@papercraneai/sandbox-agent 0.1.17-beta.2 → 0.1.18

package/dist/index.js

@@ -15,6 +15,24 @@ import { homedir, networkInterfaces } from "os";
 import { z } from "zod";
 import multer from "multer";
 import * as log from "./logger.js";
+// ─── Egress-proxy scoping (sealed GCE sandbox) ────────────────────────────────
+// The sealed GCE sandbox injects HTTPS_PROXY container-wide so Claude Code's Vertex
+// calls reach the US-multi-region endpoint through the egress proxy. But that proxy
+// allow-lists ONLY the Vertex host and 403s everything else — so every OTHER client in
+// the container (the `papercrane` CLI, npm, this agent's own control-plane calls) must
+// NOT be proxied; their targets (cp.papercrane.internal:80, *.pkg.dev) are directly
+// reachable and get denied if sent through the proxy. So: capture the proxy config,
+// strip it from the ambient env so nothing inherits it, and re-apply it to ONLY the
+// Claude Code subprocess via query()'s `options.env` (see buildQuery below).
+// gce.ts injects the proxy as UPPERCASE HTTPS_PROXY/NO_PROXY, and Claude Code reads it via
+// proxy-from-env's getProxyForUrl (confirmed by grepping the bundled SDK) whose lookup is
+// `env[key.toLowerCase()] || env[key.toUpperCase()]` — so uppercase alone is honored. Capture +
+// re-inject uppercase only; the strip below clears both casings just to fully wipe the ambient env.
+const VERTEX_HTTPS_PROXY = process.env.HTTPS_PROXY || "";
+const VERTEX_NO_PROXY = process.env.NO_PROXY || "";
+for (const k of ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "NO_PROXY", "no_proxy"]) {
+    delete process.env[k];
+}
 // Get the directory of this file (works for both source and compiled)
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -1414,6 +1432,17 @@ app.post("/chat", async (req, res) => {
     if (effort !== undefined) {
         options.effort = effort;
     }
+    // Scope the egress proxy to ONLY the Claude Code process (see top-of-file note):
+    // its Vertex calls go through the proxy; everything else in the container stays direct.
+    if (VERTEX_HTTPS_PROXY) {
+        // Claude Code reads HTTPS_PROXY/NO_PROXY via proxy-from-env (honors uppercase), so uppercase
+        // is all that's needed — no lowercase duplicate.
+        options.env = {
+            ...process.env,
+            HTTPS_PROXY: VERTEX_HTTPS_PROXY,
+            ...(VERTEX_NO_PROXY ? { NO_PROXY: VERTEX_NO_PROXY } : {}),
+        };
+    }
     try {
         let gotResult = false;
         log.debug({ ...ctx, elapsed: Date.now() - requestStartTime }, "Starting Claude SDK query");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papercraneai/sandbox-agent",
-  "version": "0.1.17-beta.2",
+  "version": "0.1.18",
   "description": "Claude Agent SDK server for sandbox environments",
   "license": "MIT",
   "type": "module",
@@ -17,19 +17,18 @@
   "scripts": {
     "start": "node dist/index.js",
     "dev": "tsx watch src/index.ts",
-    "dev:local": "PROJECT_DIR=./template/src/app tsx src/index.ts",
     "prepublishOnly": "npm run build",
     "build": "tsc",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.128",
-    "@papercraneai/cli": "*",
+    "@papercraneai/cli": "^1.10.0",
     "diff": "^5.2.0",
     "express": "^4.21.1",
     "multer": "^2.0.2",
     "tail": "^2.2.6",
-    "ws": "^8.19.0",
+    "ws": "^8.20.1",
     "zod": "^4.0.0"
   },
   "devDependencies": {
@@ -41,5 +40,10 @@
     "@types/ws": "^8.18.1",
     "tsx": "^4.20.6",
     "typescript": "^5.8.3"
+  },
+  "overrides": {
+    "hono": "^4.12.25",
+    "form-data": "^4.0.6",
+    "qs": "^6.15.2"
   }
 }