pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.js

@@ -0,0 +1,445 @@
+/**
+ * Parent/upstream HTTP proxy support.
+ *
+ * When SRT runs in an environment that requires an HTTP proxy for outbound
+ * internet access (e.g. inside a VM on a host behind a corporate proxy),
+ * SRT's own proxies must chain through that upstream rather than connecting
+ * directly.
+ *
+ * This module provides:
+ *   - config resolution (explicit config -> HTTP_PROXY/HTTPS_PROXY/NO_PROXY env)
+ *   - NO_PROXY matching (hostname suffix + CIDR via net.BlockList). Follows
+ *     golang.org/x/net/http/httpproxy semantics for suffix matching. Note:
+ *     port-specific NO_PROXY entries (e.g. `host:8080`) are matched by host
+ *     only; the port is ignored.
+ *   - a generic CONNECT-tunnel helper that works over Unix socket, TCP, or TLS
+ */
+import { BlockList, connect as netConnect, isIP } from 'node:net';
+import { connect as tlsConnect } from 'node:tls';
+import { URL } from 'node:url';
+import { logForDebugging } from '../utils/debug.js';
+import { addRange, addressInSet, isLoopbackAddress, mappedIPv4, } from './address.js';
+const CONNECT_TIMEOUT_MS = 30000;
+/**
+ * Hop-by-hop headers per RFC 7230 §6.1, plus proxy-specific headers that
+ * MUST NOT be forwarded to the upstream. `transfer-encoding` is included
+ * because we re-frame bodies via Node's client; Content-Length is preserved
+ * end-to-end (Node's llhttp already rejects the TE+CL smuggling vector).
+ */
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/**
+ * Resolve the parent proxy config, falling back to the SRT process's own
+ * environment. Note: SRT later overwrites HTTP_PROXY etc. in the *sandboxed
+ * child's* environment to point at itself — but process.env here reflects the
+ * environment SRT itself was launched with, which is what we want.
+ */
+export function resolveParentProxy(cfg) {
+    const http = cfg?.http ?? process.env.HTTP_PROXY ?? process.env.http_proxy ?? undefined;
+    const https = cfg?.https ??
+        process.env.HTTPS_PROXY ??
+        process.env.https_proxy ??
+        // Fall back to HTTP_PROXY for HTTPS if HTTPS_PROXY is unset — this is
+        // the de-facto behaviour of curl and most tooling.
+        http;
+    const noProxyRaw = cfg?.noProxy ?? process.env.NO_PROXY ?? process.env.no_proxy ?? '';
+    if (!http && !https)
+        return undefined;
+    const parse = (u) => {
+        if (!u)
+            return undefined;
+        // Accept schemeless `host:port` like curl does, but reject any scheme
+        // other than http/https.
+        const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(u);
+        const withScheme = hasScheme ? u : `http://${u}`;
+        try {
+            const parsed = new URL(withScheme);
+            if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') ||
+                !parsed.hostname) {
+                throw new Error('unsupported scheme or empty host');
+            }
+            return parsed;
+        }
+        catch {
+            logForDebugging(`Invalid parent proxy URL, ignoring: ${redactUserinfo(u)}`, { level: 'error' });
+            return undefined;
+        }
+    };
+    const httpUrl = parse(http);
+    const httpsUrl = parse(https);
+    // If both parsed to undefined, behave as if no parent proxy was configured
+    // rather than returning a husk object that makes callers do bypass checks
+    // for nothing.
+    if (!httpUrl && !httpsUrl)
+        return undefined;
+    return { httpUrl, httpsUrl, noProxy: parseNoProxy(noProxyRaw) };
+}
+function parseNoProxy(raw) {
+    const rules = {
+        all: false,
+        suffixes: [],
+        cidr: new BlockList(),
+    };
+    for (let entry of raw.split(',')) {
+        entry = entry.trim();
+        if (!entry)
+            continue;
+        if (entry === '*') {
+            rules.all = true;
+            continue;
+        }
+        // CIDR? A malformed one is ignored (do NOT treat as suffix; `/` isn't
+        // a valid hostname char).
+        if (entry.includes('/')) {
+            addRange(rules.cidr, entry);
+            continue;
+        }
+        // Hostname suffix. Normalise: lowercase, strip brackets (handling the
+        // `[v6]:port` form), strip leading `*.`, strip a trailing `:port` (unless
+        // the entry is an IP literal — IPv6 addresses contain colons).
