@sysid/sandbox-runtime-improved 0.0.61-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/sandbox-config.d.ts

@@ -50,29 +50,71 @@ declare const credentialModeSchema: z.ZodEnum<["deny", "mask"]>;
 /**
  * Schema for a single credential file/directory entry.
  *
- * `mode: "mask"` is **whole-file** masking: the entire file content is
- * replaced inside the sandbox with one sentinel string, and the proxy
- * substitutes that sentinel back to the real bytes on egress. This works
- * for files whose content *is* the credential (a token file, a single-line
- * secret). It does **not** work for structured files a tool parses
- * (`.netrc`, JSON/YAML configs) — the tool will fail to parse the sentinel.
- * For those, prefer env-var masking where the tool supports it, or
- * `mode: "deny"`. Format-aware extraction is a possible future extension.
+ * `mode: "mask"` without `extract` is **whole-file** masking: the entire
+ * file content is replaced inside the sandbox with one sentinel string,
+ * and the proxy substitutes that sentinel back to the real bytes on egress.
+ * This works for files whose content *is* the credential (a token file, a
+ * single-line secret).
  *
- * On macOS, SBPL cannot redirect reads, so `mode: "mask"` currently
- * degrades to `mode: "deny"` (the file is unreadable inside the sandbox).
+ * `mode: "mask"` with `extract` is **structured** masking: the regex is
+ * applied globally to the real file, capture group 1 of each match is a
+ * credential value, and only those captured spans are replaced with
+ * sentinels — the rest of the file is preserved byte-for-byte. This lets a
+ * tool that parses the file (`.netrc`, JSON/YAML configs) still succeed
+ * inside the sandbox while the credential values are protected. If the
+ * pattern matches nothing, behaviour is governed by `onExtractNoMatch`
+ * (default `"warn"` — the file is left readable as-is and a stderr
+ * warning is emitted).
+ *
+ * `maskDuplicates: true` (only meaningful with `extract`) additionally
+ * replaces every verbatim occurrence of each captured value *outside* the
+ * regex-matched spans — for a secret repeated where the regex does not
+ * reach (e.g. pasted into a comment). The scan is raw substring matching,
+ * so a short or common captured value may also hit unrelated content that
+ * happens to contain it; intended for long, high-entropy secrets.
+ *
+ * On macOS, SBPL cannot redirect reads, so `mode: "mask"` (with or without
+ * `extract`) currently degrades to `mode: "deny"` (the file is unreadable
+ * inside the sandbox).
  */
 export declare const CredentialFileConfigSchema: z.ZodObject<{
     path: z.ZodString;
     mode: z.ZodEnum<["deny", "mask"]>;
+    extract: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /**
+     * What to do when `extract` matches nothing in the file at runtime.
+     *
+     * - `"warn"` (default): emit a stderr warning and leave the file
+     *   readable as-is inside the sandbox (fail-open). A non-matching
+     *   pattern is treated as a config error to surface and fix, not a
+     *   reason to break a tool that needs the file when the credential is
+     *   legitimately absent.
+     * - `"deny"`: degrade the entry to `mode: "deny"` so the file is
+     *   unreadable inside the sandbox (fail-closed). The operator declared
+     *   this file as containing a credential; if the regex cannot find it,
+     *   block access rather than expose it.
+     * - `"error"`: throw at wrap time so nothing runs until the operator
+     *   fixes the regex.
+     *
+     * Only meaningful when `mode` is `"mask"` and `extract` is set;
+     * accepted but ignored otherwise.
+     */
+    onExtractNoMatch: z.ZodOptional<z.ZodEnum<["warn", "deny", "error"]>>;
+    maskDuplicates: z.ZodOptional<z.ZodBoolean>;
     injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
 }, "strip", z.ZodTypeAny, {
     mode: "deny" | "mask";
     path: string;
+    extract?: string | undefined;
+    onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+    maskDuplicates?: boolean | undefined;
     injectHosts?: string[] | undefined;
 }, {
     mode: "deny" | "mask";
     path: string;
+    extract?: string | undefined;
+    onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+    maskDuplicates?: boolean | undefined;
     injectHosts?: string[] | undefined;
 }>;
 /**
@@ -108,14 +150,41 @@ export declare const CredentialsConfigSchema: z.ZodObject<{
     files: z.ZodOptional<z.ZodArray<z.ZodObject<{
         path: z.ZodString;
         mode: z.ZodEnum<["deny", "mask"]>;
+        extract: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        /**
+         * What to do when `extract` matches nothing in the file at runtime.
