@agentsh/secure-sandbox 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/integrity.ts","../src/core/config.ts","../src/core/traceparent.ts","../src/core/provision.ts","../src/core/runtime.ts","../src/api.ts"],"sourcesContent":["import { IntegrityError } from './errors.js';\n\nexport const PINNED_VERSION = '0.15.0';\n\nexport const CHECKSUMS: Record<string, Record<string, string>> = {\n  '0.15.0': {\n    linux_amd64:\n      '89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5',\n    linux_arm64:\n      '3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b',\n  },\n  '0.14.0': {\n    linux_amd64:\n      '2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc',\n    linux_arm64:\n      '929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53',\n  },\n};\n\n/**\n * Returns the checksum to verify against.\n * If `override` is provided, returns it directly.\n * Otherwise looks up the checksum in the pinned CHECKSUMS map.\n * Throws IntegrityError if no checksum is found.\n */\nexport function getChecksum(\n  version: string,\n  arch: string,\n  override?: string,\n): string {\n  if (override) {\n    return override;\n  }\n\n  const versionChecksums = CHECKSUMS[version];\n  if (versionChecksums && versionChecksums[arch]) {\n    return versionChecksums[arch];\n  }\n\n  throw new IntegrityError({\n    expected: '',\n    actual: '',\n    message: `No pinned checksum for agentsh v${version}. Provide \\`agentshChecksum\\` explicitly or use \\`skipIntegrityCheck: true\\`.`,\n  });\n}\n\n/**\n * Returns an array of shell commands to try for computing SHA-256 checksums.\n * Each command extracts just the hex hash value from the given file.\n */\nexport function buildVerifyCommand(filePath: string): string[] {\n  return [\n    `sha256sum \"${filePath}\" | awk '{print $1}'`,\n    `shasum -a 256 \"${filePath}\" | awk '{print $1}'`,\n    `openssl dgst -sha256 \"${filePath}\" | awk '{print $NF}'`,\n  ];\n}\n\n/**\n * Returns the download URL for the agentsh binary.\n * If `overrideUrl` is provided, returns it directly.\n * Otherwise returns the default GitHub releases URL.\n */\nexport function binaryUrl(\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;\n}\n","import yaml from 'js-yaml';\nimport type { ThreatFeedsConfig } from './types.js';\n\nexport interface ServerConfigOpts {\n  workspace: string;\n  watchtower?: string;\n  enforceRedirects?: boolean;\n  realPaths?: boolean;\n  threatFeeds?: false | ThreatFeedsConfig;\n}\n\n/**\n * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).\n * Both are free, open source, and updated frequently.\n */\nexport const defaultThreatFeeds: ThreatFeedsConfig = {\n  action: 'deny',\n  feeds: [\n    {\n      name: 'urlhaus',\n      url: 'https://urlhaus.abuse.ch/downloads/hostfile/',\n      format: 'hostfile',\n      refreshInterval: '6h',\n    },\n    {\n      name: 'phishing',\n      url: 'https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt',\n      format: 'domain-list',\n      refreshInterval: '12h',\n    },\n  ],\n  allowlist: [\n    'github.com',\n    '*.github.com',\n    'registry.npmjs.org',\n    'registry.yarnpkg.com',\n    'pypi.org',\n    'files.pythonhosted.org',\n    'crates.io',\n    'static.crates.io',\n    'index.crates.io',\n    'proxy.golang.org',\n    'sum.golang.org',\n  ],\n};\n\nexport function generateServerConfig(opts: ServerConfigOpts): string {\n  const config: Record<string, unknown> = {\n    server: {\n      http: {\n        addr: '127.0.0.1:18080',\n      },\n    },\n    auth: {\n      type: 'none',\n    },\n    policies: {\n      system_dir: '/etc/agentsh/system',\n      dir: '/etc/agentsh',\n      default: 'policy',\n    },\n    workspace: opts.workspace,\n    sandbox: {\n      enabled: true,\n      allow_degraded: true,\n    },\n  };\n  if (opts.watchtower) config.watchtower = opts.watchtower;\n  if (opts.enforceRedirects) config.enforce_redirects = true;\n  if (opts.realPaths) config.real_paths = true;\n\n  // Threat feeds: enabled by default, opt-out with `threatFeeds: false`\n  const feeds = opts.threatFeeds === false ? undefined : (opts.threatFeeds ?? defaultThreatFeeds);\n  if (feeds) {\n    config.threat_feeds = {\n      enabled: true,\n      action: feeds.action ?? 'deny',\n      feeds: feeds.feeds.map(f => ({\n        name: f.name,\n        url: f.url,\n        format: f.format,\n        refresh_interval: f.refreshInterval ?? '6h',\n      })),\n      ...(feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}),\n    };\n  }\n\n  return yaml.dump(config, { lineWidth: -1 });\n}\n","/**\n * Read W3C traceparent from the active OpenTelemetry span, if available.\n *\n * Uses dynamic import so @opentelemetry/api is an optional peer dependency.\n * Returns undefined when OTEL is not installed, no span is active, or the\n * trace context is invalid (all-zero trace ID).\n */\nexport async function getTraceparent(): Promise<string | undefined> {\n  try {\n    const { trace } = await import('@opentelemetry/api');\n    const span = trace.getActiveSpan();\n    const ctx = span?.spanContext();\n    if (!ctx?.traceId || ctx.traceId === '00000000000000000000000000000000') {\n      return undefined;\n    }\n    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, '0');\n    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  SandboxAdapter,\n  SecureConfig,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport {\n  getChecksum,\n  buildVerifyCommand,\n  binaryUrl,\n  PINNED_VERSION,\n} from './integrity.js';\nimport { generateServerConfig } from './config.js';\nimport { ProvisioningError, IntegrityError } from './errors.js';\nimport { serializePolicy, systemPolicyYaml } from '../policies/serialize.js';\nimport { agentDefault } from '../policies/presets.js';\nimport { validatePolicy } from '../policies/schema.js';\nimport { getTraceparent } from './traceparent.js';\n\n// ─── Security mode ordering (strongest to weakest) ────────────\n\nconst SECURITY_MODE_RANK: Record<SecurityMode, number> = {\n  