@addai/node 0.30.13 → 0.30.14

package/dist/entitybox-model-artifact.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITYBOX_MODEL_LOADER = exports.ENTITYBOX_MODEL_FILES = void 0;
+exports.readEntityboxModelArtifact = readEntityboxModelArtifact;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+/** Explicit compiled adapter dependencies. Never enumerate host configuration,
+ * login state, provider directories or the rest of the runtime distribution. */
+exports.ENTITYBOX_MODEL_FILES = Object.freeze([
+    'paths.js', 'claude-binary.js', 'win.js', 'claude-system-prompt.js',
+    'prompt-transport.js', 'claude-print.js', 'entitybox/model-mcp-proxy.js', 'entitybox/model-entry.js',
+]);
+function readEntityboxModelArtifact(compiledRoot = __dirname) {
+    try {
+        const files = {};
+        for (const name of exports.ENTITYBOX_MODEL_FILES) {
+            const file = path.join(compiledRoot, ...name.split('/'));
+            const stat = fs.lstatSync(file);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 128 * 1024)
+                throw Error();
+            files[name] = fs.readFileSync(file, 'utf8');
+        }
+        const bytes = JSON.stringify(files);
+        if (Buffer.byteLength(bytes) > 192 * 1024)
+            throw Error();
+        return Object.freeze({ files: Object.freeze(files), sha256: (0, crypto_1.createHash)('sha256').update(bytes).digest('hex') });
+    }
+    catch {
+        throw new entitybox_execution_lease_1.EntityboxExecutionError('The isolated native model adapter is unavailable');
+    }
+}
+// This entrypoint executes only inside the task namespace as UID 10001. All
+// filenames are fixed, and only the public adapter/task crosses stdin.
+exports.ENTITYBOX_MODEL_LOADER = `
+const fs=require('node:fs'),path=require('node:path');
+const names=${JSON.stringify(exports.ENTITYBOX_MODEL_FILES)};
+let input='';const fail=()=>{console.log(JSON.stringify({type:'error',code:'entitybox_model_adapter_failed',message:'The isolated model adapter could not start.'}));process.exit(70);};
+if(process.getuid?.()!==10001||process.env.HOME!=='/home/entitybox'||!fs.existsSync('/.dockerenv'))fail();
+process.stdin.setEncoding('utf8');process.stdin.on('error',fail);
+process.stdin.on('data',part=>{input+=part;if(Buffer.byteLength(input)>240*1024)fail();});
+process.stdin.on('end',async()=>{try{
+ const value=JSON.parse(input),files=value.files;
+ if(!files||Array.isArray(files)||Object.keys(files).sort().join(',')!==[...names].sort().join(','))throw Error();
+ fs.mkdirSync('/work/entitybox-runner/entitybox',{recursive:true});
+ for(const name of names){if(typeof files[name]!=='string'||Buffer.byteLength(files[name])>128*1024)throw Error();fs.writeFileSync(path.join('/work/entitybox-runner',name),files[name],{mode:0o600,flag:'wx'});}
+ const code=await require('/work/entitybox-runner/entitybox/model-entry.js').runEntityboxModel(value.task);process.exit(code===0?0:70);
+}catch{fail();}});
+`;

package/dist/entitybox-native-services.d.ts

@@ -0,0 +1,33 @@
+import { type EntityboxApplicationBinding, type EntityboxApplicationDocker } from './entitybox-application-boundary';
+import { type EntityboxDisplayBinding } from './entitybox-display-binding';
+import type { EntityboxQueueServices } from './entitybox-queue-request';
+import type { resolveEntityboxDesktopConnection } from './install';
+export interface EntityboxDedicatedCapacity {
+    application: EntityboxApplicationBinding;
+    display: EntityboxDisplayBinding;
+}
+export interface EntityboxNativeServicesConfiguration {
+    /** Explicit trusted host configuration. SQL feature flags still authorize
+     * every claim/registration. Nothing is discovered from an ordinary desktop. */
+    enabled?: boolean;
+    runtimeId: string;
+    imageId: string;
+    dockerContext?: string;
+    recoveryDirectory: string;
+    capacities: readonly EntityboxDedicatedCapacity[];
+    desktopTools: readonly string[];
+    fileGatewayUrl?: string;
+}
+export interface EntityboxNativeServicesTransport {
+    /** Test transports only; never renderer, request, tool or model input. */
+    docker?: EntityboxApplicationDocker;
+    resolveConnection?: typeof resolveEntityboxDesktopConnection;
+    providerFetch?: typeof fetch;
+    vaultFetch?: typeof fetch;
+    fileFetch?: typeof fetch;
+}
+/** Compose existing native identity/Vault/CLI/MCP and independent browser
+ * ownership. The normal queue is unchanged until an explicit caller registers
+ * these services. Preparation is read-only; every resource owner is retained
+ * before its asynchronous startup can fail. */
+export declare function createEntityboxNativeServices(config: EntityboxNativeServicesConfiguration, transport?: EntityboxNativeServicesTransport): EntityboxQueueServices | undefined;

