pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Credential file masking (Linux).
+ *
+ * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
+ * file content on the host, registers one or more sentinels in the
+ * {@link SentinelRegistry}, and writes a fake file (sentinel-substituted)
+ * to a manager-owned temp directory. The Linux sandbox then `--ro-bind`s
+ * the fake over the real path, so the sandboxed process reads the
+ * sentinel(s). The proxy substitution from env-var masking already scans
+ * every header for any registered sentinel, so a tool that does
+ * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
+ * the real bytes — no proxy changes required.
+ *
+ * Without `extract`, masking is **whole-file**: one sentinel replaces the
+ * entire content. With `extract`, masking is **structured**: a regex picks
+ * out the credential value(s) and only those spans are replaced, so a tool
+ * that parses the file (JSON/YAML/.netrc) still sees valid syntax. See
+ * {@link extractAndSubstitute} and {@link CredentialFileConfigSchema}.
+ *
+ * On macOS, SBPL cannot redirect reads, so masked files degrade to
+ * `mode: "deny"` (see macos-sandbox-utils.ts).
+ */
+import type { CredentialFileConfig } from './sandbox-config.js';
+import type { SentinelRegistry } from './credential-sentinel.js';
+/** One masked file's bind mapping for the platform builder. */
+export interface MaskedFileBind {
+    /** Resolved (tilde-expanded, realpath'd) host path of the real file. */
+    realPath: string;
+    /** Path to the fake file containing the sentinel. */
+    fakePath: string;
+}
+/**
+ * Manager-owned temp dir holding the fake files.
+ *
+ * INVARIANT: this directory must never be writable from inside the sandbox.
+ * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
+ * after every other filesystem mount (see generateFilesystemArgs), so the
+ * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
+ * the host's $TMPDIR points under a default-writable path. If the sandbox
+ * could write here it could replace a fake's content (the bind exposes the
+ * source file) or plant a symlink for a later host-side write() to follow.
+ */
+export declare class MaskedFileStore {
+    private dir;
+    private readonly byKey;
+    /**
+     * Write `sentinel` to a fake file for `key` and return its path.
+     * Idempotent on `key`: a repeat call rewrites the same fake (so a
+     * changed sentinel after re-register propagates) instead of leaking a
+     * new file per wrapWithSandbox() call.
+     */
+    write(key: string, sentinel: string): string;
+    /** Remove the temp dir and every fake file in it. Idempotent. */
+    dispose(): void;
+    /** Temp dir path, or undefined if no fake has been written yet. */
+    get dirPath(): string | undefined;
+}
+/** Result of {@link buildMaskedFileBinds}. */
+export interface MaskedFileBuildResult {
+    binds: MaskedFileBind[];
+    /**
+     * Resolved paths of `mode: "mask"` entries that degraded to deny at
+     * runtime — populated when `extract` matches nothing (or, with
+     * `decode`, no candidate verifies) and the entry's `onExtractNoMatch`
+     * is `"deny"`. Callers union these into the read-deny set so the
+     * credential file is unreadable rather than exposed.
+     */
+    degradeToDenyPaths: string[];
+}
+/**
+ * For each `mode: "mask"` file entry: resolve the path, read the real
+ * content, build the fake content (whole-file or structured per `extract`),
+ * register sentinels in `registry`, write the fake via `store`, and return
+ * the bind list plus any entries that degraded to deny.
+ *
+ * Whole-file mode (no `extract`): one sentinel keyed `file:<path>` whose
+ * real value is the entire file content; the fake file *is* the sentinel.