full: 4,\n  landlock: 3,\n  'landlock-only': 2,\n  minimal: 1,\n};\n\nfunction isWeakerThan(detected: SecurityMode, required: SecurityMode): boolean {\n  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];\n}\n\n// ─── Architecture mapping ─────────────────────────────────────\n\nfunction mapArch(uname: string): 'linux_amd64' | 'linux_arm64' {\n  const trimmed = uname.trim();\n  if (trimmed === 'x86_64') return 'linux_amd64';\n  if (trimmed === 'aarch64') return 'linux_arm64';\n  throw new ProvisioningError({\n    phase: 'install',\n    command: 'uname -m',\n    stderr: `Unsupported architecture: ${trimmed}`,\n  });\n}\n\n// ─── Helper: check if binary exists ───────────────────────────\n\nconst AGENTSH_PATHS = ['/usr/local/bin/agentsh', '/usr/bin/agentsh'];\n\nasync function binaryExists(adapter: SandboxAdapter): Promise<boolean> {\n  for (const path of AGENTSH_PATHS) {\n    const found = adapter.fileExists\n      ? await adapter.fileExists(path)\n      : (await adapter.exec('test', ['-f', path])).exitCode === 0;\n    if (found) return true;\n  }\n  return false;\n}\n\n// ─── Helper: sleep ────────────────────────────────────────────\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n// ─── Main provisioning function ───────────────────────────────\n\nexport interface ProvisionResult {\n  sessionId: string;\n  securityMode: SecurityMode;\n  /** When true, the shell shim enforces policy — skip agentsh exec wrapper. */\n  passthrough?: boolean;\n}\n\nexport async function provision(\n  adapter: SandboxAdapter,\n  config: SecureConfig = {},\n): Promise<ProvisionResult> {\n  const {\n    policy: rawPolicy,\n    workspace = '/workspace',\n    watchtower,\n    installStrategy = 'download',\n    agentshVersion = PINNED_VERSION,\n    agentshArch: archOverride,\n    agentshBinaryUrl,\n    agentshChecksum,\n    skipIntegrityCheck = false,\n    minimumSecurityMode,\n    realPaths: realPathsOverride,\n    enforceRedirects = false,\n    traceParent,\n    policyName = 'policy',\n    threatFeeds,\n  } = config;\n\n  // Resolve and validate policy\n  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();\n\n  let securityMode: SecurityMode = 'full';\n\n  if (installStrategy === 'running') {\n    // agentsh is already fully provisioned and running with the shell shim\n    // installed. Commands go through the shim automatically, so we don't\n    // create a new session (which would deadlock the server via nested\n    // agentsh connections). Instead, read the existing session ID from\n    // the environment and use passthrough mode at runtime.\n    securityMode = await detectSecurityMode(adapter);\n\n    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: 'agentsh detect --output json',\n        stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n      });\n    }\n\n    await healthCheck(adapter);\n\n    // Read the existing session ID from the environment\n    const envResult = await adapter.exec('sh', ['-c', 'echo $AGENTSH_SESSION_ID']);\n    const sessionId = envResult.stdout.trim();\n    if (!sessionId) {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'echo $AGENTSH_SESSION_ID',\n        stderr: 'AGENTSH_SESSION_ID not set — running strategy requires a pre-created session',\n      });\n    }\n\n    return { sessionId, securityMode, passthrough: true };\n  }\n\n  // ─── Phase 1: Binary Installation ───────────────────────────\n\n  // Step 1: Check if binary exists\n  const exists = await binaryExists(adapter);\n\n  if (installStrategy === 'preinstalled') {\n    if (!exists) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: AGENTSH_PATHS.map(p => `test -f ${p}`).join(' || '),\n        stderr: 'Binary not found but installStrategy is preinstalled',\n      });\n    }\n    // Binary exists and strategy is preinstalled, skip to detect\n  } else if (installStrategy === 'download' || installStrategy === 'upload') {\n    // If binary already exists, skip installation but still detect\n    if (!exists) {\n      // Step 2: Detect architecture\n      const arch =\n        archOverride ?? await detectArch(adapter);\n\n      if (installStrategy === 'download') {\n        // Step 3a: Download\n        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      } else {\n        // Step 3b: Upload\n        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      }\n\n      // Step 4: Verify checksum\n      if (!skipIntegrityCheck) {\n        await verifyChecksum(\n          adapter,\n          agentshVersion,\n          arch,\n          agentshChecksum,\n          '/tmp/agentsh.tar.gz',\n        );\n      }\n\n      // Step 5: Install binaries (agentsh + agentsh-shell-shim + agentsh-unixwrap)\n      const binaries = [\n        { src: '/tmp/agentsh', dest: '/usr/local/bin/agentsh' },\n        { src: '/tmp/agentsh-shell-shim', dest: '/usr/bin/agentsh-shell-shim' },\n        { src: '/tmp/agentsh-unixwrap', dest: '/usr/local/bin/agentsh-unixwrap' },\n      ];\n      for (const { src, dest } of binaries) {\n        const installResult = await adapter.exec(\n          'install',\n          ['-m', '0755', src, dest],\n          { sudo: true },\n        );\n        if (installResult.exitCode !== 0) {\n          throw new ProvisioningError({\n            phase: 'install',\n            command: `install -m 0755 ${src} ${dest}`,\n            stderr: installResult.stderr,\n          });\n        }\n      }\n    }\n  }\n\n  // Step 5b: Detect security mode\n  securityMode = await detectSecurityMode(adapter);\n\n  // Check minimum security mode\n  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --json',\n      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n    });\n  }\n\n  // Auto-enable realPaths when FUSE is available (full or landlock modes),\n  // unless the user explicitly set it.