pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.js

@@ -0,0 +1,220 @@
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as fs from 'node:fs';
+import { exec, execSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { logForDebugging } from '../utils/debug.js';
+// Cache for path lookups (key: explicit path or empty string, value: resolved path or null)
+const applySeccompPathCache = new Map();
+// Cache for global npm paths (computed once per process)
+let cachedGlobalNpmPaths = null;
+let pendingGlobalNpmPaths = null;
+const NPM_ROOT_COMMAND = 'npm root -g';
+const NPM_ROOT_TIMEOUT_MS = 5000;
+/**
+ * Get paths to check for globally installed @anthropic-ai/sandbox-runtime package.
+ * This is used as a fallback when the binaries aren't bundled (e.g., native builds).
+ *
+ * Blocks the event loop on `npm root -g` (~100 ms) the first time it is
+ * called in a process unless {@link getGlobalNpmPathsAsync} has already
+ * filled the cache; initialize() goes through the async variant.
+ */
+export function getGlobalNpmPaths() {
+    if (cachedGlobalNpmPaths)
+        return cachedGlobalNpmPaths;
+    let npmRoot;
+    try {
+        npmRoot = execSync(NPM_ROOT_COMMAND, {
+            encoding: 'utf8',
+            timeout: NPM_ROOT_TIMEOUT_MS,
+            stdio: ['pipe', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        // npm not available or failed
+    }
+    cachedGlobalNpmPaths = buildGlobalNpmPaths(npmRoot);
+    return cachedGlobalNpmPaths;
+}
+/**
+ * Async variant of {@link getGlobalNpmPaths}: runs `npm root -g` without
+ * blocking the event loop and shares the same per-process cache, so a
+ * later sync call returns immediately. Never rejects — a failed or
+ * timed-out npm yields just the static fallback locations, as the sync
+ * variant does.
+ */
+export function getGlobalNpmPathsAsync() {
+    if (cachedGlobalNpmPaths)
+        return Promise.resolve(cachedGlobalNpmPaths);
+    if (pendingGlobalNpmPaths)
+        return pendingGlobalNpmPaths;
+    pendingGlobalNpmPaths = new Promise(resolve => {
+        try {
+            const child = exec(NPM_ROOT_COMMAND, { encoding: 'utf8', timeout: NPM_ROOT_TIMEOUT_MS }, (err, stdout) => resolve(err ? undefined : stdout));
+            // Match execSync's closed stdin: npm never waits on it.
+            child.stdin?.end();
+        }
+        catch {
+            resolve(undefined);
+        }
+    }).then(npmRoot => {
+        // A sync call that ran while npm was in flight already filled the cache;
+        // keep its array so every caller sees the same one.
+        cachedGlobalNpmPaths ?? (cachedGlobalNpmPaths = buildGlobalNpmPaths(npmRoot));
+        pendingGlobalNpmPaths = null;
+        return cachedGlobalNpmPaths;
+    });
+    return pendingGlobalNpmPaths;
+}
+function buildGlobalNpmPaths(npmRootOutput) {
+    const paths = [];
+    // The actual global npm root, when npm answered
+    const npmRoot = npmRootOutput?.trim();
+    if (npmRoot) {
+        paths.push(join(npmRoot, '@anthropic-ai', 'sandbox-runtime'));
+    }
+    // Common global npm locations as fallbacks
+    const home = homedir();
+    paths.push(
+    // npm global (Linux/macOS)
+    join('/usr', 'lib', 'node_modules', '@anthropic-ai', 'sandbox-runtime'), join('/usr', 'local', 'lib', 'node_modules', '@anthropic-ai', 'sandbox-runtime'), 
+    // npm global with prefix (common on macOS with homebrew)
+    join('/opt', 'homebrew', 'lib', 'node_modules', '@anthropic-ai', 'sandbox-runtime'), 
+    // User-local npm global
+    join(home, '.npm', 'lib', 'node_modules', '@anthropic-ai', 'sandbox-runtime'), join(home, '.npm-global', 'lib', 'node_modules', '@anthropic-ai', 'sandbox-runtime'));
+    return paths;
+}
+/**
+ * Map Node.js process.arch to our vendor directory architecture names
+ * Returns null for unsupported architectures
+ */
+function getVendorArchitecture() {
+    const arch = process.arch;
+    switch (arch) {
+        case 'x64':
+            return 'x64';
+        case 'arm64':
+            return 'arm64';
+        case 'ia32':
+            // ia32 multiplexes every socket operation through socketcall(), whose
+            // sub-function argument the filter cannot inspect, so AF_UNIX is not
+            // blockable there. vendor/seccomp-src/seccomp-unix-block.c carries what
+            // supporting it would take.
