@sysid/sandbox-runtime-improved 0.0.43-sysid.4 → 0.0.43-sysid.6

package/README.md

@@ -4,6 +4,12 @@
 
 
 Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/sandbox-runtime).
+Why: I just need faster feature cycle-times.
+
+This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously.
+As new features become available, equivalent local ones will be removed.
+
+> Objective: keep as close to original as possible, while allowing selected additional features.
 
 ---
 
@@ -11,14 +17,12 @@ Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/s
 
 ```json
 {
-    "network": {
-        "upstreamHttpProxy": "http://127.0.0.1:3128"
-    },
-    "allowBrowserProcess": false
+    "allowBrowserProcess": false,
+    "allowMachLookup": ["com.1password.*"]
 }
 ```
-- `network.upstreamHttpProxy` - URL of an upstream HTTP proxy to chain through (e.g., `"http://127.0.0.1:3128"`). When set, the built-in proxy forwards allowed requests through this proxy instead of connecting directly. Useful behind corporate proxies. *(fork-only)*
 - `allowBrowserProcess` - Allow browser process operations in the macOS sandbox (boolean, default: false). Grants Mach IPC, bootstrap registration, IOKit, and POSIX shared memory permissions that Chromium-based browsers need to launch. Required for tools like `agent-browser` that spawn a Chrome subprocess. *(fork-only)*
+- `allowMachLookup` - Additional Mach/XPC service names to allow in the macOS sandbox (string array, optional). Names ending with `*` use prefix matching (e.g., `"com.1password.*"`). Use for tools like 1Password CLI that need specific services. *(fork-only, mirrors [upstream PR #92](https://github.com/anthropic-experimental/sandbox-runtime/pull/92))*
 
 ---
 
@@ -33,7 +37,7 @@ A lightweight sandboxing tool for enforcing filesystem and network restrictions
 ## Installation
 
 ```bash
-npm install -g @sysid/sandbox-runtime
+npm install -g @sysid/sandbox-runtime-improved
 ```
 
 ## Basic Usage
@@ -170,6 +174,7 @@ src/
     ├── sandbox-violation-store.ts # Violation tracking
     ├── sandbox-utils.ts      # Shared sandbox utilities
     ├── http-proxy.ts         # HTTP/HTTPS proxy for network filtering
+    ├── parent-proxy.ts       # Upstream/parent proxy chaining
     ├── socks-proxy.ts        # SOCKS5 proxy for network filtering
     ├── linux-sandbox-utils.ts # Linux bubblewrap sandboxing
     └── macos-sandbox-utils.ts # macOS sandbox-exec sandboxing
@@ -198,7 +203,7 @@ srti --settings /path/to/srt-settings.json npm install
 import {
   SandboxManager,
   type SandboxRuntimeConfig,
-} from '@anthropic-ai/sandbox-runtime'
+} from '@sysid/sandbox-runtime-improved'
 import { spawn } from 'child_process'
 
 // Define your sandbox configuration
@@ -237,10 +242,10 @@ child.on('exit', async code => {
 
 ```typescript
 // Main sandbox manager
-export { SandboxManager } from '@anthropic-ai/sandbox-runtime'
+export { SandboxManager } from '@sysid/sandbox-runtime-improved'
 
 // Violation tracking
-export { SandboxViolationStore } from '@anthropic-ai/sandbox-runtime'
+export { SandboxViolationStore } from '@sysid/sandbox-runtime-improved'
 
 // TypeScript types
 export type {
@@ -252,7 +257,7 @@ export type {
   FsReadRestrictionConfig,
   FsWriteRestrictionConfig,
   NetworkRestrictionConfig,
-} from '@anthropic-ai/sandbox-runtime'
+} from '@sysid/sandbox-runtime-improved'
 ```
 
