@kitman-sh/cli 0.10.71 → 0.10.73

package/dist/{chunk-g4xsa9ks.js → chunk-0rzh8yfd.js}

@@ -285,6 +285,16 @@ import {
   skillIdentity2
 } from "./chunk-4wqjxfbv.js";
 import"./chunk-hr9vd6dj.js";
+import {
+  egressAllowed,
+  writeSecretRegistry,
+  secretRefusalLog,
+  appendSecretRefusals,
+  parseSecretRefusals,
+  secretFilter2,
+  opaqueTunnelRefusal2,
+  isOpaqueConnectReason2
+} from "./chunk-3edjgnxf.js";
 import {
   sliceBytes2,
   maxLineBytes2,
@@ -293,11 +303,6 @@ import {
   decoded2,
   readOpencode2
 } from "./chunk-csbf77zs.js";
-import {
-  writeSecretRegistry,
-  secretRefusalLog,
-  parseSecretRefusals
-} from "./chunk-1w81w56v.js";
 import {
   uploadRunFile,
   programLease,
@@ -2594,6 +2599,82 @@ var prepareDockerHome = (input) => gen(function* () {
   }
 });
 
+// packages/agent-runtime/src/docker-secret-proxy.ts
+import { createHttpProxyServer } from "@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js";
+import { isLoopbackName } from "@anthropic-ai/sandbox-runtime/dist/sandbox/address.js";
+import { createMitmCA, disposeMitmCA } from "@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-ca.js";
+import { canonicalizeHost } from "@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.js";
+import {
+  createResolvedAddressGuard
+} from "@anthropic-ai/sandbox-runtime/dist/sandbox/resolved-address-guard.js";
+import { chmodSync } from "fs";
+import { isIP } from "net";
+import { networkInterfaces } from "os";
+class SecretProxyUnavailable extends TaggedError("SecretProxyUnavailable") {
+}
+var dockerSecretProxySocket = (registryDirectory) => `${registryDirectory}/proxy.sock`;
+var anyName = "kitman-target.invalid";
+var dockerBridge = (name) => name === "docker0" || name === "docker_gwbridge" || name.startsWith("br-");
+var dockerNetworkSubnets = (interfaces = networkInterfaces()) => Object.entries(interfaces).flatMap(([name, addresses]) => dockerBridge(name) ? (addresses ?? []).flatMap(({ cidr }) => cidr === null ? [] : [cidr]) : []);
+var runnerAddresses = (interfaces) => {
+  let current;
+  try {
+    current = interfaces();
+  } catch {
+    return [];
+  }
+  const own = Object.values(current).flatMap((addresses) => (addresses ?? []).map(({ address }) => address));
+  return [...own, ...dockerNetworkSubnets(current)];
+};
+var runnerAddressGuard = (options = {}, interfaces = networkInterfaces) => createResolvedAddressGuard({ ...options, localAddresses: () => runnerAddresses(interfaces) });
+var namesRunner = (guard, host, port) => {
+  const canonical = canonicalizeHost(host) ?? host;
+  if (isLoopbackName(canonical))
+    return !guard.permits(anyName, "127.0.0.1", port);
+  return isIP(canonical) !== 0 && !guard.permits(anyName, canonical, port);
+};
+var startDockerSecretProxy = (input) => gen(function* () {
+  const ca = yield* acquireRelease(try_2({ try: () => createMitmCA({}), catch: (cause) => new SecretProxyUnavailable({ cause }) }), (ca) => ignore(tryPromise(() => disposeMitmCA(ca))));
+  const { network, registryFile } = input;
+  const guard = runnerAddressGuard(input.addressGuard);
+  const server = createHttpProxyServer({
+    filter: (port, host, _socket, _command, explain) => {
+      if (namesRunner(guard, host, port)) {
+        explain?.("the Runner's own address or one of its docker networks");
+        return false;
+      }
+      if (network === "open" || egressAllowed(network.hosts, host, port))
+        return true;
+      explain?.("host not allowed");
+      return false;
+    },
+    lookupFor: (port) => guard.lookupFor(port),
+    mitmCA: ca,
+    filterRequest: secretFilter2(registryFile),
+    refuseOpaqueTunnels: true,
+    onFilterRequestDenied: ({ method, url, reason }) => {
+      if (method !== "CONNECT" || !isOpaqueConnectReason2(reason))
+        return;
+      try {
+        appendSecretRefusals(registryFile, [{ host: url, reason: opaqueTunnelRefusal2 }]);
+      } catch {}
+    },
+    ...input.upstreamCA === undefined ? undefined : { tlsTerminateUpstreamCA: input.upstreamCA }
+  });
+  yield* acquireRelease(callback3((resume) => {
+    server.once("error", (cause) => resume(fail7(new SecretProxyUnavailable({ cause }))));
+    server.listen(input.socket, () => resume(void_3));
+  }), () => sync2(() => server.close()));
+  yield* try_2({
+    try: () => chmodSync(input.socket, 438),
+    catch: (cause) => new SecretProxyUnavailable({ cause })
+  });
+  return { socket: input.socket, trustBundle: ca.trustBundlePath };
+});
+
+// packages/agent-runtime/src/docker-sandbox.ts
+import { CA_TRUST_VARS } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
+
 // packages/agent-runtime/src/helper-scripts.ts
 import { fileURLToPath } from "url";
 var helperScriptPath = (name) => gen(function* () {
@@ -2611,9 +2692,14 @@ var RunnerLabel = "kitman.runner";
 var StepAttemptLabel = "kitman.step-attempt";
 var EgressProxyImage = "oven/bun@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a";
 var egressProxyAddress = "http://kitman-egress:3128";
+var relayedSocket = "/kitman/proxy.sock";
+var trustBundle = "/kitman/trust.pem";
 