+            logForDebugging(`[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. ` +
+                `The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.`, { level: 'error' });
+            return null;
+        default:
+            logForDebugging(`[SeccompFilter] Unsupported architecture: ${arch}. Only x64 and arm64 are supported.`);
+            return null;
+    }
+}
+/**
+ * Get local paths to check for seccomp files (bundled or package installs).
+ */
+function getLocalSeccompPaths(filename) {
+    const arch = getVendorArchitecture();
+    if (!arch)
+        return [];
+    const baseDir = dirname(fileURLToPath(import.meta.url));
+    const relativePath = join('vendor', 'seccomp', arch, filename);
+    return [
+        join(baseDir, relativePath), // bundled: same directory as bundle (e.g., when bundled into claude-cli)
+        join(baseDir, '..', '..', relativePath), // package root: vendor/seccomp/...
+        join(baseDir, '..', relativePath), // dist: dist/vendor/seccomp/...
+    ];
+}
+/**
+ * Get the path to the apply-seccomp binary from the vendor directory
+ * Returns the path if it exists, null otherwise
+ *
+ * Pre-built apply-seccomp binaries are organized by architecture:
+ * - vendor/seccomp/{x64,arm64}/apply-seccomp
+ *
+ * Tries multiple paths for resilience:
+ * 0. Explicit path provided via parameter (checked first if provided)
+ * 1. vendor/seccomp/{arch}/apply-seccomp (bundled - when bundled into consuming packages)
+ * 2. ../../vendor/seccomp/{arch}/apply-seccomp (package root - standard npm installs)
+ * 3. ../vendor/seccomp/{arch}/apply-seccomp (dist/vendor - for bundlers)
+ * 4. Global npm install (if seccompBinaryPath not provided) - for native builds
+ *
+ * @param seccompBinaryPath - Optional explicit path to the apply-seccomp binary. If provided
+ *   and exists, it will be used. If not provided, falls back to searching local paths and
+ *   then global npm install (for native builds where vendor directory isn't bundled).
+ */
+export function getApplySeccompBinaryPath(seccompBinaryPath) {
+    const cacheKey = seccompBinaryPath ?? '';
+    if (applySeccompPathCache.has(cacheKey)) {
+        return applySeccompPathCache.get(cacheKey);
+    }
+    const local = findLocalApplySeccompPath(seccompBinaryPath);
+    const result = local !== undefined
+        ? local
+        : findGlobalApplySeccompPath(getGlobalNpmPaths());
+    applySeccompPathCache.set(cacheKey, result);
+    return result;
+}
+/**
+ * Async variant of {@link getApplySeccompBinaryPath}: same lookup order and
+ * shared cache, but the global-npm fallback resolves `npm root -g` without
+ * blocking the event loop. Resolving once through here (as
+ * checkDependenciesAsync does) makes later sync calls cache hits.
+ */
+export async function getApplySeccompBinaryPathAsync(seccompBinaryPath) {
+    const cacheKey = seccompBinaryPath ?? '';
+    if (applySeccompPathCache.has(cacheKey)) {
+        return applySeccompPathCache.get(cacheKey);
+    }
+    const local = findLocalApplySeccompPath(seccompBinaryPath);
+    const result = local !== undefined
+        ? local
+        : findGlobalApplySeccompPath(await getGlobalNpmPathsAsync());
+    applySeccompPathCache.set(cacheKey, result);
+    return result;
+}
+/**
+ * Explicit path, then bundled/package locations. Returns the path when
+ * found, null when there is nothing to look for (unsupported architecture),
+ * or undefined to fall through to the global npm install.