 ## Configuration
@@ -279,6 +284,11 @@ srti --settings /path/to/srt-settings.json <command>
       "*.npmjs.org"
     ],
     "deniedDomains": ["malicious.com"],
+    "parentProxy": {
+      "http": "http://proxy.corp:3128",
+      "https": "http://proxy.corp:3128",
+      "noProxy": "localhost,127.0.0.1,*.internal.corp"
+    },
     "allowUnixSockets": ["/var/run/docker.sock"],
     "allowLocalBinding": false
   },
@@ -307,6 +317,10 @@ Uses an **allow-only pattern** - all network access is denied by default.
 - `network.allowedDomains` - Array of allowed domains (supports wildcards like `*.example.com`). Empty array = no network access.
 - `network.deniedDomains` - Array of denied domains (checked first, takes precedence over allowedDomains)
 - `network.allowLocalBinding` - Allow binding to local ports (boolean, default: false)
+- `network.parentProxy` - Upstream HTTP proxy for outbound connections (object, optional). When set, the sandbox's built-in proxy tunnels traffic through this parent proxy instead of connecting directly. Falls back to `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables if unset.
+  - `http` - Proxy URL for plain HTTP traffic (e.g., `"http://proxy.corp:3128"`)
+  - `https` - Proxy URL for HTTPS/CONNECT traffic (falls back to `http` if unset)
+  - `noProxy` - Comma-separated bypass list: hostname suffixes and CIDR ranges that connect directly
 
 **Unix Socket Settings** (platform-specific behavior):
 
@@ -369,6 +383,7 @@ Examples:
 - `ignoreViolations` - Object mapping command patterns to arrays of paths where violations should be ignored
 - `enableWeakerNestedSandbox` - Enable weaker sandbox mode for Docker environments (boolean, default: false)
 - `enableWeakerNetworkIsolation` - Allow access to `com.apple.trustd.agent` in the macOS sandbox (boolean, default: false). This is needed for Go programs (`gh`, `gcloud`, `terraform`, `kubectl`, etc.) to verify TLS certificates when using `httpProxyPort` with a MITM proxy and custom CA. **Security warning:** enabling this opens a potential data exfiltration vector through the trustd service.
+- `allowMachLookup` - Additional Mach/XPC service names to allow in the macOS sandbox (string array, optional). Names ending with `*` use prefix matching (e.g., `"com.1password.*"` allows all 1Password services). Others use exact matching.
 
 ### Common Configuration Recipes
 
@@ -536,6 +551,8 @@ The sandbox runs HTTP and SOCKS5 proxy servers on the host machine that filter a
 
 - **macOS**: The Seatbelt profile allows communication only to specific localhost ports where the proxies listen. All other network access is blocked.
 
+**Parent/upstream proxy chaining:** When running behind a corporate proxy, configure `network.parentProxy` (or set `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables) to chain the sandbox's proxies through an upstream proxy. Both HTTP and SOCKS5 traffic will tunnel through the parent proxy via CONNECT. Destinations matching `noProxy` patterns bypass the parent and connect directly.
+
 ### Filesystem Isolation
 
 Filesystem restrictions are enforced at the OS level:

package/dist/sandbox/http-proxy.d.ts

@@ -1,6 +1,6 @@
 import type { Socket, Server } from 'node:net';
 import type { Duplex } from 'node:stream';
-import { URL } from 'node:url';
+import type { ResolvedParentProxy } from './parent-proxy.js';
 export interface HttpProxyServerOptions {
     filter(port: number, host: string, socket: Socket | Duplex): Promise<boolean> | boolean;
     /**
@@ -10,10 +10,11 @@ export interface HttpProxyServerOptions {
      */
     getMitmSocketPath?(host: string): string | undefined;
     /**
-     * Optional upstream HTTP proxy to chain through for all outbound connections.
-     * When set, traffic is forwarded through this proxy instead of connecting directly.
+     * Optional upstream HTTP proxy. When present, direct-connect traffic (i.e.
+     * not routed via mitmProxy) is tunnelled through this parent instead of
+     * connecting directly. NO_PROXY-matched hosts still connect directly.
      */
-    upstreamHttpProxy?: URL;
+    parentProxy?: ResolvedParentProxy;
 }
 export declare function createHttpProxyServer(options: HttpProxyServerOptions): Server;
 //# sourceMappingURL=http-proxy.d.ts.map

package/dist/sandbox/http-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAG9B,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAA;CACxB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAqW7E"}
+{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAOzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAClC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CA8O7E"}

