@agentsh/secure-sandbox 0.1.1 → 0.1.2

package/README.md

@@ -38,7 +38,7 @@ const raw = await Sandbox.create({ runtime: 'node24' });
 const sandbox = await secureSandbox(adapters.vercel(raw));
 
 const { text } = await generateText({
-  model: anthropic('claude-sonnet-4-5-20250514'),
+  model: anthropic('claude-sonnet-4-6'),
   tools: {
     shell: tool({
       description: 'Run a shell command in the sandbox',

package/dist/adapters/blaxel.d.ts

@@ -1,4 +1,4 @@
-import { S as SandboxAdapter } from '../types-BwEbraFo.js';
+import { S as SandboxAdapter } from '../types-Cz86hRBQ.js';
 
 declare function blaxel(sandbox: any): SandboxAdapter;
 

package/dist/adapters/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { S as SandboxAdapter } from '../types-BwEbraFo.js';
+import { S as SandboxAdapter } from '../types-Cz86hRBQ.js';
 
 declare function cloudflare(sandbox: any): SandboxAdapter;
 

package/dist/adapters/daytona.d.ts

@@ -1,4 +1,4 @@
-import { S as SandboxAdapter } from '../types-BwEbraFo.js';
+import { S as SandboxAdapter } from '../types-Cz86hRBQ.js';
 
 declare function daytona(sandbox: any): SandboxAdapter;
 

package/dist/adapters/e2b.d.ts

@@ -1,4 +1,4 @@
-import { S as SandboxAdapter } from '../types-BwEbraFo.js';
+import { S as SandboxAdapter } from '../types-Cz86hRBQ.js';
 
 declare function e2b(sandbox: any): SandboxAdapter;
 

package/dist/adapters/index.d.ts

@@ -3,4 +3,4 @@ export { e2b } from './e2b.js';
 export { daytona } from './daytona.js';
 export { cloudflare } from './cloudflare.js';
 export { blaxel } from './blaxel.js';
-import '../types-BwEbraFo.js';
+import '../types-Cz86hRBQ.js';

package/dist/adapters/vercel.d.ts

@@ -1,4 +1,4 @@
-import { S as SandboxAdapter } from '../types-BwEbraFo.js';
+import { S as SandboxAdapter } from '../types-Cz86hRBQ.js';
 
 declare function vercel(sandbox: any): SandboxAdapter;
 

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as SandboxAdapter, a as SecureConfig, b as SecuredSandbox, T as ThreatFeedsConfig } from './types-BwEbraFo.js';
-export { E as ExecResult, I as InstallStrategy, R as ReadFileResult, c as SecurityMode, d as ThreatFeed, W as WriteFileResult } from './types-BwEbraFo.js';
+import { S as SandboxAdapter, a as SecureConfig, b as SecuredSandbox, T as ThreatFeedsConfig } from './types-Cz86hRBQ.js';
+export { E as ExecResult, I as InstallStrategy, R as ReadFileResult, c as SecurityMode, d as ThreatFeed, W as WriteFileResult } from './types-Cz86hRBQ.js';
 export { P as PolicyDefinition, i as policies } from './index-D0UvBOzr.js';
 import { ZodIssue } from 'zod';
 export { i as adapters } from './index-aQ1TVPtG.js';

