pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/address.js

@@ -0,0 +1,153 @@
+/**
+ * IP-literal / CIDR helpers over `net.BlockList`, shared by the
+ * resolved-address guard, the parent-proxy NO_PROXY matcher and config
+ * validation.
+ */
+import { BlockList, isIP } from 'node:net';
+/** Loopback in both families (BlockList matches IPv4-mapped forms against the IPv4 rule). */
+export const LOOPBACK_RANGES = ['127.0.0.0/8', '::1'];
+/** BlockList family of an address string, or undefined if it is not an IP. */
+function ipFamily(address) {
+    const fam = isIP(address);
+    return fam === 4 ? 'ipv4' : fam === 6 ? 'ipv6' : undefined;
+}
+/**
+ * Parse an IP literal or CIDR range (`10.0.0.0/8`, `fc00::/7`, `::1`) into
+ * the one form rules are stored in: an IPv4-mapped IPv6 entry becomes the
+ * IPv4 rule it stands for (`::ffff:10.0.0.0/104` → `10.0.0.0/8`) and a zone
+ * id is dropped, since matching treats both spellings alike and some
+ * runtimes mis-evaluate or refuse the IPv6 ones. Undefined for anything
+ * else; IPv6 is unbracketed.
+ */
+export function parseAddressRange(entry) {
+    const slash = entry.indexOf('/');
+    const address = stripZone(slash === -1 ? entry : entry.slice(0, slash));
+    const family = ipFamily(address);
+    if (!family)
+        return undefined;
+    const max = family === 'ipv6' ? 128 : 32;
+    let prefix = max;
+    if (slash !== -1) {
+        const raw = entry.slice(slash + 1);
+        if (!/^\d{1,3}$/.test(raw) || Number(raw) > max)
+            return undefined;
+        prefix = Number(raw);
+    }
+    const mapped = family === 'ipv6' ? mappedIPv4(address) : undefined;
+    if (mapped !== undefined) {
+        return prefix < 96
+            ? undefined
+            : { address: mapped, prefix: prefix - 96, family: 'ipv4' };
+    }
+    return { address, prefix, family };
+}
+/** Add an IP literal or CIDR range to `list`; false (list untouched) if malformed or refused by the runtime. */
+export function addRange(list, entry) {
+    const range = parseAddressRange(entry);
+    if (!range)
+        return false;
+    try {
+        list.addSubnet(range.address, range.prefix, range.family);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/**
+ * Build a BlockList from IP/CIDR entries. Throws on a malformed entry — the
+ * config schema validates first, so a throw here means a caller bypassed it.
+ */
+function buildAddressSet(entries) {
+    const list = new BlockList();
+    for (const entry of entries) {
+        if (!addRange(list, entry)) {
+            throw new Error(`Invalid IP address or CIDR range: ${JSON.stringify(entry)}`);
+        }
+    }
+    return list;
+}
+/**
+ * BlockList membership for an address string of either family. IPv4 rules
+ * also match the IPv4-mapped IPv6 spelling (BlockList does that itself);
+ * an IPv6 zone id (`fe80::1%en0`) is dropped first because a zoned address
+ * is a non-match on some runtimes.
+ */
+export function addressInSet(list, address) {
+    const addr = stripZone(address);
+    const family = ipFamily(addr);
+    return family !== undefined && list.check(addr, family);
+}
+/** Drop an IPv6 zone id (`fe80::1%en0` → `fe80::1`). */
+function stripZone(address) {
+    const pct = address.indexOf('%');
+    return pct === -1 ? address : address.slice(0, pct);
+}
+/** The eight 16-bit groups of an IPv6 literal (zone dropped), or undefined. */
+function ipv6Groups(address) {
+    let host;
+    try {
+        host = new URL(`http://[${stripZone(address)}]/`).hostname.slice(1, -1);
+    }
+    catch {
+        return undefined;
+    }
+    const [head = '', tail] = host.split('::');
+    const lead = head ? head.split(':') : [];
+    const rest = tail ? tail.split(':') : [];
+    const fill = tail === undefined ? 0 : 8 - lead.length - rest.length;
+    if (fill < 0 || lead.length + fill + rest.length !== 8)
+        return undefined;
+    return [...lead, ...Array(fill).fill('0'), ...rest].map(g => parseInt(g, 16));
+}
+const dottedQuad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+/** The IPv4 address of an IPv4-mapped IPv6 literal (`::ffff:a.b.c.d`), or undefined. */
+export function mappedIPv4(address) {
+    // Cheap reject before the URL parse: a mapped form always spells `ffff`.
