pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.js

@@ -0,0 +1,128 @@
+/**
+ * Streaming sentinel→real substitution for forwarded HTTP request bodies.
+ *
+ * The proxy substitutes masked-credential sentinels in request headers
+ * (SentinelRegistry.substituteInHeaders); a credential a tool places in a
+ * request body (JSON payload, form post) would otherwise reach the API as
+ * the useless fake. Sentinels are exact-match strings over `[a-z0-9_-]`, so
+ * they survive JSON, form-urlencoded, multipart, and XML verbatim — a raw
+ * byte scan needs no format parsing. Bodies are never buffered whole:
+ * memory is bounded by one chunk plus a hold-back of `maxSentinelLength - 1`
+ * bytes carried across chunk boundaries.
+ *
+ * Fail-safe direction: substitution is fake→real, so a missed sentinel
+ * (compressed body, base64-wrapped, split by an encoder) means the FAKE
+ * value reaches the API and auth fails — never a leaked secret.
+ */
+import { Transform } from 'node:stream';
+import { logForDebugging } from '../utils/debug.js';
+import { BODYLESS_METHODS } from './request-filter.js';
+/** True when substitution cannot change the body length. */
+export function allLengthMatched(pairs) {
+    return pairs.every(p => p.sentinel.length === p.realValue.length);
+}
+/**
+ * Build the substitution Transform for one forwarded request, or undefined
+ * when the body must keep the existing bare pipe, byte-identical: bodyless
+ * method, no credential injectable at `destHost`, or a Content-Encoding the
+ * byte scan cannot see through.
+ *
+ * When substitution can change the body length (some injectable sentinel is
+ * not length-matched with its real value — e.g. a caller-minted JWT-shaped
+ * fake), Content-Length is deleted from `fwdHeaders` so the outbound
+ * request re-frames as chunked; otherwise Content-Length stays verbatim.
+ */
+export function prepareBodySubstitution(getBodySubstitutions, req, fwdHeaders, destHost) {
+    if (getBodySubstitutions === undefined)
+        return undefined;
+    // A bodyless-method request can still carry a declared body (GET-with-body
+    // APIs are legal HTTP and forwarded today) — skip only when there is
+    // provably nothing to scan.
+    const declaresBody = req.headers['content-length'] !== undefined ||
+        req.headers['transfer-encoding'] !== undefined;
+    if (BODYLESS_METHODS.has(req.method ?? 'GET') && !declaresBody) {
+        return undefined;
+    }
+    const pairs = getBodySubstitutions(destHost);
+    if (!pairs?.length)
+        return undefined;
+    if (req.headers['content-encoding'] !== undefined) {
+        // Fail-safe direction: an encoded body cannot be scanned for sentinel
+        // bytes, so it passes through unchanged — a sentinel in it reaches the
+        // upstream as the useless fake and auth fails, but the real secret
+        // cannot leak. Warn so the resulting 401 is diagnosable.
+        logForDebugging(`[body-substitution] ${destHost}: request body has Content-Encoding ` +
+            `"${String(req.headers['content-encoding'])}"; masked-credential ` +
+            `substitution skipped — a sentinel in this body reaches the ` +
+            `upstream as the fake value`, { level: 'warn' });
+        return undefined;
+    }
+    if (!allLengthMatched(pairs)) {
+        delete fwdHeaders['content-length'];
+    }
+    return createBodySubstitutionTransform(pairs);
+}
+/**
+ * Transform that replaces every occurrence of each pair's sentinel bytes
+ * with its real-value bytes.
+ *
+ * Boundary-safe: the last `maxSentinelLength - 1` bytes of each chunk are
+ * held back and prepended to the next chunk, so a sentinel split across any
+ * chunk boundary is still seen whole; the hold-back is flushed on stream
+ * end. Replacement is left-to-right, resuming after each replacement — the
+ * substituted real value is never rescanned. Backpressure propagates
+ * through normal Transform semantics.
+ */
+export function createBodySubstitutionTransform(pairs) {
+    const maxLen = Math.max(...pairs.map(p => p.sentinel.length));
+    let carry;
+    return new Transform({
+        transform(chunk, encoding, callback) {
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding);
+            const work = carry?.length ? Buffer.concat([carry, buf]) : buf;
+            const { out, tail } = substitute(work, pairs, maxLen);
+            carry = tail;
+            callback(null, out);
+        },
+        flush(callback) {
+            // The hold-back cannot contain a complete sentinel — the scan loop
+            // only stops when no full match remains — so it flushes verbatim.
