@agent-compose/sdk 0.2.4 → 0.2.5

package/dist/index.js

@@ -946,7 +946,7 @@ async function extractFromBundle(source, label, pick) {
     return;
   }
 }
-var DEFINE_WORKFLOW_CALLEE = /^defineWorkflow\d*$/;
+var DEFINE_WORKFLOW_CALLEE = /^(?:defineWorkflow|defineSandboxEnvironment)\d*$/;
 function isDefineWorkflowCall(node) {
   if (node.callee.type === "Identifier") {
     return DEFINE_WORKFLOW_CALLEE.test(node.callee.name);

package/dist/runtimes/openai-desktop.js

@@ -946,7 +946,7 @@ async function extractFromBundle(source, label, pick) {
     return;
   }
 }
-var DEFINE_WORKFLOW_CALLEE = /^defineWorkflow\d*$/;
+var DEFINE_WORKFLOW_CALLEE = /^(?:defineWorkflow|defineSandboxEnvironment)\d*$/;
 function isDefineWorkflowCall(node) {
   if (node.callee.type === "Identifier") {
     return DEFINE_WORKFLOW_CALLEE.test(node.callee.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-compose/sdk",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Client library for agent-compose — define agents, runtimes, and workflows, and invoke them against an agent-compose server.",
   "license": "MIT",
   "repository": {

package/src/utils/bundler.ts

@@ -120,11 +120,19 @@ async function extractFromBundle<T>(
 /**
  * Bun bundles `import { defineWorkflow }` to a local identifier — usually
  * the exact name, or a numeric suffix like `defineWorkflow2` to disambiguate
- * scopes. Match exactly that pattern, NOT `startsWith("defineWorkflow")` —
+ * scopes. Match exactly those patterns, NOT `startsWith("defineWorkflow")` —
  * the latter would also accept `defineWorkflowAttacker`. The runtime brand
  * check is the second gate, but the syntactic check should be tight.
+ *
+ * `defineSandboxEnvironment` is sugar over `defineWorkflow` (see
+ * `src/types/sandbox-environment.ts`) and is explicitly registerable via
+ * `agentc register setup.ts --build` to capture a snapshot. The AST gate
+ * accepts it for the same reason it accepts `defineWorkflow`: the bundled
+ * default export is a CallExpression to a known SDK identifier, and the
+ * runtime brand check downstream catches anything that lies about being a
+ * workflow.
  */
-const DEFINE_WORKFLOW_CALLEE = /^defineWorkflow\d*$/;
+const DEFINE_WORKFLOW_CALLEE = /^(?:defineWorkflow|defineSandboxEnvironment)\d*$/;
 
 function isDefineWorkflowCall(node: CallExpression): boolean {
   if (node.callee.type === "Identifier") {