@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/credential-mask-files.js

@@ -0,0 +1,298 @@
+/**
+ * Credential file masking (Linux).
+ *
+ * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
+ * file content on the host, registers one or more sentinels in the
+ * {@link SentinelRegistry}, and writes a fake file (sentinel-substituted)
+ * to a manager-owned temp directory. The Linux sandbox then `--ro-bind`s
+ * the fake over the real path, so the sandboxed process reads the
+ * sentinel(s). The proxy substitution from env-var masking already scans
+ * every header for any registered sentinel, so a tool that does
+ * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
+ * the real bytes — no proxy changes required.
+ *
+ * Without `extract`, masking is **whole-file**: one sentinel replaces the
+ * entire content. With `extract`, masking is **structured**: a regex picks
+ * out the credential value(s) and only those spans are replaced, so a tool
+ * that parses the file (JSON/YAML/.netrc) still sees valid syntax. See
+ * {@link extractAndSubstitute} and {@link CredentialFileConfigSchema}.
+ *
+ * On macOS, SBPL cannot redirect reads, so masked files degrade to
+ * `mode: "deny"` (see macos-sandbox-utils.ts).
+ */
+import * as fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { logForDebugging } from '../utils/debug.js';
+import { normalizePathForSandbox } from './sandbox-utils.js';
+/**
+ * Sentinel-registry key prefix for masked files. Keeps file keys disjoint
+ * from env-var names so a credential file at path `GH_TOKEN` cannot collide
+ * with the env var `GH_TOKEN`.
+ */
+const FILE_KEY_PREFIX = 'file:';
+/**
+ * Apply `pattern` globally to `content` and return `content` with each
+ * matched capture-group-1 span replaced by `sentinelFor(capture, i)`,
+ * where `i` is the zero-based index of the distinct captured value in
+ * first-seen order.
+ *
+ * Offset-based: the regex `d` flag exposes capture-group offsets, so the
+ * output is built by slicing between spans and splicing the sentinel in
+ * at the exact `[start, end)` of group 1. By default only the
+ * regex-matched span is replaced — a captured value that coincidentally
+ * appears elsewhere in the file (outside any match) is left intact. No
+ * placeholder pass, no substring-ordering concern.
+ *
+ * With `maskDuplicates` (see {@link ExtractOptions}), an indexOf scan
+ * additionally collects every verbatim occurrence of each captured value
+ * elsewhere in the file. All spans are computed against the ORIGINAL
+ * content — never the partially substituted output — so an inserted
+ * sentinel can never be re-matched and corrupted, even when a captured
+ * value is a substring of the sentinel literal. Regex-match spans win
+ * over verbatim ones, and verbatim scans run longest-capture-first so a
+ * shorter capture that is a substring of a longer one cannot claim part
+ * of the longer secret's occurrence.
+ *
+ * Returns `null` when the pattern matches nothing — the caller routes
+ * that per the entry's `onExtractNoMatch` option (warn / deny / error;
+ * see {@link buildMaskedFileBinds}).
+ *
+ * Throws when a match has no group-1 capture. The schema already rejects
+ * patterns with zero groups, so this only fires when group 1 is optional
+ * and absent for some match (e.g. `"token: (\\S+)?"`); accepting that
+ * would silently mask nothing for that occurrence.
+ *
+ * Pure on `content`/`pattern`; the callback may close over a registry.
+ */
+export function extractAndSubstitute(content, pattern, sentinelFor, options = {}) {
+    // The schema validates `pattern` compiles; `g` makes matchAll iterate
+    // every occurrence and `d` populates `m.indices` with group offsets.
+    const re = new RegExp(pattern, 'gd');
+    const indexByCapture = new Map();
+    // First sentinel returned per capture — reused for verbatim spans so
+    // the duplicate pass never re-invokes the callback.
+    const sentinelByCapture = new Map();
+    const spans = [];
+    for (const m of content.matchAll(re)) {
+        const cap = m[1];
+        if (cap === undefined) {
+            throw new Error(`extract pattern /${pattern}/ matched at offset ${m.index} but ` +
+                `capture group 1 is undefined — group 1 must capture the ` +
+                `credential value on every match.`);
+        }
+        // Empty captures are skipped: a zero-width span has nothing to mask.
+        if (cap.length === 0)
+            continue;
+        let i = indexByCapture.get(cap);
+        if (i === undefined)
+            indexByCapture.set(cap, (i = indexByCapture.size));
+        const [start, end] = m.indices[1];
+        const sentinel = sentinelFor(cap, i);
+        if (!sentinelByCapture.has(cap))
+            sentinelByCapture.set(cap, sentinel);
+        spans.push({ start, end, sentinel });
+    }
+    if (indexByCapture.size === 0)
+        return null;
+    if (options.maskDuplicates) {
