@sysid/sandbox-runtime-improved 0.0.49-sysid.2 → 0.0.51-sysid.1

package/dist/sandbox/request-filter.js

@@ -0,0 +1,106 @@
+/**
+ * Request-level filter hook for the forward proxy.
+ *
+ * Library consumers supply a `filterRequest` callback via
+ * `network.filterRequest`. It receives the parsed HTTP request (web-standard
+ * `Request`) and returns a decision. Applies to plain HTTP through the proxy
+ * and, when `tlsTerminate` is configured, to terminated HTTPS. The proxy
+ * enforces the decision; the library does not bless any matching DSL.
+ */
+import { Readable } from 'node:stream';
+import { logForDebugging } from '../utils/debug.js';
+const BODYLESS_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * Build a `Request`, run the callback, and if denied write the 403 response
+ * and return `null`. On allow, returns the body stream the caller must pipe
+ * upstream — this is the original `IncomingMessage` when no tee was needed
+ * (GET/HEAD/OPTIONS), or the upstream-side branch of the tee otherwise.
+ * Callers must pipe the returned stream (not `req`) to the outbound request.
+ *
+ * For methods that carry a body, `req` is converted to a web stream and
+ * `tee()`'d: one branch goes to the callback's `Request.body`, the other is
+ * returned for the caller to forward. If the callback never reads its
+ * branch, we cancel it after the decision so the tee does not buffer the
+ * entire upload.
+ */
+export async function decideAndRespond(filterRequest, req, res, url, signal) {
+    let forCallback;
+    let forUpstream = req;
+    if (!BODYLESS_METHODS.has(req.method ?? 'GET')) {
+        const web = Readable.toWeb(req);
+        const [a, b] = web.tee();
+        forCallback = a;
+        forUpstream = Readable.fromWeb(b);
+    }
+    let webReq;
+    try {
+        webReq = new Request(url, {
+            method: req.method,
+            headers: incomingHeaders(req),
+            signal,
+            ...(forCallback ? { body: forCallback, duplex: 'half' } : {}),
+        });
+    }
+    catch (err) {
+        // Malformed URL/headers from the client — deny rather than crash.
+        deny(res, {
+            action: 'deny',
+            reason: `malformed request: ${err.message}`,
+        });
+        void forCallback?.cancel();
+        forUpstream.destroy();
+        return null;
+    }
+    let decision;
+    try {
+        decision = await filterRequest(webReq);
+    }
+    catch (err) {
+        decision = {
+            action: 'deny',
+            reason: `filterRequest threw: ${err.message}`,
+        };
+    }
+    // If the callback didn't read its branch, cancel it so tee() stops
+    // buffering bytes nobody will consume. If it did, the tee already buffered
+    // whatever was read; the upstream branch sees the same bytes.
+    if (forCallback && !webReq.bodyUsed) {
+        void forCallback.cancel();
+    }
+    if (decision.action === 'allow') {
+        logForDebugging(`[request-filter] allow ${req.method} ${url}`);
+        return forUpstream;
+    }
+    deny(res, decision);
+    forUpstream.destroy();
+    return null;
+}
+function deny(res, decision) {
+    const reason = decision.reason ?? 'denied by filterRequest';
+    logForDebugging(`[request-filter] deny: ${reason}`);
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    res.writeHead(403, {
+        'Content-Type': 'text/plain',
+        'X-Proxy-Error': 'blocked-by-sandbox-runtime',
+    });
+    res.end(reason + '\n');
+}
+function incomingHeaders(req) {
+    const h = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined)
+            continue;
+        if (Array.isArray(v)) {
+            for (const vv of v)
+                h.append(k, vv);
+        }
+        else {
+            h.append(k, v);
+        }
+    }
+    return h;
+}
+//# sourceMappingURL=request-filter.js.map

package/dist/sandbox/request-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-filter.js","sourceRoot":"","sources":["../../src/sandbox/request-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AA0BnD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAoC,EACpC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAmB;IAEnB,IAAI,WAAmD,CAAA;IACvD,IAAI,WAAW,GAAa,GAAG,CAAA;IAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAA;QAC7D,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,CAAA;QACxB,WAAW,GAAG,CAAC,CAAA;QACf,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC;YAC7B,MAAM;YACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,IAAI,CAAC,GAAG,EAAE;YACR,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sBAAuB,GAAa,CAAC,OAAO,EAAE;SACvD,CAAC,CAAA;QACF,KAAK,WAAW,EAAE,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,OAAO,EAAE,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG;YACT,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE;SACzD,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,eAAe,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAA;QAC9D,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnB,WAAW,CAAC,OAAO,EAAE,CAAA;IACrB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,QAAyB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,yBAAyB,CAAA;IAC3D,eAAe,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;IACnD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,OAAO,EAAE,CAAA;QACb,OAAM;IACR,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,YAAY;QAC5B,eAAe,EAAE,4BAA4B;KAC9C,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAQ;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/sandbox/sandbox-config.d.ts

