pi-codex-auto-review 0.1.2 → 0.1.4

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.d.ts

@@ -1,120 +0,0 @@
-/**
- * Credential file masking (Linux).
- *
- * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
- * file content on the host, registers one or more sentinels in the
- * {@link SentinelRegistry}, and writes a fake file (sentinel-substituted)
- * to a manager-owned temp directory. The Linux sandbox then `--ro-bind`s
- * the fake over the real path, so the sandboxed process reads the
- * sentinel(s). The proxy substitution from env-var masking already scans
- * every header for any registered sentinel, so a tool that does
- * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
- * the real bytes — no proxy changes required.
- *
- * Without `extract`, masking is **whole-file**: one sentinel replaces the
- * entire content. With `extract`, masking is **structured**: a regex picks
- * out the credential value(s) and only those spans are replaced, so a tool
- * that parses the file (JSON/YAML/.netrc) still sees valid syntax. See
- * {@link extractAndSubstitute} and {@link CredentialFileConfigSchema}.
- *
- * On macOS, SBPL cannot redirect reads, so masked files degrade to
- * `mode: "deny"` (see macos-sandbox-utils.ts).
- */
-import type { CredentialFileConfig } from './sandbox-config.js';
-import type { SentinelRegistry } from './credential-sentinel.js';
-/** One masked file's bind mapping for the platform builder. */
-export interface MaskedFileBind {
-    /** Resolved (tilde-expanded, realpath'd) host path of the real file. */
-    realPath: string;
-    /** Path to the fake file containing the sentinel. */
-    fakePath: string;
-}
-/**
- * Manager-owned temp dir holding the fake files.
- *
- * INVARIANT: this directory must never be writable from inside the sandbox.
- * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
- * after every other filesystem mount (see generateFilesystemArgs), so the
- * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
- * the host's $TMPDIR points under a default-writable path. If the sandbox
- * could write here it could replace a fake's content (the bind exposes the
- * source file) or plant a symlink for a later host-side write() to follow.
- */
-export declare class MaskedFileStore {
-    private dir;
-    private readonly byKey;
-    /**
-     * Write `sentinel` to a fake file for `key` and return its path.
-     * Idempotent on `key`: a repeat call rewrites the same fake (so a
-     * changed sentinel after re-register propagates) instead of leaking a
-     * new file per wrapWithSandbox() call.
-     */
-    write(key: string, sentinel: string): string;
-    /** Remove the temp dir and every fake file in it. Idempotent. */
-    dispose(): void;
-    /** Temp dir path, or undefined if no fake has been written yet. */
-    get dirPath(): string | undefined;
-}
-/** Result of {@link buildMaskedFileBinds}. */
-export interface MaskedFileBuildResult {
-    binds: MaskedFileBind[];
-    /**
-     * Resolved paths of `mode: "mask"` entries that degraded to deny at
-     * runtime — populated when `extract` matches nothing (or, with
-     * `decode`, no candidate verifies) and the entry's `onExtractNoMatch`
-     * is `"deny"`. Callers union these into the read-deny set so the
-     * credential file is unreadable rather than exposed.
-     */
-    degradeToDenyPaths: string[];
-}
-/**
- * For each `mode: "mask"` file entry: resolve the path, read the real
- * content, build the fake content (whole-file or structured per `extract`),
- * register sentinels in `registry`, write the fake via `store`, and return
- * the bind list plus any entries that degraded to deny.
- *
- * Whole-file mode (no `extract`): one sentinel keyed `file:<path>` whose
- * real value is the entire file content; the fake file *is* the sentinel.