+         *
+         * - `"warn"` (default): emit a stderr warning and leave the file
+         *   readable as-is inside the sandbox (fail-open). A non-matching
+         *   pattern is treated as a config error to surface and fix, not a
+         *   reason to break a tool that needs the file when the credential is
+         *   legitimately absent.
+         * - `"deny"`: degrade the entry to `mode: "deny"` so the file is
+         *   unreadable inside the sandbox (fail-closed). The operator declared
+         *   this file as containing a credential; if the regex cannot find it,
+         *   block access rather than expose it.
+         * - `"error"`: throw at wrap time so nothing runs until the operator
+         *   fixes the regex.
+         *
+         * Only meaningful when `mode` is `"mask"` and `extract` is set;
+         * accepted but ignored otherwise.
+         */
+        onExtractNoMatch: z.ZodOptional<z.ZodEnum<["warn", "deny", "error"]>>;
+        maskDuplicates: z.ZodOptional<z.ZodBoolean>;
         injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     }, "strip", z.ZodTypeAny, {
         mode: "deny" | "mask";
         path: string;
+        extract?: string | undefined;
+        onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+        maskDuplicates?: boolean | undefined;
         injectHosts?: string[] | undefined;
     }, {
         mode: "deny" | "mask";
         path: string;
+        extract?: string | undefined;
+        onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+        maskDuplicates?: boolean | undefined;
         injectHosts?: string[] | undefined;
     }>, "many">>;
     envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -136,6 +205,9 @@ export declare const CredentialsConfigSchema: z.ZodObject<{
     files?: {
         mode: "deny" | "mask";
         path: string;
+        extract?: string | undefined;
+        onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+        maskDuplicates?: boolean | undefined;
         injectHosts?: string[] | undefined;
     }[] | undefined;
     envVars?: {
@@ -148,6 +220,9 @@ export declare const CredentialsConfigSchema: z.ZodObject<{
     files?: {
         mode: "deny" | "mask";
         path: string;
+        extract?: string | undefined;
+        onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+        maskDuplicates?: boolean | undefined;
         injectHosts?: string[] | undefined;
     }[] | undefined;
     envVars?: {
@@ -185,22 +260,27 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         caCertPath: z.ZodOptional<z.ZodString>;
         caKeyPath: z.ZodOptional<z.ZodString>;
         excludeDomains: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        extraCaCertPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     }, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     }>, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     }, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     }>>;
     parentProxy: z.ZodOptional<z.ZodObject<{
         http: z.ZodOptional<z.ZodString>;
@@ -234,6 +314,7 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     } | undefined;
     parentProxy?: {
         http?: string | undefined;
@@ -259,6 +340,7 @@ export declare const NetworkConfigSchema: z.ZodObject<{
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
         excludeDomains?: string[] | undefined;
+        extraCaCertPaths?: string[] | undefined;
     } | undefined;
     parentProxy?: {
         http?: string | undefined;
@@ -312,29 +394,63 @@ export declare const RipgrepConfigSchema: z.ZodObject<{
     args?: string[] | undefined;
     argv0?: string | undefined;
 }>;
+/**
+ * Configuration for locating/invoking the `srt-win` helper (Windows
+ * only). An embedder that links `srt-win`'s CLI into its own
+ * multicall binary points `path` at that binary; spawns then pass
+ * `--srt-win` as `argv[1]` (see `SRT_WIN_DISPATCH_ARG1` in
+ * `windows-sandbox-utils.ts` / `srt_win::SRT_WIN_DISPATCH_ARG1`) so
+ * the embedder's dispatcher can route to `srt_win::run_from_args`.
