@sysid/sandbox-runtime-improved 0.0.43-sysid.5 → 0.0.45-sysid.2

package/README.md

@@ -4,6 +4,12 @@
 
 
 Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/sandbox-runtime).
+Why: I just need faster feature cycle-times.
+
+This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.45**).
+As new features become available, equivalent local ones will be removed.
+
+> Objective: keep as close to original as possible, while allowing selected additional features.
 
 ---
 
@@ -11,15 +17,11 @@ Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/s
 
 ```json
 {
-    "network": {
-        "upstreamHttpProxy": "http://127.0.0.1:3128"
-    },
     "allowBrowserProcess": false,
     "allowMachLookup": ["com.1password.*"]
 }
 ```
-- `network.upstreamHttpProxy` - URL of an upstream HTTP proxy to chain through (e.g., `"http://127.0.0.1:3128"`). When set, the built-in proxy forwards allowed requests through this proxy instead of connecting directly. Useful behind corporate proxies. *(fork-only)*
-- `allowBrowserProcess` - Allow browser process operations in the macOS sandbox (boolean, default: false). Grants Mach IPC, bootstrap registration, IOKit, and POSIX shared memory permissions that Chromium-based browsers need to launch. Required for tools like `agent-browser` that spawn a Chrome subprocess. *(fork-only)*
+- `allowBrowserProcess` - **Significantly weakens the macOS sandbox.** Grants `(allow mach*)`, `(allow process-info*)`, `(allow iokit-open)`, and `(allow ipc-posix-shm*)` — permissions Chromium-based browsers need to launch. Filesystem and network restrictions remain enforced. Only enable for browser automation (e.g. `agent-browser`). (boolean, default: false) *(fork-only)*
 - `allowMachLookup` - Additional Mach/XPC service names to allow in the macOS sandbox (string array, optional). Names ending with `*` use prefix matching (e.g., `"com.1password.*"`). Use for tools like 1Password CLI that need specific services. *(fork-only, mirrors [upstream PR #92](https://github.com/anthropic-experimental/sandbox-runtime/pull/92))*
 
 ---
@@ -172,6 +174,7 @@ src/
     ├── sandbox-violation-store.ts # Violation tracking
     ├── sandbox-utils.ts      # Shared sandbox utilities
     ├── http-proxy.ts         # HTTP/HTTPS proxy for network filtering
+    ├── parent-proxy.ts       # Upstream/parent proxy chaining
     ├── socks-proxy.ts        # SOCKS5 proxy for network filtering
     ├── linux-sandbox-utils.ts # Linux bubblewrap sandboxing
     └── macos-sandbox-utils.ts # macOS sandbox-exec sandboxing
@@ -200,7 +203,7 @@ srti --settings /path/to/srt-settings.json npm install
 import {
   SandboxManager,
   type SandboxRuntimeConfig,
-} from '@anthropic-ai/sandbox-runtime'
+} from '@sysid/sandbox-runtime-improved'
 import { spawn } from 'child_process'
 
 // Define your sandbox configuration
@@ -239,10 +242,10 @@ child.on('exit', async code => {
 
 ```typescript
 // Main sandbox manager
-export { SandboxManager } from '@anthropic-ai/sandbox-runtime'
+export { SandboxManager } from '@sysid/sandbox-runtime-improved'
 
 // Violation tracking
-export { SandboxViolationStore } from '@anthropic-ai/sandbox-runtime'
+export { SandboxViolationStore } from '@sysid/sandbox-runtime-improved'
 
 // TypeScript types
 export type {
@@ -254,7 +257,7 @@ export type {
   FsReadRestrictionConfig,
   FsWriteRestrictionConfig,
   NetworkRestrictionConfig,
-} from '@anthropic-ai/sandbox-runtime'
+} from '@sysid/sandbox-runtime-improved'
 ```
 
