@tickernelz/paperclip-pro-adapter-claude-local 2026.925.0

package/dist/server/probe-diagnostics.js

@@ -0,0 +1,140 @@
+/**
+ * The fixed label a Test result shows when the probe runs on the local
+ * Paperclip host. The label is a constant, so a local target check never
+ * carries an environment ID, a config value, or a credential-derived string.
+ */
+export const ADAPTER_TEST_HOST_TARGET_LABEL = "Paperclip host";
+// The login hint may show a login URL. The URL must be a normalized https URL
+// with an allowlisted Claude or Anthropic host and no query or fragment. A host
+// matches when it equals a suffix or ends with a dot and the suffix.
+const ALLOWED_LOGIN_URL_HOST_SUFFIXES = ["anthropic.com", "claude.ai"];
+// A JavaScript error class name is a bounded identifier. The bound stops a very
+// large or crafted class name from filling the log.
+const MAX_ERROR_CLASS_NAME_CHARS = 64;
+/**
+ * Read the class name of a thrown value for a safe probe diagnostic. The
+ * function returns the constructor name of an `Error`, or `null` for any other
+ * value. The name is a bounded identifier, not a copy of the error message, so
+ * it carries no untrusted probe text.
+ */
+export function classifyThrownErrorClass(err) {
+    if (err instanceof Error)
+        return err.constructor?.name ?? "Error";
+    return null;
+}
+// Keep only identifier characters and bound the length. The result cannot carry
+// untrusted probe text.
+function sanitizeErrorClassName(name) {
+    if (typeof name !== "string")
+        return null;
+    const safe = name.replace(/[^A-Za-z0-9_$]/g, "").slice(0, MAX_ERROR_CLASS_NAME_CHARS);
+    return safe.length > 0 ? safe : null;
+}
+/**
+ * Send a sandbox probe or config materialization diagnostic to the server log.
+ *
+ * Three Test-lane call sites use this helper:
+ *   - the Claude CLI Test lane (`test.ts`),
+ *   - the Claude ACP Test lane (`acp.ts`),
+ *   - the managed-config materialization step (`claude-config.ts`).
+ *
+ * Contract: no untrusted text reaches the log. The helper logs only the fixed
+ * context string, one allowlisted classification, and safe structured fields.
+ * The safe fields are the process exit code and a sanitized error class name.
+ * The helper never logs raw probe stdout, raw stderr, or a raw thrown-error
+ * message. A call site must never copy raw probe text into a Test-result check,
+ * because the user interface renders check text.
+ *
+ * @param context A short fixed description of the failed step. It carries no
+ *   untrusted text.
+ * @param classification One allowlisted label that the call site derives from
+ *   the probe state. It carries no untrusted text.
+ * @param fields Optional safe structured fields, such as the exit code.
+ */
+export function logSandboxProbeDiagnostic(context, classification, fields) {
+    const detail = { classification };
+    if (typeof fields?.exitCode === "number" && Number.isFinite(fields.exitCode)) {
+        detail.exitCode = fields.exitCode;
+    }
+    const errorClass = sanitizeErrorClassName(fields?.errorClass);
+    if (errorClass)
+        detail.errorClass = errorClass;
+    console.warn(`[paperclip] ${context}`, detail);
+}
+/**
+ * Normalize an untrusted login URL for a Test-result hint.
+ *
+ * The extractor reads the URL from raw sandbox stdout or stderr, so the value is
+ * untrusted. The function accepts the URL only when every rule holds:
+ *   - the protocol is `https`,
+ *   - the host equals or ends with an allowlisted Claude or Anthropic host,
+ *   - the URL has no user, password, or port,
+ *   - the URL has no query and no fragment.
+ *
+ * The function returns the normalized URL string, or `null` when any rule
+ * fails. The caller shows a fixed `claude login` hint when the function returns
+ * `null`.
+ */
+export function normalizeClaudeLoginUrl(raw) {
+    if (!raw)
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:")
+        return null;
+    if (url.username || url.password || url.port)
+        return null;
+    if (url.search || url.hash)
+        return null;
+    const host = url.hostname.toLowerCase();
+    const allowed = ALLOWED_LOGIN_URL_HOST_SUFFIXES.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+    if (!allowed)
+        return null;
+    return url.toString();
+}
+/**
+ * Build the fixed auth-required hint for a Test-result check. When the login URL
+ * normalizes to a safe value, the hint names it. Otherwise the hint tells the
+ * operator to run `claude login`.
+ */
+export function buildClaudeLoginRequiredHint(loginUrl) {
+    const safeUrl = normalizeClaudeLoginUrl(loginUrl);
+    return safeUrl
+        ? `Run \`claude login\` and complete sign-in at ${safeUrl}, then retry.`
+        : "Run `claude login` in this environment, then retry the probe.";
+}
+/**
+ * Resolve the label a Test result shows for the probed target. A remote target
+ * uses the authorized environment name. A remote target with no name uses a
+ * fixed generic label. A local target uses the fixed host label. The function
+ * never returns an environment ID, a config value, or a credential-derived
+ * string.
+ */
+export function resolveAdapterTestTargetLabel(input) {
+    if (!input.targetIsRemote)
+        return ADAPTER_TEST_HOST_TARGET_LABEL;
+    const name = typeof input.environmentName === "string" ? input.environmentName.trim() : "";
+    return name.length > 0 ? name : "the selected environment";
+}
+/**
+ * Build the target check every Test result carries, so the result names the
+ * target it probed. Both the Claude CLI Test lane and the Claude ACP Test lane
+ * use this builder. The check text carries only the authorized environment
+ * label or the fixed host label.
+ */
+export function buildAdapterTestTargetCheck(input) {
+    const label = resolveAdapterTestTargetLabel(input);
+    return {
+        code: "claude_environment_target",
+        level: "info",
+        message: input.targetIsRemote
+            ? `Probing inside environment: ${label}`
+            : "Probing on the Paperclip host.",
+    };
+}
+//# sourceMappingURL=probe-diagnostics.js.map