package/dist/sandbox/http-proxy.js

@@ -4,24 +4,30 @@ import { request as httpsRequest } from 'node:https';
 import { connect } from 'node:net';
 import { URL } from 'node:url';
 import { logForDebugging } from '../utils/debug.js';
+import { connectViaParentProxy, dialDirect, openConnectTunnel, proxyAuthHeader, selectParentProxyUrl, shouldBypassParentProxy, stripBrackets, stripHopByHop, } from './parent-proxy.js';
 export function createHttpProxyServer(options) {
     const server = createServer();
     // Handle CONNECT requests for HTTPS traffic
-    server.on('connect', async (req, socket) => {
+    server.on('connect', async (req, socket, head) => {
         // Attach error handler immediately to prevent unhandled errors
         socket.on('error', err => {
             logForDebugging(`Client socket error: ${err.message}`, { level: 'error' });
         });
+        // Track client liveness so we can abort the upstream dial if they bail.
+        let clientGone = false;
+        socket.once('close', () => {
+            clientGone = true;
+        });
         try {
-            const [hostname, portStr] = req.url.split(':');
-            const port = portStr === undefined ? undefined : parseInt(portStr, 10);
-            if (!hostname || !port) {
+            const target = parseConnectTarget(req.url);
+            if (!target) {
                 logForDebugging(`Invalid CONNECT request: ${req.url}`, {
                     level: 'error',
                 });
                 socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
                 return;
             }
+            const { hostname, port } = target;
             const allowed = await options.filter(port, hostname, socket);
             if (!allowed) {
                 logForDebugging(`Connection blocked to ${hostname}:${port}`, {
@@ -34,135 +40,58 @@ export function createHttpProxyServer(options) {
                     'Connection blocked by network allowlist');
                 return;
             }
-            // Check if this host should be routed through a MITM proxy
+            // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
-            if (mitmSocketPath) {
-                // Route through MITM proxy via Unix socket
-                logForDebugging(`Routing CONNECT ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
-                const mitmSocket = connect({ path: mitmSocketPath }, () => {
-                    // Send CONNECT request to the MITM proxy
-                    mitmSocket.write(`CONNECT ${hostname}:${port} HTTP/1.1\r\n` +
-                        `Host: ${hostname}:${port}\r\n` +
-                        '\r\n');
-                });
-                // Buffer to accumulate the MITM proxy's response
-                let responseBuffer = '';
-                const onMitmData = (chunk) => {
-                    responseBuffer += chunk.toString();
-                    // Check if we've received the full HTTP response headers
-                    const headerEndIndex = responseBuffer.indexOf('\r\n\r\n');
-                    if (headerEndIndex !== -1) {
-                        // Remove data listener, we're done parsing the response
-                        mitmSocket.removeListener('data', onMitmData);
-                        // Check if MITM proxy accepted the connection
-                        const statusLine = responseBuffer.substring(0, responseBuffer.indexOf('\r\n'));
-                        if (statusLine.includes(' 200 ')) {
-                            // Connection established, now pipe data between client and MITM
-                            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                            // If there's any data after the headers, write it to the client
-                            const remainingData = responseBuffer.substring(headerEndIndex + 4);
-                            if (remainingData.length > 0) {
-                                socket.write(remainingData);
-                            }
-                            mitmSocket.pipe(socket);
-                            socket.pipe(mitmSocket);
-                        }
-                        else {
-                            logForDebugging(`MITM proxy rejected CONNECT: ${statusLine}`, {
-                                level: 'error',
-                            });
-                            socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                            mitmSocket.destroy();
-                        }
-                    }
-                };
-                mitmSocket.on('data', onMitmData);
-                mitmSocket.on('error', err => {
-                    logForDebugging(`MITM proxy connection failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, { isHttps: true })
+                : undefined;
+            let upstream;
+            try {
+                if (mitmSocketPath) {
+                    logForDebugging(`Routing CONNECT ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
+                    upstream = await openConnectTunnel({
+                        dial: () => connect({ path: mitmSocketPath }),
+                        readyEvent: 'connect',
+                        destHost: hostname,
+                        destPort: port,
                     });
