@sysid/sandbox-runtime-improved 0.0.55-sysid.1 → 0.0.61-sysid.1

package/dist/sandbox/domain-pattern.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ */
+export declare function isInjectHostCoveredByAllowedDomains(injectHost: string, allowedDomains: readonly string[]): boolean;
+//# sourceMappingURL=domain-pattern.d.ts.map

package/dist/sandbox/domain-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.d.ts","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAUT"}

package/dist/sandbox/domain-pattern.js

@@ -0,0 +1,60 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+import { isIP } from 'node:net';
+import { stripBrackets } from './parent-proxy.js';
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export function matchesDomainPattern(hostname, pattern) {
+    const h = hostname.toLowerCase();
+    if (pattern === '*')
+        return true;
+    if (pattern.startsWith('*.')) {
+        if (isIP(stripBrackets(h)))
+            return false;
+        const baseDomain = pattern.substring(2).toLowerCase();
+        return h.endsWith('.' + baseDomain);
+    }
+    return h === pattern.toLowerCase();
+}
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ */
+export function isInjectHostCoveredByAllowedDomains(injectHost, allowedDomains) {
+    if (!injectHost.startsWith('*.')) {
+        return allowedDomains.some(p => matchesDomainPattern(injectHost, p));
+    }
+    const injectBase = injectHost.slice(2).toLowerCase();
+    return allowedDomains.some(p => {
+        if (!p.startsWith('*.'))
+            return false;
+        const allowedBase = p.slice(2).toLowerCase();
+        return injectBase === allowedBase || injectBase.endsWith('.' + allowedBase);
+    });
+}
+//# sourceMappingURL=domain-pattern.js.map

package/dist/sandbox/domain-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.js","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAe;IAEf,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAkB,EAClB,cAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACpD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC7B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/sandbox/http-proxy.d.ts

@@ -2,7 +2,7 @@ import type { Socket } from 'node:net';
 import type { Duplex } from 'node:stream';
 import type { Server } from 'node:http';
 import type { MitmCA } from './mitm-ca.js';
-import { type FilterRequestCallback } from './request-filter.js';
+import { type FilterRequestCallback, type MutateForwardedHeaders } from './request-filter.js';
 import type { ResolvedParentProxy } from './parent-proxy.js';
 export interface HttpProxyServerOptions {
     filter(port: number, host: string, socket: Socket | Duplex): Promise<boolean> | boolean;
@@ -19,11 +19,42 @@ export interface HttpProxyServerOptions {
      * config layer (sandbox-manager rejects both being set).
      */
     mitmCA?: MitmCA;
+    /**
+     * Per-host opt-out of TLS termination; consulted only when `mitmCA` is
+     * set. Return false to leave that CONNECT as an opaque byte tunnel
+     * (still hostname-allowlisted via `filter`, but not content-inspected —
+     * the same posture as the non-tlsTerminate path), so the sandboxed
+     * client performs its own TLS handshake end-to-end with the upstream.
+     *
+     * Use for upstreams the proxy must not re-originate: mTLS services
+     * (only the in-sandbox client holds the client certificate) and
+     * certificate-pinning clients that reject the MITM CA. Note that
+     * `filterRequest` and `mutateHeaders` never see the HTTPS traffic to
+     * these hosts; plain-HTTP proxy requests to them are unaffected (those
+     * are readable without termination and keep the normal request pipeline).
+     *
+     * Absent, or returning true, means today's behaviour: terminate.
+     */
+    shouldTerminateTLS?(hostname: string, port: number): boolean;
     /**
      * Per-request filter; runs on plain-HTTP proxy requests and on terminated
      * HTTPS requests. See request-filter.ts.
      */
     filterRequest?: FilterRequestCallback;
+    /**
+     * Mutate forwarded headers on the TLS-terminated path, after the allow
+     * decision and before the upstream request is built. The upstream leg is
+     * always cert-verified (rejectUnauthorized defaults to true), so the TLS
+     * handshake fails before any mutated header bytes reach an unverified
+     * server. See {@link MutateForwardedHeaders}.
+     */
+    mutateHeaders?: MutateForwardedHeaders;
+    /**
+     * Mutate forwarded headers on the plain-HTTP path. Separate from
+     * `mutateHeaders` so callers can wire the TLS path only — credential
+     * injection over plaintext is opt-in.
+     */
+    mutateHeadersPlaintext?: MutateForwardedHeaders;
     /**
      * Additional trusted CA(s) for the terminating proxy's outbound TLS leg.
      * Unset → system roots + NODE_EXTRA_CA_CERTS. Primarily a test seam.