 class ContainerError extends TaggedError("ContainerError") {
 }
+
+class SecretProxyUnreachable extends TaggedError("SecretProxyUnreachable") {
+}
 var imagePull = { timeout: "30 minutes" };
 var dockerContainerRunner = map8(ChildProcessSpawner, (spawner) => {
   const docker = (args, options = {}) => runCommand2("docker", args, options).pipe(mapError2((error) => new ContainerError({ message: error.message })), provideService(ChildProcessSpawner, spawner));
@@ -2629,6 +2715,7 @@ var dockerContainerRunner = map8(ChildProcessSpawner, (spawner) => {
       input.name,
       ...labelArgs(input.labels),
       ...input.network === undefined ? [] : ["--network", input.network],
+      ...input.alias === undefined ? [] : ["--network-alias", input.alias],
       ...input.user === undefined ? [] : ["--user", input.user],
       ...input.mounts.flatMap((mount) => [
         "--volume",
@@ -2678,26 +2765,49 @@ var startDockerSandbox = (input) => gen(function* () {
     [StepAttemptLabel, input.attemptId]
   ];
   const agent = `kitman-agent-${id}`;
-  const network = input.policy.network === "open" ? undefined : `kitman-agent-net-${id}`;
+  const { secretProxy } = input;
+  const network = input.policy.network === "open" && secretProxy === undefined ? undefined : `kitman-agent-net-${id}`;
   yield* acquireRelease(void_3, () => containers.removeLabelled([StepAttemptLabel, input.attemptId]));
-  if (input.policy.network !== "open" && network !== undefined) {
+  if (network !== undefined) {
     const proxy = `kitman-egress-${id}`;
+    const script = {
+      source: yield* helperScriptPath("egress-proxy.ts"),
+      target: "/kitman/egress-proxy.ts",
+      readOnly: true
+    };
     yield* containers.createInternalNetwork({ name: network, labels });
-    yield* containers.run({
-      name: proxy,
-      image: input.docker.proxyImage ?? EgressProxyImage,
-      labels,
-      mounts: [
-        {
-          source: yield* helperScriptPath("egress-proxy.ts"),
-          target: "/kitman/egress-proxy.ts",
-          readOnly: true
-        }
-      ],
-      env: {},
-      command: ["bun", "/kitman/egress-proxy.ts", input.policy.network.hosts.join(",")]
-    });
-    yield* containers.connect({ network, container: proxy, alias: "kitman-egress" });
+    const image = input.docker.proxyImage ?? EgressProxyImage;
+    if (secretProxy === undefined) {
+      yield* containers.run({
+        name: proxy,
+        image,
+        labels,
+        mounts: [script],
+        env: {},
+        command: ["bun", script.target, input.policy.network === "open" ? "" : input.policy.network.hosts.join(",")]
+      });
+      yield* containers.connect({ network, container: proxy, alias: "kitman-egress" });
+    } else {
+      yield* containers.run({
+        name: proxy,
+        image,
+        labels,
+        network,
+        alias: "kitman-egress",
+        mounts: [script, { source: secretProxy.socket, target: relayedSocket }],
+        env: {},
+        command: ["bun", script.target, "--relay", relayedSocket]
+      });
+      const probe = yield* containers.exec({
+        container: proxy,
+        workdir: "/",
+        env: {},
+        command: ["bun", script.target, "--probe", relayedSocket],
+        timeout: "1 minute"
+      });
+      if (probe.exitCode !== 0)
+        return yield* new SecretProxyUnreachable({ output: probe.output });
+    }
     for (const service of input.services ?? [])
       yield* acquireRelease(containers.connect({ network, ...service }), () => containers.disconnect({ network, container: service.container }));
   }
@@ -2709,7 +2819,8 @@ var startDockerSandbox = (input) => gen(function* () {
     ...input.docker.user === undefined ? undefined : { user: input.docker.user },
     mounts: [
       ...input.policy.writablePaths.map((writable) => ({ source: writable, target: writable })),
-      ...(input.readOnlyPaths ?? []).map((readable) => ({ source: readable, target: readable, readOnly: true }))
+      ...(input.readOnlyPaths ?? []).map((readable) => ({ source: readable, target: readable, readOnly: true })),
+      ...secretProxy === undefined ? [] : [{ source: secretProxy.trustBundle, target: trustBundle, readOnly: true }]
     ],
     workdir: input.workspace,
     env: {
@@ -2722,7 +2833,8 @@ var startDockerSandbox = (input) => gen(function* () {
         http_proxy: egressProxyAddress,
         NO_PROXY: "localhost,127.0.0.1",
         no_proxy: "localhost,127.0.0.1"
-      }
+      },
+      ...secretProxy === undefined ? undefined : Object.fromEntries(CA_TRUST_VARS.map((name) => [name, trustBundle]))
     },
     command: ["sleep", "infinity"]
   });
@@ -3179,12 +3291,14 @@ var runAttempt = (request, options) => gen(function* () {
