pi-codex-auto-review 0.1.2 → 0.1.3

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.js

@@ -1,128 +0,0 @@
-/**
- * Streaming sentinel→real substitution for forwarded HTTP request bodies.
- *
- * The proxy substitutes masked-credential sentinels in request headers
- * (SentinelRegistry.substituteInHeaders); a credential a tool places in a
- * request body (JSON payload, form post) would otherwise reach the API as
- * the useless fake. Sentinels are exact-match strings over `[a-z0-9_-]`, so
- * they survive JSON, form-urlencoded, multipart, and XML verbatim — a raw
- * byte scan needs no format parsing. Bodies are never buffered whole:
- * memory is bounded by one chunk plus a hold-back of `maxSentinelLength - 1`
- * bytes carried across chunk boundaries.
- *
- * Fail-safe direction: substitution is fake→real, so a missed sentinel
- * (compressed body, base64-wrapped, split by an encoder) means the FAKE
- * value reaches the API and auth fails — never a leaked secret.
- */
-import { Transform } from 'node:stream';
-import { logForDebugging } from '../utils/debug.js';
-import { BODYLESS_METHODS } from './request-filter.js';
-/** True when substitution cannot change the body length. */
-export function allLengthMatched(pairs) {
-    return pairs.every(p => p.sentinel.length === p.realValue.length);
-}
-/**
- * Build the substitution Transform for one forwarded request, or undefined
- * when the body must keep the existing bare pipe, byte-identical: bodyless
- * method, no credential injectable at `destHost`, or a Content-Encoding the
- * byte scan cannot see through.
- *
- * When substitution can change the body length (some injectable sentinel is
- * not length-matched with its real value — e.g. a caller-minted JWT-shaped
- * fake), Content-Length is deleted from `fwdHeaders` so the outbound
- * request re-frames as chunked; otherwise Content-Length stays verbatim.
- */
-export function prepareBodySubstitution(getBodySubstitutions, req, fwdHeaders, destHost) {
-    if (getBodySubstitutions === undefined)
-        return undefined;
-    // A bodyless-method request can still carry a declared body (GET-with-body
-    // APIs are legal HTTP and forwarded today) — skip only when there is
-    // provably nothing to scan.
-    const declaresBody = req.headers['content-length'] !== undefined ||
-        req.headers['transfer-encoding'] !== undefined;
-    if (BODYLESS_METHODS.has(req.method ?? 'GET') && !declaresBody) {
-        return undefined;
-    }
-    const pairs = getBodySubstitutions(destHost);
-    if (!pairs?.length)
-        return undefined;
-    if (req.headers['content-encoding'] !== undefined) {
-        // Fail-safe direction: an encoded body cannot be scanned for sentinel
-        // bytes, so it passes through unchanged — a sentinel in it reaches the
-        // upstream as the useless fake and auth fails, but the real secret
-        // cannot leak. Warn so the resulting 401 is diagnosable.
-        logForDebugging(`[body-substitution] ${destHost}: request body has Content-Encoding ` +
-            `"${String(req.headers['content-encoding'])}"; masked-credential ` +
-            `substitution skipped — a sentinel in this body reaches the ` +
-            `upstream as the fake value`, { level: 'warn' });
-        return undefined;
-    }
-    if (!allLengthMatched(pairs)) {
-        delete fwdHeaders['content-length'];
-    }
-    return createBodySubstitutionTransform(pairs);
-}
-/**
- * Transform that replaces every occurrence of each pair's sentinel bytes
- * with its real-value bytes.
- *
- * Boundary-safe: the last `maxSentinelLength - 1` bytes of each chunk are
- * held back and prepended to the next chunk, so a sentinel split across any
- * chunk boundary is still seen whole; the hold-back is flushed on stream
- * end. Replacement is left-to-right, resuming after each replacement — the
- * substituted real value is never rescanned. Backpressure propagates
- * through normal Transform semantics.
- */
-export function createBodySubstitutionTransform(pairs) {
-    const maxLen = Math.max(...pairs.map(p => p.sentinel.length));
-    let carry;
-    return new Transform({
-        transform(chunk, encoding, callback) {
-            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding);
-            const work = carry?.length ? Buffer.concat([carry, buf]) : buf;
-            const { out, tail } = substitute(work, pairs, maxLen);
-            carry = tail;
-            callback(null, out);
-        },
-        flush(callback) {
-            // The hold-back cannot contain a complete sentinel — the scan loop
-            // only stops when no full match remains — so it flushes verbatim.