+        // Longest capture first: a shorter capture that is a substring of a
+        // longer one would otherwise claim part of the longer secret's
+        // occurrence and leave the remainder exposed.
+        const byLength = [...indexByCapture.keys()].sort((a, b) => b.length - a.length);
+        for (const cap of byLength) {
+            const sentinel = sentinelByCapture.get(cap);
+            for (let start = content.indexOf(cap); start !== -1; start = content.indexOf(cap, start + 1)) {
+                const end = start + cap.length;
+                // Spans already collected (regex matches, then earlier — longer —
+                // captures' verbatim occurrences) win over this occurrence.
+                if (spans.some(s => start < s.end && s.start < end))
+                    continue;
+                spans.push({ start, end, sentinel });
+            }
+        }
+        spans.sort((a, b) => a.start - b.start);
+    }
+    // Spans are non-overlapping and sorted by offset (matchAll yields
+    // matches in order; the verbatim pass re-sorts), so a single
+    // slice-and-concat pass over the original content is sound.
+    let out = '';
+    let pos = 0;
+    for (const s of spans) {
+        out += content.slice(pos, s.start) + s.sentinel;
+        pos = s.end;
+    }
+    return {
+        fakeContent: out + content.slice(pos),
+        captures: [...indexByCapture.keys()],
+    };
+}
+/**
+ * Manager-owned temp dir holding the fake files.
+ *
+ * INVARIANT: this directory must never be writable from inside the sandbox.
+ * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
+ * after every other filesystem mount (see generateFilesystemArgs), so the
+ * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
+ * the host's $TMPDIR points under a default-writable path. If the sandbox
+ * could write here it could replace a fake's content (the bind exposes the
+ * source file) or plant a symlink for a later host-side write() to follow.
+ */
+export class MaskedFileStore {
+    constructor() {
+        this.byKey = new Map();
+    }
+    /**
+     * Write `sentinel` to a fake file for `key` and return its path.
+     * Idempotent on `key`: a repeat call rewrites the same fake (so a
+     * changed sentinel after re-register propagates) instead of leaking a
+     * new file per wrapWithSandbox() call.
+     */
+    write(key, sentinel) {
+        if (this.dir === undefined) {
+            this.dir = fs.mkdtempSync(join(tmpdir(), 'srt-credmask-'));
+        }
+        let fakePath = this.byKey.get(key);
+        if (fakePath === undefined) {
+            fakePath = join(this.dir, `${this.byKey.size}.fake`);
+            this.byKey.set(key, fakePath);
+        }
+        // Never follow a symlink at fakePath: a prior sandbox invocation may
+        // have planted one (the store dir is ro-bound now, but defence in
+        // depth). Unlink first so writeFileSync creates a fresh regular file.
+        fs.rmSync(fakePath, { force: true });
+        // 0600: owner rw so the idempotent rewrite above succeeds; the bind
+        // into the sandbox is --ro-bind so the sandboxed process sees it
+        // read-only regardless of the host mode. No group/other.
+        fs.writeFileSync(fakePath, sentinel, { mode: 0o600 });
+        return fakePath;
+    }
+    /** Remove the temp dir and every fake file in it. Idempotent. */
+    dispose() {
+        if (this.dir !== undefined) {
+            try {
+                fs.rmSync(this.dir, { recursive: true, force: true });
+            }
+            catch (err) {
+                logForDebugging(`MaskedFileStore cleanup failed: ${err}`, {
+                    level: 'error',
+                });
+            }
+        }
+        this.dir = undefined;
+        this.byKey.clear();
+    }
+    /** Temp dir path, or undefined if no fake has been written yet. */
+    get dirPath() {
+        return this.dir;
+    }
+}
+/**
+ * For each `mode: "mask"` file entry: resolve the path, read the real
+ * content, build the fake content (whole-file or structured per `extract`),
+ * register sentinels in `registry`, write the fake via `store`, and return
+ * the bind list plus any entries that degraded to deny.
+ *
+ * Whole-file mode (no `extract`): one sentinel keyed `file:<path>` whose
+ * real value is the entire file content; the fake file *is* the sentinel.
+ *
+ * Structured mode (`extract` set): one sentinel per distinct captured
+ * value, keyed `file:<path>#<i>`; the fake file is the real content with
+ * each captured span replaced by its sentinel. If the regex matches
+ * nothing, the entry's `onExtractNoMatch` decides:
+ * - `"warn"` (default): skip the entry with a loud stderr warning —
+ *   fail-open, the file stays readable via the root mount;
+ * - `"deny"`: push the path to `degradeToDenyPaths` — fail-closed, the
+ *   file becomes unreadable inside the sandbox;
+ * - `"error"`: throw, so nothing runs until the regex is fixed.