package/dist/server/probe-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-diagnostics.js","sourceRoot":"","sources":["../../src/server/probe-diagnostics.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAE/D,8EAA8E;AAC9E,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,+BAA+B,GAAG,CAAC,eAAe,EAAE,WAAW,CAAU,CAAC;AAEhF,gFAAgF;AAChF,oDAAoD;AACpD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAoCtC;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,OAAO,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,SAAS,sBAAsB,CAAC,IAA+B;IAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,cAAoD,EACpD,MAAqC;IAErC,MAAM,MAAM,GAIR,EAAE,cAAc,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,UAAU;QAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAA8B;IACpE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,+BAA+B,CAAC,IAAI,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAC3D,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAmC;IAC9E,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,OAAO;QACZ,CAAC,CAAC,gDAAgD,OAAO,eAAe;QACxE,CAAC,CAAC,+DAA+D,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,8BAA8B,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,KAAK,CAAC,cAAc;YAC3B,CAAC,CAAC,+BAA+B,KAAK,EAAE;YACxC,CAAC,CAAC,gCAAgC;KACrC,CAAC;AACJ,CAAC"}

package/dist/server/probe-diagnostics.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=probe-diagnostics.test.d.ts.map

package/dist/server/probe-diagnostics.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-diagnostics.test.d.ts","sourceRoot":"","sources":["../../src/server/probe-diagnostics.test.ts"],"names":[],"mappings":""}