+ *
+ * Structured mode (`extract` and/or `decode` set): one sentinel per
+ * distinct captured value, keyed `file:<path>#<i>`; the fake file is the
+ * real content with each captured span replaced by its sentinel. With
+ * `decode: "jwt"`, candidates come from the explicit `extract` pattern or
+ * the built-in JWT pattern, each candidate must pass {@link verifyJwt}
+ * before it is masked (failed candidates are left untouched), and the
+ * sentinel is a JWT-shaped fake ({@link mintFakeJwt}) registered via
+ * `registerWithSentinel`. With `maskClaims`, masking goes one level
+ * deeper: each named top-level payload claim present with a string value
+ * gets its own sentinel and the token is rebuilt around the modified
+ * payload ({@link maskJwtClaims}); BOTH mappings are registered — the
+ * whole fake token → the whole real token (a tool sending the token as a
+ * bearer credential) and each claim sentinel → the real claim value (a
+ * tool extracting the claim and sending it alone) — under the same
+ * injectHosts. Named claims absent or non-string in a token are skipped
+ * with a debug log (portable-config posture, like a missing file). If the
+ * regex matches nothing — or, with decode, no candidate verifies, or with
+ * `maskClaims`, no named claim matches in any verified token — the
+ * entry's `onExtractNoMatch` decides:
+ * - `"warn"` (default): skip the entry with a loud stderr warning —
+ *   fail-open, the file stays readable via the root mount;
+ * - `"deny"`: push the path to `degradeToDenyPaths` — fail-closed, the
+ *   file becomes unreadable inside the sandbox;
+ * - `"error"`: throw, so nothing runs until the config is fixed.
+ * With `maskDuplicates`, verbatim occurrences of each captured value
+ * outside the matched spans are also replaced (see {@link ExtractOptions}).
+ * Composed with `decode`, the duplicate pass covers only captures that
+ * passed verification — a duplicate is the same value, so it inherits the
+ * verified capture's sentinel without re-verification; unverified
+ * candidates (left untouched by the decode gate) never mask duplicates.
+ *
+ * Entries whose path does not exist, is unreadable, or resolves to a
+ * directory are skipped with a debug log — same posture as a masked env
+ * var that's unset on the host: nothing to protect, and surfacing a hard
+ * error would make a portable config brittle across machines.
+ *
+ * The directory check is the authoritative one (the schema only catches a
+ * trailing slash); whole-file masking has no meaning for a directory.
+ */
+export declare function buildMaskedFileBinds(files: readonly CredentialFileConfig[], allowedDomains: readonly string[], registry: SentinelRegistry, store: MaskedFileStore): MaskedFileBuildResult;
+export declare const MASKED_FILE_STORE_PREFIX = "srt-credmask-";
+//# sourceMappingURL=credential-mask-files.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-files.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAShE,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAElD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAoB5C,iEAAiE;IACjE,OAAO,IAAI,IAAI;IAcf,mEAAmE;IACnE,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;CACF;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,eAAe,GACrB,qBAAqB,CA4KvB;AAED,eAAO,MAAM,wBAAwB,kBAAkB,CAAA"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.js

@@ -0,0 +1,281 @@
+/**
+ * Credential file masking (Linux).
+ *
+ * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
+ * file content on the host, registers one or more sentinels in the
+ * {@link SentinelRegistry}, and writes a fake file (sentinel-substituted)
+ * to a manager-owned temp directory. The Linux sandbox then `--ro-bind`s
+ * the fake over the real path, so the sandboxed process reads the
+ * sentinel(s). The proxy substitution from env-var masking already scans
+ * every header for any registered sentinel, so a tool that does
+ * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
+ * the real bytes — no proxy changes required.
+ *
+ * Without `extract`, masking is **whole-file**: one sentinel replaces the
+ * entire content. With `extract`, masking is **structured**: a regex picks
+ * out the credential value(s) and only those spans are replaced, so a tool
+ * that parses the file (JSON/YAML/.netrc) still sees valid syntax. See
+ * {@link extractAndSubstitute} and {@link CredentialFileConfigSchema}.
+ *
+ * On macOS, SBPL cannot redirect reads, so masked files degrade to
+ * `mode: "deny"` (see macos-sandbox-utils.ts).
+ */
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { logForDebugging } from '../utils/debug.js';
+import { extractAndSubstitute } from './credential-extract.js';
+import { normalizePathForSandbox } from './sandbox-utils.js';
+import { JWT_DEFAULT_EXTRACT_PATTERN, maskJwtClaims, mintFakeJwt, verifyJwt, } from './credential-decode.js';
+/**
+ * Sentinel-registry key prefix for masked files. Keeps file keys disjoint
+ * from env-var names so a credential file at path `GH_TOKEN` cannot collide
+ * with the env var `GH_TOKEN`.