package/dist/sandbox/http-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAOvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAErC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IAEjE;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IAEjC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CA8T7E"}
+{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAOvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAE5D;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAErC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAA;IAEtC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAE/C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IAEjE;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IAEjC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CA0U7E"}

package/dist/sandbox/http-proxy.js

@@ -65,7 +65,8 @@ export function createHttpProxyServer(options) {
             // (tlsTerminate and mitmProxy are mutually exclusive at the config
             // layer, so the first two never both apply.)
             let wrote200 = false;
-            if (options.mitmCA) {
+            if (options.mitmCA &&
+                (options.shouldTerminateTLS?.(hostname, port) ?? true)) {
                 if (clientGone)
                     return;
                 // We can only terminate TLS. CONNECT also carries non-TLS streams —
@@ -81,12 +82,18 @@ export function createHttpProxyServer(options) {
                 if (clientGone)
                     return;
                 if (peeked.isTLS) {
-                    terminateAndForward(options.mitmCA, options.filterRequest, socket, peeked.head, { hostname, port, upstreamCA: options.tlsTerminateUpstreamCA });
+                    terminateAndForward(options.mitmCA, options.filterRequest, options.mutateHeaders, socket, peeked.head, { hostname, port, upstreamCA: options.tlsTerminateUpstreamCA });
                     return;
                 }
                 logForDebugging(`[tls-terminate] non-TLS bytes on CONNECT ${hostname}:${port}; opaque-tunnelling`);
                 head = peeked.head;
             }
+            else if (options.mitmCA) {
+                // Per-host termination opt-out: the policy exempts this host (mTLS
+                // upstream, cert-pinning client), so skip the MITM entirely and
+                // take the opaque tunnel below, exactly as if mitmCA were unset.
+                logForDebugging(`[tls-terminate] policy exempts ${hostname}:${port}; opaque-tunnelling`);
+            }
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
             const parentUrl = !mitmSocketPath &&
                 options.parentProxy &&
@@ -184,6 +191,7 @@ export function createHttpProxyServer(options) {
             if (req.socket.destroyed)
                 return;
             const fwdHeaders = { ...stripHopByHop(req.headers), host: url.host };
+            options.mutateHeadersPlaintext?.(fwdHeaders, hostname);
             // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
             const mitmSocketPath = options.getMitmSocketPath?.(hostname);
             const parentUrl = !mitmSocketPath &&

package/dist/sandbox/http-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAoD1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAW,EAAE;QACrD,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,CAAA;IACrE,CAAC,CAAA;IAED,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,CACR,gDAAgD;oBAC9C,+CAA+C,CAClD,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,+BAA+B;YAC/B,gCAAgC;YAChC,wBAAwB;YACxB,aAAa;YACb,mEAAmE;YACnE,6CAA6C;YAC7C,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,UAAU;oBAAE,OAAM;gBACtB,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnE,sDAAsD;gBACtD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAC3D,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACrD,IAAI,UAAU;oBAAE,OAAM;gBACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,mBAAmB,CACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,aAAa,EACrB,MAAM,EACN,MAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAC/D,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,eAAe,CACb,4CAA4C,QAAQ,IAAI,IAAI,qBAAqB,CAClF,CAAA;gBACD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,sEAAsE;gBACtE,uDAAuD;gBACvD,IAAI,QAAQ;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;;oBACzB,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YAEpE,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;iBACnC,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAEzE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,IAAI,GAAa,GAAG,CAAA;YACxB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,OAAO,CAAC,aAAa,EACrB,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,CAAC,MAAM,CACV,CAAA;gBACD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAM;gBACxB,IAAI,GAAG,GAAG,CAAA;YACZ,CAAC;YAED,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBACxE,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;oBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}
+{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAGjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAsF1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAW,EAAE;QACrD,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,CAAA;IACrE,CAAC,CAAA;IAED,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,CACR,gDAAgD;oBAC9C,+CAA+C,CAClD,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBAC9C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CACR,4BAA4B;oBAC1B,8BAA8B;oBAC9B,yCAAyC;oBACzC,MAAM;oBACN,yCAAyC,CAC5C,CAAA;gBACD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,+BAA+B;YAC/B,gCAAgC;YAChC,wBAAwB;YACxB,aAAa;YACb,mEAAmE;YACnE,6CAA6C;YAC7C,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IACE,OAAO,CAAC,MAAM;gBACd,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,EACtD,CAAC;gBACD,IAAI,UAAU;oBAAE,OAAM;gBACtB,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnE,sDAAsD;gBACtD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAC3D,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACrD,IAAI,UAAU;oBAAE,OAAM;gBACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,mBAAmB,CACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,aAAa,EACrB,MAAM,EACN,MAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAC/D,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,eAAe,CACb,4CAA4C,QAAQ,IAAI,IAAI,qBAAqB,CAClF,CAAA;gBACD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1B,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,eAAe,CACb,kCAAkC,QAAQ,IAAI,IAAI,qBAAqB,CACxE,CAAA;YACH,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,sEAAsE;gBACtE,uDAAuD;gBACvD,IAAI,QAAQ;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;;oBACzB,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;gBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,CAAA;YAER,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC7D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,YAAY;oBAC5B,eAAe,EAAE,sBAAsB;iBACxC,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YACpE,OAAO,CAAC,sBAAsB,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAEtD,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;iBACnC,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAEzE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,IAAI,GAAa,GAAG,CAAA;YACxB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,OAAO,CAAC,aAAa,EACrB,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,CAAC,MAAM,CACV,CAAA;gBACD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAM;gBACxB,IAAI,GAAG,GAAG,CAAA;YACZ,CAAC;YAED,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBACxE,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ;oBACR,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;oBACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}

