@sysid/sandbox-runtime-improved 0.0.51-sysid.1 → 0.0.52-sysid.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/sandbox/http-proxy.d.ts.map +1 -1
- package/dist/sandbox/http-proxy.js +31 -6
- package/dist/sandbox/http-proxy.js.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.d.ts +29 -0
- package/dist/sandbox/tls-terminate-proxy.d.ts.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.js +53 -3
- package/dist/sandbox/tls-terminate-proxy.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
|
|
6
6
|
Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/sandbox-runtime).
|
|
7
7
|
|
|
8
|
-
This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.
|
|
8
|
+
This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.52**).
|
|
9
9
|
As new features become available, equivalent local ones will be removed.
|
|
10
10
|
|
|
11
11
|
> Objective: keep as close to original as possible, while allowing selected additional features.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAOvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;
|
|
1
|
+
{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAOvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAErC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IAEjE;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAClC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAyS7E"}
|
|
@@ -5,7 +5,7 @@ import { connect } from 'node:net';
|
|
|
5
5
|
import { URL } from 'node:url';
|
|
6
6
|
import { logForDebugging } from '../utils/debug.js';
|
|
7
7
|
import { decideAndRespond, } from './request-filter.js';
|
|
8
|
-
import { terminateAndForward } from './tls-terminate-proxy.js';
|
|
8
|
+
import { peekForClientHello, terminateAndForward, } from './tls-terminate-proxy.js';
|
|
9
9
|
import { connectViaParentProxy, dialDirect, openConnectTunnel, proxyAuthHeader, selectParentProxyUrl, shouldBypassParentProxy, stripBrackets, stripHopByHop, } from './parent-proxy.js';
|
|
10
10
|
export function createHttpProxyServer(options) {
|
|
11
11
|
const server = createServer();
|
|
@@ -49,11 +49,28 @@ export function createHttpProxyServer(options) {
|
|
|
49
49
|
// > direct
|
|
50
50
|
// (tlsTerminate and mitmProxy are mutually exclusive at the config
|
|
51
51
|
// layer, so the first two never both apply.)
|
|
52
|
+
let wrote200 = false;
|
|
52
53
|
if (options.mitmCA) {
|
|
53
54
|
if (clientGone)
|
|
54
55
|
return;
|
|
55
|
-
|
|
56
|
-
|
|
56
|
+
// We can only terminate TLS. CONNECT also carries non-TLS streams —
|
|
57
|
+
// notably SSH on Linux, where the sandbox's own GIT_SSH_COMMAND
|
|
58
|
+
// routes `ssh` through this proxy via `socat - PROXY:`. Send 200 so
|
|
59
|
+
// the client transmits its first bytes, sniff for a ClientHello, and
|
|
60
|
+
// only terminate if it is one. Non-TLS falls through to the opaque
|
|
61
|
+
// tunnel below — i.e. base-sandbox behaviour, hostname-allowlisted
|
|
62
|
+
// but not content-inspected (same as the SOCKS path).
|
|
63
|
+
socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
|
|
64
|
+
wrote200 = true;
|
|
65
|
+
const peeked = await peekForClientHello(socket, head);
|
|
66
|
+
if (clientGone)
|
|
67
|
+
return;
|
|
68
|
+
if (peeked.isTLS) {
|
|
69
|
+
terminateAndForward(options.mitmCA, options.filterRequest, socket, peeked.head, { hostname, port, upstreamCA: options.tlsTerminateUpstreamCA });
|
|
70
|
+
return;
|
|
71
|
+
}
|
|
72
|
+
logForDebugging(`[tls-terminate] non-TLS bytes on CONNECT ${hostname}:${port}; opaque-tunnelling`);
|
|
73
|
+
head = peeked.head;
|
|
57
74
|
}
|
|
58
75
|
const mitmSocketPath = options.getMitmSocketPath?.(hostname);
|
|
59
76
|
const parentUrl = !mitmSocketPath &&
|
|
@@ -83,7 +100,12 @@ export function createHttpProxyServer(options) {
|
|
|
83
100
|
logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
|
|
84
101
|
level: 'error',
|
|
85
102
|
});
|
|
86
|
-
|
|
103
|
+
// If we already sent 200 (mitmCA sniff path), an HTTP status line now
|
|
104
|
+
// would land inside the tunnel as payload. Just close.
|
|
105
|
+
if (wrote200)
|
|
106
|
+
socket.destroy();
|
|
107
|
+
else
|
|
108
|
+
socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
|
|
87
109
|
return;
|
|
88
110
|
}
|
|
89
111
|
if (clientGone) {
|
|
@@ -91,9 +113,12 @@ export function createHttpProxyServer(options) {
|
|
|
91
113
|
upstream.destroy();
|
|
92
114
|
return;
|
|
93
115
|
}
|
|
94
|
-
|
|
116
|
+
if (!wrote200) {
|
|
117
|
+
socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
|
|
118
|
+
}
|
|
95
119
|
// Forward any bytes the client sent in the same packet as the CONNECT
|
|
96
|
-
// (Node delivers these as the `head` buffer, not via the socket stream)
|
|
120
|
+
// (Node delivers these as the `head` buffer, not via the socket stream),
|
|
121
|
+
// plus anything the ClientHello sniff consumed when mitmCA is on.