+ */
+const FILE_KEY_PREFIX = 'file:';
+/**
+ * Manager-owned temp dir holding the fake files.
+ *
+ * INVARIANT: this directory must never be writable from inside the sandbox.
+ * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
+ * after every other filesystem mount (see generateFilesystemArgs), so the
+ * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
+ * the host's $TMPDIR points under a default-writable path. If the sandbox
+ * could write here it could replace a fake's content (the bind exposes the
+ * source file) or plant a symlink for a later host-side write() to follow.
+ */
+export class MaskedFileStore {
+    constructor() {
+        this.byKey = new Map();
+    }
+    /**
+     * Write `sentinel` to a fake file for `key` and return its path.
+     * Idempotent on `key`: a repeat call rewrites the same fake (so a
+     * changed sentinel after re-register propagates) instead of leaking a
+     * new file per wrapWithSandbox() call.
+     */
+    write(key, sentinel) {
+        if (this.dir === undefined) {
+            this.dir = fs.mkdtempSync(join(tmpdir(), 'srt-credmask-'));
+        }
+        let fakePath = this.byKey.get(key);
+        if (fakePath === undefined) {
+            fakePath = join(this.dir, `${this.byKey.size}.fake`);
+            this.byKey.set(key, fakePath);
+        }
+        // Never follow a symlink at fakePath: a prior sandbox invocation may
+        // have planted one (the store dir is ro-bound now, but defence in
+        // depth). Unlink first so writeFileSync creates a fresh regular file.
+        fs.rmSync(fakePath, { force: true });
+        // 0600: owner rw so the idempotent rewrite above succeeds; the bind
+        // into the sandbox is --ro-bind so the sandboxed process sees it
+        // read-only regardless of the host mode. No group/other.
+        fs.writeFileSync(fakePath, sentinel, { mode: 0o600 });
+        return fakePath;
+    }
+    /** Remove the temp dir and every fake file in it. Idempotent. */
+    dispose() {
+        if (this.dir !== undefined) {
+            try {
+                fs.rmSync(this.dir, { recursive: true, force: true });
+            }
+            catch (err) {
+                logForDebugging(`MaskedFileStore cleanup failed: ${err}`, {
+                    level: 'error',
+                });
+            }
+        }
+        this.dir = undefined;
+        this.byKey.clear();
+    }
+    /** Temp dir path, or undefined if no fake has been written yet. */
+    get dirPath() {
+        return this.dir;
+    }
+}
+/**
+ * For each `mode: "mask"` file entry: resolve the path, read the real
+ * content, build the fake content (whole-file or structured per `extract`),
+ * register sentinels in `registry`, write the fake via `store`, and return
+ * the bind list plus any entries that degraded to deny.
+ *
+ * Whole-file mode (no `extract`): one sentinel keyed `file:<path>` whose
+ * real value is the entire file content; the fake file *is* the sentinel.
+ *
+ * Structured mode (`extract` and/or `decode` set): one sentinel per
+ * distinct captured value, keyed `file:<path>#<i>`; the fake file is the
+ * real content with each captured span replaced by its sentinel. With
+ * `decode: "jwt"`, candidates come from the explicit `extract` pattern or
+ * the built-in JWT pattern, each candidate must pass {@link verifyJwt}
+ * before it is masked (failed candidates are left untouched), and the
+ * sentinel is a JWT-shaped fake ({@link mintFakeJwt}) registered via
+ * `registerWithSentinel`. With `maskClaims`, masking goes one level
+ * deeper: each named top-level payload claim present with a string value
+ * gets its own sentinel and the token is rebuilt around the modified
+ * payload ({@link maskJwtClaims}); BOTH mappings are registered — the
+ * whole fake token → the whole real token (a tool sending the token as a
+ * bearer credential) and each claim sentinel → the real claim value (a
+ * tool extracting the claim and sending it alone) — under the same
+ * injectHosts. Named claims absent or non-string in a token are skipped
+ * with a debug log (portable-config posture, like a missing file). If the
+ * regex matches nothing — or, with decode, no candidate verifies, or with
+ * `maskClaims`, no named claim matches in any verified token — the
+ * entry's `onExtractNoMatch` decides:
+ * - `"warn"` (default): skip the entry with a loud stderr warning —
+ *   fail-open, the file stays readable via the root mount;
+ * - `"deny"`: push the path to `degradeToDenyPaths` — fail-closed, the
+ *   file becomes unreadable inside the sandbox;
+ * - `"error"`: throw, so nothing runs until the config is fixed.