   const { attempt } = request.attempt;
   const workspace = request.workspace.path;
   const secrets = request.launch.secrets ?? {};
-  if (Object.keys(secrets).length > 0 && request.sandbox.backend === "docker")
-    return failed("secrets_need_srt", "A docker Step cannot take Secrets yet: its egress proxy cannot swap their references for values, and Kitman puts no value in a sandbox. Run this Step in srt.");
   const bound = yield* result(requireSecretHosts(request.launch.secrets, request.launch.secretDestinations));
   if (isFailure(bound))
     return failed(bound.failure.reason, bound.failure.summary);
-  const referenced = request.sandbox.backend === "srt" ? secretReferences(secrets, request.launch.secretDestinations ?? {}) : undefined;
+  const referenced = request.sandbox.backend === "host" ? undefined : secretReferences(secrets, request.launch.secretDestinations ?? {});
+  const holdSecrets = (initial) => stepSecretRegistry(stepSecretDirectory(options.home, attempt.id), initial, referenced?.references ?? {}).pipe(mapError2(() => new AgentStepFailure({
+    reason: "secret_registry_unwritable",
+    summary: "The Step's Secret references could not be written."
+  })));
   const agent = referenced === undefined || request.launch.secrets === undefined ? request.launch : { ...request.launch, secrets: referenced.references };
   const prepared = yield* result(prepareHarness({
     attempt: request.attempt,
@@ -3225,10 +3339,7 @@ var runAttempt = (request, options) => gen(function* () {
           ]))
         };
         const holdsLogin = holdsLoginByReference(launch);
-        const registry = Object.keys(initial).length === 0 && !holdsLogin ? undefined : yield* stepSecretRegistry(stepSecretDirectory(options.home, attempt.id), initial, referenced?.references ?? {}).pipe(mapError2(() => new AgentStepFailure({
-          reason: "secret_registry_unwritable",
-          summary: "The Step's Secret references could not be written."
-        })));
+        const registry = Object.keys(initial).length === 0 && !holdsLogin ? undefined : yield* holdSecrets(initial);
         const withSessions = sessions === undefined ? policy : {
           ...policy,
           writablePaths: [...policy.writablePaths, sessions],
@@ -3254,14 +3365,27 @@ var runAttempt = (request, options) => gen(function* () {
       case "docker": {
         if (options.docker === undefined)
           return yield* new AgentStepFailure({ reason: "sandbox_unavailable", summary: "`docker` is not available." });
+        const registry = referenced === undefined || Object.keys(referenced.registry).length === 0 ? undefined : yield* holdSecrets(referenced.registry);
+        const secretProxy = registry === undefined ? undefined : yield* startDockerSecretProxy({
+          registryFile: registry.file,
+          socket: dockerSecretProxySocket(registry.directory),
+          network: policy.network
+        }).pipe(tapError2((error) => logWarning("secret_proxy_unavailable", error.cause)), mapError2(() => new AgentStepFailure({
+          reason: "secret_proxy_unavailable",
+          summary: "The proxy that swaps the Step's Secret references could not be started."
+        })));
         const { container } = yield* startDockerSandbox({
           docker: options.docker,
           runnerId: request.runnerId,
           attemptId: attempt.id,
           policy,
           workspace,
-          configDir
-        }).pipe(mapError2(() => new AgentStepFailure({
+          configDir,
+          ...secretProxy === undefined ? undefined : { secretProxy }
+        }).pipe(tapError2((error) => isTagged(error, "SecretProxyUnreachable") ? logWarning("secret_proxy_unavailable", error.output) : void_3), mapError2((error) => isTagged(error, "SecretProxyUnreachable") ? new AgentStepFailure({
+          reason: "secret_proxy_unavailable",
+          summary: "The egress container could not reach the proxy that swaps the Step's Secret references."
+        }) : new AgentStepFailure({
           reason: "sandbox_container_unavailable",
           summary: "The attempt's container could not be started."
         })));
@@ -3285,7 +3409,7 @@ var runAttempt = (request, options) => gen(function* () {
         return {
           argv: dockerExecArgv({ container, workspace, env: policy.environment, argv: harnessArgv }),
           env: policy.environment,
-          registry: undefined
+          registry
         };
       }
       default:
@@ -6804,6 +6928,7 @@ export {
   RepoMaterializationError,
   RunnerLabel,
   RunnerReplicaCancellation,
+  SecretProxyUnreachable,
   SkillMaterializationRefused2 as SkillMaterializationRefused,
   StepAttemptLabel,
   agentStepExecutionLimit,