- *
- * Structured mode (`extract` and/or `decode` set): one sentinel per
- * distinct captured value, keyed `file:<path>#<i>`; the fake file is the
- * real content with each captured span replaced by its sentinel. With
- * `decode: "jwt"`, candidates come from the explicit `extract` pattern or
- * the built-in JWT pattern, each candidate must pass {@link verifyJwt}
- * before it is masked (failed candidates are left untouched), and the
- * sentinel is a JWT-shaped fake ({@link mintFakeJwt}) registered via
- * `registerWithSentinel`. With `maskClaims`, masking goes one level
- * deeper: each named top-level payload claim present with a string value
- * gets its own sentinel and the token is rebuilt around the modified
- * payload ({@link maskJwtClaims}); BOTH mappings are registered — the
- * whole fake token → the whole real token (a tool sending the token as a
- * bearer credential) and each claim sentinel → the real claim value (a
- * tool extracting the claim and sending it alone) — under the same
- * injectHosts. Named claims absent or non-string in a token are skipped
- * with a debug log (portable-config posture, like a missing file). If the
- * regex matches nothing — or, with decode, no candidate verifies, or with
- * `maskClaims`, no named claim matches in any verified token — the
- * entry's `onExtractNoMatch` decides:
- * - `"warn"` (default): skip the entry with a loud stderr warning —
- *   fail-open, the file stays readable via the root mount;
- * - `"deny"`: push the path to `degradeToDenyPaths` — fail-closed, the
- *   file becomes unreadable inside the sandbox;
- * - `"error"`: throw, so nothing runs until the config is fixed.
- * With `maskDuplicates`, verbatim occurrences of each captured value
- * outside the matched spans are also replaced (see {@link ExtractOptions}).
- * Composed with `decode`, the duplicate pass covers only captures that
- * passed verification — a duplicate is the same value, so it inherits the
- * verified capture's sentinel without re-verification; unverified
- * candidates (left untouched by the decode gate) never mask duplicates.
- *
- * Entries whose path does not exist, is unreadable, or resolves to a
- * directory are skipped with a debug log — same posture as a masked env
- * var that's unset on the host: nothing to protect, and surfacing a hard
- * error would make a portable config brittle across machines.
- *
- * The directory check is the authoritative one (the schema only catches a
- * trailing slash); whole-file masking has no meaning for a directory.
- */
-export declare function buildMaskedFileBinds(files: readonly CredentialFileConfig[], allowedDomains: readonly string[], registry: SentinelRegistry, store: MaskedFileStore): MaskedFileBuildResult;
-export declare const MASKED_FILE_STORE_PREFIX = "srt-credmask-";
-//# sourceMappingURL=credential-mask-files.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-mask-files.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAShE,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAElD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAoB5C,iEAAiE;IACjE,OAAO,IAAI,IAAI;IAcf,mEAAmE;IACnE,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;CACF;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,eAAe,GACrB,qBAAqB,CA4KvB;AAED,eAAO,MAAM,wBAAwB,kBAAkB,CAAA"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.js

@@ -1,281 +0,0 @@
-/**
- * Credential file masking (Linux).
- *
- * For a `credentials.files` entry with `mode: "mask"`, srt reads the real
- * file content on the host, registers one or more sentinels in the
- * {@link SentinelRegistry}, and writes a fake file (sentinel-substituted)
- * to a manager-owned temp directory. The Linux sandbox then `--ro-bind`s
- * the fake over the real path, so the sandboxed process reads the
- * sentinel(s). The proxy substitution from env-var masking already scans
- * every header for any registered sentinel, so a tool that does
- * `Authorization: Bearer $(cat <maskedFile>)` reaches the upstream with
- * the real bytes — no proxy changes required.
- *
- * Without `extract`, masking is **whole-file**: one sentinel replaces the
- * entire content. With `extract`, masking is **structured**: a regex picks
- * out the credential value(s) and only those spans are replaced, so a tool
- * that parses the file (JSON/YAML/.netrc) still sees valid syntax. See
- * {@link extractAndSubstitute} and {@link CredentialFileConfigSchema}.
- *
- * On macOS, SBPL cannot redirect reads, so masked files degrade to
- * `mode: "deny"` (see macos-sandbox-utils.ts).
