pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-proxy.js","sourceRoot":"","sources":["../../src/sandbox/http-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAe,MAAM,cAAc,CAAA;AACpD,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,GAGrB,MAAM,qBAAqB,CAAA;AAE5B,MAAM,cAAc,GAAG;IACrB,yCAAyC;IACzC,sBAAsB;CACd,CAAA;AACV,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EAEpB,UAAU,EACV,eAAe,EAEf,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAkK1B,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACvC,eAAe,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,EAAE;YACzD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5B,IACG,GAA6B,CAAC,IAAI,KAAK,YAAY;YACpD,MAAM,CAAC,QAAQ,EACf,CAAC;YACD,iEAAiE;YACjE,gEAAgE;YAChE,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,iEAAiE;YACjE,SAAS;YACT,MAAM,MAAM,GACT,GAA6B,CAAC,IAAI,KAAK,qBAAqB;gBAC3D,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,iBAAiB,CAAA;YACvB,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;YACzD,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAA;YAClB,OAAM;QACR,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC,CAAC,CAAA;IAGF,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAc,EAAE;QACxD,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QAChD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QACtB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,cAAc,EAAE,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACnE,CAAA;IACH,CAAC,CAAA;IAED,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACvB,eAAe,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,+DAA+D;YAC/D,gEAAgE;YAChE,iEAAiE;YACjE,0DAA0D;YAC1D,8DAA8D;YAC9D,qBAAqB;YACrB,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,+DAA+D;QAC/D,oEAAoE;QACpE,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,oEAAoE;QACpE,8DAA8D;QAC9D,mEAAmE;QACnE,WAAW;QACX,EAAE;QACF,6DAA6D;QAC7D,iEAAiE;QACjE,iEAAiE;QACjE,2DAA2D;QAC3D,uDAAuD;QACvD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,gCAAgC;QAChC,MAAM,mBAAmB,GAAG,GAAG,EAAE;YAC/B,UAAU,GAAG,IAAI,CAAA;YACjB,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC,CAAA;QACD,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,sCAAsC;QACtC,EAAE;QACF,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,iEAAiE;QACjE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,iBAAiB;QACjB,EAAE;QACF,8DAA8D;QAC9D,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,kBAAkB;QAClB,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAA;QAC5C,IAAI,oBAAoB,GAAG,CAAC,CAAA;QAC5B,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE;YACvC,IAAI,CAAC,SAAS;gBAAE,OAAM;YACtB,oBAAoB,IAAI,KAAK,CAAC,MAAM,CAAA;YACpC,IAAI,oBAAoB,GAAG,0BAA0B,EAAE,CAAC;gBACtD,eAAe,CACb,mEAAmE,EACnE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;gBACD,mBAAmB,EAAE,CAAA;gBACrB,OAAM;YACR,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,SAAS,GAAG,IAAI,CAAA;YAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QACnC,CAAC;QACD,kEAAkE;QAClE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,mBAAmB,EAAE,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;QACzC,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,+BAA+B;QAC/B,MAAM,qBAAqB,GAAG,GAAG,EAAE;YACjC,SAAS,GAAG,KAAK,CAAA;YACjB,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;gBACxB,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC,CAAA;gBAC7C,YAAY,CAAC,MAAM,GAAG,CAAC,CAAA;YACzB,CAAC;QACH,CAAC,CAAA;QACD,MAAM,uBAAuB,GAAG,GAAG,EAAE;YACnC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;YACjD,qBAAqB,EAAE,CAAA;QACzB,CAAC,CAAA;QACD,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE;YACxC,IACE,UAAU;gBACV,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,aAAa;gBACpB,CAAC,MAAM,CAAC,QAAQ,EAChB,CAAC;gBACD,eAAe,CACb,iFAAiF,CAClF,CAAA;gBACD,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,OAAM;YACR,CAAC;YACD,+DAA+D;YAC/D,8DAA8D;YAC9D,kEAAkE;YAClE,uBAAuB,EAAE,CAAA;YACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC,CAAA;QACD,oEAAoE;QACpE,mEAAmE;QACnE,4DAA4D;QAC5D,2DAA2D;QAC3D,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,OAAM;QACR,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,aAAa,CACX,gDAAgD;oBAC9C,+CAA+C,CAClD,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,4BAA4B,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,aAAa,CAAC,kCAAkC,CAAC,CAAA;gBACjD,OAAM;YACR,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YAEhD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAClC,IAAI,EACJ,aAAa,EACb,MAAM,EACN,IAAI,CAAC,cAAc,CACpB,CAAA;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,aAAa,IAAI,IAAI,EAAE,EAAE;oBAChE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,aAAa,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,CAAC,CAAA;gBAC3C,OAAM;YACR,CAAC;YACD,gEAAgE;YAChE,6DAA6D;YAC7D,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,OAAM;YACR,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,6DAA6D;YAC7D,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,iEAAiE;YACjE,gEAAgE;YAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAA;YACjE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;YAE7D,yBAAyB;YACzB