package/dist/chunk-3edjgnxf.js

@@ -0,0 +1,202 @@
+// @bun
+import {
+  getOrUndefined,
+  flatMap,
+  toArray,
+  decodeUnknownOption,
+  optionalKey,
+  String4,
+  Struct,
+  Record,
+  ArraySchema,
+  decodeJsonStringOption,
+  encodeUnknownJsonStringSync
+} from "./chunk-d3ksv8y1.js";
+import {
+  replaceSecretReferences,
+  secretReferencesIn
+} from "./chunk-rrnee9mk.js";
+
+// packages/agent-runtime/src/srt-step.ts
+import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";
+import { spawn } from "child_process";
+import { readFileSync as readFileSync2 } from "fs";
+
+// packages/agent-runtime/src/secret-proxy.ts
+import { appendFileSync, readFileSync, renameSync, writeFileSync } from "fs";
+
+// packages/agent-runtime/src/egress-proxy.ts
+var egressAllowed = (hosts, host, port) => {
+  const target = host.toLowerCase();
+  return hosts.some((entry) => {
+    const [name = "", entryPort] = entry.toLowerCase().split(":");
+    if (entryPort !== undefined && Number(entryPort) !== port)
+      return false;
+    return name.startsWith("*.") ? target.endsWith(name.slice(1)) : target === name;
+  });
+};
+if (false)
+  ;
+
+// packages/agent-runtime/src/secret-proxy.ts
+var basicPrefix = /^basic\s+/i;
+var basicCredential = (value) => {
+  if (!basicPrefix.test(value))
+    return;
+  const decoded = Buffer.from(value.replace(basicPrefix, ""), "base64").toString("utf8");
+  return secretReferencesIn(decoded).length === 0 ? undefined : decoded;
+};
+var referencesInHeader = (value) => [
+  ...new Set([...secretReferencesIn(value), ...secretReferencesIn(basicCredential(value) ?? "")])
+];
+var swapped = (value, registry) => {
+  const swap = (reference) => registry[reference]?.value ?? reference;
+  const basic = basicCredential(value);
+  return basic === undefined ? replaceSecretReferences(value, swap) : `Basic ${Buffer.from(replaceSecretReferences(basic, swap)).toString("base64")}`;
+};
+var decideSecretRequest = (request, readRegistry) => {
+  const carrying = request.headers.flatMap(([name, value]) => {
+    const references = referencesInHeader(value);
+    return references.length === 0 ? [] : [{ name, value, references }];
+  });
+  const inTarget = secretReferencesIn(request.target);
+  if (carrying.length === 0 && inTarget.length === 0)
+    return { action: "allow" };
+  const registry = readRegistry();
+  const refusals = [
+    ...inTarget.map((reference) => ({
+      reference,
+      host: request.host,
+      reason: "A reference is swapped only in a header, never in a URL."
+    })),
+    ...[...new Set(carrying.flatMap((header) => header.references))].flatMap((reference) => {
+      const entry = registry?.[reference];
+      const reason = entry === undefined ? "The reference is unknown or revoked." : request.scheme !== "https" ? "A reference is swapped only over HTTPS." : !egressAllowed(entry.hosts, request.host, request.port) ? `The Secret may be sent only to ${entry.hosts.join(", ")}.` : undefined;
+      return reason === undefined ? [] : [{ reference, host: request.host, reason }];
+    })
+  ];
+  if (refusals.length > 0)
+    return {
+      action: "deny",
+      reason: `Kitman refused this request: ${refusals.map((refusal) => `${refusal.reference}: ${refusal.reason}`).join(" ")}`,
+      refusals
+    };
+  const names = new Set(carrying.map((header) => header.name.toLowerCase()));
+  return {
+    action: "allow",
+    setHeaders: request.headers.filter(([name]) => names.has(name.toLowerCase())).map(([name, value]) => [name, registry === undefined ? value : swapped(value, registry)])
+  };
+};
+var Registry = Record(String4, Struct({ value: String4, hosts: ArraySchema(String4) }));
+var Refusal = Struct({
+  reference: optionalKey(String4),
+  host: String4,
+  reason: String4
+});
+var readSecretRegistry = (file) => {
+  try {
+    return getOrUndefined(flatMap(decodeJsonStringOption(readFileSync(file, "utf8")), decodeUnknownOption(Registry)));
+  } catch {
+    return;
+  }
+};
+var writeSecretRegistry = (file, registry) => {
+  const next = `${file}.next`;
+  writeFileSync(next, encodeUnknownJsonStringSync(registry), { mode: 384 });
+  renameSync(next, file);
+};
+var secretRefusalLog = (registryFile) => `${registryFile}.refused`;
+var appendSecretRefusals = (registryFile, refusals) => appendFileSync(secretRefusalLog(registryFile), refusals.map((refusal) => `${encodeUnknownJsonStringSync(refusal)}
+`).join(""), { mode: 384 });
