@sysid/sandbox-runtime-improved 0.0.51-sysid.1 → 0.0.54-sysid.1

package/dist/sandbox/tls-terminate-proxy.js

@@ -17,6 +17,57 @@ import { logForDebugging } from '../utils/debug.js';
 import { decideAndRespond, } from './request-filter.js';
 import { mintLeafCert, secureContextFor } from './mitm-leaf.js';
 import { stripHopByHop } from './parent-proxy.js';
+/**
+ * True if `buf` starts with a TLS Handshake record header.
+ *
+ * Three bytes: content type 0x16 (Handshake) + legacy_record_version
+ * 0x03,0x00–0x03. RFC 8446 §5.1 froze the record-layer version (TLS 1.3+
+ * negotiate via the supported_versions extension, the wire header stays
+ * ≤0x0303), so this holds for current and future TLS. Same predicate as
+ * mitmproxy `starts_like_tls_record`; nginx `ssl_preread` routes on byte 0
+ * alone and HAProxy `req.ssl_hello_type` reads 9 bytes to also extract the
+ * handshake type — 3 is the established middle ground for "is this TLS".
+ *
+ * Routing heuristic, not a security check: a non-TLS stream that happens to
+ * start 16 03 0x is handed to the TLS server, which then rejects it properly.
+ */
+export function looksLikeClientHello(buf) {
+    return (buf.length >= 3 && buf[0] === 0x16 && buf[1] === 0x03 && buf[2] <= 0x03);
+}
+/**
+ * Wait for the client's first post-CONNECT bytes and report whether they look
+ * like a TLS ClientHello. The caller must already have written the
+ * `200 Connection Established` line — clients don't send until they see it.
+ *
+ * Any bytes consumed here are returned in `.head` so the caller can forward
+ * them to whichever downstream (terminate or opaque tunnel) it picks. The
+ * socket is left paused so further bytes buffer until the downstream
+ * `pipe()` resumes it.
+ */
+export function peekForClientHello(socket, head) {
+    if (head.length >= 3) {
+        return Promise.resolve({ isTLS: looksLikeClientHello(head), head });
+    }
+    return new Promise(resolve => {
+        let buf = head;
+        const done = () => {
+            socket.removeListener('data', onData);
+            socket.removeListener('close', done);
+            resolve({ isTLS: looksLikeClientHello(buf), head: buf });
+        };
+        const onData = (chunk) => {
+            // Pause synchronously so anything after this chunk buffers for the
+            // downstream pipe() rather than being dropped in flowing mode.
+            socket.pause();
+            buf = buf.length ? Buffer.concat([buf, chunk]) : chunk;
+            if (buf.length >= 3)
+                return done();
+            socket.resume();
+        };
+        socket.on('data', onData);
+        socket.once('close', done);
+    });
+}
 /**
  * Terminate the client's TLS on `socket`, parse the decrypted HTTP/1.1
  * stream, and forward each request to `target` over a fresh upstream TLS
@@ -85,9 +136,8 @@ export function terminateAndForward(ca, filterRequest, socket, head, target) {
             cleanup();
         });
         loop.once('connect', () => {
-            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-            // Any bytes the client sent in the same packet as the CONNECT are the
-            // start of its ClientHello — forward them first.
+            // The caller wrote `200 Connection Established` before sniffing for the
+            // ClientHello; `head` holds whatever the sniff consumed.
             if (head.length)
                 loop.write(head);
             socket.pipe(loop);
@@ -107,10 +157,24 @@ async function forwardUpstream(filterRequest, req, res, target) {
     if (filterRequest) {
         const ac = new AbortController();
         res.once('close', () => ac.abort());
-        const host = req.headers.host ??
-            (target.port === 443
-                ? target.hostname
-                : `${target.hostname}:${target.port}`);
+        // Build the URL passed to filterRequest from the CONNECT target,
+        // NOT from `req.headers.host`. The Host header is supplied by the
+        // sandboxed client and can be spoofed: a sandboxed process can
+        // CONNECT to allowlisted host A and then send a decrypted request
+        // with `Host: B` (where B is some other allowlisted host). If we
+        // built the filterRequest URL from req.headers.host the callback
+        // would see "host=B" while the request is actually delivered to A.
+        // A consumer using filterRequest for per-host method gating (e.g.