package/dist/index.js

@@ -204,17 +204,20 @@ async function provision(adapter, config = {}) {
   const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();
   let securityMode = "full";
   if (installStrategy === "running") {
-    securityMode = await detectSecurityMode(adapter);
+    await healthCheck(adapter);
+    securityMode = config.securityMode ?? "full";
     if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {
       throw new ProvisioningError({
         phase: "install",
-        command: "agentsh detect --output json",
-        stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`
+        command: "securityMode check",
+        stderr: `Security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`
       });
     }
-    await healthCheck(adapter);
-    const envResult = await adapter.exec("sh", ["-c", "echo $AGENTSH_SESSION_ID"]);
-    const sessionId2 = envResult.stdout.trim();
+    let sessionId2 = config.sessionId;
+    if (!sessionId2) {
+      const envResult = await adapter.exec("sh", ["-c", "echo $AGENTSH_SESSION_ID"]);
+      sessionId2 = envResult.stdout.trim();
+    }
     if (!sessionId2) {
       throw new ProvisioningError({
         phase: "session",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/integrity.ts","../src/core/config.ts","../src/core/traceparent.ts","../src/core/provision.ts","../src/core/runtime.ts","../src/api.ts"],"sourcesContent":["import { IntegrityError } from './errors.js';\n\nexport const PINNED_VERSION = '0.15.0';\n\nexport const CHECKSUMS: Record<string, Record<string, string>> = {\n  '0.15.0': {\n    linux_amd64:\n      '89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5',\n    linux_arm64:\n      '3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b',\n  },\n  '0.14.0': {\n    linux_amd64:\n      '2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc',\n    linux_arm64:\n      '929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53',\n  },\n};\n\n/**\n * Returns the checksum to verify against.\n * If `override` is provided, returns it directly.\n * Otherwise looks up the checksum in the pinned CHECKSUMS map.\n * Throws IntegrityError if no checksum is found.\n */\nexport function getChecksum(\n  version: string,\n  arch: string,\n  override?: string,\n): string {\n  if (override) {\n    return override;\n  }\n\n  const versionChecksums = CHECKSUMS[version];\n  if (versionChecksums && versionChecksums[arch]) {\n    return versionChecksums[arch];\n  }\n\n  throw new IntegrityError({\n    expected: '',\n    actual: '',\n    message: `No pinned checksum for agentsh v${version}. Provide \\`agentshChecksum\\` explicitly or use \\`skipIntegrityCheck: true\\`.`,\n  });\n}\n\n/**\n * Returns an array of shell commands to try for computing SHA-256 checksums.\n * Each command extracts just the hex hash value from the given file.\n */\nexport function buildVerifyCommand(filePath: string): string[] {\n  return [\n    `sha256sum \"${filePath}\" | awk '{print $1}'`,\n    `shasum -a 256 \"${filePath}\" | awk '{print $1}'`,\n    `openssl dgst -sha256 \"${filePath}\" | awk '{print $NF}'`,\n  ];\n}\n\n/**\n * Returns the download URL for the agentsh binary.\n * If `overrideUrl` is provided, returns it directly.\n * Otherwise returns the default GitHub releases URL.\n */\nexport function binaryUrl(\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;\n}\n","import yaml from 'js-yaml';\nimport type { ThreatFeedsConfig } from './types.js';\n\nexport interface ServerConfigOpts {\n  workspace: string;\n  watchtower?: string;\n  enforceRedirects?: boolean;\n  realPaths?: boolean;\n  threatFeeds?: false | ThreatFeedsConfig;\n}\n\n/**\n * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).\n * Both are free, open source, and updated frequently.\n */\nexport const defaultThreatFeeds: ThreatFeedsConfig = {\n  action: 'deny',\n  feeds: [\n    {\n      name: 'urlhaus',\n      url: 'https://urlhaus.abuse.ch/downloads/hostfile/',\n      format: 'hostfile',\n      refreshInterval: '6h',\n    },\n    {\n      name: 'phishing',\n      url: 'https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt',\n      format: 'domain-list',\n      refreshInterval: '12h',\n    },\n  ],\n  allowlist: [\n    'github.com',\n    '*.github.com',\n    'registry.npmjs.org',\n    'registry.yarnpkg.com',\n    'pypi.org',\n    'files.pythonhosted.org',\n    'crates.io',\n    'static.crates.io',\n    'index.crates.io',\n    'proxy.golang.org',\n    'sum.golang.org',\n  ],\n};\n\nexport function generateServerConfig(opts: ServerConfigOpts): string {\n  const config: Record<string, unknown> = {\n    server: {\n      http: {\n        addr: '127.0.0.1:18080',\n      },\n    },\n    auth: {\n      type: 'none',\n    },\n    policies: {\n      system_dir: '/etc/agentsh/system',\n      dir: '/etc/agentsh',\n      default: 'policy',\n    },\n    workspace: opts.workspace,\n    sandbox: {\n      enabled: true,\n      allow_degraded: true,\n    },\n  };\n  if (opts.watchtower) config.watchtower = opts.watchtower;\n  if (opts.enforceRedirects) config.enforce_redirects = true;\n  if (opts.realPaths) config.real_paths = true;\n\n  // Threat feeds: enabled by default, opt-out with `threatFeeds: false`\n  const feeds = opts.threatFeeds === false ? undefined : (opts.threatFeeds ?? defaultThreatFeeds);\n  if (feeds) {\n    config.threat_feeds = {\n      enabled: true,\n      action: feeds.action ?? 'deny',\n      feeds: feeds.feeds.map(f => ({\n        name: f.name,\n        url: f.url,\n        format: f.format,\n        refresh_interval: f.refreshInterval ?? '6h',\n      })),\n      ...(feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}),\n    };\n  }\n\n  return yaml.dump(config, { lineWidth: -1 });\n}\n","/**\n * Read W3C traceparent from the active OpenTelemetry span, if available.\n *\n * Uses dynamic import so @opentelemetry/api is an optional peer dependency.\n * Returns undefined when OTEL is not installed, no span is active, or the\n * trace context is invalid (all-zero trace ID).\n */\nexport async function getTraceparent(): Promise<string | undefined> {\n  try {\n    const { trace } = await import('@opentelemetry/api');\n    const span = trace.getActiveSpan();\n    const ctx = span?.spanContext();\n    if (!ctx?.traceId || ctx.traceId === '00000000000000000000000000000000') {\n      return undefined;\n    }\n    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, '0');\n    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  SandboxAdapter,\n  SecureConfig,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport {\n  getChecksum,\n  buildVerifyCommand,\n  binaryUrl,\n  PINNED_VERSION,\n} from './integrity.js';\nimport { generateServerConfig } from './config.js';\nimport { ProvisioningError, IntegrityError } from './errors.js';\nimport { serializePolicy, systemPolicyYaml } from '../policies/serialize.js';\nimport { agentDefault } from '../policies/presets.js';\nimport { validatePolicy } from '../policies/schema.js';\nimport { getTraceparent } from './traceparent.js';\n\n// ─── Security mode ordering (strongest to weakest) ────────────\n\nconst SECURITY_MODE_RANK: Record<SecurityMode, number> = {\n  full: 4,\n  landlock: 3,\n  'landlock-only': 2,\n  minimal: 1,\n};\n\nfunction isWeakerThan(detected: SecurityMode, required: SecurityMode): boolean {\n  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];\n}\n\n// ─── Architecture mapping ─────────────────────────────────────\n\nfunction mapArch(uname: string): 'linux_amd64' | 'linux_arm64' {\n  const trimmed = uname.trim();\n  if (trimmed === 'x86_64') return 'linux_amd64';\n  if (trimmed === 'aarch64') return 'linux_arm64';\n  throw new ProvisioningError({\n    phase: 'install',\n    command: 'uname -m',\n    stderr: `Unsupported architecture: ${trimmed}`,\n  });\n}\n\n// ─── Helper: check if binary exists ───────────────────────────\n\nconst AGENTSH_PATHS = ['/usr/local/bin/agentsh', '/usr/bin/agentsh'];\n\nasync function binaryExists(adapter: SandboxAdapter): Promise<boolean> {\n  for (const path of AGENTSH_PATHS) {\n    const found = adapter.fileExists\n      ? await adapter.fileExists(path)\n      : (await adapter.exec('test', ['-f', path])).exitCode === 0;\n    if (found) return true;\n  }\n  return false;\n}\n\n// ─── Helper: sleep ────────────────────────────────────────────\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n// ─── Main provisioning function ───────────────────────────────\n\nexport interface ProvisionResult {\n  sessionId: string;\n  securityMode: SecurityMode;\n  /** When true, the shell shim enforces policy — skip agentsh exec wrapper. */\n  passthrough?: boolean;\n}\n\nexport async function provision(\n  adapter: SandboxAdapter,\n  config: SecureConfig = {},\n): Promise<ProvisionResult> {\n  const {\n    policy: rawPolicy,\n    workspace = '/workspace',\n    watchtower,\n    installStrategy = 'download',\n    agentshVersion = PINNED_VERSION,\n    agentshArch: archOverride,\n    agentshBinaryUrl,\n    agentshChecksum,\n    skipIntegrityCheck = false,\n    minimumSecurityMode,\n    realPaths: realPathsOverride,\n    enforceRedirects = false,\n    traceParent,\n    policyName = 'policy',\n    threatFeeds,\n  } = config;\n\n  // Resolve and validate policy\n  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();\n\n  let securityMode: SecurityMode = 'full';\n\n  if (installStrategy === 'running') {\n    // agentsh is already fully provisioned and running with the shell shim\n    // installed. Commands go through the shim automatically, so we don't\n    // create a new session (which would deadlock the server via nested\n    // agentsh connections). Instead, read the existing session ID from\n    // the environment and use passthrough mode at runtime.\n    securityMode = await detectSecurityMode(adapter);\n\n    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: 'agentsh detect --output json',\n        stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n      });\n    }\n\n    await healthCheck(adapter);\n\n    // Read the existing session ID from the environment\n    const envResult = await adapter.exec('sh', ['-c', 'echo $AGENTSH_SESSION_ID']);\n    const sessionId = envResult.stdout.trim();\n    if (!sessionId) {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'echo $AGENTSH_SESSION_ID',\n        stderr: 'AGENTSH_SESSION_ID not set — running strategy requires a pre-created session',\n      });\n    }\n\n    return { sessionId, securityMode, passthrough: true };\n  }\n\n  // ─── Phase 1: Binary Installation ───────────────────────────\n\n  // Step 1: Check if binary exists\n  const exists = await binaryExists(adapter);\n\n  if (installStrategy === 'preinstalled') {\n    if (!exists) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: AGENTSH_PATHS.map(p => `test -f ${p}`).join(' || '),\n        stderr: 'Binary not found but installStrategy is preinstalled',\n      });\n    }\n    // Binary exists and strategy is preinstalled, skip to detect\n  } else if (installStrategy === 'download' || installStrategy === 'upload') {\n    // If binary already exists, skip installation but still detect\n    if (!exists) {\n      // Step 2: Detect architecture\n      