package/dist/entitybox-native-services.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEntityboxNativeServices = createEntityboxNativeServices;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_application_guard_1 = require("./entitybox-application-guard");
+const entitybox_application_boundary_1 = require("./entitybox-application-boundary");
+const entitybox_display_binding_1 = require("./entitybox-display-binding");
+const entitybox_recovery_store_1 = require("./entitybox-recovery-store");
+const entitybox_vault_provider_1 = require("./entitybox-vault-provider");
+const entitybox_operation_1 = require("./entitybox-operation");
+const entitybox_file_inputs_1 = require("./entitybox-file-inputs");
+const uuid = /^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/, fail = () => new entitybox_execution_lease_1.EntityboxExecutionError('The dedicated computer task configuration could not be verified'), exec = (0, util_1.promisify)(child_process_1.execFile);
+/** Compose existing native identity/Vault/CLI/MCP and independent browser
+ * ownership. The normal queue is unchanged until an explicit caller registers
+ * these services. Preparation is read-only; every resource owner is retained
+ * before its asynchronous startup can fail. */
+function createEntityboxNativeServices(config, transport = {}) {
+    if (config.enabled !== true)
+        return undefined;
+    const context = config.dockerContext ?? 'desktop-linux';
+    const fileGateway = config.fileGatewayUrl === undefined ? undefined : (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(config.fileGatewayUrl);
+    if (!uuid.test(config.runtimeId) || !/^sha256:[a-f0-9]{64}$/.test(config.imageId) || !/^[-a-zA-Z0-9_.]{1,80}$/.test(context)
+        || !Array.isArray(config.capacities) || !config.capacities.length || config.capacities.length > 50
+        || !Array.isArray(config.desktopTools) || !config.desktopTools.length || config.desktopTools.length > 64
+        || !config.desktopTools.every(s => /^[A-Za-z0-9_-]{1,128}$/.test(s)) || new Set(config.desktopTools).size !== config.desktopTools.length)
+        throw fail();
+    const runtimeId = config.runtimeId, imageId = config.imageId, tools = Object.freeze([...config.desktopTools]), capacities = new Map(), ids = new Set();
+    for (const c of config.capacities) {
+        const a = c?.application, d = c?.display;
+        if (!a || !d || !uuid.test(a.desktopId) || !uuid.test(a.capacityId) || a.desktopId !== d.desktopId || a.runtimeId !== runtimeId || d.runtimeId !== runtimeId || a.capacityId !== d.capacityId || a.containerId === d.containerId || capacities.has(a.desktopId) || ids.has(a.capacityId) || ids.has(a.containerId) || ids.has(d.containerId))
+            throw fail();
+        for (const b of [a, d])
+            if (!/^[a-f0-9]{64}$/.test(b.containerId) || !/^sha256:[a-f0-9]{64}$/.test(b.imageId) || !Number.isFinite(Date.parse(b.startedAt)))
+                throw fail();
+        ids.add(a.capacityId);
+        ids.add(a.containerId);
+        ids.add(d.containerId);
+        capacities.set(a.desktopId, { application: Object.freeze({ ...a }), display: Object.freeze({ ...d }) });
+    }
+    const store = new entitybox_recovery_store_1.EntityboxRecoveryStore(config.recoveryDirectory), docker = transport.docker ?? (async (args) => (await exec('docker', ['--context', context, ...args], { windowsHide: true, timeout: 5000, maxBuffer: 1024 * 1024 })).stdout.trim());
+    return { prepare: async (request, lease, signal) => {
+            try {
+                lease.assertActive();
+                if (signal.aborted || request.runtime_id !== runtimeId || lease.identity.scope.runtimeId !== runtimeId || request.id !== lease.identity.requestId || request.desktop_id !== lease.identity.scope.desktopId)
+                    throw fail();
+                const capacity = capacities.get(request.desktop_id);
+                if (!capacity)
+                    throw fail();
+                // Never silently discard a selected installation or reuse a host session.
+                // Those broader capabilities require their own contained installation path.
+                if (request.mcp_mode !== 'override' || !Array.isArray(request.mcps_override) || request.mcps_override.length !== 1 || !uuid.test(request.mcps_override[0])
+                    || (request.skills_override ?? []).length || (request.packages_override ?? []).length || Object.keys(request.skill_var_values ?? {}).length
+                    || request.resume_session_id || request.working_directory || request.project_id || request.ephemeral_git_remote || (request.ephemeral_git_remotes ?? []).length
+                    || Object.keys(request.mcp_env_overrides ?? {}).some(k => k !== 'entity-desktop-mcp')
+                    || typeof request.prompt !== 'string' || !request.prompt.trim() || request.prompt.length > 12000
+                    || (request.system_prompt != null && (typeof request.system_prompt !== 'string' || request.system_prompt.length > 64000))
+                    || (request.permission_mode != null && !['default', 'plan', 'dontAsk', 'acceptEdits', 'auto', 'bypassPermissions'].includes(request.permission_mode))
+                    || (request.effort != null && !['low', 'medium', 'high', 'xhigh', 'max'].includes(request.effort)))