-                    mitmSocket.destroy();
-                });
-                socket.on('end', () => mitmSocket.end());
-                mitmSocket.on('end', () => socket.end());
+                }
+                else if (parentUrl) {
+                    upstream = await connectViaParentProxy(parentUrl, hostname, port);
+                }
+                else {
+                    upstream = await dialDirect(hostname, port);
+                }
             }
-            else if (options.upstreamHttpProxy) {
-                // Chain through upstream HTTP proxy via CONNECT
-                const upstream = options.upstreamHttpProxy;
-                const upstreamPort = parseInt(upstream.port) || 3128;
-                logForDebugging(`Routing CONNECT ${hostname}:${port} through upstream proxy at ${upstream.hostname}:${upstreamPort}`);
-                const upstreamSocket = connect(upstreamPort, upstream.hostname, () => {
-                    upstreamSocket.write(`CONNECT ${hostname}:${port} HTTP/1.1\r\n` +
-                        `Host: ${hostname}:${port}\r\n` +
-                        '\r\n');
-                });
-                let responseBuffer = '';
-                const onUpstreamData = (chunk) => {
-                    responseBuffer += chunk.toString();
-                    const headerEndIndex = responseBuffer.indexOf('\r\n\r\n');
-                    if (headerEndIndex !== -1) {
-                        upstreamSocket.removeListener('data', onUpstreamData);
-                        const statusLine = responseBuffer.substring(0, responseBuffer.indexOf('\r\n'));
-                        if (statusLine.includes(' 200 ')) {
-                            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                            const remainingData = responseBuffer.substring(headerEndIndex + 4);
-                            if (remainingData.length > 0) {
-                                socket.write(remainingData);
-                            }
-                            upstreamSocket.pipe(socket);
-                            socket.pipe(upstreamSocket);
-                        }
-                        else {
-                            logForDebugging(`Upstream proxy rejected CONNECT: ${statusLine}`, { level: 'error' });
-                            socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                            upstreamSocket.destroy();
-                        }
-                    }
-                };
-                upstreamSocket.on('data', onUpstreamData);
-                upstreamSocket.on('error', err => {
-                    logForDebugging(`Upstream proxy connection failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
-                    });
-                    upstreamSocket.destroy();
+            catch (err) {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
                 });
-                socket.on('end', () => upstreamSocket.end());
-                upstreamSocket.on('end', () => socket.end());
+                socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+                return;
             }
-            else {
-                // Direct connection (original behavior)
-                const serverSocket = connect(port, hostname, () => {
-                    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                    serverSocket.pipe(socket);
-                    socket.pipe(serverSocket);
-                });
-                serverSocket.on('error', err => {
-                    logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
-                    });
-                    serverSocket.destroy();
-                });
-                socket.on('end', () => serverSocket.end());
-                serverSocket.on('end', () => socket.end());
+            if (clientGone) {
+                upstream.on('error', () => { }); // swallow post-resolve errors
+                upstream.destroy();
+                return;
             }
+            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            // Forward any bytes the client sent in the same packet as the CONNECT
+            // (Node delivers these as the `head` buffer, not via the socket stream).
+            if (head.length)
+                upstream.write(head);
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+            upstream.on('error', err => {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
+                });
+                socket.destroy();
+            });
+            socket.on('close', () => upstream.destroy());
+            upstream.on('close', () => socket.destroy());
         }
         catch (err) {
             logForDebugging(`Error handling CONNECT: ${err}`, { level: 'error' });
@@ -173,7 +102,7 @@ export function createHttpProxyServer(options) {
     server.on('request', async (req, res) => {
         try {
             const url = new URL(req.url);
-            const hostname = url.hostname;
+            const hostname = stripBrackets(url.hostname);
             const port = url.port
                 ? parseInt(url.port, 10)
                 : url.protocol === 'https:'
@@ -191,105 +120,113 @@ export function createHttpProxyServer(options) {
                 res.end('Connection blocked by network allowlist');
                 return;
             }