const arch =\n        archOverride ?? await detectArch(adapter);\n\n      if (installStrategy === 'download') {\n        // Step 3a: Download\n        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      } else {\n        // Step 3b: Upload\n        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      }\n\n      // Step 4: Verify checksum\n      if (!skipIntegrityCheck) {\n        await verifyChecksum(\n          adapter,\n          agentshVersion,\n          arch,\n          agentshChecksum,\n          '/tmp/agentsh.tar.gz',\n        );\n      }\n\n      // Step 5: Install binaries (agentsh + agentsh-shell-shim + agentsh-unixwrap)\n      const binaries = [\n        { src: '/tmp/agentsh', dest: '/usr/local/bin/agentsh' },\n        { src: '/tmp/agentsh-shell-shim', dest: '/usr/bin/agentsh-shell-shim' },\n        { src: '/tmp/agentsh-unixwrap', dest: '/usr/local/bin/agentsh-unixwrap' },\n      ];\n      for (const { src, dest } of binaries) {\n        const installResult = await adapter.exec(\n          'install',\n          ['-m', '0755', src, dest],\n          { sudo: true },\n        );\n        if (installResult.exitCode !== 0) {\n          throw new ProvisioningError({\n            phase: 'install',\n            command: `install -m 0755 ${src} ${dest}`,\n            stderr: installResult.stderr,\n          });\n        }\n      }\n    }\n  }\n\n  // Step 5b: Detect security mode\n  securityMode = await detectSecurityMode(adapter);\n\n  // Check minimum security mode\n  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --json',\n      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n    });\n  }\n\n  // Auto-enable realPaths when FUSE is available (full or landlock modes),\n  // unless the user explicitly set it.\n  const hasFuse = securityMode === 'full' || securityMode === 'landlock';\n  const realPaths = realPathsOverride ?? hasFuse;\n\n  // Step 6: Install shell shim\n  const shimResult = await adapter.exec(\n    'agentsh',\n    [\n      'shim', 'install-shell',\n      '--root', '/',\n      '--shim', '/usr/bin/agentsh-shell-shim',\n      '--bash',\n      '--i-understand-this-modifies-the-host',\n    ],\n    { sudo: true },\n  );\n  if (shimResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh shim install-shell',\n      stderr: shimResult.stderr,\n    });\n  }\n\n  // ─── Phase 2: Policy & Config ───────────────────────────────\n\n  // Step 7: Create dirs and make writable for file writes\n  const mkdirResult = await adapter.exec(\n    'mkdir',\n    ['-p', '/etc/agentsh/system'],\n    { sudo: true },\n  );\n  if (mkdirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'mkdir -p /etc/agentsh/system',\n      stderr: mkdirResult.stderr,\n    });\n  }\n\n  // Temporarily make writable so adapter.writeFile (which may not support sudo) can write\n  await adapter.exec('chmod', ['-R', '777', '/etc/agentsh/'], { sudo: true });\n\n  await adapter.writeFile(\n    '/etc/agentsh/system/policy.yml',\n    systemPolicyYaml(),\n    { sudo: true },\n  );\n\n  // Step 8: Write user policy\n  await adapter.writeFile(\n    '/etc/agentsh/policy.yml',\n    serializePolicy(policy),\n    { sudo: true },\n  );\n\n  // Step 9: Write server config\n  const serverConfig = generateServerConfig({\n    workspace,\n    watchtower,\n    enforceRedirects,\n    realPaths,\n    threatFeeds,\n  });\n\n  await adapter.writeFile('/etc/agentsh/config.yml', serverConfig, {\n    sudo: true,\n  });\n\n  // Step 10: Set permissions\n  const chmodDirResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'd', '-exec', 'chmod', '555', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodDirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type d -exec chmod 555 {} +',\n      stderr: chmodDirResult.stderr,\n    });\n  }\n\n  const chmodFileResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'f', '-exec', 'chmod', '444', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodFileResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type f -exec chmod 444 {} +',\n      stderr: chmodFileResult.stderr,\n    });\n  }\n\n  const chownResult = await adapter.exec(\n    'chown',\n    ['-R', 'root:root', '/etc/agentsh/'],\n    { sudo: true },\n  );\n  if (chownResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'chown -R root:root /etc/agentsh/',\n      stderr: chownResult.stderr,\n    });\n  }\n\n  // ─── Phase 3: Server Startup ────────────────────────────────\n\n  // Step 10b: Ensure workspace directory exists\n  await adapter.exec('mkdir', ['-p', workspace], { sudo: true });\n\n  // Step 11: Start server\n  const serverResult = await adapter.exec(\n    'agentsh',\n    ['server', '--config', '/etc/agentsh/config.yml'],\n    { detached: true, sudo: true },\n  );\n  if (serverResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'startup',\n      command: 'agentsh server --config /etc/agentsh/config.yml',\n      stderr: serverResult.stderr,\n    });\n  }\n\n  // Step 12: Health check\n  await healthCheck(adapter);\n\n  // Step 13: Create session\n  const sessionResult = await adapter.exec('agentsh', [\n    'session',\n    'create',\n    '--workspace',\n    workspace,\n    '--policy',\n    'policy',\n  ]);\n  if (sessionResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'session',\n      command: 'agentsh session create',\n      stderr: sessionResult.stderr,\n    });\n  }\n\n  let sessionId: string;\n  try {\n    const sessionData = JSON.parse(sessionResult.stdout);\n    sessionId = sessionData.session_id;\n  } catch {\n    // Fallback: parse text output like \"Session session-xxx