@questpie/sandbox 3.17.0 → 3.19.0

package/dist/{adapter-http-DDeL-Ym3.d.mts → adapter-http-CCmYxOrN.d.mts}

@@ -1,4 +1,4 @@
-import { a as SandboxCustomToolsRunOptions } from "./custom-tools-CgfgyVNv.mjs";
+import { a as SandboxCustomToolsRunOptions } from "./custom-tools-CbaRJ1ei.mjs";
 import { ExecutorAdapter, ExecutorRunOptions, ExecutorRunResult } from "questpie/executor";
 
 //#region src/workload-admission.d.ts

package/dist/adapter.d.mts

@@ -1,3 +1,3 @@
-import { f as SandboxWorkloadPolicy, i as httpSandboxAdapter, n as HttpSandboxAdapterOptions, o as SandboxWorkloadAuditContext, p as SandboxWorkloadRunOptions, r as WorkloadHttpSandboxOptions, s as SandboxWorkloadAuditEvent, t as HttpSandboxAdapter, u as SandboxWorkloadAuthorizer } from "./adapter-http-DDeL-Ym3.mjs";
-import { a as SandboxCustomToolsRunOptions, i as SandboxCustomToolsLimits, n as SandboxCustomToolEvidenceEvent, o as sandboxCustomTools, r as SandboxCustomToolsConfig, t as SandboxCustomToolEvidenceContext } from "./custom-tools-CgfgyVNv.mjs";
+import { f as SandboxWorkloadPolicy, i as httpSandboxAdapter, n as HttpSandboxAdapterOptions, o as SandboxWorkloadAuditContext, p as SandboxWorkloadRunOptions, r as WorkloadHttpSandboxOptions, s as SandboxWorkloadAuditEvent, t as HttpSandboxAdapter, u as SandboxWorkloadAuthorizer } from "./adapter-http-CCmYxOrN.mjs";
+import { a as SandboxCustomToolsRunOptions, i as SandboxCustomToolsLimits, n as SandboxCustomToolEvidenceEvent, o as sandboxCustomTools, r as SandboxCustomToolsConfig, t as SandboxCustomToolEvidenceContext } from "./custom-tools-CbaRJ1ei.mjs";
 export { HttpSandboxAdapter, type HttpSandboxAdapterOptions, type SandboxCustomToolEvidenceContext, type SandboxCustomToolEvidenceEvent, type SandboxCustomToolsConfig, type SandboxCustomToolsLimits, type SandboxCustomToolsRunOptions, type SandboxWorkloadAuditContext, type SandboxWorkloadAuditEvent, type SandboxWorkloadAuthorizer, type SandboxWorkloadPolicy, type SandboxWorkloadRunOptions, type WorkloadHttpSandboxOptions, httpSandboxAdapter, sandboxCustomTools };

package/dist/{custom-tools-CgfgyVNv.d.mts → custom-tools-CbaRJ1ei.d.mts}

@@ -1,6 +1,4 @@
 import { McpWorkloadAuditEvent, McpWorkloadAuthorizer, McpWorkloadContextBinder, McpWorkloadHandoff } from "@questpie/mcp";
-import "questpie";
-import "questpie/executor";
 