+ * Windows cannot reliably preserve a spoofed `argv[0]` across
+ * `CreateProcessWithLogonW` / `ShellExecuteExW(runas)`, so dispatch
+ * keys on `argv[1]`, not on `argv[0]` like
+ * {@link SeccompConfigSchema} does on Linux.
+ */
+export declare const SrtWinConfigSchema: z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path?: string | undefined;
+}, {
+    path?: string | undefined;
+}>;
 /**
  * Windows-specific configuration schema. See
  * `windows-sandbox-utils.ts` for the install flow these settings
  * must agree with.
+ *
+ * Canonical: `sublayerGuid`; the `wfpSublayerGuid` alias is resolved
+ * at read sites (`sublayerGuid ?? wfpSublayerGuid`) rather than via
+ * `.transform()` so this stays a plain `ZodObject` for consumers that
+ * `.extend()`/`.shape` it.
  */
 export declare const WindowsConfigSchema: z.ZodObject<{
-    groupName: z.ZodDefault<z.ZodString>;
-    groupSid: z.ZodOptional<z.ZodString>;
+    sandboxUser: z.ZodOptional<z.ZodString>;
+    sublayerGuid: z.ZodOptional<z.ZodString>;
     wfpSublayerGuid: z.ZodOptional<z.ZodString>;
-    asSandboxUser: z.ZodDefault<z.ZodBoolean>;
     proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+    srtWin: z.ZodOptional<z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+    }, {
+        path?: string | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
-    groupName: string;
-    asSandboxUser: boolean;
-    groupSid?: string | undefined;
+    sandboxUser?: string | undefined;
+    sublayerGuid?: string | undefined;
     wfpSublayerGuid?: string | undefined;
     proxyPortRange?: [number, number] | undefined;
+    srtWin?: {
+        path?: string | undefined;
+    } | undefined;
 }, {
-    groupName?: string | undefined;
-    groupSid?: string | undefined;
+    sandboxUser?: string | undefined;
+    sublayerGuid?: string | undefined;
     wfpSublayerGuid?: string | undefined;
-    asSandboxUser?: boolean | undefined;
     proxyPortRange?: [number, number] | undefined;
+    srtWin?: {
+        path?: string | undefined;
+    } | undefined;
 }>;
 /**
  * Seccomp configuration schema (Linux only)
@@ -378,22 +494,27 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath: z.ZodOptional<z.ZodString>;
             caKeyPath: z.ZodOptional<z.ZodString>;
             excludeDomains: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+            extraCaCertPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strip", z.ZodTypeAny, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         }, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         }>, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         }, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         }>>;
         parentProxy: z.ZodOptional<z.ZodObject<{
             http: z.ZodOptional<z.ZodString>;
@@ -427,6 +548,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -452,6 +574,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -485,14 +608,41 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files: z.ZodOptional<z.ZodArray<z.ZodObject<{
             path: z.ZodString;
             mode: z.ZodEnum<["deny", "mask"]>;
+            extract: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+            /**
+             * What to do when `extract` matches nothing in the file at runtime.
+             *
+             * - `"warn"` (default): emit a stderr warning and leave the file
+             *   readable as-is inside the sandbox (fail-open). A non-matching
+             *   pattern is treated as a config error to surface and fix, not a
+             *   reason to break a tool that needs the file when the credential is
+             *   legitimately absent.
+             * - `"deny"`: degrade the entry to `mode: "deny"` so the file is
+             *   unreadable inside the sandbox (fail-closed). The operator declared
+             *   this file as containing a credential; if the regex cannot find it,
+             *   block access rather than expose it.
+             * - `"error"`: throw at wrap time so nothing runs until the operator
+             *   fixes the regex.
+             *
+             * Only meaningful when `mode` is `"mask"` and `extract` is set;
+             * accepted but ignored otherwise.