+        let v = entry.toLowerCase();
+        const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(v);
+        if (bracketed)
+            v = bracketed[1];
+        if (v.startsWith('*.'))
+            v = v.slice(1);
+        if (!isIP(v)) {
+            const colon = v.lastIndexOf(':');
+            if (colon !== -1 && /^\d+$/.test(v.slice(colon + 1))) {
+                v = v.slice(0, colon);
+            }
+        }
+        else if (addRange(rules.cidr, v)) {
+            // Bare IP literal — an exact-match /32 or /128 rule, so lookups go
+            // through BlockList rather than string suffix matching.
+            continue;
+        }
+        rules.suffixes.push(v);
+    }
+    return rules;
+}
+/**
+ * Returns true if the given host should bypass the parent proxy and connect
+ * directly. Always bypasses loopback.
+ *
+ * NB: the port is not consulted. NO_PROXY entries of the form `host:port` are
+ * matched by host only (the port suffix is stripped during parsing).
+ */
+export function shouldBypassParentProxy(resolved, host) {
+    const h = stripBrackets(host.toLowerCase().replace(/\.$/, ''));
+    // Always bypass loopback — chaining localhost through an upstream proxy is
+    // never what you want. Covers the whole 127/8 block and IPv4-mapped forms.
+    if (h === 'localhost' || isLoopbackAddress(h))
+        return true;
+    if (resolved.noProxy.all)
+        return true;
+    if (addressInSet(resolved.noProxy.cidr, h))
+        return true;
+    for (const v of resolved.noProxy.suffixes) {
+        if (v.startsWith('.')) {
+            // .example.com matches foo.example.com and example.com
+            if (h === v.slice(1) || h.endsWith(v))
+                return true;
+        }
+        else {
+            // example.com matches example.com and foo.example.com (golang semantics)
+            if (h === v || h.endsWith('.' + v))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Pick which parent proxy URL to use for a given destination.
+ */
+export function selectParentProxyUrl(resolved, opts) {
+    if (opts.isHttps)
+        return resolved.httpsUrl ?? resolved.httpUrl;
+    // For plain HTTP we only fall back to HTTPS_PROXY if it was explicitly set
+    // — matches curl's behaviour where HTTP requests go direct if only
+    // HTTPS_PROXY is configured.
+    return resolved.httpUrl;
+}
+/**
+ * Generic CONNECT-tunnel: dial a proxy transport (unix/tcp/tls), send
+ * `CONNECT host:port`, wait for a 2xx, and resolve with the tunnelled socket.
+ * Validates destHost to prevent CRLF injection from untrusted callers.
+ */
+export function openConnectTunnel(opts) {
+    const { destHost, destPort } = opts;
+    // CRLF-injection guard: destHost may originate from an untrusted SOCKS5
+    // DOMAINNAME field. Reject anything that isn't a plain hostname or IP.
+    const bare = stripBrackets(destHost);
+    if (!isValidHost(bare)) {
+        return Promise.reject(new Error(`Invalid destination host for CONNECT: ${JSON.stringify(destHost)}`));
+    }
+    if (!Number.isInteger(destPort) || destPort < 1 || destPort > 65535) {
+        return Promise.reject(new Error(`Invalid destination port: ${destPort}`));
+    }
+    const authority = isIP(bare) === 6 ? `[${bare}]:${destPort}` : `${bare}:${destPort}`;
+    return new Promise((resolve, reject) => {
+        const sock = opts.dial();
+        let settled = false;
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            sock.destroy();
+            reject(err);
+        };
+        const onClose = () => fail(new Error('Proxy closed during CONNECT handshake'));
+        sock.setTimeout(opts.timeoutMs ?? CONNECT_TIMEOUT_MS, () => fail(new Error('CONNECT handshake timed out')));
+        sock.once('error', fail);
+        sock.once('close', onClose);
+        sock.once(opts.readyEvent, () => {
+            sock.write(`CONNECT ${authority} HTTP/1.1\r\n` +
+                `Host: ${authority}\r\n` +
+                (opts.authHeader
+                    ? `Proxy-Authorization: ${opts.authHeader}\r\n`
+                    : '') +
+                '\r\n');
+            let buf = '';
+            const onData = (chunk) => {
+                buf += chunk.toString('latin1');
+                const end = buf.indexOf('\r\n\r\n');
+                if (end === -1) {
+                    // Cap header size to avoid unbounded buffering on a misbehaving proxy.
