@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1

package/README.md

@@ -5,7 +5,7 @@
 
 Based on [Anthropic Sandbox Runtime](https://github.com/anthropic-experimental/sandbox-runtime).
 
-This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.56**).
+This fork will be rebased on [SRT](https://github.com/anthropic-experimental/sandbox-runtime) continuously (currently based on upstream **v0.0.61**).
 As new features become available, equivalent local ones will be removed.
 
 > Objective: keep as close to original as possible, while allowing selected additional features.
@@ -320,6 +320,24 @@ Uses an **allow-only pattern** - all network access is denied by default.
   - `https` - Proxy URL for HTTPS/CONNECT traffic (falls back to `http` if unset)
   - `noProxy` - Comma-separated bypass list: hostname suffixes and CIDR ranges that connect directly
 
+**TLS termination** (`network.tlsTerminate`, experimental): when set, HTTPS CONNECTs are terminated in-process so SRT can see (and filter, via `network.filterRequest`) the decrypted requests. The sandboxed process is pointed at a trust bundle containing the MITM CA (`caCertPath`/`caKeyPath`, or an ephemeral CA if omitted) plus the host's regular roots, so proxy-minted certificates and real upstream certificates both verify.
+
+- `network.tlsTerminate.excludeDomains` - Domain patterns (same syntax as `allowedDomains`) that are **not** terminated. Matching CONNECTs are tunnelled opaquely instead: they are still subject to the domain allowlist, but the client inside the sandbox completes its own TLS handshake with the real upstream, and `filterRequest` / credential injection do not apply to their HTTPS traffic. Use this for the two cases TLS termination fundamentally breaks:
+  - **mTLS upstreams** - only the in-sandbox client holds the client certificate, so the proxy cannot re-originate the connection on its behalf.
+  - **Certificate-pinning clients** - clients that verify the upstream's identity themselves (custom CAs, SAN pinning) and reject the MITM certificate.
+
+```json
+{
+  "network": {
+    "allowedDomains": ["*.example.com", "internal-mtls.example.net"],
+    "deniedDomains": [],
+    "tlsTerminate": {
+      "excludeDomains": ["internal-mtls.example.net"]
+    }
+  }
+}
+```
+
 **Unix Socket Settings** (platform-specific behavior):
 
 | Setting                        | macOS                     | Linux                                    |
@@ -455,7 +473,7 @@ Watchman accesses files outside the sandbox boundaries, which will trigger permi
 
 - **macOS**: Uses `sandbox-exec` with custom profiles (no additional dependencies)
 - **Linux**: Uses `bubblewrap` (bwrap) for containerization
-- **Windows**: Not yet supported
+- **Windows**: Alpha — see [Windows (alpha)](#windows-alpha) below for the threat model and known limitations
 
 ### Platform-Specific Dependencies
 
@@ -498,6 +516,29 @@ The package includes pre-generated seccomp BPF filters for x86-64 and arm archit
   - Install via Homebrew: `brew install ripgrep`
   - Or download from: https://github.com/BurntSushi/ripgrep/releases
 