package/dist/server/probe-diagnostics.test.js

@@ -0,0 +1,114 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildClaudeLoginRequiredHint, classifyThrownErrorClass, logSandboxProbeDiagnostic, normalizeClaudeLoginUrl, } from "./probe-diagnostics.js";
+describe("normalizeClaudeLoginUrl", () => {
+    it("accepts an allowlisted https Claude host with no query or fragment", () => {
+        expect(normalizeClaudeLoginUrl("https://claude.ai/login")).toBe("https://claude.ai/login");
+    });
+    it("accepts an allowlisted Anthropic subdomain", () => {
+        expect(normalizeClaudeLoginUrl("https://console.anthropic.com/login")).toBe("https://console.anthropic.com/login");
+    });
+    it("rejects a URL with a query", () => {
+        expect(normalizeClaudeLoginUrl("https://claude.ai/login?token=secret")).toBeNull();
+    });
+    it("rejects a URL with a fragment", () => {
+        expect(normalizeClaudeLoginUrl("https://claude.ai/login#access_token=secret")).toBeNull();
+    });
+    it("rejects a non-https URL", () => {
+        expect(normalizeClaudeLoginUrl("http://claude.ai/login")).toBeNull();
+    });
+    it("rejects a non-allowlisted host", () => {
+        expect(normalizeClaudeLoginUrl("https://evil.example.com/claude-login")).toBeNull();
+    });
+    it("rejects a look-alike host that only ends with the brand word", () => {
+        expect(normalizeClaudeLoginUrl("https://claude.ai.evil.com/login")).toBeNull();
+        expect(normalizeClaudeLoginUrl("https://notclaude.ai/login")).toBeNull();
+    });
+    it("rejects a URL that embeds credentials or a port", () => {
+        expect(normalizeClaudeLoginUrl("https://user:pass@claude.ai/login")).toBeNull();
+        expect(normalizeClaudeLoginUrl("https://claude.ai:8443/login")).toBeNull();
+    });
+    it("returns null for empty or malformed input", () => {
+        expect(normalizeClaudeLoginUrl(null)).toBeNull();
+        expect(normalizeClaudeLoginUrl(undefined)).toBeNull();
+        expect(normalizeClaudeLoginUrl("not a url")).toBeNull();
+    });
+});
+describe("buildClaudeLoginRequiredHint", () => {
+    it("names a safe login URL in the hint", () => {
+        expect(buildClaudeLoginRequiredHint("https://claude.ai/login")).toBe("Run `claude login` and complete sign-in at https://claude.ai/login, then retry.");
+    });
+    it("falls back to the fixed hint for an unsafe URL", () => {
+        expect(buildClaudeLoginRequiredHint("https://evil.example.com/claude-login?leak=secret")).toBe("Run `claude login` in this environment, then retry the probe.");
+    });
+    it("falls back to the fixed hint for a null URL", () => {
+        expect(buildClaudeLoginRequiredHint(null)).toBe("Run `claude login` in this environment, then retry the probe.");
+    });
+});
+describe("classifyThrownErrorClass", () => {
+    it("returns the constructor name for an Error", () => {
+        expect(classifyThrownErrorClass(new TypeError("boom"))).toBe("TypeError");
+        expect(classifyThrownErrorClass(new Error("boom"))).toBe("Error");
+    });
+    it("returns null for a non-Error value", () => {
+        expect(classifyThrownErrorClass("a raw secret string")).toBeNull();
+        expect(classifyThrownErrorClass(null)).toBeNull();
+        expect(classifyThrownErrorClass({ message: "opaque" })).toBeNull();
+    });
+});
+describe("logSandboxProbeDiagnostic", () => {
+    it("logs only the fixed context and the allowlisted classification", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        logSandboxProbeDiagnostic("probe failed", "auth_required");
+        expect(warnSpy).toHaveBeenCalledTimes(1);
+        expect(warnSpy).toHaveBeenCalledWith("[paperclip] probe failed", {
+            classification: "auth_required",
+        });
+        warnSpy.mockRestore();
+    });
+    it("adds a finite exit code as a structured field", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: 3 });
+        expect(warnSpy).toHaveBeenCalledWith("[paperclip] probe failed", {
+            classification: "nonzero_exit",
+            exitCode: 3,
+        });
+        warnSpy.mockRestore();
+    });
+    it("drops a null or non-finite exit code", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: null });
+        logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: Number.NaN });
+        for (const call of warnSpy.mock.calls) {
+            expect(call[1]).toEqual({ classification: "nonzero_exit" });
+        }
+        warnSpy.mockRestore();
+    });
+    it("sanitizes the error class to an identifier and bounds its length", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        // A crafted error class name that carries an opaque marker and a proxy URL.
+        // The sanitizer must strip every non-identifier character and bound the
+        // length, so no structured secret shape reaches the log.
+        logSandboxProbeDiagnostic("probe failed", "spawn_error", {
+            errorClass: `MARKER-LEAK http://user:pass@proxy.internal:8080/path?t=${"x".repeat(200)}`,
+        });
+        expect(warnSpy).toHaveBeenCalledTimes(1);
+        const detail = warnSpy.mock.calls[0][1];
+        expect(detail.errorClass).toMatch(/^[A-Za-z0-9_$]+$/);
+        expect(detail.errorClass.length).toBeLessThanOrEqual(64);
+        // The separators and the proxy structure do not survive.
+        expect(detail.errorClass).not.toContain("-");
+        expect(detail.errorClass).not.toContain(":");
+        expect(detail.errorClass).not.toContain("/");
+        warnSpy.mockRestore();
+    });
+    it("drops an empty or non-string error class", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        logSandboxProbeDiagnostic("probe failed", "spawn_error", { errorClass: null });
+        logSandboxProbeDiagnostic("probe failed", "spawn_error", { errorClass: "***" });
+        for (const call of warnSpy.mock.calls) {
+            expect(call[1]).toEqual({ classification: "spawn_error" });
+        }
+        warnSpy.mockRestore();
+    });
+});
+//# sourceMappingURL=probe-diagnostics.test.js.map

