@theokit/sdk 4.24.0 → 4.26.0

package/dist/sandbox/index.cjs

@@ -1,16 +1,18 @@
 'use strict';
 
+var chunkS7OEXQMI_cjs = require('../chunk-S7OEXQMI.cjs');
+require('../chunk-WPZTYOUX.cjs');
+var chunkA44COQJJ_cjs = require('../chunk-A44COQJJ.cjs');
+var chunkBEURCLDV_cjs = require('../chunk-BEURCLDV.cjs');
 var child_process = require('child_process');
 var fs = require('fs');
 var path = require('path');
 var os = require('os');
-var promises = require('fs/promises');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var path__default = /*#__PURE__*/_interopDefault(path);
 
-// src/sandbox/bwrap.ts
 function buildBwrapArgv(mode, opts) {
   if (mode === "danger-full-access") return null;
   const cwd = path__default.default.resolve(opts.cwd);
@@ -112,309 +114,6 @@ function resetBwrapMemo() {
   memo = void 0;
 }
 
-// src/internal/security/redact.ts
-var REDACT_ENABLED = readEnvOnce();
-function readEnvOnce() {
-  const raw = process.env.THEOKIT_REDACT_SECRETS;
-  if (raw === void 0) return true;
-  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
-}
-var warnedOptOut = false;
-if (!REDACT_ENABLED && !warnedOptOut) {
-  process.stderr.write(
-    "[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. Credentials may leak into errors, telemetry, logs, transcripts.\n"
-  );
-  warnedOptOut = true;
-}
-var BUILTIN_PATTERNS = [
-  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more
-  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before
-  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its
-  // multi-line span runs before any per-line patterns can fire.
-  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,
-  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per
-  // segment matches the minimum legal payload while skipping `a.b.c` noise.
-  /eyJ[A-Za-z0-9_-]{4,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
-  // Azure Storage SAS — match the sig= component (URL-encoded base64).
-  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,
-  // Anthropic
-  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g,
-  //   Anthropic admin keys (must precede sk-ant-)
-  /sk-ant-[A-Za-z0-9_-]{10,}/g,
-  //           Anthropic regular
-  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)
-  /sk-proj-[A-Za-z0-9_-]{10,}/g,
-  //  OpenAI project key (must precede sk- generic)
-  /sk-[A-Za-z0-9_-]{10,}/g,
-  //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek
-  // Provider prefixes (alphabetized for maintainability)
-  /AIza[A-Za-z0-9_-]{35}/g,
-  //       Google API key
-  /AKIA[A-Z0-9]{16}/g,
-  //            AWS access key
-  /fw_[A-Za-z0-9]{20,}/g,
-  //         Fireworks
-  /glpat-[A-Za-z0-9_-]{20}/g,
-  //     GitLab PAT
-  /ghp_[A-Za-z0-9]{36}/g,
-  //         GitHub PAT classic
-  /github_pat_[A-Za-z0-9_]{82}/g,
-  // GitHub PAT fine-grained
-  /gsk_[A-Za-z0-9]{20,}/g,
-  //        Groq
-  /hf_[A-Za-z0-9]{20,}/g,
-  //         HuggingFace
-  /\bpa-[A-Za-z0-9_-]{20,}/g,
-  //     Voyage AI (word-boundary to skip CSS / kebab IDs)
-  /pcsk_[A-Za-z0-9_-]{20,}/g,
-  //     Pinecone
-  /pplx-[A-Za-z0-9_-]{20,}/g,
-  //     Perplexity
-  /r8_[A-Za-z0-9_-]{20,}/g,
-  //       Replicate
-  /rk_live_[A-Za-z0-9]{20,}/g,
-  //    Stripe restricted
-  /sk_live_[A-Za-z0-9]{20,}/g,
-  //    Stripe secret
-  /sntrys_[A-Za-z0-9]{40,}/g,
-  //     Sentry user auth
-  /xai-[A-Za-z0-9_-]{20,}/g,
-  //      xAI (Grok)
-  /xox[bpasr]-[A-Za-z0-9-]{10,}/g,
-  //Slack tokens
-  // Additional unique-prefix tokens with low false-positive risk
-  /npm_[A-Za-z0-9]{36}/g,
-  //         npm access token
-  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
-  // SendGrid
-  /\bSK[A-Za-z0-9]{32}\b/g,
-  //       Twilio API SID (word-boundary to skip CSS class noise)
-  /\bkey-[a-f0-9]{32}\b/g,
-  //        Mailgun (hex-only narrows false positives)
-  /MT[A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/g,
-  // Discord bot
-  /\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g
-  // LaunchDarkly
-];
-var BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9_\-.+/=]{8,})/g;
-var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\b["']?\s*[:=]\s*["']?)([A-Za-z0-9_\-.+/]+)/gi;
-var _extraPatterns = [];
-function maskToken(token) {
-  if (token.length < 18) return "***";
-  return `${token.slice(0, 6)}...${token.slice(-4)}`;
-}
-var MASK_SHAPE = /^.{6}\.\.\..{4}$/s;
-function coerceToString(value) {
-  if (typeof value === "string") return value;
-  if (value === null || value === void 0) return null;
-  if (typeof value === "object") {
-    try {
-      const s = JSON.stringify(value);
-      return s === void 0 ? null : s;
-    } catch {
-      return "[unredactable: circular]";
-    }
-  }
-  return String(value);
-}
-function redactSecrets(text, opts) {
-  const coerced = coerceToString(text);
-  if (coerced === null) return "";
-  if (!REDACT_ENABLED) return coerced;
-  let s = coerced;
-  for (const re of BUILTIN_PATTERNS) {
-    s = s.replace(re, (m) => maskToken(m));
-  }
-  for (const re of _extraPatterns) {
-    s = s.replace(re, (m) => maskToken(m));
-  }
-  {
-    s = s.replace(BEARER_PATTERN, (_, prefix) => `${prefix}***`);
-    s = s.replace(PARAM_PATTERN, (whole, prefix, value) => {
-      if (MASK_SHAPE.test(value)) return whole;
-      return `${prefix}***`;
-    });
-  }
-  return s;
-}
-
-// src/internal/runtime/lifecycle/env-policy.ts
-var SECRET_PATTERNS = [
-  /KEY/i,
-  /SECRET/i,
-  /TOKEN/i,
-  /PASSWORD/i,
-  /PASSWD/i,
-  /PASSPHRASE/i,
-  /[_-]PWD/i,
-  /CREDENTIAL/i,
-  /PRIVATE/i,
-  /_AUTH/i,
-  // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).
-  /DSN/i,
-  /WEBHOOK/i,
-  /COOKIE/i,
-  /CONNECTION[_-]?STRING/i,
-  // Known DB / message-broker connection-string vars (carry `user:pass@`).
-  /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i
-];
-var CORE_VARS = [
-  "PATH",
-  "HOME",
-  "SHELL",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TMPDIR",
-  "TMP",
-  "TEMP",
-  "USER",
-  "LOGNAME"
-];
-function isSecretName(name) {
-  return SECRET_PATTERNS.some((re) => re.test(name));
-}
-function inheritsUnderPolicy(name, policy) {
-  if (policy === "all") return true;
-  if (policy === "core") return CORE_VARS.includes(name);
-  return !isSecretName(name);
-}
-function resolveChildEnv(options = {}) {
-  const parent = options.parent ?? process.env;