+                    throw fail();
+                let selected = [...tools];
+                if (request.allowed_tools != null) {
+                    if (!Array.isArray(request.allowed_tools) || !request.allowed_tools.length || request.allowed_tools.some(t => !tools.some(n => t === 'mcp__entity-desktop-mcp__' + n)))
+                        throw fail();
+                    selected = tools.filter(t => request.allowed_tools.includes('mcp__entity-desktop-mcp__' + t));
+                }
+                await (0, entitybox_operation_1.entityboxOperation)([lease.signal, signal], 5000, async () => {
+                    await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(capacity.display, lease.identity.scope, docker);
+                    if (await (0, entitybox_application_boundary_1.inspectEntityboxApplication)(capacity.application, lease.identity.scope, docker) !== 'paused')
+                        throw fail();
+                });
+                const resolve = transport.resolveConnection ?? (await Promise.resolve().then(() => __importStar(require('./install')))).resolveEntityboxDesktopConnection;
+                const connection = await resolve({ mcpIds: [...request.mcps_override], skillIds: [], packageIds: [] }, request.mcp_env_overrides ?? undefined, request.id, signal);
+                lease.assertActive();
+                if (signal.aborted)
+                    throw fail();
+                const provider = await (0, entitybox_vault_provider_1.entityboxNativeProvider)(lease, connection.env.ENTITY_API_KEY, signal, transport.vaultFetch);
+                if (provider.models.length !== 1 || request.model !== provider.models[0])
+                    throw fail();
+                lease.assertActive();
+                if (signal.aborted)
+                    throw fail();
+                if (request.entitybox_file_request === true && !fileGateway)
+                    throw fail();
+                const fileInputs = request.entitybox_file_request === true && fileGateway ? lease.fileInputs(fileGateway, transport.fileFetch) : undefined;
+                let guard, preparing, resource, registered;
+                return {
+                    options: { imageId, dockerContext: context, display: capacity.display, connection, desktopTools: selected, provider: { ...provider, ...(fileInputs ? { fileInputs } : {}), ...(transport.providerFetch ? { fetch: transport.providerFetch } : {}) },
+                        task: { prompt: fileInputs ? fileInputs.prompt(request.prompt) : request.prompt, model: provider.models[0], systemPrompt: request.system_prompt ?? undefined, permissionMode: request.permission_mode ?? undefined, effort: request.effort ?? undefined },
+                        onContainerCreated: r => {
+                            if (preparing)
+                                throw fail();
+                            resource = Object.freeze({ ...r });
+                            preparing = Promise.resolve().then(async () => {
+                                lease.assertActive();
+                                await lease.registerResource('display', { ...capacity.display });
+                                await entitybox_application_guard_1.EntityboxApplicationGuard.attach(lease, capacity.application, { dockerContext: context, requireInventory: true, recoveryStore: store, onOwner: value => { guard = value; } });
+                                lease.assertActive();
+                                await lease.registerResource('execution', { ...resource });
+                                await lease.sealInventory(true);
+                            });
+                            return preparing;
+                        },
+                    },
+                    register: async (container) => {
+                        if (!preparing || !resource || registered || container.id !== resource.containerId)
+                            throw fail();
+                        registered = container;
+                        await preparing;
+                        lease.assertInventorySealed();
+                        if (!guard)
+                            throw fail();
+                        await guard.resume();
+                    },
+                    verifyAllStopped: async () => {
+                        // Late preparation must settle, even when the coordinator's observation
+                        // deadline already failed. An unresolved/failed guard cannot grant reuse.
+                        if (preparing)
+                            try {
+                                await preparing;
+                            }
+                            catch { }
+                        if (registered)
+                            await registered.stopAndVerify();
+                        if (guard)
+                            await guard.pauseAndVerify();
+                        else if (preparing)
+                            throw fail();
+                        if (await (0, entitybox_application_boundary_1.inspectEntityboxApplication)(capacity.application, lease.identity.scope, docker) === 'running')
+                            throw fail();
+                    },
+                };
+            }
+            catch {
+                throw fail();
+            }
+        } };
+}