+        // "POST allowed only to inference endpoints") would be bypassed —
+        // the agent could spoof Host: api.example.com on a CONNECT to a
+        // different allowlisted host, get the POST allowed, and have it
+        // delivered to the CONNECT target instead.
+        //
+        // Always derive the URL from the verified CONNECT target so
+        // filterRequest sees the actual upstream destination.
+        const host = target.port === 443
+            ? target.hostname
+            : `${target.hostname}:${target.port}`;
         const out = await decideAndRespond(filterRequest, req, res, `https://${host}${req.url ?? '/'}`, ac.signal);
         if (out === null)
             return;

package/dist/sandbox/tls-terminate-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAajD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,MAAc,EACd,IAAY,EACZ,MAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,sEAAsE;YACtE,iDAAiD;YACjD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,GAAoB,EACpB,GAAmB,EACnB,MAAuB;IAEvB,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,IAAI,GACR,GAAG,CAAC,OAAO,CAAC,IAAI;YAChB,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAA;IAEtB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;QACnB,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,KAAK,EAAE,KAAK;KACb,EACD,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzB,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}
+{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACL,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,IAAI,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY;IAEZ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAA;QACd,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAClC,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,MAAc,EACd,IAAY,EACZ,MAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,wEAAwE;YACxE,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,GAAoB,EACpB,GAAmB,EACnB,MAAuB;IAEvB,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,2CAA2C;QAC3C,EAAE;QACF,4DAA4D;QAC5D,sDAAsD;QACtD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,GAAG;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAA;QACzC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAA;IAEtB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;QACnB,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,KAAK,EAAE,KAAK;KACb,EACD,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzB,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}

package/dist/sandbox/windows-sandbox-utils.d.ts

@@ -0,0 +1,222 @@
+import type { SandboxDependencyCheck } from './linux-sandbox-utils.js';
+/**
+ * Windows sandbox backend.
+ *
+ * Network isolation is enforced by `srt-win.exe` — a Rust helper that
+ * manages a local discriminator group, a machine-wide WFP filter set
+ * keyed on that group's SID, and an `exec` subcommand that spawns the
+ * target under a restricted token (group flipped deny-only) inside a
+ * hardened job. The sandboxed child reaches the host only via the JS
+ * http/socks proxies, which `srt-win exec` points at via env vars.
+ *
+ * This module is a thin wrapper around the `srt-win` CLI; all status
+ * comes from live enumeration (group via `LookupAccountNameW` +
+ * token-membership check; WFP via providerData-tag enumeration under
+ * the configured sublayer). There is no marker file.
+ *
+ * Filesystem restrictions are NOT enforced on Windows yet.
+ */
+export declare const DEFAULT_WINDOWS_GROUP_NAME = "sandbox-runtime-net";
+export declare const DEFAULT_WINDOWS_PROXY_PORT_RANGE: readonly [number, number];
+/** Identifies the discriminator group either by name or by SID. */
+export interface WindowsGroupRef {
+    /** Local or domain group name. Default: `sandbox-runtime-net`. */
+    groupName?: string;
+    /**
+     * Group SID in `S-1-…` form. Takes precedence over `groupName` —
+     * use for domain groups or where name resolution is unreliable.
+     */
+    groupSid?: string;
+}
+export type WindowsGroupStatus = 'absent' | 'created-not-on-token' | 'ready';
+export interface WindowsGroupStatusResult {
+    state: WindowsGroupStatus;
+    sid?: string;
+    warning?: string;
+    error?: string;
+}
+export type WindowsWfpStatus = 'absent' | 'installed';
+export interface WindowsWfpStatusResult {
+    state: WindowsWfpStatus;
+    filters: number;
+    /** `[low, high]` from the `permit-loopback` filter's tag, when present. */
+    portRange?: [number, number];
+}
+export interface WindowsSandboxParams {
+    command: string;
+    group: WindowsGroupRef;
+    /** JS HTTP proxy port — fed to `generateProxyEnvVars` for the returned env. */
+    httpProxyPort?: number;
+    /** JS SOCKS proxy port — fed to `generateProxyEnvVars` for the returned env. */
+    socksProxyPort?: number;
+    /**
+     * Inner shell. `cmd` (default), `powershell`, or `pwsh`. The child's
+     * post-`/c` content is **passthrough** — `&` chains, `"…"` quotes
+     * exactly as written. The security boundary is at the OUTER spawn
+     * (this argv is spawned with `shell:false`); the inner cmd.exe runs
+     * INSIDE the sandbox so its metachars are the user's tool.
