@agen-ai/sandbox-docker 0.0.0-stage → 0.4.4

package/dist/policy/container.js

@@ -0,0 +1,81 @@
+import { SandboxUnsupportedError } from "@agen-ai/sandbox";
+import { dockerProfile } from "./profiles.js";
+import { resourceLabels } from "../recovery/identity.js";
+import { containerMounts, verifyContainerMounts } from "../datasets/mounts.js";
+const KEEPER = ["-c", "while :; do sleep 3600; done"];
+const DOCKER_ENVIRONMENT = Object.freeze(["HOME=/home/sandbox", "TMPDIR=/tmp", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]);
+function tmpfs(policy, config) {
+  const options = (size) => `rw,nosuid,nodev,noexec,size=${size},mode=0700,uid=${config.user.uid},gid=${config.user.gid}`;
+  return { "/home/sandbox": options(policy.temporaryStorage.homeBytes), "/tmp": options(policy.temporaryStorage.tempBytes) };
+}
+function containerBody(config, record, policy, role, storageId, networkId) {
+  return {
+    Image: config.imageDigest,
+    User: `${config.user.uid}:${config.user.gid}`,
+    WorkingDir: "/workspace/work",
+    Entrypoint: ["/bin/sh"],
+    Cmd: KEEPER,
+    Env: DOCKER_ENVIRONMENT,
+    Tty: false,
+    OpenStdin: false,
+    AttachStdin: false,
+    AttachStdout: false,
+    AttachStderr: false,
+    NetworkDisabled: role === "export",
+    Healthcheck: { Test: ["NONE"] },
+    Labels: resourceLabels(record, role),
+    HostConfig: {
+      ReadonlyRootfs: true,
+      CapDrop: ["ALL"],
+      CapAdd: [],
+      SecurityOpt: ["no-new-privileges:true"],
+      Privileged: false,
+      PublishAllPorts: false,
+      PortBindings: {},
+      Devices: [],
+      DeviceRequests: [],
+      Binds: [],
+      PidMode: "",
+      IpcMode: "private",
+      CgroupnsMode: "private",
+      UsernsMode: "",
+      NetworkMode: role === "export" || policy.network.kind === "isolated" ? "none" : networkId,
+      NanoCpus: policy.resources.cpus * 1e9,
+      Memory: policy.resources.memoryBytes,
+      MemorySwap: policy.resources.memoryBytes,
+      PidsLimit: policy.resources.pids,
+      RestartPolicy: { Name: "no", MaximumRetryCount: 0 },
+      AutoRemove: false,
+      Tmpfs: tmpfs(policy, config),
+      Mounts: containerMounts(config.datasets, role, storageId)
+    }
+  };
+}
+function sameStrings(actual, expected) {
+  return Array.isArray(actual) && actual.length === expected.length && actual.every((value, index) => value === expected[index]);
+}
+function empty(actual) {
+  return actual === null || actual === void 0 || (Array.isArray(actual) ? actual.length === 0 : typeof actual === "object" && Object.keys(actual).length === 0);
+}
+function verifyContainer(container, config, policy, role, storageId, networkId, started) {
+  const host = container.HostConfig;
+  const expectedNetwork = role === "export" || policy.network.kind === "isolated" ? "none" : networkId;
+  verifyContainerMounts(container, config.datasets, role, storageId);
+  const expectedTmpfs = tmpfs(policy, config);
+  const actualTmpfs = host.Tmpfs;
+  const configuration = container.Config;
+  const healthcheck = configuration.Healthcheck;
+  const restart = host.RestartPolicy;
+  const networkNames = Object.keys(container.NetworkSettings.Networks);
+  const attachment = Object.values(container.NetworkSettings.Networks)[0];
+  if (configuration.User !== `${config.user.uid}:${config.user.gid}` || configuration.WorkingDir !== "/workspace/work" || !sameStrings(configuration.Entrypoint, ["/bin/sh"]) || !sameStrings(configuration.Cmd, KEEPER) || !sameStrings(configuration.Env, DOCKER_ENVIRONMENT) || configuration.Tty || configuration.OpenStdin || !empty(configuration.Volumes) || typeof healthcheck !== "object" || healthcheck === null || !sameStrings(Reflect.get(healthcheck, "Test"), ["NONE"]) || host.ReadonlyRootfs !== true || host.Privileged !== false || !sameStrings(host.CapDrop, ["ALL"]) || !empty(host.CapAdd) || !sameStrings(host.SecurityOpt, ["no-new-privileges:true"]) || host.PublishAllPorts !== false || !empty(host.PortBindings) || !empty(host.Devices) || !empty(host.DeviceRequests) || !empty(host.Binds) || host.PidMode !== "" || host.IpcMode !== "private" || host.CgroupnsMode !== "private" || host.UsernsMode !== "" || host.NetworkMode !== expectedNetwork || host.NanoCpus !== policy.resources.cpus * 1e9 || host.Memory !== policy.resources.memoryBytes || host.MemorySwap !== policy.resources.memoryBytes || host.PidsLimit !== policy.resources.pids || host.OomKillDisable === true || typeof restart !== "object" || restart === null || Reflect.get(restart, "Name") !== "no" || Reflect.get(restart, "MaximumRetryCount") !== 0 || host.AutoRemove !== false || typeof actualTmpfs !== "object" || actualTmpfs === null || Object.keys(actualTmpfs).length !== 2 || Object.entries(expectedTmpfs).some(([path, value]) => Reflect.get(actualTmpfs, path) !== value) || started && (!container.State.Running || container.AppArmorProfile !== dockerProfile(config.profile).appArmorProfile) || started && (networkNames.length !== 1 || !empty(container.NetworkSettings.Ports) || (expectedNetwork === "none" ? networkNames[0] !== "none" : attachment.NetworkID !== networkId)) || role === "export" && (container.State.Running || container.State.Status !== "created")) {
+    throw new SandboxUnsupportedError("Docker resource readback does not match the exact requested workload isolation and resource policy.");
+  }
+}
+export {
+  DOCKER_ENVIRONMENT,
+  KEEPER,
+  containerBody,
+  tmpfs,
+  verifyContainer
+};