+ * With `maskDuplicates`, verbatim occurrences of each captured value
+ * outside the matched spans are also replaced (see {@link ExtractOptions}).
+ * Composed with `decode`, the duplicate pass covers only captures that
+ * passed verification — a duplicate is the same value, so it inherits the
+ * verified capture's sentinel without re-verification; unverified
+ * candidates (left untouched by the decode gate) never mask duplicates.
+ *
+ * Entries whose path does not exist, is unreadable, or resolves to a
+ * directory are skipped with a debug log — same posture as a masked env
+ * var that's unset on the host: nothing to protect, and surfacing a hard
+ * error would make a portable config brittle across machines.
+ *
+ * The directory check is the authoritative one (the schema only catches a
+ * trailing slash); whole-file masking has no meaning for a directory.
+ */
+export function buildMaskedFileBinds(files, allowedDomains, registry, store) {
+    const binds = [];
+    const degradeToDenyPaths = [];
+    for (const f of files) {
+        if (f.mode !== 'mask')
+            continue;
+        // Literal: this path is stat'd, read and (on Linux) bound over, so it
+        // is the name of one file however it is spelled — a `[` in it is part
+        // of that name, not a character class.
+        const realPath = normalizePathForSandbox(f.path, { literal: true });
+        let content;
+        try {
+            const stat = fs.statSync(realPath);
+            if (stat.isDirectory()) {
+                logForDebugging(`[credential-mask] Skipping masked file entry that resolves to ` +
+                    `a directory: ${f.path} — use mode "deny" for directories.`, { level: 'warn' });
+                continue;
+            }
+            // Read as bytes first: a utf8 read silently maps invalid sequences
+            // to U+FFFD, so the sentinel would round-trip to corrupted bytes at
+            // the proxy. Masking (whole-file or extract) is for text credential
+            // files; reject binary.
+            const raw = fs.readFileSync(realPath);
+            content = raw.toString('utf8');
+            if (Buffer.byteLength(content, 'utf8') !== raw.length) {
+                logForDebugging(`[credential-mask] Skipping masked file with non-UTF-8 content ` +
+                    `(binary credential files are not supported in mask mode): ` +
+                    `${f.path}`, { level: 'warn' });
+                continue;
+            }
+        }
+        catch (err) {
+            logForDebugging(`[credential-mask] Skipping masked file (unreadable on host): ` +
+                `${f.path} — ${err.message}`);
+            continue;
+        }
+        const injectHosts = f.injectHosts ?? allowedDomains;
+        const key = FILE_KEY_PREFIX + realPath;
+        let fakeContent;
+        if (f.extract === undefined && f.decode === undefined) {
+            // Whole-file: one sentinel for the entire content.
+            fakeContent = registry.register(key, content, injectHosts);
+        }
+        else {
+            // An explicit extract pattern wins; decode without one falls back to
+            // the built-in JWT pattern so authors don't hand-write it.
+            const pattern = f.extract ?? JWT_DEFAULT_EXTRACT_PATTERN;
+            let maskedCount = 0;
+            const extracted = extractAndSubstitute(content, pattern, (cap, i) => {
+                // Decode-verification: a regex match that is not actually a JWT
+                // (the default pattern over-matches by design) is left untouched —
+                // returning the capture replaces the span with itself.