package/dist/server/probe-diagnostics.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-diagnostics.test.js","sourceRoot":"","sources":["../../src/server/probe-diagnostics.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,uBAAuB,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI,CACzE,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,uBAAuB,CAAC,sCAAsC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,uBAAuB,CAAC,6CAA6C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,uBAAuB,CAAC,uCAAuC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,uBAAuB,CAAC,kCAAkC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/E,MAAM,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,uBAAuB,CAAC,mCAAmC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChF,MAAM,CAAC,uBAAuB,CAAC,8BAA8B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,4BAA4B,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAClE,iFAAiF,CAClF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,4BAA4B,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAC5F,+DAA+D,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC7C,+DAA+D,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,yBAAyB,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,0BAA0B,EAAE;YAC/D,cAAc,EAAE,eAAe;SAChC,CAAC,CAAC;QACH,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,yBAAyB,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,0BAA0B,EAAE;YAC/D,cAAc,EAAE,cAAc;YAC9B,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,yBAAyB,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,yBAAyB,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,4EAA4E;QAC5E,wEAAwE;QACxE,yDAAyD;QACzD,yBAAyB,CAAC,cAAc,EAAE,aAAa,EAAE;YACvD,UAAU,EAAE,2DAA2D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzF,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAA4B,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC1D,yDAAyD;QACzD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,yBAAyB,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,yBAAyB,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/probe-env.d.ts

@@ -0,0 +1,42 @@
+export interface LocalProbeEnvironment {
+    /**
+     * The trusted absolute path to the resolved `claude` executable, or `null`
+     * when the trusted server PATH holds no `claude`. The caller must not run a
+     * local probe when this is `null`; it reports a probe-unavailable check
+     * instead.
+     */
+    command: string | null;
+    /**
+     * The child environment for the local probe. It holds only allowlisted
+     * caller values plus proxy values from the trusted input. It never holds a
+     * caller-supplied proxy key, a loader variable, a PATH override, or a Windows
+     * interpreter variable.
+     */
+    env: Record<string, string>;
+}
+/**
+ * Build the child environment and executable for a local Claude adapter-test
+ * hello probe. Both the ACP Test lane and the Claude CLI Test lane use this
+ * builder, so the two lanes probe the host the same safe way.
+ *
+ * The builder denies by default. It never merges the arbitrary caller env into
+ * a host base. It reads two separate inputs:
+ *   - `callerEnv`: the untrusted adapter-config env from the Test request. The
+ *     builder takes only allowlisted Claude, auth, and Bedrock keys from it. It
+ *     discards every proxy key and every Windows interpreter key, in any case.
+ *   - `trustedEnv`: the trusted server-resolved env (the server launch config
+ *     and the authorized environment's server-resolved env). The builder takes
+ *     proxy keys only from this input.
+ *
+ * The builder resolves `claude` to a trusted absolute executable with the
+ * trusted server PATH, before it reads any caller value. It ignores a caller
+ * `command` path.
+ *
+ * The builder never logs, returns, or reflects a proxy value in a check.
+ */
+export declare function buildLocalAdapterTestProbeEnv(input: {
+    callerEnv: Record<string, string>;
+    trustedEnv?: NodeJS.ProcessEnv;
+    commandName?: string;
+}): Promise<LocalProbeEnvironment>;
+//# sourceMappingURL=probe-env.d.ts.map