,+BAA+B;YAC/B,gCAAgC;YAChC,wBAAwB;YACxB,aAAa;YACb,mEAAmE;YACnE,6CAA6C;YAC7C,IACE,OAAO,CAAC,MAAM;gBACd,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,EACtD,CAAC;gBACD,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnE,sDAAsD;gBACtD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAC3D,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACrD,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACnC,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,uBAAuB,EAAE,CAAA;oBACzB,mBAAmB,CACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,oBAAoB,EAC5B,MAAM,EACN,MAAM,CAAC,IAAI,EACX;wBACE,QAAQ;wBACR,IAAI;wBACJ,UAAU,EAAE,OAAO,CAAC,sBAAsB;wBAC1C,MAAM;wBACN,mBAAmB,EAAE,OAAO,CAAC,qBAAqB;4BAChD,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACtB,OAAO,CAAC,qBAAsB,CAAC;gCAC7B,MAAM;gCACN,GAAG;gCACH,MAAM;gCACN,cAAc,EAAE,IAAI,CAAC,cAAc;6BACpC,CAAC;4BACN,CAAC,CAAC,SAAS;qBACd,EACD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,uBAAuB,CAChC,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,eAAe,CACb,4CAA4C,QAAQ,IAAI,IAAI,qBAAqB,CAClF,CAAA;gBACD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1B,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,eAAe,CACb,kCAAkC,QAAQ,IAAI,IAAI,qBAAqB,CACxE,CAAA;YACH,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CACb,mBAAmB,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CAC9E,CAAA;oBACD,QAAQ,GAAG,MAAM,iBAAiB,CAAC;wBACjC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;wBAC7C,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,SAAS,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;gBACrD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,sEAAsE;gBACtE,uDAAuD;gBACvD,IAAI,QAAQ;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;qBACzB,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;gBACvC,CAAC;;oBAAM,aAAa,CAAC,kCAAkC,CAAC,CAAA;gBACxD,OAAM;YACR,CAAC;YAED,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8BAA8B;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,OAAM;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;YACD,uBAAuB,EAAE,CAAA;YACzB,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,qCAAqC;YACrC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAA;YAC3B,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACzB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;oBACvD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,2BAA2B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,QAAQ;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;;gBACzB,aAAa,CAAC,4CAA4C,CAAC,CAAA;QAClE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gDAAgD;QAChD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACpB,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;gBACtD,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACpB,eAAe,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvD,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,8DAA8D;YAC9D,2DAA2D;YAC3D,gEAAgE;YAChE,2BAA2B;YAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;QACvB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,qEAAqE;YACrE,2DAA2D;YAC3D,oDAAoD;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,8DAA8D;YAC9D,qEAAqE;YACrE,mEAAmE;YACnE,qBAAqB;YACrB,IACE,OAAO,CAAC,MAAM;gBACd,GAAG,CAAC,MAAM,KAAK,KAAK;gBACpB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EACxD,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,sBAAsB;oBACtC,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;iBAC/C,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC9B,OAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACtC,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAClC,IAAI,EACJ,aAAa,EACb,GAAG,CAAC,MAAM,EACV,IAAI,CAAC,cAAc,CACpB,CAAA;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,2BAA2B,aAAa,IAAI,IAAI,EAAE,EAAE;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,yDAAyD;gBACzD,wDAAwD;gBACxD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,aAAa;gBACb,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC1C,GAAG,CAAC,OAAO,EAAE,CAAA;oBACb,OAAM;gBACR,CAAC;gBACD,aAAa,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAA;gBACrC,OAAM;YACR,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAEhC,+DAA+D;YAC/D,+DAA+D;YAC/D,iEAAiE;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAA;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,sDAAsD;YACtD,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;YAE9D,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YACrE,OAAO,CAAC,sBAAsB,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACtD,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,aAAa,GAAG,uBAAuB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,GAAG,EACH,UAAU,EACV,QAAQ,CACT,CAAA;YAED,wEAAwE;YACxE,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,SAAS,GACb,CAAC,cAAc;gBACf,OAAO,CAAC,WAAW;gBACnB,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE;oBACxC,OAAO;iBACR,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAA;YAEf,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;YAE1E,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,IAAI,GAAa,GAAG,CAAA;YACxB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