+                if (f.decode === 'jwt' && !verifyJwt(cap))
+                    return cap;
+                const name = `${key}#${i}`;
+                if (f.decode === 'jwt' && f.maskClaims?.length) {
+                    // Claim-level masking: sentinels go INSIDE the payload; the
+                    // rebuilt fake token is itself registered as a sentinel for
+                    // the whole real token, so both the bearer path (token sent
+                    // verbatim) and the extracted-claim path substitute on egress.
+                    const masked = maskJwtClaims(cap, f.maskClaims, (claim, real) => registry.register(`${key}#jwt${i}.${claim}`, real, injectHosts));
+                    if (masked === null) {
+                        // A verified JWT none of whose named claims are present as
+                        // strings: nothing to mask in THIS token — leave it as-is;
+                        // if no token matches any claim, onExtractNoMatch applies.
+                        logForDebugging(`[credential-mask] ${f.path}: verified JWT candidate has ` +
+                            `none of maskClaims ${JSON.stringify(f.maskClaims)} as ` +
+                            `string claims — left unmasked.`);
+                        return cap;
+                    }
+                    const skipped = f.maskClaims.filter(c => !masked.claimSentinels.has(c));
+                    if (skipped.length > 0) {
+                        logForDebugging(`[credential-mask] ${f.path}: maskClaims ` +
+                            `${JSON.stringify(skipped)} absent or non-string in a ` +
+                            `verified JWT — skipped.`);
+                    }
+                    maskedCount++;
+                    return registry.registerWithSentinel(name, masked.fakeToken, cap, injectHosts);
+                }
+                maskedCount++;
+                // For decode the fake must keep the token's shape: a JWT-shaped
+                // sentinel keeps client-side parsers (segment count, payload
+                // decode, exp checks) working inside the sandbox.
+                return f.decode === 'jwt'
+                    ? registry.registerWithSentinel(name, mintFakeJwt(randomUUID()), cap, injectHosts)
+                    : registry.register(name, cap, injectHosts);
+            }, { maskDuplicates: f.maskDuplicates ?? false });
+            if (extracted === null || maskedCount === 0) {
+                // Nothing was masked — either the pattern matched nothing or, with
+                // decode, no candidate survived verification. Both are the same
+                // "masking cannot apply" condition, so both route through the
+                // entry's onExtractNoMatch policy.
+                const cause = f.decode === 'jwt'
+                    ? f.maskClaims?.length
+                        ? `decode "jwt" with pattern "${pattern}" that matched no ` +
+                            `verified JWT with maskable claims (maskClaims: ` +
+                            `${JSON.stringify(f.maskClaims)})`
+                        : `decode "jwt" with pattern "${pattern}" that matched no ` +
+                            `verified JWT`
+                    : `extract pattern "${pattern}" that matched nothing`;
+                const onNoMatch = f.onExtractNoMatch ?? 'warn';
+                if (onNoMatch === 'error') {
+                    throw new Error(`credentials.files entry "${f.path}": ${cause} ` +
+                        `(onExtractNoMatch: "error"). Fix the config, change to ` +
+                        `"warn"/"deny", or remove the entry.`);
+                }
+                if (onNoMatch === 'deny') {
+                    // Fail-closed: the operator declared this file as containing a
+                    // credential. Masking can't apply — degrade to deny so the
+                    // sandboxed process cannot read the credential at all.
+                    logForDebugging(`[credential-mask] ${f.path} has ${cause} — degrading to ` +
+                        `mode "deny".`, { level: 'warn' });
+                    degradeToDenyPaths.push(realPath);
+                    continue;
+                }
+                // 'warn' (default): fail-open. A non-matching config is an error
+                // to surface, not a reason to block file access. Skip the entry
+                // (no bind, no deny) — the file stays readable via the root mount
+                // — and warn loudly on stderr so the operator fixes the config.