+ * With `maskDuplicates`, verbatim occurrences of each captured value
+ * outside the matched spans are also replaced (see {@link ExtractOptions}).
+ *
+ * Entries whose path does not exist, is unreadable, or resolves to a
+ * directory are skipped with a debug log — same posture as a masked env
+ * var that's unset on the host: nothing to protect, and surfacing a hard
+ * error would make a portable config brittle across machines.
+ *
+ * The directory check is the authoritative one (the schema only catches a
+ * trailing slash); whole-file masking has no meaning for a directory.
+ */
+export function buildMaskedFileBinds(files, allowedDomains, registry, store) {
+    const binds = [];
+    const degradeToDenyPaths = [];
+    for (const f of files) {
+        if (f.mode !== 'mask')
+            continue;
+        const realPath = normalizePathForSandbox(f.path);
+        let content;
+        try {
+            const stat = fs.statSync(realPath);
+            if (stat.isDirectory()) {
+                logForDebugging(`[credential-mask] Skipping masked file entry that resolves to ` +
+                    `a directory: ${f.path} — use mode "deny" for directories.`, { level: 'warn' });
+                continue;
+            }
+            // Read as bytes first: a utf8 read silently maps invalid sequences
+            // to U+FFFD, so the sentinel would round-trip to corrupted bytes at
+            // the proxy. Masking (whole-file or extract) is for text credential
+            // files; reject binary.
+            const raw = fs.readFileSync(realPath);
+            content = raw.toString('utf8');
+            if (Buffer.byteLength(content, 'utf8') !== raw.length) {
+                logForDebugging(`[credential-mask] Skipping masked file with non-UTF-8 content ` +
+                    `(binary credential files are not supported in mask mode): ` +
+                    `${f.path}`, { level: 'warn' });
+                continue;
+            }
+        }
+        catch (err) {
+            logForDebugging(`[credential-mask] Skipping masked file (unreadable on host): ` +
+                `${f.path} — ${err.message}`);
+            continue;
+        }
+        const injectHosts = f.injectHosts ?? allowedDomains;
+        const key = FILE_KEY_PREFIX + realPath;
+        let fakeContent;
+        if (f.extract === undefined) {
+            // Whole-file: one sentinel for the entire content.
+            fakeContent = registry.register(key, content, injectHosts);
+        }
+        else {
+            const extracted = extractAndSubstitute(content, f.extract, (cap, i) => registry.register(`${key}#${i}`, cap, injectHosts), { maskDuplicates: f.maskDuplicates ?? false });
+            if (extracted === null) {
+                const onNoMatch = f.onExtractNoMatch ?? 'warn';
+                if (onNoMatch === 'error') {
+                    throw new Error(`credentials.files entry "${f.path}": extract pattern ` +
+                        `"${f.extract}" matched nothing (onExtractNoMatch: "error"). ` +
+                        `Fix the regex, change to "warn"/"deny", or remove the entry.`);
+                }
+                if (onNoMatch === 'deny') {
+                    // Fail-closed: the operator declared this file as containing a
+                    // credential. Masking can't apply — degrade to deny so the
+                    // sandboxed process cannot read the credential at all.
+                    logForDebugging(`[credential-mask] extract pattern /${f.extract}/ matched ` +
+                        `nothing in ${f.path} — degrading to mode "deny".`, { level: 'warn' });
+                    degradeToDenyPaths.push(realPath);
+                    continue;
+                }
+                // 'warn' (default): fail-open. A non-matching pattern is a config
+                // error to surface, not a reason to block file access. Skip the
+                // entry (no bind, no deny) — the file stays readable via the root
+                // mount — and warn loudly on stderr so the operator fixes the regex.
+                const msg = `[sandbox-runtime] WARNING: credentials.files entry ` +
+                    `"${f.path}" has extract pattern "${f.extract}" that matched ` +
+                    `nothing in the file. The file is left UNPROTECTED (readable ` +
+                    `as-is inside the sandbox). Fix the regex, set onExtractNoMatch ` +
+                    `to "deny" or "error", or remove the entry.`;
+                console.warn(msg);
+                logForDebugging(msg, { level: 'warn' });
+                continue;
+            }
+            fakeContent = extracted.fakeContent;
+        }
+        const fakePath = store.write(key, fakeContent);
+        binds.push({ realPath, fakePath });
+    }
+    return { binds, degradeToDenyPaths };
+}
+export const MASKED_FILE_STORE_PREFIX = 'srt-credmask-';
+//# sourceMappingURL=credential-mask-files.js.map