 ## Configuration
@@ -281,6 +284,11 @@ srti --settings /path/to/srt-settings.json <command>
       "*.npmjs.org"
     ],
     "deniedDomains": ["malicious.com"],
+    "parentProxy": {
+      "http": "http://proxy.corp:3128",
+      "https": "http://proxy.corp:3128",
+      "noProxy": "localhost,127.0.0.1,*.internal.corp"
+    },
     "allowUnixSockets": ["/var/run/docker.sock"],
     "allowLocalBinding": false
   },
@@ -309,6 +317,10 @@ Uses an **allow-only pattern** - all network access is denied by default.
 - `network.allowedDomains` - Array of allowed domains (supports wildcards like `*.example.com`). Empty array = no network access.
 - `network.deniedDomains` - Array of denied domains (checked first, takes precedence over allowedDomains)
 - `network.allowLocalBinding` - Allow binding to local ports (boolean, default: false)
+- `network.parentProxy` - Upstream HTTP proxy for outbound connections (object, optional). When set, the sandbox's built-in proxy tunnels traffic through this parent proxy instead of connecting directly. Falls back to `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables if unset.
+  - `http` - Proxy URL for plain HTTP traffic (e.g., `"http://proxy.corp:3128"`)
+  - `https` - Proxy URL for HTTPS/CONNECT traffic (falls back to `http` if unset)
+  - `noProxy` - Comma-separated bypass list: hostname suffixes and CIDR ranges that connect directly
 
 **Unix Socket Settings** (platform-specific behavior):
 
@@ -464,6 +476,14 @@ Watchman accesses files outside the sandbox boundaries, which will trigger permi
   - Fedora: `dnf install ripgrep`
   - Arch: `pacman -S ripgrep`
 
+**Ubuntu 24.04+ note:** These releases enable `kernel.apparmor_restrict_unprivileged_userns` by default, which allows `unshare(CLONE_NEWUSER)` but strips capabilities from the resulting namespace. Both bubblewrap and the seccomp isolation layer need capability-bearing user namespaces. Disable the restriction with:
+
+```bash
+sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+```
+
+or add an AppArmor profile that grants `userns` to the relevant binaries.
+
 **Optional Linux dependencies (for seccomp fallback):**
 
 The package includes pre-generated seccomp BPF filters for x86-64 and arm architectures. These dependencies are only needed if you are on a different architecture where pre-generated filters are not available:
@@ -539,6 +559,8 @@ The sandbox runs HTTP and SOCKS5 proxy servers on the host machine that filter a
 
 - **macOS**: The Seatbelt profile allows communication only to specific localhost ports where the proxies listen. All other network access is blocked.
 
+**Parent/upstream proxy chaining:** When running behind a corporate proxy, configure `network.parentProxy` (or set `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables) to chain the sandbox's proxies through an upstream proxy. Both HTTP and SOCKS5 traffic will tunnel through the parent proxy via CONNECT. Destinations matching `noProxy` patterns bypass the parent and connect directly.
+
 ### Filesystem Isolation
 
 Filesystem restrictions are enforced at the OS level:
@@ -620,11 +642,14 @@ On Linux, the sandbox uses **seccomp BPF (Berkeley Packet Filter)** to block Uni
 4. **Two-stage application using apply-seccomp binary**:
    - Outer bwrap creates the sandbox with filesystem, network, and PID namespace restrictions
    - Network bridging processes (socat) start inside the sandbox (need Unix sockets)
-   - apply-seccomp binary applies the seccomp filter via `prctl()`
-   - apply-seccomp execs the user command with seccomp active
+   - apply-seccomp creates a nested user+PID+mount namespace and remounts `/proc`
+   - Inside the nested namespace, apply-seccomp acts as PID 1 (non-dumpable init/reaper)
+   - apply-seccomp forks, applies the seccomp filter via `prctl()`, and execs the user command
    - User command runs with all sandbox restrictions plus Unix socket creation blocking
 