package/dist/policy/preflight.d.ts

@@ -0,0 +1,9 @@
+import type { SandboxPolicy } from '@agen-ai/sandbox';
+import type { DockerApi } from '../resources/api.js';
+import type { DockerSandboxConfig } from './config.js';
+export declare function assertDockerController(config: DockerSandboxConfig): void;
+export declare function verifyDaemon(api: DockerApi, config: DockerSandboxConfig, signal?: AbortSignal): Promise<string>;
+export declare function verifyDatasetImages(api: DockerApi, config: DockerSandboxConfig, signal?: AbortSignal): Promise<void>;
+export declare function verifyImage(api: DockerApi, config: DockerSandboxConfig, signal?: AbortSignal): Promise<void>;
+export declare function assertDockerPolicy(policy: SandboxPolicy): void;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/policy/preflight.js

@@ -0,0 +1,89 @@
+import { z } from "zod/v4";
+import { SandboxUnsupportedError } from "@agen-ai/sandbox";
+import { DOCKER_API } from "./config.js";
+import { dockerProfile } from "./profiles.js";
+const versionSchema = z.object({ Version: z.string().max(64).optional(), ApiVersion: z.string(), MinAPIVersion: z.string(), Os: z.string(), Arch: z.string() });
+const infoSchema = z.object({
+  ID: z.string().min(1).max(256).regex(/^[^\s/\\]+$/u),
+  OSType: z.string(),
+  Architecture: z.string(),
+  CgroupVersion: z.string(),
+  CgroupDriver: z.string(),
+  SecurityOptions: z.array(z.string()).max(64),
+  OperatingSystem: z.string().optional(),
+  Driver: z.string().optional(),
+  DriverStatus: z.array(z.tuple([z.string(), z.string()])).max(64).optional(),
+  MemoryLimit: z.boolean(),
+  SwapLimit: z.boolean(),
+  PidsLimit: z.boolean(),
+  CpuCfsPeriod: z.boolean(),
+  CpuCfsQuota: z.boolean()
+});
+const imageSchema = z.object({
+  Id: z.string(),
+  Os: z.string(),
+  Architecture: z.string(),
+  Config: z.object({ Volumes: z.record(z.string(), z.unknown()).nullish() })
+});
+const datasetImageSchema = z.object({ Id: z.string(), Os: z.string(), RootFS: z.object({ Type: z.string() }) });
+function versionNumber(value) {
+  if (!/^\d+\.\d+$/u.test(value)) return Number.NaN;
+  const [major, minor] = value.split(".").map(Number);
+  return major * 1e3 + minor;
+}
+function supportsDatasetMountNames(version) {
+  if (version === void 0 || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u.test(version)) return false;
+  const [major, minor, patch] = version.split(".").map(BigInt);
+  return major > 29n || major === 29n && (minor > 1n || minor === 1n && patch >= 4n);
+}
+function assertDockerController(config) {
+  const profile = dockerProfile(config.profile);
+  if (process.platform !== profile.controllerOS || process.arch !== profile.controllerArchitecture) {
+    throw new SandboxUnsupportedError(`Docker profile ${config.profile} requires a ${profile.controllerOS}/${profile.controllerArchitecture} controller.`);
+  }
+}
+async function verifyDaemon(api, config, signal) {
+  assertDockerController(config);
+  const profile = dockerProfile(config.profile);
+  const version = await api.json("GET", "/version", versionSchema, { signal });