,OAAO,CAAC,aAAa,EACrB,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,CAAC,MAAM,EACT,OAAO,CAAC,qBAAqB;oBAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACtB,OAAO,CAAC,qBAAsB,CAAC;wBAC7B,MAAM;wBACN,GAAG;wBACH,MAAM;wBACN,cAAc,EAAE,IAAI,CAAC,cAAc;qBACpC,CAAC;oBACN,CAAC,CAAC,SAAS,CACd,CAAA;gBACD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAM;gBACxB,IAAI,GAAG,GAAG,CAAA;gBACV,+DAA+D;gBAC/D,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,gEAAgE;gBAChE,0DAA0D;gBAC1D,IACE,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;oBACrC,GAAG,CAAC,SAAS;oBACb,GAAG,CAAC,MAAM,CAAC,SAAS;oBACpB,IAAI,CAAC,SAAS,EACd,CAAC;oBACD,IAAI,CAAC,OAAO,EAAE,CAAA;oBACd,OAAM;gBACR,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,0DAA0D;YAC1D,6DAA6D;YAC7D,iEAAiE;YACjE,2CAA2C;YAC3C,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAClE,CAAA;YACD,IACE,kBAAkB;gBAClB,UAAU,CAAC,gBAAgB,CAAC,KAAK,SAAS;gBAC1C,UAAU,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAC7C,CAAC;gBACD,UAAU,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC7C,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,GAAU,EAAE,EAAE;gBAClC,eAAe,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAChC,CAAC,CAAA;YACD,IAAI,QAAQ,CAAA;YACZ,IAAI,cAAc,EAAE,CAAC;gBACnB,eAAe,CACb,gBAAgB,GAAG,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,0BAA0B,cAAc,EAAE,CACzF,CAAA;gBACD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;oBAC1B,0DAA0D;oBAC1D,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAA;gBACF,QAAQ,GAAG,WAAW,CACpB;oBACE,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,6DAA6D;oBAC7D,0DAA0D;oBAC1D,wBAAwB;oBACxB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBACzB,eAAe,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,EAAE;4BACzD,KAAK,EAAE,OAAO;yBACf,CAAC,CAAA;wBACF,GAAG,CAAC,OAAO,EAAE,CAAA;oBACf,CAAC,CAAC,CAAA;oBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACxE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;gBACvC,MAAM,SAAS,GACb,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC9D,QAAQ,GAAG,SAAS,CAClB;oBACE,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI;wBACX,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE;wBAChD,CAAC,CAAC,UAAU;iBACf,EACD,QAAQ,CAAC,EAAE;oBACT,6DAA6D;oBAC7D,0DAA0D;oBAC1D,wBAAwB;oBACxB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBACzB,eAAe,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,EAAE;4BACzD,KAAK,EAAE,OAAO;yBACf,CAAC,CAAA;wBACF,GAAG,CAAC,OAAO,EAAE,CAAA;oBACf,CAAC,CAAC,CAAA;oBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,wEAAwE;gBACxE,IAAI,MAA4B,CAAA;gBAChC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,oBAAoB,CACjC,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,EAC9C,OAAO,CACR,CAAA;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,YAAY,CAAC,GAAY,CAAC,CAAA;oBAC1B,OAAM;gBACR,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAC1C,oCAAoC;oBACpC,IAAI,CAAC,OAAO,EAAE,CAAA;oBACd,OAAM;gBACR,CAAC;gBACD,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAC/C;oBACE,GAAG,MAAM;oBACT,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,UAAU;iBACpB,EACD,QAAQ,CAAC,EAAE;oBACT,6DAA6D;oBAC7D,0DAA0D;oBAC1D,wBAAwB;oBACxB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBACzB,eAAe,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,EAAE;4BACzD,KAAK,EAAE,OAAO;yBACf,CAAC,CAAA;wBACF,GAAG,CAAC,OAAO,EAAE,CAAA;oBACf,CAAC,CAAC,CAAA;oBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;oBACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpB,CAAC,CACF,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YAElC,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAEzC,IAAI,aAAa,EAAE,CAAC;gBAClB,+DAA+D;gBAC/D,mEAAmE;gBACnE,UAAU;gBACV,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;gBACvD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;gBACnD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzC,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,8DAA8D;gBAC9D,gEAAgE;gBAChE,qBAAqB;gBACrB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAc;IAEd,MAAM,CAAC,GACL,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,SAAS,CAAA;IACzE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/java-proxy-agent.d.ts

@@ -0,0 +1,32 @@
+export declare const JAVA_PROXY_AGENT_JAR_NAME = "srt-proxy-agent.jar";
+/**
+ * Locate srt-proxy-agent.jar. Order:
+ * 0. explicit path (config `javaAgentJarPath`) — used if it exists,
+ * 1. vendor/java-proxy-agent/ next to this module (bundled),
+ * 2. ../../vendor/java-proxy-agent/ (package root — normal npm install),
+ * 3. ../vendor/java-proxy-agent/ (dist/vendor — some bundlers),
+ * 4. a global npm install of the package (native builds without vendor/).
+ * Returns null when nothing is found; callers then leave JAVA_TOOL_OPTIONS
+ * alone (JVMs are simply not proxy-aware, as before) rather than failing.
+ *
+ * The global-npm fallback resolves `npm root -g` without blocking the event
+ * loop.
+ */
+export declare function getJavaProxyAgentJarPathAsync(explicitPath?: string): Promise<string | null>;
+/**
+ * Compose the JAVA_TOOL_OPTIONS value for a sandboxed child.