-            callback(null, carry?.length ? carry : undefined);
-        },
-    });
-}
-function substitute(work, pairs, maxLen) {
-    const parts = [];
-    let pos = 0;
-    for (;;) {
-        // Earliest match across all pairs (typically 1–3 sentinels per host).
-        // Matching is earliest-position-then-registration-order, not
-        // longest-match — sound because no sentinel is a substring of another
-        // (registerWithSentinel's caller contract).
-        let matchIdx = -1;
-        let matchPair;
-        for (const p of pairs) {
-            const i = work.indexOf(p.sentinel, pos);
-            if (i !== -1 && (matchIdx === -1 || i < matchIdx)) {
-                matchIdx = i;
-                matchPair = p;
-            }
-        }
-        if (matchPair === undefined)
-            break;
-        parts.push(work.subarray(pos, matchIdx), matchPair.realValue);
-        pos = matchIdx + matchPair.sentinel.length;
-    }
-    // Hold back the longest suffix that could still be a proper prefix of a
-    // sentinel completed by the next chunk. A partial match of a sentinel of
-    // length L occupies at most L-1 trailing bytes, so maxLen-1 always covers
-    // it. Copied (not a subarray view) so the carry never aliases a buffer
-    // the stream may reuse.
-    const tailStart = Math.max(pos, work.length - (maxLen - 1));
-    parts.push(work.subarray(pos, tailStart));
-    return {
-        out: Buffer.concat(parts),
-        tail: Buffer.from(work.subarray(tailStart)),
-    };
-}
-//# sourceMappingURL=body-substitution.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/body-substitution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"body-substitution.js","sourceRoot":"","sources":["../../src/sandbox/body-substitution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAmBtD,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAC9B,KAAoC;IAEpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,oBAAsD,EACtD,GAAoB,EACpB,UAA+B,EAC/B,QAAgB;IAEhB,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxD,2EAA2E;IAC3E,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC3C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAA;IAChD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,yDAAyD;QACzD,eAAe,CACb,uBAAuB,QAAQ,sCAAsC;YACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,uBAAuB;YAClE,6DAA6D;YAC7D,4BAA4B,EAC9B,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,IAAI,KAAyB,CAAA;IAC7B,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,QAAQ,EAAE,QAAQ;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YACzE,MAAM,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACrD,KAAK,GAAG,IAAI,CAAA;YACZ,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,mEAAmE;YACnE,kEAAkE;YAClE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAoC,EACpC,MAAc;IAEd,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,SAAS,CAAC;QACR,sEAAsE;QACtE,6DAA6D;QAC7D,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;QACjB,IAAI,SAAyC,CAAA;QAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACvC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAClD,QAAQ,GAAG,CAAC,CAAA;gBACZ,SAAS,GAAG,CAAC,CAAA;YACf,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAK;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7D,GAAG,GAAG,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAA;IAC5C,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAA;IACzC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAC5C,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.d.ts

@@ -1,124 +0,0 @@
-/**
- * Linked AWS credential pairs for SigV4 re-signing.
- *
- * The sentinel registry maps independent name→value fakes, but SigV4
- * needs the access key id, secret access key, and optional session token
- * linked as ONE credential: the signature is an HMAC derived from the
- * secret, so a request signed with the fake secret must be re-signed with
- * the real one — and the only reliable trigger is the fake access key id
- * appearing in the signature's credential scope.
- *
- * Pairs come from two sources (see {@link registerAwsPairs}):
- * - an explicit `credentials.awsPairs` grouping, for non-standard
- *   variable names;
- * - auto-detection of the conventional AWS_ACCESS_KEY_ID /
- *   AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio when those vars are
- *   masked whole-value — the names the AWS SDKs and CLI actually read, so
- *   masking them is the opt-in.
- *
- * {@link createSigv4Planner} builds the per-request hook the
- * TLS-terminating proxy runs: exact-match the referenced access key id
- * against registered pair sentinels, classify the signature shape, and
- * either plan a re-sign (header-sigv4) or apply the configured
- * deny/passthrough policy (streaming, presigned, sigv4a).