+ */
+function findLocalApplySeccompPath(seccompBinaryPath) {
+    // Check explicit path first (highest priority)
+    if (seccompBinaryPath) {
+        if (fs.existsSync(seccompBinaryPath)) {
+            logForDebugging(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${seccompBinaryPath}`);
+            return seccompBinaryPath;
+        }
+        logForDebugging(`[SeccompFilter] Explicit path provided but file not found: ${seccompBinaryPath}`);
+    }
+    const arch = getVendorArchitecture();
+    if (!arch) {
+        logForDebugging(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`);
+        return null;
+    }
+    logForDebugging(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${arch}`);
+    // Check local paths first (bundled or package install)
+    for (const binaryPath of getLocalSeccompPaths('apply-seccomp')) {
+        if (fs.existsSync(binaryPath)) {
+            logForDebugging(`[SeccompFilter] Found apply-seccomp binary: ${binaryPath} (${arch})`);
+            return binaryPath;
+        }
+    }
+    return undefined;
+}
+/**
+ * Fallback: check global npm install (for native builds without bundled vendor)
+ */
+function findGlobalApplySeccompPath(globalBases) {
+    const arch = getVendorArchitecture();
+    if (!arch)
+        return null;
+    for (const globalBase of globalBases) {
+        const binaryPath = join(globalBase, 'vendor', 'seccomp', arch, 'apply-seccomp');
+        if (fs.existsSync(binaryPath)) {
+            logForDebugging(`[SeccompFilter] Found apply-seccomp binary in global install: ${binaryPath} (${arch})`);
+            return binaryPath;
+        }
+    }
+    logForDebugging(`[SeccompFilter] apply-seccomp binary not found in any expected location (${arch})`);
+    return null;
+}
+//# sourceMappingURL=generate-seccomp-filter.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-seccomp-filter.js","sourceRoot":"","sources":["../../src/sandbox/generate-seccomp-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAE9D,yDAAyD;AACzD,IAAI,oBAAoB,GAAoB,IAAI,CAAA;AAChD,IAAI,qBAAqB,GAA6B,IAAI,CAAA;AAE1D,MAAM,gBAAgB,GAAG,aAAa,CAAA;AACtC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAA;IAErD,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,gBAAgB,EAAE;YACnC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,mBAAmB;YAC5B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,oBAAoB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACnD,OAAO,oBAAoB,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,oBAAoB;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACtE,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAA;IAEvD,qBAAqB,GAAG,IAAI,OAAO,CAAqB,OAAO,CAAC,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAChB,gBAAgB,EAChB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAClD,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CACnD,CAAA;YACD,wDAAwD;YACxD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,SAAS,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAChB,yEAAyE;QACzE,oDAAoD;QACpD,oBAAoB,KAApB,oBAAoB,GAAK,mBAAmB,CAAC,OAAO,CAAC,EAAA;QACrD,qBAAqB,GAAG,IAAI,CAAA;QAC5B,OAAO,oBAAoB,CAAA;IAC7B,CAAC,CAAC,CAAA;IACF,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAiC;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,gDAAgD;IAChD,MAAM,OAAO,GAAG,aAAa,EAAE,IAAI,EAAE,CAAA;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,2CAA2C;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,KAAK,CAAC,IAAI;IACR,2BAA2B;IAC3B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,EACvE,IAAI,CACF,MAAM,EACN,OAAO,EACP,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,yDAAyD;IACzD,IAAI,CACF,MAAM,EACN,UAAU,EACV,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB;IACD,wBAAwB;IACxB,IAAI,CACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,EACD,IAAI,CACF,IAAI,EACJ,aAAa,EACb,KAAK,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,CAClB,CACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,KAAK,CAAA;QACd,KAAK,OAAO;YACV,OAAO,OAAO,CAAA;QAChB,KAAK,MAAM;YACT,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,4BAA4B;YAC5B,eAAe,CACb,6GAA6G;gBAC3G,0HAA0H,EAC5H,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,OAAO,IAAI,CAAA;QACb;YACE,eAAe,CACb,6CAA6C,IAAI,qCAAqC,CACvF,CAAA;YACD,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAE9D,OAAO;QACL,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,yEAAyE;QACtG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,mCAAmC;QAC5E,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,gCAAgC;KACpE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAA;IACxC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;IAC7C,CAAC;IAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAA;IAC1D,MAAM,MAAM,GACV,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,0BAA0B,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACrD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAA;IACxC