+                    if (buf.length > 16 * 1024)
+                        fail(new Error('CONNECT response header too large'));
+                    return;
+                }
+                // Pause before detaching the data listener so the stream stops
+                // flowing — otherwise the unshift below (or any bytes arriving
+                // between now and the caller's pipe()) would be dropped.
+                sock.pause();
+                sock.removeListener('data', onData);
+                const statusLine = buf.slice(0, buf.indexOf('\r\n'));
+                if (!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(statusLine)) {
+                    return fail(new Error(`Proxy refused CONNECT: ${statusLine.trim()}`));
+                }
+                // Re-emit any bytes that arrived after the header terminator.
+                const rest = buf.slice(end + 4);
+                if (rest.length)
+                    sock.unshift(Buffer.from(rest, 'latin1'));
+                settled = true;
+                sock.setTimeout(0);
+                sock.removeListener('error', fail);
+                sock.removeListener('close', onClose);
+                resolve(sock);
+            };
+            sock.on('data', onData);
+        });
+    });
+}
+/**
+ * Open a CONNECT tunnel through a parent HTTP(S) proxy specified by URL.
+ * Thin wrapper around openConnectTunnel that dials TCP or TLS based on the
+ * proxy URL scheme.
+ */
+export function connectViaParentProxy(proxyUrl, destHost, destPort) {
+    const proxyHost = stripBrackets(proxyUrl.hostname);
+    const proxyPort = Number(proxyUrl.port) || (proxyUrl.protocol === 'https:' ? 443 : 80);
+    const useTls = proxyUrl.protocol === 'https:';
+    return openConnectTunnel({
+        destHost,
+        destPort,
+        authHeader: proxyAuthHeader(proxyUrl),
+        readyEvent: useTls ? 'secureConnect' : 'connect',
+        dial: () => useTls
+            ? tlsConnect({
+                host: proxyHost,
+                port: proxyPort,
+                // SNI must be a hostname, never an IP literal (RFC 6066 §3).
+                ...(isIP(proxyHost) ? {} : { servername: proxyHost }),
+            })
+            : netConnect(proxyPort, proxyHost),
+    });
+}
+// ---------------------------------------------------------------------------
+// Utilities
+// ---------------------------------------------------------------------------
+export function proxyAuthHeader(proxyUrl) {
+    if (!proxyUrl.username && !proxyUrl.password)
+        return undefined;
+    try {
+        const creds = `${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`;
+        return `Basic ${Buffer.from(creds).toString('base64')}`;
+    }
+    catch {
+        // Malformed percent-encoding in userinfo — fall back to raw values
+        // rather than throwing synchronously into the caller.
+        const creds = `${proxyUrl.username}:${proxyUrl.password}`;
+        return `Basic ${Buffer.from(creds).toString('base64')}`;
+    }
+}
+/**
+ * Strip hop-by-hop and proxy-specific headers before forwarding upstream.
+ * Also strips any headers named in the incoming `Connection` header, per
+ * RFC 7230 §6.1.
+ */
+export function stripHopByHop(h) {
+    const extra = new Set();
+    const connHeader = h.connection;
+    if (connHeader) {
+        for (const tok of String(connHeader).split(',')) {
+            extra.add(tok.trim().toLowerCase());
+        }
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(h)) {
+        const lk = k.toLowerCase();
+        if (!HOP_BY_HOP.has(lk) && !extra.has(lk))
+            out[k] = v;
+    }
+    return out;
+}
+/** Remove surrounding square brackets from an IPv6 literal. */
+export function stripBrackets(host) {
+    return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+}
+/** Redact userinfo from a URL for safe logging. */
+export function redactUrl(u) {
+    if (!u)
+        return '-';
+    if (!u.username && !u.password)
+        return u.href;
+    const c = new URL(u.href);
+    c.username = '***';
+    c.password = '***';
+    return c.href;
+}
+function redactUserinfo(raw) {
+    // Best-effort redaction for unparseable URLs.
+    return raw.replace(/\/\/[^@/]*@/, '//***:***@');
+}
+/**
+ * Hostname validation: accepts DNS names and IP literals (without zone IDs).
+ * Primary purpose is to block control characters (CRLF injection, null-byte
+ * DNS truncation) and zone-identifier allowlist bypasses from reaching the
+ * wire or the allowlist matcher.