package/dist/server/probe-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-env.d.ts","sourceRoot":"","sources":["../../src/server/probe-env.ts"],"names":[],"mappings":"AA+CA,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AA4DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwCjC"}

package/dist/server/probe-env.js

@@ -0,0 +1,149 @@
+import { access } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import path from "node:path";
+/**
+ * The environment variable names that a local Claude adapter-test probe may
+ * take from the untrusted adapter configuration. The builder denies every
+ * other key by default. The list holds the documented Claude, Anthropic auth,
+ * and AWS Bedrock variables that the probe needs to reach the real credential
+ * the agent run uses.
+ */
+const LOCAL_PROBE_ALLOWED_CALLER_ENV_KEYS = [
+    // Claude and Anthropic subscription and API auth.
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_MODEL",
+    "ANTHROPIC_SMALL_FAST_MODEL",
+    "CLAUDE_CONFIG_DIR",
+    // AWS Bedrock inference.
+    "CLAUDE_CODE_USE_BEDROCK",
+    "ANTHROPIC_BEDROCK_BASE_URL",
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_PROFILE",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION",
+];
+/**
+ * The proxy variable names the probe may forward. The builder reads these only
+ * from the trusted server-resolved input. It never reads a proxy key from the
+ * untrusted caller input, and it never logs, returns, or reflects a proxy
+ * value.
+ */
+const PROXY_ENV_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"];
+/**
+ * Windows interpreter-selection variables. The builder never takes these from
+ * any input. The child-process launcher derives the interpreter from trusted
+ * server state instead, so a caller value must never reach the child env.
+ */
+const WINDOWS_INTERPRETER_ENV_KEYS = new Set(["SYSTEMROOT", "WINDIR", "COMSPEC"]);
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function readCaseInsensitive(source, key) {
+    const direct = source[key];
+    if (typeof direct === "string")
+        return direct;
+    const upper = key.toUpperCase();
+    for (const [candidateKey, candidateValue] of Object.entries(source)) {
+        if (candidateKey.toUpperCase() === upper && typeof candidateValue === "string") {
+            return candidateValue;
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolve a command name to a trusted absolute executable. The function reads
+ * the PATH and PATHEXT from the trusted server env only. It never reads a
+ * caller value, so a hostile caller PATH cannot select the executable. The
+ * function ignores a command that contains a path separator; a local probe
+ * must not run a caller-supplied executable path.
+ */
+async function resolveTrustedExecutable(commandName, trustedEnv) {
+    if (commandName.includes("/") || commandName.includes("\\")) {
+        return null;
+    }
+    const pathValue = trustedEnv.PATH ?? trustedEnv.Path ?? "";
+    const delimiter = process.platform === "win32" ? ";" : ":";
+    const dirs = pathValue.split(delimiter).filter(Boolean);
+    const exts = process.platform === "win32"
+        ? (trustedEnv.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean)
+        : [""];
+    const mode = process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK;
+    for (const dir of dirs) {
+        const candidates = process.platform === "win32"
+            ? exts.map((ext) => path.join(dir, `${commandName}${ext}`))
+            : [path.join(dir, commandName)];
+        for (const candidate of candidates) {
+            try {
+                await access(candidate, mode);
+                return candidate;
+            }
+            catch {
+                // Try the next candidate.
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Build the child environment and executable for a local Claude adapter-test
+ * hello probe. Both the ACP Test lane and the Claude CLI Test lane use this
+ * builder, so the two lanes probe the host the same safe way.
+ *
+ * The builder denies by default. It never merges the arbitrary caller env into
+ * a host base. It reads two separate inputs:
+ *   - `callerEnv`: the untrusted adapter-config env from the Test request. The
+ *     builder takes only allowlisted Claude, auth, and Bedrock keys from it. It
+ *     discards every proxy key and every Windows interpreter key, in any case.
+ *   - `trustedEnv`: the trusted server-resolved env (the server launch config
+ *     and the authorized environment's server-resolved env). The builder takes
+ *     proxy keys only from this input.
+ *
+ * The builder resolves `claude` to a trusted absolute executable with the
+ * trusted server PATH, before it reads any caller value. It ignores a caller
+ * `command` path.
+ *
+ * The builder never logs, returns, or reflects a proxy value in a check.
+ */
+export async function buildLocalAdapterTestProbeEnv(input) {
+    const trustedEnv = input.trustedEnv ?? process.env;
+    const commandName = input.commandName ?? "claude";
+    const command = await resolveTrustedExecutable(commandName, trustedEnv);
+    const env = {};
+    // Allowlisted caller values. Read each allowed key by name so no unexpected
+    // caller key can enter the child env. Proxy and Windows interpreter keys are
+    // never in the allowlist, so a caller cannot pass them here.
+    for (const key of LOCAL_PROBE_ALLOWED_CALLER_ENV_KEYS) {
+        const value = readCaseInsensitive(input.callerEnv, key);
+        if (isNonEmptyString(value)) {
+            env[key] = value;
+        }
+    }
+    // Proxy values come from the trusted input only. A caller-supplied proxy key
+    // in `callerEnv` is never read, so it cannot reach the child.
+    for (const key of PROXY_ENV_KEYS) {
+        const upperValue = trustedEnv[key];
+        if (isNonEmptyString(upperValue)) {
+            env[key] = upperValue;
+        }
+        const lowerKey = key.toLowerCase();
+        const lowerValue = trustedEnv[lowerKey];
+        if (isNonEmptyString(lowerValue)) {
+            env[lowerKey] = lowerValue;
+        }
+    }
+    // Defense in depth: strip any Windows interpreter key that a future allowlist
+    // edit might introduce, in any case.
+    for (const key of Object.keys(env)) {
+        if (WINDOWS_INTERPRETER_ENV_KEYS.has(key.toUpperCase())) {
+            delete env[key];
+        }
+    }
+    return { command, env };
+}
+//# sourceMappingURL=probe-env.js.map