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;IAC7C,CAAC;IAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAA;IAC1D,MAAM,MAAM,GACV,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,0BAA0B,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAA;IAChE,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,iBAA0B;IAE1B,+CAA+C;IAC/C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,eAAe,CACb,kEAAkE,iBAAiB,EAAE,CACtF,CAAA;YACD,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,eAAe,CACb,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,CACb,8EAA8E,OAAO,CAAC,IAAI,EAAE,CAC7F,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe,CACb,sEAAsE,IAAI,EAAE,CAC7E,CAAA;IAED,uDAAuD;IACvD,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,+CAA+C,UAAU,KAAK,IAAI,GAAG,CACtE,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAAC,WAAqB;IACvD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CACrB,UAAU,EACV,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,eAAe,CAChB,CAAA;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,eAAe,CACb,iEAAiE,UAAU,KAAK,IAAI,GAAG,CACxF,CAAA;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,eAAe,CACb,4EAA4E,IAAI,GAAG,CACpF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.d.ts

@@ -0,0 +1,150 @@
+import type { Socket } from 'node:net';
+import type { Duplex } from 'node:stream';
+import type { Server } from 'node:http';
+import { type MitmCA } from './mitm-ca.js';
+import { type FilterRequestCallback, type MutateForwardedHeaders } from './request-filter.js';
+import { type GetBodySubstitutions } from './body-substitution.js';
+import type { PlanSigv4 } from './credential-aws-pairs.js';
+import type { ResolvedParentProxy } from './parent-proxy.js';
+import { type DirectLookup } from './parent-proxy.js';
+export interface HttpProxyServerOptions {
+    /**
+     * Host-allowlist decision. `encodedCommand` is the per-command suffix
+     * parsed from the Proxy-Authorization username (`srt.<encodedCommand>`),
+     * so the manager can attribute a denial to the invocation that made it.
+     *
+     * Receives the host exactly as the client spelled it (so denials and
+     * permission prompts show what the process asked for); the manager's
+     * filter canonicalizes internally. Every other hook below, and the
+     * upstream leg itself, get the {@link canonicalizeHost} spelling of an
+     * allowed host — see the note at the CONNECT handler's routing step.
+     */
+    filter(port: number, host: string, socket: Socket | Duplex, encodedCommand?: string): Promise<boolean> | boolean;
+    /**
+     * Optional function to get the MITM proxy socket path for a given host.
+     * If returns a socket path, the request will be routed through that MITM proxy.
+     * If returns undefined, the request will be handled directly.
+     *
+     * Called with the canonical host; the CONNECT authority / absolute URI
+     * forwarded to the MITM socket carries the same canonical spelling, so
+     * the proxy behind the socket never has to re-derive it.
+     */
+    getMitmSocketPath?(host: string): string | undefined;
+    /**
+     * If present, CONNECT requests are TLS-terminated in-process and the
+     * decrypted HTTP forwarded upstream over real TLS, instead of opening an
+     * opaque byte tunnel. Mutually exclusive with getMitmSocketPath at the
+     * config layer (sandbox-manager rejects both being set).
+     */
+    mitmCA?: MitmCA;
+    /**
+     * Per-host opt-out of TLS termination; consulted only when `mitmCA` is
+     * set. Return false to leave that CONNECT as an opaque byte tunnel
+     * (still hostname-allowlisted via `filter`, but not content-inspected —
+     * the same posture as the non-tlsTerminate path), so the sandboxed
+     * client performs its own TLS handshake end-to-end with the upstream.
+     *
+     * Use for upstreams the proxy must not re-originate: mTLS services
+     * (only the in-sandbox client holds the client certificate) and
+     * certificate-pinning clients that reject the MITM CA. Note that
+     * `filterRequest` and `mutateHeaders` never see the HTTPS traffic to
+     * these hosts; plain-HTTP proxy requests to them are unaffected (those
+     * are readable without termination and keep the normal request pipeline).
+     *
+     * Absent, or returning true, means today's behaviour: terminate.
+     */
+    shouldTerminateTLS?(hostname: string, port: number): boolean;
+    /**
+     * Per-request filter; runs on plain-HTTP proxy requests and on terminated
+     * HTTPS requests. See request-filter.ts.
+     */
+    filterRequest?: FilterRequestCallback;
+    /**
+     * Called when `filterRequest` denies a request, with the verified
+     * method/URL, the decision reason, and the encodedCommand parsed from
+     * the Proxy-Authorization username. Lets the manager record the deny in
+     * the SandboxViolationStore alongside the host-allowlist denials.
