pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/vendor/java-proxy-agent/build.ts

@@ -0,0 +1,95 @@
+/**
+ * Build the JVM proxy agent (vendor/java-proxy-agent-src) into
+ * vendor/java-proxy-agent/srt-proxy-agent.jar.
+ *
+ * Same model as the seccomp / srt-win helpers: only the source is in git,
+ * the artifact is built by the release workflow and shipped in the npm
+ * package, and consumers that bundle srt point at their own copy via the
+ * `javaAgentJarPath` config key. The jar is reproducible: `jar --date`
+ * pins entry timestamps, and STORED entries in a fixed order.
+ *
+ *   npm run build:java-agent        (needs a JDK >= 17 on PATH or JAVA_HOME)
+ */
+import { spawnSync } from 'node:child_process'
+import {
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { run } from '../build-common.js'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const SRC = join(here, '..', 'java-proxy-agent-src')
+const OUT = join(here, 'srt-proxy-agent.jar')
+const AGENT_CLASS = 'com.anthropic.srt.ProxyAgent'
+
+const bin = (tool: string) =>
+  process.env.JAVA_HOME ? join(process.env.JAVA_HOME, 'bin', tool) : tool
+const javac = bin('javac')
+const jar = bin('jar')
+const version = spawnSync(javac, ['-version'], { encoding: 'utf8' })
+if (version.error) {
+  console.error(
+    `java-proxy-agent build: cannot run ${javac}: ${version.error.message}`,
+  )
+  process.exit(1)
+}
+
+function walk(dir: string): string[] {
+  const out: string[] = []
+  for (const name of readdirSync(dir).sort()) {
+    const p = join(dir, name)
+    if (statSync(p).isDirectory()) out.push(...walk(p))
+    else out.push(p)
+  }
+  return out
+}
+
+const work = mkdtempSync(join(tmpdir(), 'srt-java-agent-'))
+try {
+  const classes = join(work, 'classes')
+  const sources = walk(SRC).filter(f => f.endsWith('.java'))
+  // --release 8: the agent runs inside whatever JVM the sandboxed tool
+  // brings, and Java 8 is still common in build tooling.
+  run([
+    javac,
+    '--release',
+    '8',
+    '-Xlint:all,-options',
+    '-Werror',
+    '-g:none',
+    '-d',
+    classes,
+    ...sources,
+  ])
+
+  const manifest = join(work, 'MANIFEST.MF')
+  writeFileSync(
+    manifest,
+    `Premain-Class: ${AGENT_CLASS}\nAgent-Class: ${AGENT_CLASS}\n`,
+  )
+  // -0: STORED (no compression). --date: fixed entry timestamps. Entries
+  // are added in a fixed order (walk() sorts) so the bytes are reproducible.
+  const entries = walk(classes).map(f => f.slice(classes.length + 1))
+  run([
+    jar,
+    '--create',
+    '--file',
+    OUT,
+    '--manifest',
+    manifest,
+    '--no-compress',
+    '--date',
+    '1980-01-01T00:00:02Z',
+    // -C applies to the single following file, so repeat it per entry.
+    ...entries.flatMap(e => ['-C', classes, e]),
+  ])
+  console.log(`built ${OUT} (${statSync(OUT).size} bytes)`)
+} finally {
+  rmSync(work, { recursive: true, force: true })
+}

package/node_modules/@anthropic-ai/sandbox-runtime/vendor/seccomp/build.ts

@@ -0,0 +1,69 @@
+import { readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { run, setup } from '../build-common.js'
+
+const { SRC, OUT } = setup({
+  importMetaUrl: import.meta.url,
+  requirePlatform: 'linux',
+  srcDirName: 'seccomp-src',
+})
+
+function toCArray(bytes: Buffer): string {
+  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
+  const lines: string[] = []
+  for (let i = 0; i < hex.length; i += 8) {
+    lines.push('    ' + hex.slice(i, i + 8).join(', ') + ',')
+  }
+  return lines.join('\n')
+}
+
+const cflags = ['-static', '-O2', '-Wall', '-Wextra']
+
+const gen = join(OUT, 'seccomp-unix-block')
+run([
+  'gcc',
+  ...cflags,
+  '-o',
+  gen,
+  join(SRC, 'seccomp-unix-block.c'),
+  '-lseccomp',
+])
+
+const bpf: Record<string, Buffer> = {}
+for (const target of ['x86_64', 'aarch64']) {
+  const tmp = join(OUT, target + '.bpf')
+  run([gen, tmp, target])
+  bpf[target] = readFileSync(tmp)
+  rmSync(tmp)
+}
+rmSync(gen)
+
+const header = join(OUT, 'unix-block-bpf.h')
+writeFileSync(
+  header,
+  '#if defined(__x86_64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.x86_64) +
+    '\n};\n' +
+    '#elif defined(__aarch64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.aarch64) +
+    '\n};\n' +
+    '#else\n' +
+    '#error "unsupported architecture for unix-block BPF filter"\n' +
+    '#endif\n',
+)
+
+run([
+  'gcc',
+  ...cflags,
+  '-I',
+  OUT,
+  '-o',
+  join(OUT, 'apply-seccomp'),
+  join(SRC, 'apply-seccomp.c'),
+])
+run(['strip', join(OUT, 'apply-seccomp')])
+rmSync(header)
+
+console.log('built ' + join(OUT, 'apply-seccomp'))