+ *
+ * IPv6 zone IDs (`fe80::1%eth0`) are rejected because `isIP` accepts a very
+ * permissive zone charset including dots — `::ffff:1.2.3.4%x.allowed.com`
+ * would pass `isIP`, pass a `.endsWith('.allowed.com')` wildcard check, and
+ * then connect to 1.2.3.4 when the OS discards the bogus scope.
+ */
+export function isValidHost(h) {
+    if (!h || h.length > 255)
+        return false;
+    const bare = stripBrackets(h);
+    // Reject zone identifiers outright (see doc comment).
+    if (bare.includes('%'))
+        return false;
+    if (isIP(bare))
+        return true;
+    // DNS label charset. Underscore is permitted for compatibility with real-
+    // world DNS records (_dmarc, _acme-challenge, etc.).
+    return /^[A-Za-z0-9._-]+$/.test(bare);
+}
+/**
+ * Canonicalize a host string via the WHATWG URL parser so that string
+ * comparisons in the allowlist agree with what `net.connect()`/`getaddrinfo()`
+ * will actually dial. This normalizes:
+ *   - inet_aton shorthand (`127.1` → `127.0.0.1`, `2130706433` → `127.0.0.1`)
+ *   - hex/octal octets (`0x7f.0.0.1` → `127.0.0.1`)
+ *   - IPv6 compression (`0:0:0:0:0:0:0:1` → `::1`)
+ *   - trailing dots, case, brackets
+ *
+ * Returns undefined if the input is not a valid URL host.
+ */
+export function canonicalizeHost(h) {
+    try {
+        const bare = stripBrackets(h);
+        // WHATWG URL rejects zone IDs and most garbage; it normalizes inet_aton
+        // forms and IPv6 compression. It does NOT strip trailing dots or IPv6
+        // brackets from the output, so we do that ourselves.
+        const bracketed = isIP(bare) === 6 ? `[${bare}]` : bare;
+        const out = stripBrackets(new URL(`http://${bracketed}/`).hostname);
+        // An IPv4-mapped literal connects to that IPv4 address, so it is spelled
+        // as one: allow/deny entries and requests then compare equal.
+        return isIP(out) === 6 ? (mappedIPv4(out) ?? out) : out.replace(/\.$/, '');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `host[:port]` as it belongs in a Host header / URL authority: IPv6 bracketed, the default port elided. */
+export function formatAuthority(host, port, defaultPort) {
+    const bracketed = isIP(host) === 6 ? `[${host}]` : host;
+    return port === defaultPort ? bracketed : `${bracketed}:${port}`;
+}
+/**
+ * Connection options for an `http(s).request` to `host:port` over the direct
+ * route. The name is dialed exactly as a tunnel would be ({@link dialDirect}:
+ * the guard's `lookup`, the connect timeout, the runtime's address-family
+ * fallback), the address that answered is kept and that connection released;
+ * the request then goes to the literal, with the name in SNI (callers keep it
+ * in Host). So the vetted address is the one requested and `lookup` never
+ * reaches the HTTP client: Bun's node:http client up to 1.3.x resolves through
+ * a custom `lookup` but then drops or repeats a streamed request body, and
+ * ignores `createConnection` (oven-sh/bun#7471), so the vetted socket cannot
+ * simply be adopted. Bun 1.4 rewrote that client (oven-sh/bun#31587); once it
+ * is the floor, hand the request the dialed socket and drop the second connect.
+ * No agent: the global pool is shared with the embedding process (and Bun
+ * caches the first request's `ca` on it), and the vetting dial runs per request
+ * anyway. Without a `lookup`, or for an IP literal, the host is used as given.
+ */
+export async function directRequestOptions(host, port, lookup, tls) {
+    let address = host;
+    if (lookup && !isIP(host)) {
+        const probe = await dialDirect(host, port, lookup);
+        address = probe.remoteAddress ?? '';
+        probe.destroy();
+        if (!address)
+            throw new Error(`connect ${host}:${port}: no peer address`);
+    }
+    // SNI cannot carry an IP literal, and Bun treats `servername: undefined`
+    // differently from an absent key.
+    return {
+        host: address,
+        port,
+        ...(tls && !isIP(host) ? { servername: host } : {}),
+        agent: false,
+    };
+}
+/**
+ * Dial `host:port` directly with a bounded timeout. Shared by the HTTP and
+ * SOCKS direct-connect paths so they get the same timeout behaviour as the
+ * CONNECT-tunnelled paths. `lookup` is the resolved-address guard's (see
+ * resolved-address-guard.ts); the runtime dials what it returns. It is a
+ * required argument so no direct dial omits it by accident — pass
+ * `undefined` explicitly to use the runtime's resolver unguarded.
