@theokit/sdk 4.23.0 → 4.25.0

package/dist/sandbox/index.js

@@ -1,10 +1,13 @@
-import { execFileSync, execFile } from 'child_process';
+import { LocalSandbox, shellEscapePosix } from '../chunk-SKWVAQAY.js';
+export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox } from '../chunk-SKWVAQAY.js';
+import '../chunk-7GFX45DD.js';
+import { TheokitAgentError } from '../chunk-WLKFWQSJ.js';
+import { redactSecrets } from '../chunk-JTFYYKDT.js';
+import { execFileSync } from 'child_process';
 import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'fs';
 import path, { dirname, join } from 'path';
 import { tmpdir } from 'os';
-import { mkdir, writeFile } from 'fs/promises';
 
-// src/sandbox/bwrap.ts
 function buildBwrapArgv(mode, opts) {
   if (mode === "danger-full-access") return null;
   const cwd = path.resolve(opts.cwd);
@@ -106,309 +109,6 @@ function resetBwrapMemo() {
   memo = void 0;
 }
 
-// src/internal/security/redact.ts
-var REDACT_ENABLED = readEnvOnce();
-function readEnvOnce() {
-  const raw = process.env.THEOKIT_REDACT_SECRETS;
-  if (raw === void 0) return true;
-  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
-}
-var warnedOptOut = false;
-if (!REDACT_ENABLED && !warnedOptOut) {
-  process.stderr.write(
-    "[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. Credentials may leak into errors, telemetry, logs, transcripts.\n"
-  );
-  warnedOptOut = true;
-}
-var BUILTIN_PATTERNS = [
-  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more
-  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before
-  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its
-  // multi-line span runs before any per-line patterns can fire.
-  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,
-  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per
-  // segment matches the minimum legal payload while skipping `a.b.c` noise.
-  /eyJ[A-Za-z0-9_-]{4,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
-  // Azure Storage SAS — match the sig= component (URL-encoded base64).
-  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,
-  // Anthropic
-  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g,
-  //   Anthropic admin keys (must precede sk-ant-)
-  /sk-ant-[A-Za-z0-9_-]{10,}/g,
-  //           Anthropic regular
-  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)
-  /sk-proj-[A-Za-z0-9_-]{10,}/g,
-  //  OpenAI project key (must precede sk- generic)
-  /sk-[A-Za-z0-9_-]{10,}/g,
-  //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek
-  // Provider prefixes (alphabetized for maintainability)
-  /AIza[A-Za-z0-9_-]{35}/g,
-  //       Google API key
-  /AKIA[A-Z0-9]{16}/g,
-  //            AWS access key
-  /fw_[A-Za-z0-9]{20,}/g,
-  //         Fireworks
-  /glpat-[A-Za-z0-9_-]{20}/g,
-  //     GitLab PAT
-  /ghp_[A-Za-z0-9]{36}/g,
-  //         GitHub PAT classic
-  /github_pat_[A-Za-z0-9_]{82}/g,
-  // GitHub PAT fine-grained
-  /gsk_[A-Za-z0-9]{20,}/g,
-  //        Groq
-  /hf_[A-Za-z0-9]{20,}/g,
-  //         HuggingFace
-  /\bpa-[A-Za-z0-9_-]{20,}/g,
-  //     Voyage AI (word-boundary to skip CSS / kebab IDs)
-  /pcsk_[A-Za-z0-9_-]{20,}/g,
-  //     Pinecone
-  /pplx-[A-Za-z0-9_-]{20,}/g,
-  //     Perplexity
-  /r8_[A-Za-z0-9_-]{20,}/g,
-  //       Replicate
-  /rk_live_[A-Za-z0-9]{20,}/g,
-  //    Stripe restricted
-  /sk_live_[A-Za-z0-9]{20,}/g,
-  //    Stripe secret
-  /sntrys_[A-Za-z0-9]{40,}/g,
-  //     Sentry user auth
-  /xai-[A-Za-z0-9_-]{20,}/g,
-  //      xAI (Grok)
-  /xox[bpasr]-[A-Za-z0-9-]{10,}/g,
-  //Slack tokens
-  // Additional unique-prefix tokens with low false-positive risk
-  /npm_[A-Za-z0-9]{36}/g,
-  //         npm access token
-  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
-  // SendGrid
-  /\bSK[A-Za-z0-9]{32}\b/g,
-  //       Twilio API SID (word-boundary to skip CSS class noise)
-  /\bkey-[a-f0-9]{32}\b/g,
-  //        Mailgun (hex-only narrows false positives)
-  /MT[A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/g,
-  // Discord bot
-  /\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g
-  // LaunchDarkly
-];
-var BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9_\-.+/=]{8,})/g;
-var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\b["']?\s*[:=]\s*["']?)([A-Za-z0-9_\-.+/]+)/gi;
-var _extraPatterns = [];
-function maskToken(token) {
-  if (token.length < 18) return "***";
-  return `${token.slice(0, 6)}...${token.slice(-4)}`;
-}
-var MASK_SHAPE = /^.{6}\.\.\..{4}$/s;
-function coerceToString(value) {
-  if (typeof value === "string") return value;
-  if (value === null || value === void 0) return null;
-  if (typeof value === "object") {
-    try {
-      const s = JSON.stringify(value);
-      return s === void 0 ? null : s;
-    } catch {
-      return "[unredactable: circular]";
-    }
-  }
-  return String(value);
-}
-function redactSecrets(text, opts) {
-  const coerced = coerceToString(text);
-  if (coerced === null) return "";
-  if (!REDACT_ENABLED) return coerced;
-  let s = coerced;
-  for (const re of BUILTIN_PATTERNS) {
-    s = s.replace(re, (m) => maskToken(m));
-  }
-  for (const re of _extraPatterns) {
-    s = s.replace(re, (m) => maskToken(m));
-  }
-  {
-    s = s.replace(BEARER_PATTERN, (_, prefix) => `${prefix}***`);
-    s = s.replace(PARAM_PATTERN, (whole, prefix, value) => {
-      if (MASK_SHAPE.test(value)) return whole;