package/dist/sandbox/linux-sandbox-utils.d.ts

@@ -22,6 +22,23 @@ export interface LinuxSandboxParams {
     caCertPath?: string;
     readConfig?: FsReadRestrictionConfig;
     writeConfig?: FsWriteRestrictionConfig;
+    /** Environment variable names to unset inside the sandbox (bwrap --unsetenv) */
+    unsetEnvVars?: string[];
+    /** Environment variables to set inside the sandbox (bwrap --setenv NAME VALUE) */
+    setEnvVars?: Record<string, string>;
+    /**
+     * Whole-file credential masks: bind fakePath (sentinel content) over
+     * realPath read-only so the sandbox reads the sentinel.
+     */
+    maskedFileBinds?: Array<{
+        realPath: string;
+        fakePath: string;
+    }>;
+    /**
+     * Host directory holding the fake files. Ro-bound over itself so the
+     * sandbox cannot write the bind sources even if allowWrite covers it.
+     */
+    maskedFileStoreDir?: string;
     enableWeakerNestedSandbox?: boolean;
     allowAllUnixSockets?: boolean;
     binShell?: string;

package/dist/sandbox/linux-sandbox-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAYtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AA8PD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAyCxE;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAWD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,qBAAqB,CAWvB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,sBAAsB,CA6BxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAkIpC;AAqdD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAiPjB"}
+{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAYtD,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/D;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACpD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AA8PD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAyCxE;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAWD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,qBAAqB,CAWvB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,sBAAsB,CA6BxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAmJpC;AA0hBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAoRjB"}