+ */
+export function dialDirect(host, port, lookup, timeoutMs = CONNECT_TIMEOUT_MS) {
+    return new Promise((resolve, reject) => {
+        const s = netConnect({ port, host, lookup });
+        let settled = false;
+        const done = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            s.setTimeout(0);
+            if (err) {
+                s.destroy();
+                reject(err);
+            }
+            else {
+                resolve(s);
+            }
+        };
+        s.setTimeout(timeoutMs, () => done(new Error('connect timed out')));
+        s.once('connect', () => done());
+        s.once('error', done);
+        s.once('close', () => done(new Error('socket closed before connect')));
+    });
+}
+//# sourceMappingURL=parent-proxy.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parent-proxy.js","sourceRoot":"","sources":["../../src/sandbox/parent-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,UAAU,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,UAAU,GACX,MAAM,cAAc,CAAA;AAcrB,MAAM,kBAAkB,GAAG,KAAM,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAuB;IAEvB,MAAM,IAAI,GACR,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAA;IAC5E,MAAM,KAAK,GACT,GAAG,EAAE,KAAK;QACV,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,sEAAsE;QACtE,mDAAmD;QACnD,IAAI,CAAA;IACN,MAAM,UAAU,GACd,GAAG,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAA;IAEpE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAErC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAmB,EAAE;QACvD,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,sEAAsE;QACtE,yBAAyB;QACzB,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7D,CAAC,MAAM,CAAC,QAAQ,EAChB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACrD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,CACb,uCAAuC,cAAc,CAAC,CAAC,CAAC,EAAE,EAC1D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7B,2EAA2E;IAC3E,0EAA0E;IAC1E,eAAe;IACf,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAE3C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAiB;QAC1B,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,IAAI,SAAS,EAAE;KACtB,CAAA;IAED,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QACpB,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;YAChB,SAAQ;QACV,CAAC;QAED,sEAAsE;QACtE,0BAA0B;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC3B,SAAQ;QACV,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,SAAS;YAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAA;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,mEAAmE;YACnE,wDAAwD;YACxD,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA6B,EAC7B,IAAY;IAEZ,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAE9D,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,CAAC,KAAK,WAAW,IAAI,iBAAiB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1D,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,uDAAuD;YACvD,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;QACpD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA6B,EAC7B,IAA0B;IAE1B,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAA;IAC9D,2EAA2E;IAC3E,mEAAmE;IACnE,6BAA6B;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAA;AACzB,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEnC,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,yCAAyC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACpE,CACF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;IAEpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACxB,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;QAE1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,EAAE,GAAG,EAAE,CACzD,IAAI,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAC/C,CAAA;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAE3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE;YAC9B,IAAI,CAAC,KAAK,CACR,WAAW,SAAS,eAAe;gBACjC,SAAS,SAAS,MAAM;gBACxB,CAAC,IAAI,CAAC,UAAU;oBACd,CAAC,CAAC,wBAAwB,IAAI,CAAC,UAAU,MAAM;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,CACT,CAAA;YAED,IAAI,GAAG,GAAG,EAAE,CAAA;YACZ,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;gBAC/B,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,uEAAuE;oBACvE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;wBACxB,IAAI,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAA;oBACtD,OAAM;gBACR,CAAC;gBACD,+DAA+D;gBAC/D,+DAA+D;gBAC/D,yDAAyD;gBACzD,IAAI,CAAC,KAAK,EAAE,CAAA;gBACZ,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAEnC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;gBACpD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,0BAA0B,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;gBACvE,CAAC;gBAED,8DAA8D;gBAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;gBAC/B,IAAI,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAE1D,OAAO,GAAG,IAAI,CAAA;gBACd,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;gBAClB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAClC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,CAAA;YACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,QAAgB,EAChB,QAAgB;IAEhB,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,SAAS,GACb,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAE7C,OAAO,iBAAiB,CAAC;QACvB,QAAQ;QACR,QAAQ;QACR,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QAChD,IAAI,EAAE,GAAG,EAAE,CACT,MAAM;YACJ,CAAC,CAAC,UAAU,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,SAAS;gBACf,6DAA6D;gBAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;aACtD,CAAC;YACJ,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;KACvC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