- */
-import { randomUUID } from 'node:crypto';
-import * as fs from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { logForDebugging } from '../utils/debug.js';
-import { extractAndSubstitute } from './credential-extract.js';
-import { normalizePathForSandbox } from './sandbox-utils.js';
-import { JWT_DEFAULT_EXTRACT_PATTERN, maskJwtClaims, mintFakeJwt, verifyJwt, } from './credential-decode.js';
-/**
- * Sentinel-registry key prefix for masked files. Keeps file keys disjoint
- * from env-var names so a credential file at path `GH_TOKEN` cannot collide
- * with the env var `GH_TOKEN`.
- */
-const FILE_KEY_PREFIX = 'file:';
-/**
- * Manager-owned temp dir holding the fake files.
- *
- * INVARIANT: this directory must never be writable from inside the sandbox.
- * The Linux layer enforces this by emitting `--ro-bind <dirPath> <dirPath>`
- * after every other filesystem mount (see generateFilesystemArgs), so the
- * store stays read-only even if a caller's allowWrite covers os.tmpdir() or
- * the host's $TMPDIR points under a default-writable path. If the sandbox
- * could write here it could replace a fake's content (the bind exposes the
- * source file) or plant a symlink for a later host-side write() to follow.
- */
-export class MaskedFileStore {
-    constructor() {
-        this.byKey = new Map();
-    }
-    /**
-     * Write `sentinel` to a fake file for `key` and return its path.
-     * Idempotent on `key`: a repeat call rewrites the same fake (so a
-     * changed sentinel after re-register propagates) instead of leaking a
-     * new file per wrapWithSandbox() call.
-     */
-    write(key, sentinel) {
-        if (this.dir === undefined) {
-            this.dir = fs.mkdtempSync(join(tmpdir(), 'srt-credmask-'));
-        }
-        let fakePath = this.byKey.get(key);
-        if (fakePath === undefined) {
-            fakePath = join(this.dir, `${this.byKey.size}.fake`);
-            this.byKey.set(key, fakePath);
-        }
-        // Never follow a symlink at fakePath: a prior sandbox invocation may
-        // have planted one (the store dir is ro-bound now, but defence in
-        // depth). Unlink first so writeFileSync creates a fresh regular file.
-        fs.rmSync(fakePath, { force: true });
-        // 0600: owner rw so the idempotent rewrite above succeeds; the bind
-        // into the sandbox is --ro-bind so the sandboxed process sees it
-        // read-only regardless of the host mode. No group/other.
-        fs.writeFileSync(fakePath, sentinel, { mode: 0o600 });
-        return fakePath;
-    }
-    /** Remove the temp dir and every fake file in it. Idempotent. */
-    dispose() {
-        if (this.dir !== undefined) {
-            try {
-                fs.rmSync(this.dir, { recursive: true, force: true });
-            }
-            catch (err) {
-                logForDebugging(`MaskedFileStore cleanup failed: ${err}`, {
-                    level: 'error',
-                });
-            }
-        }
-        this.dir = undefined;
-        this.byKey.clear();
-    }
-    /** Temp dir path, or undefined if no fake has been written yet. */
-    get dirPath() {
-        return this.dir;
-    }
-}
-/**
- * For each `mode: "mask"` file entry: resolve the path, read the real
- * content, build the fake content (whole-file or structured per `extract`),
- * register sentinels in `registry`, write the fake via `store`, and return
- * the bind list plus any entries that degraded to deny.
- *
- * Whole-file mode (no `extract`): one sentinel keyed `file:<path>` whose
- * real value is the entire file content; the fake file *is* the sentinel.