-**Security limitations**: The filter only blocks `socket(AF_UNIX, ...)` syscalls. It does not prevent operations on Unix socket file descriptors inherited from parent processes or passed via `SCM_RIGHTS`. For most sandboxing scenarios, blocking socket creation is sufficient to prevent unauthorized IPC.
+**PID namespace isolation**: The nested PID namespace ensures the user command cannot see or address any process that runs without the seccomp filter (bwrap's init, the shell wrapper, or the socat helpers). This keeps the seccomp boundary intact regardless of `kernel.yama.ptrace_scope`, since unfiltered helpers are not reachable via `ptrace` or `/proc/N/mem`. The inner PID 1 sets `PR_SET_DUMPABLE=0` so it is not ptraceable either. If nested namespace creation fails, apply-seccomp aborts rather than running without isolation.
+
+**Security limitations**: The filter blocks `socket(AF_UNIX, ...)` and the `io_uring_setup`/`io_uring_enter`/`io_uring_register` syscalls (the latter three because `IORING_OP_SOCKET` on Linux 5.19+ would otherwise bypass the `socket()` rule). It does not prevent operations on Unix socket file descriptors inherited from parent processes or passed via `SCM_RIGHTS`. For most sandboxing scenarios, blocking socket creation is sufficient to prevent unauthorized IPC.
 
 **Zero runtime dependencies**: Pre-built static apply-seccomp binaries and pre-generated BPF filters are included for x64 and arm64 architectures. No compilation tools or external dependencies required at runtime.
 

package/dist/sandbox/http-proxy.d.ts

@@ -1,6 +1,6 @@
 import type { Socket, Server } from 'node:net';
 import type { Duplex } from 'node:stream';
-import { URL } from 'node:url';
+import type { ResolvedParentProxy } from './parent-proxy.js';
 export interface HttpProxyServerOptions {
     filter(port: number, host: string, socket: Socket | Duplex): Promise<boolean> | boolean;
     /**
@@ -10,10 +10,11 @@ export interface HttpProxyServerOptions {
      */
     getMitmSocketPath?(host: string): string | undefined;
     /**
-     * Optional upstream HTTP proxy to chain through for all outbound connections.
-     * When set, traffic is forwarded through this proxy instead of connecting directly.
+     * Optional upstream HTTP proxy. When present, direct-connect traffic (i.e.
+     * not routed via mitmProxy) is tunnelled through this parent instead of
+     * connecting directly. NO_PROXY-matched hosts still connect directly.
      */
-    upstreamHttpProxy?: URL;
+    parentProxy?: ResolvedParentProxy;
 }
 export declare function createHttpProxyServer(options: HttpProxyServerOptions): Server;
 //# sourceMappingURL=http-proxy.d.ts.map

package/dist/sandbox/http-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAG9B,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAA;CACxB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAqW7E"}
+{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAOzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAClC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CA8O7E"}