+  const info = await api.json("GET", "/info", infoSchema, { signal });
+  const security = info.SecurityOptions;
+  const imageStore = info.DriverStatus?.filter(([name]) => name === "driver-type");
+  if (version.Os !== "linux" || version.Arch !== profile.daemonArchitecture || !profile.daemonInfoArchitectures.includes(info.Architecture) || info.OSType !== "linux" || info.OperatingSystem === "Docker Desktop" !== profile.desktop || !(versionNumber(version.MinAPIVersion) <= 1052 && versionNumber(version.ApiVersion) >= 1052) || info.CgroupVersion !== "2" || info.CgroupDriver !== profile.cgroupDriver || !info.MemoryLimit || !info.SwapLimit || !info.PidsLimit || !info.CpuCfsPeriod || !info.CpuCfsQuota || security.some((item) => /rootless|userns/iu.test(item)) || security.includes("name=apparmor") === profile.desktop || !security.includes("name=seccomp,profile=builtin") || !security.includes("name=cgroupns")) {
+    throw new SandboxUnsupportedError(`Docker daemon does not match profile ${config.profile}, its architecture, cgroup-v2 controllers or required default isolation.`);
+  }
+  if (config.datasets.length > 0 && (info.Driver !== "overlayfs" || imageStore?.length !== 1 || imageStore[0][1] !== "io.containerd.snapshotter.v1")) {
+    throw new SandboxUnsupportedError("Docker image datasets require the explicitly admitted overlayfs containerd image store.");
+  }
+  if (config.datasets.length > 0 && !supportsDatasetMountNames(version.Version)) {
+    throw new SandboxUnsupportedError("Docker image datasets require a stable Engine release of at least 29.1.4 with the image-layer filename fix.");
+  }
+  return info.ID;
+}
+async function verifyDatasetImages(api, config, signal) {
+  for (const dataset of config.datasets) {
+    const image = await api.json("GET", `${DOCKER_API}/images/${dataset.imageDigest}/json`, datasetImageSchema, { signal });
+    if (image.Id !== dataset.imageDigest || image.Os !== "linux" || image.RootFS.Type !== "layers") {
+      throw new SandboxUnsupportedError("Docker datasets require their exact existing Linux filesystem image ID.");
+    }
+  }
+}
+async function verifyImage(api, config, signal) {
+  const profile = dockerProfile(config.profile);
+  const image = await api.json("GET", `${DOCKER_API}/images/${config.imageDigest}/json`, imageSchema, { signal });
+  if (image.Id !== config.imageDigest || image.Os !== "linux" || image.Architecture !== profile.imageArchitecture || Object.keys(image.Config.Volumes ?? {}).length !== 0) {
+    throw new SandboxUnsupportedError(`Docker profile ${config.profile} requires the exact local Linux ${profile.imageArchitecture} image ID without declared image volumes.`);
+  }
+}
+function assertDockerPolicy(policy) {
+  if (!Number.isSafeInteger(policy.resources.cpus * 1e9) || policy.resources.cpus > 1024 || policy.resources.memoryBytes < 6 * 1024 ** 2) {
+    throw new SandboxUnsupportedError("Docker requires representable NanoCPUs and at least 6 MiB of memory.");
+  }
+}
+export {
+  assertDockerController,
+  assertDockerPolicy,
+  verifyDaemon,
+  verifyDatasetImages,
+  verifyImage
+};