+    if (!/ffff/i.test(address))
+        return undefined;
+    const g = ipv6Groups(address);
+    return g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff
+        ? dottedQuad(g[6], g[7])
+        : undefined;
+}
+/**
+ * The IPv4 address an IPv6 address carries in one of the forms a network
+ * delivers to that IPv4 destination: IPv4-mapped and IPv4-compatible
+ * (`::ffff:0:0/96`, `::/96`), IPv4-translated (`::ffff:0:0:0/96`), the NAT64
+ * well-known prefix (`64:ff9b::/96`) and 6to4 (`2002::/16`). Undefined for
+ * anything else — including the local-use NAT64 prefix `64:ff9b:1::/48` and
+ * network-specific prefixes, whose layout (RFC 6052 §2.2 allows /32…/96)
+ * cannot be told from the address, so the embedded IPv4 could be anywhere;
+ * an embedder on such a network lists the prefix's translations of the
+ * ranges it denies.
+ */
+export function embeddedIPv4(address) {
+    if (isIP(address) !== 6)
+        return undefined;
+    const g = ipv6Groups(address);
+    if (!g)
+        return undefined;
+    const zero = (from, to) => g.slice(from, to).every(x => x === 0);
+    if (g[0] === 0x2002)
+        return dottedQuad(g[1], g[2]);
+    const low = dottedQuad(g[6], g[7]);
+    if (g[0] === 0x64 && g[1] === 0xff9b && zero(2, 6))
+        return low; // NAT64 /96
+    if (zero(0, 5) && (g[5] === 0 || g[5] === 0xffff))
+        return low;
+    if (zero(0, 4) && g[4] === 0xffff && g[5] === 0)
+        return low;
+    return undefined;
+}
+const LOOPBACK = buildAddressSet(LOOPBACK_RANGES);
+/** True for an IPv4/IPv6 loopback literal (including v4-mapped forms). */
+export function isLoopbackAddress(address) {
+    return addressInSet(LOOPBACK, address);
+}
+/** `localhost` and names under `.localhost` (RFC 6761 §6.3). */
+export function isLoopbackName(hostname) {
+    const h = hostname.toLowerCase().replace(/\.$/, '');
+    return h === 'localhost' || h.endsWith('.localhost');
+}
+//# sourceMappingURL=address.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/sandbox/address.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;AAIxE,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACzB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,IAAI,MAAM,GAAG,GAAG,CAAA;IAChB,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG;YAAE,OAAO,SAAS,CAAA;QACjE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,GAAG,EAAE;YAChB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC9D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACpC,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,QAAQ,CAAC,IAAe,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAA0B;IACjD,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAA;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,wDAAwD;AACxD,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACnE,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAClE,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAChB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAU,EAAU,EAAE,CACpD,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAA;AAEjD,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,yEAAyE;IACzE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5C,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAC9D,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC1B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACxC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACvC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IACpC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,GAAG,CAAA,CAAC,YAAY;IAC3E,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QAAE,OAAO,GAAG,CAAA;IAC7D,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,eAAe,CAAC,eAAe,CAAC,CAAA;AAEjD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AACxC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACtD,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/aws-sigv4.d.ts

@@ -0,0 +1,164 @@
+/**
+ * AWS Signature Version 4 protocol code for the TLS-terminating proxy.