- *
- * Structured mode (`extract` and/or `decode` set): one sentinel per
- * distinct captured value, keyed `file:<path>#<i>`; the fake file is the
- * real content with each captured span replaced by its sentinel. With
- * `decode: "jwt"`, candidates come from the explicit `extract` pattern or
- * the built-in JWT pattern, each candidate must pass {@link verifyJwt}
- * before it is masked (failed candidates are left untouched), and the
- * sentinel is a JWT-shaped fake ({@link mintFakeJwt}) registered via
- * `registerWithSentinel`. With `maskClaims`, masking goes one level
- * deeper: each named top-level payload claim present with a string value
- * gets its own sentinel and the token is rebuilt around the modified
- * payload ({@link maskJwtClaims}); BOTH mappings are registered — the
- * whole fake token → the whole real token (a tool sending the token as a
- * bearer credential) and each claim sentinel → the real claim value (a
- * tool extracting the claim and sending it alone) — under the same
- * injectHosts. Named claims absent or non-string in a token are skipped
- * with a debug log (portable-config posture, like a missing file). If the
- * regex matches nothing — or, with decode, no candidate verifies, or with
- * `maskClaims`, no named claim matches in any verified token — the
- * entry's `onExtractNoMatch` decides:
- * - `"warn"` (default): skip the entry with a loud stderr warning —
- *   fail-open, the file stays readable via the root mount;
- * - `"deny"`: push the path to `degradeToDenyPaths` — fail-closed, the
- *   file becomes unreadable inside the sandbox;
- * - `"error"`: throw, so nothing runs until the config is fixed.
- * With `maskDuplicates`, verbatim occurrences of each captured value
- * outside the matched spans are also replaced (see {@link ExtractOptions}).
- * Composed with `decode`, the duplicate pass covers only captures that
- * passed verification — a duplicate is the same value, so it inherits the
- * verified capture's sentinel without re-verification; unverified
- * candidates (left untouched by the decode gate) never mask duplicates.
- *
- * Entries whose path does not exist, is unreadable, or resolves to a
- * directory are skipped with a debug log — same posture as a masked env
- * var that's unset on the host: nothing to protect, and surfacing a hard
- * error would make a portable config brittle across machines.
- *
- * The directory check is the authoritative one (the schema only catches a
- * trailing slash); whole-file masking has no meaning for a directory.
- */
-export function buildMaskedFileBinds(files, allowedDomains, registry, store) {
-    const binds = [];
-    const degradeToDenyPaths = [];
-    for (const f of files) {
-        if (f.mode !== 'mask')
-            continue;
-        // Literal: this path is stat'd, read and (on Linux) bound over, so it
-        // is the name of one file however it is spelled — a `[` in it is part
-        // of that name, not a character class.
-        const realPath = normalizePathForSandbox(f.path, { literal: true });
-        let content;
-        try {
-            const stat = fs.statSync(realPath);
-            if (stat.isDirectory()) {
-                logForDebugging(`[credential-mask] Skipping masked file entry that resolves to ` +
-                    `a directory: ${f.path} — use mode "deny" for directories.`, { level: 'warn' });
-                continue;
-            }
-            // Read as bytes first: a utf8 read silently maps invalid sequences
-            // to U+FFFD, so the sentinel would round-trip to corrupted bytes at
-            // the proxy. Masking (whole-file or extract) is for text credential
-            // files; reject binary.
-            const raw = fs.readFileSync(realPath);
-            content = raw.toString('utf8');
-            if (Buffer.byteLength(content, 'utf8') !== raw.length) {
-                logForDebugging(`[credential-mask] Skipping masked file with non-UTF-8 content ` +
-                    `(binary credential files are not supported in mask mode): ` +
-                    `${f.path}`, { level: 'warn' });
-                continue;
-            }
-        }
-        catch (err) {
-            logForDebugging(`[credential-mask] Skipping masked file (unreadable on host): ` +
-                `${f.path} — ${err.message}`);
-            continue;
-        }
-        const injectHosts = f.injectHosts ?? allowedDomains;
-        const key = FILE_KEY_PREFIX + realPath;
-        let fakeContent;
-        if (f.extract === undefined && f.decode === undefined) {
-            // Whole-file: one sentinel for the entire content.