package/dist/policy/profiles.d.ts

@@ -0,0 +1,32 @@
+export declare const DOCKER_SANDBOX_PROFILES: readonly ["linux-x64", "desktop-apple-virtualization-native-arm64", "desktop-apple-virtualization-rosetta-amd64"];
+export type DockerSandboxProfile = typeof DOCKER_SANDBOX_PROFILES[number];
+export declare function dockerProfile(profile: DockerSandboxProfile): {
+    controllerOS: string;
+    controllerArchitecture: string;
+    daemonArchitecture: string;
+    daemonInfoArchitectures: string[];
+    imageArchitecture: string;
+    cgroupDriver: string;
+    appArmorProfile: string;
+    desktop: false;
+} | {
+    controllerOS: string;
+    controllerArchitecture: string;
+    daemonArchitecture: string;
+    daemonInfoArchitectures: string[];
+    imageArchitecture: string;
+    cgroupDriver: string;
+    appArmorProfile: string;
+    desktop: true;
+} | {
+    controllerOS: string;
+    controllerArchitecture: string;
+    daemonArchitecture: string;
+    daemonInfoArchitectures: string[];
+    imageArchitecture: string;
+    cgroupDriver: string;
+    appArmorProfile: string;
+    desktop: true;
+};
+export declare function dockerBackendRevision(profile: DockerSandboxProfile): string;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/policy/profiles.js

@@ -0,0 +1,44 @@
+const DOCKER_SANDBOX_PROFILES = ["linux-x64", "desktop-apple-virtualization-native-arm64", "desktop-apple-virtualization-rosetta-amd64"];
+const profiles = {
+  "linux-x64": {
+    controllerOS: "linux",
+    controllerArchitecture: "x64",
+    daemonArchitecture: "amd64",
+    daemonInfoArchitectures: ["amd64", "x86_64"],
+    imageArchitecture: "amd64",
+    cgroupDriver: "systemd",
+    appArmorProfile: "docker-default",
+    desktop: false
+  },
+  "desktop-apple-virtualization-native-arm64": {
+    controllerOS: "darwin",
+    controllerArchitecture: "arm64",
+    daemonArchitecture: "arm64",
+    daemonInfoArchitectures: ["arm64", "aarch64"],
+    imageArchitecture: "arm64",
+    cgroupDriver: "cgroupfs",
+    appArmorProfile: "",
+    desktop: true
+  },
+  "desktop-apple-virtualization-rosetta-amd64": {
+    controllerOS: "darwin",
+    controllerArchitecture: "arm64",
+    daemonArchitecture: "arm64",
+    daemonInfoArchitectures: ["arm64", "aarch64"],
+    imageArchitecture: "amd64",
+    cgroupDriver: "cgroupfs",
+    appArmorProfile: "",
+    desktop: true
+  }
+};
+function dockerProfile(profile) {
+  return profiles[profile];
+}
+function dockerBackendRevision(profile) {
+  return `engine-1.52-v4-${profile}`;
+}
+export {
+  DOCKER_SANDBOX_PROFILES,
+  dockerBackendRevision,
+  dockerProfile
+};

package/dist/process/attachment.d.ts

@@ -0,0 +1,19 @@
+import type { SandboxStreamLimits } from '@agen-ai/sandbox';
+import type { DockerEngineAttachment } from '../engine/client.js';
+import { DockerInput } from './input.js';
+import { DockerOutput } from './output.js';
+export declare class DockerProcessAttachment {
+    private readonly attachment;
+    private readonly limits;
+    readonly stdin: DockerInput;
+    readonly stdout: DockerOutput;
+    readonly stderr: DockerOutput;
+    readonly settled: Promise<void>;
+    private closed;
+    private outputBytes;
+    constructor(attachment: DockerEngineAttachment, limits: SandboxStreamLimits, failure: (error: Error) => void);
+    close(error?: Error): void;
+    private pump;
+    private receiveReady;
+}
+//# sourceMappingURL=attachment.d.ts.map