+## Windows (alpha)
+
+Windows support is **alpha and the design is in flux**. The current implementation provides network egress filtering (via the Windows Filtering Platform) and file read/write denial (via ACL stamping), but it is **not a security boundary against a deliberately adversarial sandboxed process** — see [Threat model](#threat-model) below. The mechanism will be substantially revised (the sandboxed process will run under a separate sandbox user account) in a future version.
+
+### Setup
+
+Run `npx @sysid/sandbox-runtime-improved windows-install` once per machine (requires admin; creates the `sandbox-runtime-net` local group and installs the WFP egress filters). **Log out and log back in** for group membership to take effect on your token. After that, `SandboxManager.initialize()` and the `srti` CLI work as on other platforms.
+
+### Threat model
+
+**Important:** the Windows sandbox runs the child as the **same user** as the host, with a restricted token (the discriminator group is flipped to deny-only). This protects against **accidental** access by well-behaved tools, and against **deliberate in-token** access by the sandboxed process itself — code running under the restricted token cannot open denied files or make direct outbound connections.
+
+It does **not** protect against a sandboxed process that deliberately escapes via system-service brokering. Task Scheduler, `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS` (re-parenting onto an unrestricted process such as `explorer.exe`), BITS, and certain COM out-of-process servers will spawn a process under the user's full, unrestricted interactive token. That process can then read or write any "denied" file and make unrestricted network connections. There is no same-user fix for this class of escape; the structural answer is running the sandboxed process under a **separate sandbox user account**, which is the planned next revision.
+
+Until that revision lands, treat the Windows sandbox as **best-effort defense against accidental access and well-behaved tooling**, not as containment for an adversarial process.
+
+### Known limitations
+
+- **Not a security boundary against a deliberate child** — see [Threat model](#threat-model) above.
+- `filesystem.allowWrite` (write allow-list) and `filesystem.allowRead` (re-allow within denyRead) are **not supported** on Windows — `initialize()` rejects a config that sets either. Only `denyRead` / `denyWrite` are applied.
+- `network.tlsTerminate` is not yet supported on Windows.
+- Directory targets in `filesystem.denyRead` / `filesystem.denyWrite` are not yet supported (individual files only).
+
 ## Development
 
 ```bash

package/dist/index.d.ts

@@ -3,11 +3,11 @@ export { SandboxViolationStore } from './sandbox/sandbox-violation-store.js';
 export type { SandboxRuntimeConfig, NetworkConfig, FilesystemConfig, CredentialsConfig, CredentialFileConfig, CredentialEnvVarConfig, CredentialMode, IgnoreViolationsConfig, } from './sandbox/sandbox-config.js';
 export { SandboxRuntimeConfigSchema, NetworkConfigSchema, FilesystemConfigSchema, CredentialsConfigSchema, IgnoreViolationsConfigSchema, RipgrepConfigSchema, } from './sandbox/sandbox-config.js';
 export type { SandboxAskCallback, FsReadRestrictionConfig, FsWriteRestrictionConfig, CredentialRestrictionConfig, NetworkRestrictionConfig, NetworkHostPattern, } from './sandbox/sandbox-schemas.js';
-export type { FilterRequestCallback, RequestDecision, } from './sandbox/request-filter.js';
+export type { FilterRequestCallback, RequestDecision, MutateForwardedHeaders, } from './sandbox/request-filter.js';
 export type { SandboxViolationEvent } from './sandbox/macos-sandbox-utils.js';
 export { type SandboxDependencyCheck } from './sandbox/linux-sandbox-utils.js';
-export { getSrtWinPath, getWindowsGroupStatus, getWindowsWfpStatus, installWindowsSandbox, uninstallWindowsSandbox, createWindowsGroup, deleteWindowsGroup, createWindowsWfp, windowsInstallInstructions, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './sandbox/windows-sandbox-utils.js';
-export type { WindowsGroupRef, WindowsInstallOptions, WindowsInstallResult, WindowsGroupStatus, WindowsGroupStatusResult, WindowsWfpStatus, WindowsWfpStatusResult, } from './sandbox/windows-sandbox-utils.js';
+export { getSrtWinPath, getWindowsGroupStatus, getWindowsWfpStatus, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, windowsTrustCa, installWindowsSandbox, uninstallWindowsSandbox, createWindowsGroup, deleteWindowsGroup, createWindowsWfp, windowsInstallInstructions, stampWindowsAcl, restoreWindowsAcl, expandWindowsFsDenyPaths, WINDOWS_ACL_PATH_OK, WINDOWS_ACL_PARENT_OK, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './sandbox/windows-sandbox-utils.js';
+export type { WindowsGroupRef, WindowsInstallOptions, WindowsInstallResult, WindowsGroupStatus, WindowsGroupStatusResult, WindowsWfpStatus, WindowsAclStampOptions, WindowsAclRestoreOptions, WindowsAclRestoreResult, WindowsAclPathOutcome, WindowsAclParentOutcome, WindowsWfpStatusResult, WindowsSandboxUserStatus, } from './sandbox/windows-sandbox-utils.js';
 export type { WindowsConfig } from './sandbox/sandbox-config.js';
 export { WindowsConfigSchema } from './sandbox/sandbox-config.js';
