pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.js

@@ -0,0 +1,208 @@
+/**
+ * Per-session sentinel registry for credential masking.
+ *
+ * A masked credential's real value is replaced inside the sandbox with a
+ * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
+ * the sentinel; the host-side proxy substitutes sentinel→real on egress to
+ * allowlisted destinations. The map lives only in process memory — it is
+ * never written to disk and never logged.
+ */
+import { randomBytes, randomUUID } from 'node:crypto';
+export const SENTINEL_PREFIX = 'fake_value_';
+// Padding alphabet: the same character class as the base sentinel, so a
+// padded sentinel still survives shells, JSON, URLs, and multipart unquoted.
+const SENTINEL_ALPHABET = 'abcdefghijklmnopqrstuvwxyz0123456789_-';
+/**
+ * Mint `fake_value_<uuid4>`, padded with random alphabet chars up to the
+ * real value's byte length when the real value is longer. A length-matched
+ * sentinel keeps Content-Length invariant under body substitution, so the
+ * proxy forwards the header verbatim; a shorter real value keeps the
+ * 47-byte base sentinel (entropy is never reduced below the uuid4) and the
+ * proxy falls back to chunked framing instead. The padding carries no
+ * entropy contract — the uuid4 does — so modulo bias is irrelevant.
+ */
+function mintSentinel(realValue) {
+    const base = SENTINEL_PREFIX + randomUUID();
+    const pad = Buffer.byteLength(realValue) - base.length;
+    if (pad <= 0)
+        return base;
+    let out = base;
+    for (const b of randomBytes(pad)) {
+        out += SENTINEL_ALPHABET[b % SENTINEL_ALPHABET.length];
+    }
+    return out;
+}
+/**
+ * Sentinel↔real-value map for one sandbox session, keyed by credential name.
+ *
+ * Each credential carries its own `injectHosts` list, and substitution is
+ * gated per sentinel: a sentinel is swapped to its real value only when the
+ * destination matches THAT credential's hosts. This prevents laundering
+ * credential A through credential B's allowlisted host by sending A's
+ * sentinel there — the proxy leaves A's sentinel intact on B's host.
+ *
+ * Keying on name (not value) means two env vars holding the same secret get
+ * distinct sentinels, so each can have an independent host list.
+ */
+export class SentinelRegistry {
+    constructor() {
+        this.byName = new Map();
+        this.bySentinel = new Map();
+        // True while every registered sentinel starts with SENTINEL_PREFIX, which
+        // keeps the substring fast path in substituteInString() valid. A
+        // caller-minted sentinel (e.g. a JWT-shaped fake) clears it.
+        this.allSentinelsPrefixed = true;
+    }
+    /**
+     * Return the sentinel for the credential named `name`, minting a fresh one
+     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
+     * accidental collision with legitimate header content is negligible, and
+     * free of shell/URL metacharacters so it survives `--setenv` and
+     * `env NAME=value` unquoted.
+     *
+     * Idempotent on `name`: a repeat call returns the same sentinel and updates
+     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
+     * without invalidating sentinels the sandboxed process has already read.
+     * (A re-register whose new value has a different byte length leaves the
+     * sentinel un-length-matched; body substitution then re-frames as chunked
+     * rather than trusting a stale Content-Length.)
+     */
+    register(name, realValue, injectHosts) {
+        return this.registerWithSentinel(name, mintSentinel(realValue), realValue, injectHosts);
+    }
+    /**
+     * Like {@link register}, but with a caller-minted sentinel instead of the
+     * default `fake_value_<uuid4>` — used when the fake must keep the real
+     * value's shape (e.g. a structurally valid JWT for `decode: "jwt"`), so
+     * client-side parsers inside the sandbox don't choke on it.