package/dist/process/attachment.js

@@ -0,0 +1,109 @@
+import { SandboxOperationError } from "@agen-ai/sandbox";
+import { DockerFrameDecoder } from "./framing.js";
+import { DockerInput } from "./input.js";
+import { DockerOutput } from "./output.js";
+const RECEIVE_CHUNK_BYTES = 64 * 1024;
+class DockerProcessAttachment {
+  constructor(attachment, limits, failure) {
+    this.attachment = attachment;
+    this.limits = limits;
+    const fail = (error) => {
+      if (!this.closed) {
+        this.close(error);
+        failure(error);
+      }
+    };
+    this.stdin = new DockerInput(attachment.stream, limits.highWaterMarkBytes, fail);
+    this.stdout = new DockerOutput(fail);
+    this.stderr = new DockerOutput(fail);
+    const pumping = this.pump().catch((cause) => {
+      if (!this.closed) fail(cause instanceof Error ? cause : new SandboxOperationError("stream_failure", "Docker output failed.", { cause }));
+    });
+    this.settled = Promise.all([pumping, attachment.closed.catch((cause) => {
+      if (!this.closed) fail(cause instanceof Error ? cause : new SandboxOperationError("stream_failure", "Docker attachment failed.", { cause }));
+    })]).then(() => void 0);
+  }
+  stdin;
+  stdout;
+  stderr;
+  settled;
+  closed = false;
+  outputBytes = 0n;
+  close(error) {
+    if (this.closed) return;
+    this.closed = true;
+    this.stdin.close(error);
+    this.stdout.close(error);
+    this.stderr.close(error);
+    this.attachment.stream.destroy(error);
+  }
+  async pump() {
+    const decoder = new DockerFrameDecoder();
+    if (this.attachment.head.byteLength > RECEIVE_CHUNK_BYTES || this.attachment.stream.readableHighWaterMark > RECEIVE_CHUNK_BYTES) {
+      throw new SandboxOperationError("output_limit", "Docker attachment exceeds its bounded native receive profile.");
+    }
+    const deliver = async (channel, payload) => {
+      for (let offset = 0; offset < payload.byteLength; ) {
+        if (this.closed) return;
+        const size = Math.min(this.limits.highWaterMarkBytes, payload.byteLength - offset);
+        if (this.limits.maxOutputBytes !== void 0 && BigInt(size) > BigInt(this.limits.maxOutputBytes) - this.outputBytes) {
+          throw new SandboxOperationError("output_limit", "Docker output exceeded its caller-selected combined byte quota.");
+        }
+        this.outputBytes += BigInt(size);
+        const bytes = Buffer.from(payload.subarray(offset, offset + size));
+        await (channel === 1 ? this.stdout : this.stderr).deliver(bytes);
+        offset += size;
+      }
+    };
+    await decoder.accept(this.attachment.head, deliver);
+    while (!this.attachment.stream.readableEnded) {
+      if (this.closed) return;
+      const size = Math.min(this.attachment.stream.readableLength, RECEIVE_CHUNK_BYTES);
+      if (size === 0) {
+        await this.receiveReady();
+        continue;
+      }
+      const chunk = this.attachment.stream.read(size);
+      if (!(chunk instanceof Uint8Array)) throw new SandboxOperationError("stream_failure", "Docker attachment returned non-binary bytes.");
+      await decoder.accept(chunk, deliver);
+    }
+    if (this.closed) return;
+    decoder.finish();
+    this.stdout.finish();
+    this.stderr.finish();
+  }
+  receiveReady() {
+    const stream = this.attachment.stream;
+    if (stream.readableEnded || stream.readableLength !== 0 || this.closed) return Promise.resolve();
+    if (stream.destroyed) return Promise.reject(new SandboxOperationError("stream_failure", "Docker attachment closed before output EOF."));
+    return new Promise((resolve, reject) => {
+      const clear = () => {
+        stream.removeListener("readable", ready);
+        stream.removeListener("end", ready);
+        stream.removeListener("close", closed);
+        stream.removeListener("error", failed);
+      };
+      const ready = () => {
+        clear();
+        resolve();
+      };
+      const failed = (error) => {
+        clear();
+        reject(error);
+      };
+      const closed = () => {
+        clear();
+        if (this.closed || stream.readableEnded) resolve();
+        else reject(new SandboxOperationError("stream_failure", "Docker attachment closed before output EOF."));
+      };
+      stream.once("readable", ready);
+      stream.once("end", ready);
+      stream.once("close", closed);
+      stream.once("error", failed);
+      stream.read(0);
+    });
+  }
+}
+export {
+  DockerProcessAttachment
+};