package/dist/sandbox/http-proxy.js

@@ -4,24 +4,30 @@ import { request as httpsRequest } from 'node:https';
 import { connect } from 'node:net';
 import { URL } from 'node:url';
 import { logForDebugging } from '../utils/debug.js';
+import { connectViaParentProxy, dialDirect, openConnectTunnel, proxyAuthHeader, selectParentProxyUrl, shouldBypassParentProxy, stripBrackets, stripHopByHop, } from './parent-proxy.js';
 export function createHttpProxyServer(options) {
     const server = createServer();
     // Handle CONNECT requests for HTTPS traffic
-    server.on('connect', async (req, socket) => {
+    server.on('connect', async (req, socket, head) => {
         // Attach error handler immediately to prevent unhandled errors
         socket.on('error', err => {
             logForDebugging(`Client socket error: ${err.message}`, { level: 'error' });
         });
+        // Track client liveness so we can abort the upstream dial if they bail.
+        let clientGone = false;
+        socket.once('close', () => {
+            clientGone = true;
+        });
         try {
-            const [hostname, portStr] = req.url.split(':');
-            const port = portStr === undefined ? undefined : parseInt(portStr, 10);
-            if (!hostname || !port) {
+            const target = parseConnectTarget(req.url);
+            if (!target) {
                 logForDebugging(`Invalid CONNECT request: ${req.url}`, {
                     level: 'error',
                 });
                 socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
                 return;
             }
+            const { hostname, port } = target;
             const allowed = await options.filter(port, hostname, socket);
             if (!allowed) {
                 logForDebugging(`Connection blocked to ${hostname}:${port}`, {
@@ -34,135 +40,58 @@ export function createHttpProxyServer(options) {
                     'Connection blocked by network allowlist');
                 return;
             }
-            // Check if this host should be routed through a MITM proxy
+            // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
-            if (mitmSocketPath) {
-                // Route through MITM proxy via Unix socket
-                logForDebugging(`Routing CONNECT ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
-                const mitmSocket = connect({ path: mitmSocketPath }, () => {
-                    // Send CONNECT request to the MITM proxy
-                    mitmSocket.write(`CONNECT ${hostname}:${port} HTTP/1.1\r\n` +
-                        `Host: ${hostname}:${port}\r\n` +
-                        '\r\n');
-                });
-                // Buffer to accumulate the MITM proxy's response
-                let responseBuffer = '';
-                const onMitmData = (chunk) => {
-                    responseBuffer += chunk.toString();
-                    // Check if we've received the full HTTP response headers
-                    const headerEndIndex = responseBuffer.indexOf('\r\n\r\n');
-                    if (headerEndIndex !== -1) {
-                        // Remove data listener, we're done parsing the response
-                        mitmSocket.removeListener('data', onMitmData);
-                        // Check if MITM proxy accepted the connection
-                        const statusLine = responseBuffer.substring(0, responseBuffer.indexOf('\r\n'));
-                        if (statusLine.includes(' 200 ')) {
-                            // Connection established, now pipe data between client and MITM
-                            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                            // If there's any data after the headers, write it to the client
-                            const remainingData = responseBuffer.substring(headerEndIndex + 4);
-                            if (remainingData.length > 0) {
-                                socket.write(remainingData);
-                            }
-                            mitmSocket.pipe(socket);
-                            socket.pipe(mitmSocket);
-                        }
-                        else {
-                            logForDebugging(`MITM proxy rejected CONNECT: ${statusLine}`, {
-                                level: 'error',
-                            });
-                            socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                            mitmSocket.destroy();
-                        }
-                    }
-                };
-                mitmSocket.on('data', onMitmData);
-                mitmSocket.on('error', err => {
-                    logForDebugging(`MITM proxy connection failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, { isHttps: true })
+                : undefined;
+            let upstream;
+            try {
+                if (mitmSocketPath) {
+                    logForDebugging(`Routing CONNECT ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
+                    upstream = await openConnectTunnel({
+                        dial: () => connect({ path: mitmSocketPath }),
+                        readyEvent: 'connect',
+                        destHost: hostname,
+                        destPort: port,
                     });
-                    mitmSocket.destroy();
-                });
-                socket.on('end', () => mitmSocket.end());
-                mitmSocket.on('end', () => socket.end());
+                }
+                else if (parentUrl) {
+                    upstream = await connectViaParentProxy(parentUrl, hostname, port);
