pi-codex-auto-review 0.1.2 → 0.1.3

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mux-proxy.d.ts

@@ -1,59 +0,0 @@
-import { type Server, type Socket } from 'node:net';
-import type { Server as HttpServer } from 'node:http';
-export interface MuxProxyOptions {
-    /**
-     * The HTTP CONNECT/absolute-URI proxy. Must NOT already be listening;
-     * the mux owns its listen lifecycle (on a private unix socket on
-     * macOS/Linux, or a localhost TCP port on Windows).
-     */
-    httpServer: HttpServer;
-    /**
-     * Per-connection SOCKS entry point. The mux calls this with a socket
-     * whose peeked first byte has been `unshift()`ed back, so the handler
-     * sees the full SOCKS greeting starting at byte 0.
-     */
-    handleSocksConnection: (socket: Socket) => void;
-    /**
-     * How long to wait for the client's first byte before destroying the
-     * connection. Guards against connect-then-stall clients holding a slot.
-     */
-    firstByteTimeoutMs?: number;
-    /**
-     * Windows only: range the HTTP backend's TCP port must fall inside, so
-     * the WFP loopback permit covers the mux→backend hop. Ignored on other
-     * platforms (unix socket needs no port).
-     */
-    httpBackendPortRange?: readonly [number, number];
-}
-export interface MuxProxyServer {
-    /** The front-end TCP listener. Call `.listen()` on this. */
-    server: Server;
-    /** Bound front-end port, once listening. */
-    getPort(): number | undefined;
-    /**
-     * Start the HTTP backend listener (unix socket on macOS/Linux, localhost
-     * TCP on Windows). Must be awaited before the front-end `.listen()`s so
-     * an early HTTP connection never dispatches to an unbound backend.
-     * Returns the backend's TCP port on Windows (so the caller can exclude
-     * it when binding the front-end in the same range), or undefined on
-     * unix-socket platforms.
-     */
-    listenHttpBackend(): Promise<number | undefined>;
-    /** Tear down front-end, backend, and all open client sockets. */
-    close(): Promise<void>;
-    /** unref() both listeners so they don't keep the event loop alive. */
-    unref(): void;
-}
-/**
- * Single-port proxy front-end that dispatches each connection to either the
- * SOCKS handler or the HTTP proxy based on the first byte the client sends.
- *
- * The HTTP leg cannot use `httpServer.emit('connection', socket)` because
- * Bun's `http.Server` does not implement that injection path (Node does).
- * Instead the HTTP backend listens on a private endpoint — a unix socket on
- * macOS/Linux, a localhost TCP port on Windows — and the mux pipes the
- * client socket to it. SOCKS connections are handed directly to the
- * library's per-connection entry, no extra hop.
- */
-export declare function createMuxProxyServer(opts: MuxProxyOptions): MuxProxyServer;
-//# sourceMappingURL=mux-proxy.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mux-proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mux-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/mux-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAmBrD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,OAAO,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7B;;;;;;;OAOG;IACH,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChD,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAAA;CACd;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CA8I1E"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mux-proxy.js

@@ -1,159 +0,0 @@
-import { createServer, connect } from 'node:net';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { unlink } from 'node:fs/promises';
-import { logForDebugging } from '../utils/debug.js';
-import { getPlatform } from '../utils/platform.js';
-import { listenInRange } from './listen-in-range.js';
-/**
- * First-byte values that select the SOCKS handler. SOCKS5's greeting is
- * `VER NMETHODS METHODS...` with VER=0x05; SOCKS4's CONNECT is
- * `VN CD DSTPORT...` with VN=0x04. Everything else on this port is HTTP:
- * request methods start with an ASCII uppercase letter (>= 0x41 'A'),
- * h2-prior-knowledge starts `PRI ` (0x50), and a stray TLS ClientHello
- * starts 0x16 — none of which collide with 0x04/0x05. A one-byte peek is
- * therefore an unambiguous discriminator.
- */
-const SOCKS_FIRST_BYTES = new Set([0x04, 0x05]);
-const DEFAULT_FIRST_BYTE_TIMEOUT_MS = 10000;
-let backendSeq = 0;
-function unixSocketPath() {
-    // Keep it short — macOS sun_path is 104 bytes.
-    return join(tmpdir(), `srt-mux-${process.pid}-${(backendSeq++).toString(36)}.sock`);
-}
-/**
- * Single-port proxy front-end that dispatches each connection to either the
- * SOCKS handler or the HTTP proxy based on the first byte the client sends.