- */
-import type { IncomingHttpHeaders } from 'node:http';
-import type { HostMatcher } from './credential-sentinel.js';
-import type { AwsPairConfig, CredentialEnvVarConfig, Sigv4Config } from './sandbox-config.js';
-/** Conventional env var names the AWS SDKs and CLI read credentials from. */
-export declare const AWS_ACCESS_KEY_ID_VAR = "AWS_ACCESS_KEY_ID";
-export declare const AWS_SECRET_ACCESS_KEY_VAR = "AWS_SECRET_ACCESS_KEY";
-export declare const AWS_SESSION_TOKEN_VAR = "AWS_SESSION_TOKEN";
-export interface AwsCredentialPair {
-    /** The fake access key id the sandboxed process holds (the sentinel). */
-    readonly accessKeyIdSentinel: string;
-    readonly realAccessKeyId: string;
-    readonly realSecretAccessKey: string;
-    readonly realSessionToken?: string;
-    /**
-     * Hosts where the pair may be injected — the access-key-id entry's
-     * effective injectHosts. Requests to other hosts keep the fake
-     * signature untouched, same as ordinary sentinel substitution.
-     */
-    readonly injectHosts: readonly string[];
-}
-/**
- * AWS pairs for one sandbox session, keyed by the access-key-id sentinel.
- * Like the sentinel registry, it lives only in process memory — never
- * written to disk, never logged.
- */
-export declare class AwsPairRegistry {
-    private readonly bySentinel;
-    /** Insert or replace the pair keyed on its access-key-id sentinel. */
-    register(pair: AwsCredentialPair): void;
-    /** Exact-match lookup by the fake access key id; never pattern-based. */
-    lookup(accessKeyIdSentinel: string): AwsCredentialPair | undefined;
-    get size(): number;
-    /** Drop every pair. Called on session teardown. */
-    clear(): void;
-}
-/**
- * Register AWS credential pairs from the masked env vars.
- *
- * Runs after `buildMaskedEnvVars`: `setEnvVars` maps each masked variable
- * to its fake in-sandbox value, which for whole-value masking IS the
- * sentinel. Pair specs are the explicit `credentials.awsPairs` entries
- * plus — when none of them claims a conventional name — an implicit
- * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN spec.
- *
- * A spec registers only when both the access-key-id and secret variables
- * were actually masked (present in the host env, whole-value entries in
- * `setEnvVars`); the session token joins the pair when its variable was
- * masked too. A partially available spec is skipped — with one loud
- * warning for the dangerous half-masking: a masked secret without a
- * masked access key id means SigV4 requests carry a real key id (so
- * nothing triggers re-signing) over a fake-secret signature that can
- * never verify.
- */
-export declare function registerAwsPairs(envVars: readonly CredentialEnvVarConfig[], awsPairs: readonly AwsPairConfig[] | undefined, allowedDomains: readonly string[], setEnvVars: Readonly<Record<string, string>>, registry: AwsPairRegistry, env?: Record<string, string | undefined>): void;
-export type Sigv4Policy = 'deny' | 'passthrough';
-export declare function resolveSigv4Policies(config: Sigv4Config | undefined): {
-    streaming: "passthrough" | "deny";
-    presigned: "passthrough" | "deny";
-    sigv4a: "passthrough" | "deny";
-};
-/** Decision for one request, produced before header substitution runs. */
-export type Sigv4Plan = {
-    action: 'deny';
-    reason: string;
-} | {
-    action: 'resign';
-    /**
-     * Payload hash to sign. `undefined` means the client signed a
-     * literal body hash (or none): the caller must buffer the body,
-     * SHA-256 it, and pass the hex digest to `apply` — the hash must
-     * cover the bytes actually sent upstream.
-     */
-    payloadHash: string | undefined;
-    /**
-     * Mutate the outgoing (post-substitution) headers in place:
-     * replace Authorization with the real-credential signature, pin
-     * x-amz-content-sha256 to the signed hash, and inject the real
-     * session token when the pair carries one.
-     */
-    apply(headers: IncomingHttpHeaders, hostHeader: string, payloadHash: string): void;
-};
-/**
- * Per-request SigV4 hook for the TLS-terminating proxy. Returns
- * `undefined` when the request is not the re-signer's to handle (no
- * SigV4 signature, unknown/real access key id, destination outside the
- * pair's injectHosts, or a passthrough policy) — the proxy then forwards
- * it exactly as before this feature existed.
- *
- * Must be called with the ORIGINAL client headers, before sentinel
- * substitution: detection matches the fake access key id, which
- * substitution would have already replaced.
- */
-export type PlanSigv4 = (method: string, requestTarget: string, headers: IncomingHttpHeaders, destHost: string) => Sigv4Plan | undefined;
-/**
- * Build the {@link PlanSigv4} hook from the session's pair registry and
- * configured policies. `matches` is the same host matcher used for
- * sentinel substitution, so injectHosts gating is consistent across both.