-      return `${prefix}***`;
-    });
-  }
-  return s;
-}
-
-// src/internal/runtime/lifecycle/env-policy.ts
-var SECRET_PATTERNS = [
-  /KEY/i,
-  /SECRET/i,
-  /TOKEN/i,
-  /PASSWORD/i,
-  /PASSWD/i,
-  /PASSPHRASE/i,
-  /[_-]PWD/i,
-  /CREDENTIAL/i,
-  /PRIVATE/i,
-  /_AUTH/i,
-  // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).
-  /DSN/i,
-  /WEBHOOK/i,
-  /COOKIE/i,
-  /CONNECTION[_-]?STRING/i,
-  // Known DB / message-broker connection-string vars (carry `user:pass@`).
-  /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i
-];
-var CORE_VARS = [
-  "PATH",
-  "HOME",
-  "SHELL",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TMPDIR",
-  "TMP",
-  "TEMP",
-  "USER",
-  "LOGNAME"
-];
-function isSecretName(name) {
-  return SECRET_PATTERNS.some((re) => re.test(name));
-}
-function inheritsUnderPolicy(name, policy) {
-  if (policy === "all") return true;
-  if (policy === "core") return CORE_VARS.includes(name);
-  return !isSecretName(name);
-}
-function resolveChildEnv(options = {}) {
-  const parent = options.parent ?? process.env;
-  const policy = options.policy ?? "inherit-scrubbed";
-  const base = {};
-  for (const [name, value] of Object.entries(parent)) {
-    if (value !== void 0 && inheritsUnderPolicy(name, policy)) base[name] = value;
-  }
-  for (const [name, value] of Object.entries(options.overrides ?? {})) {
-    base[name] = value;
-  }
-  return base;
-}
-
-// src/sandbox/shell-escape.ts
-function shellEscapePosix(arg) {
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-
-// src/sandbox/types.ts
-var SandboxSecurityError = class extends Error {
-  code = "sandbox_security";
-  constructor(message) {
-    super(message);
-    this.name = "SandboxSecurityError";
-  }
-};
-var SandboxNotAvailableError = class extends Error {
-  code = "sandbox_not_available";
-  constructor(message) {
-    super(message);
-    this.name = "SandboxNotAvailableError";
-  }
-};
-var SandboxBackend = class {
-  config;
-  constructor(config = {}) {
-    this.config = {
-      workDir: config.workDir ?? "/tmp",
-      timeoutMs: config.timeoutMs ?? 3e4,
-      maxOutputBytes: config.maxOutputBytes ?? 5 * 1024 * 1024,
-      // #54 — preserve the env policy so backends can scrub secrets.
-      env: config.env ?? "inherit-scrubbed"
-    };
-  }
-  async readFile(path2) {
-    const result = await this.execute(`cat ${this.shellEscape(path2)}`);
-    if (result.exitCode !== 0) {
-      throw new Error(`readFile failed: ${result.stderr}`);
-    }
-    return result.stdout;
-  }
-  async writeFile(path2, content) {
-    await this.uploadFile(path2, content);
-  }
-  async glob(pattern, cwd) {
-    const dir = cwd ?? this.config.workDir ?? ".";
-    const result = await this.execute(
-      `find ${this.shellEscape(dir)} -name ${this.shellEscape(pattern)} -type f 2>/dev/null`
-    );
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  async grep(pattern, path2) {
-    const target = path2 ?? ".";
-    const result = await this.execute(
-      `grep -rn ${this.shellEscape(pattern)} ${this.shellEscape(target)} 2>/dev/null`
-    );
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  async listDir(path2) {
-    const result = await this.execute(`ls -1 ${this.shellEscape(path2)}`);
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  truncateOutput(output) {
-    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
-    if (Buffer.byteLength(output) > max) {
-      return `${output.slice(0, max)}
-...(truncated)`;
-    }
-    return output;
-  }
-  shellEscape(arg) {
-    return shellEscapePosix(arg);
-  }
-};
-async function resolveSandbox(provider, ctx) {
-  return provider instanceof SandboxBackend ? provider : provider(ctx);
-}
-
-// src/sandbox/local-sandbox.ts
-var LocalSandbox = class extends SandboxBackend {
-  constructor(config = {}) {
-    super(config);
-  }
-  async execute(command, opts) {
-    const timeout = opts?.timeoutMs ?? this.config.timeoutMs ?? 3e4;
-    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
-    return new Promise((resolve) => {
-      const child = execFile(
-        "/bin/sh",
-        ["-c", command],
-        {
-          cwd: this.config.workDir,
-          timeout,
-          maxBuffer: max,
-          encoding: "utf-8",
-          // #54 — scrub secret-like host env vars from the child by default.
-          env: resolveChildEnv({ policy: this.config.env })
-        },
-        (error, stdout, stderr) => {
-          resolve(this.buildResult(error, stdout ?? "", stderr ?? ""));
-        }
-      );
-      child.on("error", () => {
-        resolve({ stdout: "", stderr: "spawn error", exitCode: 1, timedOut: false });
-      });
-    });
-  }
-  buildResult(error, stdout, stderr) {
-    const timedOut = error !== null && "killed" in error && error.killed;
-    return {
-      stdout: this.truncateOutput(stdout),
-      stderr: this.truncateOutput(stderr),
-      exitCode: timedOut ? 124 : error ? 1 : 0,
-      timedOut
-    };
-  }
-  async uploadFile(path2, content) {
-    const fullPath = path2.startsWith("/") ? path2 : `${this.config.workDir}/${path2}`;
-    await mkdir(dirname(fullPath), { recursive: true });
-    await writeFile(fullPath, content, "utf-8");
-  }
-};
-
 // src/sandbox/seccomp.ts
 var BPF_LD = 0;
 var BPF_W = 0;
@@ -686,22 +386,6 @@ function interactiveWrapCommand(opts) {
   };
 }
 