package/dist/sandbox/credential-mask-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-files.js","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAI5D;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAA;AAyC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAe,EACf,WAAuD,EACvD,UAA0B,EAAE;IAE5B,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAA;IAChD,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnD,MAAM,KAAK,GAAsB,EAAE,CAAA;IACnC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAuC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,uBAAuB,CAAC,CAAC,KAAK,OAAO;gBAC9D,0DAA0D;gBAC1D,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACrE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,oEAAoE;QACpE,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAC9B,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;YAC5C,KACE,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAChC,KAAK,KAAK,CAAC,CAAC,EACZ,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EACvC,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAA;gBAC9B,kEAAkE;gBAClE,4DAA4D;gBAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;oBAAE,SAAQ;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IACzC,CAAC;IAED,kEAAkE;IAClE,6DAA6D;IAC7D,4DAA4D;IAC5D,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC/C,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;IACb,CAAC;IACD,OAAO;QACL,WAAW,EAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;KACrC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAA5B;QAEmB,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IA+CpD,CAAC;IA7CC;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,QAAgB;QACjC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,mCAAmC,GAAG,EAAE,EAAE;oBACxD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;CACF;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsC,EACtC,cAAiC,EACjC,QAA0B,EAC1B,KAAsB;IAEtB,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAEhD,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,eAAe,CACb,gEAAgE;oBAC9D,gBAAgB,CAAC,CAAC,IAAI,qCAAqC,EAC7D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,wBAAwB;YACxB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtD,eAAe,CACb,gEAAgE;oBAC9D,4DAA4D;oBAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EACb,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CACb,+DAA+D;gBAC7D,GAAG,CAAC,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC1C,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAA;QACnD,MAAM,GAAG,GAAG,eAAe,GAAG,QAAQ,CAAA;QAEtC,IAAI,WAAmB,CAAA;QACvB,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5B,mDAAmD;YACnD,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,oBAAoB,CACpC,OAAO,EACP,CAAC,CAAC,OAAO,EACT,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,EAC9D,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK,EAAE,CAC9C,CAAA;YACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAA;gBAC9C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,IAAI,qBAAqB;wBACrD,IAAI,CAAC,CAAC,OAAO,iDAAiD;wBAC9D,8DAA8D,CACjE,CAAA;gBACH,CAAC;gBACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,+DAA+D;oBAC/D,2DAA2D;oBAC3D,uDAAuD;oBACvD,eAAe,CACb,sCAAsC,CAAC,CAAC,OAAO,YAAY;wBACzD,cAAc,CAAC,CAAC,IAAI,8BAA8B,EACpD,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;oBACD,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBACjC,SAAQ;gBACV,CAAC;gBACD,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,qEAAqE;gBACrE,MAAM,GAAG,GACP,qDAAqD;oBACrD,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,OAAO,iBAAiB;oBAC9D,8DAA8D;oBAC9D,iEAAiE;oBACjE,4CAA4C,CAAA;gBAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBACvC,SAAQ;YACV,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,WAAW,CAAA;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAA"}