+     *
+     * Same idempotency contract as {@link register}: if `name` is already
+     * registered, the EXISTING sentinel is returned (and `sentinel` discarded)
+     * so a re-register never invalidates a fake the sandboxed process has
+     * already read. The caller must mint sentinels with enough entropy that
+     * collisions with real content are negligible (embed a uuid4). No
+     * registered sentinel may be a substring of any other registered sentinel:
+     * the body-substitution scan matches earliest-position-then-registration-
+     * order, not longest-match, so nested sentinels would make replacement
+     * chunk-boundary-dependent (still fail-safe — worst case a wrong fake
+     * reaches upstream, never a secret).
+     *
+     * Caller-minted sentinels are used verbatim — never length-padded: a
+     * shaped fake (e.g. a JWT) must keep its structure. They are therefore
+     * generally not length-matched, and body substitution at hosts where they
+     * inject falls back to chunked framing.
+     */
+    registerWithSentinel(name, sentinel, realValue, injectHosts) {
+        const existing = this.byName.get(name);
+        if (existing !== undefined) {
+            existing.realValue = realValue;
+            existing.injectHosts = injectHosts;
+            return existing.sentinel;
+        }
+        if (!sentinel.startsWith(SENTINEL_PREFIX)) {
+            this.allSentinelsPrefixed = false;
+        }
+        const entry = { name, sentinel, realValue, injectHosts };
+        this.byName.set(name, entry);
+        this.bySentinel.set(sentinel, entry);
+        return sentinel;
+    }
+    /** Real value for `sentinel`, or undefined if not registered. */
+    lookupReal(sentinel) {
+        return this.bySentinel.get(sentinel)?.realValue;
+    }
+    /**
+     * Names of the registered credentials whose `injectHosts` cover
+     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
+     * exempted from TLS termination (so substitution can never run there) but
+     * a masked credential is configured for injection at it.
+     */
+    namesInjectableAt(destHost, matches) {
+        const names = [];
+        for (const e of this.byName.values()) {
+            if (e.injectHosts.some(p => matches(destHost, p)))
+                names.push(e.name);
+        }
+        return names;
+    }
+    /**
+     * Sentinel→real byte pairs for every credential whose `injectHosts`
+     * cover `destHost` — the substitution set the body transform scans for.
+     * Same per-credential gating as {@link substituteInHeaders}. Buffers are
+     * built per call so a re-registered credential's updated real value is
+     * always current.
+     */
+    sentinelsForHost(destHost, matches) {
+        const pairs = [];
+        for (const e of this.bySentinel.values()) {
+            if (!e.injectHosts.some(p => matches(destHost, p)))
+                continue;
+            pairs.push({
+                sentinel: Buffer.from(e.sentinel),
+                realValue: Buffer.from(e.realValue),
+            });
+        }
+        return pairs;
+    }
+    /** Iterate registered `[sentinel, realValue]` pairs. */
+    *entries() {
+        for (const e of this.bySentinel.values())
+            yield [e.sentinel, e.realValue];
+    }
+    /** Number of registered sentinels. */
+    get size() {
+        return this.bySentinel.size;
+    }
+    /** Drop every mapping. Called on session teardown. */
+    clear() {
+        this.byName.clear();
+        this.bySentinel.clear();
+        this.allSentinelsPrefixed = true;
+    }
+    /**
+     * Replace registered sentinels found in `headers` with their real values,
+     * in place. Each sentinel substitutes only when `destHost` matches one of
+     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
+     * whose host list does not cover `destHost` is left as the useless fake.
+     *
+     * Scans all header values rather than a fixed set — a sentinel showing up
+     * anywhere is the substitution trigger, regardless of header name
+     * (Authorization, X-Api-Key, Private-Token, ...).
+     *
+     * The caller remains responsible for transport gating (TLS-terminated path
+     * unless `allowPlaintextInject`).
+     */
+    substituteInHeaders(headers, destHost, matches) {
+        if (this.bySentinel.size === 0)
+            return;
+        for (const [name, value] of Object.entries(headers)) {
+            if (value === undefined)
+                continue;
+            if (Array.isArray(value)) {
+                for (let i = 0; i < value.length; i++) {
+                    value[i] = this.substituteInString(value[i], destHost, matches);
+                }
+            }
+            else {
+                headers[name] = this.substituteInString(value, destHost, matches);
+            }
+        }
+    }
+    substituteInString(s, destHost, matches) {
+        // Fast path: while every sentinel carries the fixed prefix, a header
+        // value that doesn't contain it cannot contain any sentinel. Disabled
+        // once a caller-minted sentinel (arbitrary shape) is registered.