package/dist/sandbox/linux-sandbox-utils.js

@@ -365,6 +365,8 @@ export async function initializeLinuxNetworkBridge(httpProxyPort, socksProxyPort
     const socat = socatPath ?? 'socat';
     const socketId = randomBytes(8).toString('hex');
     const httpSocketPath = join(tmpdir(), `claude-http-${socketId}.sock`);
+    // Only allocated when ports differ; in the mux case the SOCKS side
+    // reuses httpSocketPath.
     const socksSocketPath = join(tmpdir(), `claude-socks-${socketId}.sock`);
     // Start HTTP bridge
     const httpSocatArgs = [
@@ -390,34 +392,48 @@ export async function initializeLinuxNetworkBridge(httpProxyPort, socksProxyPort
     if (!httpBridgeProcess.pid) {
         throw new Error('Failed to start HTTP bridge process');
     }
-    // Start SOCKS bridge
-    const socksSocatArgs = [
-        `UNIX-LISTEN:${socksSocketPath},fork,reuseaddr`,
-        `TCP:localhost:${socksProxyPort},keepalive,keepidle=10,keepintvl=5,keepcnt=3`,
-    ];
-    logForDebugging(`Starting SOCKS bridge: ${socat} ${socksSocatArgs.join(' ')}`);
-    const socksBridgeProcess = spawn(socat, socksSocatArgs, {
-        stdio: 'ignore',
-    });
-    // Add error and exit handlers to monitor bridge health — registered
-    // before the !pid check for the same reason as the HTTP bridge above.
-    socksBridgeProcess.on('error', err => {
-        logForDebugging(`SOCKS bridge process error: ${err}`, { level: 'error' });
-    });
-    socksBridgeProcess.on('exit', (code, signal) => {
-        logForDebugging(`SOCKS bridge process exited with code ${code}, signal ${signal}`, { level: code === 0 ? 'info' : 'error' });
-    });
-    if (!socksBridgeProcess.pid) {
-        // Clean up HTTP bridge
-        if (httpBridgeProcess.pid) {
-            try {
-                process.kill(httpBridgeProcess.pid, 'SIGTERM');
-            }
-            catch {
-                // Ignore errors
+    // SOCKS bridge: when the host serves both protocols on one port (the mux),
+    // a second socat to the same TCP target is redundant — reuse the HTTP
+    // bridge's process and socket path. Downstream consumers
+    // (LinuxNetworkBridgeContext, in-sandbox socat, cleanup) treat duplicate
+    // refs idempotently. A separate bridge is only spawned when the ports
+    // differ (external proxy override).
+    let socksBridgeProcess;
+    let socksSockPath;
+    if (socksProxyPort === httpProxyPort) {
+        socksBridgeProcess = httpBridgeProcess;
+        socksSockPath = httpSocketPath;
+    }
+    else {
+        socksSockPath = socksSocketPath;
+        const socksSocatArgs = [
+            `UNIX-LISTEN:${socksSocketPath},fork,reuseaddr`,
+            `TCP:localhost:${socksProxyPort},keepalive,keepidle=10,keepintvl=5,keepcnt=3`,
+        ];
+        logForDebugging(`Starting SOCKS bridge: ${socat} ${socksSocatArgs.join(' ')}`);
+        socksBridgeProcess = spawn(socat, socksSocatArgs, {
+            stdio: 'ignore',
+        });
+        // Add error and exit handlers to monitor bridge health — registered
+        // before the !pid check for the same reason as the HTTP bridge above.
+        socksBridgeProcess.on('error', err => {
+            logForDebugging(`SOCKS bridge process error: ${err}`, { level: 'error' });
+        });
+        socksBridgeProcess.on('exit', (code, signal) => {
+            logForDebugging(`SOCKS bridge process exited with code ${code}, signal ${signal}`, { level: code === 0 ? 'info' : 'error' });
+        });
+        if (!socksBridgeProcess.pid) {
+            // Clean up HTTP bridge
+            if (httpBridgeProcess.pid) {
+                try {
+                    process.kill(httpBridgeProcess.pid, 'SIGTERM');
+                }
+                catch {
+                    // Ignore errors
+                }
             }
+            throw new Error('Failed to start SOCKS bridge process');
         }
-        throw new Error('Failed to start SOCKS bridge process');
     }
     // Wait for both sockets to be ready
     const maxAttempts = 5;
@@ -430,7 +446,7 @@ export async function initializeLinuxNetworkBridge(httpProxyPort, socksProxyPort
         }
         try {
             // fs already imported
-            if (fs.existsSync(httpSocketPath) && fs.existsSync(socksSocketPath)) {
+            if (fs.existsSync(httpSocketPath) && fs.existsSync(socksSockPath)) {
                 logForDebugging(`Linux bridges ready after ${i + 1} attempts`);
                 break;
             }
@@ -464,7 +480,7 @@ export async function initializeLinuxNetworkBridge(httpProxyPort, socksProxyPort
     }
     return {
         httpSocketPath,
-        socksSocketPath,
+        socksSocketPath: socksSockPath,