\n  const hasFuse = securityMode === 'full' || securityMode === 'landlock';\n  const realPaths = realPathsOverride ?? hasFuse;\n\n  // Step 6: Install shell shim\n  const shimResult = await adapter.exec(\n    'agentsh',\n    [\n      'shim', 'install-shell',\n      '--root', '/',\n      '--shim', '/usr/bin/agentsh-shell-shim',\n      '--bash',\n      '--i-understand-this-modifies-the-host',\n    ],\n    { sudo: true },\n  );\n  if (shimResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh shim install-shell',\n      stderr: shimResult.stderr,\n    });\n  }\n\n  // ─── Phase 2: Policy & Config ───────────────────────────────\n\n  // Step 7: Create dirs and make writable for file writes\n  const mkdirResult = await adapter.exec(\n    'mkdir',\n    ['-p', '/etc/agentsh/system'],\n    { sudo: true },\n  );\n  if (mkdirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'mkdir -p /etc/agentsh/system',\n      stderr: mkdirResult.stderr,\n    });\n  }\n\n  // Temporarily make writable so adapter.writeFile (which may not support sudo) can write\n  await adapter.exec('chmod', ['-R', '777', '/etc/agentsh/'], { sudo: true });\n\n  await adapter.writeFile(\n    '/etc/agentsh/system/policy.yml',\n    systemPolicyYaml(),\n    { sudo: true },\n  );\n\n  // Step 8: Write user policy\n  await adapter.writeFile(\n    '/etc/agentsh/policy.yml',\n    serializePolicy(policy),\n    { sudo: true },\n  );\n\n  // Step 9: Write server config\n  const serverConfig = generateServerConfig({\n    workspace,\n    watchtower,\n    enforceRedirects,\n    realPaths,\n    threatFeeds,\n  });\n\n  await adapter.writeFile('/etc/agentsh/config.yml', serverConfig, {\n    sudo: true,\n  });\n\n  // Step 10: Set permissions\n  const chmodDirResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'd', '-exec', 'chmod', '555', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodDirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type d -exec chmod 555 {} +',\n      stderr: chmodDirResult.stderr,\n    });\n  }\n\n  const chmodFileResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'f', '-exec', 'chmod', '444', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodFileResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type f -exec chmod 444 {} +',\n      stderr: chmodFileResult.stderr,\n    });\n  }\n\n  const chownResult = await adapter.exec(\n    'chown',\n    ['-R', 'root:root', '/etc/agentsh/'],\n    { sudo: true },\n  );\n  if (chownResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'chown -R root:root /etc/agentsh/',\n      stderr: chownResult.stderr,\n    });\n  }\n\n  // ─── Phase 3: Server Startup ────────────────────────────────\n\n  // Step 10b: Ensure workspace directory exists\n  await adapter.exec('mkdir', ['-p', workspace], { sudo: true });\n\n  // Step 11: Start server\n  const serverResult = await adapter.exec(\n    'agentsh',\n    ['server', '--config', '/etc/agentsh/config.yml'],\n    { detached: true, sudo: true },\n  );\n  if (serverResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'startup',\n      command: 'agentsh server --config /etc/agentsh/config.yml',\n      stderr: serverResult.stderr,\n    });\n  }\n\n  // Step 12: Health check\n  await healthCheck(adapter);\n\n  // Step 13: Create session\n  const sessionResult = await adapter.exec('agentsh', [\n    'session',\n    'create',\n    '--workspace',\n    workspace,\n    '--policy',\n    'policy',\n  ]);\n  if (sessionResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'session',\n      command: 'agentsh session create',\n      stderr: sessionResult.stderr,\n    });\n  }\n\n  let sessionId: string;\n  try {\n    const sessionData = JSON.parse(sessionResult.stdout);\n    sessionId = sessionData.session_id;\n  } catch {\n    // Fallback: parse text output like \"Session session-xxx started\"\n    const match = sessionResult.stdout.match(/Session\\s+(session-[^\\s]+)/);\n    if (match) {\n      sessionId = match[1];\n    } else {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'agentsh session create',\n        stderr: `Failed to parse session output: ${sessionResult.stdout}`,\n      });\n    }\n  }\n\n  // Step 13b: Set trace context if traceParent is provided or OTEL span is active\n  const effectiveTraceParent = traceParent ?? (await getTraceparent());\n  if (effectiveTraceParent) {\n    await adapter.exec('curl', [\n      '-X',\n      'PUT',\n      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,\n      '-H',\n      'Content-Type: application/json',\n      '-d',\n      JSON.stringify({ traceparent: effectiveTraceParent }),\n    ]);\n  }\n\n  // ─── Phase 4: Handoff ───────────────────────────────────────\n\n  // Step 14: Return result\n  return { sessionId, securityMode };\n}\n\n// ─── Phase 1 helpers ──────────────────────────────────────────\n\nasync function detectArch(\n  adapter: SandboxAdapter,\n): Promise<'linux_amd64' | 'linux_arm64'> {\n  const result = await adapter.exec('uname', ['-m']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'uname -m',\n      stderr: result.stderr,\n    });\n  }\n  return mapArch(result.stdout);\n}\n\nasync function downloadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Try curl first\n  const curlResult = await adapter.exec('curl', [\n    '-fsSL',\n    url,\n    '-o',\n    '/tmp/agentsh.tar.gz',\n  ]);\n\n  if (curlResult.exitCode !== 0) {\n    // Fallback to wget (may not be available on all platforms)\n    let wgetResult: ExecResult;\n    try {\n      wgetResult = await adapter.exec('wget', [\n        '-q',\n        url,\n        '-O',\n        '/tmp/agentsh.tar.gz',\n      ]);\n    } catch {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,\n        stderr: curlResult.stderr || 'Download failed (curl failed, wget not available)',\n      });\n    }\n    if (wgetResult.exitCode !