+                }
+                else {
+                    upstream = await dialDirect(hostname, port);
+                }
             }
-            else if (options.upstreamHttpProxy) {
-                // Chain through upstream HTTP proxy via CONNECT
-                const upstream = options.upstreamHttpProxy;
-                const upstreamPort = parseInt(upstream.port) || 3128;
-                logForDebugging(`Routing CONNECT ${hostname}:${port} through upstream proxy at ${upstream.hostname}:${upstreamPort}`);
-                const upstreamSocket = connect(upstreamPort, upstream.hostname, () => {
-                    upstreamSocket.write(`CONNECT ${hostname}:${port} HTTP/1.1\r\n` +
-                        `Host: ${hostname}:${port}\r\n` +
-                        '\r\n');
-                });
-                let responseBuffer = '';
-                const onUpstreamData = (chunk) => {
-                    responseBuffer += chunk.toString();
-                    const headerEndIndex = responseBuffer.indexOf('\r\n\r\n');
-                    if (headerEndIndex !== -1) {
-                        upstreamSocket.removeListener('data', onUpstreamData);
-                        const statusLine = responseBuffer.substring(0, responseBuffer.indexOf('\r\n'));
-                        if (statusLine.includes(' 200 ')) {
-                            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                            const remainingData = responseBuffer.substring(headerEndIndex + 4);
-                            if (remainingData.length > 0) {
-                                socket.write(remainingData);
-                            }
-                            upstreamSocket.pipe(socket);
-                            socket.pipe(upstreamSocket);
-                        }
-                        else {
-                            logForDebugging(`Upstream proxy rejected CONNECT: ${statusLine}`, { level: 'error' });
-                            socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                            upstreamSocket.destroy();
-                        }
-                    }
-                };
-                upstreamSocket.on('data', onUpstreamData);
-                upstreamSocket.on('error', err => {
-                    logForDebugging(`Upstream proxy connection failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
-                    });
-                    upstreamSocket.destroy();
+            catch (err) {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
                 });
-                socket.on('end', () => upstreamSocket.end());
-                upstreamSocket.on('end', () => socket.end());
+                socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+                return;
             }
-            else {
-                // Direct connection (original behavior)
-                const serverSocket = connect(port, hostname, () => {
-                    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-                    serverSocket.pipe(socket);
-                    socket.pipe(serverSocket);
-                });
-                serverSocket.on('error', err => {
-                    logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-                });
-                socket.on('error', err => {
-                    logForDebugging(`Client socket error: ${err.message}`, {
-                        level: 'error',
-                    });
-                    serverSocket.destroy();
-                });
-                socket.on('end', () => serverSocket.end());
-                serverSocket.on('end', () => socket.end());
+            if (clientGone) {
+                upstream.on('error', () => { }); // swallow post-resolve errors
+                upstream.destroy();
+                return;
             }
+            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            // Forward any bytes the client sent in the same packet as the CONNECT
+            // (Node delivers these as the `head` buffer, not via the socket stream).
+            if (head.length)
+                upstream.write(head);
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+            upstream.on('error', err => {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
+                });
+                socket.destroy();
+            });
+            socket.on('close', () => upstream.destroy());
+            upstream.on('close', () => socket.destroy());
         }
         catch (err) {
             logForDebugging(`Error handling CONNECT: ${err}`, { level: 'error' });
@@ -173,7 +102,7 @@ export function createHttpProxyServer(options) {
     server.on('request', async (req, res) => {
         try {
             const url = new URL(req.url);
-            const hostname = url.hostname;
+            const hostname = stripBrackets(url.hostname);
             const port = url.port
                 ? parseInt(url.port, 10)
                 : url.protocol === 'https:'
@@ -191,105 +120,113 @@ export function createHttpProxyServer(options) {
                 res.end('Connection blocked by network allowlist');
                 return;
             }
-            // Check if this host should be routed through a MITM proxy
+            // Client may have disconnected while we awaited the filter; bail now
+            // rather than dialing an upstream nobody will read from.
+            if (req.socket.destroyed)
+                return;
+            const fwdHeaders = { ...stripHopByHop(req.headers), host: url.host };