         httpBridgeProcess,
         socksBridgeProcess,
         httpProxyPort,
@@ -521,6 +537,30 @@ function buildSandboxCommand(httpSocketPath, socksSocketPath, userCommand, apply
         return `${shellPath} -c ${shellquote.quote([innerScript])}`;
     }
 }
+/**
+ * bwrap cannot create a file bind mount point over a destination that is
+ * itself a symlink — `--ro-bind /dev/null <symlink>` fails with "Can't create
+ * file at <path>" and the whole command refuses to start. File read-deny
+ * binds therefore target the symlink's resolved target instead: reads
+ * through the symlink resolve to that target inside the mount namespace, so
+ * the denied content stays covered. This matters for credential dotfiles
+ * (~/.netrc, ~/.npmrc, …) that are commonly symlinks into a dotfile
+ * manager's directory. Directory denies (`--tmpfs`) are left on the original
+ * path: bwrap accepts those, and rewriting them would break allowRead
+ * carve-outs expressed against the symlink path (e.g. /bin on usr-merged
+ * systems).
+ */
+function resolveSymlinkDenyDest(normalizedPath) {
+    try {
+        if (fs.lstatSync(normalizedPath).isSymbolicLink()) {
+            return fs.realpathSync(normalizedPath);
+        }
+    }
+    catch {
+        // Dangling symlink or vanished path — keep the original.
+    }
+    return normalizedPath;
+}
 /**
  * Mount a tmpfs over a read-denied directory, then restore the allowed write
  * paths and allowRead paths the tmpfs just wiped. Used by the denyRead loop
@@ -563,7 +603,7 @@ function pushReadDenyDirMounts(args, normalizedPath, allowedWritePaths, readAllo
 /**
  * Generate filesystem bind mount arguments for bwrap
  */
-async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = { command: 'rg' }, mandatoryDenySearchDepth = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH, allowGitConfig = false, abortSignal) {
+async function generateFilesystemArgs(readConfig, writeConfig, maskedFileBinds, maskedFileStoreDir, ripgrepConfig = { command: 'rg' }, mandatoryDenySearchDepth = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH, allowGitConfig = false, abortSignal) {
     const args = [];
     // fs already imported
     // Collect normalized allowed write paths. Populated in the writeConfig
@@ -712,9 +752,12 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
     // Handle read restrictions by mounting tmpfs over denied paths
     const readDenyPaths = [];
     const readAllowPaths = (readConfig?.allowWithinDeny || []).map(p => normalizePathForSandbox(p));
-    // Files masked by --ro-bind /dev/null below. Used to filter denyWriteArgs so
-    // that --ro-bind <host> <host> doesn't undo the mask.
-    const maskedFiles = new Set();
+    // Files masked by --ro-bind <source> <dest> below. Map of dest → source
+    // (/dev/null for read-deny, the sentinel fake for credential mask). Used
+    // to filter denyWriteArgs so that --ro-bind <host> <host> doesn't undo
+    // the mask, and to re-apply the correct source if a denyWrite ancestor
+    // bind re-exposes the dest.
+    const maskedFiles = new Map();
     // Directories masked by --tmpfs below, in emission (shallow-first) order.
     // Used to filter denyWriteArgs the same way: a dir in both deny lists must
     // not get its host contents re-bound on top of its own tmpfs.
@@ -739,7 +782,10 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
     // Always hide /etc/ssh/ssh_config.d to avoid permission issues with OrbStack
     // SSH is very strict about config file permissions and ownership, and they can
     // appear wrong inside the sandbox causing "Bad owner or permissions" errors
-    if (fs.existsSync('/etc/ssh/ssh_config.d')) {
+    //
+    // Skipped when readConfig is undefined (filesystem.disabled): no read
+    // policy means no implicit read denies either.
+    if (readConfig && fs.existsSync('/etc/ssh/ssh_config.d')) {
         readDenyPaths.push('/etc/ssh/ssh_config.d');
     }
     // Normalize then sort shallow-first so tmpfs over ancestor dirs lands before
@@ -767,11 +813,29 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
                 logForDebugging(`[Sandbox Linux] Skipping read deny for re-allowed path: ${normalizedPath}`);
                 continue;
             }
-            // For files, bind /dev/null instead of tmpfs
-            args.push('--ro-bind', '/dev/null', normalizedPath);
-            maskedFiles.add(normalizedPath);
+            // For files, bind /dev/null instead of tmpfs. bwrap rejects symlink
+            // bind destinations, so the deny bind lands on the resolved target.
+            const denyDest = resolveSymlinkDenyDest(normalizedPath);
+            args.push('--ro-bind', '/dev/null', denyDest);