 export { getDefaultWritePaths } from './sandbox/sandbox-utils.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAG5E,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,6BAA6B,CAAA;AAGpC,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAGrC,YAAY,EACV,qBAAqB,EACrB,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAGpC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAG9E,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAGjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAGjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAG5E,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,6BAA6B,CAAA;AAGpC,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAGrC,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,6BAA6B,CAAA;AAGpC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAG9E,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAGjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAGjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/index.js

@@ -3,7 +3,7 @@ export { SandboxManager } from './sandbox/sandbox-manager.js';
 export { SandboxViolationStore } from './sandbox/sandbox-violation-store.js';
 export { SandboxRuntimeConfigSchema, NetworkConfigSchema, FilesystemConfigSchema, CredentialsConfigSchema, IgnoreViolationsConfigSchema, RipgrepConfigSchema, } from './sandbox/sandbox-config.js';
 // Windows install/status API
-export { getSrtWinPath, getWindowsGroupStatus, getWindowsWfpStatus, installWindowsSandbox, uninstallWindowsSandbox, createWindowsGroup, deleteWindowsGroup, createWindowsWfp, windowsInstallInstructions, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './sandbox/windows-sandbox-utils.js';
+export { getSrtWinPath, getWindowsGroupStatus, getWindowsWfpStatus, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, windowsTrustCa, installWindowsSandbox, uninstallWindowsSandbox, createWindowsGroup, deleteWindowsGroup, createWindowsWfp, windowsInstallInstructions, stampWindowsAcl, restoreWindowsAcl, expandWindowsFsDenyPaths, WINDOWS_ACL_PATH_OK, WINDOWS_ACL_PARENT_OK, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './sandbox/windows-sandbox-utils.js';
 export { WindowsConfigSchema } from './sandbox/sandbox-config.js';
 // Utility functions
 export { getDefaultWritePaths } from './sandbox/sandbox-utils.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAc5E,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,6BAA6B,CAAA;AAsBpC,6BAA6B;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oCAAoC,CAAA;AAW3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,oBAAoB;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEjE,qBAAqB;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAc5E,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,6BAA6B,CAAA;AAuBpC,6BAA6B;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oCAAoC,CAAA;AAiB3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,oBAAoB;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEjE,qBAAqB;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/sandbox/credential-mask-files.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Whole-file credential masking (Linux).
+ *
+ * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
+ * file content on the host, registers a sentinel for it in the
+ * {@link SentinelRegistry}, and writes the sentinel to a fake file in a
+ * manager-owned temp directory. The Linux sandbox then `--ro-bind`s the
+ * fake over the real path, so the sandboxed process reads the sentinel.
+ * The proxy substitution from env-var masking already scans every header
+ * for any registered sentinel, so a tool that does
+ * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
+ * the real bytes — no proxy changes required.
+ *
+ * On macOS, SBPL cannot redirect reads, so masked files degrade to
+ * `mode: "deny"` (see macos-sandbox-utils.ts).
+ *
+ * LIMITATION: this is whole-file masking. It works when the file content
+ * *is* the credential (a token file). It does not work for structured
+ * files a tool parses (JSON/YAML/.netrc) — the tool will fail to parse
+ * the sentinel. See {@link CredentialFileConfigSchema}.
+ */
+import type { CredentialFileConfig } from './sandbox-config.js';
+import type { SentinelRegistry } from './credential-sentinel.js';
+/** One masked file's bind mapping for the platform builder. */
+export interface MaskedFileBind {
+    /** Resolved (tilde-expanded, realpath'd) host path of the real file. */
+    realPath: string;
+    /** Path to the fake file containing the sentinel. */
+    fakePath: string;
+}
+/**
+ * Manager-owned temp dir holding the fake files.
+ *
+ * INVARIANT: this directory must never be writable from inside the sandbox.
+ * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
+ * after every other filesystem mount (see generateFilesystemArgs), so the
+ * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
+ * the host's $TMPDIR points under a default-writable path. If the sandbox
+ * could write here it could replace a fake's content (the bind exposes the
+ * source file) or plant a symlink for a later host-side write() to follow.
+ */
+export declare class MaskedFileStore {
+    private dir;
+    private readonly byKey;
+    /**
+     * Write `sentinel` to a fake file for `key` and return its path.
+     * Idempotent on `key`: a repeat call rewrites the same fake (so a
+     * changed sentinel after re-register propagates) instead of leaking a
+     * new file per wrapWithSandbox() call.
+     */