-            fakeContent = registry.register(key, content, injectHosts);
-        }
-        else {
-            // An explicit extract pattern wins; decode without one falls back to
-            // the built-in JWT pattern so authors don't hand-write it.
-            const pattern = f.extract ?? JWT_DEFAULT_EXTRACT_PATTERN;
-            let maskedCount = 0;
-            const extracted = extractAndSubstitute(content, pattern, (cap, i) => {
-                // Decode-verification: a regex match that is not actually a JWT
-                // (the default pattern over-matches by design) is left untouched —
-                // returning the capture replaces the span with itself.
-                if (f.decode === 'jwt' && !verifyJwt(cap))
-                    return cap;
-                const name = `${key}#${i}`;
-                if (f.decode === 'jwt' && f.maskClaims?.length) {
-                    // Claim-level masking: sentinels go INSIDE the payload; the
-                    // rebuilt fake token is itself registered as a sentinel for
-                    // the whole real token, so both the bearer path (token sent
-                    // verbatim) and the extracted-claim path substitute on egress.
-                    const masked = maskJwtClaims(cap, f.maskClaims, (claim, real) => registry.register(`${key}#jwt${i}.${claim}`, real, injectHosts));
-                    if (masked === null) {
-                        // A verified JWT none of whose named claims are present as
-                        // strings: nothing to mask in THIS token — leave it as-is;
-                        // if no token matches any claim, onExtractNoMatch applies.
-                        logForDebugging(`[credential-mask] ${f.path}: verified JWT candidate has ` +
-                            `none of maskClaims ${JSON.stringify(f.maskClaims)} as ` +
-                            `string claims — left unmasked.`);
-                        return cap;
-                    }
-                    const skipped = f.maskClaims.filter(c => !masked.claimSentinels.has(c));
-                    if (skipped.length > 0) {
-                        logForDebugging(`[credential-mask] ${f.path}: maskClaims ` +
-                            `${JSON.stringify(skipped)} absent or non-string in a ` +
-                            `verified JWT — skipped.`);
-                    }
-                    maskedCount++;
-                    return registry.registerWithSentinel(name, masked.fakeToken, cap, injectHosts);
-                }
-                maskedCount++;
-                // For decode the fake must keep the token's shape: a JWT-shaped
-                // sentinel keeps client-side parsers (segment count, payload
-                // decode, exp checks) working inside the sandbox.
-                return f.decode === 'jwt'
-                    ? registry.registerWithSentinel(name, mintFakeJwt(randomUUID()), cap, injectHosts)
-                    : registry.register(name, cap, injectHosts);
-            }, { maskDuplicates: f.maskDuplicates ?? false });
-            if (extracted === null || maskedCount === 0) {
-                // Nothing was masked — either the pattern matched nothing or, with
-                // decode, no candidate survived verification. Both are the same
-                // "masking cannot apply" condition, so both route through the
-                // entry's onExtractNoMatch policy.
-                const cause = f.decode === 'jwt'
-                    ? f.maskClaims?.length
-                        ? `decode "jwt" with pattern "${pattern}" that matched no ` +
-                            `verified JWT with maskable claims (maskClaims: ` +
-                            `${JSON.stringify(f.maskClaims)})`
-                        : `decode "jwt" with pattern "${pattern}" that matched no ` +
-                            `verified JWT`
-                    : `extract pattern "${pattern}" that matched nothing`;
-                const onNoMatch = f.onExtractNoMatch ?? 'warn';
-                if (onNoMatch === 'error') {
-                    throw new Error(`credentials.files entry "${f.path}": ${cause} ` +
-                        `(onExtractNoMatch: "error"). Fix the config, change to ` +
-                        `"warn"/"deny", or remove the entry.`);
-                }
-                if (onNoMatch === 'deny') {
-                    // Fail-closed: the operator declared this file as containing a
-                    // credential. Masking can't apply — degrade to deny so the
-                    // sandboxed process cannot read the credential at all.