,QAAa;IAC3C,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QACjG,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzD,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACzD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAAsB;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;IAC/B,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAwB,EAAE,CAAA;IACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9E,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,SAAS,CAAC,CAAkB;IAC1C,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAA;IAClB,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IAC7C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAA;IAClB,OAAO,CAAC,CAAC,IAAI,CAAA;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,8CAA8C;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAC7B,sDAAsD;IACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3B,0EAA0E;IAC1E,qDAAqD;IACrD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;QAC7B,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;QACnE,yEAAyE;QACzE,8DAA8D;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAQD,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,IAAY,EACZ,WAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACvD,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAA;AAClE,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,IAAY,EACZ,MAAkC,EAClC,GAAY;IAEZ,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAA;QACnC,KAAK,CAAC,OAAO,EAAE,CAAA;QACf,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,mBAAmB,CAAC,CAAA;IAC3E,CAAC;IACD,yEAAyE;IACzE,kCAAkC;IAClC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI;QACJ,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,EAAE,KAAK;KACb,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,IAAY,EACZ,MAAkC,EAClC,SAAS,GAAG,kBAAkB;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,GAAG,EAAE,CAAC;gBACR,CAAC,CAAC,OAAO,EAAE,CAAA;gBACX,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,CAAA;YACZ,CAAC;QACH,CAAC,CAAA;QACD,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACnE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/read-deny-glob.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Expand a read-deny glob into the paths bwrap should mount over, collapsed
+ * against `reExposedPaths` (the caller's allowRead and allowWrite entries).
+ * A pattern ending in `/**` also takes its directory form, so
+ * `**\/build/**` yields one mount per `build/` directory. A match reached
+ * through a symlink is listed where it really lives, and a directory the walk
+ * could not list is denied whole. Sorted, so an ancestor precedes its
+ * descendants.
+ *
+ * @param unlistableDirs - receives the returned locations that hide something
+ * the walk could not enumerate, whether by being that directory or by
+ * covering it. The Linux wrapper binds nothing back beneath one: what the
+ * pattern matches under an allowed path in there was never found, and would
+ * come back unmasked.
+ */
+export declare function expandReadDenyGlobLinux(globPattern: string, reExposedPaths: readonly string[], unlistableDirs?: Set<string>): string[];
+//# sourceMappingURL=read-deny-glob.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/read-deny-glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-deny-glob.d.ts","sourceRoot":"","sources":["../../src/sandbox/read-deny-glob.ts"],"names":[],"mappings":"AA0DA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B,MAAM,EAAE,CAiIV"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/read-deny-glob.js

@@ -0,0 +1,163 @@
+import { logForDebugging } from '../utils/debug.js';
+import { isAtOrUnder, normalizePathForSandbox, pathSpellings, properAncestors, walkGlobPattern, } from './sandbox-utils.js';
+/**
+ * A read-deny glob still needing more than this many mounts after collapsing
+ * is logged at warn level (SRT_DEBUG) as a hint that the pattern is broad.
+ * The expansion is never truncated, which would silently un-deny paths.
+ */
+const READ_DENY_GLOB_MOUNT_WARN_THRESHOLD = 256;
+/** The directory holding `p`, or '' for a root child. */
+function parentOf(p) {
+    return p.slice(0, p.lastIndexOf('/'));
+}
+/**
+ * Reduce the places a read-deny glob's matches really live to the ones whose
+ * mount changes what the sandbox can read. A location is dropped only when a
+ * kept proper ancestor's tmpfs already hides it and no re-exposer sits at the
+ * ancestor or between the two.
+ */
+function collapseReadDenyLocations({ locations, reExposedPaths, }) {
+    // A proper ancestor is a proper string prefix, so lexicographic order
+    // visits every ancestor before its descendants.
+    const sorted = [...new Set(locations)].sort();
+    const kept = new Set();
+    for (const location of sorted) {
+        let reExposedBetween = reExposedPaths.has(location);
+        let hidden = false;
+        for (const ancestor of properAncestors(location)) {
+            // A re-exposer at the kept ancestor counts: the deny loop binds it back
+            // over the tmpfs, so everything beneath needs its own mount.
+            if (reExposedPaths.has(ancestor))
+                reExposedBetween = true;
+            if (kept.has(ancestor)) {
+                hidden = true;
+                break;
+            }
+        }
+        if (!hidden || reExposedBetween)
+            kept.add(location);
+    }
+    return kept;
+}
+/**
+ * Expand a read-deny glob into the paths bwrap should mount over, collapsed
+ * against `reExposedPaths` (the caller's allowRead and allowWrite entries).