+var parseSecretRefusals = (text) => text.split(`
+`).flatMap((line) => toArray(flatMap(decodeJsonStringOption(line), decodeUnknownOption(Refusal))));
+
+// packages/agent-runtime/src/srt-step.ts
+var secretFilter2 = (registryFile) => (request, info) => {
+  const url = new URL(request.url);
+  const decision = decideSecretRequest({
+    headers: [...request.headers.entries()],
+    host: info?.target?.host ?? url.hostname,
+    port: info?.target?.port ?? (url.port === "" ? url.protocol === "https:" ? 443 : 80 : Number(url.port)),
+    target: info?.requestTarget ?? `${url.pathname}${url.search}`,
+    scheme: info?.scheme ?? (url.protocol === "https:" ? "https" : "http")
+  }, () => readSecretRegistry(registryFile));
+  if (decision.action === "allow")
+    return Promise.resolve(decision.setHeaders === undefined ? { action: "allow" } : { action: "allow", setHeaders: decision.setHeaders.map(([name, value]) => [name, value]) });
+  try {
+    appendSecretRefusals(registryFile, decision.refusals);
+  } catch {}
+  return Promise.resolve({ action: "deny", status: 403, mark: "secret-refused", reason: decision.reason });
+};
+var stepSandboxConfig = (settings, registryFile) => {
+  const parsed = SandboxRuntimeConfigSchema.safeParse({
+    ...settings,
+    network: { ...settings.network, tlsTerminate: {}, refuseOpaqueTunnels: true }
+  });
+  return parsed.success ? {
+    success: true,
+    data: { ...parsed.data, network: { ...parsed.data.network, filterRequest: secretFilter2(registryFile) } }
+  } : parsed;
+};
+var opaqueTunnelRefusal2 = "A tunnel Kitman cannot see into, such as SOCKS or a CONNECT without TLS, is refused.";
+var opaqueConnectReasons = "tunnel carries no TLS|this proxy does not tunnel CONNECTs";
+var isOpaqueConnectReason2 = (reason) => new RegExp(`^(?:${opaqueConnectReasons})`).test(reason);
+var opaqueTunnel = new RegExp(`^deny (?:socks-tunnel (\\S+) \\(refuseOpaqueTunnels\\)|http-request CONNECT (\\S+) \\((?:${opaqueConnectReasons})[^)]*\\))`);
+var refusedTunnelHost = (line) => {
+  const match = opaqueTunnel.exec(line);
+  return match === null ? undefined : match[1] ?? match[2];
+};
+var shellQuoted = (arg) => `'${arg.replaceAll("'", "'\\''")}'`;
+var argument = (args, flag) => {
+  const at = args.indexOf(flag);
+  return at === -1 ? undefined : args[at + 1];
+};
+var runSrtStep2 = async (args) => {
+  const separator = args.indexOf("--");
+  const settingsFile = argument(args, "--settings");
+  const registryFile = argument(args, "--secrets");
+  const command = separator === -1 ? [] : args.slice(separator + 1);
+  if (settingsFile === undefined || registryFile === undefined || command.length === 0) {
+    console.error("Usage: srt-step --settings <file> --secrets <registry> -- <command>");
+    process.exit(2);
+  }
+  delete process.env.SRT_DEBUG;
+  const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
+  const config = stepSandboxConfig(JSON.parse(readFileSync2(settingsFile, "utf8")), registryFile);
+  if (!config.success) {
+    console.error(`srt-step: ${settingsFile} does not hold a valid srt config: ${config.error.message}`);
+    process.exit(2);
+  }
+  await SandboxManager.initialize(config.data);
+  const recorded = new WeakSet;
+  SandboxManager.getSandboxViolationStore().subscribe((violations) => {
+    const refusals = violations.flatMap((violation) => {
+      if (recorded.has(violation))
+        return [];
+      recorded.add(violation);
+      const host = refusedTunnelHost(violation.line);
+      return host === undefined ? [] : [{ host, reason: opaqueTunnelRefusal2 }];
+    });
+    if (refusals.length === 0)
+      return;
+    try {
+      appendSecretRefusals(registryFile, refusals);
+    } catch {}
+  });
+  const child = spawn(await SandboxManager.wrapWithSandbox(command.map(shellQuoted).join(" ")), {
+    shell: true,
+    stdio: "inherit"
+  });
+  child.on("exit", (code, signal) => {
+    SandboxManager.cleanupAfterCommand();
+    process.exit(signal === null ? code ?? 0 : signal === "SIGINT" || signal === "SIGTERM" ? 0 : 1);
+  });
+  child.on("error", (error) => {
+    console.error(`Failed to execute command: ${error.message}`);
+    process.exit(1);
+  });
+  for (const signal of ["SIGINT", "SIGTERM"])
+    process.on(signal, () => child.kill(signal));
+};
+
+export { egressAllowed, writeSecretRegistry, secretRefusalLog, appendSecretRefusals, parseSecretRefusals, secretFilter2, opaqueTunnelRefusal2, isOpaqueConnectReason2, runSrtStep2 };