package/dist/entitybox-operation.d.ts

@@ -0,0 +1,4 @@
+/** A bounded host operation. Cancellation covers response bodies and delayed
+ * credential callbacks, not just receipt of HTTP headers. Late settlement is
+ * observed by the race but cannot return a result to the caller. */
+export declare function entityboxOperation<T>(signals: readonly AbortSignal[], timeoutMs: number, operation: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/entitybox-operation.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entityboxOperation = entityboxOperation;
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+/** A bounded host operation. Cancellation covers response bodies and delayed
+ * credential callbacks, not just receipt of HTTP headers. Late settlement is
+ * observed by the race but cannot return a result to the caller. */
+async function entityboxOperation(signals, timeoutMs, operation) {
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 120000)
+        throw new entitybox_execution_lease_1.EntityboxExecutionError('Invalid operation deadline');
+    const controller = new AbortController(), inputs = [...new Set(signals)];
+    let reject;
+    const canceled = new Promise((_, r) => { reject = r; });
+    const abort = () => { controller.abort(); reject(new entitybox_execution_lease_1.EntityboxExecutionError('Computer operation ended')); };
+    for (const signal of inputs)
+        signal.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(abort, timeoutMs);
+    try {
+        if (inputs.some(s => s.aborted))
+            abort();
+        const work = Promise.resolve().then(() => { if (controller.signal.aborted)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Computer operation ended'); return operation(controller.signal); });
+        const result = await Promise.race([work, canceled]);
+        if (controller.signal.aborted)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Computer operation ended');
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+        for (const signal of inputs)
+            signal.removeEventListener('abort', abort);
+        controller.abort();
+    }
+}

package/dist/entitybox-provider-broker.d.ts

@@ -0,0 +1,41 @@
+import { type EntityboxExecutionLease } from './entitybox-execution-lease';
+import { EntityboxFileInputs } from './entitybox-file-inputs';
+export type EntityboxBrokerEvent = {
+    type: 'head';
+    status: number;
+    contentType: string;
+} | {
+    type: 'data';
+    data: string;
+} | {
+    type: 'end';
+};
+export type EntityboxBrokerEmit = (event: EntityboxBrokerEvent) => Promise<void>;
+interface Config {
+    /** Supplied by the trusted native request adapter, never by model input. */
+    models: readonly string[];
+    fileInputs?: EntityboxFileInputs;
+    apiKey: (signal: AbortSignal) => Promise<string>;
+    /** Transport injection for isolated fixtures; production defaults to fetch. */
+    fetch?: typeof fetch;
+}
+/** Streaming exact-secret scrubber retains partial prefixes across chunks.
+ * Provider error bodies and response headers are never passed through. */
+export declare class EntityboxSecretFilter {
+    private readonly secret;
+    private tail;
+    constructor(secret: string);
+    push(text: string, final?: boolean): string;
+}
+/** Provider access stays in the trusted native process. The container can
+ * submit only bounded Anthropic-format inference/token-count requests, not a
+ * URL, authentication header, upload, admin operation or arbitrary fetch. */
+export declare class EntityboxProviderBroker {
+    private readonly lease;
+    private readonly config;
+    private count;
+    constructor(lease: EntityboxExecutionLease, config: Config);
+    handle(raw: unknown, signal: AbortSignal, emit: EntityboxBrokerEmit): Promise<void>;
+    private send;
+}
+export {};