+        if (this.allSentinelsPrefixed && !s.includes(SENTINEL_PREFIX))
+            return s;
+        let out = s;
+        for (const e of this.bySentinel.values()) {
+            if (!out.includes(e.sentinel))
+                continue;
+            if (!e.injectHosts.some(p => matches(destHost, p)))
+                continue;
+            out = out.split(e.sentinel).join(e.realValue);
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=credential-sentinel.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sentinel.js","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIrD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C,wEAAwE;AACxE,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,wCAAwC,CAAA;AAElE;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,IAAI,GAAG,eAAe,GAAG,UAAU,EAAE,CAAA;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;IACtD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,GAAG,IAAI,iBAAiB,CAAC,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACmB,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAA;QACzC,eAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;QAC9D,0EAA0E;QAC1E,iEAAiE;QACjE,6DAA6D;QACrD,yBAAoB,GAAG,IAAI,CAAA;IAkLrC,CAAC;IAhLC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CACN,IAAY,EACZ,SAAiB,EACjB,WAA8B;QAE9B,OAAO,IAAI,CAAC,oBAAoB,CAC9B,IAAI,EACJ,YAAY,CAAC,SAAS,CAAC,EACvB,SAAS,EACT,WAAW,CACZ,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,oBAAoB,CAClB,IAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,WAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;YAC9B,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAA;YAClC,OAAO,QAAQ,CAAC,QAAQ,CAAA;QAC1B,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAA;QACnC,CAAC;QACD,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,QAAgB,EAAE,OAAoB;QACtD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,QAAgB,EAChB,OAAoB;QAEpB,MAAM,KAAK,GAAyB,EAAE,CAAA;QACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAQ;YAC5D,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACpC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wDAAwD;IACxD,CAAC,OAAO;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;IAC3E,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAED,sDAAsD;IACtD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACvB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;IAClC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAA4B,EAC5B,QAAgB,EAChB,OAAoB;QAEpB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,CAAS,EACT,QAAgB,EAChB,OAAoB;QAEpB,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,IAAI,CAAC,oBAAoB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAO,CAAC,CAAA;QACvE,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YACvC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAQ;YAC5D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/domain-pattern.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+/**
+ * Split an optional `:port` suffix off a domain pattern.
+ *
+ * `api.github.com:443` → `{ hostPattern: 'api.github.com', port: 443 }`
+ * `api.github.com`     → `{ hostPattern: 'api.github.com', port: undefined }`
+ * `[::1]:443`          → `{ hostPattern: '::1', port: 443 }`
+ * `[2001:db8::1]`      → `{ hostPattern: '2001:db8::1', port: undefined }`
+ *
+ * Only a strictly-numeric suffix in 1–65535 (no leading zeros) counts as a
+ * port, so a smuggled host suffix like `evil.com:443.allowed.com` is left
+ * whole (and then fails host validation on the remaining `:`).
+ *
+ * IPv6 literals must be bracketed (RFC 3986 / RFC 5952 §6: `[addr]` or
+ * `[addr]:port`); the returned hostPattern is the bare, canonically
+ * compressed address so it compares equal to what {@link canonicalizeHost}
+ * yields for a destination. An *unbracketed* string with two or more colons
+ * is ambiguous (`::1:443` is itself a valid address) — it is returned whole
+ * with no port, never split, so a trailing hextet can't be mistaken for a
+ * port and silently narrow the entry. The config schema rejects that form;
+ * this fallback only matters for embedders passing config programmatically.