- *
- * The HTTP leg cannot use `httpServer.emit('connection', socket)` because
- * Bun's `http.Server` does not implement that injection path (Node does).
- * Instead the HTTP backend listens on a private endpoint — a unix socket on
- * macOS/Linux, a localhost TCP port on Windows — and the mux pipes the
- * client socket to it. SOCKS connections are handed directly to the
- * library's per-connection entry, no extra hop.
- */
-export function createMuxProxyServer(opts) {
-    const firstByteTimeoutMs = opts.firstByteTimeoutMs ?? DEFAULT_FIRST_BYTE_TIMEOUT_MS;
-    const isWindows = getPlatform() === 'windows';
-    // Where the HTTP backend listens. Exactly one of these is set after
-    // listenHttpBackend() resolves.
-    let backendSocketPath;
-    let backendTcpPort;
-    // Track every accepted client socket so close() can tear them down
-    // immediately rather than waiting for in-flight tunnels to drain.
-    const openSockets = new Set();
-    function dispatchHttp(client) {
-        if (backendSocketPath === undefined && backendTcpPort === undefined) {
-            // listenHttpBackend() must resolve before the front-end listens; this
-            // guard is defense-in-depth in case a future caller reorders them.
-            logForDebugging('mux: HTTP dispatch before backend bound; dropping', {
-                level: 'error',
-            });
-            client.destroy();
-            return;
-        }
-        const upstream = backendSocketPath
-            ? connect(backendSocketPath)
-            : connect(backendTcpPort, '127.0.0.1');
-        upstream.on('error', err => {
-            // Surface a 502 with the errno code so callers (and CI logs) can tell
-            // *why* the backend was unreachable instead of an opaque empty-reply.
-            // Full error (including path) goes to debug logging only — the client
-            // is our own sandboxed child, but there's no need to echo host paths.
-            const code = err.code ?? 'ERR';
-            logForDebugging(`mux: HTTP backend dial failed: ${err.message}`, { level: 'error' });
-            if (!client.destroyed) {
-                client.end(`HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n` +
-                    `mux backend dial failed (${code})\n`);
-            }
-        });
-        client.on('error', () => upstream.destroy());
-        client.once('close', () => upstream.destroy());
-        upstream.once('close', () => client.destroy());
-        client.pipe(upstream);
-        upstream.pipe(client);
-    }
-    const server = createServer(client => {
-        openSockets.add(client);
-        client.once('close', () => openSockets.delete(client));
-        client.on('error', err => logForDebugging(`mux: client socket error: ${err.message}`));
-        const timer = setTimeout(() => {
-            logForDebugging('mux: first-byte timeout; destroying connection');
-            client.destroy();
-        }, firstByteTimeoutMs);
-        // Don't let a pending sniff keep the process alive.
-        if (typeof timer.unref === 'function')
-            timer.unref();
-        client.once('readable', () => {
-            clearTimeout(timer);
-            const peek = client.read(1);
-            if (!peek || peek.length === 0) {
-                // EOF before any byte — client connected and closed.
-                client.destroy();
-                return;
-            }
-            client.unshift(peek);
-            if (SOCKS_FIRST_BYTES.has(peek[0])) {
-                opts.handleSocksConnection(client);
-            }
-            else {
-                dispatchHttp(client);
-            }
-        });
-    });
-    return {
-        server,
-        getPort() {
-            const addr = server.address();
-            return addr && typeof addr === 'object' ? addr.port : undefined;
-        },
-        async listenHttpBackend() {
-            if (!isWindows) {
-                const path = unixSocketPath();
-                // A prior process with the same PID may have crashed without
-                // unlinking; clear any stale file so listen() doesn't EADDRINUSE.
-                await unlink(path).catch(() => { });
-                await new Promise((resolve, reject) => {
-                    opts.httpServer.once('error', reject);
-                    opts.httpServer.listen(path, () => {
-                        opts.httpServer.removeListener('error', reject);
-                        resolve();
-                    });
-                });
-                backendSocketPath = path;
-                logForDebugging(`mux: HTTP backend listening on ${path}`);
-                return undefined;
-            }
-            // Windows: AF_UNIX support under Bun is unverified, so the backend
-            // listens on a localhost TCP port inside the WFP-permitted range.