+ *
+ * A masked AWS credential hands the sandboxed process a fake access key id
+ * and secret, so any SigV4 signature the client computes is an HMAC over
+ * the fake secret — header substitution can swap the access key id in the
+ * credential scope, but it cannot fix the signature. The proxy therefore
+ * re-signs: strip the client's Authorization, keep its credential scope /
+ * signed-header set / x-amz-date, and recompute the signature with the
+ * real secret over the request as it actually goes upstream. Prior art:
+ * awslabs/aws-sigv4-proxy.
+ *
+ * This module is pure protocol code — request classification,
+ * Authorization parsing, canonical-request construction, and signing —
+ * validated against the official aws-sig-v4-test-suite vectors
+ * (test/fixtures/aws-sigv4-suite). The credential-pair registry and the
+ * proxy-side planner live in credential-aws-pairs.ts.
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+export declare const SIGV4_ALGORITHM = "AWS4-HMAC-SHA256";
+export declare const SIGV4A_ALGORITHM = "AWS4-ECDSA-P256-SHA256";
+export declare const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+/**
+ * How a request references AWS SigV4 authentication:
+ *
+ * - `header-sigv4`: Authorization is `AWS4-HMAC-SHA256 ...` — the case the
+ *   proxy can re-sign.
+ * - `streaming`: `x-amz-content-sha256` declares an aws-chunked payload
+ *   (`STREAMING-*`) whose chunk signatures chain off the seed signature —
+ *   re-signing would require rewriting the body's per-chunk signatures.
+ * - `presigned`: the signature lives in the query (`X-Amz-Algorithm` /
+ *   `X-Amz-Signature`) — re-signing would rewrite the URL itself. Applies
+ *   whenever the Authorization header does not itself classify: a non-AWS
+ *   Authorization value (e.g. `Basic ...`) must not exempt the query, or
+ *   adding a junk header would bypass the presigned policy.
+ * - `sigv4a`: Authorization is `AWS4-ECDSA-P256-SHA256 ...` — asymmetric
+ *   signing keyed off the secret via ECDSA; there is no shared-key HMAC to
+ *   recompute without the client's derived private key.
+ */
+export type Sigv4Kind = 'header-sigv4' | 'streaming' | 'presigned' | 'sigv4a';
+export interface Sigv4Detection {
+    kind: Sigv4Kind;
+    /**
+     * Access key id the signature references — from the Authorization
+     * `Credential=<akid>/...` scope, or `X-Amz-Credential` in the query for
+     * presigned URLs. Callers exact-match this against registered masked
+     * pairs to decide whether the request is theirs to handle.
+     */
+    accessKeyId: string;
+}
+/**
+ * Classify a request's SigV4 shape from headers and the request-target
+ * only (no body inspection). Returns null when the request carries no
+ * recognizable SigV4 signature.
+ */
+export declare function detectSigv4(headers: IncomingHttpHeaders, requestTarget: string): Sigv4Detection | null;
+export interface ParsedSigv4Authorization {
+    accessKeyId: string;
+    /** Credential-scope date (yyyymmdd). */
+    date: string;
+    region: string;
+    service: string;
+    /** Lowercase signed header names, in the order the client listed them. */
+    signedHeaders: string[];
+    signature: string;
+}
+/**
+ * Parse an `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=...,
+ * Signature=...` Authorization value. Returns null when any component is
+ * missing or the credential scope is not the 5-part
+ * `<akid>/<date>/<region>/<service>/aws4_request` form.
+ */
+export declare function parseSigv4Authorization(auth: string): ParsedSigv4Authorization | null;
+/**
+ * Strict RFC 3986 percent-encoding: everything except unreserved
+ * characters (A-Za-z0-9 - _ . ~) is encoded. encodeURIComponent leaves
+ * `!'()*` raw; SigV4 requires them encoded.
+ */
+export declare function uriEncode(s: string): string;
+/**
+ * Canonical URI per SigV4: for S3 the raw request path is used verbatim
+ * (no dot-segment normalization, no re-encoding — S3 object keys are
+ * byte-significant and the service verifies against the wire path); for
+ * every other service, dot segments are resolved and the path is
+ * percent-encoded once more on top of its wire encoding ('/' preserved).
+ * Matches the AWS SDK signer (smithy SignatureV4.getCanonicalPath) and
+ * awslabs/aws-sigv4-proxy, which disables path escaping for s3 only.