-  const policy = options.policy ?? "inherit-scrubbed";
-  const base = {};
-  for (const [name, value] of Object.entries(parent)) {
-    if (value !== void 0 && inheritsUnderPolicy(name, policy)) base[name] = value;
-  }
-  for (const [name, value] of Object.entries(options.overrides ?? {})) {
-    base[name] = value;
-  }
-  return base;
-}
-
-// src/sandbox/shell-escape.ts
-function shellEscapePosix(arg) {
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-
-// src/sandbox/types.ts
-var SandboxSecurityError = class extends Error {
-  code = "sandbox_security";
-  constructor(message) {
-    super(message);
-    this.name = "SandboxSecurityError";
-  }
-};
-var SandboxNotAvailableError = class extends Error {
-  code = "sandbox_not_available";
-  constructor(message) {
-    super(message);
-    this.name = "SandboxNotAvailableError";
-  }
-};
-var SandboxBackend = class {
-  config;
-  constructor(config = {}) {
-    this.config = {
-      workDir: config.workDir ?? "/tmp",
-      timeoutMs: config.timeoutMs ?? 3e4,
-      maxOutputBytes: config.maxOutputBytes ?? 5 * 1024 * 1024,
-      // #54 — preserve the env policy so backends can scrub secrets.
-      env: config.env ?? "inherit-scrubbed"
-    };
-  }
-  async readFile(path2) {
-    const result = await this.execute(`cat ${this.shellEscape(path2)}`);
-    if (result.exitCode !== 0) {
-      throw new Error(`readFile failed: ${result.stderr}`);
-    }
-    return result.stdout;
-  }
-  async writeFile(path2, content) {
-    await this.uploadFile(path2, content);
-  }
-  async glob(pattern, cwd) {
-    const dir = cwd ?? this.config.workDir ?? ".";
-    const result = await this.execute(
-      `find ${this.shellEscape(dir)} -name ${this.shellEscape(pattern)} -type f 2>/dev/null`
-    );
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  async grep(pattern, path2) {
-    const target = path2 ?? ".";
-    const result = await this.execute(
-      `grep -rn ${this.shellEscape(pattern)} ${this.shellEscape(target)} 2>/dev/null`
-    );
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  async listDir(path2) {
-    const result = await this.execute(`ls -1 ${this.shellEscape(path2)}`);
-    if (result.exitCode !== 0) return [];
-    return result.stdout.trim().split("\n").filter(Boolean);
-  }
-  truncateOutput(output) {
-    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
-    if (Buffer.byteLength(output) > max) {
-      return `${output.slice(0, max)}
-...(truncated)`;
-    }
-    return output;
-  }
-  shellEscape(arg) {
-    return shellEscapePosix(arg);
-  }
-};
-async function resolveSandbox(provider, ctx) {
-  return provider instanceof SandboxBackend ? provider : provider(ctx);
-}
-
-// src/sandbox/local-sandbox.ts
-var LocalSandbox = class extends SandboxBackend {
-  constructor(config = {}) {
-    super(config);
-  }
-  async execute(command, opts) {
-    const timeout = opts?.timeoutMs ?? this.config.timeoutMs ?? 3e4;
-    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
-    return new Promise((resolve) => {
-      const child = child_process.execFile(
-        "/bin/sh",
-        ["-c", command],
-        {
-          cwd: this.config.workDir,
-          timeout,
-          maxBuffer: max,
-          encoding: "utf-8",
-          // #54 — scrub secret-like host env vars from the child by default.
-          env: resolveChildEnv({ policy: this.config.env })
-        },
-        (error, stdout, stderr) => {
-          resolve(this.buildResult(error, stdout ?? "", stderr ?? ""));
-        }
-      );
-      child.on("error", () => {
-        resolve({ stdout: "", stderr: "spawn error", exitCode: 1, timedOut: false });
-      });
-    });
-  }
-  buildResult(error, stdout, stderr) {
-    const timedOut = error !== null && "killed" in error && error.killed;
-    return {
-      stdout: this.truncateOutput(stdout),
-      stderr: this.truncateOutput(stderr),
-      exitCode: timedOut ? 124 : error ? 1 : 0,
-      timedOut
-    };
-  }
-  async uploadFile(path2, content) {
-    const fullPath = path2.startsWith("/") ? path2 : `${this.config.workDir}/${path2}`;
-    await promises.mkdir(path.dirname(fullPath), { recursive: true });
-    await promises.writeFile(fullPath, content, "utf-8");
-  }
-};
-
 // src/sandbox/seccomp.ts
 var BPF_LD = 0;
 var BPF_W = 0;
@@ -526,7 +225,7 @@ function allowlistedEnv(source = process.env) {
   }
   return out;
 }
-var LinuxSandbox = class extends LocalSandbox {
+var LinuxSandbox = class extends chunkS7OEXQMI_cjs.LocalSandbox {
   mode;
   network;
   cwd;
@@ -620,7 +319,7 @@ function seccompPathForArch(arch, warn) {
 var seccompFilterPath;
 function restrictedSeccompPath() {
   if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
-  const path2 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
+  const path2 = seccompPathForArch(process.arch, (m) => console.warn(chunkBEURCLDV_cjs.redactSecrets(m)));
   seccompFilterPath = path2 ?? null;
   return path2;
 }
@@ -640,17 +339,17 @@ function resolveSandboxPosture(opts) {
 }
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
-  if (opts.mode === "danger-full-access") return new LocalSandbox(config);
+  if (opts.mode === "danger-full-access") return new chunkS7OEXQMI_cjs.LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoizado)();
   if (!detection.ok) {
     if (!warnedUnavailable) {
       warnedUnavailable = true;
-      const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+      const warn = opts.warn ?? ((m) => console.warn(chunkBEURCLDV_cjs.redactSecrets(m)));
       warn(
         `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
       );
     }
-    return new LocalSandbox(config);
+    return new chunkS7OEXQMI_cjs.LocalSandbox(config);
   }
   return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
 }
@@ -667,7 +366,7 @@ function decidirConfinamento(opts) {
   if (detection.ok) return detection.bin;
   if (!avisouInterativo) {
     avisouInterativo = true;
-    const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+    const warn = opts.warn ?? ((m) => console.warn(chunkBEURCLDV_cjs.redactSecrets(m)));
     warn(
       `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 interactive session runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`
     );
@@ -692,24 +391,8 @@ function interactiveWrapCommand(opts) {
   };
 }
 