 //#region src/custom-tools.d.ts
 interface SandboxCustomToolsLimits {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as SandboxWorkloadAdmissionVerification, C as SandboxCapabilities, D as SandboxWorkloadAdmissionClaims, E as WORKLOAD_ADMISSION_HEADER, O as SandboxWorkloadAdmissionDenialReason, S as SandboxBindings, T as SandboxRunResult, _ as GuestResultMessage, a as SANDBOX_WORKLOAD_DENIAL_MESSAGE, b as HostRpcResultMessage, c as SandboxWorkloadAuthorizationContext, d as SandboxWorkloadDeniedError, f as SandboxWorkloadPolicy, g as GuestMessage, h as FRAME_MARKER, i as httpSandboxAdapter, k as SandboxWorkloadAdmissionKey, l as SandboxWorkloadAuthorizationPhase, m as BINDINGS_TOKEN_HEADER, n as HttpSandboxAdapterOptions, o as SandboxWorkloadAuditContext, p as SandboxWorkloadRunOptions, r as WorkloadHttpSandboxOptions, s as SandboxWorkloadAuditEvent, t as HttpSandboxAdapter, u as SandboxWorkloadAuthorizer, v as GuestRpcMessage, w as SandboxRunRequest, x as SandboxBindingError, y as HOST_ADMISSION_HEADER } from "./adapter-http-DDeL-Ym3.mjs";
-import { a as SandboxCustomToolsRunOptions, i as SandboxCustomToolsLimits, n as SandboxCustomToolEvidenceEvent, o as sandboxCustomTools, r as SandboxCustomToolsConfig, t as SandboxCustomToolEvidenceContext } from "./custom-tools-CgfgyVNv.mjs";
+import { A as SandboxWorkloadAdmissionVerification, C as SandboxCapabilities, D as SandboxWorkloadAdmissionClaims, E as WORKLOAD_ADMISSION_HEADER, O as SandboxWorkloadAdmissionDenialReason, S as SandboxBindings, T as SandboxRunResult, _ as GuestResultMessage, a as SANDBOX_WORKLOAD_DENIAL_MESSAGE, b as HostRpcResultMessage, c as SandboxWorkloadAuthorizationContext, d as SandboxWorkloadDeniedError, f as SandboxWorkloadPolicy, g as GuestMessage, h as FRAME_MARKER, i as httpSandboxAdapter, k as SandboxWorkloadAdmissionKey, l as SandboxWorkloadAuthorizationPhase, m as BINDINGS_TOKEN_HEADER, n as HttpSandboxAdapterOptions, o as SandboxWorkloadAuditContext, p as SandboxWorkloadRunOptions, r as WorkloadHttpSandboxOptions, s as SandboxWorkloadAuditEvent, t as HttpSandboxAdapter, u as SandboxWorkloadAuthorizer, v as GuestRpcMessage, w as SandboxRunRequest, x as SandboxBindingError, y as HOST_ADMISSION_HEADER } from "./adapter-http-CCmYxOrN.mjs";
+import { a as SandboxCustomToolsRunOptions, i as SandboxCustomToolsLimits, n as SandboxCustomToolEvidenceEvent, o as sandboxCustomTools, r as SandboxCustomToolsConfig, t as SandboxCustomToolEvidenceContext } from "./custom-tools-CbaRJ1ei.mjs";
 
 //#region src/net-validation.d.ts
 
@@ -17,10 +17,25 @@ import { a as SandboxCustomToolsRunOptions, i as SandboxCustomToolsLimits, n as
  * Bun/Node (manifest validation in the adapter) and Deno (the sandbox server).
  * It defaults to `node:dns/promises`, which both Bun and Deno implement.
  *
- * SCOPE (M2): manifest-time rejection of private-IP hosts is implemented and
- * enforced here. Full connect-time DNS-rebind PINNING (re-resolving and
- * re-checking the exact IP the socket connects to, including across redirects)
- * is NOT yet implemented — see `TODO(security)` in `sandbox-server.ts`.
+ * SCOPE: this module is the MANIFEST-TIME check — it rejects a host whose
+ * records already point somewhere private before the run is admitted.
+ *
+ * It is NOT the rebinding defense, and does not need to be. Connect-time
+ * pinning lives on the trusted host in the core executor's brokered fetch
+ * (`questpie/src/server/modules/core/integrated/executor/bindings/host-fetch.ts`):
+ * the guest runs with `--allow-net=[]` and cannot open a socket at all, so every
+ * request is relayed to the broker, which resolves the host itself, validates
+ * every A and AAAA record, pins the socket to a validated IP literal while
+ * keeping the hostname for SNI and the Host header, and re-resolves and
+ * re-validates each redirect hop with auto-follow disabled.
+ *
+ * On Linux there is additionally a kernel-level egress drop
+ * (`egress-firewall.ts`) as a second, independent boundary.
+ *
+ * An earlier version of this comment said pinning was unimplemented and pointed
+ * at a `TODO(security)` in `sandbox-server.ts`. Both the TODO and the gap are
+ * gone; `test/unit/services/host-fetch-ssrf.test.ts` covers redirect re-pinning,
+ * open-redirect egress, metadata addresses and non-decimal IPv4 encodings.
  */
 /** A single parsed `host[:port]` allowlist entry. */
 interface ParsedHost {