+ */
+export declare function canonicalUri(rawPath: string, service: string): string;
+/**
+ * Canonical query string per SigV4: each key and value is decoded then
+ * strictly re-encoded, pairs are sorted by encoded key then encoded
+ * value, and joined with '&'. A literal '+' is treated as a plus (RFC
+ * 3986), not a space.
+ */
+export declare function canonicalQueryString(rawQuery: string): string;
+export interface Sigv4SignInput {
+    method: string;
+    /**
+     * Origin-form request-target exactly as forwarded upstream
+     * (`/path?query`). The canonical URI/query are derived from it.
+     */
+    requestTarget: string;
+    /**
+     * Headers as they will be sent upstream. `host` is not looked up here —
+     * its value comes from `hostHeader`.
+     */
+    headers: IncomingHttpHeaders;
+    /** Host header value the upstream connection will carry. */
+    hostHeader: string;
+    /**
+     * Lowercase header names to sign. Sorted internally; every name other
+     * than `host` must be present in `headers`.
+     */
+    signedHeaders: readonly string[];
+    /** Hex SHA-256 of the payload, or the UNSIGNED-PAYLOAD marker. */
+    payloadHash: string;
+    /** ISO 8601 basic timestamp (e.g. 20150830T123600Z). */
+    amzDate: string;
+    scope: {
+        date: string;
+        region: string;
+        service: string;
+    };
+}
+/**
+ * Build the SigV4 canonical request. Throws if a signed header (other
+ * than `host`) is absent from `headers` — the caller must have validated
+ * presence, since signing an empty value the upstream never sees would
+ * produce a signature the service rejects confusingly.
+ */
+export declare function buildCanonicalRequest(input: Sigv4SignInput): string;
+/** String-to-sign over a canonical request. */
+export declare function buildStringToSign(canonicalRequest: string, amzDate: string, scope: {
+    date: string;
+    region: string;
+    service: string;
+}): string;
+/** kSigning = HMAC-chain(AWS4+secret, date, region, service, terminator). */
+export declare function deriveSigningKey(secretAccessKey: string, scope: {
+    date: string;
+    region: string;
+    service: string;
+}): Buffer;
+export interface Sigv4SignResult {
+    /** Full Authorization header value. */
+    authorization: string;
+    signature: string;
+    canonicalRequest: string;
+    stringToSign: string;
+}
+/**
+ * Sign a request with SigV4. The caller supplies the credential scope and
+ * timestamp taken from the client's (fake-signed) request so the re-signed
+ * request stays byte-compatible with what the client believes it sent.
+ */
+export declare function signSigv4(input: Sigv4SignInput & {
+    accessKeyId: string;
+    secretAccessKey: string;
+}): Sigv4SignResult;
+export declare function sha256Hex(data: string | Buffer): string;
+/** First value of a possibly-repeated header, or undefined. */
+export declare function singleHeader(v: string | string[] | undefined): string | undefined;
+//# sourceMappingURL=aws-sigv4.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/aws-sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.d.ts","sourceRoot":"","sources":["../../src/sandbox/aws-sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,eAAO,MAAM,eAAe,qBAAqB,CAAA;AACjD,eAAO,MAAM,gBAAgB,2BAA2B,CAAA;AACxD,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAA;IACf;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,MAAM,GACpB,cAAc,GAAG,IAAI,CAgCvB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX,wBAAwB,GAAG,IAAI,CAkBjC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAc7D;AAeD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,EAAE,mBAAmB,CAAA;IAC5B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CA2BnE;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAC/B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD,MAAM,CAOR;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD,MAAM,CAKR;AAED,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvE,eAAe,CAuBjB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvD;AAMD,+DAA+D;AAC/D,wBAAgB,YAAY,CAC1B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAEpB"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/aws-sigv4.js

@@ -0,0 +1,246 @@
+/**
+ * AWS Signature Version 4 protocol code for the TLS-terminating proxy.