-            // Check if this host should be routed through a MITM proxy
+            // Client may have disconnected while we awaited the filter; bail now
+            // rather than dialing an upstream nobody will read from.
+            if (req.socket.destroyed)
+                return;
+            const fwdHeaders = { ...stripHopByHop(req.headers), host: url.host };
+            // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, {
+                    isHttps: url.protocol === 'https:',
+                })
+                : undefined;
+            // Reconstruct the absolute URI from parsed components rather than
+            // forwarding the client's raw req.url. This ensures the upstream proxy
+            // sees exactly the host we allowlist-checked, closing URL-parser
+            // differential bypasses.
+            const absUrl = `${url.protocol}//${url.host}${url.pathname}${url.search}`;
+            let proxyReq;
             if (mitmSocketPath) {
-                // Route through MITM proxy via Unix socket
-                // Use an agent that connects via the Unix socket
                 logForDebugging(`Routing HTTP ${req.method} ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
                 const mitmAgent = new Agent({
                     // @ts-expect-error - socketPath is valid but not in types
                     socketPath: mitmSocketPath,
                 });
-                // Send request to MITM proxy with full URL (proxy-style request)
-                const proxyReq = httpRequest({
+                proxyReq = httpRequest({
                     agent: mitmAgent,
-                    // For proxy requests, path should be the full URL
-                    path: req.url,
+                    path: absUrl,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`MITM proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
-            else if (options.upstreamHttpProxy) {
-                // Forward through upstream HTTP proxy
-                const upstream = options.upstreamHttpProxy;
-                const upstreamPort = parseInt(upstream.port) || 3128;
-                logForDebugging(`Routing HTTP ${req.method} ${hostname}:${port} through upstream proxy at ${upstream.hostname}:${upstreamPort}`);
-                const proxyReq = httpRequest({
-                    hostname: upstream.hostname,
-                    port: upstreamPort,
-                    path: req.url,
+            else if (parentUrl) {
+                const parentHost = stripBrackets(parentUrl.hostname);
+                const parentPort = Number(parentUrl.port) || (parentUrl.protocol === 'https:' ? 443 : 80);
+                const auth = proxyAuthHeader(parentUrl);
+                const requestFn = parentUrl.protocol === 'https:' ? httpsRequest : httpRequest;
+                proxyReq = requestFn({
+                    hostname: parentHost,
+                    port: parentPort,
+                    path: absUrl,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: auth
+                        ? { ...fwdHeaders, 'proxy-authorization': auth }
+                        : fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`Upstream proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
             else {
-                // Direct request (original behavior)
-                // Choose http or https module
                 const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;
-                const proxyReq = requestFn({
+                proxyReq = requestFn({
                     hostname,
                     port,
                     path: url.pathname + url.search,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`Proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
+            proxyReq.on('error', err => {
+                logForDebugging(`Proxy request failed: ${err.message}`, {
+                    level: 'error',
+                });
+                if (!res.headersSent) {
+                    res.writeHead(502, { 'Content-Type': 'text/plain' });
+                    res.end('Bad Gateway');
+                }
+                else {
+                    res.destroy();
+                }
+            });
+            // Tear down the upstream request if the client goes away mid-flight.
+            res.on('close', () => proxyReq.destroy());
+            req.pipe(proxyReq);
         }
         catch (err) {
             logForDebugging(`Error handling HTTP request: ${err}`, { level: 'error' });
-            res.writeHead(500, { 'Content-Type': 'text/plain' });
-            res.end('Internal Server Error');
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+                res.end('Internal Server Error');
+            }
+            else {
+                res.destroy();
+            }
         }
     });
     return server;
 }
+/**
+ * Parse a CONNECT request-target into host + port. Handles both plain
+ * `host:port` and bracketed IPv6 `[::1]:port`.
+ */
+function parseConnectTarget(target) {
+    const m = /^\[([^\]]+)\]:(\d+)$/.exec(target) ?? /^([^:]+):(\d+)$/.exec(target);
+    if (!m)
+        return undefined;
+    const port = Number(m[2]);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return undefined;
+    return { hostname: m[1], port };
+}
 //# sourceMappingURL=http-proxy.js.map