== 0) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,\n        stderr: wgetResult.stderr,\n      });\n    }\n  }\n\n  // Extract\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function uploadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Download on host side using fetch (Node 18+)\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: `fetch ${url}`,\n      stderr: `HTTP ${response.status}: ${response.statusText}`,\n    });\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n\n  // Upload tarball to sandbox and extract\n  await adapter.writeFile('/tmp/agentsh.tar.gz', buffer);\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function verifyChecksum(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  checksumOverride: string | undefined,\n  filePath: string,\n): Promise<void> {\n  const expected = getChecksum(version, arch, checksumOverride);\n  const commands = buildVerifyCommand(filePath);\n\n  let actual: string | undefined;\n\n  for (const cmd of commands) {\n    const result = await adapter.exec('sh', ['-c', cmd]);\n    if (result.exitCode === 0 && result.stdout.trim()) {\n      actual = result.stdout.trim();\n      break;\n    }\n  }\n\n  if (actual === undefined) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'sha256sum / shasum / openssl',\n      stderr: 'No checksum tool available in sandbox',\n    });\n  }\n\n  if (actual !== expected) {\n    throw new IntegrityError({\n      expected,\n      actual,\n      message: `Checksum mismatch: expected ${expected}, got ${actual}`,\n    });\n  }\n}\n\nasync function detectSecurityMode(\n  adapter: SandboxAdapter,\n): Promise<SecurityMode> {\n  const result = await adapter.exec('agentsh', ['detect', '--output', 'json']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: result.stderr,\n    });\n  }\n\n  // agentsh detect outputs JSON to stderr\n  const jsonOutput = result.stderr || result.stdout;\n  let parsed: { security_mode: string };\n  try {\n    parsed = JSON.parse(jsonOutput);\n  } catch {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`,\n    });\n  }\n\n  const mode = parsed.security_mode;\n  const validModes: SecurityMode[] = ['full', 'landlock', 'landlock-only', 'minimal'];\n  if (!validModes.includes(mode as SecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Unknown security mode: '${mode}'`,\n    });\n  }\n  return mode as SecurityMode;\n}\n\nasync function healthCheck(adapter: SandboxAdapter): Promise<void> {\n  const maxRetries = 10;\n  const delayMs = 500;\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await adapter.exec('curl', [\n      '-sf',\n      'http://127.0.0.1:18080/health',\n    ]);\n    if (result.exitCode === 0) {\n      return;\n    }\n    if (i < maxRetries - 1) {\n      await sleep(delayMs);\n    }\n  }\n\n  throw new ProvisioningError({\n    phase: 'startup',\n    command: 'curl http://127.0.0.1:18080/health',\n    stderr: 'Health check failed after 10 attempts',\n  });\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport { RuntimeError } from './errors.js';\nimport { getTraceparent } from './traceparent.js';\n\n/** Build env object with TRACEPARENT if an OTEL span is active. */\nasync function traceEnv(): Promise<Record<string, string> | undefined> {\n  const tp = await getTraceparent();\n  return tp ? { TRACEPARENT: tp } : undefined;\n}\n\n/** Parse the JSON envelope from `agentsh exec --output json`. */\nfunction parseExecJson(raw: ExecResult): ExecResult {\n  try {\n    const json = JSON.parse(raw.stdout);\n    const result = json.result ?? {};\n    return {\n      exitCode: result.exit_code ?? raw.exitCode,\n      stdout: result.stdout ?? '',\n      stderr: result.stderr ?? result.error?.message ?? '',\n    };\n  } catch {\n    // If not valid JSON, return as-is (e.g. mock adapters)\n    return raw;\n  }\n}\n\nexport function createSecuredSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n  options?: { passthrough?: boolean },\n): SecuredSandbox {\n  if (options?.passthrough) {\n    return createPassthroughSandbox(adapter, sessionId, securityMode);\n  }\n  return createAgentshSandbox(adapter, sessionId, securityMode);\n}\n\n/**\n * Passthrough mode: the shell shim enforces policy on every command,\n * so we run commands directly through the adapter without wrapping\n * them in `agentsh exec`. Used with the 'running' install strategy.\n */\nfunction createPassthroughSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const result = await adapter.exec('bash', ['-c', command], {\n        cwd: opts?.cwd,\n      });\n      return result;\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const result = await adapter.exec('sh', [\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const result = await adapter.exec('cat', [path]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\n/** Standard mode: wraps commands in `agentsh exec` for policy enforcement. */\nfunction createAgentshSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const args = [\n        'exec',\n        '--output',\n        'json',\n        sessionId,\n        '--',\n        'bash',\n        '-c',\n        command,\n      ];\n      const env = await traceEnv();\n      const execOpts = { cwd: opts?.cwd, env };\n      const result = await adapter.exec('agentsh', args, execOpts);\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command,\n          stderr: result.stderr,\n        });\n      }\n      return parseExecJson(result);\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const args = [\n        'exec',\n        sessionId,\n        '--',\n        'sh',\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `writeFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const args = ['exec', sessionId, '--', 'cat', path];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `readFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\nfunction isTransportFailure(result: ExecResult): boolean {\n  return result.exitCode === 127 && result.stderr.includes('agentsh');\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecureConfig,\n} from './core/types.js';\nimport { provision } from './core/provision.js';\nimport { createSecuredSandbox } from './core/runtime.js';\n\nexport async function secureSandbox(\n  adapter: SandboxAdapter,\n  config?: SecureConfig,\n): Promise<SecuredSandbox> {\n  