-// src/errors.ts
-var TheokitAgentError = class extends Error {
-  name = "TheokitAgentError";
-  isRetryable;
-  code;
-  protoErrorCode;
-  metadata;
-  constructor(message, options = {}) {
-    super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
-    this.isRetryable = options.isRetryable ?? false;
-    if (options.code !== void 0) this.code = options.code;
-    if (options.protoErrorCode !== void 0) this.protoErrorCode = options.protoErrorCode;
-    if (options.metadata !== void 0) this.metadata = options.metadata;
-  }
-};
-
 // src/sandbox/provision.ts
 var RepoProvisionError = class extends TheokitAgentError {
   constructor(instanceId, message, options = {}) {
@@ -751,6 +435,6 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
   return { repoDir };
 }
 
-export { LinuxSandbox, LocalSandbox, RepoProvisionError, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, allowlistedEnv, buildBwrapArgv, buildSeccompFilter, createSandboxBackend, detectBwrap, detectBwrapMemoizado, interactiveWrapCommand, provisionRepo, realProbeCount, realProbes, resetBwrapMemo, resetInteractiveWarnLatch, resetSandboxWarnLatch, resolveSandbox, resolveSandboxPosture, restrictedSeccompPath, seccompPathForArch, wrapCommandForSandbox };
+export { LinuxSandbox, RepoProvisionError, allowlistedEnv, buildBwrapArgv, buildSeccompFilter, createSandboxBackend, detectBwrap, detectBwrapMemoizado, interactiveWrapCommand, provisionRepo, realProbeCount, realProbes, resetBwrapMemo, resetInteractiveWarnLatch, resetSandboxWarnLatch, resolveSandboxPosture, restrictedSeccompPath, seccompPathForArch, wrapCommandForSandbox };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map