package/dist/modules/sandbox.d.mts

@@ -1,7 +1,6 @@
-import "../custom-tools-CgfgyVNv.mjs";
+import "../custom-tools-CbaRJ1ei.mjs";
 import * as questpie0 from "questpie";
 import { routeApp } from "questpie";
-import "questpie/executor";
 import { RouteDefinition, RouteParamsFromKey } from "questpie/types";
 
 //#region src/server/modules/sandbox/routes/sandbox/rpc.d.ts

package/package.json

@@ -1,7 +1,8 @@
 {
 	"name": "@questpie/sandbox",
-	"version": "3.17.0",
+	"version": "3.19.0",
 	"private": false,
+	"description": "Hardened isolated-script execution for QUESTPIE",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/questpie/questpie.git",
@@ -68,12 +69,12 @@
 	"scripts": {
 		"build": "tsdown",
 		"check-types": "tsc --noEmit",
-		"questpie:generate": "bun questpie generate --verbose",
+		"questpie:generate": "bun run ../questpie/src/exports/cli.ts generate --verbose",
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@questpie/mcp": "^3.17.0",
-		"questpie": "^3.17.0"
+		"@questpie/mcp": "^3.19.0",
+		"questpie": "^3.19.0"
 	},
 	"devDependencies": {
 		"bun-types": "latest",
@@ -81,6 +82,6 @@
 		"zod": "^4.2.1"
 	},
 	"peerDependencies": {
-		"questpie": "^3.17.0"
+		"questpie": "^3.19.0"
 	}
 }

package/src/net-validation.ts

@@ -12,10 +12,25 @@
  * Bun/Node (manifest validation in the adapter) and Deno (the sandbox server).
  * It defaults to `node:dns/promises`, which both Bun and Deno implement.
  *
- * SCOPE (M2): manifest-time rejection of private-IP hosts is implemented and
- * enforced here. Full connect-time DNS-rebind PINNING (re-resolving and
- * re-checking the exact IP the socket connects to, including across redirects)
- * is NOT yet implemented — see `TODO(security)` in `sandbox-server.ts`.
+ * SCOPE: this module is the MANIFEST-TIME check — it rejects a host whose
+ * records already point somewhere private before the run is admitted.
+ *
+ * It is NOT the rebinding defense, and does not need to be. Connect-time
+ * pinning lives on the trusted host in the core executor's brokered fetch
+ * (`questpie/src/server/modules/core/integrated/executor/bindings/host-fetch.ts`):
+ * the guest runs with `--allow-net=[]` and cannot open a socket at all, so every
+ * request is relayed to the broker, which resolves the host itself, validates
+ * every A and AAAA record, pins the socket to a validated IP literal while
+ * keeping the hostname for SNI and the Host header, and re-resolves and
+ * re-validates each redirect hop with auto-follow disabled.
+ *
+ * On Linux there is additionally a kernel-level egress drop
+ * (`egress-firewall.ts`) as a second, independent boundary.
+ *
+ * An earlier version of this comment said pinning was unimplemented and pointed
+ * at a `TODO(security)` in `sandbox-server.ts`. Both the TODO and the gap are
+ * gone; `test/unit/services/host-fetch-ssrf.test.ts` covers redirect re-pinning,
+ * open-redirect egress, metadata addresses and non-decimal IPv4 encodings.
  */
 
 /** A single parsed `host[:port]` allowlist entry. */