+            callback(null, carry?.length ? carry : undefined);
+        },
+    });
+}
+function substitute(work, pairs, maxLen) {
+    const parts = [];
+    let pos = 0;
+    for (;;) {
+        // Earliest match across all pairs (typically 1–3 sentinels per host).
+        // Matching is earliest-position-then-registration-order, not
+        // longest-match — sound because no sentinel is a substring of another
+        // (registerWithSentinel's caller contract).
+        let matchIdx = -1;
+        let matchPair;
+        for (const p of pairs) {
+            const i = work.indexOf(p.sentinel, pos);
+            if (i !== -1 && (matchIdx === -1 || i < matchIdx)) {
+                matchIdx = i;
+                matchPair = p;
+            }
+        }
+        if (matchPair === undefined)
+            break;
+        parts.push(work.subarray(pos, matchIdx), matchPair.realValue);
+        pos = matchIdx + matchPair.sentinel.length;
+    }
+    // Hold back the longest suffix that could still be a proper prefix of a
+    // sentinel completed by the next chunk. A partial match of a sentinel of
+    // length L occupies at most L-1 trailing bytes, so maxLen-1 always covers
+    // it. Copied (not a subarray view) so the carry never aliases a buffer
+    // the stream may reuse.
+    const tailStart = Math.max(pos, work.length - (maxLen - 1));
+    parts.push(work.subarray(pos, tailStart));
+    return {
+        out: Buffer.concat(parts),
+        tail: Buffer.from(work.subarray(tailStart)),
+    };
+}
+//# sourceMappingURL=body-substitution.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-substitution.js","sourceRoot":"","sources":["../../src/sandbox/body-substitution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAmBtD,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAC9B,KAAoC;IAEpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,oBAAsD,EACtD,GAAoB,EACpB,UAA+B,EAC/B,QAAgB;IAEhB,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxD,2EAA2E;IAC3E,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC3C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAA;IAChD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,yDAAyD;QACzD,eAAe,CACb,uBAAuB,QAAQ,sCAAsC;YACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,uBAAuB;YAClE,6DAA6D;YAC7D,4BAA4B,EAC9B,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,IAAI,KAAyB,CAAA;IAC7B,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,QAAQ,EAAE,QAAQ;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YACzE,MAAM,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACrD,KAAK,GAAG,IAAI,CAAA;YACZ,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,mEAAmE;YACnE,kEAAkE;YAClE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAoC,EACpC,MAAc;IAEd,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,SAAS,CAAC;QACR,sEAAsE;QACtE,6DAA6D;QAC7D,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;QACjB,IAAI,SAAyC,CAAA;QAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACvC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAClD,QAAQ,GAAG,CAAC,CAAA;gBACZ,SAAS,GAAG,CAAC,CAAA;YACf,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAK;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7D,GAAG,GAAG,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAA;IAC5C,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAA;IACzC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAC5C,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Linked AWS credential pairs for SigV4 re-signing.
+ *
+ * The sentinel registry maps independent name→value fakes, but SigV4
+ * needs the access key id, secret access key, and optional session token
+ * linked as ONE credential: the signature is an HMAC derived from the
+ * secret, so a request signed with the fake secret must be re-signed with
+ * the real one — and the only reliable trigger is the fake access key id
+ * appearing in the signature's credential scope.
+ *
+ * Pairs come from two sources (see {@link registerAwsPairs}):
+ * - an explicit `credentials.awsPairs` grouping, for non-standard
+ *   variable names;
+ * - auto-detection of the conventional AWS_ACCESS_KEY_ID /
+ *   AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio when those vars are
+ *   masked whole-value — the names the AWS SDKs and CLI actually read, so
+ *   masking them is the opt-in.
+ *
+ * {@link createSigv4Planner} builds the per-request hook the
+ * TLS-terminating proxy runs: exact-match the referenced access key id
+ * against registered pair sentinels, classify the signature shape, and
+ * either plan a re-sign (header-sigv4) or apply the configured
+ * deny/passthrough policy (streaming, presigned, sigv4a).