+            maskedFiles.set(denyDest, '/dev/null');
+            maskedFiles.set(normalizedPath, '/dev/null');
         }
     }
+    // Whole-file credential masks: same bind shape as a file read-deny,
+    // but the source is the sentinel-content fake instead of /dev/null.
+    // realPath was already normalized (tilde-expanded, realpath'd) by the
+    // caller; resolveSymlinkDenyDest covers the symlinked-credential case
+    // for the same reason as above. The fake's parent dir is explicitly
+    // ro-bound at the end of this function, so the bind source is never
+    // writable from inside the sandbox. Adding the dest to maskedFiles
+    // ensures a later denyWrite ro-bind over the same path doesn't undo
+    // the mask.
+    for (const { realPath, fakePath } of maskedFileBinds ?? []) {
+        const dest = resolveSymlinkDenyDest(realPath);
+        args.push('--ro-bind', fakePath, dest);
+        maskedFiles.set(dest, fakePath);
+        maskedFiles.set(realPath, fakePath);
+    }
     // Emitting denyWrite last means these ro-binds layer on top of any write
     // paths the denyRead loop just re-bound. Before this ordering, tmpfs over
     // an ancestor of cwd would wipe the .git/hooks protection. But skip any
@@ -816,14 +880,32 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
             pushReadDenyDirMounts(args, tmpfsDir, allowedWritePaths, readAllowPaths);
         }
     }
-    // Same problem for read-denied files: the /dev/null mask landed before the
-    // denyWrite ancestor bind, so the real file is back. Re-apply the mask.
-    for (const maskedFile of maskedFiles) {
+    // Same problem for masked files: the mask landed before the denyWrite
+    // ancestor bind, so the real file is back. Re-apply the mask with its
+    // original source (/dev/null for read-deny, the fake for credential mask).
+    for (const [maskedFile, source] of maskedFiles) {
         if (emittedDenyWriteDests.some(dest => maskedFile.startsWith(dest + '/'))) {
-            logForDebugging(`[Sandbox Linux] Re-applying denyRead file mask re-exposed by denyWrite bind: ${maskedFile}`);
-            args.push('--ro-bind', '/dev/null', maskedFile);
+            // maskedFiles holds both the symlink path and its resolved target so
+            // the denyWrite skip-check above matches either. Re-emission must go
+            // to the target only — bwrap rejects a symlink bind dest (see
+            // resolveSymlinkDenyDest), and the target is masked independently:
+            // either its original mask survived (target outside this denyWrite
+            // ancestor) or its own iteration re-emits it here.
+            if (resolveSymlinkDenyDest(maskedFile) !== maskedFile)
+                continue;
+            logForDebugging(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${maskedFile}`);
+            args.push('--ro-bind', source, maskedFile);
         }
     }
+    // INVARIANT: the fake-file store directory must never be writable from
+    // inside the sandbox. If it were, a sandboxed process could plant a
+    // symlink at a fake path and a later host-side write() would follow it,
+    // or replace a fake's content so the bind exposes attacker bytes. Emit
+    // last so it overlays any earlier --bind that covers the store dir
+    // (e.g. allowWrite: ['/tmp'] when the store is under os.tmpdir()).
+    if (maskedFileStoreDir !== undefined) {
+        args.push('--ro-bind', maskedFileStoreDir, maskedFileStoreDir);
+    }
     return args;
 }
 /**
@@ -875,16 +957,20 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
  * Dependencies are checked by checkLinuxDependencies() before enabling the sandbox.
  */
 export async function wrapCommandWithSandboxLinux(params) {
-    const { command, needsNetworkRestriction, httpSocketPath, socksSocketPath, httpProxyPort, socksProxyPort, proxyAuthToken, caCertPath, readConfig, writeConfig, enableWeakerNestedSandbox, allowAllUnixSockets, binShell, ripgrepConfig = { command: 'rg' }, mandatoryDenySearchDepth = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH, allowGitConfig = false, seccompConfig, bwrapPath, socatPath, abortSignal, } = params;
+    const { command, needsNetworkRestriction, httpSocketPath, socksSocketPath, httpProxyPort, socksProxyPort, proxyAuthToken, caCertPath, readConfig, writeConfig, unsetEnvVars, setEnvVars, maskedFileBinds, maskedFileStoreDir, enableWeakerNestedSandbox, allowAllUnixSockets, binShell, ripgrepConfig = { command: 'rg' }, mandatoryDenySearchDepth = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH, allowGitConfig = false, seccompConfig, bwrapPath, socatPath, abortSignal, } = params;
     // Determine if we have restrictions to apply
