs";
+
+// packages/agent-runtime/src/secret-proxy.ts
+import { appendFileSync, readFileSync, renameSync, writeFileSync } from "fs";
+
+// packages/agent-runtime/src/egress-proxy.ts
+var egressAllowed = (hosts, host, port) => {
+  const target = host.toLowerCase();
+  return hosts.some((entry) => {
+    const [name = "", entryPort] = entry.toLowerCase().split(":");
+    if (entryPort !== undefined && Number(entryPort) !== port)
+      return false;
+    return name.startsWith("*.") ? target.endsWith(name.slice(1)) : target === name;
+  });
+};
+if (false)
+  ;
+
+// packages/agent-runtime/src/secret-proxy.ts
+var basicPrefix = /^basic\s+/i;
+var basicCredential = (value) => {
+  if (!basicPrefix.test(value))
+    return;
+  const decoded = Buffer.from(value.replace(basicPrefix, ""), "base64").toString("utf8");
+  return secretReferencesIn(decoded).length === 0 ? undefined : decoded;
+};
+var referencesInHeader = (value) => [
+  ...new Set([...secretReferencesIn(value), ...secretReferencesIn(basicCredential(value) ?? "")])
+];
+var swapped = (value, registry) => {
+  const swap = (reference) => registry[reference]?.value ?? reference;
+  const basic = basicCredential(value);
+  return basic === undefined ? replaceSecretReferences(value, swap) : `Basic ${Buffer.from(replaceSecretReferences(basic, swap)).toString("base64")}`;
+};
+var decideSecretRequest = (request, readRegistry) => {
+  const carrying = request.headers.flatMap(([name, value]) => {
+    const references = referencesInHeader(value);
+    return references.length === 0 ? [] : [{ name, value, references }];
+  });
+  const inTarget = secretReferencesIn(request.target);
+  if (carrying.length === 0 && inTarget.length === 0)
+    return { action: "allow" };
+  const registry = readRegistry();
+  const refusals = [
+    ...inTarget.map((reference) => ({
+      reference,
+      host: request.host,
+      reason: "A reference is swapped only in a header, never in a URL."
+    })),
+    ...[...new Set(carrying.flatMap((header) => header.references))].flatMap((reference) => {
+      const entry = registry?.[reference];
+      const reason = entry === undefined ? "The reference is unknown or revoked." : request.scheme !== "https" ? "A reference is swapped only over HTTPS." : !egressAllowed(entry.hosts, request.host, request.port) ? `The Secret may be sent only to ${entry.hosts.join(", ")}.` : undefined;
+      return reason === undefined ? [] : [{ reference, host: request.host, reason }];
+    })
+  ];
+  if (refusals.length > 0)
+    return {
+      action: "deny",
+      reason: `Kitman refused this request: ${refusals.map((refusal) => `${refusal.reference}: ${refusal.reason}`).join(" ")}`,
+      refusals
+    };
+  const names = new Set(carrying.map((header) => header.name.toLowerCase()));
+  return {
+    action: "allow",
+    setHeaders: request.headers.filter(([name]) => names.has(name.toLowerCase())).map(([name, value]) => [name, registry === undefined ? value : swapped(value, registry)])
+  };
+};
+var Registry = Record(String4, Struct({ value: String4, hosts: ArraySchema(String4) }));
+var Refusal = Struct({
+  reference: optionalKey(String4),
+  host: String4,
+  reason: String4
+});
+var readSecretRegistry = (file) => {
+  try {
+    return getOrUndefined(flatMap(decodeJsonStringOption(readFileSync(file, "utf8")), decodeUnknownOption(Registry)));
+  } catch {
+    return;
+  }
+};
+var writeSecretRegistry = (file, registry) => {
+  const next = `${file}.next`;
+  writeFileSync(next, encodeUnknownJsonStringSync(registry), { mode: 384 });
+  renameSync(next, file);
+};
+var secretRefusalLog = (registryFile) => `${registryFile}.refused`;
+var appendSecretRefusals = (registryFile, refusals) => appendFileSync(secretRefusalLog(registryFile), refusals.map((refusal) => `${encodeUnknownJsonStringSync(refusal)}
+`).join(""), { mode: 384 });
+var parseSecretRefusals = (text) => text.split(`
+`).flatMap((line) => toArray(flatMap(decodeJsonStringOption(line), decodeUnknownOption(Refusal))));
+
+// packages/agent-runtime/src/srt-step.ts
+var secretFilter2 = (registryFile) => (request, info) => {
+  const url = new URL(request.url);