package/dist/process/framing.d.ts

@@ -0,0 +1,10 @@
+export declare const DOCKER_FRAME_LIMIT: number;
+export declare class DockerFrameDecoder {
+    private readonly header;
+    private headerBytes;
+    private remaining;
+    private channel;
+    accept(bytes: Uint8Array, deliver: (channel: 1 | 2, bytes: Uint8Array) => Promise<void>): Promise<void>;
+    finish(): void;
+}
+//# sourceMappingURL=framing.d.ts.map

package/dist/process/framing.js

@@ -0,0 +1,43 @@
+import { SandboxOperationError } from "@agen-ai/sandbox";
+const DOCKER_FRAME_LIMIT = 1024 * 1024;
+class DockerFrameDecoder {
+  header = Buffer.alloc(8);
+  headerBytes = 0;
+  remaining = 0;
+  channel = 1;
+  async accept(bytes, deliver) {
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      if (this.remaining === 0) {
+        const copied = Math.min(8 - this.headerBytes, bytes.byteLength - offset);
+        this.header.set(bytes.subarray(offset, offset + copied), this.headerBytes);
+        this.headerBytes += copied;
+        offset += copied;
+        if (this.headerBytes !== 8) continue;
+        const channel = this.header[0];
+        if (channel !== 1 && channel !== 2 || this.header[1] !== 0 || this.header[2] !== 0 || this.header[3] !== 0) {
+          throw new SandboxOperationError("stream_failure", "Docker output contains an invalid multiplex header.");
+        }
+        this.remaining = this.header.readUInt32BE(4);
+        this.headerBytes = 0;
+        this.channel = channel;
+        if (this.remaining > DOCKER_FRAME_LIMIT) throw new SandboxOperationError("output_limit", "Docker declared an oversized output frame.");
+        if (this.remaining === 0) continue;
+      }
+      const size = Math.min(this.remaining, bytes.byteLength - offset);
+      if (size === 0) continue;
+      await deliver(this.channel, bytes.subarray(offset, offset + size));
+      offset += size;
+      this.remaining -= size;
+    }
+  }
+  finish() {
+    if (this.headerBytes !== 0 || this.remaining !== 0) {
+      throw new SandboxOperationError("stream_failure", "Docker output ended inside a multiplex frame.");
+    }
+  }
+}
+export {
+  DOCKER_FRAME_LIMIT,
+  DockerFrameDecoder
+};

package/dist/process/input.d.ts

@@ -0,0 +1,16 @@
+import { Writable, type Duplex } from 'node:stream';
+type WriteCallback = (error?: Error | null) => void;
+export declare class DockerInput extends Writable {
+    private readonly socket;
+    private readonly failure;
+    private closing;
+    private active;
+    constructor(socket: Duplex, highWaterMark: number, failure: (error: Error) => void);
+    _write(chunk: unknown, _encoding: BufferEncoding, callback: WriteCallback): void;
+    _final(callback: WriteCallback): void;
+    close(error?: Error): void;
+    _destroy(error: Error | null, callback: WriteCallback): void;
+    private callback;
+}
+export {};
+//# sourceMappingURL=input.d.ts.map

package/dist/process/input.js

@@ -0,0 +1,62 @@
+import { Writable } from "node:stream";
+import { SandboxOperationError } from "@agen-ai/sandbox";
+class DockerInput extends Writable {
+  constructor(socket, highWaterMark, failure) {
+    super({ highWaterMark, decodeStrings: false, autoDestroy: false });
+    this.socket = socket;
+    this.failure = failure;
+    this.on("error", () => {
+    });
+    socket.on("error", (error) => this.close(error));
+    socket.once("close", () => {
+      if (this.active) this.close(new SandboxOperationError("stream_failure", "Docker attachment closed before stdin delivery settled."));
+    });
+  }
+  closing = false;
+  active;
+  _write(chunk, _encoding, callback) {
+    if (!(chunk instanceof Uint8Array)) {
+      callback(new SandboxOperationError("stream_failure", "Docker stdin requires binary bytes."));
+      return;
+    }
+    const complete = this.callback(callback);
+    try {
+      this.socket.write(chunk, complete);
+    } catch (cause) {
+      complete(cause instanceof Error ? cause : new SandboxOperationError("stream_failure", "Docker stdin write failed.", { cause }));
+    }
+  }
+  _final(callback) {
+    const complete = this.callback(callback);
+    try {
+      this.socket.end(complete);
+    } catch (cause) {
+      complete(cause instanceof Error ? cause : new SandboxOperationError("stream_failure", "Docker stdin half-close failed.", { cause }));
+    }
+  }
+  close(error) {
+    this.closing = true;
+    this.destroy(error);
+  }
+  _destroy(error, callback) {
+    this.active?.(error ?? new SandboxOperationError("cancelled", "Docker stdin closed before its write settled."));
+    if (!this.closing && (!this.writableFinished || error)) {
+      this.failure(error ?? new SandboxOperationError("stream_failure", "Docker stdin was abandoned."));
+    }
+    callback(error);
+  }
+  callback(callback) {
+    let done = false;
+    const complete = (error) => {
+      if (done) return;
+      done = true;
+      this.active = void 0;
+      callback(error);
+    };
+    this.active = complete;
+    return complete;
+  }
+}
+export {
+  DockerInput
+};