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+import type { HostMatcher } from './credential-sentinel.js';
+import type { AwsPairConfig, CredentialEnvVarConfig, Sigv4Config } from './sandbox-config.js';
+/** Conventional env var names the AWS SDKs and CLI read credentials from. */
+export declare const AWS_ACCESS_KEY_ID_VAR = "AWS_ACCESS_KEY_ID";
+export declare const AWS_SECRET_ACCESS_KEY_VAR = "AWS_SECRET_ACCESS_KEY";
+export declare const AWS_SESSION_TOKEN_VAR = "AWS_SESSION_TOKEN";
+export interface AwsCredentialPair {
+    /** The fake access key id the sandboxed process holds (the sentinel). */
+    readonly accessKeyIdSentinel: string;
+    readonly realAccessKeyId: string;
+    readonly realSecretAccessKey: string;
+    readonly realSessionToken?: string;
+    /**
+     * Hosts where the pair may be injected — the access-key-id entry's
+     * effective injectHosts. Requests to other hosts keep the fake
+     * signature untouched, same as ordinary sentinel substitution.
+     */
+    readonly injectHosts: readonly string[];
+}
+/**
+ * AWS pairs for one sandbox session, keyed by the access-key-id sentinel.
+ * Like the sentinel registry, it lives only in process memory — never
+ * written to disk, never logged.
+ */
+export declare class AwsPairRegistry {
+    private readonly bySentinel;
+    /** Insert or replace the pair keyed on its access-key-id sentinel. */
+    register(pair: AwsCredentialPair): void;
+    /** Exact-match lookup by the fake access key id; never pattern-based. */
+    lookup(accessKeyIdSentinel: string): AwsCredentialPair | undefined;
+    get size(): number;
+    /** Drop every pair. Called on session teardown. */
+    clear(): void;
+}
+/**
+ * Register AWS credential pairs from the masked env vars.
+ *
+ * Runs after `buildMaskedEnvVars`: `setEnvVars` maps each masked variable
+ * to its fake in-sandbox value, which for whole-value masking IS the
+ * sentinel. Pair specs are the explicit `credentials.awsPairs` entries
+ * plus — when none of them claims a conventional name — an implicit
+ * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN spec.
+ *
+ * A spec registers only when both the access-key-id and secret variables
+ * were actually masked (present in the host env, whole-value entries in
+ * `setEnvVars`); the session token joins the pair when its variable was
+ * masked too. A partially available spec is skipped — with one loud
+ * warning for the dangerous half-masking: a masked secret without a
+ * masked access key id means SigV4 requests carry a real key id (so
+ * nothing triggers re-signing) over a fake-secret signature that can
+ * never verify.
+ */
+export declare function registerAwsPairs(envVars: readonly CredentialEnvVarConfig[], awsPairs: readonly AwsPairConfig[] | undefined, allowedDomains: readonly string[], setEnvVars: Readonly<Record<string, string>>, registry: AwsPairRegistry, env?: Record<string, string | undefined>): void;
+export type Sigv4Policy = 'deny' | 'passthrough';
+export declare function resolveSigv4Policies(config: Sigv4Config | undefined): {
+    streaming: "passthrough" | "deny";
+    presigned: "passthrough" | "deny";
+    sigv4a: "passthrough" | "deny";
+};
+/** Decision for one request, produced before header substitution runs. */
+export type Sigv4Plan = {
+    action: 'deny';
+    reason: string;
+} | {
+    action: 'resign';
+    /**
+     * Payload hash to sign. `undefined` means the client signed a
+     * literal body hash (or none): the caller must buffer the body,
+     * SHA-256 it, and pass the hex digest to `apply` — the hash must
+     * cover the bytes actually sent upstream.
+     */
+    payloadHash: string | undefined;
+    /**
+     * Mutate the outgoing (post-substitution) headers in place:
+     * replace Authorization with the real-credential signature, pin
+     * x-amz-content-sha256 to the signed hash, and inject the real
+     * session token when the pair carries one.
+     */
+    apply(headers: IncomingHttpHeaders, hostHeader: string, payloadHash: string): void;
+};
+/**
+ * Per-request SigV4 hook for the TLS-terminating proxy. Returns
+ * `undefined` when the request is not the re-signer's to handle (no
+ * SigV4 signature, unknown/real access key id, destination outside the
+ * pair's injectHosts, or a passthrough policy) — the proxy then forwards
+ * it exactly as before this feature existed.
+ *
+ * Must be called with the ORIGINAL client headers, before sentinel
+ * substitution: detection matches the fake access key id, which
+ * substitution would have already replaced.
+ */
+export type PlanSigv4 = (method: string, requestTarget: string, headers: IncomingHttpHeaders, destHost: string) => Sigv4Plan | undefined;
+/**
+ * Build the {@link PlanSigv4} hook from the session's pair registry and
+ * configured policies. `matches` is the same host matcher used for
+ * sentinel substitution, so injectHosts gating is consistent across both.