+     */
+    onFilterRequestDenied?: (info: {
+        method: string;
+        url: string;
+        reason: string;
+        encodedCommand?: string;
+    }) => void;
+    /**
+     * Mutate forwarded headers on the TLS-terminated path, after the allow
+     * decision and before the upstream request is built. The upstream leg is
+     * always cert-verified (rejectUnauthorized defaults to true), so the TLS
+     * handshake fails before any mutated header bytes reach an unverified
+     * server. See {@link MutateForwardedHeaders}.
+     */
+    mutateHeaders?: MutateForwardedHeaders;
+    /**
+     * Mutate forwarded headers on the plain-HTTP path. Separate from
+     * `mutateHeaders` so callers can wire the TLS path only — credential
+     * injection over plaintext is opt-in.
+     */
+    mutateHeadersPlaintext?: MutateForwardedHeaders;
+    /**
+     * Per-destination sentinel→real byte pairs for masked-credential
+     * substitution in request BODIES on the TLS-terminated path — the body
+     * counterpart of `mutateHeaders`. Consulted once per body-carrying
+     * request; an empty/undefined result keeps the existing bare body pipe,
+     * byte-identical. See body-substitution.ts for gating and framing rules.
+     */
+    getBodySubstitutions?: GetBodySubstitutions;
+    /**
+     * Body substitution on the plain-HTTP path. Separate from
+     * `getBodySubstitutions` for the same reason `mutateHeadersPlaintext` is
+     * separate: credential injection over plaintext is opt-in.
+     */
+    getBodySubstitutionsPlaintext?: GetBodySubstitutions;
+    /**
+     * Per-request AWS SigV4 hook on the TLS-terminated path. Runs in
+     * forwardUpstream around `mutateHeaders`: requests whose signature
+     * references a masked credential pair are re-signed with the real
+     * credentials (or denied per policy for shapes that cannot be
+     * re-signed); everything else is untouched. See credential-aws-pairs.ts.
+     */
+    planSigv4?: PlanSigv4;
+    /**
+     * Override for the SigV4 literal-hash body buffering cap
+     * (MAX_SIGV4_RESIGN_BODY_BYTES). Primarily a test seam — exercising the
+     * over-cap denial with the production 64 MiB value would need a 64 MiB
+     * fixture upload per test.
+     */
+    maxSigv4ResignBodyBytes?: number;
+    /**
+     * Additional trusted CA(s) for the terminating proxy's outbound TLS leg.
+     * Unset → system roots + NODE_EXTRA_CA_CERTS. Primarily a test seam.
+     */
+    tlsTerminateUpstreamCA?: string | Buffer | Array<string | Buffer>;
+    /**
+     * Optional upstream HTTP proxy. When present, direct-connect traffic (i.e.
+     * not routed via mitmProxy) is tunnelled through this parent instead of
+     * connecting directly. NO_PROXY-matched hosts still connect directly.
+     */
+    parentProxy?: ResolvedParentProxy;
+    /**
+     * Name resolution for DIRECT dials (opaque CONNECT tunnel, plain-HTTP
+     * forward, TLS-terminated upstream leg), bound per destination port and
+     * requesting command. The manager returns the resolved-address guard's
+     * lookup, which refuses (and records) an allow-listed hostname that
+     * resolves into denied address space; the proxy answers that with a 403.
+     * Not consulted for the mitmProxy or parentProxy routes — that hop
+     * resolves the name.
+     */
+    lookupFor?: DirectLookup;
+    /**
+     * Per-session bearer token. When set, every CONNECT and absolute-URI
+     * request must carry `Proxy-Authorization: Basic
+     * base64("srt[.<encodedCommand>]:<token>")` or it gets a 407. Without
+     * this, any host process can dial 127.0.0.1 and reach the filter
+     * callback. The optional `<encodedCommand>` suffix is parsed and passed to
+     * `filter()` / `onFilterRequestDenied` so denials can be attributed to a
+     * specific command.
+     */
+    proxyAuthToken?: string;
+}
+export declare function createHttpProxyServer(options: HttpProxyServerOptions): Server;
+//# sourceMappingURL=http-proxy.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAQvC,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAA;AAU5B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,EAOL,KAAK,YAAY,EAOlB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;OAUG;IACH,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAEpD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAE5D;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAErC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,KAAK,IAAI,CAAA;IAEV;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAA;IAEtC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAE/C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAE3C;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,oBAAoB,CAAA;IAEpD;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IAEjE;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IAEjC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,YAAY,CAAA;IAExB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CA8tB7E"}