package/dist/server/probe-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-env.js","sourceRoot":"","sources":["../../src/server/probe-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,mCAAmC,GAAG;IAC1C,kDAAkD;IAClD,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,iBAAiB;IACjB,4BAA4B;IAC5B,mBAAmB;IACnB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,oBAAoB;CACZ,CAAC;AAEX;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AAE1E;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAmBlF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA0C,EAC1C,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC/E,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,WAAmB,EACnB,UAA6B;IAE7B,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1E,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAExE,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,4EAA4E;IAC5E,6EAA6E;IAC7E,6DAA6D;IAC7D,KAAK,MAAM,GAAG,IAAI,mCAAmC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8DAA8D;IAC9D,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC"}

package/dist/server/probe-env.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=probe-env.test.d.ts.map

package/dist/server/probe-env.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-env.test.d.ts","sourceRoot":"","sources":["../../src/server/probe-env.test.ts"],"names":[],"mappings":""}

package/dist/server/probe-env.test.js

@@ -0,0 +1,135 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { buildLocalAdapterTestProbeEnv } from "./probe-env.js";
+const tempDirs = [];
+async function makeTrustedPathWithClaude() {
+    const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-probe-env-"));
+    tempDirs.push(dir);
+    const claudePath = path.join(dir, "claude");
+    await writeFile(claudePath, "#!/bin/sh\nexit 0\n");
+    await chmod(claudePath, 0o755);
+    return { dir, claudePath };
+}
+afterEach(async () => {
+    while (tempDirs.length > 0) {
+        const dir = tempDirs.pop();
+        if (dir)
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+});
+describe("buildLocalAdapterTestProbeEnv", () => {
+    it("resolves claude from the trusted PATH and ignores the caller PATH", async () => {
+        const { dir, claudePath } = await makeTrustedPathWithClaude();
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: { PATH: "/hostile/bin", Path: "/hostile/bin", command: "/tmp/evil/claude" },
+            trustedEnv: { PATH: dir },
+        });
+        expect(built.command).toBe(claudePath);
+        expect(built.env.PATH).toBeUndefined();
+        expect(built.env.Path).toBeUndefined();
+    });
+    it("returns a null command when the trusted PATH holds no claude", async () => {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-probe-env-empty-"));
+        tempDirs.push(dir);
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: {},
+            trustedEnv: { PATH: dir },
+        });
+        expect(built.command).toBeNull();
+    });
+    it("keeps the allowlisted Claude, auth, and Bedrock values", async () => {
+        const { dir } = await makeTrustedPathWithClaude();
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: {
+                ANTHROPIC_API_KEY: "api-key-value",
+                CLAUDE_CODE_OAUTH_TOKEN: "oauth-token-value",
+                CLAUDE_CODE_USE_BEDROCK: "1",
+                ANTHROPIC_BEDROCK_BASE_URL: "https://bedrock.example",
+                AWS_ACCESS_KEY_ID: "aws-key",
+                AWS_SECRET_ACCESS_KEY: "aws-secret",
+                AWS_REGION: "us-east-1",
+                CLAUDE_CONFIG_DIR: "/managed/config",
+            },
+            trustedEnv: { PATH: dir },
+        });
+        expect(built.env.ANTHROPIC_API_KEY).toBe("api-key-value");
+        expect(built.env.CLAUDE_CODE_OAUTH_TOKEN).toBe("oauth-token-value");