- */
-export declare function createSigv4Planner(registry: AwsPairRegistry, config: Sigv4Config | undefined, matches: HostMatcher): PlanSigv4;
-//# sourceMappingURL=credential-aws-pairs.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-aws-pairs.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-aws-pairs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AASpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EACtB,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAE5B,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AACxD,eAAO,MAAM,yBAAyB,0BAA0B,CAAA;AAChE,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAElE,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI;IAIvC,yEAAyE;IACzE,MAAM,CAAC,mBAAmB,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIlE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,mDAAmD;IACnD,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EAC9C,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,QAAQ,EAAE,eAAe,EACzB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,IAAI,CAmFN;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,aAAa,CAAA;AAQhD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS;;;;EAMnE;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,MAAM,EAAE,QAAQ,CAAA;IAChB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B;;;;;OAKG;IACH,KAAK,CACH,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,IAAI,CAAA;CACR,CAAA;AAEL;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,KACb,SAAS,GAAG,SAAS,CAAA;AAE1B;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,WAAW,GACnB,SAAS,CAoHX"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.js

@@ -1,258 +0,0 @@
-/**
- * Linked AWS credential pairs for SigV4 re-signing.
- *
- * The sentinel registry maps independent name→value fakes, but SigV4
- * needs the access key id, secret access key, and optional session token
- * linked as ONE credential: the signature is an HMAC derived from the
- * secret, so a request signed with the fake secret must be re-signed with
- * the real one — and the only reliable trigger is the fake access key id
- * appearing in the signature's credential scope.
- *
- * Pairs come from two sources (see {@link registerAwsPairs}):
- * - an explicit `credentials.awsPairs` grouping, for non-standard
- *   variable names;
- * - auto-detection of the conventional AWS_ACCESS_KEY_ID /
- *   AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio when those vars are
- *   masked whole-value — the names the AWS SDKs and CLI actually read, so
- *   masking them is the opt-in.
- *
- * {@link createSigv4Planner} builds the per-request hook the
- * TLS-terminating proxy runs: exact-match the referenced access key id
- * against registered pair sentinels, classify the signature shape, and
- * either plan a re-sign (header-sigv4) or apply the configured
- * deny/passthrough policy (streaming, presigned, sigv4a).
- */
-import { logForDebugging } from '../utils/debug.js';
-import { detectSigv4, parseSigv4Authorization, signSigv4, singleHeader, UNSIGNED_PAYLOAD, } from './aws-sigv4.js';
-/** Conventional env var names the AWS SDKs and CLI read credentials from. */
-export const AWS_ACCESS_KEY_ID_VAR = 'AWS_ACCESS_KEY_ID';
-export const AWS_SECRET_ACCESS_KEY_VAR = 'AWS_SECRET_ACCESS_KEY';
-export const AWS_SESSION_TOKEN_VAR = 'AWS_SESSION_TOKEN';
-/**
- * AWS pairs for one sandbox session, keyed by the access-key-id sentinel.
- * Like the sentinel registry, it lives only in process memory — never
- * written to disk, never logged.
- */
-export class AwsPairRegistry {
-    constructor() {
-        this.bySentinel = new Map();
-    }
-    /** Insert or replace the pair keyed on its access-key-id sentinel. */
-    register(pair) {
-        this.bySentinel.set(pair.accessKeyIdSentinel, pair);
-    }
-    /** Exact-match lookup by the fake access key id; never pattern-based. */
-    lookup(accessKeyIdSentinel) {
-        return this.bySentinel.get(accessKeyIdSentinel);
-    }
-    get size() {
-        return this.bySentinel.size;
-    }
-    /** Drop every pair. Called on session teardown. */
-    clear() {
-        this.bySentinel.clear();
-    }
-}
-/**
- * Register AWS credential pairs from the masked env vars.
- *
- * Runs after `buildMaskedEnvVars`: `setEnvVars` maps each masked variable
- * to its fake in-sandbox value, which for whole-value masking IS the
- * sentinel. Pair specs are the explicit `credentials.awsPairs` entries
- * plus — when none of them claims a conventional name — an implicit
- * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN spec.
- *
- * A spec registers only when both the access-key-id and secret variables
- * were actually masked (present in the host env, whole-value entries in
- * `setEnvVars`); the session token joins the pair when its variable was
- * masked too. A partially available spec is skipped — with one loud
- * warning for the dangerous half-masking: a masked secret without a
- * masked access key id means SigV4 requests carry a real key id (so
- * nothing triggers re-signing) over a fake-secret signature that can
- * never verify.