package/dist/sandbox/credential-sentinel.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+export declare const SENTINEL_PREFIX = "fake_value_";
+/** Predicate matching a destination host against one injectHosts pattern. */
+export type HostMatcher = (host: string, pattern: string) => boolean;
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export declare class SentinelRegistry {
+    private readonly byName;
+    private readonly bySentinel;
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     */
+    register(name: string, realValue: string, injectHosts: readonly string[]): string;
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel: string): string | undefined;
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost: string, matches: HostMatcher): string[];
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    entries(): IterableIterator<[string, string]>;
+    /** Number of registered sentinels. */
+    get size(): number;
+    /** Drop every mapping. Called on session teardown. */
+    clear(): void;
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers: IncomingHttpHeaders, destHost: string, matches: HostMatcher): void;
+    private substituteInString;
+}
+//# sourceMappingURL=credential-sentinel.d.ts.map

package/dist/sandbox/credential-sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;AASpE;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAE9D;;;;;;;;;;OAUG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAcT,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE;IAQnE,wDAAwD;IACvD,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI9C,sCAAsC;IACtC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,sDAAsD;IACtD,KAAK,IAAI,IAAI;IAKb;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,IAAI;IAcP,OAAO,CAAC,kBAAkB;CAgB3B"}

package/dist/sandbox/credential-sentinel.js

@@ -0,0 +1,130 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import { randomUUID } from 'node:crypto';
+export const SENTINEL_PREFIX = 'fake_value_';
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export class SentinelRegistry {
+    constructor() {
+        this.byName = new Map();
+        this.bySentinel = new Map();
+    }
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     */
+    register(name, realValue, injectHosts) {
+        const existing = this.byName.get(name);
+        if (existing !== undefined) {
+            existing.realValue = realValue;
+            existing.injectHosts = injectHosts;
+            return existing.sentinel;
+        }
+        const sentinel = SENTINEL_PREFIX + randomUUID();
+        const entry = { name, sentinel, realValue, injectHosts };
+        this.byName.set(name, entry);
+        this.bySentinel.set(sentinel, entry);
+        return sentinel;
+    }
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel) {
+        return this.bySentinel.get(sentinel)?.realValue;
+    }
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost, matches) {
+        const names = [];
+        for (const e of this.byName.values()) {
+            if (e.injectHosts.some(p => matches(destHost, p)))
+                names.push(e.name);
+        }
+        return names;
+    }
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    *entries() {
+        for (const e of this.bySentinel.values())
+            yield [e.sentinel, e.realValue];
+    }
+    /** Number of registered sentinels. */
+    get size() {
+        return this.bySentinel.size;
+    }
+    /** Drop every mapping. Called on session teardown. */
+    clear() {
+        this.byName.clear();
+        this.bySentinel.clear();
+    }
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers, destHost, matches) {
+        if (this.bySentinel.size === 0)
+            return;
+        for (const [name, value] of Object.entries(headers)) {
+            if (value === undefined)
+                continue;
+            if (Array.isArray(value)) {
+                for (let i = 0; i < value.length; i++) {
+                    value[i] = this.substituteInString(value[i], destHost, matches);
+                }
+            }
+            else {