+ */
+export declare function createSigv4Planner(registry: AwsPairRegistry, config: Sigv4Config | undefined, matches: HostMatcher): PlanSigv4;
+//# sourceMappingURL=credential-aws-pairs.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-aws-pairs.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-aws-pairs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AASpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EACtB,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAE5B,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AACxD,eAAO,MAAM,yBAAyB,0BAA0B,CAAA;AAChE,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAElE,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI;IAIvC,yEAAyE;IACzE,MAAM,CAAC,mBAAmB,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIlE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,mDAAmD;IACnD,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EAC9C,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,QAAQ,EAAE,eAAe,EACzB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,IAAI,CAmFN;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,aAAa,CAAA;AAQhD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS;;;;EAMnE;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,MAAM,EAAE,QAAQ,CAAA;IAChB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B;;;;;OAKG;IACH,KAAK,CACH,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,IAAI,CAAA;CACR,CAAA;AAEL;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,KACb,SAAS,GAAG,SAAS,CAAA;AAE1B;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,WAAW,GACnB,SAAS,CAoHX"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.js

@@ -0,0 +1,258 @@
+/**
+ * Linked AWS credential pairs for SigV4 re-signing.
+ *
+ * The sentinel registry maps independent name→value fakes, but SigV4
+ * needs the access key id, secret access key, and optional session token
+ * linked as ONE credential: the signature is an HMAC derived from the
+ * secret, so a request signed with the fake secret must be re-signed with
+ * the real one — and the only reliable trigger is the fake access key id
+ * appearing in the signature's credential scope.
+ *
+ * Pairs come from two sources (see {@link registerAwsPairs}):
+ * - an explicit `credentials.awsPairs` grouping, for non-standard
+ *   variable names;
+ * - auto-detection of the conventional AWS_ACCESS_KEY_ID /
+ *   AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio when those vars are
+ *   masked whole-value — the names the AWS SDKs and CLI actually read, so
+ *   masking them is the opt-in.
+ *
+ * {@link createSigv4Planner} builds the per-request hook the
+ * TLS-terminating proxy runs: exact-match the referenced access key id
+ * against registered pair sentinels, classify the signature shape, and
+ * either plan a re-sign (header-sigv4) or apply the configured
+ * deny/passthrough policy (streaming, presigned, sigv4a).
+ */
+import { logForDebugging } from '../utils/debug.js';
+import { detectSigv4, parseSigv4Authorization, signSigv4, singleHeader, UNSIGNED_PAYLOAD, } from './aws-sigv4.js';
+/** Conventional env var names the AWS SDKs and CLI read credentials from. */
+export const AWS_ACCESS_KEY_ID_VAR = 'AWS_ACCESS_KEY_ID';
+export const AWS_SECRET_ACCESS_KEY_VAR = 'AWS_SECRET_ACCESS_KEY';
+export const AWS_SESSION_TOKEN_VAR = 'AWS_SESSION_TOKEN';
+/**
+ * AWS pairs for one sandbox session, keyed by the access-key-id sentinel.
+ * Like the sentinel registry, it lives only in process memory — never
+ * written to disk, never logged.
+ */
+export class AwsPairRegistry {
+    constructor() {
+        this.bySentinel = new Map();
+    }
+    /** Insert or replace the pair keyed on its access-key-id sentinel. */
+    register(pair) {
+        this.bySentinel.set(pair.accessKeyIdSentinel, pair);
+    }
+    /** Exact-match lookup by the fake access key id; never pattern-based. */
+    lookup(accessKeyIdSentinel) {
+        return this.bySentinel.get(accessKeyIdSentinel);
+    }
+    get size() {
+        return this.bySentinel.size;
+    }
+    /** Drop every pair. Called on session teardown. */
+    clear() {
+        this.bySentinel.clear();
+    }
+}
+/**
+ * Register AWS credential pairs from the masked env vars.
+ *
+ * Runs after `buildMaskedEnvVars`: `setEnvVars` maps each masked variable
+ * to its fake in-sandbox value, which for whole-value masking IS the
+ * sentinel. Pair specs are the explicit `credentials.awsPairs` entries
+ * plus — when none of them claims a conventional name — an implicit
+ * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN spec.
+ *
+ * A spec registers only when both the access-key-id and secret variables
+ * were actually masked (present in the host env, whole-value entries in
+ * `setEnvVars`); the session token joins the pair when its variable was
+ * masked too. A partially available spec is skipped — with one loud
+ * warning for the dangerous half-masking: a masked secret without a
+ * masked access key id means SigV4 requests carry a real key id (so
+ * nothing triggers re-signing) over a fake-secret signature that can
+ * never verify.