started\"\n    const match = sessionResult.stdout.match(/Session\\s+(session-[^\\s]+)/);\n    if (match) {\n      sessionId = match[1];\n    } else {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'agentsh session create',\n        stderr: `Failed to parse session output: ${sessionResult.stdout}`,\n      });\n    }\n  }\n\n  // Step 13b: Set trace context if traceParent is provided or OTEL span is active\n  const effectiveTraceParent = traceParent ?? (await getTraceparent());\n  if (effectiveTraceParent) {\n    await adapter.exec('curl', [\n      '-X',\n      'PUT',\n      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,\n      '-H',\n      'Content-Type: application/json',\n      '-d',\n      JSON.stringify({ traceparent: effectiveTraceParent }),\n    ]);\n  }\n\n  // ─── Phase 4: Handoff ───────────────────────────────────────\n\n  // Step 14: Return result\n  return { sessionId, securityMode };\n}\n\n// ─── Phase 1 helpers ──────────────────────────────────────────\n\nasync function detectArch(\n  adapter: SandboxAdapter,\n): Promise<'linux_amd64' | 'linux_arm64'> {\n  const result = await adapter.exec('uname', ['-m']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'uname -m',\n      stderr: result.stderr,\n    });\n  }\n  return mapArch(result.stdout);\n}\n\nasync function downloadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Try curl first\n  const curlResult = await adapter.exec('curl', [\n    '-fsSL',\n    url,\n    '-o',\n    '/tmp/agentsh.tar.gz',\n  ]);\n\n  if (curlResult.exitCode !== 0) {\n    // Fallback to wget (may not be available on all platforms)\n    let wgetResult: ExecResult;\n    try {\n      wgetResult = await adapter.exec('wget', [\n        '-q',\n        url,\n        '-O',\n        '/tmp/agentsh.tar.gz',\n      ]);\n    } catch {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,\n        stderr: curlResult.stderr || 'Download failed (curl failed, wget not available)',\n      });\n    }\n    if (wgetResult.exitCode !== 0) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,\n        stderr: wgetResult.stderr,\n      });\n    }\n  }\n\n  // Extract\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function uploadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Download on host side using fetch (Node 18+)\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: `fetch ${url}`,\n      stderr: `HTTP ${response.status}: ${response.statusText}`,\n    });\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n\n  // Upload tarball to sandbox and extract\n  await adapter.writeFile('/tmp/agentsh.tar.gz', buffer);\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function verifyChecksum(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  checksumOverride: string | undefined,\n  filePath: string,\n): Promise<void> {\n  const expected = getChecksum(version, arch, checksumOverride);\n  const commands = buildVerifyCommand(filePath);\n\n  let actual: string | undefined;\n\n  for (const cmd of commands) {\n    const result = await adapter.exec('sh', ['-c', cmd]);\n    if (result.exitCode === 0 && result.stdout.trim()) {\n      actual = result.stdout.trim();\n      break;\n    }\n  }\n\n  if (actual === undefined) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'sha256sum / shasum / openssl',\n      stderr: 'No checksum tool available in sandbox',\n    });\n  }\n\n  if (actual !== expected) {\n    throw new IntegrityError({\n      expected,\n      actual,\n      message: `Checksum mismatch: expected ${expected}, got ${actual}`,\n    });\n  }\n}\n\nasync function detectSecurityMode(\n  adapter: SandboxAdapter,\n): Promise<SecurityMode> {\n  const result = await adapter.exec('agentsh', ['detect', '--output', 'json']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: result.stderr,\n    });\n  }\n\n  // agentsh detect outputs JSON to stderr\n  const jsonOutput = result.stderr || result.stdout;\n  let parsed: { security_mode: string };\n  try {\n    parsed = JSON.parse(jsonOutput);\n  } catch {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`,\n    });\n  }\n\n  const mode = parsed.security_mode;\n  const validModes: SecurityMode[] = ['full', 'landlock', 'landlock-only', 'minimal'];\n  if (!validModes.includes(mode as SecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Unknown security mode: '${mode}'`,\n    });\n  }\n  return mode as SecurityMode;\n}\n\nasync function healthCheck(adapter: SandboxAdapter): Promise<void> {\n  const maxRetries = 10;\n  const delayMs = 500;\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await adapter.exec('curl', [\n      '-sf',\n      'http://127.0.0.1:18080/health',\n    ]);\n    if (result.exitCode === 0) {\n      return;\n    }\n    if (i < maxRetries - 1) {\n      await sleep(delayMs);\n    }\n  }\n\n  throw new ProvisioningError({\n    phase: 'startup',\n    command: 'curl http://127.0.0.1:18080/health',\n    stderr: 'Health check failed after 10 attempts',\n  });\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport { RuntimeError } from './errors.js';\nimport { getTraceparent } from './traceparent.js';\n\n/** Build env object with TRACEPARENT if an OTEL span is active. */\nasync function traceEnv(): Promise<Record<string, string> | undefined> {\n  const tp = await getTraceparent();\n  return tp ? { TRACEPARENT: tp } : undefined;\n}\n\n/** Parse the JSON envelope from `agentsh exec --output json`. */\nfunction parseExecJson(raw: ExecResult): ExecResult {\n  try {\n    const json = JSON.parse(raw.stdout);\n    const result = json.result ?? {};\n    return {\n      exitCode: result.exit_code ?? raw.exitCode,\n      stdout: result.stdout ?? '',\n      stderr: result.stderr ?? result.error?.message ?? '',\n    };\n  } catch {\n    // If not valid JSON, return as-is (e.g. mock adapters)\n    return raw;\n  }\n}\n\nexport function createSecuredSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n  options?: { passthrough?: boolean },\n): SecuredSandbox {\n  if (options?.passthrough) {\n    return createPassthroughSandbox(adapter, sessionId, securityMode);\n  }\n  return createAgentshSandbox(adapter, sessionId, securityMode);\n}\n\n/**\n * Passthrough mode: the shell shim enforces policy on every command,\n * so we run commands directly through the adapter without wrapping\n * them in `agentsh exec`. Used with the 'running' install strategy.