+            // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, {
+                    isHttps: url.protocol === 'https:',
+                })
+                : undefined;
+            // Reconstruct the absolute URI from parsed components rather than
+            // forwarding the client's raw req.url. This ensures the upstream proxy
+            // sees exactly the host we allowlist-checked, closing URL-parser
+            // differential bypasses.
+            const absUrl = `${url.protocol}//${url.host}${url.pathname}${url.search}`;
+            let proxyReq;
             if (mitmSocketPath) {
-                // Route through MITM proxy via Unix socket
-                // Use an agent that connects via the Unix socket
                 logForDebugging(`Routing HTTP ${req.method} ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
                 const mitmAgent = new Agent({
                     // @ts-expect-error - socketPath is valid but not in types
                     socketPath: mitmSocketPath,
                 });
-                // Send request to MITM proxy with full URL (proxy-style request)
-                const proxyReq = httpRequest({
+                proxyReq = httpRequest({
                     agent: mitmAgent,
-                    // For proxy requests, path should be the full URL
-                    path: req.url,
+                    path: absUrl,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`MITM proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
-            else if (options.upstreamHttpProxy) {
-                // Forward through upstream HTTP proxy
-                const upstream = options.upstreamHttpProxy;
-                const upstreamPort = parseInt(upstream.port) || 3128;
-                logForDebugging(`Routing HTTP ${req.method} ${hostname}:${port} through upstream proxy at ${upstream.hostname}:${upstreamPort}`);
-                const proxyReq = httpRequest({
-                    hostname: upstream.hostname,
-                    port: upstreamPort,
-                    path: req.url,
+            else if (parentUrl) {
+                const parentHost = stripBrackets(parentUrl.hostname);
+                const parentPort = Number(parentUrl.port) || (parentUrl.protocol === 'https:' ? 443 : 80);
+                const auth = proxyAuthHeader(parentUrl);
+                const requestFn = parentUrl.protocol === 'https:' ? httpsRequest : httpRequest;
+                proxyReq = requestFn({
+                    hostname: parentHost,
+                    port: parentPort,
+                    path: absUrl,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: auth
+                        ? { ...fwdHeaders, 'proxy-authorization': auth }
+                        : fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`Upstream proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
             else {
-                // Direct request (original behavior)
-                // Choose http or https module
                 const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;
-                const proxyReq = requestFn({
+                proxyReq = requestFn({
                     hostname,
                     port,
                     path: url.pathname + url.search,
                     method: req.method,
-                    headers: {
-                        ...req.headers,
-                        host: url.host,
-                    },
+                    headers: fwdHeaders,
                 }, proxyRes => {
-                    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
                     proxyRes.pipe(res);
                 });
-                proxyReq.on('error', err => {
-                    logForDebugging(`Proxy request failed: ${err.message}`, {
-                        level: 'error',
-                    });
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'text/plain' });
-                        res.end('Bad Gateway');
-                    }
-                });
-                req.pipe(proxyReq);
             }
+            proxyReq.on('error', err => {
+                logForDebugging(`Proxy request failed: ${err.message}`, {
+                    level: 'error',
+                });
+                if (!res.headersSent) {
+                    res.writeHead(502, { 'Content-Type': 'text/plain' });
+                    res.end('Bad Gateway');
+                }
+                else {
+                    res.destroy();
+                }
+            });
+            // Tear down the upstream request if the client goes away mid-flight.
+            res.on('close', () => proxyReq.destroy());
+            req.pipe(proxyReq);
         }
         catch (err) {
             logForDebugging(`Error handling HTTP request: ${err}`, { level: 'error' });
-            res.writeHead(500, { 'Content-Type': 'text/plain' });
-            res.end('Internal Server Error');
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+                res.end('Internal Server Error');
+            }
+            else {
+                res.destroy();
+            }
         }
     });
     return server;
 }
+/**
+ * Parse a CONNECT request-target into host + port. Handles both plain
+ * `host:port` and bracketed IPv6 `[::1]:port`.
+ */
+function parseConnectTarget(target) {
+    const m = /^\[([^\]]+)\]:(\d+)$/.exec(target) ?? /^([^:]+):(\d+)$/.exec(target);
+    if (!m)
+        return undefined;
+    const port = Number(m[2]);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return undefined;
+    return { hostname: m[1], port };
+}
 //# sourceMappingURL=http-proxy.js.map