-// src/errors.ts
-var TheokitAgentError = class extends Error {
-  name = "TheokitAgentError";
-  isRetryable;
-  code;
-  protoErrorCode;
-  metadata;
-  constructor(message, options = {}) {
-    super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
-    this.isRetryable = options.isRetryable ?? false;
-    if (options.code !== void 0) this.code = options.code;
-    if (options.protoErrorCode !== void 0) this.protoErrorCode = options.protoErrorCode;
-    if (options.metadata !== void 0) this.metadata = options.metadata;
-  }
-};
-
 // src/sandbox/provision.ts
-var RepoProvisionError = class extends TheokitAgentError {
+var RepoProvisionError = class extends chunkA44COQJJ_cjs.TheokitAgentError {
   constructor(instanceId, message, options = {}) {
     super(`[${instanceId}] ${message}`, {
       code: "repo_provision_failed",
@@ -723,7 +406,7 @@ var RepoProvisionError = class extends TheokitAgentError {
 };
 var SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 async function provisionRepo(sandboxOrOpts, maybeOpts) {
-  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new LocalSandbox();
+  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkS7OEXQMI_cjs.LocalSandbox();
   const opts = maybeOpts ?? sandboxOrOpts;
   const { repoUrl, ref, instanceId } = opts;
   if (!SAFE_INSTANCE_ID.test(instanceId)) {
@@ -736,20 +419,20 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
     throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);
   }
   const clone = await sandbox.execute(
-    `git -c protocol.ext.allow=never clone --quiet -- ${shellEscapePosix(repoUrl)} ${shellEscapePosix(instanceId)}`
+    `git -c protocol.ext.allow=never clone --quiet -- ${chunkS7OEXQMI_cjs.shellEscapePosix(repoUrl)} ${chunkS7OEXQMI_cjs.shellEscapePosix(instanceId)}`
   );
   if (clone.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);
   }
   const top = await sandbox.execute(
-    `git -C ${shellEscapePosix(instanceId)} rev-parse --show-toplevel`
+    `git -C ${chunkS7OEXQMI_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
   );
   if (top.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);
   }
   const repoDir = top.stdout.trim();
   const checkout = await sandbox.execute(
-    `git -C ${shellEscapePosix(repoDir)} checkout --quiet ${shellEscapePosix(ref)}`
+    `git -C ${chunkS7OEXQMI_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkS7OEXQMI_cjs.shellEscapePosix(ref)}`
   );
   if (checkout.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);
@@ -757,12 +440,28 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
   return { repoDir };
 }
 