\n */\nfunction createPassthroughSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const result = await adapter.exec('bash', ['-c', command], {\n        cwd: opts?.cwd,\n      });\n      return result;\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const result = await adapter.exec('sh', [\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const result = await adapter.exec('cat', [path]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\n/** Standard mode: wraps commands in `agentsh exec` for policy enforcement. */\nfunction createAgentshSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const args = [\n        'exec',\n        '--output',\n        'json',\n        sessionId,\n        '--',\n        'bash',\n        '-c',\n        command,\n      ];\n      const env = await traceEnv();\n      const execOpts = { cwd: opts?.cwd, env };\n      const result = await adapter.exec('agentsh', args, execOpts);\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command,\n          stderr: result.stderr,\n        });\n      }\n      return parseExecJson(result);\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const args = [\n        'exec',\n        sessionId,\n        '--',\n        'sh',\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `writeFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const args = ['exec', sessionId, '--', 'cat', path];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `readFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\nfunction isTransportFailure(result: ExecResult): boolean {\n  return result.exitCode === 127 && result.stderr.includes('agentsh');\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecureConfig,\n} from './core/types.js';\nimport { provision } from './core/provision.js';\nimport { createSecuredSandbox } from './core/runtime.js';\n\nexport async function secureSandbox(\n  adapter: SandboxAdapter,\n  config?: SecureConfig,\n): Promise<SecuredSandbox> {\n  const resolvedConfig = config ?? {};\n  const { sessionId, securityMode, passthrough } = await provision(adapter, {\n    workspace: '/workspace',\n    ...resolvedConfig,\n  });\n  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,iBAAiB;AAEvB,IAAM,YAAoD;AAAA,EAC/D,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AAAA,EACA,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AACF;AAQO,SAAS,YACd,SACA,MACA,UACQ;AACR,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,OAAO;AAC1C,MAAI,oBAAoB,iBAAiB,IAAI,GAAG;AAC9C,WAAO,iBAAiB,IAAI;AAAA,EAC9B;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,mCAAmC,OAAO;AAAA,EACrD,CAAC;AACH;AAMO,SAAS,mBAAmB,UAA4B;AAC7D,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,UACd,SACA,MACA,aACQ;AACR,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,SAAO,4DAA4D,OAAO,YAAY,OAAO,IAAI,IAAI;AACvG;;;ACzEA,OAAO,UAAU;AAeV,IAAM,qBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,OAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAkC;AAAA,IACtC,QAAQ;AAAA,MACN,MAAM;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,SAAS;AAAA,MACP,SAAS;AAAA,MACT,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,MAAI,KAAK,WAAY,QAAO,aAAa,KAAK;AAC9C,MAAI,KAAK,iBAAkB,QAAO,oBAAoB;AACtD,MAAI,KAAK,UAAW,QAAO,aAAa;AAGxC,QAAM,QAAQ,KAAK,gBAAgB,QAAQ,SAAa,KAAK,eAAe;AAC5E,MAAI,OAAO;AACT,WAAO,eAAe;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,MAAM,IAAI,QAAM;AAAA,QAC3B,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,QAAQ,EAAE;AAAA,QACV,kBAAkB,EAAE,mBAAmB;AAAA,MACzC,EAAE;AAAA,MACF,GAAI,MAAM,WAAW,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,QAAQ,EAAE,WAAW,GAAG,CAAC;AAC5C;;;ACjFA,eAAsB,iBAA8C;AAClE,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,mBAAoB;AACnD,UAAM,OAAO,MAAM,cAAc;AACjC,UAAM,MAAM,MAAM,YAAY;AAC9B,QAAI,CAAC,KAAK,WAAW,IAAI,YAAY,oCAAoC;AACvE,aAAO;AAAA,IACT;AACA,UAAM,SAAS,IAAI,cAAc,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAChE,WAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACCA,IAAM,qBAAmD;AAAA,EACvD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,SAAS;AACX;AAEA,SAAS,aAAa,UAAwB,UAAiC;AAC7E,SAAO,mBAAmB,QAAQ,IAAI,mBAAmB,QAAQ;AACnE;AAIA,SAAS,QAAQ,OAA8C;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,SAAU,QAAO;AACjC,MAAI,YAAY,UAAW,QAAO;AAClC,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,6BAA6B,OAAO;AAAA,EAC9C,CAAC;AACH;AAIA,IAAM,gBAAgB,CAAC,0BAA0B,kBAAkB;AAEnE,eAAe,aAAa,SAA2C;AACrE,aAAW,QAAQ,eAAe;AAChC,UAAM,QAAQ,QAAQ,aAClB,MAAM,QAAQ,WAAW,IAAI,KAC5B,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa;AAC5D,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAIA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,SACA,SAAuB,CAAC,GACE;AAC1B,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAGJ,QAAM,SAAS,YAAY,eAAe,SAAS,IAAI,aAAa;AAEpE,MAAI,eAA6B;AAEjC,MAAI,oBAAoB,WAAW;AAMjC,mBAAe,MAAM,mBAAmB,OAAO;AAE/C,QAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