package/node_modules/@anthropic-ai/sandbox-runtime/vendor/srt-win/build.ts

@@ -0,0 +1,28 @@
+import { copyFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { run, setup } from '../build-common.js'
+
+const { SRC, OUT } = setup({
+  importMetaUrl: import.meta.url,
+  requirePlatform: 'win32',
+  srcDirName: 'srt-win-src',
+})
+
+run([
+  'cargo',
+  'build',
+  '--release',
+  '--locked',
+  '--manifest-path',
+  join(SRC, 'Cargo.toml'),
+])
+
+const built = join(SRC, 'target', 'release', 'srt-win.exe')
+if (!existsSync(built)) {
+  console.error('srt-win build: expected output not found at ' + built)
+  process.exit(1)
+}
+
+const dest = join(OUT, 'srt-win.exe')
+copyFileSync(built, dest)
+console.log('built ' + dest)

package/node_modules/@pondwader/socks5-server/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [20.x]
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+          run_install: true
+      - run: pnpm test

package/node_modules/@pondwader/socks5-server/LICENSE

@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) 2024 PondWader
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

package/node_modules/@pondwader/socks5-server/README.md

@@ -0,0 +1,151 @@
+# node-socks5-server
+A Node.js implementation of a socks5 server written in TypeScript.  
+The library handles the protocol side but allows you to gain fine-grained control of connections and how they're handled.
+> **Features:**
+- Override the handling of socket proxying
+- Handle authentication yourself
+- Full type support
+- Process Duplex streams as connections
+
+## Installation
+With npm:
+```
+npm i @pondwader/socks5-server
+```
+With yarn:
+```
+yarn add @pondwader/socks5-server
+```
+## Basic usage
+Spin up a basic socks5 proxy server with just this code:
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+createServer({
+    port: 5000
+})
+```
+Or handle the listening yourself:
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+const server = createServer();
+server.listen(5000, '127.0.0.1', () => {
+    console.log('Server listening on port 5000');
+})
+```
+## Username-password authentication
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+createServer({
+    port: 5000,
+    auth: {
+        username: 'user123',
+        password: 'password123'
+    }
+})
+```
+Or handle the authentication yourself:
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+const server = createServer({
+    port: 5000
+})
+
+// Using a synchronous function
+server.setAuthHandler((conn) => {
+    return conn.username === 'user123' && conn.password === 'password123';
+})
+
+// Using a promise
+server.setAuthHandler((conn) => {
+    return new Promise(resolve => {
+        resolve(conn.username === 'user123' && conn.password === 'password123');
+    })
+})
+
+// Using callbacks
+server.setAuthHandler((conn, accept, reject) => {
+    if (conn.username === 'user123' && conn.password === 'password123') accept();
+    else reject();
+})
+```
+
+## Rejecting connections for breaking ruleset
+You can reject connections that beak your ruleset:
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+const server = createServer({
+    port: 5000
+})
+
+// Using a synchronous return
+server.setRulesetValidator((conn) => {
+    return conn.destPort !== 25;
+});
+
+// Using a promise
+server.setRulesetValidator((conn) => {
+    return new Promise(resolve => {
+        resolve(conn.destPort !== 25);
+    })
+});
+
+// Using callbacks
+server.setRulesetValidator((conn, accept, deny) => {
+    if (conn.destPort === 25) deny();
+    else accept();
+});
+```
+You also have to access to `<Socks5Connection>.destAddress`.
+
+## Handling the proxying of connections
+By default the library will handle connections itself using the built in connection handler, but you can override this to use your own handler.  
+[See the built in connection handling function here to further your understanding on how to handle connections.](https://github.com/PondWader/node-socks5-server/blob/main/src/connectionHandler.ts)  
+You can set your handling function:
+```js
+const { createServer } = require('@pondwader/socks5-server');
+
+const server = createServer({
+    port: 5000
+})
+
+server.setConnectionHandler((conn, sendStatus) => {
+    const { socket, destAddress, destPort } = conn;
+
+    /*
+        You need to send a status before the client should start sending data in the socket.
+        If you send REQUEST_GRANTED the client should begin sending data, any other status will close the socket.
+
+        REQUEST_GRANTED,
+        GENERAL_FAILURE,
+        CONNECTION_NOT_ALLOWED,
+        NETWORK_UNREACHABLE,
+        HOST_UNREACHABLE,
+        CONNECTION_REFUSED,
+        TTL_EXPIRED,
+        COMMAND_NOT_SUPPORTED
+    */
+
+    // Do stuff here
+})
+```
+
+## Handling commands other than `connect`
+The library only has a built in handler for connections using the `connect` command, this is used for TCP socket proxying and is by far the most common command however, you may wish to add support for other commands.  
+The other command types are `udp` and `bind`. To handle these you will need to make your own connection handler (see section above). **Note:** the `Socks5Connection` class exposes the `command` property which gives you access to the command sent by the client.  
+You will also need to add the commands you want to handle to the supported commands set. The `Socks5Server` class has the `supportedCommands` property which is a [Set](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Set) instance.  
+For example:
+`<Socks5Server>.supportedCommands.add('udp');`
+
+## You can also pass Duplex streams as connections...
+```js
+const { Duplex } = require('streams');
+server._handleConnection(new Duplex());
+```
+
+## Metadata
+The `Socks5Connection` class has a metadata attribute which starts as an empty object, you can put data in this to pass data about a connection between seperate handlers.  