const resolvedConfig = config ?? {};\n  const { sessionId, securityMode, passthrough } = await provision(adapter, {\n    workspace: '/workspace',\n    ...resolvedConfig,\n  });\n  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,iBAAiB;AAEvB,IAAM,YAAoD;AAAA,EAC/D,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AAAA,EACA,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AACF;AAQO,SAAS,YACd,SACA,MACA,UACQ;AACR,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,OAAO;AAC1C,MAAI,oBAAoB,iBAAiB,IAAI,GAAG;AAC9C,WAAO,iBAAiB,IAAI;AAAA,EAC9B;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,mCAAmC,OAAO;AAAA,EACrD,CAAC;AACH;AAMO,SAAS,mBAAmB,UAA4B;AAC7D,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,UACd,SACA,MACA,aACQ;AACR,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,SAAO,4DAA4D,OAAO,YAAY,OAAO,IAAI,IAAI;AACvG;;;ACzEA,OAAO,UAAU;AAeV,IAAM,qBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,OAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAkC;AAAA,IACtC,QAAQ;AAAA,MACN,MAAM;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,SAAS;AAAA,MACP,SAAS;AAAA,MACT,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,MAAI,KAAK,WAAY,QAAO,aAAa,KAAK;AAC9C,MAAI,KAAK,iBAAkB,QAAO,oBAAoB;AACtD,MAAI,KAAK,UAAW,QAAO,aAAa;AAGxC,QAAM,QAAQ,KAAK,gBAAgB,QAAQ,SAAa,KAAK,eAAe;AAC5E,MAAI,OAAO;AACT,WAAO,eAAe;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,MAAM,IAAI,QAAM;AAAA,QAC3B,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,QAAQ,EAAE;AAAA,QACV,kBAAkB,EAAE,mBAAmB;AAAA,MACzC,EAAE;AAAA,MACF,GAAI,MAAM,WAAW,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,QAAQ,EAAE,WAAW,GAAG,CAAC;AAC5C;;;ACjFA,eAAsB,iBAA8C;AAClE,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,mBAAoB;AACnD,UAAM,OAAO,MAAM,cAAc;AACjC,UAAM,MAAM,MAAM,YAAY;AAC9B,QAAI,CAAC,KAAK,WAAW,IAAI,YAAY,oCAAoC;AACvE,aAAO;AAAA,IACT;AACA,UAAM,SAAS,IAAI,cAAc,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAChE,WAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACCA,IAAM,qBAAmD;AAAA,EACvD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,SAAS;AACX;AAEA,SAAS,aAAa,UAAwB,UAAiC;AAC7E,SAAO,mBAAmB,QAAQ,IAAI,mBAAmB,QAAQ;AACnE;AAIA,SAAS,QAAQ,OAA8C;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,SAAU,QAAO;AACjC,MAAI,YAAY,UAAW,QAAO;AAClC,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,6BAA6B,OAAO;AAAA,EAC9C,CAAC;AACH;AAIA,IAAM,gBAAgB,CAAC,0BAA0B,kBAAkB;AAEnE,eAAe,aAAa,SAA2C;AACrE,aAAW,QAAQ,eAAe;AAChC,UAAM,QAAQ,QAAQ,aAClB,MAAM,QAAQ,WAAW,IAAI,KAC5B,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa;AAC5D,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAIA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,SACA,SAAuB,CAAC,GACE;AAC1B,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAGJ,QAAM,SAAS,YAAY,eAAe,SAAS,IAAI,aAAa;AAEpE,MAAI,eAA6B;AAEjC,MAAI,oBAAoB,WAAW;AAMjC,mBAAe,MAAM,mBAAmB,OAAO;AAE/C,QAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,MAClG,CAAC;AAAA,IACH;AAEA,UAAM,YAAY,OAAO;AAGzB,UAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,0BAA0B,CAAC;AAC7E,UAAMA,aAAY,UAAU,OAAO,KAAK;AACxC,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,WAAAA,YAAW,cAAc,aAAa,KAAK;AAAA,EACtD;AAKA,QAAM,SAAS,MAAM,aAAa,OAAO;AAEzC,MAAI,oBAAoB,gBAAgB;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,IAAI,OAAK,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM;AAAA,QAC3D,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EAEF,WAAW,oBAAoB,cAAc,oBAAoB,UAAU;AAEzE,QAAI,CAAC,QAAQ;AAEX,YAAM,OACJ,gBAAgB,MAAM,WAAW,OAAO;AAE1C,UAAI,oBAAoB,YAAY;AAElC,cAAM,eAAe,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACtE,OAAO;AAEL,cAAM,aAAa,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACpE;AAGA,UAAI,CAAC,oBAAoB;AACvB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW;AAAA,QACf,EAAE,KAAK,gBAAgB,MAAM,yBAAyB;AAAA,QACtD,EAAE,KAAK,2BAA2B,MAAM,8BAA8B;AAAA,QACtE,EAAE,KAAK,yBAAyB,MAAM,kCAAkC;AAAA,MAC1E;AACA,iBAAW,EAAE,KAAK,KAAK,KAAK,UAAU;AACpC,cAAM,gBAAgB,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,CAAC,MAAM,QAAQ,KAAK,IAAI;AAAA,UACxB,EAAE,MAAM,KAAK;AAAA,QACf;AACA,YAAI,cAAc,aAAa,GAAG;AAChC,gBAAM,IAAI,kBAAkB;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS,mBAAmB,GAAG,IAAI,IAAI;AAAA,YACvC,QAAQ,cAAc;AAAA,UACxB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,MAAM,mBAAmB,OAAO;AAG/C,MAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,IAClG,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,iBAAiB,UAAU,iBAAiB;AAC5D,QAAM,YAAY,qBAAqB;AAGvC,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B;AAAA,IACA;AAAA,MACE;AAAA,MAAQ;AAAA,MACR;AAAA,MAAU;AAAA,MACV;AAAA,MAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,WAAW,aAAa,GAAG;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAKA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,qBAAqB;AAAA,IAC5B,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAGA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,OAAO,eAAe,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,iBAAiB;AAAA,IACjB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,eAAe,qBAAqB;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,UAAU,2BAA2B,cAAc;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,eAAe,aAAa,GAAG;AACjC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,eAAe;AAAA,IACzB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,gBAAgB,aAAa,GAAG;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gBAAgB;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,aAAa,eAAe;AAAA,IACnC,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAKA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,KAAK,CAAC;AAG7D,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC;AAAA,IACA,CAAC,UAAU,YAAY,yBAAyB;AAAA,IAChD,EAAE,UAAU,MAAM,MAAM,KAAK;AAAA,EAC/B;AACA,MAAI,aAAa,aAAa,GAAG;AAC/B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,OAAO;AAGzB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,WAAW;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,cAAc,aAAa,GAAG;AAChC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,cAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,KAAK,MAAM,cAAc,MAAM;AACnD,gBAAY,YAAY;AAAA,EAC1B,QAAQ;AAEN,UAAM,QAAQ,cAAc,OAAO,MAAM,4BAA4B;AACrE,QAAI,OAAO;AACT,kBAAY,MAAM,CAAC;AAAA,IACrB,OAAO;AACL,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,mCAAmC,cAAc,MAAM;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,uBAAuB,eAAgB,MAAM,eAAe;AAClE,MAAI,sBAAsB;AACxB,UAAM,QAAQ,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,mCAAmC,SAAS;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,UAAU,EAAE,aAAa,qBAAqB,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAKA,SAAO,EAAE,WAAW,aAAa;AACnC;AAIA,eAAe,WACb,SACwC;AACxC,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC;AACjD,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,OAAO,MAAM;AAC9B;AAEA,eAAe,eACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,aAAa,GAAG;AAE7B,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,GAAG;AAAA,QAC1B,QAAQ,WAAW,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,GAAG;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,WAAW,GAAG;AAAA,QACvB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,aACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS,SAAS,GAAG;AAAA,MACrB,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAGvD,QAAM,QAAQ,UAAU,uBAAuB,MAAM;AACrD,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,eACb,SACA,SACA,MACA,kBACA,UACe;AACf,QAAM,WAAW,YAAY,SAAS,MAAM,gBAAgB;AAC5D,QAAM,WAAW,mBAAmB,QAAQ;AAE5C,MAAI;AAEJ,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;AACnD,QAAI,OAAO,aAAa,KAAK,OAAO,OAAO,KAAK,GAAG;AACjD,eAAS,OAAO,OAAO,KAAK;AAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA,SAAS,+BAA+B,QAAQ,SAAS,MAAM;AAAA,IACjE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBACb,SACuB;AACvB,QAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,CAAC,UAAU,YAAY,MAAM,CAAC;AAC3E,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,QAAM,aAAa,OAAO,UAAU,OAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gCAAgC,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,IAClE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,aAA6B,CAAC,QAAQ,YAAY,iBAAiB,SAAS;AAClF,MAAI,CAAC,WAAW,SAAS,IAAoB,GAAG;AAC9C,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,IAAI;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,YAAY,SAAwC;AACjE,QAAM,aAAa;AACnB,QAAM,UAAU;AAEhB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ;AAAA,MACxC;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,OAAO,aAAa,GAAG;AACzB;AAAA,IACF;AACA,QAAI,IAAI,aAAa,GAAG;AACtB,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,EACV,CAAC;AACH;;;ACllBA,eAAe,WAAwD;AACrE,QAAM,KAAK,MAAM,eAAe;AAChC,SAAO,KAAK,EAAE,aAAa,GAAG,IAAI;AACpC;AAGA,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,WAAO;AAAA,MACL,UAAU,OAAO,aAAa,IAAI;AAAA,MAClC,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO,UAAU,OAAO,OAAO,WAAW;AAAA,IACpD;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,SACA,WACA,cACA,SACgB;AAChB,MAAI,SAAS,aAAa;AACxB,WAAO,yBAAyB,SAAS,WAAW,YAAY;AAAA,EAClE;AACA,SAAO,qBAAqB,SAAS,WAAW,YAAY;AAC9D;AAOA,SAAS,yBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,OAAO,GAAG;AAAA,QACzD,KAAK,MAAM;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC;AAC/C,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,qBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ;AAC3D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,aAAa,IAAI;AAAA,UAC1B,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,CAAC,QAAQ,WAAW,MAAM,OAAO,IAAI;AAClD,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,YAAY,IAAI;AAAA,UACzB,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,OAAO,aAAa,OAAO,OAAO,OAAO,SAAS,SAAS;AACpE;;;AC5LA,eAAsB,cACpB,SACA,QACyB;AACzB,QAAM,iBAAiB,UAAU,CAAC;AAClC,QAAM,EAAE,WAAW,cAAc,YAAY,IAAI,MAAM,UAAU,SAAS;AAAA,IACxE,WAAW;AAAA,IACX,GAAG;AAAA,EACL,CAAC;AACD,SAAO,qBAAqB,SAAS,WAAW,cAAc,EAAE,YAAY,CAAC;AAC/E;","names":["sessionId"]}

package/dist/policies/index.d.ts

@@ -0,0 +1,2 @@
+export { C as CommandRule, a as ConnectRedirect, D as DnsRedirect, E as EnvRule, F as FileRule, N as NetworkRule, P as PolicyDefinition, b as PolicyDefinitionSchema, c as agentDefault, d as agentSandbox, e as ciStrict, f as devSafe, m as merge, g as mergePrepend, s as serializePolicy, h as systemPolicyYaml, v as validatePolicy } from '../index-D0UvBOzr.js';
+import 'zod';

package/dist/policies/index.js

@@ -0,0 +1,26 @@
+import {
+  PolicyDefinitionSchema,
+  agentDefault,
+  agentSandbox,
+  ciStrict,
+  devSafe,
+  merge,
+  mergePrepend,
+  serializePolicy,
+  systemPolicyYaml,
+  validatePolicy
+} from "../chunk-NWHVZ3DG.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  PolicyDefinitionSchema,
+  agentDefault,
+  agentSandbox,
+  ciStrict,
+  devSafe,
+  merge,
+  mergePrepend,
+  serializePolicy,
+  systemPolicyYaml,
+  validatePolicy
+};
+//# sourceMappingURL=index.js.map

package/dist/policies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/testing/index.d.ts

@@ -0,0 +1,13 @@
+import { E as ExecResult, c as SecurityMode, b as SecuredSandbox } from '../types-BwEbraFo.js';
+
+interface MockConfig {
+    commands?: Record<string, ExecResult>;
+    files?: Record<string, string>;
+}
+interface MockOptions {
+    securityMode?: SecurityMode;
+    sessionId?: string;
+}
+declare function mockSecuredSandbox(config: MockConfig, opts?: MockOptions): SecuredSandbox;
+
+export { mockSecuredSandbox };

package/dist/testing/index.js

@@ -0,0 +1,32 @@
+import "../chunk-PZ5AY32C.js";
+
+// src/testing/index.ts
+function mockSecuredSandbox(config, opts) {
+  const files = new Map(Object.entries(config.files ?? {}));
+  const commands = config.commands ?? {};
+  return {
+    sessionId: opts?.sessionId ?? "mock-session",
+    securityMode: opts?.securityMode ?? "full",
+    async exec(command) {
+      if (command in commands) return commands[command];
+      return { stdout: "", stderr: `mock: no response for "${command}"`, exitCode: 1 };
+    },
+    async writeFile(path, content) {
+      files.set(path, content);