+ *
+ * `-javaagent:<jar>` is prepended when a jar path is given; `flags` are
+ * appended (e.g. macOS's -Djava.net.preferIPv4Stack=true). The parent's
+ * own JAVA_TOOL_OPTIONS is preserved unless that var is on the
+ * credential-deny list, in which case it is dropped so the deny holds.
+ * Flags already present in the inherited value are not duplicated.
+ * Returns undefined when there is nothing to set.
+ */
+export declare function buildJavaToolOptions(opts: {
+    agentJarPath?: string;
+    flags?: string[];
+    unsetEnvVars?: string[];
+    inherited?: string;
+}): string | undefined;
+//# sourceMappingURL=java-proxy-agent.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/java-proxy-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java-proxy-agent.d.ts","sourceRoot":"","sources":["../../src/sandbox/java-proxy-agent.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,yBAAyB,wBAAwB,CAAA;AAI9D;;;;;;;;;;;;GAYG;AACH,wBAAsB,6BAA6B,CACjD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,GAAG,SAAS,CAYrB"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/java-proxy-agent.js

@@ -0,0 +1,111 @@
+/**
+ * JVM proxy agent: makes Java tools inside the sandbox honour the proxy.
+ *
+ * The JVM ignores HTTPS_PROXY/NO_PROXY — proxy selection is driven by the
+ * `https.proxyHost` family of system properties, and the credential the
+ * proxy requires can only be supplied through `java.net.Authenticator`,
+ * which needs code running inside the JVM. Env vars alone can't do that,
+ * so gRPC-Java (Bazel's remote cache), Gradle, Maven, etc. either dial the
+ * target directly (no route out of the sandbox) or hit the proxy without
+ * the token and get a 407.
+ *
+ * The fix is a tiny `-javaagent` (source in vendor/java-proxy-agent-src,
+ * built into vendor/java-proxy-agent/srt-proxy-agent.jar by the release
+ * workflow) that, at JVM start-up, translates the proxy env vars into
+ * system properties and installs an Authenticator for the proxy endpoint.
+ * This module locates that jar — same lookup shape as the apply-seccomp
+ * binary — and builds the JAVA_TOOL_OPTIONS value that points every JVM in
+ * the sandbox at it. The env var carries only the jar path; the credential
+ * stays in HTTPS_PROXY, which the agent reads itself, so the JVM's "Picked
+ * up JAVA_TOOL_OPTIONS: …" stderr line leaks nothing.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { logForDebugging } from '../utils/debug.js';
+import { getGlobalNpmPathsAsync } from './generate-seccomp-filter.js';
+export const JAVA_PROXY_AGENT_JAR_NAME = 'srt-proxy-agent.jar';
+const jarPathCache = new Map();
+/**
+ * Locate srt-proxy-agent.jar. Order:
+ * 0. explicit path (config `javaAgentJarPath`) — used if it exists,
+ * 1. vendor/java-proxy-agent/ next to this module (bundled),
+ * 2. ../../vendor/java-proxy-agent/ (package root — normal npm install),
+ * 3. ../vendor/java-proxy-agent/ (dist/vendor — some bundlers),
+ * 4. a global npm install of the package (native builds without vendor/).
+ * Returns null when nothing is found; callers then leave JAVA_TOOL_OPTIONS
+ * alone (JVMs are simply not proxy-aware, as before) rather than failing.
+ *
+ * The global-npm fallback resolves `npm root -g` without blocking the event
+ * loop.
+ */
+export async function getJavaProxyAgentJarPathAsync(explicitPath) {
+    const key = explicitPath ?? '';
+    const cached = jarPathCache.get(key);
+    if (cached !== undefined)
+        return cached;
+    const found = findLocalJar(explicitPath) ?? findGlobalJar(await getGlobalNpmPathsAsync());
+    jarPathCache.set(key, found);
+    return found;
+}
+const JAR_REL_PATH = join('vendor', 'java-proxy-agent', JAVA_PROXY_AGENT_JAR_NAME);
+/** Steps 0–3 of the lookup; undefined means try the global npm install. */
+function findLocalJar(explicitPath) {
+    if (explicitPath) {
+        if (existsSync(explicitPath))
+            return explicitPath;
+        logForDebugging(`[java-proxy-agent] javaAgentJarPath not found: ${explicitPath}`, { level: 'warn' });
+    }
+    const baseDir = dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        join(baseDir, JAR_REL_PATH),
+        join(baseDir, '..', '..', JAR_REL_PATH),
+        join(baseDir, '..', JAR_REL_PATH),
+    ];
+    return candidates.find(p => existsSync(p));
+}
+/** Step 4 of the lookup: a global npm install of the package. */
+function findGlobalJar(globalBases) {
+    for (const base of globalBases) {
+        const p = join(base, JAR_REL_PATH);
+        if (existsSync(p))
+            return p;
+    }
+    logForDebugging(`[java-proxy-agent] ${JAVA_PROXY_AGENT_JAR_NAME} not found; JVMs in the ` +
+        `sandbox will not be pointed at the proxy (run \`npm run build:java-agent\`)`, { level: 'warn' });
+    return null;
+}
+/**
+ * Compose the JAVA_TOOL_OPTIONS value for a sandboxed child.