@@ -2,6 +2,7 @@
  * Configuration for Sandbox Runtime
  * This is the main configuration interface that consumers pass to SandboxManager.initialize()
  */
+import type { FilterRequestCallback } from './request-filter.js';
 import { z } from 'zod';
 /**
  * Schema for MITM proxy configuration
@@ -57,6 +58,23 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         socketPath: string;
         domains: string[];
     }>>;
+    filterRequest: z.ZodOptional<z.ZodType<FilterRequestCallback, z.ZodTypeDef, FilterRequestCallback>>;
+    tlsTerminate: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        caCertPath: z.ZodOptional<z.ZodString>;
+        caKeyPath: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    }, {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    }>, {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    }, {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    }>>;
     parentProxy: z.ZodOptional<z.ZodObject<{
         http: z.ZodOptional<z.ZodString>;
         https: z.ZodOptional<z.ZodString>;
@@ -83,6 +101,11 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         socketPath: string;
         domains: string[];
     } | undefined;
+    filterRequest?: FilterRequestCallback | undefined;
+    tlsTerminate?: {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    } | undefined;
     parentProxy?: {
         http?: string | undefined;
         https?: string | undefined;
@@ -101,6 +124,11 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         socketPath: string;
         domains: string[];
     } | undefined;
+    filterRequest?: FilterRequestCallback | undefined;
+    tlsTerminate?: {
+        caCertPath?: string | undefined;
+        caKeyPath?: string | undefined;
+    } | undefined;
     parentProxy?: {
         http?: string | undefined;
         https?: string | undefined;
@@ -186,6 +214,23 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
             socketPath: string;
             domains: string[];
         }>>;
+        filterRequest: z.ZodOptional<z.ZodType<FilterRequestCallback, z.ZodTypeDef, FilterRequestCallback>>;
+        tlsTerminate: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            caCertPath: z.ZodOptional<z.ZodString>;
+            caKeyPath: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        }, {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        }>, {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        }, {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        }>>;
         parentProxy: z.ZodOptional<z.ZodObject<{
             http: z.ZodOptional<z.ZodString>;
             https: z.ZodOptional<z.ZodString>;
@@ -212,6 +257,11 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
             socketPath: string;
             domains: string[];
         } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        } | undefined;
         parentProxy?: {
             http?: string | undefined;
             https?: string | undefined;
@@ -230,6 +280,11 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
             socketPath: string;
             domains: string[];
         } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        } | undefined;
         parentProxy?: {
             http?: string | undefined;
             https?: string | undefined;
@@ -284,6 +339,8 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         argv0?: string | undefined;
         applyPath?: string | undefined;
     }>>;
+    bwrapPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    socatPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
     network: {
         allowedDomains: string[];
@@ -298,6 +355,11 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
             socketPath: string;
             domains: string[];
         } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        } | undefined;
         parentProxy?: {
             http?: string | undefined;
             https?: string | undefined;
@@ -326,6 +388,8 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         argv0?: string | undefined;
         applyPath?: string | undefined;
     } | undefined;
+    bwrapPath?: string | undefined;
+    socatPath?: string | undefined;
 }, {
     network: {
         allowedDomains: string[];
@@ -340,6 +404,11 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
             socketPath: string;
             domains: string[];
         } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+        } | undefined;
         parentProxy?: {
             http?: string | undefined;
             https?: string | undefined;
@@ -368,6 +437,8 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         argv0?: string | undefined;
         applyPath?: string | undefined;
     } | undefined;
+    bwrapPath?: string | undefined;
+    socatPath?: string | undefined;
 }>;
 export type MitmProxyConfig = z.infer<typeof MitmProxyConfigSchema>;
 export type ParentProxyConfig = z.infer<typeof ParentProxyConfigSchema>;

package/dist/sandbox/sandbox-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAoDvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmE9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDrC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAgEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4G9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+DrC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}