+ */
+export function registerAwsPairs(envVars, awsPairs, allowedDomains, setEnvVars, registry, env = process.env) {
+    const specs = [...(awsPairs ?? [])];
+    const explicitNames = new Set(specs.flatMap(p => [
+        p.accessKeyIdVar,
+        p.secretAccessKeyVar,
+        ...(p.sessionTokenVar ? [p.sessionTokenVar] : []),
+    ]));
+    const conventional = [
+        AWS_ACCESS_KEY_ID_VAR,
+        AWS_SECRET_ACCESS_KEY_VAR,
+        AWS_SESSION_TOKEN_VAR,
+    ];
+    if (!conventional.some(n => explicitNames.has(n))) {
+        specs.push({
+            accessKeyIdVar: AWS_ACCESS_KEY_ID_VAR,
+            secretAccessKeyVar: AWS_SECRET_ACCESS_KEY_VAR,
+            sessionTokenVar: AWS_SESSION_TOKEN_VAR,
+        });
+    }
+    // A variable is usable as a pair member when it has a whole-value
+    // mask entry AND was actually masked at runtime (set in the host env).
+    const wholeValueEntry = (name) => envVars.find(v => v.name === name &&
+        v.mode === 'mask' &&
+        v.extract === undefined &&
+        v.decode === undefined);
+    const maskedSentinel = (name) => wholeValueEntry(name) !== undefined ? setEnvVars[name] : undefined;
+    for (const spec of specs) {
+        const akidSentinel = maskedSentinel(spec.accessKeyIdVar);
+        const secretMasked = maskedSentinel(spec.secretAccessKeyVar) !== undefined;
+        const realAkid = env[spec.accessKeyIdVar];
+        const realSecret = env[spec.secretAccessKeyVar];
+        if (akidSentinel === undefined ||
+            !secretMasked ||
+            realAkid === undefined ||
+            realSecret === undefined) {
+            if (secretMasked && akidSentinel === undefined) {
+                const msg = `[sandbox-runtime] WARNING: "${spec.secretAccessKeyVar}" is ` +
+                    `masked but "${spec.accessKeyIdVar}" is not, so no AWS ` +
+                    `credential pair was registered. SigV4 requests will be signed ` +
+                    `with the masked placeholder secret and the proxy cannot ` +
+                    `detect or re-sign them — they will fail upstream. Mask both ` +
+                    `variables (whole-value) to enable re-signing.`;
+                console.warn(msg);
+                logForDebugging(msg, { level: 'warn' });
+            }
+            continue;
+        }
+        const akidEntry = wholeValueEntry(spec.accessKeyIdVar);
+        const sessionSentinel = spec.sessionTokenVar !== undefined
+            ? maskedSentinel(spec.sessionTokenVar)
+            : undefined;
+        const realSessionToken = sessionSentinel !== undefined && spec.sessionTokenVar !== undefined
+            ? env[spec.sessionTokenVar]
+            : undefined;
+        registry.register({
+            accessKeyIdSentinel: akidSentinel,
+            realAccessKeyId: realAkid,
+            realSecretAccessKey: realSecret,
+            ...(realSessionToken !== undefined ? { realSessionToken } : {}),
+            injectHosts: akidEntry.injectHosts ?? allowedDomains,
+        });
+        logForDebugging(`[credential-aws] registered SigV4 pair for ` +
+            `${spec.accessKeyIdVar}/${spec.secretAccessKeyVar}` +
+            (realSessionToken !== undefined ? ` (+session token)` : ''));
+    }
+}
+export function resolveSigv4Policies(config) {
+    return {
+        streaming: config?.streaming ?? 'deny',
+        presigned: config?.presigned ?? 'deny',
+        sigv4a: config?.sigv4a ?? 'deny',
+    };
+}
+/**
+ * Build the {@link PlanSigv4} hook from the session's pair registry and
+ * configured policies. `matches` is the same host matcher used for
+ * sentinel substitution, so injectHosts gating is consistent across both.
+ */
+export function createSigv4Planner(registry, config, matches) {
+    const policies = resolveSigv4Policies(config);
+    return (method, requestTarget, headers, destHost) => {
+        if (registry.size === 0)
+            return undefined;
+        const detected = detectSigv4(headers, requestTarget);
+        if (detected === null)
+            return undefined;
+        const pair = registry.lookup(detected.accessKeyId);
+        // Unknown key id — including a real, unmasked AWS credential — is
+        // never rewritten and never denied.