+ *
+ * `-javaagent:<jar>` is prepended when a jar path is given; `flags` are
+ * appended (e.g. macOS's -Djava.net.preferIPv4Stack=true). The parent's
+ * own JAVA_TOOL_OPTIONS is preserved unless that var is on the
+ * credential-deny list, in which case it is dropped so the deny holds.
+ * Flags already present in the inherited value are not duplicated.
+ * Returns undefined when there is nothing to set.
+ */
+export function buildJavaToolOptions(opts) {
+    const denied = (opts.unsetEnvVars ?? []).includes('JAVA_TOOL_OPTIONS');
+    const inherited = denied ? '' : (opts.inherited ?? '');
+    const parts = [];
+    if (opts.agentJarPath) {
+        parts.push(javaAgentFlag(opts.agentJarPath));
+    }
+    if (inherited)
+        parts.push(inherited);
+    for (const flag of opts.flags ?? []) {
+        if (!inherited.includes(flag) && !parts.includes(flag))
+            parts.push(flag);
+    }
+    return parts.length > 0 ? parts.join(' ') : undefined;
+}
+/**
+ * The JVM tokenizes JAVA_TOOL_OPTIONS on whitespace but honours double
+ * quotes, so a jar path containing whitespace is wrapped in them.
+ */
+function javaAgentFlag(jarPath) {
+    const flag = `-javaagent:${jarPath}`;
+    return /\s/.test(jarPath) ? `"${flag}"` : flag;
+}
+//# sourceMappingURL=java-proxy-agent.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/java-proxy-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java-proxy-agent.js","sourceRoot":"","sources":["../../src/sandbox/java-proxy-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAErE,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAA;AAE9D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAqB;IAErB,MAAM,GAAG,GAAG,YAAY,IAAI,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,MAAM,KAAK,GACT,YAAY,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAA;IAC7E,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,CACvB,QAAQ,EACR,kBAAkB,EAClB,yBAAyB,CAC1B,CAAA;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,YAAqB;IACzC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,YAAY,CAAA;QACjD,eAAe,CACb,kDAAkD,YAAY,EAAE,EAChE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC;KAClC,CAAA;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,WAAqB;IAC1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAClC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,eAAe,CACb,sBAAsB,yBAAyB,0BAA0B;QACvE,6EAA6E,EAC/E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,cAAc,OAAO,EAAE,CAAA;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/linux-sandbox-utils.d.ts

@@ -0,0 +1,305 @@
+import type { ChildProcess } from 'node:child_process';
+import { type RipgrepConfig } from '../utils/ripgrep.js';
+import type { FsReadRestrictionConfig, FsWriteRestrictionConfig } from './sandbox-schemas.js';
+import type { SeccompConfig } from './sandbox-config.js';
+export interface LinuxNetworkBridgeContext {
+    httpSocketPath: string;
+    socksSocketPath: string;
+    httpBridgeProcess: ChildProcess;
+    socksBridgeProcess: ChildProcess;
+    httpProxyPort: number;
+    socksProxyPort: number;
+}
+export interface LinuxSandboxParams {
+    command: string;
+    /** Attribution key encoded for violation correlation; defaults to
+     *  `command`. See MacOSSandboxParams.commandId. */
+    commandId?: string;
+    needsNetworkRestriction: boolean;
+    httpSocketPath?: string;
+    socksSocketPath?: string;
+    httpProxyPort?: number;
+    socksProxyPort?: number;
+    /** Per-session proxy auth token; embedded in proxy env URLs. */
+    proxyAuthToken?: string;
+    /** Path to the TLS-termination CA cert; injected as trust env vars. */
+    caCertPath?: string;
+    /** Path to the JVM proxy agent jar; injected via JAVA_TOOL_OPTIONS. */
+    javaAgentJarPath?: string;
+    readConfig?: FsReadRestrictionConfig;
+    writeConfig?: FsWriteRestrictionConfig;
+    /** Environment variable names to unset inside the sandbox (bwrap --unsetenv) */
+    unsetEnvVars?: string[];
+    /** Environment variables to set inside the sandbox (bwrap --setenv NAME VALUE) */
+    setEnvVars?: Record<string, string>;
+    /**
+     * Whole-file credential masks: bind fakePath (sentinel content) over
+     * realPath read-only so the sandbox reads the sentinel.
+     */
+    maskedFileBinds?: Array<{
+        realPath: string;
+        fakePath: string;
+    }>;
+    /**
+     * Host directory holding the fake files. Ro-bound over itself so the
+     * sandbox cannot write the bind sources even if allowWrite covers it.