+        expect(built.env.CLAUDE_CODE_USE_BEDROCK).toBe("1");
+        expect(built.env.ANTHROPIC_BEDROCK_BASE_URL).toBe("https://bedrock.example");
+        expect(built.env.AWS_ACCESS_KEY_ID).toBe("aws-key");
+        expect(built.env.AWS_SECRET_ACCESS_KEY).toBe("aws-secret");
+        expect(built.env.AWS_REGION).toBe("us-east-1");
+        expect(built.env.CLAUDE_CONFIG_DIR).toBe("/managed/config");
+    });
+    it("drops hostile loader, PATH, shell-startup, and Windows interpreter keys", async () => {
+        const { dir } = await makeTrustedPathWithClaude();
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: {
+                PATH: "/hostile/bin",
+                Path: "/hostile/bin",
+                PATHEXT: ".EVIL",
+                LD_PRELOAD: "/hostile/lib/evil.so",
+                LD_LIBRARY_PATH: "/hostile/lib",
+                DYLD_INSERT_LIBRARIES: "/hostile/lib/evil.dylib",
+                DYLD_LIBRARY_PATH: "/hostile/lib",
+                NODE_OPTIONS: "--require /hostile/evil.js",
+                ENV: "/hostile/profile",
+                BASH_ENV: "/hostile/bashrc",
+                SystemRoot: "C:\\hostile",
+                systemroot: "C:\\hostile",
+                WINDIR: "C:\\hostile",
+                windir: "C:\\hostile",
+                ComSpec: "C:\\hostile\\evil.exe",
+                comspec: "C:\\hostile\\evil.exe",
+            },
+            trustedEnv: { PATH: dir },
+        });
+        for (const key of Object.keys(built.env)) {
+            expect(key.toUpperCase()).not.toBe("PATH");
+            expect(key.toUpperCase()).not.toBe("PATHEXT");
+            expect(key.toUpperCase()).not.toBe("LD_PRELOAD");
+            expect(key.toUpperCase()).not.toBe("LD_LIBRARY_PATH");
+            expect(key.toUpperCase()).not.toBe("DYLD_INSERT_LIBRARIES");
+            expect(key.toUpperCase()).not.toBe("DYLD_LIBRARY_PATH");
+            expect(key.toUpperCase()).not.toBe("NODE_OPTIONS");
+            expect(key.toUpperCase()).not.toBe("ENV");
+            expect(key.toUpperCase()).not.toBe("BASH_ENV");
+            expect(key.toUpperCase()).not.toBe("SYSTEMROOT");
+            expect(key.toUpperCase()).not.toBe("WINDIR");
+            expect(key.toUpperCase()).not.toBe("COMSPEC");
+        }
+    });
+    it("takes proxy values only from the trusted env, never from the caller", async () => {
+        const { dir } = await makeTrustedPathWithClaude();
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: {
+                HTTP_PROXY: "http://caller-proxy:8080",
+                HTTPS_PROXY: "http://caller-proxy:8443",
+                http_proxy: "http://caller-proxy-lower:8080",
+                NO_PROXY: "caller.example",
+            },
+            trustedEnv: { PATH: dir, HTTPS_PROXY: "http://trusted-proxy:8443" },
+        });
+        // The trusted proxy reaches the child; the caller proxy does not.
+        expect(built.env.HTTPS_PROXY).toBe("http://trusted-proxy:8443");
+        expect(built.env.HTTP_PROXY).toBeUndefined();
+        expect(built.env.http_proxy).toBeUndefined();
+        expect(built.env.NO_PROXY).toBeUndefined();
+        // No env value carries the caller proxy host.
+        const serialized = JSON.stringify(built.env);
+        expect(serialized).not.toContain("caller-proxy");
+    });
+    it("forwards no proxy variable when the trusted env has none", async () => {
+        const { dir } = await makeTrustedPathWithClaude();
+        const built = await buildLocalAdapterTestProbeEnv({
+            callerEnv: { HTTP_PROXY: "http://caller-proxy:8080", https_proxy: "http://caller:8443" },
+            trustedEnv: { PATH: dir },
+        });
+        for (const key of Object.keys(built.env)) {
+            expect(key.toUpperCase()).not.toContain("PROXY");
+        }
+    });
+});
+//# sourceMappingURL=probe-env.test.js.map