|
|
97
122
|
if (head.length)
|
|
98
123
|
upstream.write(head);
|
|
99
124
|
upstream.pipe(socket);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,
|
|
1
|
+
{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AA4C1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,+BAA+B;YAC/B,gCAAgC;YAChC,wBAAwB;YACxB,aAAa;YACb,mEAAmE;YACnE,6CAA6C;YAC7C,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,UAAU;oBAAE,OAAM;gBACtB,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnE,sDAAsD;gBACtD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAC3D,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACrD,IAAI,UAAU;oBAAE,OAAM;gBACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,mBAAmB,CACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,aAAa,EACrB,MAAM,EACN,MAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAC/D,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,eAAe,CACb,4CAA4C,QAAQ,IAAI,IAAI,qBAAqB,CAClF,CAAA;gBACD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,sEAAsE;gBACtE,uDAAuD;gBACvD,IAAI,QAAQ;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;;oBACzB,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YAEpE,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;iBACnC,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAEzE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,IAAI,GAAa,GAAG,CAAA;YACxB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,OAAO,CAAC,aAAa,EACrB,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,CAAC,MAAM,CACV,CAAA;gBACD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAM;gBACxB,IAAI,GAAG,GAAG,CAAA;YACZ,CAAC;YAED,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBACxE,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;oBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}
|
|
@@ -11,6 +11,35 @@
|
|
|
11
11
|
import type { Duplex } from 'node:stream';
|
|
12
12
|
import type { MitmCA } from './mitm-ca.js';
|
|
13
13
|
import { type FilterRequestCallback } from './request-filter.js';
|
|
14
|
+
/**
|
|
15
|
+
* True if `buf` starts with a TLS Handshake record header.
|
|
16
|
+
*
|
|
17
|
+
* Three bytes: content type 0x16 (Handshake) + legacy_record_version
|
|
18
|
+
* 0x03,0x00–0x03. RFC 8446 §5.1 froze the record-layer version (TLS 1.3+
|
|
19
|
+
* negotiate via the supported_versions extension, the wire header stays
|
|
20
|
+
* ≤0x0303), so this holds for current and future TLS. Same predicate as
|
|
21
|
+
* mitmproxy `starts_like_tls_record`; nginx `ssl_preread` routes on byte 0
|
|
22
|
+
* alone and HAProxy `req.ssl_hello_type` reads 9 bytes to also extract the
|
|
23
|
+
* handshake type — 3 is the established middle ground for "is this TLS".
|
|
24
|
+
*
|
|
25
|
+
* Routing heuristic, not a security check: a non-TLS stream that happens to
|
|
26
|
+
* start 16 03 0x is handed to the TLS server, which then rejects it properly.
|
|
27
|
+
*/
|
|
28
|
+
export declare function looksLikeClientHello(buf: Buffer): boolean;
|
|
29
|
+
/**
|
|
30
|
+
* Wait for the client's first post-CONNECT bytes and report whether they look
|
|
31
|
+
* like a TLS ClientHello. The caller must already have written the
|
|
32
|
+
* `200 Connection Established` line — clients don't send until they see it.
|
|
33
|
+
*
|
|
34
|
+
* Any bytes consumed here are returned in `.head` so the caller can forward
|
|
35
|
+
* them to whichever downstream (terminate or opaque tunnel) it picks. The
|
|
36
|
+
* socket is left paused so further bytes buffer until the downstream
|
|
37
|
+
* `pipe()` resumes it.
|
|
38
|
+
*/
|
|
39
|
+
export declare function peekForClientHello(socket: Duplex, head: Buffer): Promise<{
|
|
40
|
+
isTLS: boolean;
|
|
41
|
+
head: Buffer;
|
|
42
|
+
}>;
|
|
14
43
|
export type TerminateTarget = {
|
|
15
44
|
hostname: string;
|
|
16
45
|
port: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tls-terminate-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAI5B,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,qBAAqB,GAAG,SAAS,EAChD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,IAAI,
|
|
1
|
+
{"version":3,"file":"tls-terminate-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAI5B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3C;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,qBAAqB,GAAG,SAAS,EAChD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,IAAI,CAyEN"}
|
|
@@ -17,6 +17,57 @@ import { logForDebugging } from '../utils/debug.js';
|
|
|
17
17
|
import { decideAndRespond, } from './request-filter.js';
|
|
18
18
|
import { mintLeafCert, secureContextFor } from './mitm-leaf.js';
|
|
19
19
|
import { stripHopByHop } from './parent-proxy.js';
|
|
20
|
+
/**
|
|
21
|
+
* True if `buf` starts with a TLS Handshake record header.