package/dist/sandbox/http-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAuBnD,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzC,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAEtE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,2DAA2D;YAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAE5D,IAAI,cAAc,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;gBAED,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBACxD,yCAAyC;oBACzC,UAAU,CAAC,KAAK,CACd,WAAW,QAAQ,IAAI,IAAI,eAAe;wBACxC,SAAS,QAAQ,IAAI,IAAI,MAAM;wBAC/B,MAAM,CACT,CAAA;gBACH,CAAC,CAAC,CAAA;gBAEF,iDAAiD;gBACjD,IAAI,cAAc,GAAG,EAAE,CAAA;gBAEvB,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE;oBACnC,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;oBAElC,yDAAyD;oBACzD,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBACzD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC1B,wDAAwD;wBACxD,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;wBAE7C,8CAA8C;wBAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CACzC,CAAC,EACD,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/B,CAAA;wBACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACjC,gEAAgE;4BAChE,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;4BAE3D,gEAAgE;4BAChE,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;4BAClE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC7B,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;4BAC7B,CAAC;4BAED,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;4BACvB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;wBACzB,CAAC;6BAAM,CAAC;4BACN,eAAe,CAAC,gCAAgC,UAAU,EAAE,EAAE;gCAC5D,KAAK,EAAE,OAAO;6BACf,CAAC,CAAA;4BACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;4BAC9C,UAAU,CAAC,OAAO,EAAE,CAAA;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAA;gBAED,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAEjC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC3B,eAAe,CAAC,iCAAiC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC9D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,UAAU,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAA;gBACxC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;iBAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBACrC,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;gBAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;gBACpD,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,IAAI,YAAY,EAAE,CACrG,CAAA;gBAED,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACnE,cAAc,CAAC,KAAK,CAClB,WAAW,QAAQ,IAAI,IAAI,eAAe;wBACxC,SAAS,QAAQ,IAAI,IAAI,MAAM;wBAC/B,MAAM,CACT,CAAA;gBACH,CAAC,CAAC,CAAA;gBAEF,IAAI,cAAc,GAAG,EAAE,CAAA;gBAEvB,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE;oBACvC,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;oBAElC,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBACzD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC1B,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;wBAErD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CACzC,CAAC,EACD,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/B,CAAA;wBACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;4BAE3D,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;4BAClE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC7B,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;4BAC7B,CAAC;4BAED,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;4BAC3B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;wBAC7B,CAAC;6BAAM,CAAC;4BACN,eAAe,CACb,oCAAoC,UAAU,EAAE,EAChD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;4BACD,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;4BAC9C,cAAc,CAAC,OAAO,EAAE,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC,CAAA;gBAED,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;gBAEzC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC/B,eAAe,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAClE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,cAAc,CAAC,OAAO,EAAE,CAAA;gBAC1B,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;oBAChD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;oBAC3D,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC3B,CAAC,CAAC,CAAA;gBAEF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC7B,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;wBACvD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACrD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,YAAY,CAAC,OAAO,EAAE,CAAA;gBACxB,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC1C,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,2DAA2D;YAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAE5D,IAAI,cAAc,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,iDAAiD;gBACjD,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBAEF,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,WAAW,CAC1B;oBACE,KAAK,EAAE,SAAS;oBAChB,kDAAkD;oBAClD,IAAI,EAAE,GAAG,CAAC,GAAG;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC3D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBACrC,sCAAsC;gBACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;gBAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;gBACpD,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,IAAI,YAAY,EAAE,CAChH,CAAA;gBAED,MAAM,QAAQ,GAAG,WAAW,CAC1B;oBACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,GAAG,CAAC,GAAG;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC/D,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,8BAA8B;gBAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAExE,MAAM,QAAQ,GAAG,SAAS,CACxB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,GAAG,GAAG,CAAC,OAAO;wBACd,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;gBAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;wBACtD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;oBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;wBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAwB1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YAEpE,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;iBACnC,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAEzE,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBACxE,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;oBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}