@sysid/sandbox-runtime-improved 0.0.49-sysid.2 → 0.0.51-sysid.1

package/dist/sandbox/socks-proxy.js

@@ -80,15 +80,27 @@ export function createSocksProxyServer(options) {
             }
         });
     });
+    // Track every accepted client socket so close() can tear them down
+    // immediately. `net.Server.close()`'s callback waits for all open
+    // connections to finish, and a SOCKS connection mid-`dialDirect()` (30s
+    // timeout) or mid-relay holds the server open indefinitely. During
+    // SandboxManager.reset() that turns into a hang that can outlive bun's
+    // 5s test/hook timeout, so we destroy connections rather than drain them.
+    const internalServer = socksServer
+        ?.server;
+    const openSockets = new Set();
+    internalServer?.on('connection', (socket) => {
+        openSockets.add(socket);
+        socket.once('close', () => openSockets.delete(socket));
+    });
     return {
         server: socksServer,
         getPort() {
             // Access the internal server to get the port
             // We need to use type assertion here as the server property is private
             try {
-                const serverInternal = socksServer?.server;
-                if (serverInternal && typeof serverInternal?.address === 'function') {
-                    const address = serverInternal.address();
+                if (internalServer && typeof internalServer?.address === 'function') {
+                    const address = internalServer.address();
                     if (address && typeof address === 'object' && 'port' in address) {
                         return address.port;
                     }
@@ -102,10 +114,9 @@ export function createSocksProxyServer(options) {
         },
         listen(port, hostname) {
             return new Promise((resolve, reject) => {
-                const serverInternal = socksServer?.server;
-                serverInternal?.once('error', reject);
+                internalServer?.once('error', reject);
                 const listeningCallback = () => {
-                    serverInternal?.removeListener('error', reject);
+                    internalServer?.removeListener('error', reject);
                     const actualPort = this.getPort();
                     if (actualPort) {
                         logForDebugging(`SOCKS proxy listening on ${hostname}:${actualPort}`);
@@ -135,14 +146,20 @@ export function createSocksProxyServer(options) {
                     }
                     resolve();
                 });
+                // Forcibly drop any sockets still open. close() above stopped the
+                // listener; the callback won't fire until these drain on their own,
+                // and a stuck upstream dial means they may never drain.
+                for (const socket of openSockets) {
+                    socket.destroy();
+                }
+                openSockets.clear();
             });
         },
         unref() {
             // Access the internal server to call unref
             try {
-                const serverInternal = socksServer?.server;
-                if (serverInternal && typeof serverInternal?.unref === 'function') {
-                    serverInternal.unref();
+                if (internalServer && typeof internalServer?.unref === 'function') {
+                    internalServer.unref();
                 }
             }
             catch (error) {

package/dist/sandbox/socks-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"socks-proxy.js","sourceRoot":"","sources":["../../src/sandbox/socks-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAA;AAqB1B,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,WAAW,GAAG,YAAY,EAAE,CAAA;IAElC,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAA;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;YAE1B,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,eAAe,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAC5D,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,gCAAgC,KAAK,EAAE,EAAE;gBACvD,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,2DAA2D;IAC3D,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;QAE1B,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,WAA+B,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAC7B,UAAU,GAAG,IAAI,CAAA;YACjB,WAAW,EAAE,OAAO,EAAE,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;QAErD,iEAAiE;QACjE,0EAA0E;QAC1E,MAAM,SAAS,GACb,OAAO,CAAC,WAAW,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;YACxE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,IAAI,GAAG,SAAS;YACpB,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAE1B,IAAI;aACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YACf,WAAW,GAAG,QAAQ,CAAA;YACtB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,UAAU,CAAC,iBAAiB,CAAC,CAAA;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACnD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACX,eAAe,CACb,oBAAoB,IAAI,IAAI,IAAI,YAAa,GAAa,CAAC,OAAO,EAAE,EACpE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,UAAU,CAAC,kBAAkB,CAAC,CAAA;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,yDAAyD;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,OAAO;YACL,6CAA6C;YAC7C,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,cAAc,GAClB,WACD,EAAE,MAAM,CAAA;gBACT,IAAI,cAAc,IAAI,OAAO,cAAc,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;oBACpE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBACxC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