,MAClG,CAAC;AAAA,IACH;AAEA,UAAM,YAAY,OAAO;AAGzB,UAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,0BAA0B,CAAC;AAC7E,UAAMA,aAAY,UAAU,OAAO,KAAK;AACxC,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,WAAAA,YAAW,cAAc,aAAa,KAAK;AAAA,EACtD;AAKA,QAAM,SAAS,MAAM,aAAa,OAAO;AAEzC,MAAI,oBAAoB,gBAAgB;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,IAAI,OAAK,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM;AAAA,QAC3D,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EAEF,WAAW,oBAAoB,cAAc,oBAAoB,UAAU;AAEzE,QAAI,CAAC,QAAQ;AAEX,YAAM,OACJ,gBAAgB,MAAM,WAAW,OAAO;AAE1C,UAAI,oBAAoB,YAAY;AAElC,cAAM,eAAe,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACtE,OAAO;AAEL,cAAM,aAAa,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACpE;AAGA,UAAI,CAAC,oBAAoB;AACvB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW;AAAA,QACf,EAAE,KAAK,gBAAgB,MAAM,yBAAyB;AAAA,QACtD,EAAE,KAAK,2BAA2B,MAAM,8BAA8B;AAAA,QACtE,EAAE,KAAK,yBAAyB,MAAM,kCAAkC;AAAA,MAC1E;AACA,iBAAW,EAAE,KAAK,KAAK,KAAK,UAAU;AACpC,cAAM,gBAAgB,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,CAAC,MAAM,QAAQ,KAAK,IAAI;AAAA,UACxB,EAAE,MAAM,KAAK;AAAA,QACf;AACA,YAAI,cAAc,aAAa,GAAG;AAChC,gBAAM,IAAI,kBAAkB;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS,mBAAmB,GAAG,IAAI,IAAI;AAAA,YACvC,QAAQ,cAAc;AAAA,UACxB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,MAAM,mBAAmB,OAAO;AAG/C,MAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,IAClG,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,iBAAiB,UAAU,iBAAiB;AAC5D,QAAM,YAAY,qBAAqB;AAGvC,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B;AAAA,IACA;AAAA,MACE;AAAA,MAAQ;AAAA,MACR;AAAA,MAAU;AAAA,MACV;AAAA,MAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,WAAW,aAAa,GAAG;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAKA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,qBAAqB;AAAA,IAC5B,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAGA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,OAAO,eAAe,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,iBAAiB;AAAA,IACjB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,eAAe,qBAAqB;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,UAAU,2BAA2B,cAAc;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,eAAe,aAAa,GAAG;AACjC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,eAAe;AAAA,IACzB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,gBAAgB,aAAa,GAAG;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gBAAgB;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,aAAa,eAAe;AAAA,IACnC,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAKA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,KAAK,CAAC;AAG7D,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC;AAAA,IACA,CAAC,UAAU,YAAY,yBAAyB;AAAA,IAChD,EAAE,UAAU,MAAM,MAAM,KAAK;AAAA,EAC/B;AACA,MAAI,aAAa,aAAa,GAAG;AAC/B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,OAAO;AAGzB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,WAAW;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,cAAc,aAAa,GAAG;AAChC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,cAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,KAAK,MAAM,cAAc,MAAM;AACnD,gBAAY,YAAY;AAAA,EAC1B,QAAQ;AAEN,UAAM,QAAQ,cAAc,OAAO,MAAM,4BAA4B;AACrE,QAAI,OAAO;AACT,kBAAY,MAAM,CAAC;AAAA,IACrB,OAAO;AACL,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,mCAAmC,cAAc,MAAM;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,uBAAuB,eAAgB,MAAM,eAAe;AAClE,MAAI,sBAAsB;AACxB,UAAM,QAAQ,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,mCAAmC,SAAS;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,UAAU,EAAE,aAAa,qBAAqB,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAKA,SAAO,EAAE,WAAW,aAAa;AACnC;AAIA,eAAe,WACb,SACwC;AACxC,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC;AACjD,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,OAAO,MAAM;AAC9B;AAEA,eAAe,eACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,aAAa,GAAG;AAE7B,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,GAAG;AAAA,QAC1B,QAAQ,WAAW,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,GAAG;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,WAAW,GAAG;AAAA,QACvB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,aACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS,SAAS,GAAG;AAAA,MACrB,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAGvD,QAAM,QAAQ,UAAU,uBAAuB,MAAM;AACrD,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,eACb,SACA,SACA,MACA,kBACA,UACe;AACf,QAAM,WAAW,YAAY,SAAS,MAAM,gBAAgB;AAC5D,QAAM,WAAW,mBAAmB,QAAQ;AAE5C,MAAI;AAEJ,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;AACnD,QAAI,OAAO,aAAa,KAAK,OAAO,OAAO,KAAK,GAAG;AACjD,eAAS,OAAO,OAAO,KAAK;AAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA,SAAS,+BAA+B,QAAQ,SAAS,MAAM;AAAA,IACjE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBACb,SACuB;AACvB,QAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,CAAC,UAAU,YAAY,MAAM,CAAC;AAC3E,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,QAAM,aAAa,OAAO,UAAU,OAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gCAAgC,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,IAClE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,aAA6B,CAAC,QAAQ,YAAY,iBAAiB,SAAS;AAClF,MAAI,CAAC,WAAW,SAAS,IAAoB,GAAG;AAC9C,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,IAAI;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,YAAY,SAAwC;AACjE,QAAM,aAAa;AACnB,QAAM,UAAU;AAEhB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ;AAAA,MACxC;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,OAAO,aAAa,GAAG;AACzB;AAAA,IACF;AACA,QAAI,IAAI,aAAa,GAAG;AACtB,