+    write(key: string, sentinel: string): string;
+    /** Remove the temp dir and every fake file in it. Idempotent. */
+    dispose(): void;
+    /** Temp dir path, or undefined if no fake has been written yet. */
+    get dirPath(): string | undefined;
+}
+/**
+ * For each `mode: "mask"` file entry: resolve the path, read the real
+ * content, register `(file:<path>, content, injectHosts)` in `registry`,
+ * write the sentinel to a fake file via `store`, and return the bind list.
+ *
+ * Entries whose path does not exist, is unreadable, or resolves to a
+ * directory are skipped with a debug log — same posture as a masked env
+ * var that's unset on the host: nothing to protect, and surfacing a hard
+ * error would make a portable config brittle across machines.
+ *
+ * The directory check is the authoritative one (the schema only catches a
+ * trailing slash); whole-file masking has no meaning for a directory.
+ */
+export declare function buildMaskedFileBinds(files: readonly CredentialFileConfig[], allowedDomains: readonly string[], registry: SentinelRegistry, store: MaskedFileStore): MaskedFileBind[];
+export declare const MASKED_FILE_STORE_PREFIX = "srt-credmask-";
+//# sourceMappingURL=credential-mask-files.d.ts.map

package/dist/sandbox/credential-mask-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-files.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAShE,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAElD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAoB5C,iEAAiE;IACjE,OAAO,IAAI,IAAI;IAcf,mEAAmE;IACnE,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,eAAe,GACrB,cAAc,EAAE,CA8ClB;AAED,eAAO,MAAM,wBAAwB,kBAAkB,CAAA"}

package/dist/sandbox/credential-mask-files.js

@@ -0,0 +1,146 @@
+/**
+ * Whole-file credential masking (Linux).
+ *
+ * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
+ * file content on the host, registers a sentinel for it in the
+ * {@link SentinelRegistry}, and writes the sentinel to a fake file in a
+ * manager-owned temp directory. The Linux sandbox then `--ro-bind`s the
+ * fake over the real path, so the sandboxed process reads the sentinel.
+ * The proxy substitution from env-var masking already scans every header
+ * for any registered sentinel, so a tool that does
+ * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
+ * the real bytes — no proxy changes required.
+ *
+ * On macOS, SBPL cannot redirect reads, so masked files degrade to
+ * `mode: "deny"` (see macos-sandbox-utils.ts).
+ *
+ * LIMITATION: this is whole-file masking. It works when the file content
+ * *is* the credential (a token file). It does not work for structured
+ * files a tool parses (JSON/YAML/.netrc) — the tool will fail to parse
+ * the sentinel. See {@link CredentialFileConfigSchema}.
+ */
+import * as fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { logForDebugging } from '../utils/debug.js';
+import { normalizePathForSandbox } from './sandbox-utils.js';
+/**
+ * Sentinel-registry key prefix for masked files. Keeps file keys disjoint
+ * from env-var names so a credential file at path `GH_TOKEN` cannot collide
+ * with the env var `GH_TOKEN`.
+ */
+const FILE_KEY_PREFIX = 'file:';
+/**
+ * Manager-owned temp dir holding the fake files.
+ *
+ * INVARIANT: this directory must never be writable from inside the sandbox.
+ * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
+ * after every other filesystem mount (see generateFilesystemArgs), so the
+ * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
+ * the host's $TMPDIR points under a default-writable path. If the sandbox
+ * could write here it could replace a fake's content (the bind exposes the
+ * source file) or plant a symlink for a later host-side write() to follow.
+ */
+export class MaskedFileStore {
+    constructor() {
+        this.byKey = new Map();
+    }
+    /**
+     * Write `sentinel` to a fake file for `key` and return its path.
+     * Idempotent on `key`: a repeat call rewrites the same fake (so a
+     * changed sentinel after re-register propagates) instead of leaking a
+     * new file per wrapWithSandbox() call.
+     */
+    write(key, sentinel) {
+        if (this.dir === undefined) {
+            this.dir = fs.mkdtempSync(join(tmpdir(), 'srt-credmask-'));
+        }
+        let fakePath = this.byKey.get(key);
+        if (fakePath === undefined) {
+            fakePath = join(this.dir, `${this.byKey.size}.fake`);
+            this.byKey.set(key, fakePath);
+        }
+        // Never follow a symlink at fakePath: a prior sandbox invocation may
+        // have planted one (the store dir is ro-bound now, but defence in
+        // depth). Unlink first so writeFileSync creates a fresh regular file.
+        fs.rmSync(fakePath, { force: true });
+        // 0600: owner rw so the idempotent rewrite above succeeds; the bind
+        // into the sandbox is --ro-bind so the sandboxed process sees it
+        // read-only regardless of the host mode. No group/other.
+        fs.writeFileSync(fakePath, sentinel, { mode: 0o600 });
+        return fakePath;
+    }
+    /** Remove the temp dir and every fake file in it. Idempotent. */
+    dispose() {
+        if (this.dir !== undefined) {
+            try {
+                fs.rmSync(this.dir, { recursive: true, force: true });
+            }
+            catch (err) {