+     */
+    maskedFileStoreDir?: string;
+    enableWeakerNestedSandbox?: boolean;
+    allowAllUnixSockets?: boolean;
+    binShell?: string;
+    ripgrepConfig?: RipgrepConfig;
+    /** Maximum directory depth to search for dangerous files (default: 3) */
+    mandatoryDenySearchDepth?: number;
+    /** Allow writes to .git/config files (default: false) */
+    allowGitConfig?: boolean;
+    /**
+     * Directories to emit as `safe.directory` via `GIT_CONFIG_*` env
+     * vars (see {@link buildPosixGitSafeDirEnv}). Under `--unshare-user`
+     * the repo owner's uid is unmapped inside the sandbox, so git
+     * refuses with "detected dubious ownership" without this.
+     */
+    gitSafeDirectories?: readonly string[];
+    /** Custom seccomp binary paths */
+    seccompConfig?: SeccompConfig;
+    /** Absolute path to the bwrap binary (default: resolve "bwrap" via PATH) */
+    bwrapPath?: string;
+    /** Absolute path to the socat binary (default: resolve "socat" via PATH) */
+    socatPath?: string;
+    /** Filesystem unix socket bound by the Linux violation monitor. When set,
+     *  the socket is bind-mounted into the sandbox and apply-seccomp is told
+     *  (via SRT_OBSERVE_SOCK) to install a USER_NOTIF observation filter and
+     *  stream observed write-intent paths over that socket as newline JSON. */
+    observeSocketPath?: string;
+    /** Abort signal to cancel the ripgrep scan */
+    abortSignal?: AbortSignal;
+}
+/**
+ * The part of the mandatory deny set that follows from the cwd alone: the
+ * dangerous files and directories resolved against it, plus `.git/hooks` and
+ * (unless the caller allows git config) `.git/config`.
+ * {@link linuxGetMandatoryDenyPaths} adds the nested matches its ripgrep scan
+ * finds on top of these. Split out so a consumer that must not scan — the
+ * violation monitor, which needs the same denies to judge a write bwrap
+ * refuses — reads the same definition rather than a copy of it.
+ */
+export declare function linuxGetCwdMandatoryDenyPaths(allowGitConfig?: boolean): string[];
+export declare const CAP_SETFCAP = 31;
+/**
+ * Whether this process holds `cap` in its bounding or inheritable set (Linux).
+ *
+ * bwrap is reached by execve, and for a euid-0 caller the kernel recomputes
+ * the new permitted set from the bounding and inheritable sets, discarding
+ * what the caller itself had permitted. Those two sets are therefore what
+ * decides which capabilities bwrap holds when it writes its uid map; CapPrm
+ * and CapEff do not, and for any process itself reached by exec as root they
+ * merely repeat the union.
+ */
+export declare function processHasBoundingCapability(cap: number): boolean;
+/**
+ * The capability set an execve gives a euid-0 caller's child, parsed out of a
+ * `/proc/<pid>/status`: CapBnd unioned with CapInh. `undefined` when either
+ * line is absent. CapPrm and CapEff are deliberately not consulted — see
+ * processHasBoundingCapability.
+ */
+export declare function boundingCapabilitiesFromStatus(status: string): bigint | undefined;
+/**
+ * The bwrap capability list. Always `--cap-drop ALL`, which for a non-root
+ * caller is bwrap's default anyway. `--cap-add CAP_SETFCAP` for the whole
+ * bwrap invocation — the outer shell and the two socat relays hold it too —
+ * when the caller is uid 0, the seccomp helper is in use and the capability
+ * survives into bwrap: the helper's nested user namespace maps uid 0, which
+ * Linux 5.12 and the distribution kernels that backported it allow only from
+ * a creator holding CAP_SETFCAP. Under the helper a uid-0 caller's command
+ * therefore has a full set inside that nested namespace, which is
+ * identity-mapped to the caller's uid 0, and the filesystem policy there
+ * rests on the nested namespace's mount copies being locked. Without the
+ * helper (`allowAllUnixSockets`, or no usable helper binary) the command runs
+ * in bwrap's own namespaces and `--cap-drop ALL` is what stops it unmounting
+ * a deny.
+ *
+ * Pure: `hasSetfcap` is decided by the caller, which is also where the
+ * missing-capability case is reported once per process.
+ */
+export declare function capabilityArgs({ euid, hasSetfcap, usesSeccompHelper, }: {
+    euid: number | undefined;
+    hasSetfcap: boolean;
+    usesSeccompHelper: boolean;
+}): string[];
+export declare const CAP_SETFCAP_MISSING_MESSAGE: string;
+/** Why a bubblewrap profile could not be run. */
+export type LinuxSandboxProfileErrorCode = 
+/** More arguments than bubblewrap parses, on the line or through a file. */
+'too_many_arguments'
+/** A mount path holds a NUL byte, which no carrier of arguments can hold. */
+ | 'nul_in_path'
+/**
+ * No unnamed file could be opened to carry the mounts: passing (this
+ * process is out of descriptors) or lasting (no directory on this host
+ * takes one). The error on `.cause` names each directory tried and what it
+ * said.