;wBAChE,OAAO,OAAO,CAAC,IAAI,CAAA;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,8DAA8D;gBAC9D,eAAe,CAAC,uBAAuB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,QAAgB;YACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,cAAc,GAClB,WACD,EAAE,MAAM,CAAA;gBACT,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACrC,MAAM,iBAAiB,GAAG,GAAS,EAAE;oBACnC,cAAc,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACjC,IAAI,UAAU,EAAE,CAAC;wBACf,eAAe,CACb,4BAA4B,QAAQ,IAAI,UAAU,EAAE,CACrD,CAAA;wBACD,OAAO,CAAC,UAAU,CAAC,CAAA;oBACrB,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;oBAC5D,CAAC;gBACH,CAAC,CAAA;gBACD,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;YACvD,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;oBACxB,IAAI,KAAK,EAAE,CAAC;wBACV,iEAAiE;wBACjE,mDAAmD;wBACnD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;wBACvD,MAAM,eAAe,GACnB,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;4BACpC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;4BACvC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;wBAExC,IAAI,CAAC,eAAe,EAAE,CAAC;4BACrB,MAAM,CAAC,KAAK,CAAC,CAAA;4BACb,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,OAAO,EAAE,CAAA;gBACX,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK;YACH,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,cAAc,GAClB,WACD,EAAE,MAAM,CAAA;gBACT,IAAI,cAAc,IAAI,OAAO,cAAc,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;oBAClE,cAAc,CAAC,KAAK,EAAE,CAAA;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,wBAAwB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"socks-proxy.js","sourceRoot":"","sources":["../../src/sandbox/socks-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAA;AAqB1B,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,WAAW,GAAG,YAAY,EAAE,CAAA;IAElC,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAA;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;YAE1B,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,eAAe,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAC5D,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,gCAAgC,KAAK,EAAE,EAAE;gBACvD,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,2DAA2D;IAC3D,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;QAE1B,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,WAA+B,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAC7B,UAAU,GAAG,IAAI,CAAA;YACjB,WAAW,EAAE,OAAO,EAAE,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;QAErD,iEAAiE;QACjE,0EAA0E;QAC1E,MAAM,SAAS,GACb,OAAO,CAAC,WAAW,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;YACxE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,IAAI,GAAG,SAAS;YACpB,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAE1B,IAAI;aACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YACf,WAAW,GAAG,QAAQ,CAAA;YACtB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,UAAU,CAAC,iBAAiB,CAAC,CAAA;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACnD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACX,eAAe,CACb,oBAAoB,IAAI,IAAI,IAAI,YAAa,GAAa,CAAC,OAAO,EAAE,EACpE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,UAAU,CAAC,kBAAkB,CAAC,CAAA;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,yDAAyD;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,cAAc,GAAI,WAAiD;QACvE,EAAE,MAAM,CAAA;IACV,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,cAAc,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;QAClD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,OAAO;YACL,6CAA6C;YAC7C,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,cAAc,IAAI,OAAO,cAAc,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;oBACpE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBACxC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;wBAChE,OAAO,OAAO,CAAC,IAAI,CAAA;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,8DAA8D;gBAC9D,eAAe,CAAC,uBAAuB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,QAAgB;YACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACrC,MAAM,iBAAiB,GAAG,GAAS,EAAE;oBACnC,cAAc,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACjC,IAAI,UAAU,EAAE,CAAC;wBACf,eAAe,CACb,4BAA4B,QAAQ,IAAI,UAAU,EAAE,CACrD,CAAA;wBACD,OAAO,CAAC,UAAU,CAAC,CAAA;oBACrB,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;oBAC5D,CAAC;gBACH,CAAC,CAAA;gBACD,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;YACvD,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;oBACxB,IAAI,KAAK,EAAE,CAAC;wBACV,iEAAiE;wBACjE,mDAAmD;wBACnD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;wBACvD,MAAM,eAAe,GACnB,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;4BACpC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;4BACvC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;wBAExC,IAAI,CAAC,eAAe,EAAE,CAAC;4BACrB,MAAM,CAAC,KAAK,CAAC,CAAA;4BACb,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,OAAO,EAAE,CAAA;gBACX,CAAC,CAAC,CAAA;gBACF,kEAAkE;gBAClE,oEAAoE;gBACpE,wDAAwD;gBACxD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;oBACjC,MAAM,CAAC,OAAO,EAAE,CAAA;gBAClB,CAAC;gBACD,WAAW,CAAC,KAAK,EAAE,CAAA;YACrB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK;YACH,2CAA2C;YAC3C,IAAI,CAAC;gBACH,IAAI,cAAc,IAAI,OAAO,cAAc,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;oBAClE,cAAc,CAAC,KAAK,EAAE,CAAA;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,wBAAwB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/sandbox/tls-terminate-proxy.d.ts

@@ -0,0 +1,41 @@
+/**
+ * In-process TLS termination for HTTPS traffic through the forward proxy.