-            // The mux→backend hop originates from the parent process (not the
-            // sandboxed child), so WFP doesn't strictly require it; staying in
-            // range just keeps the port surface predictable.
-            await listenInRange(opts.httpServer, p => opts.httpServer.listen(p, '127.0.0.1'), opts.httpBackendPortRange, new Set());
-            const addr = opts.httpServer.address();
-            backendTcpPort = addr && typeof addr === 'object' ? addr.port : undefined;
-            logForDebugging(`mux: HTTP backend listening on 127.0.0.1:${backendTcpPort}`);
-            return backendTcpPort;
-        },
-        async close() {
-            for (const s of openSockets)
-                s.destroy();
-            openSockets.clear();
-            await new Promise(resolve => server.close(() => resolve()));
-            // The mux owns httpServer's listen lifecycle, so it owns close too.
-            // sandbox-manager.reset() additionally calls forceCloseHttpServer()
-            // for closeAllConnections() semantics; double-close is a no-op.
-            await new Promise(resolve => opts.httpServer.close(() => resolve()));
-            if (backendSocketPath) {
-                await unlink(backendSocketPath).catch(() => { });
-                backendSocketPath = undefined;
-            }
-            backendTcpPort = undefined;
-        },
-        unref() {
-            server.unref();
-            opts.httpServer.unref();
-        },
-    };
-}
-//# sourceMappingURL=mux-proxy.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mux-proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mux-proxy.js","sourceRoot":"","sources":["../../src/sandbox/mux-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAA4B,MAAM,UAAU,CAAA;AAE1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAgD/C,MAAM,6BAA6B,GAAG,KAAM,CAAA;AAE5C,IAAI,UAAU,GAAG,CAAC,CAAA;AAClB,SAAS,cAAc;IACrB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,WAAW,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,6BAA6B,CAAA;IAC1D,MAAM,SAAS,GAAG,WAAW,EAAE,KAAK,SAAS,CAAA;IAE7C,oEAAoE;IACpE,gCAAgC;IAChC,IAAI,iBAAqC,CAAA;IACzC,IAAI,cAAkC,CAAA;IAEtC,mEAAmE;IACnE,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,SAAS,YAAY,CAAC,MAAc;QAClC,IAAI,iBAAiB,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,eAAe,CAAC,mDAAmD,EAAE;gBACnE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB;YAChC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC5B,CAAC,CAAC,OAAO,CAAC,cAAe,EAAE,WAAW,CAAC,CAAA;QACzC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACzB,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,KAAK,CAAA;YACzD,eAAe,CACb,kCAAmC,GAAa,CAAC,OAAO,EAAE,EAC1D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CACR,uDAAuD;oBACrD,4BAA4B,IAAI,KAAK,CACxC,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE;QACnC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CACvB,eAAe,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAC5D,CAAA;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,eAAe,CAAC,gDAAgD,CAAC,CAAA;YACjE,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACtB,oDAAoD;QACpD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAEpD,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAkB,CAAA;YAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,qDAAqD;gBACrD,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,OAAM;YACR,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM;QACN,OAAO;YACL,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC7B,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,CAAC;QACD,KAAK,CAAC,iBAAiB;YACrB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;gBAC7B,6DAA6D;gBAC7D,kEAAkE;gBAClE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;wBAChC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;wBAC/C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;gBACF,iBAAiB,GAAG,IAAI,CAAA;gBACxB,eAAe,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAA;gBACzD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,aAAa,CACjB,IAAI,CAAC,UAAU,EACf,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,EAC3C,IAAI,CAAC,oBAAoB,EACzB,IAAI,GAAG,EAAE,CACV,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;YACtC,cAAc,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;YACzE,eAAe,CACb,4CAA4C,cAAc,EAAE,CAC7D,CAAA;YACD,OAAO,cAAc,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,CAAC,IAAI,WAAW;gBAAE,CAAC,CAAC,OAAO,EAAE,CAAA;YACxC,WAAW,CAAC,KAAK,EAAE,CAAA;YACnB,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACjE,oEAAoE;YACpE,oEAAoE;YACpE,gEAAgE;YAChE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC1E,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAC/C,iBAAiB,GAAG,SAAS,CAAA;YAC/B,CAAC;YACD,cAAc,GAAG,SAAS,CAAA;QAC5B,CAAC;QACD,KAAK;YACH,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC;KACF,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.d.ts

@@ -1,147 +0,0 @@
-/**
- * Parent/upstream HTTP proxy support.