+ *
+ * A masked AWS credential hands the sandboxed process a fake access key id
+ * and secret, so any SigV4 signature the client computes is an HMAC over
+ * the fake secret — header substitution can swap the access key id in the
+ * credential scope, but it cannot fix the signature. The proxy therefore
+ * re-signs: strip the client's Authorization, keep its credential scope /
+ * signed-header set / x-amz-date, and recompute the signature with the
+ * real secret over the request as it actually goes upstream. Prior art:
+ * awslabs/aws-sigv4-proxy.
+ *
+ * This module is pure protocol code — request classification,
+ * Authorization parsing, canonical-request construction, and signing —
+ * validated against the official aws-sig-v4-test-suite vectors
+ * (test/fixtures/aws-sigv4-suite). The credential-pair registry and the
+ * proxy-side planner live in credential-aws-pairs.ts.
+ */
+import { createHash, createHmac } from 'node:crypto';
+export const SIGV4_ALGORITHM = 'AWS4-HMAC-SHA256';
+export const SIGV4A_ALGORITHM = 'AWS4-ECDSA-P256-SHA256';
+export const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
+/**
+ * Classify a request's SigV4 shape from headers and the request-target
+ * only (no body inspection). Returns null when the request carries no
+ * recognizable SigV4 signature.
+ */
+export function detectSigv4(headers, requestTarget) {
+    const auth = singleHeader(headers.authorization);
+    if (auth !== undefined && auth.startsWith(SIGV4A_ALGORITHM)) {
+        const akid = credentialAccessKeyId(auth);
+        if (akid !== undefined)
+            return { kind: 'sigv4a', accessKeyId: akid };
+    }
+    else if (auth !== undefined && auth.startsWith(SIGV4_ALGORITHM)) {
+        const akid = credentialAccessKeyId(auth);
+        if (akid !== undefined) {
+            const contentSha = singleHeader(headers['x-amz-content-sha256']);
+            // Covers STREAMING-AWS4-HMAC-SHA256-PAYLOAD, its -TRAILER variant,
+            // and STREAMING-UNSIGNED-PAYLOAD-TRAILER: all declare an aws-chunked
+            // body the plain re-sign path cannot reproduce.
+            const kind = contentSha?.startsWith('STREAMING-')
+                ? 'streaming'
+                : 'header-sigv4';
+            return { kind, accessKeyId: akid };
+        }
+    }
+    // Presigned URL: the signature is in the query string. Checked whenever
+    // the Authorization header did not classify above — an unrecognized or
+    // malformed Authorization value alongside presigned sentinel params must
+    // not turn the request invisible to the presigned policy.
+    const q = requestTarget.indexOf('?');
+    if (q === -1)
+        return null;
+    const params = new URLSearchParams(requestTarget.slice(q + 1));
+    if (params.get('X-Amz-Algorithm') !== SIGV4_ALGORITHM)
+        return null;
+    if (!params.has('X-Amz-Signature'))
+        return null;
+    const credential = params.get('X-Amz-Credential');
+    if (!credential)
+        return null;
+    const akid = credential.split('/')[0];
+    return akid ? { kind: 'presigned', accessKeyId: akid } : null;
+}
+/** `Credential=<akid>/...` access key id from an Authorization value. */
+function credentialAccessKeyId(auth) {
+    const m = /Credential=([^/,\s]+)\//.exec(auth);
+    return m?.[1];
+}
+/**
+ * Parse an `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=...,
+ * Signature=...` Authorization value. Returns null when any component is
+ * missing or the credential scope is not the 5-part
+ * `<akid>/<date>/<region>/<service>/aws4_request` form.