package/dist/chunk-gmnqchsc.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  secretFilter2,
+  opaqueTunnelRefusal2,
+  isOpaqueConnectReason2,
+  runSrtStep2
+} from "./chunk-3edjgnxf.js";
+import"./chunk-rrnee9mk.js";
+import"./chunk-v01c0k6j.js";
+import"./chunk-d3ksv8y1.js";
+export {
+  isOpaqueConnectReason2 as isOpaqueConnectReason,
+  opaqueTunnelRefusal2 as opaqueTunnelRefusal,
+  runSrtStep2 as runSrtStep,
+  secretFilter2 as secretFilter
+};

package/dist/{chunk-y7p921rs.js → chunk-r8rcfjag.js}

@@ -1651,7 +1651,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.10.71";
+var cliVersion = "0.10.73";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1901,7 +1901,7 @@ var Usage = [
   "Every run, loop, agent, verify, constraint, secret, claim, deploy, dev and kit command takes --json."
 ].join(`
 `);
-var agentRuntime = promise(() => import("./chunk-g4xsa9ks.js"));
+var agentRuntime = promise(() => import("./chunk-0rzh8yfd.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -4351,9 +4351,9 @@ function claimCommand(args) {
     }
   });
 }
-var KitWriter = map8(promise(() => import("./chunk-vs10kwdr.js")), (build) => build.writeKit);
+var KitWriter = map8(promise(() => import("./chunk-t1z7atrq.js")), (build) => build.writeKit);
 var KitBuilder = Reference("kitman/cli/KitBuilder", {
-  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-vs10kwdr.js")), (build) => build.buildKit(directory))
+  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-t1z7atrq.js")), (build) => build.buildKit(directory))
 });
 var uploadKit = (client, workspaceId, built) => gen(function* () {
   yield* client.uploadKitBundle(workspaceId, built.digest, { bundle: encode2(built.bundle) });

package/dist/egress-proxy.ts

@@ -215,10 +215,57 @@ export const startEgressProxy = (input: {
   return once(server, 'listening').then(() => server)
 }
 
-// `bun egress-proxy.ts <comma-separated allowlist>`
-if (import.meta.main)
-  void startEgressProxy({
-    hosts: (Bun.argv[2] ?? '').split(',').filter(host => host.length > 0),
+/** Passes every connection to the proxy listening on the Unix socket `socket`, which decides what leaves. */
+export const startEgressRelay = (input: {
+  readonly socket: string
+  readonly port: number
+  readonly hostname: string
+}): Promise<Server> => {
+  const server = createServer(client => {
+    const upstream = connect(input.socket)
+    let connected = false
+
+    client.pipe(upstream)
+    upstream.pipe(client)
+    upstream.once('connect', () => {
+      connected = true
+    })
+    upstream.on('error', () => {
+      if (connected) client.destroy()
+      else
+        client.end(
+          "HTTP/1.1 502 Bad Gateway\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nKitman's egress relay cannot reach the Runner's secret proxy.\n"
+        )
+    })
+    client.on('error', () => upstream.destroy())
+  }).listen(input.port, input.hostname)
+
+  return once(server, 'listening').then(() => server)
+}
+
+/** Whether a connection to the Unix socket `socket` opens. */
+export const probeSocket = (socket: string): Promise<boolean> => {
+  const probe = connect(socket)
+
+  return once(probe, 'connect').then(
+    () => (probe.destroy(), true),
+    () => false
+  )
+}
+
+const main = (argv: readonly string[]) => {
+  const [mode = '', socket = ''] = argv
+
+  if (mode === '--probe') return probeSocket(socket).then(opened => process.exit(opened ? 0 : 1))
+
+  if (mode === '--relay') return startEgressRelay({ socket, port: 3128, hostname: '0.0.0.0' })
+
+  return startEgressProxy({
+    hosts: mode.split(',').filter(host => host.length > 0),
     port: 3128,
     hostname: '0.0.0.0'
   })
+}
+
+// `bun egress-proxy.ts <comma-separated allowlist>`, `bun egress-proxy.ts --relay <socket>` or `--probe <socket>`
+if (import.meta.main) void main(Bun.argv.slice(2))

package/dist/index.js

@@ -8,12 +8,12 @@ if (args[0] === "srt") {
   const { runSrtCli } = await import("./chunk-rm83dbpv.js");
   await runSrtCli();
 } else if (args[0] === "srt-step") {
-  const { runSrtStep } = await import("./chunk-wtpwkjws.js");
+  const { runSrtStep } = await import("./chunk-gmnqchsc.js");
   await runSrtStep(args.slice(1));
 } else if (args[0] === "opencode-read") {
   const { runOpencodeReader } = await import("./chunk-60333x3q.js");
   runOpencodeReader();
 } else {
-  const { runCli } = await import("./chunk-y7p921rs.js");
+  const { runCli } = await import("./chunk-r8rcfjag.js");
   runCli(args);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.10.71",
+  "version": "0.10.73",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {

package/dist/chunk-1w81w56v.js

@@ -1,109 +0,0 @@
-// @bun
-import {
-  getOrUndefined,
-  flatMap,
-  toArray,
-  decodeUnknownOption,
-  optionalKey,
-  String4,
-  Struct,
-  Record,
-  ArraySchema,
-  decodeJsonStringOption,
-  encodeUnknownJsonStringSync
-} from "./chunk-d3ksv8y1.js";
-import {
-  replaceSecretReferences,
-  secretReferencesIn
-} from "./chunk-rrnee9mk.js";
-
-// packages/agent-runtime/src/secret-proxy.ts
-import { appendFileSync, readFileSync, renameSync, writeFileSync } from "fs";
-
-// packages/agent-runtime/src/egress-proxy.ts
-var egressAllowed = (hosts, host, port) => {
-  const target = host.toLowerCase();
-  return hosts.some((entry) => {
-    const [name = "", entryPort] = entry.toLowerCase().split(":");
-    if (entryPort !== undefined && Number(entryPort) !== port)
-      return false;
-    return name.startsWith("*.") ? target.endsWith(name.slice(1)) : target === name;
-  });
-};
-if (false)
-  ;
-
-// packages/agent-runtime/src/secret-proxy.ts
-var basicPrefix = /^basic\s+/i;
-var basicCredential = (value) => {
-  if (!basicPrefix.test(value))
-    return;
-  const decoded = Buffer.from(value.replace(basicPrefix, ""), "base64").toString("utf8");
-  return secretReferencesIn(decoded).length === 0 ? undefined : decoded;
-};
-var referencesInHeader = (value) => [
-  ...new Set([...secretReferencesIn(value), ...secretReferencesIn(basicCredential(value) ?? "")])
-];
-var swapped = (value, registry) => {
-  const swap = (reference) => registry[reference]?.value ?? reference;
-  const basic = basicCredential(value);
-  return basic === undefined ? replaceSecretReferences(value, swap) : `Basic ${Buffer.from(replaceSecretReferences(basic, swap)).toString("base64")}`;
-};
-var decideSecretRequest = (request, readRegistry) => {
-  const carrying = request.headers.flatMap(([name, value]) => {
-    const references = referencesInHeader(value);
-    return references.length === 0 ? [] : [{ name, value, references }];
-  });
-  const inTarget = secretReferencesIn(request.target);
-  if (carrying.length === 0 && inTarget.length === 0)
-    return { action: "allow" };
-  const registry = readRegistry();
-  const refusals = [
-    ...inTarget.map((reference) => ({
-      reference,
-      host: request.host,
-      reason: "A reference is swapped only in a header, never in a URL."
-    })),
-    ...[...new Set(carrying.flatMap((header) => header.references))].flatMap((reference) => {
-      const entry = registry?.[reference];
-      const reason = entry === undefined ? "The reference is unknown or revoked." : request.scheme !== "https" ? "A reference is swapped only over HTTPS." : !egressAllowed(entry.hosts, request.host, request.port) ? `The Secret may be sent only to ${entry.hosts.join(", ")}.` : undefined;
-      return reason === undefined ? [] : [{ reference, host: request.host, reason }];
-    })
-  ];
-  if (refusals.length > 0)
-    return {
-      action: "deny",
-      reason: `Kitman refused this request: ${refusals.map((refusal) => `${refusal.reference}: ${refusal.reason}`).join(" ")}`,
-      refusals
-    };
-  const names = new Set(carrying.map((header) => header.name.toLowerCase()));
-  return {
-    action: "allow",
-    setHeaders: request.headers.filter(([name]) => names.has(name.toLowerCase())).map(([name, value]) => [name, registry === undefined ? value : swapped(value, registry)])
-  };
-};
-var Registry = Record(String4, Struct({ value: String4, hosts: ArraySchema(String4) }));
-var Refusal = Struct({
-  reference: optionalKey(String4),
-  host: String4,
-  reason: String4
-});
-var readSecretRegistry = (file) => {
-  try {
-    return getOrUndefined(flatMap(decodeJsonStringOption(readFileSync(file, "utf8")), decodeUnknownOption(Registry)));
-  } catch {
-    return;
-  }
-};
-var writeSecretRegistry = (file, registry) => {
-  const next = `${file}.next`;
-  writeFileSync(next, encodeUnknownJsonStringSync(registry), { mode: 384 });
-  renameSync(next, file);
-};
-var secretRefusalLog = (registryFile) => `${registryFile}.refused`;
-var appendSecretRefusals = (registryFile, refusals) => appendFileSync(secretRefusalLog(registryFile), refusals.map((refusal) => `${encodeUnknownJsonStringSync(refusal)}
-`).join(""), { mode: 384 });
-var parseSecretRefusals = (text) => text.split(`
-`).flatMap((line) => toArray(flatMap(decodeJsonStringOption(line), decodeUnknownOption(Refusal))));
-
-export { decideSecretRequest, readSecretRegistry, writeSecretRegistry, secretRefusalLog, appendSecretRefusals, parseSecretRefusals };