- *
- * When SRT runs in an environment that requires an HTTP proxy for outbound
- * internet access (e.g. inside a VM on a host behind a corporate proxy),
- * SRT's own proxies must chain through that upstream rather than connecting
- * directly.
- *
- * This module provides:
- *   - config resolution (explicit config -> HTTP_PROXY/HTTPS_PROXY/NO_PROXY env)
- *   - NO_PROXY matching (hostname suffix + CIDR via net.BlockList). Follows
- *     golang.org/x/net/http/httpproxy semantics for suffix matching. Note:
- *     port-specific NO_PROXY entries (e.g. `host:8080`) are matched by host
- *     only; the port is ignored.
- *   - a generic CONNECT-tunnel helper that works over Unix socket, TCP, or TLS
- */
-import type { LookupFunction, Socket } from 'node:net';
-import type { IncomingHttpHeaders } from 'node:http';
-import { BlockList } from 'node:net';
-import { URL } from 'node:url';
-import type { ParentProxyConfig } from './sandbox-config.js';
-export interface ResolvedParentProxy {
-    httpUrl?: URL;
-    httpsUrl?: URL;
-    noProxy: NoProxyRules;
-}
-interface NoProxyRules {
-    all: boolean;
-    suffixes: string[];
-    cidr: BlockList;
-}
-/**
- * Resolve the parent proxy config, falling back to the SRT process's own
- * environment. Note: SRT later overwrites HTTP_PROXY etc. in the *sandboxed
- * child's* environment to point at itself — but process.env here reflects the
- * environment SRT itself was launched with, which is what we want.
- */
-export declare function resolveParentProxy(cfg?: ParentProxyConfig): ResolvedParentProxy | undefined;
-/**
- * Returns true if the given host should bypass the parent proxy and connect
- * directly. Always bypasses loopback.
- *
- * NB: the port is not consulted. NO_PROXY entries of the form `host:port` are
- * matched by host only (the port suffix is stripped during parsing).
- */
-export declare function shouldBypassParentProxy(resolved: ResolvedParentProxy, host: string): boolean;
-/**
- * Pick which parent proxy URL to use for a given destination.
- */
-export declare function selectParentProxyUrl(resolved: ResolvedParentProxy, opts: {
-    isHttps: boolean;
-}): URL | undefined;
-export interface ConnectTunnelOptions {
-    /** Establish the transport to the proxy. */
-    dial(): Socket;
-    /** Fired when the transport is ready to write (e.g. 'connect'/'secureConnect'). */
-    readyEvent: 'connect' | 'secureConnect';
-    destHost: string;
-    destPort: number;
-    authHeader?: string;
-    timeoutMs?: number;
-}
-/**
- * Generic CONNECT-tunnel: dial a proxy transport (unix/tcp/tls), send
- * `CONNECT host:port`, wait for a 2xx, and resolve with the tunnelled socket.
- * Validates destHost to prevent CRLF injection from untrusted callers.
- */
-export declare function openConnectTunnel(opts: ConnectTunnelOptions): Promise<Socket>;
-/**
- * Open a CONNECT tunnel through a parent HTTP(S) proxy specified by URL.
- * Thin wrapper around openConnectTunnel that dials TCP or TLS based on the
- * proxy URL scheme.
- */
-export declare function connectViaParentProxy(proxyUrl: URL, destHost: string, destPort: number): Promise<Socket>;
-export declare function proxyAuthHeader(proxyUrl: URL): string | undefined;
-/**
- * Strip hop-by-hop and proxy-specific headers before forwarding upstream.
- * Also strips any headers named in the incoming `Connection` header, per
- * RFC 7230 §6.1.
- */
-export declare function stripHopByHop(h: IncomingHttpHeaders): IncomingHttpHeaders;
-/** Remove surrounding square brackets from an IPv6 literal. */
-export declare function stripBrackets(host: string): string;
-/** Redact userinfo from a URL for safe logging. */
-export declare function redactUrl(u: URL | undefined): string;
-/**
- * Hostname validation: accepts DNS names and IP literals (without zone IDs).
- * Primary purpose is to block control characters (CRLF injection, null-byte
- * DNS truncation) and zone-identifier allowlist bypasses from reaching the
- * wire or the allowlist matcher.