+ *
+ * When a MitmCA is configured, the forward proxy hands CONNECT requests here
+ * instead of opening an opaque byte tunnel. We terminate the client's TLS
+ * with a per-host leaf cert (see mitm-leaf.ts), parse the decrypted stream
+ * as HTTP/1.1, and re-issue each request upstream over a real TLS
+ * connection. The optional `filterRequest` callback runs on each parsed
+ * request before it is forwarded.
+ */
+import type { Duplex } from 'node:stream';
+import type { MitmCA } from './mitm-ca.js';
+import { type FilterRequestCallback } from './request-filter.js';
+export type TerminateTarget = {
+    hostname: string;
+    port: number;
+    /**
+     * Additional trusted CA(s) for the proxy's outbound TLS leg. Unset → system
+     * roots + NODE_EXTRA_CA_CERTS. Primarily a test seam (NODE_EXTRA_CA_CERTS
+     * is read at process start, so tests can't set it from inside the suite).
+     */
+    upstreamCA?: string | Buffer | Array<string | Buffer>;
+};
+/**
+ * Terminate the client's TLS on `socket`, parse the decrypted HTTP/1.1
+ * stream, and forward each request to `target` over a fresh upstream TLS
+ * connection.
+ *
+ * Preconditions: the caller has already validated `target` against the
+ * domain allowlist; this function does not re-check it.
+ *
+ * Implementation: we stand up a short-lived https.Server on a unix socket
+ * and pipe the client socket through it. The Node-idiomatic alternative —
+ * feeding the raw socket to a non-listening server via
+ * `emit('connection', socket)` — is not implemented by Bun's https.Server,
+ * and SRT runs under both runtimes. A per-connection server lets the
+ * request handler close over `target` (which carries the originally-
+ * requested host:port) without socket-keyed lookups.
+ */
+export declare function terminateAndForward(ca: MitmCA, filterRequest: FilterRequestCallback | undefined, socket: Duplex, head: Buffer, target: TerminateTarget): void;
+//# sourceMappingURL=tls-terminate-proxy.d.ts.map

package/dist/sandbox/tls-terminate-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-terminate-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAI5B,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,qBAAqB,GAAG,SAAS,EAChD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,IAAI,CA0EN"}

package/dist/sandbox/tls-terminate-proxy.js

@@ -0,0 +1,167 @@
+/**
+ * In-process TLS termination for HTTPS traffic through the forward proxy.
+ *
+ * When a MitmCA is configured, the forward proxy hands CONNECT requests here
+ * instead of opening an opaque byte tunnel. We terminate the client's TLS
+ * with a per-host leaf cert (see mitm-leaf.ts), parse the decrypted stream
+ * as HTTP/1.1, and re-issue each request upstream over a real TLS
+ * connection. The optional `filterRequest` callback runs on each parsed
+ * request before it is forwarded.
+ */
+import { createServer as createHttpsServer, request as httpsRequest, } from 'node:https';
+import { connect, isIP } from 'node:net';
+import { unlink } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { logForDebugging } from '../utils/debug.js';
+import { decideAndRespond, } from './request-filter.js';
+import { mintLeafCert, secureContextFor } from './mitm-leaf.js';
+import { stripHopByHop } from './parent-proxy.js';
+/**
+ * Terminate the client's TLS on `socket`, parse the decrypted HTTP/1.1
+ * stream, and forward each request to `target` over a fresh upstream TLS
+ * connection.