+ * A pattern ending in `/**` also takes its directory form, so
+ * `**\/build/**` yields one mount per `build/` directory. A match reached
+ * through a symlink is listed where it really lives, and a directory the walk
+ * could not list is denied whole. Sorted, so an ancestor precedes its
+ * descendants.
+ *
+ * @param unlistableDirs - receives the returned locations that hide something
+ * the walk could not enumerate, whether by being that directory or by
+ * covering it. The Linux wrapper binds nothing back beneath one: what the
+ * pattern matches under an allowed path in there was never found, and would
+ * come back unmasked.
+ */
+export function expandReadDenyGlobLinux(globPattern, reExposedPaths, unlistableDirs) {
+    const walk = walkGlobPattern(globPattern, {
+        withDirectoryForm: true,
+        followSymlinkedDirectories: true,
+    });
+    // Where a path the walk reported really lives: the denyRead loop mounts an
+    // entry there, whatever spelling named it.
+    const locationOf = (p) => walk.realOf.get(p) ?? p;
+    // An unlisted directory hides whatever the pattern matches beneath it.
+    const candidates = new Set([...walk.matches, ...walk.unlisted]);
+    if (walk.directoryMatches.length > 0) {
+        // Everything beneath a directory-form match is itself a match (the
+        // pattern ends in /**), so a directory with something to deny holds one.
+        // An empty one gets no mount: it has nothing to deny, and as a tmpfs it
+        // would swallow later writes. Compared where they live, since one
+        // spelling of a directory is walked and the matches found through it are
+        // reported at their real locations.
+        const holdMatches = new Set(walk.matches.map(m => parentOf(locationOf(m))));
+        for (const dir of walk.directoryMatches) {
+            // A directory-form match that is a symlink counts in its own right:
+            // one the walk did not list through (a link back up the tree, or a
+            // further name for a directory already listed) has no match beneath
+            // it, yet denies everything it reaches.
+            if (holdMatches.has(locationOf(dir)) || walk.symlinks.has(dir)) {
+                candidates.add(dir);
+            }
+        }
+    }
+    const locations = new Set();
+    /** Which spelling first put a location in the list, for the warning below. */
+    const namedBy = new Map();
+    const addLocation = (location, candidate) => {
+        locations.add(location);
+        if (!namedBy.has(location))
+            namedBy.set(location, candidate);
+    };
+    for (const candidate of candidates) {
+        if (walk.symlinks.has(candidate) && !walk.realOf.has(candidate)) {
+            if (!walk.uninspectableLinks.has(candidate)) {
+                // A link that resolves to nothing denies nothing, and bwrap cannot
+                // mount on the link itself.
+                logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}": ${candidate} does not resolve, skipping`);
+                continue;
+            }
+            // A link whose target is there but cannot be looked at: kept under its
+            // own spelling, where the denyRead loop's stand-in rule hides the
+            // nearest directory above it that can be inspected.
+            logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}": ${candidate} leads somewhere that cannot be inspected; denying what holds it`, { level: 'warn' });
+            addLocation(candidate, candidate);
+            continue;
+        }
+        const location = locationOf(candidate);
+        if (location !== '/') {
+            addLocation(location, candidate);
+            continue;
+        }
+        // A link to the root. A tmpfs there would wipe every mount placed before
+        // it and the pivot would promote it, booting the command on an empty
+        // tree, and bwrap cannot mount on the link itself. The nearest directory
+        // above the link stands in for it, as for an entry that cannot be
+        // inspected — never the root itself.
+        const standIn = locationOf(parentOf(candidate));
+        if (standIn === '' || standIn === '/') {
+            logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}": ${candidate} resolves to / and nothing but / holds it, skipping`, { level: 'warn' });
+            continue;
+        }
+        logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}": ${candidate} resolves to /; denying ${standIn}, which holds it, instead`, { level: 'warn' });
+        addLocation(standIn, candidate);
+    }
+    const reExposed = new Set(reExposedPaths.flatMap(p => pathSpellings(normalizePathForSandbox(p))));
+    const mounts = collapseReadDenyLocations({
+        locations,
+        reExposedPaths: reExposed,
+    });
+    // Which mounts stand for something the walk could not enumerate: the
+    // unlistable directory itself when it survived the collapse, otherwise the
+    // kept ancestor that hides it.