+                headers[name] = this.substituteInString(value, destHost, matches);
+            }
+        }
+    }
+    substituteInString(s, destHost, matches) {
+        // Fast path: the sentinel prefix is fixed, so a header value that
+        // doesn't contain it cannot contain any sentinel.
+        if (!s.includes(SENTINEL_PREFIX))
+            return s;
+        let out = s;
+        for (const e of this.bySentinel.values()) {
+            if (!out.includes(e.sentinel))
+                continue;
+            if (!e.injectHosts.some(p => matches(destHost, p)))
+                continue;
+            out = out.split(e.sentinel).join(e.realValue);
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=credential-sentinel.js.map

package/dist/sandbox/credential-sentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.js","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAY5C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACmB,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAA;QACzC,eAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAiHhE,CAAC;IA/GC;;;;;;;;;;OAUG;IACH,QAAQ,CACN,IAAY,EACZ,SAAiB,EACjB,WAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;YAC9B,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAA;YAClC,OAAO,QAAQ,CAAC,QAAQ,CAAA;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,GAAG,UAAU,EAAE,CAAA;QAC/C,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,QAAgB,EAAE,OAAoB;QACtD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wDAAwD;IACxD,CAAC,OAAO;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;IAC3E,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAED,sDAAsD;IACtD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAA4B,EAC5B,QAAgB,EAChB,OAAoB;QAEpB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,CAAS,EACT,QAAgB,EAChB,OAAoB;QAEpB,kEAAkE;QAClE,kDAAkD;QAClD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAO,CAAC,CAAA;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YACvC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAQ;YAC5D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/sandbox/domain-pattern.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ */
+export declare function isInjectHostCoveredByAllowedDomains(injectHost: string, allowedDomains: readonly string[]): boolean;
+//# sourceMappingURL=domain-pattern.d.ts.map

package/dist/sandbox/domain-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.d.ts","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAUT"}

package/dist/sandbox/domain-pattern.js

@@ -0,0 +1,60 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+import { isIP } from 'node:net';
+import { stripBrackets } from './parent-proxy.js';
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export function matchesDomainPattern(hostname, pattern) {
+    const h = hostname.toLowerCase();
+    if (pattern === '*')
+        return true;
+    if (pattern.startsWith('*.')) {
+        if (isIP(stripBrackets(h)))
+            return false;
+        const baseDomain = pattern.substring(2).toLowerCase();
+        return h.endsWith('.' + baseDomain);
+    }
+    return h === pattern.toLowerCase();
+}
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ */
+export function isInjectHostCoveredByAllowedDomains(injectHost, allowedDomains) {
+    if (!injectHost.startsWith('*.')) {
+        return allowedDomains.some(p => matchesDomainPattern(injectHost, p));
+    }
+    const injectBase = injectHost.slice(2).toLowerCase();
+    return allowedDomains.some(p => {
+        if (!p.startsWith('*.'))
+            return false;
+        const allowedBase = p.slice(2).toLowerCase();
+        return injectBase === allowedBase || injectBase.endsWith('.' + allowedBase);
+    });
+}
+//# sourceMappingURL=domain-pattern.js.map

package/dist/sandbox/domain-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.js","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAe;IAEf,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAkB,EAClB,cAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACpD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC7B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC"}