+ */
+export declare function splitDomainPatternPort(pattern: string): {
+    hostPattern: string;
+    port: number | undefined;
+};
+/**
+ * The IP-literal entries of an allow/deny list as `{ range, port? }` rules
+ * for the resolved-address check: an address the list names explicitly is
+ * judged the same way when a hostname resolves to it.
+ */
+export declare function ipLiteralRules(entries: readonly string[]): Array<{
+    range: string;
+    port?: number;
+}>;
+/** Drop a `:port` suffix, if any (see {@link splitDomainPatternPort}). */
+export declare function stripDomainPatternPort(pattern: string): string;
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * {@link matchesDomainPattern} with an optional `:port` suffix on the
+ * pattern (`example.com:443`, `*.example.com:8443`, `*:22`). A pattern
+ * without a port matches every port; a pattern with one matches only when
+ * the destination port is equal.
+ */
+export declare function matchesDomainPatternWithPort(hostname: string, port: number, pattern: string): boolean;
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ *
+ * `:port` suffixes on allowedDomains entries are ignored: injection is
+ * host-scoped, and a port-scoped allow still makes the host reachable.
+ */
+export declare function isInjectHostCoveredByAllowedDomains(injectHost: string, allowedDomains: readonly string[]): boolean;
+//# sourceMappingURL=domain-pattern.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/domain-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.d.ts","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB,CA2BA;AAQD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAKzC;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAIT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAWT"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/domain-pattern.js

@@ -0,0 +1,155 @@
+/**
+ * Domain-pattern matching shared between runtime host filtering
+ * (sandbox-manager) and config-time validation (sandbox-config).
+ * Lives in its own module so the schema can import it without pulling
+ * in sandbox-manager (which imports the schema — circular).
+ */
+import { isIP } from 'node:net';
+import { canonicalizeHost, stripBrackets } from './parent-proxy.js';
+/** Drop an IPv6 zone id from an IP-literal entry; matching ignores zones. */
+function dropZone(host) {
+    const pct = host.indexOf('%');
+    return pct === -1 ? host : host.slice(0, pct);
+}
+/**
+ * Split an optional `:port` suffix off a domain pattern.
+ *
+ * `api.github.com:443` → `{ hostPattern: 'api.github.com', port: 443 }`
+ * `api.github.com`     → `{ hostPattern: 'api.github.com', port: undefined }`
+ * `[::1]:443`          → `{ hostPattern: '::1', port: 443 }`
+ * `[2001:db8::1]`      → `{ hostPattern: '2001:db8::1', port: undefined }`
+ *
+ * Only a strictly-numeric suffix in 1–65535 (no leading zeros) counts as a
+ * port, so a smuggled host suffix like `evil.com:443.allowed.com` is left
+ * whole (and then fails host validation on the remaining `:`).
+ *
+ * IPv6 literals must be bracketed (RFC 3986 / RFC 5952 §6: `[addr]` or
+ * `[addr]:port`); the returned hostPattern is the bare, canonically
+ * compressed address so it compares equal to what {@link canonicalizeHost}
+ * yields for a destination. An *unbracketed* string with two or more colons
+ * is ambiguous (`::1:443` is itself a valid address) — it is returned whole
+ * with no port, never split, so a trailing hextet can't be mistaken for a
+ * port and silently narrow the entry. The config schema rejects that form;
+ * this fallback only matters for embedders passing config programmatically.
+ */
+export function splitDomainPatternPort(pattern) {
+    if (pattern.startsWith('[')) {
+        const close = pattern.indexOf(']');
+        if (close === -1)
+            return { hostPattern: pattern, port: undefined };
+        const inner = dropZone(pattern.slice(1, close));
+        const host = canonicalizeHost(inner) ?? inner;
+        const rest = pattern.slice(close + 1);
+        if (rest === '')
+            return { hostPattern: host, port: undefined };
+        const port = parsePortSuffix(rest.startsWith(':') ? rest.slice(1) : '');
+        // `[::1]junk` / `[::1]:0` — leave whole so validation rejects it.