+ */
+export function parseSigv4Authorization(auth) {
+    if (!auth.startsWith(SIGV4_ALGORITHM))
+        return null;
+    const cred = /Credential=([^,\s]+)/.exec(auth)?.[1];
+    const signedHeaders = /SignedHeaders=([^,\s]+)/.exec(auth)?.[1];
+    const signature = /Signature=([0-9a-fA-F]+)/.exec(auth)?.[1];
+    if (!cred || !signedHeaders || !signature)
+        return null;
+    const parts = cred.split('/');
+    if (parts.length !== 5 || parts[4] !== 'aws4_request')
+        return null;
+    const [accessKeyId, date, region, service] = parts;
+    if (!accessKeyId || !date || !region || !service)
+        return null;
+    return {
+        accessKeyId,
+        date,
+        region,
+        service,
+        signedHeaders: signedHeaders.split(';').map(h => h.toLowerCase()),
+        signature,
+    };
+}
+/**
+ * Strict RFC 3986 percent-encoding: everything except unreserved
+ * characters (A-Za-z0-9 - _ . ~) is encoded. encodeURIComponent leaves
+ * `!'()*` raw; SigV4 requires them encoded.
+ */
+export function uriEncode(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+}
+/**
+ * Canonical URI per SigV4: for S3 the raw request path is used verbatim
+ * (no dot-segment normalization, no re-encoding — S3 object keys are
+ * byte-significant and the service verifies against the wire path); for
+ * every other service, dot segments are resolved and the path is
+ * percent-encoded once more on top of its wire encoding ('/' preserved).
+ * Matches the AWS SDK signer (smithy SignatureV4.getCanonicalPath) and
+ * awslabs/aws-sigv4-proxy, which disables path escaping for s3 only.
+ */
+export function canonicalUri(rawPath, service) {
+    if (rawPath === '')
+        return '/';
+    if (service === 's3')
+        return rawPath;
+    const segments = [];
+    for (const seg of rawPath.split('/')) {
+        if (seg === '' || seg === '.')
+            continue;
+        if (seg === '..')
+            segments.pop();
+        else
+            segments.push(seg);
+    }
+    const trailing = segments.length > 0 && rawPath.endsWith('/') ? '/' : '';
+    const normalized = `/${segments.join('/')}${trailing}`;
+    return uriEncode(normalized).replace(/%2F/gi, '/');
+}
+/**
+ * Canonical query string per SigV4: each key and value is decoded then
+ * strictly re-encoded, pairs are sorted by encoded key then encoded
+ * value, and joined with '&'. A literal '+' is treated as a plus (RFC
+ * 3986), not a space.
+ */
+export function canonicalQueryString(rawQuery) {
+    if (rawQuery === '')
+        return '';
+    const pairs = [];
+    for (const part of rawQuery.split('&')) {
+        if (part === '')
+            continue;
+        const eq = part.indexOf('=');
+        const rawKey = eq === -1 ? part : part.slice(0, eq);
+        const rawValue = eq === -1 ? '' : part.slice(eq + 1);
+        pairs.push([uriEncode(safeDecode(rawKey)), uriEncode(safeDecode(rawValue))]);
+    }
+    pairs.sort(([ak, av], [bk, bv]) => ak < bk ? -1 : ak > bk ? 1 : av < bv ? -1 : av > bv ? 1 : 0);
+    return pairs.map(([k, v]) => `${k}=${v}`).join('&');
+}
+function safeDecode(s) {
+    try {
+        return decodeURIComponent(s);
+    }
+    catch {
+        return s;
+    }
+}
+/** SigV4 "trimall": strip leading/trailing whitespace, collapse runs. */
+function trimall(value) {
+    return value.trim().replace(/[ \t]+/g, ' ');
+}
+/**
+ * Build the SigV4 canonical request. Throws if a signed header (other
+ * than `host`) is absent from `headers` — the caller must have validated
+ * presence, since signing an empty value the upstream never sees would
+ * produce a signature the service rejects confusingly.