+                const msg = `[sandbox-runtime] WARNING: credentials.files entry ` +
+                    `"${f.path}" has ${cause} in the file. The file is left ` +
+                    `UNPROTECTED (readable as-is inside the sandbox). Fix the ` +
+                    `config, set onExtractNoMatch to "deny" or "error", or remove ` +
+                    `the entry.`;
+                console.warn(msg);
+                logForDebugging(msg, { level: 'warn' });
+                continue;
+            }
+            fakeContent = extracted.fakeContent;
+        }
+        const fakePath = store.write(key, fakeContent);
+        binds.push({ realPath, fakePath });
+    }
+    return { binds, degradeToDenyPaths };
+}
+export const MASKED_FILE_STORE_PREFIX = 'srt-credmask-';
+//# sourceMappingURL=credential-mask-files.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-files.js","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EACL,2BAA2B,EAC3B,aAAa,EACb,WAAW,EACX,SAAS,GACV,MAAM,wBAAwB,CAAA;AAI/B;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAA;AAU/B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAA5B;QAEmB,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IA+CpD,CAAC;IA7CC;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,QAAgB;QACjC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,mCAAmC,GAAG,EAAE,EAAE;oBACxD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;CACF;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsC,EACtC,cAAiC,EACjC,QAA0B,EAC1B,KAAsB;IAEtB,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,sEAAsE;QACtE,sEAAsE;QACtE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAEnE,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,eAAe,CACb,gEAAgE;oBAC9D,gBAAgB,CAAC,CAAC,IAAI,qCAAqC,EAC7D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,wBAAwB;YACxB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtD,eAAe,CACb,gEAAgE;oBAC9D,4DAA4D;oBAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EACb,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CACb,+DAA+D;gBAC7D,GAAG,CAAC,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC1C,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAA;QACnD,MAAM,GAAG,GAAG,eAAe,GAAG,QAAQ,CAAA;QAEtC,IAAI,WAAmB,CAAA;QACvB,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtD,mDAAmD;YACnD,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,2BAA2B,CAAA;YACxD,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,MAAM,SAAS,GAAG,oBAAoB,CACpC,OAAO,EACP,OAAO,EACP,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACT,gEAAgE;gBAChE,mEAAmE;gBACnE,uDAAuD;gBACvD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,GAAG,CAAA;gBACrD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAA;gBAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;oBAC/C,4DAA4D;oBAC5D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC9D,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAChE,CAAA;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,2DAA2D;wBAC3D,2DAA2D;wBAC3D,2DAA2D;wBAC3D,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,+BAA+B;4BACxD,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;4BACxD,gCAAgC,CACnC,CAAA;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC;oBACD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CAAA;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,eAAe;4BACxC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6BAA6B;4BACvD,yBAAyB,CAC5B,CAAA;oBACH,CAAC;oBACD,WAAW,EAAE,CAAA;oBACb,OAAO,QAAQ,CAAC,oBAAoB,CAClC,IAAI,EACJ,MAAM,CAAC,SAAS,EAChB,GAAG,EACH,WAAW,CACZ,CAAA;gBACH,CAAC;gBACD,WAAW,EAAE,CAAA;gBACb,gEAAgE;gBAChE,6DAA6D;gBAC7D,kDAAkD;gBAClD,OAAO,CAAC,CAAC,MAAM,KAAK,KAAK;oBACvB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAC3B,IAAI,EACJ,WAAW,CAAC,UAAU,EAAE,CAAC,EACzB,GAAG,EACH,WAAW,CACZ;oBACH,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;YAC/C,CAAC,EACD,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK,EAAE,CAC9C,CAAA;YACD,IAAI,SAAS,KAAK,IAAI,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,mCAAmC;gBACnC,MAAM,KAAK,GACT,CAAC,CAAC,MAAM,KAAK,KAAK;oBAChB,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM;wBACpB,CAAC,CAAC,8BAA8B,OAAO,oBAAoB;4BACzD,iDAAiD;4BACjD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG;wBACpC,CAAC,CAAC,8BAA8B,OAAO,oBAAoB;4BACzD,cAAc;oBAClB,CAAC,CAAC,oBAAoB,OAAO,wBAAwB,CAAA;gBACzD,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAA;gBAC9C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,IAAI,MAAM,KAAK,GAAG;wBAC9C,yDAAyD;wBACzD,qCAAqC,CACxC,CAAA;gBACH,CAAC;gBACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,+DAA+D;oBAC/D,2DAA2D;oBAC3D,uDAAuD;oBACvD,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,QAAQ,KAAK,kBAAkB;wBACxD,cAAc,EAChB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;oBACD,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBACjC,SAAQ;gBACV,CAAC;gBACD,iEAAiE;gBACjE,gEAAgE;gBAChE,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,GAAG,GACP,qDAAqD;oBACrD,IAAI,CAAC,CAAC,IAAI,SAAS,KAAK,iCAAiC;oBACzD,2DAA2D;oBAC3D,+DAA+D;oBAC/D,YAAY,CAAA;gBACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBACvC,SAAQ;YACV,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,WAAW,CAAA;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAA"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+import type { SentinelBufferPair } from './body-substitution.js';