+      return { success: true, path };
+    },
+    async readFile(path) {
+      const content = files.get(path);
+      if (content !== void 0) {
+        return { success: true, path, content };
+      }
+      return { success: false, path, error: `mock: file not found "${path}"` };
+    },
+    async stop() {
+    }
+  };
+}
+export {
+  mockSecuredSandbox
+};
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/testing/index.ts"],"sourcesContent":["import type { SecuredSandbox, ExecResult, SecurityMode } from '../core/types.js';\n\ninterface MockConfig {\n  commands?: Record<string, ExecResult>;\n  files?: Record<string, string>;\n}\n\ninterface MockOptions {\n  securityMode?: SecurityMode;\n  sessionId?: string;\n}\n\nexport function mockSecuredSandbox(config: MockConfig, opts?: MockOptions): SecuredSandbox {\n  const files = new Map(Object.entries(config.files ?? {}));\n  const commands = config.commands ?? {};\n\n  return {\n    sessionId: opts?.sessionId ?? 'mock-session',\n    securityMode: opts?.securityMode ?? 'full',\n\n    async exec(command) {\n      if (command in commands) return commands[command];\n      return { stdout: '', stderr: `mock: no response for \"${command}\"`, exitCode: 1 };\n    },\n\n    async writeFile(path, content) {\n      files.set(path, content);\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const content = files.get(path);\n      if (content !== undefined) {\n        return { success: true as const, path, content };\n      }\n      return { success: false as const, path, error: `mock: file not found \"${path}\"` };\n    },\n\n    async stop() {},\n  };\n}\n"],"mappings":";;;AAYO,SAAS,mBAAmB,QAAoB,MAAoC;AACzF,QAAM,QAAQ,IAAI,IAAI,OAAO,QAAQ,OAAO,SAAS,CAAC,CAAC,CAAC;AACxD,QAAM,WAAW,OAAO,YAAY,CAAC;AAErC,SAAO;AAAA,IACL,WAAW,MAAM,aAAa;AAAA,IAC9B,cAAc,MAAM,gBAAgB;AAAA,IAEpC,MAAM,KAAK,SAAS;AAClB,UAAI,WAAW,SAAU,QAAO,SAAS,OAAO;AAChD,aAAO,EAAE,QAAQ,IAAI,QAAQ,0BAA0B,OAAO,KAAK,UAAU,EAAE;AAAA,IACjF;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,IAAI,MAAM,OAAO;AACvB,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,UAAU,MAAM,IAAI,IAAI;AAC9B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,SAAS,MAAe,MAAM,QAAQ;AAAA,MACjD;AACA,aAAO,EAAE,SAAS,OAAgB,MAAM,OAAO,yBAAyB,IAAI,IAAI;AAAA,IAClF;AAAA,IAEA,MAAM,OAAO;AAAA,IAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/types-BwEbraFo.d.ts

@@ -0,0 +1,194 @@
+interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+type WriteFileResult = {
+    success: true;
+    path: string;
+} | {
+    success: false;
+    path: string;
+    error: string;
+};
+type ReadFileResult = {
+    success: true;
+    path: string;
+    content: string;
+} | {
+    success: false;
+    path: string;
+    error: string;
+};
+type SecurityMode = 'full' | 'landlock' | 'landlock-only' | 'minimal';
+type InstallStrategy = 'preinstalled' | 'download' | 'upload' | 'running';
+interface SandboxAdapter {
+    /**
+     * Execute a command inside the sandbox.
+     *
+     * During provisioning: used for installing binary, starting server,
+     * creating session, health checks.
+     *
+     * At runtime: used as transport for `agentsh exec $SID -- <command>`.
+     */
+    exec(cmd: string, args?: string[], opts?: {
+        cwd?: string;
+        sudo?: boolean;
+        /** If true, don't wait for completion (for starting daemons). */
+        detached?: boolean;
+        /** Environment variables to set for this command. */
+        env?: Record<string, string>;
+    }): Promise<ExecResult>;
+    /**
+     * Write a file inside the sandbox.
+     * Used during provisioning only: writing policy, writing config,
+     * uploading binary (when installStrategy is 'upload').
+     * Never called at runtime.
+     */
+    writeFile(path: string, content: string | Buffer, opts?: {
+        sudo?: boolean;
+    }): Promise<void>;
+    /**
+     * Read a file from the sandbox.
+     * Used during provisioning only: health checks, reading session output.
+     * Never called at runtime.
+     */
+    readFile(path: string): Promise<string>;
+    /** Stop/destroy the sandbox. Optional. */
+    stop?(): Promise<void>;
+    /**
+     * Check if a file exists. Optional.
+     * Used to detect pre-installed agentsh in snapshots.
+     * If not implemented, the library uses exec('test -f ...').
+     */
+    fileExists?(path: string): Promise<boolean>;
+}
+interface SecuredSandbox {
+    /**
+     * Run a shell command through agentsh.
+     *
+     * Internally executes:
+     *   adapter.exec('agentsh', ['exec', '--output', 'json', sessionId, '--', 'bash', '-c', command])
+     *
+     * Every subprocess spawned by this command is also policy-enforced
+     * via the shell shim and agentsh's process tree tracking.
+     */
+    exec(command: string, opts?: {
+        cwd?: string;
+        /** Timeout in milliseconds. Default: no timeout. */
+        timeout?: number;
+    }): Promise<ExecResult>;
+    /**
+     * Write a text file through agentsh.
+     * Returns success/failure + path. On deny, returns the policy message
+     * instead of throwing.
+     */
+    writeFile(path: string, content: string): Promise<WriteFileResult>;
+    /**
+     * Read a text file through agentsh.
+     * Returns content on success, error message on deny.
+     */
+    readFile(path: string): Promise<ReadFileResult>;
+    /** Stop the sandbox and clean up all resources. */
+    stop(): Promise<void>;
+    /** The agentsh session ID (for Watchtower / telemetry). */
+    readonly sessionId: string;
+    /**
+     * The security mode detected by `agentsh detect` during provisioning.
+     * 'full' = seccomp + eBPF + FUSE (100% enforcement)
+     * 'landlock' = Landlock + FUSE (~85%)
+     * 'landlock-only' = Landlock without FUSE (~80%)
+     * 'minimal' = capability dropping + shim only (~50%)
+     */
+    readonly securityMode: SecurityMode;
+}
+interface SecureConfig {
+    /**
+     * Policy: a PolicyDefinition object or a preset function result.