package/dist/sandbox/sandbox-config.js

@@ -2,6 +2,7 @@
  * Configuration for Sandbox Runtime
  * This is the main configuration interface that consumers pass to SandboxManager.initialize()
  */
+import { isAbsolute } from 'node:path';
 import { z } from 'zod';
 /**
  * Schema for domain patterns (e.g., "example.com", "*.npmjs.org")
@@ -42,6 +43,17 @@ const domainPatternSchema = z.string().refine(val => {
  * Schema for filesystem paths
  */
 const filesystemPathSchema = z.string().min(1, 'Path cannot be empty');
+/**
+ * Schema for an absolute path to an external binary.
+ * Relative paths are rejected to prevent PATH/CWD-based hijacking — these
+ * overrides are intended for admin-managed installs at fixed locations.
+ */
+const binaryPathSchema = z
+    .string()
+    .min(1, 'Path cannot be empty')
+    .refine(val => isAbsolute(val), {
+    message: 'Binary path must be absolute',
+});
 /**
  * Schema for MITM proxy configuration
  * Allows routing specific domains through an upstream MITM proxy via Unix socket
@@ -121,6 +133,41 @@ export const NetworkConfigSchema = z.object({
         .optional()
         .describe('Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering.'),
     mitmProxy: MitmProxyConfigSchema.optional().describe('Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering.'),
+    filterRequest: z
+        .custom(v => typeof v === 'function', {
+        message: 'filterRequest must be a function',
+    })
+        .optional()
+        .describe('Per-request filter callback. Receives the parsed HTTP request ' +
+        '(web-standard Request) and returns {action, reason?}. Denied ' +
+        'requests get a 403 with the reason. If the callback throws, the ' +
+        'request is denied. Applies to plain HTTP through the proxy and, ' +
+        'when tlsTerminate is configured, to terminated HTTPS. SRT does not ' +
+        'provide a policy language; library consumers own matching.'),
+    tlsTerminate: z
+        .object({
+        caCertPath: z
+            .string()
+            .min(1)
+            .optional()
+            .describe('Path to a PEM-encoded CA certificate. The sandboxed child is ' +
+            'configured to trust this CA, and the TLS-terminating proxy uses ' +
+            'it to sign per-host certificates. If omitted, SRT generates an ' +
+            'ephemeral CA into a temp directory for the lifetime of the ' +
+            'session.'),
+        caKeyPath: z
+            .string()
+            .min(1)
+            .optional()
+            .describe('Path to the PEM-encoded private key for caCertPath.'),
+    })
+        .refine(o => !o.caCertPath === !o.caKeyPath, {
+        message: 'caCertPath and caKeyPath must be provided together',
+    })
+        .optional()
+        .describe('[EXPERIMENTAL] Enable in-process TLS termination so HTTPS ' +
+        'request/response bodies are visible to SRT. Provide a CA cert+key, ' +
+        'or omit both to have SRT generate an ephemeral one.'),
     parentProxy: ParentProxyConfigSchema.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy " +
         'tunnels non-mitmProxy traffic through this parent instead of ' +
         'connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY ' +
@@ -223,5 +270,13 @@ export const SandboxRuntimeConfigSchema = z.object({
         'that spawn a Chrome/Chromium subprocess. Without this, Chrome will crash on startup ' +
         'due to denied Mach service lookups and bootstrap registrations.'),
     seccomp: SeccompConfigSchema.optional().describe('Custom seccomp binary paths (Linux only).'),
+    bwrapPath: binaryPathSchema
+        .optional()
+        .describe('Linux only: absolute path to the bwrap (bubblewrap) binary. ' +
+        'When set, this path is used directly instead of resolving "bwrap" via PATH.'),
+    socatPath: binaryPathSchema
+        .optional()
+        .describe('Linux only: absolute path to the socat binary. ' +
+        'When set, this path is used directly instead of resolving "socat" via PATH.'),
 });
 //# sourceMappingURL=sandbox-config.js.map

package/dist/sandbox/sandbox-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;CACF,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;CACJ,CAAC,CAAA"}

package/dist/sandbox/sandbox-manager.d.ts

@@ -1,3 +1,4 @@
+import { type MitmCA } from './mitm-ca.js';
 import type { SandboxRuntimeConfig } from './sandbox-config.js';
 import type { SandboxAskCallback, FsReadRestrictionConfig, FsWriteRestrictionConfig, NetworkRestrictionConfig } from './sandbox-schemas.js';
 import { type SandboxDependencyCheck } from './linux-sandbox-utils.js';
@@ -31,6 +32,7 @@ export interface ISandboxManager {
     annotateStderrWithSandboxFailures(command: string, stderr: string): string;
     getLinuxGlobPatternWarnings(): string[];
     getConfig(): SandboxRuntimeConfig | undefined;
+    getMitmCA(): MitmCA | undefined;
     updateConfig(newConfig: SandboxRuntimeConfig): void;
     cleanupAfterCommand(): void;
     reset(): Promise<void>;

package/dist/sandbox/sandbox-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA08BpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA0BnB,CAAA"}
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAwgCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA2BnB,CAAA"}