     // Read: denyOnly pattern - empty array means no restrictions
     // Write: allowOnly pattern - undefined means no restrictions, any config means restrictions
-    const hasReadRestrictions = readConfig && readConfig.denyOnly.length > 0;
+    const hasReadRestrictions = (readConfig && readConfig.denyOnly.length > 0) ||
+        (maskedFileBinds !== undefined && maskedFileBinds.length > 0);
     const hasWriteRestrictions = writeConfig !== undefined;
+    const hasEnvRestrictions = (unsetEnvVars !== undefined && unsetEnvVars.length > 0) ||
+        (setEnvVars !== undefined && Object.keys(setEnvVars).length > 0);
     // Check if we need any sandboxing
     if (!needsNetworkRestriction &&
         !hasReadRestrictions &&
-        !hasWriteRestrictions) {
+        !hasWriteRestrictions &&
+        !hasEnvRestrictions) {
         return command;
     }
     // Mark this sandbox invocation as active. cleanupBwrapMountPoints() will
@@ -913,6 +999,21 @@ export async function wrapCommandWithSandboxLinux(params) {
         else {
             logForDebugging('[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled');
         }
+        // ========== ENV RESTRICTIONS ==========
+        // Drop denied credential env vars from the inherited environment. Emitted
+        // before the proxy --setenv flags below: bwrap applies env operations in
+        // argument order, so SRT's own proxy plumbing vars survive even if a
+        // caller lists one of them as a denied credential.
+        if (hasEnvRestrictions) {
+            for (const name of unsetEnvVars ?? []) {
+                bwrapArgs.push('--unsetenv', name);
+            }
+            // Masked credentials override the inherited real value with a
+            // sentinel; bwrap --setenv replaces any inherited value of NAME.
+            for (const [name, value] of Object.entries(setEnvVars ?? {})) {
+                bwrapArgs.push('--setenv', name, value);
+            }
+        }
         // ========== NETWORK RESTRICTIONS ==========
         if (needsNetworkRestriction) {
             // Always unshare network namespace to isolate network access
@@ -933,13 +1034,18 @@ export async function wrapCommandWithSandboxLinux(params) {
                 }
                 // Bind both sockets into the sandbox
                 bwrapArgs.push('--bind', httpSocketPath, httpSocketPath);
-                bwrapArgs.push('--bind', socksSocketPath, socksSocketPath);
+                // When the mux serves both protocols, socksSocketPath is the same
+                // file as httpSocketPath; bwrap rejects a duplicate --bind of the
+                // same source→target.
+                if (socksSocketPath !== httpSocketPath) {
+                    bwrapArgs.push('--bind', socksSocketPath, socksSocketPath);
+                }
                 // Add proxy environment variables
                 // HTTP_PROXY points to the socat listener inside the sandbox (port 3128)
                 // which forwards to the Unix socket that bridges to the host's proxy server
                 const proxyEnv = generateProxyEnvVars(3128, // Internal HTTP listener port
                 1080, // Internal SOCKS listener port
-                caCertPath, proxyAuthToken);
+                caCertPath, proxyAuthToken, writeConfig === undefined);
                 bwrapArgs.push(...proxyEnv.flatMap((env) => {
                     const firstEq = env.indexOf('=');
                     const key = env.slice(0, firstEq);
@@ -958,7 +1064,7 @@ export async function wrapCommandWithSandboxLinux(params) {
             // If no sockets provided, network is completely blocked (--unshare-net without proxy)
         }
         // ========== FILESYSTEM RESTRICTIONS ==========
-        const fsArgs = await generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig, mandatoryDenySearchDepth, allowGitConfig, abortSignal);
+        const fsArgs = await generateFilesystemArgs(readConfig, writeConfig, maskedFileBinds, maskedFileStoreDir, ripgrepConfig, mandatoryDenySearchDepth, allowGitConfig, abortSignal);
         bwrapArgs.push(...fsArgs);
         // Always bind /dev
         bwrapArgs.push('--dev', '/dev');
@@ -1022,6 +1128,8 @@ export async function wrapCommandWithSandboxLinux(params) {
             restrictions.push('network');
         if (hasReadRestrictions || hasWriteRestrictions)
             restrictions.push('filesystem');
+        if (hasEnvRestrictions)
+            restrictions.push('env');
         if (applySeccompPrefix)
             restrictions.push('seccomp(unix-block)');
         logForDebugging(`[Sandbox Linux] Wrapped command with bwrap (${restrictions.join(', ')} restrictions)`);