+                logForDebugging(`MaskedFileStore cleanup failed: ${err}`, {
+                    level: 'error',
+                });
+            }
+        }
+        this.dir = undefined;
+        this.byKey.clear();
+    }
+    /** Temp dir path, or undefined if no fake has been written yet. */
+    get dirPath() {
+        return this.dir;
+    }
+}
+/**
+ * For each `mode: "mask"` file entry: resolve the path, read the real
+ * content, register `(file:<path>, content, injectHosts)` in `registry`,
+ * write the sentinel to a fake file via `store`, and return the bind list.
+ *
+ * Entries whose path does not exist, is unreadable, or resolves to a
+ * directory are skipped with a debug log — same posture as a masked env
+ * var that's unset on the host: nothing to protect, and surfacing a hard
+ * error would make a portable config brittle across machines.
+ *
+ * The directory check is the authoritative one (the schema only catches a
+ * trailing slash); whole-file masking has no meaning for a directory.
+ */
+export function buildMaskedFileBinds(files, allowedDomains, registry, store) {
+    const binds = [];
+    for (const f of files) {
+        if (f.mode !== 'mask')
+            continue;
+        const realPath = normalizePathForSandbox(f.path);
+        let content;
+        try {
+            const stat = fs.statSync(realPath);
+            if (stat.isDirectory()) {
+                logForDebugging(`[credential-mask] Skipping masked file entry that resolves to ` +
+                    `a directory: ${f.path} — use mode "deny" for directories.`, { level: 'warn' });
+                continue;
+            }
+            // Read as bytes first: a utf8 read silently maps invalid sequences
+            // to U+FFFD, so the sentinel would round-trip to corrupted bytes at
+            // the proxy. Whole-file masking is for token files; reject binary.
+            const raw = fs.readFileSync(realPath);
+            content = raw.toString('utf8');
+            if (Buffer.byteLength(content, 'utf8') !== raw.length) {
+                logForDebugging(`[credential-mask] Skipping masked file with non-UTF-8 content ` +
+                    `(binary credential files are not supported in whole-file ` +
+                    `mask mode): ${f.path}`, { level: 'warn' });
+                continue;
+            }
+        }
+        catch (err) {
+            logForDebugging(`[credential-mask] Skipping masked file (unreadable on host): ` +
+                `${f.path} — ${err.message}`);
+            continue;
+        }
+        const injectHosts = f.injectHosts ?? allowedDomains;
+        const key = FILE_KEY_PREFIX + realPath;
+        const sentinel = registry.register(key, content, injectHosts);
+        const fakePath = store.write(key, sentinel);
+        binds.push({ realPath, fakePath });
+    }
+    return binds;
+}
+export const MASKED_FILE_STORE_PREFIX = 'srt-credmask-';
+//# sourceMappingURL=credential-mask-files.js.map

package/dist/sandbox/credential-mask-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-files.js","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAI5D;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAA;AAU/B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAA5B;QAEmB,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IA+CpD,CAAC;IA7CC;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,QAAgB;QACjC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,mCAAmC,GAAG,EAAE,EAAE;oBACxD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsC,EACtC,cAAiC,EACjC,QAA0B,EAC1B,KAAsB;IAEtB,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAEhD,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,eAAe,CACb,gEAAgE;oBAC9D,gBAAgB,CAAC,CAAC,IAAI,qCAAqC,EAC7D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtD,eAAe,CACb,gEAAgE;oBAC9D,2DAA2D;oBAC3D,eAAe,CAAC,CAAC,IAAI,EAAE,EACzB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CACb,+DAA+D;gBAC7D,GAAG,CAAC,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC1C,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAA;QACnD,MAAM,GAAG,GAAG,eAAe,GAAG,QAAQ,CAAA;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAA"}

package/dist/sandbox/credential-sentinel.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+export declare const SENTINEL_PREFIX = "fake_value_";
+/** Predicate matching a destination host against one injectHosts pattern. */
+export type HostMatcher = (host: string, pattern: string) => boolean;
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export declare class SentinelRegistry {
+    private readonly byName;
+    private readonly bySentinel;
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     */
+    register(name: string, realValue: string, injectHosts: readonly string[]): string;
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel: string): string | undefined;
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost: string, matches: HostMatcher): string[];
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    entries(): IterableIterator<[string, string]>;
+    /** Number of registered sentinels. */
+    get size(): number;
+    /** Drop every mapping. Called on session teardown. */
+    clear(): void;
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers: IncomingHttpHeaders, destHost: string, matches: HostMatcher): void;
+    private substituteInString;
+}
+//# sourceMappingURL=credential-sentinel.d.ts.map