package/dist/entitybox-provider-broker.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxProviderBroker = exports.EntityboxSecretFilter = void 0;
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_operation_1 = require("./entitybox-operation");
+const entitybox_file_inputs_1 = require("./entitybox-file-inputs");
+/** Streaming exact-secret scrubber retains partial prefixes across chunks.
+ * Provider error bodies and response headers are never passed through. */
+class EntityboxSecretFilter {
+    secret;
+    tail = '';
+    constructor(secret) {
+        this.secret = secret;
+    }
+    push(text, final = false) {
+        const all = (this.tail + text).split(this.secret).join('[redacted]');
+        this.tail = '';
+        if (final)
+            return all;
+        let hold = 0;
+        for (let i = 1; i < Math.min(this.secret.length, all.length + 1); i++)
+            if (all.endsWith(this.secret.slice(0, i)))
+                hold = i;
+        if (hold) {
+            this.tail = all.slice(-hold);
+            return all.slice(0, -hold);
+        }
+        return all;
+    }
+}
+exports.EntityboxSecretFilter = EntityboxSecretFilter;
+/** Provider access stays in the trusted native process. The container can
+ * submit only bounded Anthropic-format inference/token-count requests, not a
+ * URL, authentication header, upload, admin operation or arbitrary fetch. */
+class EntityboxProviderBroker {
+    lease;
+    config;
+    count = 0;
+    constructor(lease, config) {
+        this.lease = lease;
+        this.config = config;
+        if (!config.models.length || !config.models.every(m => /^[a-zA-Z0-9_.:-]{1,120}$/.test(m)))
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Invalid provider model configuration');
+    }
+    async handle(raw, signal, emit) {
+        this.lease.assertActive();
+        const r = raw;
+        if (!r || r.kind !== 'provider' || r.method !== 'POST' || !['/v1/messages', '/v1/messages?beta=true', '/v1/messages/count_tokens', '/v1/messages/count_tokens?beta=true'].includes(r.path)
+            || typeof r.body !== 'string' || Buffer.byteLength(r.body) > 512 * 1024
+            || (r.beta !== undefined && (typeof r.beta !== 'string' || !/^[-a-zA-Z0-9,]{1,1024}$/.test(r.beta)))
+            || Object.keys(r).some(k => !['kind', 'method', 'path', 'body', 'beta'].includes(k)))
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Provider request is unavailable');
+        let body;
+        try {
+            body = JSON.parse(r.body);
+        }
+        catch {
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Invalid provider request');
+        }
+        if (!body || !this.config.models.includes(String(body.model)) || !Array.isArray(body.messages)
+            || (body.max_tokens !== undefined && (!Number.isInteger(body.max_tokens) || Number(body.max_tokens) < 1 || Number(body.max_tokens) > 32768)))
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Provider model or limits are unavailable');
+        if (++this.count > 128)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Provider request limit reached');
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        signal.addEventListener('abort', abort, { once: true });
+        this.lease.signal.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(abort, 120000);
+        let reader;
+        try {
+            if (signal.aborted || this.lease.signal.aborted)
+                throw new Error();
+            let attached = false, requestBody = r.body;
+            if (this.config.fileInputs) {
+                attached = await this.config.fileInputs.attach(body, controller.signal);
+                this.lease.assertActive();
+                if (controller.signal.aborted)
+                    throw new Error();
+                requestBody = JSON.stringify(body);
+                if (Buffer.byteLength(requestBody) > entitybox_file_inputs_1.ENTITYBOX_PROVIDER_BYTES)
+                    throw new entitybox_file_inputs_1.EntityboxFileInputError();
+            }
+            const key = await (0, entitybox_operation_1.entityboxOperation)([controller.signal], 10000, signal => this.config.apiKey(signal));
+            this.lease.assertActive();
+            if (signal.aborted || controller.signal.aborted || typeof key !== 'string' || !/^sk-ant-[A-Za-z0-9_-]{20,}$/.test(key))
+                throw new Error();
+            const headers = { 'content-type': 'application/json', 'anthropic-version': '2023-06-01', 'x-api-key': key };
+            if (r.beta)
+                headers['anthropic-beta'] = r.beta;
+            const response = await (this.config.fetch ?? fetch)('https://api.anthropic.com' + r.path, { method: 'POST', headers, body: requestBody, signal: controller.signal, redirect: 'error' });
+            this.lease.assertActive();
+            if (controller.signal.aborted)
+                throw new Error();
+            if (!response.ok) {
+                await response.body?.cancel();
+                await emit({ type: 'head', status: response.status === 429 ? 429 : attached && response.status === 400 ? 400 : 502, contentType: 'application/json' });
+                await emit({ type: 'data', data: Buffer.from(JSON.stringify({ type: 'error', error: { type: 'api_error', message: attached && response.status === 400 ? new entitybox_file_inputs_1.EntityboxFileInputError().message : 'The configured provider could not complete this request.' } })).toString('base64') });
+                await emit({ type: 'end' });
+                return;
+            }
+            const contentType = (response.headers.get('content-type') || '').split(';')[0];
+            if (!['application/json', 'text/event-stream'].includes(contentType) || !response.body)
+                throw new Error();
+            await emit({ type: 'head', status: 200, contentType });
+            reader = response.body.getReader();
+            const decoder = new TextDecoder(), filter = new EntityboxSecretFilter(key);
+            let total = 0;
+            while (true) {
+                const value = await reader.read();
+                this.lease.assertActive();
+                if (controller.signal.aborted)
+                    throw new Error();
+                if (value.done)
+                    break;
+                total += value.value.byteLength;
+                if (total > 16 * 1024 * 1024)
+                    throw new Error();
+                const safe = filter.push(decoder.decode(value.value, { stream: true }));
+                if (safe)
+                    await this.send(safe, emit);
+            }
+            const rest = filter.push(decoder.decode(), true);
+            if (rest)
+                await this.send(rest, emit);
+            await emit({ type: 'end' });
+        }
+        catch (error) {
+            controller.abort();
+            if (error instanceof entitybox_file_inputs_1.EntityboxFileInputError && !signal.aborted && !this.lease.signal.aborted) {
+                await emit({ type: 'head', status: 400, contentType: 'application/json' });
+                await emit({ type: 'data', data: Buffer.from(JSON.stringify({ type: 'error', error: { type: 'invalid_request_error', message: error.message } })).toString('base64') });
+                await emit({ type: 'end' });
+                return;
+            }
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Provider connection ended');
+        }
+        finally {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            this.lease.signal.removeEventListener('abort', abort);
+            await reader?.cancel().catch(() => { });
+            reader?.releaseLock();
+        }
+    }
+    async send(text, emit) { const bytes = Buffer.from(text); for (let offset = 0; offset < bytes.length; offset += 16384)
+        await emit({ type: 'data', data: bytes.subarray(offset, offset + 16384).toString('base64') }); }
+}
+exports.EntityboxProviderBroker = EntityboxProviderBroker;