-                    logForDebugging(`[credential-mask] ${f.path} has ${cause} — degrading to ` +
-                        `mode "deny".`, { level: 'warn' });
-                    degradeToDenyPaths.push(realPath);
-                    continue;
-                }
-                // 'warn' (default): fail-open. A non-matching config is an error
-                // to surface, not a reason to block file access. Skip the entry
-                // (no bind, no deny) — the file stays readable via the root mount
-                // — and warn loudly on stderr so the operator fixes the config.
-                const msg = `[sandbox-runtime] WARNING: credentials.files entry ` +
-                    `"${f.path}" has ${cause} in the file. The file is left ` +
-                    `UNPROTECTED (readable as-is inside the sandbox). Fix the ` +
-                    `config, set onExtractNoMatch to "deny" or "error", or remove ` +
-                    `the entry.`;
-                console.warn(msg);
-                logForDebugging(msg, { level: 'warn' });
-                continue;
-            }
-            fakeContent = extracted.fakeContent;
-        }
-        const fakePath = store.write(key, fakeContent);
-        binds.push({ realPath, fakePath });
-    }
-    return { binds, degradeToDenyPaths };
-}
-export const MASKED_FILE_STORE_PREFIX = 'srt-credmask-';
-//# sourceMappingURL=credential-mask-files.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-files.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-mask-files.js","sourceRoot":"","sources":["../../src/sandbox/credential-mask-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EACL,2BAA2B,EAC3B,aAAa,EACb,WAAW,EACX,SAAS,GACV,MAAM,wBAAwB,CAAA;AAI/B;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAA;AAU/B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAA5B;QAEmB,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IA+CpD,CAAC;IA7CC;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,QAAgB;QACjC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,mCAAmC,GAAG,EAAE,EAAE;oBACxD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;CACF;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsC,EACtC,cAAiC,EACjC,QAA0B,EAC1B,KAAsB;IAEtB,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,sEAAsE;QACtE,sEAAsE;QACtE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAEnE,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,eAAe,CACb,gEAAgE;oBAC9D,gBAAgB,CAAC,CAAC,IAAI,qCAAqC,EAC7D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,wBAAwB;YACxB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtD,eAAe,CACb,gEAAgE;oBAC9D,4DAA4D;oBAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EACb,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,SAAQ;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CACb,+DAA+D;gBAC7D,GAAG,CAAC,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC1C,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAA;QACnD,MAAM,GAAG,GAAG,eAAe,GAAG,QAAQ,CAAA;QAEtC,IAAI,WAAmB,CAAA;QACvB,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtD,mDAAmD;YACnD,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,2BAA2B,CAAA;YACxD,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,MAAM,SAAS,GAAG,oBAAoB,CACpC,OAAO,EACP,OAAO,EACP,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACT,gEAAgE;gBAChE,mEAAmE;gBACnE,uDAAuD;gBACvD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,GAAG,CAAA;gBACrD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAA;gBAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;oBAC/C,4DAA4D;oBAC5D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC9D,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAChE,CAAA;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,2DAA2D;wBAC3D,2DAA2D;wBAC3D,2DAA2D;wBAC3D,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,+BAA+B;4BACxD,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;4BACxD,gCAAgC,CACnC,CAAA;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC;oBACD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CAAA;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,eAAe;4BACxC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6BAA6B;4BACvD,yBAAyB,CAC5B,CAAA;oBACH,CAAC;oBACD,WAAW,EAAE,CAAA;oBACb,OAAO,QAAQ,CAAC,oBAAoB,CAClC,IAAI,EACJ,MAAM,CAAC,SAAS,EAChB,GAAG,EACH,WAAW,CACZ,CAAA;gBACH,CAAC;gBACD,WAAW,EAAE,CAAA;gBACb,gEAAgE;gBAChE,6DAA6D;gBAC7D,kDAAkD;gBAClD,OAAO,CAAC,CAAC,MAAM,KAAK,KAAK;oBACvB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAC3B,IAAI,EACJ,WAAW,CAAC,UAAU,EAAE,CAAC,EACzB,GAAG,EACH,WAAW,CACZ;oBACH,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;YAC/C,CAAC,EACD,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK,EAAE,CAC9C,CAAA;YACD,IAAI,SAAS,KAAK,IAAI,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,mCAAmC;gBACnC,MAAM,KAAK,GACT,CAAC,CAAC,MAAM,KAAK,KAAK;oBAChB,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM;wBACpB,CAAC,CAAC,8BAA8B,OAAO,oBAAoB;4BACzD,iDAAiD;4BACjD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG;wBACpC,CAAC,CAAC,8BAA8B,OAAO,oBAAoB;4BACzD,cAAc;oBAClB,CAAC,CAAC,oBAAoB,OAAO,wBAAwB,CAAA;gBACzD,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAA;gBAC9C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,IAAI,MAAM,KAAK,GAAG;wBAC9C,yDAAyD;wBACzD,qCAAqC,CACxC,CAAA;gBACH,CAAC;gBACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,+DAA+D;oBAC/D,2DAA2D;oBAC3D,uDAAuD;oBACvD,eAAe,CACb,qBAAqB,CAAC,CAAC,IAAI,QAAQ,KAAK,kBAAkB;wBACxD,cAAc,EAChB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;oBACD,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBACjC,SAAQ;gBACV,CAAC;gBACD,iEAAiE;gBACjE,gEAAgE;gBAChE,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,GAAG,GACP,qDAAqD;oBACrD,IAAI,CAAC,CAAC,IAAI,SAAS,KAAK,iCAAiC;oBACzD,2DAA2D;oBAC3D,+DAA+D;oBAC/D,YAAY,CAAA;gBACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBACvC,SAAQ;YACV,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,WAAW,CAAA;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAA"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.d.ts

@@ -1,108 +0,0 @@
-/**
- * Per-session sentinel registry for credential masking.
- *
- * A masked credential's real value is replaced inside the sandbox with a
- * sentinel of the form `fake_value_<uuid4>`. The sandboxed process sees only
- * the sentinel; the host-side proxy substitutes sentinel→real on egress to
- * allowlisted destinations. The map lives only in process memory — it is
- * never written to disk and never logged.
- */
-import type { IncomingHttpHeaders } from 'node:http';
-import type { SentinelBufferPair } from './body-substitution.js';
-export declare const SENTINEL_PREFIX = "fake_value_";
-/** Predicate matching a destination host against one injectHosts pattern. */
-export type HostMatcher = (host: string, pattern: string) => boolean;
-/**
- * Sentinel↔real-value map for one sandbox session, keyed by credential name.
- *
- * Each credential carries its own `injectHosts` list, and substitution is
- * gated per sentinel: a sentinel is swapped to its real value only when the
- * destination matches THAT credential's hosts. This prevents laundering
- * credential A through credential B's allowlisted host by sending A's
- * sentinel there — the proxy leaves A's sentinel intact on B's host.
- *
- * Keying on name (not value) means two env vars holding the same secret get
- * distinct sentinels, so each can have an independent host list.
- */
-export declare class SentinelRegistry {
-    private readonly byName;
-    private readonly bySentinel;
-    private allSentinelsPrefixed;
-    /**
-     * Return the sentinel for the credential named `name`, minting a fresh one
-     * on first use. The sentinel is `fake_value_<uuid4>`: long enough that an
-     * accidental collision with legitimate header content is negligible, and
-     * free of shell/URL metacharacters so it survives `--setenv` and
-     * `env NAME=value` unquoted.
-     *
-     * Idempotent on `name`: a repeat call returns the same sentinel and updates
-     * `realValue`/`injectHosts` in place so `updateConfig()` can change either
-     * without invalidating sentinels the sandboxed process has already read.
-     * (A re-register whose new value has a different byte length leaves the
-     * sentinel un-length-matched; body substitution then re-frames as chunked
-     * rather than trusting a stale Content-Length.)