+ */
+ | 'args_file_unavailable'
+/** The line does not fit one shell argument even with the mounts in a file. */
+ | 'command_too_long';
+/**
+ * Thrown when a Linux bubblewrap profile cannot be run on this host: what the
+ * configuration expands to is past a limit, or, for `command_too_long` and
+ * `nul_in_path`, what the caller passed in is. The command was not run and no
+ * profile file stays open, so do not run the per-command cleanup
+ * (`cleanupAfterCommand()`, `cleanupBwrapMountPoints()`) for a wrap that
+ * threw: it would release a second time, and a sandbox still running would
+ * lose its mount points. Branch on `.code`, never on `.message`, which
+ * carries the sizes of the moment. Other wrap-time failures (a shell that is
+ * not on PATH, a bridge socket that is gone) are plain Errors.
+ */
+export declare class LinuxSandboxProfileError extends Error {
+    readonly code: LinuxSandboxProfileErrorCode;
+    readonly cause?: unknown;
+    constructor(code: LinuxSandboxProfileErrorCode, message: string, cause?: unknown);
+}
+/**
+ * Clean up mount point files created by bwrap for non-existent deny paths.
+ *
+ * When protecting non-existent deny paths, bwrap creates empty files on the
+ * host filesystem as mount points for --ro-bind. These files persist after
+ * bwrap exits. This function removes them.
+ *
+ * This should be called after each sandboxed command completes to prevent
+ * ghost dotfiles (e.g. .bashrc, .gitconfig) from appearing in the working
+ * directory. It is also called automatically on process exit as a safety net.
+ *
+ * Each call decrements the active-sandbox counter that was incremented by
+ * wrapCommandWithSandboxLinux(). File deletion is deferred until the counter
+ * reaches zero. Deleting a mount point file on the host while another bwrap
+ * instance is still running detaches that instance's bind mount (the dentry
+ * is unhashed, so path lookup no longer finds the mount) and the deny rule
+ * stops applying inside that sandbox.
+ *
+ * Pass `{ force: true }` to delete unconditionally — used by the process-exit
+ * handler and reset() where deferral is not meaningful.
+ *
+ * Also closes the `--args` profiles the wraps of this batch opened.
+ */
+export declare function cleanupBwrapMountPoints(opts?: {
+    force?: boolean;
+}): void;
+/**
+ * Detailed status of Linux sandbox dependencies
+ */
+export type LinuxDependencyStatus = {
+    hasBwrap: boolean;
+    hasSocat: boolean;
+    hasSeccompApply: boolean;
+};
+/**
+ * Result of checking sandbox dependencies
+ */
+export type SandboxDependencyCheck = {
+    warnings: string[];
+    errors: string[];
+};
+/**
+ * Options for Linux dependency checks. Explicit binary paths, when set,
+ * are checked directly instead of resolving via PATH.
+ */
+export type LinuxDependencyOptions = {
+    seccompConfig?: SeccompConfig;
+    bwrapPath?: string;
+    socatPath?: string;
+};
+/**
+ * Get detailed status of Linux sandbox dependencies
+ */
+export declare function getLinuxDependencyStatus(opts?: LinuxDependencyOptions): LinuxDependencyStatus;
+/**
+ * Check sandbox dependencies and return structured result
+ */
+export declare function checkLinuxDependencies(opts?: LinuxDependencyOptions): SandboxDependencyCheck;
+/**
+ * Predict, then confirm. The prediction — uid 0 with no CAP_SETFCAP to hand
+ * to bwrap — is exact about the capability but not about the kernel, so ask
+ * bubblewrap itself before failing the caller's initialize(). An error, not a
+ * warning: if it holds, every sandboxed command fails.
+ *
+ * `bwrap === null` skips the probe: a missing or unusable bubblewrap is
+ * already its own dependency error, and a second one about capabilities would
+ * only misdirect.
+ */
+export declare function uid0SandboxError({ euid, hasSetfcap, bwrap, }: {
+    euid: number | undefined;
+    hasSetfcap: boolean;
+    bwrap: string | null;
+}): string | null;
+/**
+ * Initialize the Linux network bridge for sandbox networking
+ *
+ * ARCHITECTURE NOTE:
+ * Linux network sandboxing uses bwrap --unshare-net which creates a completely isolated
+ * network namespace with NO network access. To enable network access, we:
+ *
+ * 1. Host side: Run socat bridges that listen on Unix sockets and forward to host proxy servers
+ *    - HTTP bridge: Unix socket -> host HTTP proxy (for HTTP/HTTPS traffic)
+ *    - SOCKS bridge: Unix socket -> host SOCKS5 proxy (for SSH/git traffic)
+ *
+ * 2. Sandbox side: Bind the Unix sockets into the isolated namespace and run socat listeners
+ *    - HTTP listener on port 3128 -> HTTP Unix socket -> host HTTP proxy
+ *    - SOCKS listener on port 1080 -> SOCKS Unix socket -> host SOCKS5 proxy
+ *
+ * 3. Configure environment:
+ *    - HTTP_PROXY=http://localhost:3128 for HTTP/HTTPS tools
+ *    - GIT_SSH_COMMAND with socat for SSH through SOCKS5
+ *
+ * LIMITATION: Unlike macOS sandbox which can enforce domain-based allowlists at the kernel level,
+ * Linux's --unshare-net provides only all-or-nothing network isolation. Domain filtering happens
+ * at the host proxy level, not the sandbox boundary. This means network restrictions on Linux
+ * depend on the proxy's filtering capabilities.