package/node_modules/@pondwader/socks5-server/dist/index.d.mts

@@ -0,0 +1,87 @@
+import * as net from 'net';
+import net__default from 'net';
+import { Duplex } from 'stream';
+
+declare class Socks5Connection {
+    socket: Duplex;
+    server: Socks5Server;
+    username?: string;
+    password?: string;
+    destAddress?: string;
+    destPort?: number;
+    command?: keyof typeof Socks5ConnectionCommand;
+    private errorHandler;
+    metadata: any;
+    constructor(server: Socks5Server, socket: Duplex);
+    private readBytes;
+    private handleGreeting;
+    private handleUserPassword;
+    private handleConnectionRequest;
+    private connect;
+}
+
+declare enum Socks5ConnectionCommand {
+    connect = 1,
+    bind = 2,
+    udp = 3
+}
+declare enum Socks5ConnectionStatus {
+    REQUEST_GRANTED = 0,
+    GENERAL_FAILURE = 1,
+    CONNECTION_NOT_ALLOWED = 2,
+    NETWORK_UNREACHABLE = 3,
+    HOST_UNREACHABLE = 4,
+    CONNECTION_REFUSED = 5,
+    TTL_EXPIRED = 6,
+    COMMAND_NOT_SUPPORTED = 7,
+    ADDRESS_TYPE_NOT_SUPPORTED = 8
+}
+type AuthSocks5Connection = Socks5Connection & {
+    username: string;
+    password: string;
+};
+type InitialisedSocks5Connection = Socks5Connection & {
+    destAddress: string;
+    destPort: number;
+    command: keyof typeof Socks5ConnectionCommand;
+};
+
+declare class Socks5Server {
+    authHandler?: (connection: AuthSocks5Connection, accept: () => void, deny: () => void) => boolean | Promise<boolean> | any;
+    rulesetValidator?: (connection: InitialisedSocks5Connection, accept: () => void, deny: () => void) => boolean | Promise<boolean> | void;
+    connectionHandler: (connection: InitialisedSocks5Connection, sendStatus: (status: keyof typeof Socks5ConnectionStatus) => void) => void;
+    supportedCommands: Set<keyof typeof Socks5ConnectionCommand>;
+    private server;
+    constructor();
+    listen(port?: number, hostname?: string, backlog?: number, listeningListener?: () => void): this;
+    listen(port?: number, hostname?: string, listeningListener?: () => void): this;
+    listen(port?: number, backlog?: number, listeningListener?: () => void): this;
+    listen(port?: number, listeningListener?: () => void): this;
+    listen(path: string, backlog?: number, listeningListener?: () => void): this;
+    listen(path: string, listeningListener?: () => void): this;
+    listen(options: net.ListenOptions, listeningListener?: () => void): this;
+    listen(handle: any, backlog?: number, listeningListener?: () => void): this;
+    listen(handle: any, listeningListener?: () => void): this;
+    close(callback?: ((err?: Error | undefined) => void) | undefined): this;
+    setAuthHandler(handler: typeof this.authHandler): this;
+    disableAuthHandler(): this;
+    setRulesetValidator(handler: typeof this.rulesetValidator): this;
+    disableRulesetValidator(): this;
+    setConnectionHandler(handler: typeof this.connectionHandler): this;
+    useDefaultConnectionHandler(): this;
+    _handleConnection(socket: Duplex): this;
+}
+
+declare function export_default(connection: InitialisedSocks5Connection, sendStatus: (status: keyof typeof Socks5ConnectionStatus) => void): void | net__default.Socket;
+
+type ServerOptions = {
+    auth?: {
+        username: string;
+        password: string;
+    };
+    port?: number;
+    hostname?: string;
+};
+declare function createServer(opts?: ServerOptions): Socks5Server;
+
+export { Socks5Server, createServer, export_default as defaultConnectionHandler };