package/dist/sandbox/http-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAuBnD,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzC,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAEtE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,2DAA2D;YAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAE5D,IAAI,cAAc,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;gBAED,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBACxD,yCAAyC;oBACzC,UAAU,CAAC,KAAK,CACd,WAAW,QAAQ,IAAI,IAAI,eAAe;wBACxC,SAAS,QAAQ,IAAI,IAAI,MAAM;wBAC/B,MAAM,CACT,CAAA;gBACH,CAAC,CAAC,CAAA;gBAEF,iDAAiD;gBACjD,IAAI,cAAc,GAAG,EAAE,CAAA;gBAEvB,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE;oBACnC,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;oBAElC,yDAAyD;oBACzD,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBACzD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC1B,wDAAwD;wBACxD,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;wBAE7C,8CAA8C;wBAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CACzC,CAAC,EACD,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/B,CAAA;wBACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACjC,gEAAgE;4BAChE,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;4BAE3D,gEAAgE;4BAChE,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;4BAClE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC7B,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;4BAC7B,CAAC;4BAED,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;4BACvB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;wBACzB,CAAC;6BAAM,CAAC;4BACN,eAAe,CAAC,gCAAgC,UAAU,EAAE,EAAE;gCAC5D,KAAK,EAAE,OAAO;6BACf,CAAC,CAAA;4BACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;4BAC9C,UAAU,CAAC,OAAO,EAAE,CAAA;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAA;gBAED,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAEjC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC3B,eAAe,CAAC,iCAAiC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC9D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,UAAU,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAA;gBACxC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;iBAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBACrC,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;gBAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;gBACpD,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,IAAI,YAAY,EAAE,CACrG,CAAA;gBAED,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACnE,cAAc,CAAC,KAAK,CAClB,WAAW,QAAQ,IAAI,IAAI,eAAe;wBACxC,SAAS,QAAQ,IAAI,IAAI,MAAM;wBAC/B,MAAM,CACT,CAAA;gBACH,CAAC,CAAC,CAAA;gBAEF,IAAI,cAAc,GAAG,EAAE,CAAA;gBAEvB,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE;oBACvC,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;oBAElC,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBACzD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC1B,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;wBAErD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CACzC,CAAC,EACD,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/B,CAAA;wBACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;4BAE3D,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;4BAClE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC7B,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;4BAC7B,CAAC;4BAED,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;4BAC3B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;wBAC7B,CAAC;6BAAM,CAAC;4BACN,eAAe,CACb,oCAAoC,UAAU,EAAE,EAChD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;4BACD,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;4BAC9C,cAAc,CAAC,OAAO,EAAE,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC,CAAA;gBAED,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;gBAEzC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC/B,eAAe,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAClE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,cAAc,CAAC,OAAO,EAAE,CAAA;gBAC1B,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;oBAChD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;oBAC3D,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC3B,CAAC,CAAC,CAAA;gBAEF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC7B,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;wBACvD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,YAAY,CAAC,OAAO,EAAE,CAAA;gBACxB,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC1C,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,2DAA2D;YAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAE5D,IAAI,cAAc,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,iDAAiD;gBACjD,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBAEF,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,WAAW,CAC1B;oBACE,KAAK,EAAE,SAAS;oBAChB,kDAAkD;oBAClD,IAAI,EAAE,GAAG,CAAC,GAAG;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC3D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBACrC,sCAAsC;gBACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;gBAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;gBACpD,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,IAAI,YAAY,EAAE,CAChH,CAAA;gBAED,MAAM,QAAQ,GAAG,WAAW,CAC1B;oBACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,GAAG,CAAC,GAAG;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC/D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,8BAA8B;gBAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAExE,MAAM,QAAQ,GAAG,SAAS,CACxB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACtD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAwB1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YAEpE,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;iBACnC,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAEzE,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBACxE,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;oBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}

package/dist/sandbox/macos-sandbox-utils.d.ts

@@ -13,6 +13,7 @@ export interface MacOSSandboxParams {
     ignoreViolations?: IgnoreViolationsConfig | undefined;
     allowPty?: boolean;
     allowBrowserProcess?: boolean;
+    allowMachLookup?: string[];
     allowGitConfig?: boolean;
     enableWeakerNetworkIsolation?: boolean;
     binShell?: string;

package/dist/sandbox/macos-sandbox-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macos-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox-utils.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC/C,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAA;IACjD,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,UAAQ,GAAG,MAAM,EAAE,CA2B5E;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,qBAAqB,KAC7B,IAAI,CAAA;AAwmBT;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,GACzB,MAAM,CA4FR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,wBAAwB,EAClC,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,MAAM,IAAI,CA8GZ"}
+{"version":3,"file":"macos-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox-utils.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC/C,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAA;IACjD,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,UAAQ,GAAG,MAAM,EAAE,CA2B5E;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,qBAAqB,KAC7B,IAAI,CAAA;AA0nBT;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,GACzB,MAAM,CA8FR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,wBAAwB,EAClC,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,MAAM,IAAI,CA8GZ"}