package/dist/entitybox-queue-request.d.ts

@@ -0,0 +1,32 @@
+import { EntityboxExecutionLease } from './entitybox-execution-lease';
+import { EntityboxComputerTask, type EntityboxComputerTaskOptions } from './entitybox-computer-task';
+import type { EntityboxExecutionContainer } from './entitybox-execution-container';
+import type { RuntimeRequestRow } from './session-runner';
+interface Io {
+    rpc: <T>(name: string, args: Record<string, unknown>) => Promise<T>;
+    pairing: () => {
+        runtimeId: string;
+        daemonToken: string;
+    } | null;
+}
+export interface EntityboxQueueServices {
+    /** Runtime shutdown fences isolated work; ordinary native requests are unchanged. */
+    readonly signal?: AbortSignal;
+    /** Trusted runtime adapter only. Resolve selected credentials and existing
+     * dedicated capacity without starting processes or writing host projects.
+     * The lease already proves the native request mapping and its principal. */
+    prepare: (request: Readonly<RuntimeRequestRow>, lease: EntityboxExecutionLease, signal: AbortSignal) => Promise<{
+        options: Omit<EntityboxComputerTaskOptions, 'onEvent' | 'onContainer' | 'onTask'>;
+        register: (container: EntityboxExecutionContainer) => Promise<void>;
+        /** Must prove ALL owned resources, including persistent application work.
+         * A stopped model/MCP alone is insufficient. Uncertain cleanup retains
+         * the native reservation for explicit recovery. */
+        verifyAllStopped: () => Promise<void>;
+        onTask?: (task: EntityboxComputerTask) => void;
+    }>;
+}
+/** Called before native host auth, cwd/project preparation or installation.
+ * No adapter means disabled, never ordinary-host fallback. An MCP scope is
+ * only a route marker: the runtime-authenticated SQL claim is authorization. */
+export declare function runEntityboxQueueRequest(req: RuntimeRequestRow, io: Io, services?: EntityboxQueueServices): Promise<boolean>;
+export {};