- */
-export function registerAwsPairs(envVars, awsPairs, allowedDomains, setEnvVars, registry, env = process.env) {
-    const specs = [...(awsPairs ?? [])];
-    const explicitNames = new Set(specs.flatMap(p => [
-        p.accessKeyIdVar,
-        p.secretAccessKeyVar,
-        ...(p.sessionTokenVar ? [p.sessionTokenVar] : []),
-    ]));
-    const conventional = [
-        AWS_ACCESS_KEY_ID_VAR,
-        AWS_SECRET_ACCESS_KEY_VAR,
-        AWS_SESSION_TOKEN_VAR,
-    ];
-    if (!conventional.some(n => explicitNames.has(n))) {
-        specs.push({
-            accessKeyIdVar: AWS_ACCESS_KEY_ID_VAR,
-            secretAccessKeyVar: AWS_SECRET_ACCESS_KEY_VAR,
-            sessionTokenVar: AWS_SESSION_TOKEN_VAR,
-        });
-    }
-    // A variable is usable as a pair member when it has a whole-value
-    // mask entry AND was actually masked at runtime (set in the host env).
-    const wholeValueEntry = (name) => envVars.find(v => v.name === name &&
-        v.mode === 'mask' &&
-        v.extract === undefined &&
-        v.decode === undefined);
-    const maskedSentinel = (name) => wholeValueEntry(name) !== undefined ? setEnvVars[name] : undefined;
-    for (const spec of specs) {
-        const akidSentinel = maskedSentinel(spec.accessKeyIdVar);
-        const secretMasked = maskedSentinel(spec.secretAccessKeyVar) !== undefined;
-        const realAkid = env[spec.accessKeyIdVar];
-        const realSecret = env[spec.secretAccessKeyVar];
-        if (akidSentinel === undefined ||
-            !secretMasked ||
-            realAkid === undefined ||
-            realSecret === undefined) {
-            if (secretMasked && akidSentinel === undefined) {
-                const msg = `[sandbox-runtime] WARNING: "${spec.secretAccessKeyVar}" is ` +
-                    `masked but "${spec.accessKeyIdVar}" is not, so no AWS ` +
-                    `credential pair was registered. SigV4 requests will be signed ` +
-                    `with the masked placeholder secret and the proxy cannot ` +
-                    `detect or re-sign them — they will fail upstream. Mask both ` +
-                    `variables (whole-value) to enable re-signing.`;
-                console.warn(msg);
-                logForDebugging(msg, { level: 'warn' });
-            }
-            continue;
-        }
-        const akidEntry = wholeValueEntry(spec.accessKeyIdVar);
-        const sessionSentinel = spec.sessionTokenVar !== undefined
-            ? maskedSentinel(spec.sessionTokenVar)
-            : undefined;
-        const realSessionToken = sessionSentinel !== undefined && spec.sessionTokenVar !== undefined
-            ? env[spec.sessionTokenVar]
-            : undefined;
-        registry.register({
-            accessKeyIdSentinel: akidSentinel,
-            realAccessKeyId: realAkid,
-            realSecretAccessKey: realSecret,
-            ...(realSessionToken !== undefined ? { realSessionToken } : {}),
-            injectHosts: akidEntry.injectHosts ?? allowedDomains,
-        });
-        logForDebugging(`[credential-aws] registered SigV4 pair for ` +
-            `${spec.accessKeyIdVar}/${spec.secretAccessKeyVar}` +
-            (realSessionToken !== undefined ? ` (+session token)` : ''));
-    }
-}
-export function resolveSigv4Policies(config) {
-    return {
-        streaming: config?.streaming ?? 'deny',
-        presigned: config?.presigned ?? 'deny',
-        sigv4a: config?.sigv4a ?? 'deny',
-    };
-}
-/**
- * Build the {@link PlanSigv4} hook from the session's pair registry and
- * configured policies. `matches` is the same host matcher used for
- * sentinel substitution, so injectHosts gating is consistent across both.
- */
-export function createSigv4Planner(registry, config, matches) {
-    const policies = resolveSigv4Policies(config);
-    return (method, requestTarget, headers, destHost) => {
-        if (registry.size === 0)
-            return undefined;
-        const detected = detectSigv4(headers, requestTarget);
-        if (detected === null)
-            return undefined;
-        const pair = registry.lookup(detected.accessKeyId);
-        // Unknown key id — including a real, unmasked AWS credential — is
-        // never rewritten and never denied.
