@neeter/server 0.8.1 → 0.9.0

package/dist/hooks.d.ts

@@ -1,10 +1,34 @@
 import type { HookCallbackMatcher } from "@anthropic-ai/claude-agent-sdk";
+export interface SandboxHookOptions {
+    /**
+     * Allow Bash tool calls through the sandbox hook (default: `false`).
+     *
+     * Bash commands can reference arbitrary filesystem paths via subshells,
+     * variable expansion, redirects, and other shell features that can't be
+     * reliably inspected. When `false`, all Bash calls are blocked.
+     *
+     * If you need Bash access inside a sandbox, set this to `true` and use
+     * OS-level isolation instead: containers with `--network none` and a
+     * read-only filesystem, `@anthropic-ai/sandbox-runtime`, or VMs.
+     *
+     * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+     */
+    allowBash?: boolean;
+}
 /**
  * Creates a PreToolUse hook that blocks file operations outside a sandbox directory.
  * Inspects `file_path` and `path` fields in tool input and blocks any resolved path
  * that falls outside the given directory.
  *
+ * Bash is blocked by default because shell commands can reference paths outside the
+ * sandbox in ways that can't be reliably detected (subshells, variable expansion,
+ * redirects, backticks). To sandbox Bash, use OS-level isolation — containers,
+ * `@anthropic-ai/sandbox-runtime`, or VMs — and set `options.allowBash` to `true`.
+ *
+ * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+ *
  * @param sandboxDir - Absolute path to the sandbox directory (must already be resolved)
  * @param resolvePath - Path resolver function (e.g. `path.resolve` from `node:path`)
+ * @param options - Configuration options
  */
-export declare function createSandboxHook(sandboxDir: string, resolvePath: (...segments: string[]) => string): HookCallbackMatcher[];
+export declare function createSandboxHook(sandboxDir: string, resolvePath: (...segments: string[]) => string, options?: SandboxHookOptions): HookCallbackMatcher[];

package/dist/hooks.js

@@ -3,17 +3,35 @@
  * Inspects `file_path` and `path` fields in tool input and blocks any resolved path
  * that falls outside the given directory.
  *
+ * Bash is blocked by default because shell commands can reference paths outside the
+ * sandbox in ways that can't be reliably detected (subshells, variable expansion,
+ * redirects, backticks). To sandbox Bash, use OS-level isolation — containers,
+ * `@anthropic-ai/sandbox-runtime`, or VMs — and set `options.allowBash` to `true`.
+ *
+ * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+ *
  * @param sandboxDir - Absolute path to the sandbox directory (must already be resolved)
  * @param resolvePath - Path resolver function (e.g. `path.resolve` from `node:path`)
+ * @param options - Configuration options
  */
-export function createSandboxHook(sandboxDir, resolvePath) {
+export function createSandboxHook(sandboxDir, resolvePath, options) {
     const normalizedDir = resolvePath(sandboxDir);
+    const allowBash = options?.allowBash ?? false;
     return [
         {
             hooks: [
                 async (input) => {
                     if (input.hook_event_name !== "PreToolUse")
                         return {};
+                    const toolName = input.tool_name;
+                    if (toolName === "Bash" && !allowBash) {
+                        return {
+                            decision: "block",
+                            reason: "Bash is blocked in sandbox mode — shell commands can reference arbitrary paths. " +
+                                "Use allowBash with OS-level isolation (containers, sandbox-runtime) for Bash access. " +
+                                "See https://platform.claude.com/docs/en/agent-sdk/secure-deployment",
+                        };
+                    }
                     const toolInput = input.tool_input;
                     const filePath = (toolInput.file_path ?? toolInput.path);
                     if (!filePath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neeter/server",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Hono server toolkit for building chat UIs on top of the Claude Agent SDK",
   "license": "MIT",
   "author": "Dan Leeper",
@@ -21,7 +21,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@neeter/types": "0.8.1"
+    "@neeter/types": "0.9.0"
   },
   "peerDependencies": {
     "@anthropic-ai/claude-agent-sdk": ">=0.2.0",