+     */
+    binShell?: string;
+}
+/**
+ * Locate `srt-win.exe`. Resolution order:
+ *   1. `SRT_WIN_PATH` env var (CI sets this to the freshly-built binary).
+ *   2. `<repo>/vendor/srt-win/target/release/srt-win.exe` (local cargo build).
+ *   3. `<repo>/dist/vendor/srt-win/target/release/srt-win.exe`
+ *      (post-`npm run build` shape, when running from compiled output).
+ *
+ * Resolution via the optional `@anthropic-ai/sandbox-runtime-win32-*`
+ * platform packages is added separately.
+ *
+ * @throws if none exist.
+ */
+export declare function getSrtWinPath(): string;
+/**
+ * Query the discriminator group's state in SAM and in the current
+ * process's `TokenGroups`. `ready` means the group exists AND is
+ * enabled in the caller's token (i.e. the logout/login dance has
+ * happened). `created-not-on-token` means the install step ran but
+ * a fresh logon is needed before {@link initialize} can succeed.
+ */
+export declare function getWindowsGroupStatus(ref: WindowsGroupRef): WindowsGroupStatusResult;
+/**
+ * Query the WFP filter set under the given sublayer. `installed` means
+ * srt-win-tagged `permit-group` AND `block` filters are both present
+ * under that sublayer. Detection is **tag-based** (providerData JSON);
+ * filters installed by other tooling without the tag are not counted.
+ */
+export declare function getWindowsWfpStatus(opts?: {
+    sublayerGuid?: string;
+}): WindowsWfpStatusResult;
+export interface WindowsInstallOptions extends WindowsGroupRef {
+    /** Add this user (instead of the current user) to the group. */
+    userSid?: string;
+    /** WFP sublayer GUID. Omit for srt-win's compile-time default. */
+    sublayerGuid?: string;
+    /**
+     * Loopback PERMIT port range. Must match what
+     * `SandboxRuntimeConfig.windows.proxyPortRange` will be set to.
+     * Default {@link DEFAULT_WINDOWS_PROXY_PORT_RANGE}.
+     */
+    proxyPortRange?: readonly [number, number];
+    /**
+     * Replace an existing install whose configuration differs
+     * (different group SID or port range under the same sublayer).
+     * Without this, install refuses with "already installed with
+     * different config" rather than silently overwriting.
+     */
+    force?: boolean;
+}
+export interface WindowsInstallResult {
+    /** Post-install group state. */
+    group: WindowsGroupStatusResult;
+    /** Post-install WFP state. */
+    wfp: WindowsWfpStatusResult;
+    /**
+     * `true` if the user dismissed the UAC prompt. Not an error —
+     * the install simply didn't happen. Re-run when the user is
+     * ready to grant elevation.
+     */
+    cancelled?: true;
+}
+/**
+ * One-shot install: creates the discriminator group, adds the
+ * current user (or `userSid`), and installs the machine-wide WFP
+ * filter set — all in a single self-elevating process (one UAC
+ * prompt). Idempotent.
+ *
+ * Network for the calling user is **not disrupted** before the
+ * required logout: while the group is absent from the token, WFP
+ * filter-0 (PERMIT non-members) matches and traffic flows normally.
+ * After log-out/log-in, the group is enabled in the token and
+ * filter-1 (PERMIT group-enabled) takes over for the broker; only
+ * `srt-win exec` children (group flipped deny-only) fall through to
+ * the loopback/BLOCK filters.
+ *
+ * Returns the post-call group + WFP state. If the user cancels the
+ * UAC prompt this returns `{cancelled: true, …}` rather than
+ * throwing — cancellation is a user choice, not an error.
+ *
+ * @throws on group/WFP creation failure, or if filters already
+ *   exist under `sublayerGuid` with different configuration and
+ *   `force` is not set.
+ */
+export declare function installWindowsSandbox(opts?: WindowsInstallOptions): WindowsInstallResult;
+/**
+ * Remove the WFP filter set under `sublayerGuid` (one UAC prompt).
+ * Idempotent.
+ *
+ * **Does NOT delete the discriminator group** — group membership is
+ * persistent user state and removing it would force every user to
+ * re-do the logout dance on the next install. Call
+ * {@link deleteWindowsGroup} explicitly if you want full teardown.