+    for (const unlisted of walk.unlisted) {
+        const location = locationOf(unlisted);
+        if (mounts.has(location)) {
+            unlistableDirs?.add(location);
+            continue;
+        }
+        for (const ancestor of properAncestors(location)) {
+            if (mounts.has(ancestor)) {
+                unlistableDirs?.add(ancestor);
+                break;
+            }
+        }
+    }
+    logForDebugging(`[Sandbox Linux] Expanded denyRead glob "${globPattern}": ${walk.matches.length} matches -> ${mounts.size} mounts`);
+    for (const mount of mounts) {
+        // A matched link decides what is hidden for the whole sandbox: a
+        // `certs/*` entry pointing at a database directory mounts a tmpfs over
+        // that directory, not over anything the pattern names.
+        if (walk.baseLocation !== '' && !isAtOrUnder(mount, walk.baseLocation)) {
+            logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}" hides ${mount}, outside ${walk.baseLocation}: reached through ${namedBy.get(mount) === mount ? 'a symlinked directory' : namedBy.get(mount)}`, { level: 'warn' });
+        }
+    }
+    if (mounts.size > READ_DENY_GLOB_MOUNT_WARN_THRESHOLD) {
+        logForDebugging(`[Sandbox Linux] denyRead glob "${globPattern}" still needs ${mounts.size} mounts after collapsing ` +
+            `(threshold ${READ_DENY_GLOB_MOUNT_WARN_THRESHOLD}); each is a separate bwrap mount at sandbox start. ` +
+            `Prefer denying the enclosing directories.`, { level: 'warn' });
+    }
+    return [...mounts].sort();
+}
+//# sourceMappingURL=read-deny-glob.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/read-deny-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-deny-glob.js","sourceRoot":"","sources":["../../src/sandbox/read-deny-glob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAE3B;;;;GAIG;AACH,MAAM,mCAAmC,GAAG,GAAG,CAAA;AAE/C,yDAAyD;AACzD,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,EACjC,SAAS,EACT,cAAc,GAOf;IACC,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnD,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,wEAAwE;YACxE,6DAA6D;YAC7D,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,gBAAgB,GAAG,IAAI,CAAA;YACzD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM,GAAG,IAAI,CAAA;gBACb,MAAK;YACP,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,cAAiC,EACjC,cAA4B;IAE5B,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE;QACxC,iBAAiB,EAAE,IAAI;QACvB,0BAA0B,EAAE,IAAI;KACjC,CAAC,CAAA;IACF,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACjE,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,wCAAwC;YACxC,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACzC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAQ,EAAE;QAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC9D,CAAC,CAAA;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,4BAA4B;gBAC5B,eAAe,CACb,kCAAkC,WAAW,MAAM,SAAS,6BAA6B,CAC1F,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,uEAAuE;YACvE,kEAAkE;YAClE,oDAAoD;YACpD,eAAe,CACb,kCAAkC,WAAW,MAAM,SAAS,kEAAkE,EAC9H,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACD,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,qCAAqC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC/C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,eAAe,CACb,kCAAkC,WAAW,MAAM,SAAS,qDAAqD,EACjH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACD,SAAQ;QACV,CAAC;QACD,eAAe,CACb,kCAAkC,WAAW,MAAM,SAAS,2BAA2B,OAAO,2BAA2B,EACzH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;QACD,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CACvE,CAAA;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC;QACvC,SAAS;QACT,cAAc,EAAE,SAAS;KAC1B,CAAC,CAAA;IAEF,qEAAqE;IACrE,2EAA2E;IAC3E,+BAA+B;IAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC7B,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC7B,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe,CACb,2CAA2C,WAAW,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,eAAe,MAAM,CAAC,IAAI,SAAS,CACnH,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,iEAAiE;QACjE,uEAAuE;QACvE,uDAAuD;QACvD,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACvE,eAAe,CACb,kCAAkC,WAAW,WAAW,KAAK,aAAa,IAAI,CAAC,YAAY,qBAAqB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAC7L,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,mCAAmC,EAAE,CAAC;QACtD,eAAe,CACb,kCAAkC,WAAW,iBAAiB,MAAM,CAAC,IAAI,2BAA2B;YAClG,cAAc,mCAAmC,sDAAsD;YACvG,2CAA2C,EAC7C,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AAC3B,CAAC"}