package/dist/chunk-wtpwkjws.js

@@ -1,100 +0,0 @@
-// @bun
-import"./chunk-d3ksv8y1.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import {
-  decideSecretRequest,
-  readSecretRegistry,
-  appendSecretRefusals
-} from "./chunk-1w81w56v.js";
-
-// packages/agent-runtime/src/srt-step.ts
-import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";
-import { spawn } from "child_process";
-import { readFileSync } from "fs";
-var secretFilter = (registryFile) => (request, info) => {
-  const url = new URL(request.url);
-  const decision = decideSecretRequest({
-    headers: [...request.headers.entries()],
-    host: info?.target?.host ?? url.hostname,
-    port: info?.target?.port ?? (url.port === "" ? url.protocol === "https:" ? 443 : 80 : Number(url.port)),
-    target: info?.requestTarget ?? `${url.pathname}${url.search}`,
-    scheme: info?.scheme ?? (url.protocol === "https:" ? "https" : "http")
-  }, () => readSecretRegistry(registryFile));
-  if (decision.action === "allow")
-    return Promise.resolve(decision.setHeaders === undefined ? { action: "allow" } : { action: "allow", setHeaders: decision.setHeaders.map(([name, value]) => [name, value]) });
-  try {
-    appendSecretRefusals(registryFile, decision.refusals);
-  } catch {}
-  return Promise.resolve({ action: "deny", status: 403, mark: "secret-refused", reason: decision.reason });
-};
-var stepSandboxConfig = (settings, registryFile) => {
-  const parsed = SandboxRuntimeConfigSchema.safeParse({
-    ...settings,
-    network: { ...settings.network, tlsTerminate: {}, refuseOpaqueTunnels: true }
-  });
-  return parsed.success ? {
-    success: true,
-    data: { ...parsed.data, network: { ...parsed.data.network, filterRequest: secretFilter(registryFile) } }
-  } : parsed;
-};
-var opaqueTunnel = /^deny (?:socks-tunnel (\S+) \(refuseOpaqueTunnels\)|http-request CONNECT (\S+) \((?:tunnel carries no TLS|this proxy does not tunnel CONNECTs)[^)]*\))/;
-var refusedTunnelHost = (line) => {
-  const match = opaqueTunnel.exec(line);
-  return match === null ? undefined : match[1] ?? match[2];
-};
-var shellQuoted = (arg) => `'${arg.replaceAll("'", "'\\''")}'`;
-var argument = (args, flag) => {
-  const at = args.indexOf(flag);
-  return at === -1 ? undefined : args[at + 1];
-};
-var runSrtStep = async (args) => {
-  const separator = args.indexOf("--");
-  const settingsFile = argument(args, "--settings");
-  const registryFile = argument(args, "--secrets");
-  const command = separator === -1 ? [] : args.slice(separator + 1);
-  if (settingsFile === undefined || registryFile === undefined || command.length === 0) {
-    console.error("Usage: srt-step --settings <file> --secrets <registry> -- <command>");
-    process.exit(2);
-  }
-  delete process.env.SRT_DEBUG;
-  const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
-  const config = stepSandboxConfig(JSON.parse(readFileSync(settingsFile, "utf8")), registryFile);
-  if (!config.success) {
-    console.error(`srt-step: ${settingsFile} does not hold a valid srt config: ${config.error.message}`);
-    process.exit(2);
-  }
-  await SandboxManager.initialize(config.data);
-  const recorded = new WeakSet;
-  SandboxManager.getSandboxViolationStore().subscribe((violations) => {
-    const refusals = violations.flatMap((violation) => {
-      if (recorded.has(violation))
-        return [];
-      recorded.add(violation);
-      const host = refusedTunnelHost(violation.line);
-      return host === undefined ? [] : [{ host, reason: "A tunnel Kitman cannot see into, such as SOCKS or a CONNECT without TLS, is refused." }];
-    });
-    if (refusals.length === 0)
-      return;
-    try {
-      appendSecretRefusals(registryFile, refusals);
-    } catch {}
-  });
-  const child = spawn(await SandboxManager.wrapWithSandbox(command.map(shellQuoted).join(" ")), {
-    shell: true,
-    stdio: "inherit"
-  });
-  child.on("exit", (code, signal) => {
-    SandboxManager.cleanupAfterCommand();
-    process.exit(signal === null ? code ?? 0 : signal === "SIGINT" || signal === "SIGTERM" ? 0 : 1);
-  });
-  child.on("error", (error) => {
-    console.error(`Failed to execute command: ${error.message}`);
-    process.exit(1);
-  });
-  for (const signal of ["SIGINT", "SIGTERM"])
-    process.on(signal, () => child.kill(signal));
-};
-export {
-  runSrtStep
-};

package/dist/{chunk-vs10kwdr.js → chunk-t1z7atrq.js}

@@ -35,6 +35,14 @@ import {
 } from "./chunk-d3ksv8y1.js";
 import"./chunk-rrnee9mk.js";
 import"./chunk-v01c0k6j.js";
+import {
+  decodeText,
+  mkString,
+  FileSystem,
+  Path,
+  withDefault,
+  String2
+} from "./chunk-dk0ftqwg.js";
 import {
   SecureRandom,
   layerWebCrypto,
@@ -47,14 +55,6 @@ import {
   kitmanMcpServer,
   RunnerRpcProtocolVersion
 } from "./chunk-9e452fhe.js";
-import {
-  decodeText,
-  mkString,
-  FileSystem,
-  Path,
-  withDefault,
-  String2
-} from "./chunk-dk0ftqwg.js";
 import {
   Packument,
   tarballMatches