+ *
+ * @returns `{cancelled: true}` if the user dismissed UAC.
+ */
+export declare function uninstallWindowsSandbox(opts?: {
+    sublayerGuid?: string;
+}): {
+    cancelled?: true;
+};
+/**
+ * Delete the discriminator group. Separate from
+ * {@link uninstallWindowsSandbox} so that uninstall→reinstall
+ * doesn't force a fresh logout for every member. **Requires
+ * elevation.** Idempotent (no-op if the group doesn't exist).
+ */
+export declare function deleteWindowsGroup(ref: WindowsGroupRef): void;
+/**
+ * Granular primitive: create the discriminator group and add the
+ * current user (or `userSid`). Most callers should use
+ * {@link installWindowsSandbox} instead; this exists for
+ * enterprise/CI flows that manage group and WFP separately.
+ * **Requires elevation.** Idempotent.
+ */
+export declare function createWindowsGroup(ref: WindowsGroupRef & {
+    userSid?: string;
+}): void;
+/**
+ * Granular primitive: install the machine-wide WFP filter set
+ * under `sublayerGuid` keyed on the group SID. Most callers should
+ * use {@link installWindowsSandbox} instead; this exists for
+ * enterprise/CI flows that manage group and WFP separately.
+ * **Requires elevation.** Idempotent — re-running replaces any
+ * existing srt-win-tagged filters under that sublayer.
+ */
+export declare function createWindowsWfp(ref: WindowsGroupRef & {
+    sublayerGuid?: string;
+    proxyPortRange?: readonly [number, number];
+}): void;
+/**
+ * Build the spawn descriptor for running `command` inside the Windows
+ * sandbox: an `argv` array plus the `env` to spawn it with.
+ *
+ * Caller MUST spawn the result with `{shell: false}` — that is the
+ * security boundary that keeps untrusted bytes off the host's shell
+ * (the inner `cmd.exe /c` runs INSIDE the sandbox; see
+ * `vendor/srt-win/src/launch.rs` `build_cmdline` for the passthrough
+ * rationale) — AND with the returned `env`.
+ *
+ * Proxy configuration is single-sourced by {@link generateProxyEnvVars}
+ * (the same canonical builder used on macOS/Linux). `srt-win exec`
+ * takes no `--http-proxy` / `--socks-proxy` flags and synthesizes no
+ * proxy env; it forwards its own environment to the sandboxed child
+ * verbatim. So the full proxy set is merged over the broker's
+ * environment here and the child inherits it through the spawn.
+ */
+export declare function wrapCommandWithSandboxWindows(p: WindowsSandboxParams): {
+    argv: string[];
+    env: NodeJS.ProcessEnv;
+};
+/**
+ * Install instructions, surfaced verbatim in error messages.
+ * Tailored to the observed group state: if the install already
+ * ran (`created-not-on-token`), only the logout is missing.
+ */
+export declare function windowsInstallInstructions(ref: WindowsGroupRef, sublayerGuid: string | undefined, groupState: WindowsGroupStatus): string;
+/**
+ * Check the Windows backend is ready to sandbox. Errors block
+ * `initialize()`; warnings are informational.
+ */
+export declare function checkWindowsDependencies(ref: WindowsGroupRef, sublayerGuid?: string): SandboxDependencyCheck;
+//# sourceMappingURL=windows-sandbox-utils.d.ts.map

package/dist/sandbox/windows-sandbox-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEtE;;;;;;;;;;;;;;;;GAgBG;AAMH,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAC/D,eAAO,MAAM,gCAAgC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAEtE,CAAA;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,sBAAsB,GAAG,OAAO,CAAA;AAE5E,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,kBAAkB,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAErD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,eAAe,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,IAAI,MAAM,CA0BtC;AAqDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,GACnB,wBAAwB,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,sBAAsB,CAaxB;AAED,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,KAAK,EAAE,wBAAwB,CAAA;IAC/B,8BAA8B;IAC9B,GAAG,EAAE,sBAAsB,CAAA;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,qBAA0B,GAC/B,oBAAoB,CAqDtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG;IAC7E,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAS7D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,IAAI,CAYN;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,GAAG;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC3C,GACA,IAAI,CAkBN;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,oBAAoB,GAAG;IACtE,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CACvB,CA2CA;AAqBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,kBAAkB,GAC7B,MAAM,CAuBR;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,sBAAsB,CA2DxB"}