+  const decision = decideSecretRequest({
+    headers: [...request.headers.entries()],
+    host: info?.target?.host ?? url.hostname,
+    port: info?.target?.port ?? (url.port === "" ? url.protocol === "https:" ? 443 : 80 : Number(url.port)),
+    target: info?.requestTarget ?? `${url.pathname}${url.search}`,
+    scheme: info?.scheme ?? (url.protocol === "https:" ? "https" : "http")
+  }, () => readSecretRegistry(registryFile));
+  if (decision.action === "allow")
+    return Promise.resolve(decision.setHeaders === undefined ? { action: "allow" } : { action: "allow", setHeaders: decision.setHeaders.map(([name, value]) => [name, value]) });
+  try {
+    appendSecretRefusals(registryFile, decision.refusals);
+  } catch {}
+  return Promise.resolve({ action: "deny", status: 403, mark: "secret-refused", reason: decision.reason });
+};
+var stepSandboxConfig = (settings, registryFile) => {
+  const parsed = SandboxRuntimeConfigSchema.safeParse({
+    ...settings,
+    network: { ...settings.network, tlsTerminate: {}, refuseOpaqueTunnels: true }
+  });
+  return parsed.success ? {
+    success: true,
+    data: { ...parsed.data, network: { ...parsed.data.network, filterRequest: secretFilter2(registryFile) } }
+  } : parsed;
+};
+var opaqueTunnelRefusal2 = "A tunnel Kitman cannot see into, such as SOCKS or a CONNECT without TLS, is refused.";
+var opaqueConnectReasons = "tunnel carries no TLS|this proxy does not tunnel CONNECTs";
+var isOpaqueConnectReason2 = (reason) => new RegExp(`^(?:${opaqueConnectReasons})`).test(reason);
+var opaqueTunnel = new RegExp(`^deny (?:socks-tunnel (\\S+) \\(refuseOpaqueTunnels\\)|http-request CONNECT (\\S+) \\((?:${opaqueConnectReasons})[^)]*\\))`);
+var refusedTunnelHost = (line) => {
+  const match = opaqueTunnel.exec(line);
+  return match === null ? undefined : match[1] ?? match[2];
+};
+var shellQuoted = (arg) => `'${arg.replaceAll("'", "'\\''")}'`;
+var argument = (args, flag) => {
+  const at = args.indexOf(flag);
+  return at === -1 ? undefined : args[at + 1];
+};
+var runSrtStep2 = async (args) => {
+  const separator = args.indexOf("--");
+  const settingsFile = argument(args, "--settings");
+  const registryFile = argument(args, "--secrets");
+  const command = separator === -1 ? [] : args.slice(separator + 1);
+  if (settingsFile === undefined || registryFile === undefined || command.length === 0) {
+    console.error("Usage: srt-step --settings <file> --secrets <registry> -- <command>");
+    process.exit(2);
+  }
+  delete process.env.SRT_DEBUG;
+  const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
+  const config = stepSandboxConfig(JSON.parse(readFileSync2(settingsFile, "utf8")), registryFile);
+  if (!config.success) {
+    console.error(`srt-step: ${settingsFile} does not hold a valid srt config: ${config.error.message}`);
+    process.exit(2);
+  }
+  await SandboxManager.initialize(config.data);
+  const recorded = new WeakSet;
+  SandboxManager.getSandboxViolationStore().subscribe((violations) => {
+    const refusals = violations.flatMap((violation) => {
+      if (recorded.has(violation))
+        return [];
+      recorded.add(violation);
+      const host = refusedTunnelHost(violation.line);
+      return host === undefined ? [] : [{ host, reason: opaqueTunnelRefusal2 }];
+    });
+    if (refusals.length === 0)
+      return;
+    try {
+      appendSecretRefusals(registryFile, refusals);
+    } catch {}
+  });
+  const child = spawn(await SandboxManager.wrapWithSandbox(command.map(shellQuoted).join(" ")), {
+    shell: true,
+    stdio: "inherit"
+  });
+  child.on("exit", (code, signal) => {
+    SandboxManager.cleanupAfterCommand();
+    process.exit(signal === null ? code ?? 0 : signal === "SIGINT" || signal === "SIGTERM" ? 0 : 1);
+  });
+  child.on("error", (error) => {
+    console.error(`Failed to execute command: ${error.message}`);
+    process.exit(1);
+  });
+  for (const signal of ["SIGINT", "SIGTERM"])
+    process.on(signal, () => child.kill(signal));
+};
+
+export { egressAllowed, writeSecretRegistry, secretRefusalLog, appendSecretRefusals, parseSecretRefusals, secretFilter2, opaqueTunnelRefusal2, isOpaqueConnectReason2, runSrtStep2 };