-        if (pair === undefined)
-            return undefined;
-        if (!pair.injectHosts.some(p => matches(destHost, p)))
-            return undefined;
-        if (detected.kind !== 'header-sigv4') {
-            if (policies[detected.kind] === 'passthrough') {
-                logForDebugging(`[credential-aws] ${detected.kind} request with masked ` +
-                    `credential passed through un-resigned per ` +
-                    `credentials.sigv4.${detected.kind} (its signature covers ` +
-                    `the placeholder secret and will fail upstream)`);
-                return undefined;
-            }
-            return {
-                action: 'deny',
-                reason: `AWS SigV4 ${detected.kind} request uses a masked credential ` +
-                    `but cannot be re-signed by the sandbox proxy; denied by ` +
-                    `policy. Set credentials.sigv4.${detected.kind} to ` +
-                    `"passthrough" to forward it unmodified (it will fail ` +
-                    `upstream: the signature covers the masked placeholder).`,
-            };
-        }
-        const auth = parseSigv4Authorization(singleHeader(headers.authorization));
-        if (auth === null) {
-            return {
-                action: 'deny',
-                reason: 'AWS SigV4 request uses a masked credential but its ' +
-                    'Authorization header is malformed; the proxy cannot re-sign it.',
-            };
-        }
-        const amzDate = singleHeader(headers['x-amz-date']);
-        if (amzDate === undefined) {
-            return {
-                action: 'deny',
-                reason: 'AWS SigV4 request uses a masked credential but carries no ' +
-                    'x-amz-date header; the proxy cannot re-sign it.',
-            };
-        }
-        // Presence check now so apply() cannot fail after the body was
-        // consumed. host is synthesized; a session token the pair carries
-        // is injected by apply().
-        const signedHeaders = [...auth.signedHeaders];
-        for (const name of signedHeaders) {
-            if (name === 'host')
-                continue;
-            if (name === 'x-amz-security-token' &&
-                pair.realSessionToken !== undefined) {
-                continue;
-            }
-            if (headers[name] === undefined) {
-                return {
-                    action: 'deny',
-                    reason: `AWS SigV4 request uses a masked credential but signed ` +
-                        `header "${name}" is missing; the proxy cannot re-sign it.`,
-                };
-            }
-        }
-        if (pair.realSessionToken !== undefined &&
-            !signedHeaders.includes('x-amz-security-token')) {
-            signedHeaders.push('x-amz-security-token');
-        }
-        const contentSha = singleHeader(headers['x-amz-content-sha256']);
-        return {
-            action: 'resign',
-            payloadHash: contentSha === UNSIGNED_PAYLOAD ? UNSIGNED_PAYLOAD : undefined,
-            apply(fwdHeaders, hostHeader, payloadHash) {
-                if (pair.realSessionToken !== undefined) {
-                    fwdHeaders['x-amz-security-token'] = pair.realSessionToken;
-                }
-                if (fwdHeaders['x-amz-content-sha256'] !== undefined &&
-                    contentSha !== UNSIGNED_PAYLOAD) {
-                    // The recomputed hash is authoritative: the signature must
-                    // cover the bytes forwarded upstream, not the client's claim.