- *
- * IPv6 zone IDs (`fe80::1%eth0`) are rejected because `isIP` accepts a very
- * permissive zone charset including dots — `::ffff:1.2.3.4%x.allowed.com`
- * would pass `isIP`, pass a `.endsWith('.allowed.com')` wildcard check, and
- * then connect to 1.2.3.4 when the OS discards the bogus scope.
- */
-export declare function isValidHost(h: string): boolean;
-/**
- * Canonicalize a host string via the WHATWG URL parser so that string
- * comparisons in the allowlist agree with what `net.connect()`/`getaddrinfo()`
- * will actually dial. This normalizes:
- *   - inet_aton shorthand (`127.1` → `127.0.0.1`, `2130706433` → `127.0.0.1`)
- *   - hex/octal octets (`0x7f.0.0.1` → `127.0.0.1`)
- *   - IPv6 compression (`0:0:0:0:0:0:0:1` → `::1`)
- *   - trailing dots, case, brackets
- *
- * Returns undefined if the input is not a valid URL host.
- */
-export declare function canonicalizeHost(h: string): string | undefined;
-/** Per-dial name resolution the proxies are handed: the guard's `lookup` for `port`, refusals recorded. */
-export type DirectLookup = (port: number, encodedCommand?: string) => LookupFunction;
-/** `host[:port]` as it belongs in a Host header / URL authority: IPv6 bracketed, the default port elided. */
-export declare function formatAuthority(host: string, port: number, defaultPort: number): string;
-export interface DirectRequestOptions {
-    host: string;
-    port: number;
-    servername?: string;
-    agent: false;
-}
-/**
- * Connection options for an `http(s).request` to `host:port` over the direct
- * route. The name is dialed exactly as a tunnel would be ({@link dialDirect}:
- * the guard's `lookup`, the connect timeout, the runtime's address-family
- * fallback), the address that answered is kept and that connection released;
- * the request then goes to the literal, with the name in SNI (callers keep it
- * in Host). So the vetted address is the one requested and `lookup` never
- * reaches the HTTP client: Bun's node:http client up to 1.3.x resolves through
- * a custom `lookup` but then drops or repeats a streamed request body, and
- * ignores `createConnection` (oven-sh/bun#7471), so the vetted socket cannot
- * simply be adopted. Bun 1.4 rewrote that client (oven-sh/bun#31587); once it
- * is the floor, hand the request the dialed socket and drop the second connect.
- * No agent: the global pool is shared with the embedding process (and Bun
- * caches the first request's `ca` on it), and the vetting dial runs per request
- * anyway. Without a `lookup`, or for an IP literal, the host is used as given.
- */
-export declare function directRequestOptions(host: string, port: number, lookup: LookupFunction | undefined, tls: boolean): Promise<DirectRequestOptions>;
-/**
- * Dial `host:port` directly with a bounded timeout. Shared by the HTTP and
- * SOCKS direct-connect paths so they get the same timeout behaviour as the
- * CONNECT-tunnelled paths. `lookup` is the resolved-address guard's (see
- * resolved-address-guard.ts); the runtime dials what it returns. It is a
- * required argument so no direct dial omits it by accident — pass
- * `undefined` explicitly to use the runtime's resolver unguarded.
- */
-export declare function dialDirect(host: string, port: number, lookup: LookupFunction | undefined, timeoutMs?: number): Promise<Socket>;
-export {};
-//# sourceMappingURL=parent-proxy.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parent-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/parent-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAE,SAAS,EAA+B,MAAM,UAAU,CAAA;AAEjE,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAE9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAQ5D,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,GAAG,CAAA;IACb,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,OAAO,EAAE,YAAY,CAAA;CACtB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE,OAAO,CAAA;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;CAChB;AAsBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,CAAC,EAAE,iBAAiB,GACtB,mBAAmB,GAAG,SAAS,CA+CjC;AA+CD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAoBT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,GAAG,GAAG,SAAS,CAMjB;AAMD,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,IAAI,IAAI,MAAM,CAAA;IACd,mFAAmF;IACnF,UAAU,EAAE,SAAS,GAAG,eAAe,CAAA;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmF7E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAMD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAWjE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,CAczE;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,mDAAmD;AACnD,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,MAAM,CAOpD;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAS9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc9D;AAED,2GAA2G;AAC3G,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,MAAM,KACpB,cAAc,CAAA;AAEnB,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,oBAAoB,CAAC,CAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAoBjB"}