+     * Default: policies.agentDefault()
+     */
+    policy?: unknown;
+    /** Workspace root inside the sandbox. Default: '/workspace'. */
+    workspace?: string;
+    /** Watchtower event sink URL. Optional. */
+    watchtower?: string;
+    /**
+     * How to get the agentsh binary into the sandbox.
+     * - 'preinstalled': Binary already exists (snapshot or baked image).
+     * - 'download': Download from GitHub releases inside the sandbox. Default.
+     * - 'upload': Library downloads on host, uploads via adapter.writeFile().
+     * - 'running': agentsh is already fully provisioned and running.
+     *   Skips install, shim, policy, config, and server startup.
+     *   Only detects security mode, runs health check, and creates session.
+     */
+    installStrategy?: InstallStrategy;
+    /** Override agentsh binary version. Default: pinned per library release. */
+    agentshVersion?: string;
+    /** Override agentsh binary architecture. Default: auto-detected. */
+    agentshArch?: 'linux_amd64' | 'linux_arm64';
+    /** Override agentsh binary download URL (for 'download' strategy). */
+    agentshBinaryUrl?: string;
+    /** Override SHA256 checksum. Use with custom binary URL. */
+    agentshChecksum?: string;
+    /**
+     * Skip SHA256 integrity check. NOT RECOMMENDED.
+     * Only use if you are providing your own binary via a trusted channel.
+     */
+    skipIntegrityCheck?: boolean;
+    /**
+     * Minimum acceptable security mode. If `agentsh detect` reports a
+     * weaker mode, provisioning fails with ProvisioningError.
+     * Default: undefined (accept any mode, log warning if degraded).
+     */
+    minimumSecurityMode?: SecurityMode;
+    /**
+     * Use real host paths instead of virtualizing under /workspace.
+     * Default: auto-detected. Enabled when FUSE is available (security
+     * mode 'full' or 'landlock'), disabled otherwise. Set explicitly
+     * to override auto-detection.
+     */
+    realPaths?: boolean;
+    /**
+     * Make redirect rules enforced (deny execution) instead of shadowing
+     * to a stub binary.
+     * Default: false (shadow mode).
+     */
+    enforceRedirects?: boolean;
+    /**
+     * W3C traceparent header to propagate into the agentsh session.
+     * Format: '00-<trace-id>-<span-id>-<flags>'
+     */
+    traceParent?: string;
+    /**
+     * Policy name for session creation. Only used with installStrategy 'running'.
+     * Must match a policy file in the server's policy directory.
+     * Default: 'policy' (matches the file written by other install strategies).
+     */
+    policyName?: string;
+    /**
+     * Threat intelligence feeds for blocking known-malicious domains.
+     * Default: enabled with URLhaus and Phishing.Database feeds.
+     * Set to `false` to disable, or provide a custom ThreatFeedsConfig.
+     */
+    threatFeeds?: false | ThreatFeedsConfig;
+}
+interface ThreatFeed {
+    /** Display name for this feed. */
+    name: string;
+    /** URL to fetch the feed from. */
+    url: string;
+    /** Feed format: 'hostfile' (hosts-style) or 'domain-list' (one domain per line). */
+    format: 'hostfile' | 'domain-list';
+    /** How often to refresh the feed. Default: '6h'. */
+    refreshInterval?: string;
+}
+interface ThreatFeedsConfig {
+    /** Action to take when a domain matches a feed. Default: 'deny'. */
+    action?: 'deny' | 'audit';
+    /** Feed sources. */
+    feeds: ThreatFeed[];
+    /** Domains to exclude from blocking (e.g. legitimate services that may appear in feeds). */
+    allowlist?: string[];
+}
+
+export type { ExecResult as E, InstallStrategy as I, ReadFileResult as R, SandboxAdapter as S, ThreatFeedsConfig as T, WriteFileResult as W, SecureConfig as a, SecuredSandbox as b, SecurityMode as c, ThreatFeed as d };

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "@agentsh/secure-sandbox",
+  "version": "0.1.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./adapters": {
+      "types": "./dist/adapters/index.d.ts",
+      "import": "./dist/adapters/index.js"
+    },
+    "./adapters/vercel": {
+      "types": "./dist/adapters/vercel.d.ts",
+      "import": "./dist/adapters/vercel.js"
+    },
+    "./adapters/e2b": {
+      "types": "./dist/adapters/e2b.d.ts",
+      "import": "./dist/adapters/e2b.js"
+    },
+    "./adapters/daytona": {
+      "types": "./dist/adapters/daytona.d.ts",
+      "import": "./dist/adapters/daytona.js"
+    },
+    "./adapters/cloudflare": {
+      "types": "./dist/adapters/cloudflare.d.ts",
+      "import": "./dist/adapters/cloudflare.js"
+    },
+    "./adapters/blaxel": {
+      "types": "./dist/adapters/blaxel.d.ts",
+      "import": "./dist/adapters/blaxel.js"
+    },
+    "./policies": {
+      "types": "./dist/policies/index.d.ts",
+      "import": "./dist/policies/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "test:e2e": "E2E=1 vitest run --config vitest.e2e.config.ts",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "js-yaml": "^4.1.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@blaxel/core": "^0.2.71",
+    "@cloudflare/sandbox": "^0.7.13",
+    "@daytonaio/sdk": "^0.149.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.3.5",
+    "@vercel/sandbox": "^1.8.0",
+    "dotenv": "^17.3.1",
+    "e2b": "^2.14.1",
+    "tsup": "^8.4.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "wrangler": "^4.71.0"
+  },
+  "peerDependencies": {
+    "@blaxel/core": "^0.1.0 || ^0.2.0",
+    "@cloudflare/sandbox": "^0.1.0",
+    "@daytonaio/sdk": "^0.12.0 || ^1.0.0",
+    "@e2b/code-interpreter": "^1.2.0",
+    "@vercel/sandbox": "^1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@vercel/sandbox": {
+      "optional": true
+    },
+    "@e2b/code-interpreter": {
+      "optional": true
+    },
+    "@blaxel/core": {
+      "optional": true
+    },
+    "@cloudflare/sandbox": {
+      "optional": true
+    },
+    "@daytonaio/sdk": {
+      "optional": true
+    }
+  }
+}