+        if (pair === undefined)
+            return undefined;
+        if (!pair.injectHosts.some(p => matches(destHost, p)))
+            return undefined;
+        if (detected.kind !== 'header-sigv4') {
+            if (policies[detected.kind] === 'passthrough') {
+                logForDebugging(`[credential-aws] ${detected.kind} request with masked ` +
+                    `credential passed through un-resigned per ` +
+                    `credentials.sigv4.${detected.kind} (its signature covers ` +
+                    `the placeholder secret and will fail upstream)`);
+                return undefined;
+            }
+            return {
+                action: 'deny',
+                reason: `AWS SigV4 ${detected.kind} request uses a masked credential ` +
+                    `but cannot be re-signed by the sandbox proxy; denied by ` +
+                    `policy. Set credentials.sigv4.${detected.kind} to ` +
+                    `"passthrough" to forward it unmodified (it will fail ` +
+                    `upstream: the signature covers the masked placeholder).`,
+            };
+        }
+        const auth = parseSigv4Authorization(singleHeader(headers.authorization));
+        if (auth === null) {
+            return {
+                action: 'deny',
+                reason: 'AWS SigV4 request uses a masked credential but its ' +
+                    'Authorization header is malformed; the proxy cannot re-sign it.',
+            };
+        }
+        const amzDate = singleHeader(headers['x-amz-date']);
+        if (amzDate === undefined) {
+            return {
+                action: 'deny',
+                reason: 'AWS SigV4 request uses a masked credential but carries no ' +
+                    'x-amz-date header; the proxy cannot re-sign it.',
+            };
+        }
+        // Presence check now so apply() cannot fail after the body was
+        // consumed. host is synthesized; a session token the pair carries
+        // is injected by apply().
+        const signedHeaders = [...auth.signedHeaders];
+        for (const name of signedHeaders) {
+            if (name === 'host')
+                continue;
+            if (name === 'x-amz-security-token' &&
+                pair.realSessionToken !== undefined) {
+                continue;
+            }
+            if (headers[name] === undefined) {
+                return {
+                    action: 'deny',
+                    reason: `AWS SigV4 request uses a masked credential but signed ` +
+                        `header "${name}" is missing; the proxy cannot re-sign it.`,
+                };
+            }
+        }
+        if (pair.realSessionToken !== undefined &&
+            !signedHeaders.includes('x-amz-security-token')) {
+            signedHeaders.push('x-amz-security-token');
+        }
+        const contentSha = singleHeader(headers['x-amz-content-sha256']);
+        return {
+            action: 'resign',
+            payloadHash: contentSha === UNSIGNED_PAYLOAD ? UNSIGNED_PAYLOAD : undefined,
+            apply(fwdHeaders, hostHeader, payloadHash) {
+                if (pair.realSessionToken !== undefined) {
+                    fwdHeaders['x-amz-security-token'] = pair.realSessionToken;
+                }
+                if (fwdHeaders['x-amz-content-sha256'] !== undefined &&
+                    contentSha !== UNSIGNED_PAYLOAD) {
+                    // The recomputed hash is authoritative: the signature must
+                    // cover the bytes forwarded upstream, not the client's claim.