+        return port === undefined
+            ? { hostPattern: pattern, port: undefined }
+            : { hostPattern: host, port };
+    }
+    const idx = pattern.lastIndexOf(':');
+    if (idx === -1)
+        return { hostPattern: pattern, port: undefined };
+    if (pattern.indexOf(':') !== idx) {
+        // ≥2 colons, no brackets: an IPv6 literal (or garbage). Never split.
+        const host = dropZone(pattern);
+        return {
+            hostPattern: canonicalizeHost(host) ?? host,
+            port: undefined,
+        };
+    }
+    const port = parsePortSuffix(pattern.slice(idx + 1));
+    if (port === undefined)
+        return { hostPattern: pattern, port: undefined };
+    return { hostPattern: pattern.slice(0, idx), port };
+}
+function parsePortSuffix(suffix) {
+    if (!/^[1-9][0-9]{0,4}$/.test(suffix))
+        return undefined;
+    const port = Number(suffix);
+    return port > 65535 ? undefined : port;
+}
+/**
+ * The IP-literal entries of an allow/deny list as `{ range, port? }` rules
+ * for the resolved-address check: an address the list names explicitly is
+ * judged the same way when a hostname resolves to it.
+ */
+export function ipLiteralRules(entries) {
+    return entries.flatMap(entry => {
+        const { hostPattern, port } = splitDomainPatternPort(entry);
+        return isIP(hostPattern) ? [{ range: hostPattern, port }] : [];
+    });
+}
+/** Drop a `:port` suffix, if any (see {@link splitDomainPatternPort}). */
+export function stripDomainPatternPort(pattern) {
+    return splitDomainPatternPort(pattern).hostPattern;
+}
+/**
+ * Match a hostname against a domain pattern.
+ *
+ * Patterns:
+ *   - `*` matches everything (deny-all; the schema only accepts this in
+ *     deniedDomains).
+ *   - `*.example.com` matches any strict subdomain of example.com.
+ *   - anything else matches exactly (case-insensitive).
+ *
+ * Wildcard suffix matching is refused for IP literals so an IPv6 zone-ID
+ * payload like `::ffff:1.2.3.4%x.allowed.com` cannot pass `.endsWith()`
+ * while the OS connects to the bare IP. isValidHost already rejects `%`,
+ * but we refuse here too for defence in depth.
+ */
+export function matchesDomainPattern(hostname, pattern) {
+    const h = hostname.toLowerCase();
+    if (pattern === '*')
+        return true;
+    if (pattern.startsWith('*.')) {
+        if (isIP(stripBrackets(h)))
+            return false;
+        const baseDomain = pattern.substring(2).toLowerCase();
+        return h.endsWith('.' + baseDomain);
+    }
+    return h === pattern.toLowerCase();
+}
+/**
+ * {@link matchesDomainPattern} with an optional `:port` suffix on the
+ * pattern (`example.com:443`, `*.example.com:8443`, `*:22`). A pattern
+ * without a port matches every port; a pattern with one matches only when
+ * the destination port is equal.
+ */
+export function matchesDomainPatternWithPort(hostname, port, pattern) {
+    const { hostPattern, port: patternPort } = splitDomainPatternPort(pattern);
+    if (patternPort !== undefined && patternPort !== port)
+        return false;
+    return matchesDomainPattern(hostname, hostPattern);
+}
+/**
+ * Decide whether a per-credential `injectHosts` entry is reachable via
+ * `network.allowedDomains` — i.e. every concrete host that could match
+ * `injectHost` is allowed by at least one entry in `allowedDomains`.
+ *
+ * For an exact `injectHost` (`api.github.com`) this is just
+ * `matchesDomainPattern` against each allowed pattern.
+ *
+ * For a wildcard `injectHost` (`*.X`), an exact allowedDomain can never
+ * cover it (it admits only one host), so coverage requires an allowed
+ * wildcard `*.Y` whose base is `X` or an ancestor of `X` — e.g.
+ * `*.api.github.com` is covered by `*.github.com`.
+ *
+ * `:port` suffixes on allowedDomains entries are ignored: injection is
+ * host-scoped, and a port-scoped allow still makes the host reachable.