package/dist/server/probe-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-env.test.js","sourceRoot":"","sources":["../../src/server/probe-env.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,MAAM,QAAQ,GAAa,EAAE,CAAC;AAE9B,KAAK,UAAU,yBAAyB;IACtC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,GAAG;YAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE;YACtF,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE;gBACT,iBAAiB,EAAE,eAAe;gBAClC,uBAAuB,EAAE,mBAAmB;gBAC5C,uBAAuB,EAAE,GAAG;gBAC5B,0BAA0B,EAAE,yBAAyB;gBACrD,iBAAiB,EAAE,SAAS;gBAC5B,qBAAqB,EAAE,YAAY;gBACnC,UAAU,EAAE,WAAW;gBACvB,iBAAiB,EAAE,iBAAiB;aACrC;YACD,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,sBAAsB;gBAClC,eAAe,EAAE,cAAc;gBAC/B,qBAAqB,EAAE,yBAAyB;gBAChD,iBAAiB,EAAE,cAAc;gBACjC,YAAY,EAAE,4BAA4B;gBAC1C,GAAG,EAAE,kBAAkB;gBACvB,QAAQ,EAAE,iBAAiB;gBAC3B,UAAU,EAAE,aAAa;gBACzB,UAAU,EAAE,aAAa;gBACzB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,uBAAuB;gBAChC,OAAO,EAAE,uBAAuB;aACjC;YACD,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE;gBACT,UAAU,EAAE,0BAA0B;gBACtC,WAAW,EAAE,0BAA0B;gBACvC,UAAU,EAAE,gCAAgC;gBAC5C,QAAQ,EAAE,gBAAgB;aAC3B;YACD,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE;SACpE,CAAC,CAAC;QACH,kEAAkE;QAClE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3C,8CAA8C;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,SAAS,EAAE,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,oBAAoB,EAAE;YACxF,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/probe-redaction.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=probe-redaction.test.d.ts.map