+export declare const SENTINEL_PREFIX = "fake_value_";
+/** Predicate matching a destination host against one injectHosts pattern. */
+export type HostMatcher = (host: string, pattern: string) => boolean;
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export declare class SentinelRegistry {
+    private readonly byName;
+    private readonly bySentinel;
+    private allSentinelsPrefixed;
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     * (A re-register whose new value has a different byte length leaves the
+     * sentinel un-length-matched; body substitution then re-frames as chunked
+     * rather than trusting a stale Content-Length.)
+     */
+    register(name: string, realValue: string, injectHosts: readonly string[]): string;
+    /**
+     * Like {@link register}, but with a caller-minted sentinel instead of the
+     * default `fake_value_<uuid4>` — used when the fake must keep the real
+     * value's shape (e.g. a structurally valid JWT for `decode: "jwt"`), so
+     * client-side parsers inside the sandbox don't choke on it.
+     *
+     * Same idempotency contract as {@link register}: if `name` is already
+     * registered, the EXISTING sentinel is returned (and `sentinel` discarded)
+     * so a re-register never invalidates a fake the sandboxed process has
+     * already read. The caller must mint sentinels with enough entropy that
+     * collisions with real content are negligible (embed a uuid4). No
+     * registered sentinel may be a substring of any other registered sentinel:
+     * the body-substitution scan matches earliest-position-then-registration-
+     * order, not longest-match, so nested sentinels would make replacement
+     * chunk-boundary-dependent (still fail-safe — worst case a wrong fake
+     * reaches upstream, never a secret).
+     *
+     * Caller-minted sentinels are used verbatim — never length-padded: a
+     * shaped fake (e.g. a JWT) must keep its structure. They are therefore
+     * generally not length-matched, and body substitution at hosts where they
+     * inject falls back to chunked framing.
+     */
+    registerWithSentinel(name: string, sentinel: string, realValue: string, injectHosts: readonly string[]): string;
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel: string): string | undefined;
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost: string, matches: HostMatcher): string[];
+    /**
+     * Sentinel→real byte pairs for every credential whose `injectHosts`
+     * cover `destHost` — the substitution set the body transform scans for.
+     * Same per-credential gating as {@link substituteInHeaders}. Buffers are
+     * built per call so a re-registered credential's updated real value is
+     * always current.
+     */
+    sentinelsForHost(destHost: string, matches: HostMatcher): SentinelBufferPair[];
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    entries(): IterableIterator<[string, string]>;
+    /** Number of registered sentinels. */
+    get size(): number;
+    /** Drop every mapping. Called on session teardown. */
+    clear(): void;
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers: IncomingHttpHeaders, destHost: string, matches: HostMatcher): void;
+    private substituteInString;
+}
+//# sourceMappingURL=credential-sentinel.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,eAAO,MAAM,eAAe,gBAAgB,CAAA;AA0B5C,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;AASpE;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAI9D,OAAO,CAAC,oBAAoB,CAAO;IAEnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAST;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAgBT,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE;IAQnE;;;;;;OAMG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE;IAYvB,wDAAwD;IACvD,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI9C,sCAAsC;IACtC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,sDAAsD;IACtD,KAAK,IAAI,IAAI;IAMb;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,IAAI;IAcP,OAAO,CAAC,kBAAkB;CAiB3B"}