+ *
+ * Preconditions: the caller has already validated `target` against the
+ * domain allowlist; this function does not re-check it.
+ *
+ * Implementation: we stand up a short-lived https.Server on a unix socket
+ * and pipe the client socket through it. The Node-idiomatic alternative —
+ * feeding the raw socket to a non-listening server via
+ * `emit('connection', socket)` — is not implemented by Bun's https.Server,
+ * and SRT runs under both runtimes. A per-connection server lets the
+ * request handler close over `target` (which carries the originally-
+ * requested host:port) without socket-keyed lookups.
+ */
+export function terminateAndForward(ca, filterRequest, socket, head, target) {
+    // ALPN advertises HTTP/1.1 only — terminating HTTP/2 would require a frame
+    // parser; clients negotiate down. The base secureContext covers clients
+    // that don't send SNI; SNICallback covers everyone else.
+    const baseLeaf = mintLeafCert(ca, target.hostname);
+    const inner = createHttpsServer({
+        ALPNProtocols: ['http/1.1'],
+        cert: baseLeaf.certPem,
+        key: baseLeaf.keyPem,
+        SNICallback: (servername, cb) => {
+            try {
+                cb(null, secureContextFor(ca, servername || target.hostname));
+            }
+            catch (err) {
+                cb(err);
+            }
+        },
+    });
+    inner.on('request', (req, res) => {
+        void forwardUpstream(filterRequest, req, res, target);
+    });
+    inner.on('tlsClientError', (err, sock) => {
+        logForDebugging(`[tls-terminate] client TLS error for ${target.hostname}: ${err.message}`, { level: 'error' });
+        sock.destroy();
+    });
+    inner.on('upgrade', (_req, sock) => {
+        // WebSocket / non-HTTP over TLS — out of scope for now.
+        logForDebugging('[tls-terminate] upgrade request refused', {
+            level: 'warn',
+        });
+        sock.destroy();
+    });
+    const sockPath = innerSocketPath();
+    const cleanup = () => {
+        inner.close();
+        unlink(sockPath, () => { });
+    };
+    inner.on('error', err => {
+        logForDebugging(`[tls-terminate] inner server listen failed: ${err.message}`, { level: 'error' });
+        socket.destroy();
+        cleanup();
+    });
+    inner.listen(sockPath, () => {
+        const loop = connect({ path: sockPath });
+        loop.on('error', err => {
+            logForDebugging(`[tls-terminate] inner loopback failed: ${err.message}`, {
+                level: 'error',
+            });
+            socket.destroy();
+            cleanup();
+        });
+        loop.once('connect', () => {
+            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            // Any bytes the client sent in the same packet as the CONNECT are the
+            // start of its ClientHello — forward them first.
+            if (head.length)
+                loop.write(head);
+            socket.pipe(loop);
+            loop.pipe(socket);
+        });
+        socket.on('error', () => loop.destroy());
+        socket.once('close', () => {
+            loop.destroy();
+            cleanup();
+        });
+        loop.once('close', () => socket.destroy());
+    });
+    inner.unref();
+}
+async function forwardUpstream(filterRequest, req, res, target) {
+    let body = req;
+    if (filterRequest) {
+        const ac = new AbortController();
+        res.once('close', () => ac.abort());
+        const host = req.headers.host ??
+            (target.port === 443
+                ? target.hostname
+                : `${target.hostname}:${target.port}`);
+        const out = await decideAndRespond(filterRequest, req, res, `https://${host}${req.url ?? '/'}`, ac.signal);
+        if (out === null)
+            return;
+        body = out;
+    }
+    // Bun's https.request verifies the upstream cert against headers.host
+    // verbatim (including ":port"), which never matches a SAN. Drop the host
+    // header and let the runtime derive it from {host, port} — same wire value,
+    // correct verification under both Node and Bun.
+    const fwdHeaders = stripHopByHop(req.headers);
+    delete fwdHeaders.host;
+    // TODO(terminating-tls): honour parentProxy for the upstream leg.