-                    fwdHeaders['x-amz-content-sha256'] = payloadHash;
-                }
-                const { authorization } = signSigv4({
-                    method,
-                    requestTarget,
-                    headers: fwdHeaders,
-                    hostHeader,
-                    signedHeaders,
-                    payloadHash,
-                    amzDate,
-                    scope: {
-                        date: auth.date,
-                        region: auth.region,
-                        service: auth.service,
-                    },
-                    accessKeyId: pair.realAccessKeyId,
-                    secretAccessKey: pair.realSecretAccessKey,
-                });
-                fwdHeaders.authorization = authorization;
-            },
-        };
-    };
-}
-//# sourceMappingURL=credential-aws-pairs.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-aws-pairs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-aws-pairs.js","sourceRoot":"","sources":["../../src/sandbox/credential-aws-pairs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AAQvB,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAA;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAA;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAA;AAgBxD;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAA5B;QACmB,eAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAoBpE,CAAC;IAlBC,sEAAsE;IACtE,QAAQ,CAAC,IAAuB;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,mBAA2B;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAED,mDAAmD;IACnD,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0C,EAC1C,QAA8C,EAC9C,cAAiC,EACjC,UAA4C,EAC5C,QAAyB,EACzB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,KAAK,GAAoB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,kBAAkB;QACpB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CACH,CAAA;IACD,MAAM,YAAY,GAAG;QACnB,qBAAqB;QACrB,yBAAyB;QACzB,qBAAqB;KACtB,CAAA;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC;YACT,cAAc,EAAE,qBAAqB;YACrC,kBAAkB,EAAE,yBAAyB;YAC7C,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,CAAC,IAAI,KAAK,MAAM;QACjB,CAAC,CAAC,OAAO,KAAK,SAAS;QACvB,CAAC,CAAC,MAAM,KAAK,SAAS,CACzB,CAAA;IACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC1D,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAA;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC/C,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,YAAY;YACb,QAAQ,KAAK,SAAS;YACtB,UAAU,KAAK,SAAS,EACxB,CAAC;YACD,IAAI,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,GAAG,GACP,+BAA+B,IAAI,CAAC,kBAAkB,OAAO;oBAC7D,eAAe,IAAI,CAAC,cAAc,sBAAsB;oBACxD,gEAAgE;oBAChE,0DAA0D;oBAC1D,8DAA8D;oBAC9D,+CAA+C,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACzC,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,CAAE,CAAA;QACvD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAChC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;YACtC,CAAC,CAAC,SAAS,CAAA;QACf,MAAM,gBAAgB,GACpB,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YACjE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAA;QAEf,QAAQ,CAAC,QAAQ,CAAC;YAChB,mBAAmB,EAAE,YAAY;YACjC,eAAe,EAAE,QAAQ;YACzB,mBAAmB,EAAE,UAAU;YAC/B,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,cAAc;SACrD,CAAC,CAAA;QACF,eAAe,CACb,6CAA6C;YAC3C,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,kBAAkB,EAAE;YACnD,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAA;IACH,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAClE,OAAO;QACL,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,MAAM;QACtC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,MAAM;QACtC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM;KACT,CAAA;AAC3B,CAAC;AA6CD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,MAA+B,EAC/B,OAAoB;IAEpB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,kEAAkE;QAClE,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAEvE,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBAC9C,eAAe,CACb,oBAAoB,QAAQ,CAAC,IAAI,uBAAuB;oBACtD,4CAA4C;oBAC5C,qBAAqB,QAAQ,CAAC,IAAI,yBAAyB;oBAC3D,gDAAgD,CACnD,CAAA;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,aAAa,QAAQ,CAAC,IAAI,oCAAoC;oBAC9D,0DAA0D;oBAC1D,iCAAiC,QAAQ,CAAC,IAAI,MAAM;oBACpD,uDAAuD;oBACvD,yDAAyD;aAC5D,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAE,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,qDAAqD;oBACrD,iEAAiE;aACpE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,4DAA4D;oBAC5D,iDAAiD;aACpD,CAAA;QACH,CAAC;QACD,+DAA+D;QAC/D,kEAAkE;QAClE,0BAA0B;QAC1B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;QAC7C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAQ;YAC7B,IACE,IAAI,KAAK,sBAAsB;gBAC/B,IAAI,CAAC,gBAAgB,KAAK,SAAS,EACnC,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EACJ,wDAAwD;wBACxD,WAAW,IAAI,4CAA4C;iBAC9D,CAAA;YACH,CAAC;QACH,CAAC;QACD,IACE,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACnC,CAAC,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC/C,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,WAAW,EACT,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW;gBACvC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAA;gBAC5D,CAAC;gBACD,IACE,UAAU,CAAC,sBAAsB,CAAC,KAAK,SAAS;oBAChD,UAAU,KAAK,gBAAgB,EAC/B,CAAC;oBACD,2DAA2D;oBAC3D,8DAA8D;oBAC9D,UAAU,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAA;gBAClD,CAAC;gBACD,MAAM,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;oBAClC,MAAM;oBACN,aAAa;oBACb,OAAO,EAAE,UAAU;oBACnB,UAAU;oBACV,aAAa;oBACb,WAAW;oBACX,OAAO;oBACP,KAAK,EAAE;wBACL,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB;oBACD,WAAW,EAAE,IAAI,CAAC,eAAe;oBACjC,eAAe,EAAE,IAAI,CAAC,mBAAmB;iBAC1C,CAAC,CAAA;gBACF,UAAU,CAAC,aAAa,GAAG,aAAa,CAAA;YAC1C,CAAC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.d.ts

@@ -1,87 +0,0 @@
-/**
- * Decoding support for encoded credential formats (`decode` on a
- * `credentials.files` entry). Currently JWT only.