+ */
+export function isInjectHostCoveredByAllowedDomains(injectHost, allowedDomains) {
+    const allowedHosts = allowedDomains.map(stripDomainPatternPort);
+    if (!injectHost.startsWith('*.')) {
+        return allowedHosts.some(p => matchesDomainPattern(injectHost, p));
+    }
+    const injectBase = injectHost.slice(2).toLowerCase();
+    return allowedHosts.some(p => {
+        if (!p.startsWith('*.'))
+            return false;
+        const allowedBase = p.slice(2).toLowerCase();
+        return injectBase === allowedBase || injectBase.endsWith('.' + allowedBase);
+    });
+}
+//# sourceMappingURL=domain-pattern.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/domain-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.js","sourceRoot":"","sources":["../../src/sandbox/domain-pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEnE,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IAIpD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACvE,kEAAkE;QAClE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAC3C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAChE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,qEAAqE;QACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO;YACL,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI;YAC3C,IAAI,EAAE,SAAS;SAChB,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACxE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA0B;IAE1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC7B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC,WAAW,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAe;IAEf,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,IAAY,EACZ,OAAe;IAEf,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAC1E,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACnE,OAAO,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAkB,EAClB,cAAiC;IAEjC,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC/D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACpD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Get paths to check for globally installed @anthropic-ai/sandbox-runtime package.
+ * This is used as a fallback when the binaries aren't bundled (e.g., native builds).
+ *
+ * Blocks the event loop on `npm root -g` (~100 ms) the first time it is
+ * called in a process unless {@link getGlobalNpmPathsAsync} has already
+ * filled the cache; initialize() goes through the async variant.
+ */
+export declare function getGlobalNpmPaths(): string[];
+/**
+ * Async variant of {@link getGlobalNpmPaths}: runs `npm root -g` without
+ * blocking the event loop and shares the same per-process cache, so a
+ * later sync call returns immediately. Never rejects — a failed or
+ * timed-out npm yields just the static fallback locations, as the sync
+ * variant does.
+ */
+export declare function getGlobalNpmPathsAsync(): Promise<string[]>;
+/**
+ * Get the path to the apply-seccomp binary from the vendor directory
+ * Returns the path if it exists, null otherwise
+ *
+ * Pre-built apply-seccomp binaries are organized by architecture:
+ * - vendor/seccomp/{x64,arm64}/apply-seccomp
+ *
+ * Tries multiple paths for resilience:
+ * 0. Explicit path provided via parameter (checked first if provided)
+ * 1. vendor/seccomp/{arch}/apply-seccomp (bundled - when bundled into consuming packages)
+ * 2. ../../vendor/seccomp/{arch}/apply-seccomp (package root - standard npm installs)
+ * 3. ../vendor/seccomp/{arch}/apply-seccomp (dist/vendor - for bundlers)
+ * 4. Global npm install (if seccompBinaryPath not provided) - for native builds
+ *
+ * @param seccompBinaryPath - Optional explicit path to the apply-seccomp binary. If provided
+ *   and exists, it will be used. If not provided, falls back to searching local paths and
+ *   then global npm install (for native builds where vendor directory isn't bundled).
+ */
+export declare function getApplySeccompBinaryPath(seccompBinaryPath?: string): string | null;
+/**
+ * Async variant of {@link getApplySeccompBinaryPath}: same lookup order and
+ * shared cache, but the global-npm fallback resolves `npm root -g` without
+ * blocking the event loop. Resolving once through here (as
+ * checkDependenciesAsync does) makes later sync calls cache hits.
+ */
+export declare function getApplySeccompBinaryPathAsync(seccompBinaryPath?: string): Promise<string | null>;
+//# sourceMappingURL=generate-seccomp-filter.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-seccomp-filter.d.ts","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAe5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAwB1D;AAsGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,iBAAiB,CAAC,EAAE,MAAM,GACzB,MAAM,GAAG,IAAI,CAaf;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB"}