+    const upstream = httpsRequest({
+        host: target.hostname,
+        port: target.port,
+        path: req.url,
+        method: req.method,
+        headers: fwdHeaders,
+        // We're a TLS-terminating proxy, not a trust boundary for the upstream
+        // server's identity — let the runtime do normal verification against
+        // system roots (and NODE_EXTRA_CA_CERTS). servername must match the
+        // host the client intended; SNI cannot carry an IP literal, and Bun's
+        // https.request treats `servername: undefined` differently from
+        // omitting the key, so spread conditionally.
+        ...(isIP(target.hostname) ? {} : { servername: target.hostname }),
+        ...(target.upstreamCA ? { ca: target.upstreamCA } : {}),
+        // No global agent: a proxy's outbound leg shouldn't share a connection
+        // pool keyed on the proxy process. Also works around a Bun quirk where
+        // the first request's `ca:` value is cached on the global agent and
+        // subsequent calls with a different `ca:` are silently ignored.
+        agent: false,
+    }, upRes => {
+        res.writeHead(upRes.statusCode ?? 502, stripHopByHop(upRes.headers));
+        upRes.pipe(res);
+    });
+    upstream.on('error', err => {
+        logForDebugging(`[tls-terminate] upstream ${target.hostname}:${target.port} failed: ${err.message}`, { level: 'error' });
+        if (!res.headersSent) {
+            res.writeHead(502, { 'Content-Type': 'text/plain' });
+            res.end('Bad Gateway');
+        }
+        else {
+            res.destroy();
+        }
+    });
+    res.on('close', () => upstream.destroy());
+    body.pipe(upstream);
+}
+let sockSeq = 0;
+function innerSocketPath() {
+    // Keep it short — macOS sun_path is 104 bytes.
+    return join(tmpdir(), `srt-tt-${process.pid}-${(sockSeq++).toString(36)}.sock`);
+}
+//# sourceMappingURL=tls-terminate-proxy.js.map

package/dist/sandbox/tls-terminate-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAajD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,MAAc,EACd,IAAY,EACZ,MAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,sEAAsE;YACtE,iDAAiD;YACjD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,GAAoB,EACpB,GAAmB,EACnB,MAAuB;IAEvB,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,IAAI,GACR,GAAG,CAAC,OAAO,CAAC,IAAI;YAChB,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAA;IAEtB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;QACnB,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,KAAK,EAAE,KAAK;KACb,EACD,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzB,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sysid/sandbox-runtime-improved",
-  "version": "0.0.49-sysid.2",
+  "version": "0.0.51-sysid.1",
   "description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
   "type": "module",
   "main": "./dist/index.js",
@@ -26,6 +26,7 @@
   "dependencies": {
     "@pondwader/socks5-server": "^1.0.10",
     "commander": "^12.1.0",
+    "node-forge": "^1.4.0",
     "shell-quote": "^1.8.3",
     "zod": "^3.24.1"
   },
@@ -33,6 +34,7 @@
     "@eslint/js": "^9.14.0",
     "@types/bun": "^1.3.2",
     "@types/node": "^18",
+    "@types/node-forge": "^1.3.14",
     "@types/shell-quote": "^1.7.5",
     "eslint": "^9.14.0",
     "eslint-config-prettier": "^8.10.0",
@@ -64,16 +66,16 @@
     "network-filtering",
     "filesystem-restrictions"
   ],
-  "author": "sysid (fork of Anthropic PBC)",
+  "author": "Anthropic PBC",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/sysid/sandbox-runtime-improved.git#sysid"
+    "url": "git+https://github.com/anthropic-experimental/sandbox-runtime.git"
   },
   "bugs": {
-    "url": "https://github.com/sysid/sandbox-runtime-improved/issues"
+    "url": "https://github.com/anthropic-experimental/sandbox-runtime/issues"
   },
-  "homepage": "https://github.com/sysid/sandbox-runtime-improved/tree/sysid#readme",
+  "homepage": "https://github.com/anthropic-experimental/sandbox-runtime#readme",
   "lint-staged": {
     "*.ts": [
       "eslint --fix --cache --cache-location=node_modules/.cache/.eslintcache",