+Object.defineProperty(exports, "LocalSandbox", {
+  enumerable: true,
+  get: function () { return chunkS7OEXQMI_cjs.LocalSandbox; }
+});
+Object.defineProperty(exports, "SandboxBackend", {
+  enumerable: true,
+  get: function () { return chunkS7OEXQMI_cjs.SandboxBackend; }
+});
+Object.defineProperty(exports, "SandboxNotAvailableError", {
+  enumerable: true,
+  get: function () { return chunkS7OEXQMI_cjs.SandboxNotAvailableError; }
+});
+Object.defineProperty(exports, "SandboxSecurityError", {
+  enumerable: true,
+  get: function () { return chunkS7OEXQMI_cjs.SandboxSecurityError; }
+});
+Object.defineProperty(exports, "resolveSandbox", {
+  enumerable: true,
+  get: function () { return chunkS7OEXQMI_cjs.resolveSandbox; }
+});
 exports.LinuxSandbox = LinuxSandbox;
-exports.LocalSandbox = LocalSandbox;
 exports.RepoProvisionError = RepoProvisionError;
-exports.SandboxBackend = SandboxBackend;
-exports.SandboxNotAvailableError = SandboxNotAvailableError;
-exports.SandboxSecurityError = SandboxSecurityError;
 exports.allowlistedEnv = allowlistedEnv;
 exports.buildBwrapArgv = buildBwrapArgv;
 exports.buildSeccompFilter = buildSeccompFilter;
@@ -776,7 +475,6 @@ exports.realProbes = realProbes;
 exports.resetBwrapMemo = resetBwrapMemo;
 exports.resetInteractiveWarnLatch = resetInteractiveWarnLatch;
 exports.resetSandboxWarnLatch = resetSandboxWarnLatch;
-exports.resolveSandbox = resolveSandbox;
 exports.resolveSandboxPosture = resolveSandboxPosture;
 exports.restrictedSeccompPath = restrictedSeccompPath;
 exports.seccompPathForArch = seccompPathForArch;