package/dist/sandbox/credential-sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;AASpE;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAE9D;;;;;;;;;;OAUG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAcT,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE;IAQnE,wDAAwD;IACvD,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI9C,sCAAsC;IACtC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,sDAAsD;IACtD,KAAK,IAAI,IAAI;IAKb;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,IAAI;IAcP,OAAO,CAAC,kBAAkB;CAgB3B"}

package/dist/sandbox/credential-sentinel.js

@@ -0,0 +1,130 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import { randomUUID } from 'node:crypto';
+export const SENTINEL_PREFIX = 'fake_value_';
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export class SentinelRegistry {
+    constructor() {
+        this.byName = new Map();
+        this.bySentinel = new Map();
+    }
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     */
+    register(name, realValue, injectHosts) {
+        const existing = this.byName.get(name);
+        if (existing !== undefined) {
+            existing.realValue = realValue;
+            existing.injectHosts = injectHosts;
+            return existing.sentinel;
+        }
+        const sentinel = SENTINEL_PREFIX + randomUUID();
+        const entry = { name, sentinel, realValue, injectHosts };
+        this.byName.set(name, entry);
+        this.bySentinel.set(sentinel, entry);
+        return sentinel;
+    }
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel) {
+        return this.bySentinel.get(sentinel)?.realValue;
+    }
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost, matches) {
+        const names = [];
+        for (const e of this.byName.values()) {
+            if (e.injectHosts.some(p => matches(destHost, p)))
+                names.push(e.name);
+        }
+        return names;
+    }
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    *entries() {
+        for (const e of this.bySentinel.values())
+            yield [e.sentinel, e.realValue];
+    }
+    /** Number of registered sentinels. */
+    get size() {
+        return this.bySentinel.size;
+    }
+    /** Drop every mapping. Called on session teardown. */
+    clear() {
+        this.byName.clear();
+        this.bySentinel.clear();
+    }
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers, destHost, matches) {
+        if (this.bySentinel.size === 0)
+            return;
+        for (const [name, value] of Object.entries(headers)) {
+            if (value === undefined)
+                continue;
+            if (Array.isArray(value)) {
+                for (let i = 0; i < value.length; i++) {
+                    value[i] = this.substituteInString(value[i], destHost, matches);
+                }
+            }
+            else {
+                headers[name] = this.substituteInString(value, destHost, matches);
+            }
+        }
+    }
+    substituteInString(s, destHost, matches) {
+        // Fast path: the sentinel prefix is fixed, so a header value that
+        // doesn't contain it cannot contain any sentinel.
+        if (!s.includes(SENTINEL_PREFIX))
+            return s;
+        let out = s;
+        for (const e of this.bySentinel.values()) {
+            if (!out.includes(e.sentinel))
+                continue;
+            if (!e.injectHosts.some(p => matches(destHost, p)))
+                continue;
+            out = out.split(e.sentinel).join(e.realValue);
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=credential-sentinel.js.map

package/dist/sandbox/credential-sentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.js","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAY5C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACmB,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAA;QACzC,eAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAiHhE,CAAC;IA/GC;;;;;;;;;;OAUG;IACH,QAAQ,CACN,IAAY,EACZ,SAAiB,EACjB,WAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;YAC9B,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAA;YAClC,OAAO,QAAQ,CAAC,QAAQ,CAAA;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,GAAG,UAAU,EAAE,CAAA;QAC/C,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,QAAgB,EAAE,OAAoB;QACtD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wDAAwD;IACxD,CAAC,OAAO;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;IAC3E,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAED,sDAAsD;IACtD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAA4B,EAC5B,QAAgB,EAChB,OAAoB;QAEpB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,CAAS,EACT,QAAgB,EAChB,OAAoB;QAEpB,kEAAkE;QAClE,kDAAkD;QAClD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAO,CAAC,CAAA;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YACvC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAQ;YAC5D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/sandbox/domain-pattern.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ */
+export declare function isInjectHostCoveredByAllowedDomains(injectHost: string, allowedDomains: readonly string[]): boolean;
+//# sourceMappingURL=domain-pattern.d.ts.map

package/dist/sandbox/domain-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.d.ts","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAUT"}