@kitman-sh/cli 0.10.70 → 0.10.72

package/dist/chunk-wtpwkjws.js

@@ -1,100 +0,0 @@
-// @bun
-import"./chunk-d3ksv8y1.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import {
-  decideSecretRequest,
-  readSecretRegistry,
-  appendSecretRefusals
-} from "./chunk-1w81w56v.js";
-
-// packages/agent-runtime/src/srt-step.ts
-import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";
-import { spawn } from "child_process";
-import { readFileSync } from "fs";
-var secretFilter = (registryFile) => (request, info) => {
-  const url = new URL(request.url);
-  const decision = decideSecretRequest({
-    headers: [...request.headers.entries()],
-    host: info?.target?.host ?? url.hostname,
-    port: info?.target?.port ?? (url.port === "" ? url.protocol === "https:" ? 443 : 80 : Number(url.port)),
-    target: info?.requestTarget ?? `${url.pathname}${url.search}`,
-    scheme: info?.scheme ?? (url.protocol === "https:" ? "https" : "http")
-  }, () => readSecretRegistry(registryFile));
-  if (decision.action === "allow")
-    return Promise.resolve(decision.setHeaders === undefined ? { action: "allow" } : { action: "allow", setHeaders: decision.setHeaders.map(([name, value]) => [name, value]) });
-  try {
-    appendSecretRefusals(registryFile, decision.refusals);
-  } catch {}
-  return Promise.resolve({ action: "deny", status: 403, mark: "secret-refused", reason: decision.reason });
-};
-var stepSandboxConfig = (settings, registryFile) => {
-  const parsed = SandboxRuntimeConfigSchema.safeParse({
-    ...settings,
-    network: { ...settings.network, tlsTerminate: {}, refuseOpaqueTunnels: true }
-  });
-  return parsed.success ? {
-    success: true,
-    data: { ...parsed.data, network: { ...parsed.data.network, filterRequest: secretFilter(registryFile) } }
-  } : parsed;
-};
-var opaqueTunnel = /^deny (?:socks-tunnel (\S+) \(refuseOpaqueTunnels\)|http-request CONNECT (\S+) \((?:tunnel carries no TLS|this proxy does not tunnel CONNECTs)[^)]*\))/;
-var refusedTunnelHost = (line) => {
-  const match = opaqueTunnel.exec(line);
-  return match === null ? undefined : match[1] ?? match[2];
-};
-var shellQuoted = (arg) => `'${arg.replaceAll("'", "'\\''")}'`;
-var argument = (args, flag) => {
-  const at = args.indexOf(flag);
-  return at === -1 ? undefined : args[at + 1];
-};
-var runSrtStep = async (args) => {
-  const separator = args.indexOf("--");
-  const settingsFile = argument(args, "--settings");
-  const registryFile = argument(args, "--secrets");
-  const command = separator === -1 ? [] : args.slice(separator + 1);
-  if (settingsFile === undefined || registryFile === undefined || command.length === 0) {
-    console.error("Usage: srt-step --settings <file> --secrets <registry> -- <command>");
-    process.exit(2);
-  }
-  delete process.env.SRT_DEBUG;
-  const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
-  const config = stepSandboxConfig(JSON.parse(readFileSync(settingsFile, "utf8")), registryFile);
-  if (!config.success) {
-    console.error(`srt-step: ${settingsFile} does not hold a valid srt config: ${config.error.message}`);
-    process.exit(2);
-  }
-  await SandboxManager.initialize(config.data);
-  const recorded = new WeakSet;
-  SandboxManager.getSandboxViolationStore().subscribe((violations) => {
-    const refusals = violations.flatMap((violation) => {
-      if (recorded.has(violation))
-        return [];
-      recorded.add(violation);
-      const host = refusedTunnelHost(violation.line);
-      return host === undefined ? [] : [{ host, reason: "A tunnel Kitman cannot see into, such as SOCKS or a CONNECT without TLS, is refused." }];
-    });
-    if (refusals.length === 0)
-      return;
-    try {
-      appendSecretRefusals(registryFile, refusals);
-    } catch {}
-  });
-  const child = spawn(await SandboxManager.wrapWithSandbox(command.map(shellQuoted).join(" ")), {
-    shell: true,
-    stdio: "inherit"
-  });
-  child.on("exit", (code, signal) => {
-    SandboxManager.cleanupAfterCommand();
-    process.exit(signal === null ? code ?? 0 : signal === "SIGINT" || signal === "SIGTERM" ? 0 : 1);
-  });
-  child.on("error", (error) => {
-    console.error(`Failed to execute command: ${error.message}`);
-    process.exit(1);
-  });
-  for (const signal of ["SIGINT", "SIGTERM"])
-    process.on(signal, () => child.kill(signal));
-};
-export {
-  runSrtStep
-};