+ *
+ * DEPENDENCIES: Requires bwrap (bubblewrap) and socat
+ */
+export declare function initializeLinuxNetworkBridge(httpProxyPort: number, socksProxyPort: number, socatPath?: string): Promise<LinuxNetworkBridgeContext>;
+/**
+ * Wrap a command with sandbox restrictions on Linux
+ *
+ * UNIX SOCKET BLOCKING (APPLY-SECCOMP):
+ * This implementation uses a custom apply-seccomp binary to block Unix domain socket
+ * creation for user commands while allowing network infrastructure:
+ *
+ * The two stages are described in README.md, "Unix Socket Restrictions
+ * (Linux)".
+ *
+ * This solves the conflict between:
+ * - Security: Blocking arbitrary Unix socket creation in user commands
+ * - Functionality: Network sandboxing requires socat to call socket(AF_UNIX, ...) for bridge connections
+ *
+ * The seccomp-bpf filter blocks socket(AF_UNIX, ...) syscalls, preventing:
+ * - Creating new Unix domain socket file descriptors
+ *
+ * Security limitations:
+ * - Does NOT block operations (bind, connect, sendto, etc.) on inherited Unix socket FDs
+ * - Does NOT prevent passing Unix socket FDs via SCM_RIGHTS
+ * - For most sandboxing use cases, blocking socket creation is sufficient
+ *
+ * The filter allows:
+ * - All TCP/UDP sockets (AF_INET, AF_INET6) for normal network operations
+ * - All other syscalls
+ *
+ * PLATFORM NOTE:
+ * The allowUnixSockets configuration is not path-based on Linux (unlike macOS)
+ * because seccomp-bpf cannot inspect user-space memory to read socket paths.
+ *
+ * Requirements for seccomp filtering:
+ * - Pre-built apply-seccomp binaries are included for x64 and ARM64
+ * - Pre-generated BPF filters are included for x64 and ARM64
+ * - Other architectures are not currently supported (no apply-seccomp binary available)
+ * - To use sandboxing without Unix socket blocking on unsupported architectures,
+ *   set allowAllUnixSockets: true in your configuration
+ * Dependencies are checked by checkLinuxDependencies() before enabling the sandbox.
+ *
+ * CALLER OBLIGATION: the euid and capability decisions behind the returned
+ * string are made here, in the process that builds it, so the string must be
+ * run by a process with the same euid and the same capability bounding and
+ * inheritable sets.
+ */
+export declare function wrapCommandWithSandboxLinux(params: LinuxSandboxParams): Promise<string>;
+//# sourceMappingURL=linux-sandbox-utils.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/linux-sandbox-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-sandbox-utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGtD,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAgBjE,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,iBAAiB,EAAE,YAAY,CAAA;IAC/B,kBAAkB,EAAE,YAAY,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf;uDACmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uBAAuB,EAAE,OAAO,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,uBAAuB,CAAA;IACpC,WAAW,CAAC,EAAE,wBAAwB,CAAA;IACtC,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/D;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,kCAAkC;IAClC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;+EAG2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AA2KD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,UAAQ,GACrB,MAAM,EAAE,CAkCV;AAuKD,eAAO,MAAM,WAAW,KAAK,CAAA;AAW7B;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAwBjE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,IAAI,EACJ,UAAU,EACV,iBAAiB,GAClB,EAAE;IACD,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;IACnB,iBAAiB,EAAE,OAAO,CAAA;CAC3B,GAAG,MAAM,EAAE,CAMX;AAaD,eAAO,MAAM,2BAA2B,QAIyD,CAAA;AA6IjG,iDAAiD;AACjD,MAAM,MAAM,4BAA4B;AACtC,4EAA4E;AAC1E,oBAAoB;AACtB,6EAA6E;GAC3E,aAAa;AACf;;;;;GAKG;GACD,uBAAuB;AACzB,+EAA+E;GAC7E,kBAAkB,CAAA;AAEtB;;;;;;;;;;GAUG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;IAC3C,SAAiB,KAAK,CAAC,EAAE,OAAO,CAAA;gBAE9B,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO;CAgBlB;AA8GD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAuExE;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAWD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,qBAAqB,CAWvB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,sBAAsB,CAsCxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,UAAU,EACV,KAAK,GACN,EAAE;IACD,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,GAAG,MAAM,GAAG,IAAI,CAOhB;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAmJpC;AAgjDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAqWjB"}