+ */
+export function buildCanonicalRequest(input) {
+    const q = input.requestTarget.indexOf('?');
+    const rawPath = q === -1 ? input.requestTarget : input.requestTarget.slice(0, q);
+    const rawQuery = q === -1 ? '' : input.requestTarget.slice(q + 1);
+    const names = [...input.signedHeaders].map(h => h.toLowerCase()).sort();
+    const headerLines = [];
+    for (const name of names) {
+        const value = name === 'host' ? input.hostHeader : input.headers[name];
+        if (value === undefined) {
+            throw new Error(`signed header "${name}" is missing from the request`);
+        }
+        const canonical = Array.isArray(value)
+            ? value.map(trimall).join(',')
+            : trimall(String(value));
+        headerLines.push(`${name}:${canonical}`);
+    }
+    return [
+        input.method.toUpperCase(),
+        canonicalUri(rawPath, input.scope.service),
+        canonicalQueryString(rawQuery),
+        headerLines.join('\n') + '\n',
+        names.join(';'),
+        input.payloadHash,
+    ].join('\n');
+}
+/** String-to-sign over a canonical request. */
+export function buildStringToSign(canonicalRequest, amzDate, scope) {
+    return [
+        SIGV4_ALGORITHM,
+        amzDate,
+        `${scope.date}/${scope.region}/${scope.service}/aws4_request`,
+        sha256Hex(canonicalRequest),
+    ].join('\n');
+}
+/** kSigning = HMAC-chain(AWS4+secret, date, region, service, terminator). */
+export function deriveSigningKey(secretAccessKey, scope) {
+    const kDate = hmac(`AWS4${secretAccessKey}`, scope.date);
+    const kRegion = hmac(kDate, scope.region);
+    const kService = hmac(kRegion, scope.service);
+    return hmac(kService, 'aws4_request');
+}
+/**
+ * Sign a request with SigV4. The caller supplies the credential scope and
+ * timestamp taken from the client's (fake-signed) request so the re-signed
+ * request stays byte-compatible with what the client believes it sent.
+ */
+export function signSigv4(input) {
+    const canonicalRequest = buildCanonicalRequest(input);
+    const stringToSign = buildStringToSign(canonicalRequest, input.amzDate, input.scope);
+    const signature = createHmac('sha256', deriveSigningKey(input.secretAccessKey, input.scope))
+        .update(stringToSign, 'utf8')
+        .digest('hex');
+    const names = [...input.signedHeaders].map(h => h.toLowerCase()).sort();
+    const scopeStr = `${input.scope.date}/${input.scope.region}/${input.scope.service}/aws4_request`;
+    return {
+        authorization: `${SIGV4_ALGORITHM} Credential=${input.accessKeyId}/${scopeStr}, ` +
+            `SignedHeaders=${names.join(';')}, Signature=${signature}`,
+        signature,
+        canonicalRequest,
+        stringToSign,
+    };
+}
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data, 'utf8').digest();
+}
+/** First value of a possibly-repeated header, or undefined. */
+export function singleHeader(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+//# sourceMappingURL=aws-sigv4.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/aws-sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.js","sourceRoot":"","sources":["../../src/sandbox/aws-sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGpD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAA;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAgClD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAA4B,EAC5B,aAAqB;IAErB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAA;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,IAAI,GAAG,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,cAAc,CAAA;YAClB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QACpC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC;AAED,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACf,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY;IAEZ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5D,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,cAAc;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAA;IAClD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7D,OAAO;QACL,WAAW;QACX,IAAI;QACJ,MAAM;QACN,OAAO;QACP,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAClC,UAAU,EACV,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CACtD,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAe;IAC3D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,GAAG,CAAA;IAC9B,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;YAAE,SAAQ;QACvC,IAAI,GAAG,KAAK,IAAI;YAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;;YAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACxE,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAA;IACtD,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACpD,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAChC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAA;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;AAC7C,CAAC;AA4BD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,MAAM,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjE,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAC1C,oBAAoB,CAAC,QAAQ,CAAC;QAC9B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACf,KAAK,CAAC,WAAW;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iBAAiB,CAC/B,gBAAwB,EACxB,OAAe,EACf,KAAwD;IAExD,OAAO;QACL,eAAe;QACf,OAAO;QACP,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,eAAe;QAC7D,SAAS,CAAC,gBAAgB,CAAC;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAC9B,eAAuB,EACvB,KAAwD;IAExD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,eAAe,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;AACvC,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAAwE;IAExE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IACrD,MAAM,YAAY,GAAG,iBAAiB,CACpC,gBAAgB,EAChB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CAAA;IACD,MAAM,SAAS,GAAG,UAAU,CAC1B,QAAQ,EACR,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,CACrD;SACE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,eAAe,CAAA;IAChG,OAAO;QACL,aAAa,EACX,GAAG,eAAe,eAAe,KAAK,CAAC,WAAW,IAAI,QAAQ,IAAI;YAClE,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,EAAE;QAC5D,SAAS;QACT,gBAAgB;QAChB,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;AAChE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAC1B,CAAgC;IAEhC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACpC,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Streaming sentinel→real substitution for forwarded HTTP request bodies.