package/node_modules/@pondwader/socks5-server/dist/index.d.ts

@@ -0,0 +1,87 @@
+import * as net from 'net';
+import net__default from 'net';
+import { Duplex } from 'stream';
+
+declare class Socks5Connection {
+    socket: Duplex;
+    server: Socks5Server;
+    username?: string;
+    password?: string;
+    destAddress?: string;
+    destPort?: number;
+    command?: keyof typeof Socks5ConnectionCommand;
+    private errorHandler;
+    metadata: any;
+    constructor(server: Socks5Server, socket: Duplex);
+    private readBytes;
+    private handleGreeting;
+    private handleUserPassword;
+    private handleConnectionRequest;
+    private connect;
+}
+
+declare enum Socks5ConnectionCommand {
+    connect = 1,
+    bind = 2,
+    udp = 3
+}
+declare enum Socks5ConnectionStatus {
+    REQUEST_GRANTED = 0,
+    GENERAL_FAILURE = 1,
+    CONNECTION_NOT_ALLOWED = 2,
+    NETWORK_UNREACHABLE = 3,
+    HOST_UNREACHABLE = 4,
+    CONNECTION_REFUSED = 5,
+    TTL_EXPIRED = 6,
+    COMMAND_NOT_SUPPORTED = 7,
+    ADDRESS_TYPE_NOT_SUPPORTED = 8
+}
+type AuthSocks5Connection = Socks5Connection & {
+    username: string;
+    password: string;
+};
+type InitialisedSocks5Connection = Socks5Connection & {
+    destAddress: string;
+    destPort: number;
+    command: keyof typeof Socks5ConnectionCommand;
+};
+
+declare class Socks5Server {
+    authHandler?: (connection: AuthSocks5Connection, accept: () => void, deny: () => void) => boolean | Promise<boolean> | any;
+    rulesetValidator?: (connection: InitialisedSocks5Connection, accept: () => void, deny: () => void) => boolean | Promise<boolean> | void;
+    connectionHandler: (connection: InitialisedSocks5Connection, sendStatus: (status: keyof typeof Socks5ConnectionStatus) => void) => void;
+    supportedCommands: Set<keyof typeof Socks5ConnectionCommand>;
+    private server;
+    constructor();
+    listen(port?: number, hostname?: string, backlog?: number, listeningListener?: () => void): this;
+    listen(port?: number, hostname?: string, listeningListener?: () => void): this;
+    listen(port?: number, backlog?: number, listeningListener?: () => void): this;
+    listen(port?: number, listeningListener?: () => void): this;
+    listen(path: string, backlog?: number, listeningListener?: () => void): this;
+    listen(path: string, listeningListener?: () => void): this;
+    listen(options: net.ListenOptions, listeningListener?: () => void): this;
+    listen(handle: any, backlog?: number, listeningListener?: () => void): this;
+    listen(handle: any, listeningListener?: () => void): this;
+    close(callback?: ((err?: Error | undefined) => void) | undefined): this;
+    setAuthHandler(handler: typeof this.authHandler): this;
+    disableAuthHandler(): this;
+    setRulesetValidator(handler: typeof this.rulesetValidator): this;
+    disableRulesetValidator(): this;
+    setConnectionHandler(handler: typeof this.connectionHandler): this;
+    useDefaultConnectionHandler(): this;
+    _handleConnection(socket: Duplex): this;
+}
+
+declare function export_default(connection: InitialisedSocks5Connection, sendStatus: (status: keyof typeof Socks5ConnectionStatus) => void): void | net__default.Socket;
+
+type ServerOptions = {
+    auth?: {
+        username: string;
+        password: string;
+    };
+    port?: number;
+    hostname?: string;
+};
+declare function createServer(opts?: ServerOptions): Socks5Server;
+
+export { Socks5Server, createServer, export_default as defaultConnectionHandler };