+                    fwdHeaders['x-amz-content-sha256'] = payloadHash;
+                }
+                const { authorization } = signSigv4({
+                    method,
+                    requestTarget,
+                    headers: fwdHeaders,
+                    hostHeader,
+                    signedHeaders,
+                    payloadHash,
+                    amzDate,
+                    scope: {
+                        date: auth.date,
+                        region: auth.region,
+                        service: auth.service,
+                    },
+                    accessKeyId: pair.realAccessKeyId,
+                    secretAccessKey: pair.realSecretAccessKey,
+                });
+                fwdHeaders.authorization = authorization;
+            },
+        };
+    };
+}
+//# sourceMappingURL=credential-aws-pairs.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-aws-pairs.js","sourceRoot":"","sources":["../../src/sandbox/credential-aws-pairs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AAQvB,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAA;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAA;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAA;AAgBxD;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAA5B;QACmB,eAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAoBpE,CAAC;IAlBC,sEAAsE;IACtE,QAAQ,CAAC,IAAuB;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,mBAA2B;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAED,mDAAmD;IACnD,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0C,EAC1C,QAA8C,EAC9C,cAAiC,EACjC,UAA4C,EAC5C,QAAyB,EACzB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,KAAK,GAAoB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,kBAAkB;QACpB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CACH,CAAA;IACD,MAAM,YAAY,GAAG;QACnB,qBAAqB;QACrB,yBAAyB;QACzB,qBAAqB;KACtB,CAAA;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC;YACT,cAAc,EAAE,qBAAqB;YACrC,kBAAkB,EAAE,yBAAyB;YAC7C,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,CAAC,IAAI,KAAK,MAAM;QACjB,CAAC,CAAC,OAAO,KAAK,SAAS;QACvB,CAAC,CAAC,MAAM,KAAK,SAAS,CACzB,CAAA;IACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC1D,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAA;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC/C,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,YAAY;YACb,QAAQ,KAAK,SAAS;YACtB,UAAU,KAAK,SAAS,EACxB,CAAC;YACD,IAAI,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,GAAG,GACP,+BAA+B,IAAI,CAAC,kBAAkB,OAAO;oBAC7D,eAAe,IAAI,CAAC,cAAc,sBAAsB;oBACxD,gEAAgE;oBAChE,0DAA0D;oBAC1D,8DAA8D;oBAC9D,+CAA+C,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACzC,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,CAAE,CAAA;QACvD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAChC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;YACtC,CAAC,CAAC,SAAS,CAAA;QACf,MAAM,gBAAgB,GACpB,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YACjE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAA;QAEf,QAAQ,CAAC,QAAQ,CAAC;YAChB,mBAAmB,EAAE,YAAY;YACjC,eAAe,EAAE,QAAQ;YACzB,mBAAmB,EAAE,UAAU;YAC/B,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,cAAc;SACrD,CAAC,CAAA;QACF,eAAe,CACb,6CAA6C;YAC3C,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,kBAAkB,EAAE;YACnD,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAA;IACH,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAClE,OAAO;QACL,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,MAAM;QACtC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,MAAM;QACtC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM;KACT,CAAA;AAC3B,CAAC;AA6CD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,MAA+B,EAC/B,OAAoB;IAEpB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,kEAAkE;QAClE,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAEvE,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBAC9C,eAAe,CACb,oBAAoB,QAAQ,CAAC,IAAI,uBAAuB;oBACtD,4CAA4C;oBAC5C,qBAAqB,QAAQ,CAAC,IAAI,yBAAyB;oBAC3D,gDAAgD,CACnD,CAAA;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,aAAa,QAAQ,CAAC,IAAI,oCAAoC;oBAC9D,0DAA0D;oBAC1D,iCAAiC,QAAQ,CAAC,IAAI,MAAM;oBACpD,uDAAuD;oBACvD,yDAAyD;aAC5D,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAE,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,qDAAqD;oBACrD,iEAAiE;aACpE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,4DAA4D;oBAC5D,iDAAiD;aACpD,CAAA;QACH,CAAC;QACD,+DAA+D;QAC/D,kEAAkE;QAClE,0BAA0B;QAC1B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;QAC7C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAQ;YAC7B,IACE,IAAI,KAAK,sBAAsB;gBAC/B,IAAI,CAAC,gBAAgB,KAAK,SAAS,EACnC,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EACJ,wDAAwD;wBACxD,WAAW,IAAI,4CAA4C;iBAC9D,CAAA;YACH,CAAC;QACH,CAAC;QACD,IACE,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACnC,CAAC,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC/C,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,WAAW,EACT,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW;gBACvC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAA;gBAC5D,CAAC;gBACD,IACE,UAAU,CAAC,sBAAsB,CAAC,KAAK,SAAS;oBAChD,UAAU,KAAK,gBAAgB,EAC/B,CAAC;oBACD,2DAA2D;oBAC3D,8DAA8D;oBAC9D,UAAU,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAA;gBAClD,CAAC;gBACD,MAAM,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;oBAClC,MAAM;oBACN,aAAa;oBACb,OAAO,EAAE,UAAU;oBACnB,UAAU;oBACV,aAAa;oBACb,WAAW;oBACX,OAAO;oBACP,KAAK,EAAE;wBACL,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB;oBACD,WAAW,EAAE,IAAI,CAAC,eAAe;oBACjC,eAAe,EAAE,IAAI,CAAC,mBAAmB;iBAC1C,CAAC,CAAA;gBACF,UAAU,CAAC,aAAa,GAAG,aAAa,CAAA;YAC1C,CAAC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Decoding support for encoded credential formats (`decode` on a
+ * `credentials.files` entry). Currently JWT only.
