@neeter/server - npm Package Compare versions

Comparing version 0.8.1 to 0.9.0

dist/hooks.d.ts

 import type { HookCallbackMatcher } from "@anthropic-ai/claude-agent-sdk";
+export interface SandboxHookOptions {
+    /**
+     * Allow Bash tool calls through the sandbox hook (default: `false`).
+     *
+     * Bash commands can reference arbitrary filesystem paths via subshells,
+     * variable expansion, redirects, and other shell features that can't be
+     * reliably inspected. When `false`, all Bash calls are blocked.
+     *
+     * If you need Bash access inside a sandbox, set this to `true` and use
+     * OS-level isolation instead: containers with `--network none` and a
+     * read-only filesystem, `@anthropic-ai/sandbox-runtime`, or VMs.
+     *
+     * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+     */
+    allowBash?: boolean;
+}
 /**
@@ -7,5 +23,13 @@ * Creates a PreToolUse hook that blocks file operations outside a sandbox directory.
  *
+ * Bash is blocked by default because shell commands can reference paths outside the
+ * sandbox in ways that can't be reliably detected (subshells, variable expansion,
+ * redirects, backticks). To sandbox Bash, use OS-level isolation — containers,
+ * `@anthropic-ai/sandbox-runtime`, or VMs — and set `options.allowBash` to `true`.
+ *
+ * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+ *
  * @param sandboxDir - Absolute path to the sandbox directory (must already be resolved)
  * @param resolvePath - Path resolver function (e.g. `path.resolve` from `node:path`)
+ * @param options - Configuration options
  */
-export declare function createSandboxHook(sandboxDir: string, resolvePath: (...segments: string[]) => string): HookCallbackMatcher[];
+export declare function createSandboxHook(sandboxDir: string, resolvePath: (...segments: string[]) => string, options?: SandboxHookOptions): HookCallbackMatcher[];

dist/hooks.js

@@ -6,7 +6,16 @@ /**
  *
+ * Bash is blocked by default because shell commands can reference paths outside the
+ * sandbox in ways that can't be reliably detected (subshells, variable expansion,
+ * redirects, backticks). To sandbox Bash, use OS-level isolation — containers,
+ * `@anthropic-ai/sandbox-runtime`, or VMs — and set `options.allowBash` to `true`.
+ *
+ * @see https://platform.claude.com/docs/en/agent-sdk/secure-deployment
+ *
  * @param sandboxDir - Absolute path to the sandbox directory (must already be resolved)
  * @param resolvePath - Path resolver function (e.g. `path.resolve` from `node:path`)
+ * @param options - Configuration options
  */
-export function createSandboxHook(sandboxDir, resolvePath) {
+export function createSandboxHook(sandboxDir, resolvePath, options) {
     const normalizedDir = resolvePath(sandboxDir);
+    const allowBash = options?.allowBash ?? false;
     return [
@@ -18,2 +27,11 @@ {
                         return {};
+                    const toolName = input.tool_name;
+                    if (toolName === "Bash" && !allowBash) {
+                        return {
+                            decision: "block",
+                            reason: "Bash is blocked in sandbox mode — shell commands can reference arbitrary paths. " +
+                                "Use allowBash with OS-level isolation (containers, sandbox-runtime) for Bash access. " +
+                                "See https://platform.claude.com/docs/en/agent-sdk/secure-deployment",
+                        };
+                    }
                     const toolInput = input.tool_input;
@@ -20,0 +38,0 @@ const filePath = (toolInput.file_path ?? toolInput.path);

package.json

 {
   "name": "@neeter/server",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Hono server toolkit for building chat UIs on top of the Claude Agent SDK",
@@ -24,3 +24,3 @@ "license": "MIT",
   "dependencies": {
-    "@neeter/types": "0.8.1"
+    "@neeter/types": "0.9.0"
   },
@@ -27,0 +27,0 @@ "peerDependencies": {

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

33132

7.42%

Lines of code

695

6.43%

Worsened metrics

Number of low supply chain risk alerts

1

Infinity%

Dependency changes

• + Added

  @neeter/types@0.9.0
  (transitive)

• - Removed

  @neeter/types@0.8.1
  (transitive)

• Updated

  @neeter/types@0.9.0