- *
- * Pure helpers: the default extraction pattern for finding JWT candidates
- * in a file, the verification predicate that confirms a candidate actually
- * is a JWT before it gets masked, and the minting of a JWT-shaped fake to
- * stand in for the real token inside the sandbox.
- */
-/**
- * Default `extract` pattern for `decode: "jwt"` entries.
- *
- * A JWT's first segment is the base64url encoding of a JSON header that
- * starts `{"` (it always declares `alg`/`typ`), and base64url of `{"` is
- * `eyJ` — so every JWT starts with `eyJ`. Capture group 1 is the whole
- * three-segment token. The pattern over-matches (any eyJ-prefixed
- * base64url triple); {@link verifyJwt} filters the false positives.
- */
-export declare const JWT_DEFAULT_EXTRACT_PATTERN = "(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";
-/**
- * True when `candidate` is structurally a JWT: three dot-separated
- * segments, the first two base64url-decoding to JSON, and the header
- * (segment 1) declaring an `alg` property.
- *
- * Used to filter extraction candidates before masking — a regex match
- * that fails this check (e.g. a random base64 blob the default pattern
- * over-matched) is left untouched rather than masked.
- */
-export declare function verifyJwt(candidate: string): boolean;
-/**
- * Mint a structurally valid fake JWT carrying the sentinel identity
- * `fake_value_<uuid>` in its `sub` claim. Deterministic given `uuid`.
- *
- * The fake is parseable by client-side JWT handling (three segments, JSON
- * header/payload, far-future `exp`), so a tool inside the sandbox that
- * inspects the token before sending it doesn't break. The header says
- * `alg: HS256` — NOT `alg: none` — deliberately: misconfigured validators
- * accept `alg: none` tokens as valid, whereas an HS256 header forces every
- * validator to attempt signature verification and reject the garbage
- * signature. So if the fake ever reaches a verifier unswapped (e.g. sent
- * to a non-injectHosts destination, the designed fail-closed pass-through),
- * it is cryptographically rejected.
- */
-export declare function mintFakeJwt(uuid: string): string;
-/** Result of {@link maskJwtClaims}. */
-export interface MaskedClaimsResult {
-    /**
-     * The rebuilt token: the original header segment verbatim, the modified
-     * payload re-encoded, and the fixed filler signature.
-     */
-    fakeToken: string;
-    /** Claim name → the sentinel now carried in the fake payload. */
-    claimSentinels: Map<string, string>;
-}
-/**
- * Claim-level masking for a verified JWT: replace each named top-level
- * payload claim that is present with a string value by a caller-provided
- * sentinel, and rebuild the token around the modified payload.
- *
- * The rebuilt token is `header.payload'.signature-filler`:
- *
- * - **Header**: the original base64url segment is reused verbatim, so the
- *   token still advertises the real `alg`/`typ`/`kid` and client-side
- *   header inspection sees exactly what it would outside the sandbox.
- * - **Payload**: the decoded object with the named claims swapped for
- *   sentinels, re-encoded with `JSON.stringify`. Key order and whitespace
- *   inside the payload segment may differ from the original encoding —
- *   irrelevant to any JSON consumer, and the segment bytes change anyway
- *   because a claim value changed.
- * - **Signature**: the fixed filler from {@link mintFakeJwt}, NOT the real
- *   signature. For RS/ES algorithms signature verification needs only the
- *   public key, so shipping the real signature over a modified payload
- *   would hand the sandbox an offline brute-force oracle for a low-entropy
- *   masked claim (guess the claim, re-encode, verify). The filler also
- *   keeps the fake a non-credential end to end, consistent with the
- *   garbage-signature rationale in {@link mintFakeJwt}.
- *
- * Claims that are absent from the payload, or present with a non-string
- * value, are skipped (the caller logs them). Returns `null` — without
- * invoking `sentinelFor` — when no named claim matched, or when the
- * payload does not decode to a JSON object; the caller routes that
- * through its no-match policy.
- *
- * Pure on `token`/`claims`; the callback may close over a registry.
- */
-export declare function maskJwtClaims(token: string, claims: readonly string[], sentinelFor: (claim: string, realValue: string) => string): MaskedClaimsResult | null;
-//# sourceMappingURL=credential-decode.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-decode.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,0DACiB,CAAA;AAWzD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQpD;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GACxD,kBAAkB,GAAG,IAAI,CA4B3B"}