+ *
+ * Pure helpers: the default extraction pattern for finding JWT candidates
+ * in a file, the verification predicate that confirms a candidate actually
+ * is a JWT before it gets masked, and the minting of a JWT-shaped fake to
+ * stand in for the real token inside the sandbox.
+ */
+/**
+ * Default `extract` pattern for `decode: "jwt"` entries.
+ *
+ * A JWT's first segment is the base64url encoding of a JSON header that
+ * starts `{"` (it always declares `alg`/`typ`), and base64url of `{"` is
+ * `eyJ` — so every JWT starts with `eyJ`. Capture group 1 is the whole
+ * three-segment token. The pattern over-matches (any eyJ-prefixed
+ * base64url triple); {@link verifyJwt} filters the false positives.
+ */
+export declare const JWT_DEFAULT_EXTRACT_PATTERN = "(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";
+/**
+ * True when `candidate` is structurally a JWT: three dot-separated
+ * segments, the first two base64url-decoding to JSON, and the header
+ * (segment 1) declaring an `alg` property.
+ *
+ * Used to filter extraction candidates before masking — a regex match
+ * that fails this check (e.g. a random base64 blob the default pattern
+ * over-matched) is left untouched rather than masked.
+ */
+export declare function verifyJwt(candidate: string): boolean;
+/**
+ * Mint a structurally valid fake JWT carrying the sentinel identity
+ * `fake_value_<uuid>` in its `sub` claim. Deterministic given `uuid`.
+ *
+ * The fake is parseable by client-side JWT handling (three segments, JSON
+ * header/payload, far-future `exp`), so a tool inside the sandbox that
+ * inspects the token before sending it doesn't break. The header says
+ * `alg: HS256` — NOT `alg: none` — deliberately: misconfigured validators
+ * accept `alg: none` tokens as valid, whereas an HS256 header forces every
+ * validator to attempt signature verification and reject the garbage
+ * signature. So if the fake ever reaches a verifier unswapped (e.g. sent
+ * to a non-injectHosts destination, the designed fail-closed pass-through),
+ * it is cryptographically rejected.
+ */
+export declare function mintFakeJwt(uuid: string): string;
+/** Result of {@link maskJwtClaims}. */
+export interface MaskedClaimsResult {
+    /**
+     * The rebuilt token: the original header segment verbatim, the modified
+     * payload re-encoded, and the fixed filler signature.
+     */
+    fakeToken: string;
+    /** Claim name → the sentinel now carried in the fake payload. */
+    claimSentinels: Map<string, string>;
+}
+/**
+ * Claim-level masking for a verified JWT: replace each named top-level
+ * payload claim that is present with a string value by a caller-provided
+ * sentinel, and rebuild the token around the modified payload.
+ *
+ * The rebuilt token is `header.payload'.signature-filler`:
+ *
+ * - **Header**: the original base64url segment is reused verbatim, so the
+ *   token still advertises the real `alg`/`typ`/`kid` and client-side
+ *   header inspection sees exactly what it would outside the sandbox.
+ * - **Payload**: the decoded object with the named claims swapped for
+ *   sentinels, re-encoded with `JSON.stringify`. Key order and whitespace
+ *   inside the payload segment may differ from the original encoding —
+ *   irrelevant to any JSON consumer, and the segment bytes change anyway
+ *   because a claim value changed.
+ * - **Signature**: the fixed filler from {@link mintFakeJwt}, NOT the real
+ *   signature. For RS/ES algorithms signature verification needs only the
+ *   public key, so shipping the real signature over a modified payload
+ *   would hand the sandbox an offline brute-force oracle for a low-entropy
+ *   masked claim (guess the claim, re-encode, verify). The filler also
+ *   keeps the fake a non-credential end to end, consistent with the
+ *   garbage-signature rationale in {@link mintFakeJwt}.
+ *
+ * Claims that are absent from the payload, or present with a non-string
+ * value, are skipped (the caller logs them). Returns `null` — without
+ * invoking `sentinelFor` — when no named claim matched, or when the
+ * payload does not decode to a JSON object; the caller routes that
+ * through its no-match policy.
+ *
+ * Pure on `token`/`claims`; the callback may close over a registry.
+ */
+export declare function maskJwtClaims(token: string, claims: readonly string[], sentinelFor: (claim: string, realValue: string) => string): MaskedClaimsResult | null;
+//# sourceMappingURL=credential-decode.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-decode.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,0DACiB,CAAA;AAWzD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQpD;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GACxD,kBAAkB,GAAG,IAAI,CA4B3B"}