+ *
+ * The proxy substitutes masked-credential sentinels in request headers
+ * (SentinelRegistry.substituteInHeaders); a credential a tool places in a
+ * request body (JSON payload, form post) would otherwise reach the API as
+ * the useless fake. Sentinels are exact-match strings over `[a-z0-9_-]`, so
+ * they survive JSON, form-urlencoded, multipart, and XML verbatim — a raw
+ * byte scan needs no format parsing. Bodies are never buffered whole:
+ * memory is bounded by one chunk plus a hold-back of `maxSentinelLength - 1`
+ * bytes carried across chunk boundaries.
+ *
+ * Fail-safe direction: substitution is fake→real, so a missed sentinel
+ * (compressed body, base64-wrapped, split by an encoder) means the FAKE
+ * value reaches the API and auth fails — never a leaked secret.
+ */
+import type { IncomingHttpHeaders, IncomingMessage } from 'node:http';
+import { Transform } from 'node:stream';
+/** One sentinel→real replacement, as raw bytes. */
+export interface SentinelBufferPair {
+    sentinel: Buffer;
+    realValue: Buffer;
+}
+/**
+ * Per-destination substitution set for masked-credential body rewriting.
+ * Consulted once per request with the canonical destination host (the
+ * CONNECT target, never the spoofable Host header). Empty/undefined means
+ * no credential is injectable at the host — the caller must keep the
+ * existing bare pipe, byte-identical.
+ */
+export type GetBodySubstitutions = (destHost: string) => SentinelBufferPair[] | undefined;
+/** True when substitution cannot change the body length. */
+export declare function allLengthMatched(pairs: readonly SentinelBufferPair[]): boolean;
+/**
+ * Build the substitution Transform for one forwarded request, or undefined
+ * when the body must keep the existing bare pipe, byte-identical: bodyless
+ * method, no credential injectable at `destHost`, or a Content-Encoding the
+ * byte scan cannot see through.
+ *
+ * When substitution can change the body length (some injectable sentinel is
+ * not length-matched with its real value — e.g. a caller-minted JWT-shaped
+ * fake), Content-Length is deleted from `fwdHeaders` so the outbound
+ * request re-frames as chunked; otherwise Content-Length stays verbatim.
+ */
+export declare function prepareBodySubstitution(getBodySubstitutions: GetBodySubstitutions | undefined, req: IncomingMessage, fwdHeaders: IncomingHttpHeaders, destHost: string): Transform | undefined;
+/**
+ * Transform that replaces every occurrence of each pair's sentinel bytes
+ * with its real-value bytes.
+ *
+ * Boundary-safe: the last `maxSentinelLength - 1` bytes of each chunk are
+ * held back and prepended to the next chunk, so a sentinel split across any
+ * chunk boundary is still seen whole; the hold-back is flushed on stream
+ * end. Replacement is left-to-right, resuming after each replacement — the
+ * substituted real value is never rescanned. Backpressure propagates
+ * through normal Transform semantics.
+ */
+export declare function createBodySubstitutionTransform(pairs: readonly SentinelBufferPair[]): Transform;
+//# sourceMappingURL=body-substitution.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-substitution.d.ts","sourceRoot":"","sources":["../../src/sandbox/body-substitution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIvC,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,KACb,kBAAkB,EAAE,GAAG,SAAS,CAAA;AAErC,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,GACnC,OAAO,CAET;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,EACtD,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,MAAM,GACf,SAAS,GAAG,SAAS,CA+BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,SAAS,kBAAkB,EAAE,GACnC,SAAS,CAiBX"}