-     */
-    register(name: string, realValue: string, injectHosts: readonly string[]): string;
-    /**
-     * Like {@link register}, but with a caller-minted sentinel instead of the
-     * default `fake_value_<uuid4>` — used when the fake must keep the real
-     * value's shape (e.g. a structurally valid JWT for `decode: "jwt"`), so
-     * client-side parsers inside the sandbox don't choke on it.
-     *
-     * Same idempotency contract as {@link register}: if `name` is already
-     * registered, the EXISTING sentinel is returned (and `sentinel` discarded)
-     * so a re-register never invalidates a fake the sandboxed process has
-     * already read. The caller must mint sentinels with enough entropy that
-     * collisions with real content are negligible (embed a uuid4). No
-     * registered sentinel may be a substring of any other registered sentinel:
-     * the body-substitution scan matches earliest-position-then-registration-
-     * order, not longest-match, so nested sentinels would make replacement
-     * chunk-boundary-dependent (still fail-safe — worst case a wrong fake
-     * reaches upstream, never a secret).
-     *
-     * Caller-minted sentinels are used verbatim — never length-padded: a
-     * shaped fake (e.g. a JWT) must keep its structure. They are therefore
-     * generally not length-matched, and body substitution at hosts where they
-     * inject falls back to chunked framing.
-     */
-    registerWithSentinel(name: string, sentinel: string, realValue: string, injectHosts: readonly string[]): string;
-    /** Real value for `sentinel`, or undefined if not registered. */
-    lookupReal(sentinel: string): string | undefined;
-    /**
-     * Names of the registered credentials whose `injectHosts` cover
-     * `destHost`. Diagnostic helper: the proxy uses it to warn when a host is
-     * exempted from TLS termination (so substitution can never run there) but
-     * a masked credential is configured for injection at it.
-     */
-    namesInjectableAt(destHost: string, matches: HostMatcher): string[];
-    /**
-     * Sentinel→real byte pairs for every credential whose `injectHosts`
-     * cover `destHost` — the substitution set the body transform scans for.
-     * Same per-credential gating as {@link substituteInHeaders}. Buffers are
-     * built per call so a re-registered credential's updated real value is
-     * always current.
-     */
-    sentinelsForHost(destHost: string, matches: HostMatcher): SentinelBufferPair[];
-    /** Iterate registered `[sentinel, realValue]` pairs. */
-    entries(): IterableIterator<[string, string]>;
-    /** Number of registered sentinels. */
-    get size(): number;
-    /** Drop every mapping. Called on session teardown. */
-    clear(): void;
-    /**
-     * Replace registered sentinels found in `headers` with their real values,
-     * in place. Each sentinel substitutes only when `destHost` matches one of
-     * THAT credential's `injectHosts` patterns (via `matches`); a sentinel
-     * whose host list does not cover `destHost` is left as the useless fake.
-     *
-     * Scans all header values rather than a fixed set — a sentinel showing up
-     * anywhere is the substitution trigger, regardless of header name
-     * (Authorization, X-Api-Key, Private-Token, ...).
-     *
-     * The caller remains responsible for transport gating (TLS-terminated path
-     * unless `allowPlaintextInject`).
-     */
-    substituteInHeaders(headers: IncomingHttpHeaders, destHost: string, matches: HostMatcher): void;
-    private substituteInString;
-}
-//# sourceMappingURL=credential-sentinel.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-sentinel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-sentinel.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,eAAO,MAAM,eAAe,gBAAgB,CAAA;AA0B5C,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;AASpE;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAI9D,OAAO,CAAC,oBAAoB,CAAO;IAEnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAST;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM;IAgBT,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE;IAQnE;;;;;;OAMG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE;IAYvB,wDAAwD;IACvD,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI9C,sCAAsC;IACtC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,sDAAsD;IACtD,KAAK,IAAI,IAAI;IAMb;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,IAAI;IAcP,OAAO,CAAC,kBAAkB;CAiB3B"}