+             */
+            onExtractNoMatch: z.ZodOptional<z.ZodEnum<["warn", "deny", "error"]>>;
+            maskDuplicates: z.ZodOptional<z.ZodBoolean>;
             injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
         }, "strip", z.ZodTypeAny, {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }, {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }>, "many">>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -513,6 +663,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -525,6 +678,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -567,23 +723,33 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     bwrapPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     socatPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     windows: z.ZodOptional<z.ZodObject<{
-        groupName: z.ZodDefault<z.ZodString>;
-        groupSid: z.ZodOptional<z.ZodString>;
+        sandboxUser: z.ZodOptional<z.ZodString>;
+        sublayerGuid: z.ZodOptional<z.ZodString>;
         wfpSublayerGuid: z.ZodOptional<z.ZodString>;
-        asSandboxUser: z.ZodDefault<z.ZodBoolean>;
         proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+        srtWin: z.ZodOptional<z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            path?: string | undefined;
+        }, {
+            path?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
-        groupName: string;
-        asSandboxUser: boolean;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     }, {
-        groupName?: string | undefined;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
-        asSandboxUser?: boolean | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     network: {
@@ -605,6 +771,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -624,6 +791,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -652,11 +822,13 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
     windows?: {
-        groupName: string;
-        asSandboxUser: boolean;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     } | undefined;
 }, {
     network: {
@@ -678,6 +850,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -697,6 +870,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -725,11 +901,13 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
     windows?: {
-        groupName?: string | undefined;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
-        asSandboxUser?: boolean | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     } | undefined;
 }>, {
     network: {
@@ -751,6 +929,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -770,6 +949,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -798,11 +980,13 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
     windows?: {
-        groupName: string;
-        asSandboxUser: boolean;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     } | undefined;
 }, {
     network: {
@@ -824,6 +1008,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
             excludeDomains?: string[] | undefined;
+            extraCaCertPaths?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -843,6 +1028,9 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
         files?: {
             mode: "deny" | "mask";
             path: string;
+            extract?: string | undefined;
+            onExtractNoMatch?: "error" | "warn" | "deny" | undefined;
+            maskDuplicates?: boolean | undefined;
             injectHosts?: string[] | undefined;
         }[] | undefined;
         envVars?: {
@@ -871,11 +1059,13 @@ export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     bwrapPath?: string | undefined;
     socatPath?: string | undefined;
     windows?: {
-        groupName?: string | undefined;
-        groupSid?: string | undefined;
+        sandboxUser?: string | undefined;
+        sublayerGuid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
-        asSandboxUser?: boolean | undefined;
         proxyPortRange?: [number, number] | undefined;
+        srtWin?: {
+            path?: string | undefined;
+        } | undefined;
     } | undefined;
 }>;
 export type MitmProxyConfig = z.infer<typeof MitmProxyConfigSchema>;
@@ -889,6 +1079,7 @@ export type CredentialsConfig = z.infer<typeof CredentialsConfigSchema>;
 export type IgnoreViolationsConfig = z.infer<typeof IgnoreViolationsConfigSchema>;
 export type RipgrepConfig = z.infer<typeof RipgrepConfigSchema>;
 export type SeccompConfig = z.infer<typeof SeccompConfigSchema>;
+export type SrtWinConfig = z.infer<typeof SrtWinConfigSchema>;
 export type WindowsConfig = z.infer<typeof WindowsConfigSchema>;
 export type SandboxRuntimeConfig = z.infer<typeof SandboxRuntimeConfigSchema>;
 export {};

package/dist/sandbox/sandbox-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAiEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;;;;;;;;GASG;AACH,QAAA,MAAM,oBAAoB,6BAA2B,CAAA;AAcrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAerC,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;EAcvC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBzB,CAAA;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqI9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAgCjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAgD9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2NnC,CAAA;AAGJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAiEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;;;;;;;;GASG;AACH,QAAA,MAAM,oBAAoB,6BAA2B,CAAA;AAiDrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0BAA0B;;;;IAerC;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;;;;;;;;;;;EAgCH,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;EAcvC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;QAnFlC;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwFM,CAAA;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJ9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAgCjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;EAW7B,CAAA;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6C9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAzarC;;;;;;;;;;;;;;;;;eAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmnBD,CAAA;AAGJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}