package/dist/process/output.d.ts

@@ -0,0 +1,13 @@
+import { Readable } from 'node:stream';
+export declare class DockerOutput extends Readable {
+    private readonly failure;
+    private demand;
+    private complete;
+    constructor(failure: (error: Error) => void);
+    _read(): void;
+    deliver(bytes: Uint8Array): Promise<void>;
+    finish(): void;
+    close(error?: Error): void;
+    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
+}
+//# sourceMappingURL=output.d.ts.map

package/dist/process/output.js

@@ -0,0 +1,41 @@
+import { Readable } from "node:stream";
+import { SandboxOperationError } from "@agen-ai/sandbox";
+class DockerOutput extends Readable {
+  constructor(failure) {
+    super({ highWaterMark: 0 });
+    this.failure = failure;
+    this.on("error", () => {
+    });
+  }
+  demand;
+  complete = false;
+  _read() {
+    this.demand?.();
+    this.demand = void 0;
+  }
+  async deliver(bytes) {
+    if (this.destroyed) throw new SandboxOperationError("stream_failure", "Docker output was closed.");
+    const requested = Promise.withResolvers();
+    this.demand = requested.resolve;
+    this.push(bytes);
+    if (this.readableLength !== 0) await requested.promise;
+    if (this.demand === requested.resolve) this.demand = void 0;
+  }
+  finish() {
+    this.complete = true;
+    this.push(null);
+  }
+  close(error) {
+    this.complete = true;
+    this.destroy(error);
+  }
+  _destroy(error, callback) {
+    this.demand?.();
+    this.demand = void 0;
+    if (!this.complete) this.failure(error ?? new SandboxOperationError("stream_failure", "Docker output was abandoned."));
+    callback(error);
+  }
+}
+export {
+  DockerOutput
+};

package/dist/process/owner.d.ts

@@ -0,0 +1,30 @@
+import type { OperationOptions, SandboxPolicy, SandboxProcessSpec, SandboxProcessStreams } from '@agen-ai/sandbox';
+import type { SandboxDriverProcessReservation } from '@agen-ai/sandbox/backend';
+import type { DockerSandboxConfig } from '../policy/config.js';
+import type { DockerApi } from '../resources/api.js';
+export declare class DockerProcessOwner implements SandboxDriverProcessReservation {
+    private readonly api;
+    private readonly config;
+    private readonly containerId;
+    private readonly spec;
+    private readonly policy;
+    private readonly assertActive;
+    private readonly stopSandbox;
+    readonly id: import("@agen-ai/sandbox").SandboxProcessId;
+    private readonly stopping;
+    private readonly exited;
+    private entered;
+    private startActual;
+    private exitSettled;
+    private attachment;
+    private monitoring;
+    constructor(api: DockerApi, config: DockerSandboxConfig, containerId: string, spec: SandboxProcessSpec, policy: SandboxPolicy, assertActive: (signal?: AbortSignal) => Promise<void>, stopSandbox: () => Promise<void>);
+    start(options?: OperationOptions): Promise<SandboxProcessStreams>;
+    private launch;
+    closeAdmission(): void;
+    computeStopped(): Promise<void>;
+    private monitor;
+    private exit;
+    private fail;
+}
+//# sourceMappingURL=owner.d.ts.map