|
|
22
|
+
*
|
|
23
|
+
* Three bytes: content type 0x16 (Handshake) + legacy_record_version
|
|
24
|
+
* 0x03,0x00–0x03. RFC 8446 §5.1 froze the record-layer version (TLS 1.3+
|
|
25
|
+
* negotiate via the supported_versions extension, the wire header stays
|
|
26
|
+
* ≤0x0303), so this holds for current and future TLS. Same predicate as
|
|
27
|
+
* mitmproxy `starts_like_tls_record`; nginx `ssl_preread` routes on byte 0
|
|
28
|
+
* alone and HAProxy `req.ssl_hello_type` reads 9 bytes to also extract the
|
|
29
|
+
* handshake type — 3 is the established middle ground for "is this TLS".
|
|
30
|
+
*
|
|
31
|
+
* Routing heuristic, not a security check: a non-TLS stream that happens to
|
|
32
|
+
* start 16 03 0x is handed to the TLS server, which then rejects it properly.
|
|
33
|
+
*/
|
|
34
|
+
export function looksLikeClientHello(buf) {
|
|
35
|
+
return (buf.length >= 3 && buf[0] === 0x16 && buf[1] === 0x03 && buf[2] <= 0x03);
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* Wait for the client's first post-CONNECT bytes and report whether they look
|
|
39
|
+
* like a TLS ClientHello. The caller must already have written the
|
|
40
|
+
* `200 Connection Established` line — clients don't send until they see it.
|
|
41
|
+
*
|
|
42
|
+
* Any bytes consumed here are returned in `.head` so the caller can forward
|
|
43
|
+
* them to whichever downstream (terminate or opaque tunnel) it picks. The
|
|
44
|
+
* socket is left paused so further bytes buffer until the downstream
|
|
45
|
+
* `pipe()` resumes it.
|
|
46
|
+
*/
|
|
47
|
+
export function peekForClientHello(socket, head) {
|
|
48
|
+
if (head.length >= 3) {
|
|
49
|
+
return Promise.resolve({ isTLS: looksLikeClientHello(head), head });
|
|
50
|
+
}
|
|
51
|
+
return new Promise(resolve => {
|
|
52
|
+
let buf = head;
|
|
53
|
+
const done = () => {
|
|
54
|
+
socket.removeListener('data', onData);
|
|
55
|
+
socket.removeListener('close', done);
|
|
56
|
+
resolve({ isTLS: looksLikeClientHello(buf), head: buf });
|
|
57
|
+
};
|
|
58
|
+
const onData = (chunk) => {
|
|
59
|
+
// Pause synchronously so anything after this chunk buffers for the
|
|
60
|
+
// downstream pipe() rather than being dropped in flowing mode.
|
|
61
|
+
socket.pause();
|
|
62
|
+
buf = buf.length ? Buffer.concat([buf, chunk]) : chunk;
|
|
63
|
+
if (buf.length >= 3)
|
|
64
|
+
return done();
|
|
65
|
+
socket.resume();
|
|
66
|
+
};
|
|
67
|
+
socket.on('data', onData);
|
|
68
|
+
socket.once('close', done);
|
|
69
|
+
});
|
|
70
|
+
}
|
|
20
71
|
/**
|
|
21
72
|
* Terminate the client's TLS on `socket`, parse the decrypted HTTP/1.1
|
|
22
73
|
* stream, and forward each request to `target` over a fresh upstream TLS
|
|
@@ -85,9 +136,8 @@ export function terminateAndForward(ca, filterRequest, socket, head, target) {
|
|
|
85
136
|
cleanup();
|
|
86
137
|
});
|
|
87
138
|
loop.once('connect', () => {
|
|
88
|
-
|
|
89
|
-
//
|
|
90
|
-
// start of its ClientHello — forward them first.
|
|
139
|
+
// The caller wrote `200 Connection Established` before sniffing for the
|
|
140
|
+
// ClientHello; `head` holds whatever the sniff consumed.
|
|
91
141
|
if (head.length)
|
|
92
142
|
loop.write(head);
|
|
93
143
|
socket.pipe(loop);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;
|
|
1
|
+
{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACL,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,IAAI,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY;IAEZ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAA;QACd,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAClC,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,MAAc,EACd,IAAY,EACZ,MAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,wEAAwE;YACxE,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,GAAoB,EACpB,GAAmB,EACnB,MAAuB;IAEvB,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,IAAI,GACR,GAAG,CAAC,OAAO,CAAC,IAAI;YAChB,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAA;IAEtB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;QACnB,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,KAAK,EAAE,KAAK;KACb,EACD,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzB,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sysid/sandbox-runtime-improved",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.52-sysid.1",
|
|
4
4
|
"description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|