package/dist/{chunk-2wkdq54x.js → chunk-hxm3bvpn.js}

@@ -23,24 +23,24 @@ import {
   fnUntraced,
   encodePrettyJsonString,
   decodeJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-vrt08dk9.js";
 import {
   isJsonObject,
   isString
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-nhd7dh79.js";
 import {
   FileSystem,
   Path,
   optionalEnv
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-7672g0fj.js";
 import {
   AgentHarnessIds,
   sha2562,
   runCommand2
-} from "./chunk-x7g0rzqj.js";
+} from "./chunk-030xsst1.js";
 import {
   NpmRegistry
-} from "./chunk-pq9bkyj6.js";
+} from "./chunk-290se4bt.js";
 
 // packages/agent-runtime/src/config-convergence.ts
 var writeAgentEnvironmentConfigFile2 = fnUntraced(function* (file, content, keep = {}) {

package/dist/{chunk-v01c0k6j.js → chunk-nhd7dh79.js}

@@ -8,7 +8,7 @@ import {
   isFunction2,
   isUndefined2,
   isObjectOrArray
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-vrt08dk9.js";
 
 // packages/core/src/runtime-type.ts
 var UnsafeJsonObjectKeys = new Set(["__proto__", "constructor", "prototype"]);

package/dist/{chunk-9hr71e7c.js → chunk-pnsqttt3.js}

@@ -4,13 +4,13 @@ import {
   runnerRpcUrl2,
   makeRunnerRpcClient2,
   makeProgramRpcClient2
-} from "./chunk-h0sw8tks.js";
-import"./chunk-fgecj3t0.js";
-import"./chunk-x7g0rzqj.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-cefprsjj.js";
+import"./chunk-cj3ef3pv.js";
+import"./chunk-030xsst1.js";
+import"./chunk-se79jbha.js";
+import"./chunk-nhd7dh79.js";
+import"./chunk-7672g0fj.js";
+import"./chunk-vrt08dk9.js";
 export {
   makeProgramRpcClient2 as makeProgramRpcClient,
   makeRunnerRpcClient2 as makeRunnerRpcClient,

package/dist/{chunk-1rry0tsn.js → chunk-pyt2zrwc.js}

@@ -22,7 +22,7 @@ import {
   map8,
   raceFirst,
   scoped
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-vrt08dk9.js";
 import {
   unwrap,
   drainFork,
@@ -31,7 +31,7 @@ import {
   runCollect,
   runDrain,
   mkString
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-7672g0fj.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/redacted.js
 var redactedRegistry = /* @__PURE__ */ new WeakMap;

package/dist/{chunk-rrnee9mk.js → chunk-se79jbha.js}

@@ -18,7 +18,7 @@ import {
   isMinLength,
   isMaxLength,
   FiniteFromString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-vrt08dk9.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/JsonSchema.js
 var PRE_2020_TO_2020_COLLISIONS = ["$anchor", "$defs", "$dynamicAnchor", "$dynamicRef", "$vocabulary", "contentSchema", "dependentRequired", "dependentSchemas", "maxContains", "minContains", "prefixItems", "unevaluatedItems", "unevaluatedProperties"];

package/dist/{chunk-60333x3q.js → chunk-tv94e132.js}

@@ -7,11 +7,11 @@ import {
   decoded2,
   readOpencode2,
   runOpencodeReader2
-} from "./chunk-csbf77zs.js";
-import"./chunk-1rry0tsn.js";
-import"./chunk-v01c0k6j.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-7sm45hhc.js";
+import"./chunk-pyt2zrwc.js";
+import"./chunk-nhd7dh79.js";
+import"./chunk-7672g0fj.js";
+import"./chunk-vrt08dk9.js";
 export {
   decoded2 as decoded,
   decodedOption2 as decodedOption,

package/dist/{chunk-7jh6atr0.js → chunk-vd8f9brg.js}

@@ -32,17 +32,9 @@ import {
   toCodecJson,
   Json,
   encodePrettyJsonString
-} from "./chunk-d3ksv8y1.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import {
-  decodeText,
-  mkString,
-  FileSystem,
-  Path,
-  withDefault,
-  String2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-vrt08dk9.js";
+import"./chunk-se79jbha.js";
+import"./chunk-nhd7dh79.js";
 import {
   SecureRandom,
   layerWebCrypto,
@@ -54,23 +46,31 @@ import {
   layer4,
   kitmanMcpServer,
   RunnerRpcProtocolVersion
-} from "./chunk-x7g0rzqj.js";
+} from "./chunk-030xsst1.js";
+import {
+  decodeText,
+  mkString,
+  FileSystem,
+  Path,
+  withDefault,
+  String2
+} from "./chunk-7672g0fj.js";
 import {
   Packument,
   tarballMatches
-} from "./chunk-pq9bkyj6.js";
-import"./chunk-h0sw8tks.js";
+} from "./chunk-290se4bt.js";
+import"./chunk-cefprsjj.js";
 import {
   AgentDeclaration,
   KitDeclarations,
   describeFlag,
   Described
-} from "./chunk-1j1jh211.js";
+} from "./chunk-7wenq6ew.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-1rry0tsn.js";
-import"./chunk-fgecj3t0.js";
+} from "./chunk-pyt2zrwc.js";
+import"./chunk-cj3ef3pv.js";
 
 // packages/sdk/src/build/index.ts
 class DependencyInstallFailed extends TaggedError2()("DependencyInstallFailed", {