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,EACV,CAAC;AACH;;;ACllBA,eAAe,WAAwD;AACrE,QAAM,KAAK,MAAM,eAAe;AAChC,SAAO,KAAK,EAAE,aAAa,GAAG,IAAI;AACpC;AAGA,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,WAAO;AAAA,MACL,UAAU,OAAO,aAAa,IAAI;AAAA,MAClC,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO,UAAU,OAAO,OAAO,WAAW;AAAA,IACpD;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,SACA,WACA,cACA,SACgB;AAChB,MAAI,SAAS,aAAa;AACxB,WAAO,yBAAyB,SAAS,WAAW,YAAY;AAAA,EAClE;AACA,SAAO,qBAAqB,SAAS,WAAW,YAAY;AAC9D;AAOA,SAAS,yBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,OAAO,GAAG;AAAA,QACzD,KAAK,MAAM;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC;AAC/C,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,qBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ;AAC3D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,aAAa,IAAI;AAAA,UAC1B,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,CAAC,QAAQ,WAAW,MAAM,OAAO,IAAI;AAClD,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,YAAY,IAAI;AAAA,UACzB,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,OAAO,aAAa,OAAO,OAAO,OAAO,SAAS,SAAS;AACpE;;;AC5LA,eAAsB,cACpB,SACA,QACyB;AACzB,QAAM,iBAAiB,UAAU,CAAC;AAClC,QAAM,EAAE,WAAW,cAAc,YAAY,IAAI,MAAM,UAAU,SAAS;AAAA,IACxE,WAAW;AAAA,IACX,GAAG;AAAA,EACL,CAAC;AACD,SAAO,qBAAqB,SAAS,WAAW,cAAc,EAAE,YAAY,CAAC;AAC/E;","names":["sessionId"]}
+{"version":3,"sources":["../src/core/integrity.ts","../src/core/config.ts","../src/core/traceparent.ts","../src/core/provision.ts","../src/core/runtime.ts","../src/api.ts"],"sourcesContent":["import { IntegrityError } from './errors.js';\n\nexport const PINNED_VERSION = '0.15.0';\n\nexport const CHECKSUMS: Record<string, Record<string, string>> = {\n  '0.15.0': {\n    linux_amd64:\n      '89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5',\n    linux_arm64:\n      '3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b',\n  },\n  '0.14.0': {\n    linux_amd64:\n      '2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc',\n    linux_arm64:\n      '929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53',\n  },\n};\n\n/**\n * Returns the checksum to verify against.\n * If `override` is provided, returns it directly.\n * Otherwise looks up the checksum in the pinned CHECKSUMS map.\n * Throws IntegrityError if no checksum is found.\n */\nexport function getChecksum(\n  version: string,\n  arch: string,\n  override?: string,\n): string {\n  if (override) {\n    return override;\n  }\n\n  const versionChecksums = CHECKSUMS[version];\n  if (versionChecksums && versionChecksums[arch]) {\n    return versionChecksums[arch];\n  }\n\n  throw new IntegrityError({\n    expected: '',\n    actual: '',\n    message: `No pinned checksum for agentsh v${version}. Provide \\`agentshChecksum\\` explicitly or use \\`skipIntegrityCheck: true\\`.`,\n  });\n}\n\n/**\n * Returns an array of shell commands to try for computing SHA-256 checksums.\n * Each command extracts just the hex hash value from the given file.\n */\nexport function buildVerifyCommand(filePath: string): string[] {\n  return [\n    `sha256sum \"${filePath}\" | awk '{print $1}'`,\n    `shasum -a 256 \"${filePath}\" | awk '{print $1}'`,\n    `openssl dgst -sha256 \"${filePath}\" | awk '{print $NF}'`,\n  ];\n}\n\n/**\n * Returns the download URL for the agentsh binary.\n * If `overrideUrl` is provided, returns it directly.\n * Otherwise returns the default GitHub releases URL.\n */\nexport function binaryUrl(\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;\n}\n","import yaml from 'js-yaml';\nimport type { ThreatFeedsConfig } from './types.js';\n\nexport interface ServerConfigOpts {\n  workspace: string;\n  watchtower?: string;\n  enforceRedirects?: boolean;\n  realPaths?: boolean;\n  threatFeeds?: false | ThreatFeedsConfig;\n}\n\n/**\n * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).\n * Both are free, open source, and updated frequently.\n */\nexport const defaultThreatFeeds: ThreatFeedsConfig = {\n  action: 'deny',\n  feeds: [\n    {\n      name: 'urlhaus',\n      url: 'https://urlhaus.abuse.ch/downloads/hostfile/',\n      format: 'hostfile',\n      refreshInterval: '6h',\n    },\n    {\n      name: 'phishing',\n      url: 'https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt',\n      format: 'domain-list',\n      refreshInterval: '12h',\n    },\n  ],\n  allowlist: [\n    'github.com',\n    '*.github.com',\n    'registry.npmjs.org',\n    'registry.yarnpkg.com',\n    'pypi.org',\n    'files.pythonhosted.org',\n    'crates.io',\n    'static.crates.io',\n    'index.crates.io',\n    'proxy.golang.org',\n    'sum.golang.org',\n  ],\n};\n\nexport function generateServerConfig(opts: ServerConfigOpts): string {\n  const config: Record<string, unknown> = {\n    server: {\n      http: {\n        addr: '127.0.0.1:18080',\n      },\n    },\n    auth: {\n      type: 'none',\n    },\n    policies: {\n      system_dir: '/etc/agentsh/system',\n      dir: '/etc/agentsh',\n      default: 'policy',\n    },\n    workspace: opts.workspace,\n    sandbox: {\n      enabled: true,\n      allow_degraded: true,\n    },\n  };\n  if (opts.watchtower) config.watchtower = opts.watchtower;\n  if (opts.enforceRedirects) config.enforce_redirects = true;\n  if (opts.realPaths) config.real_paths = true;\n\n  // Threat feeds: enabled by default, opt-out with `threatFeeds: false`\n  const feeds = opts.threatFeeds === false ? undefined : (opts.threatFeeds ?? defaultThreatFeeds);\n  if (feeds) {\n    config.threat_feeds = {\n      enabled: true,\n      action: feeds.action ?? 'deny',\n      feeds: feeds.feeds.map(f => ({\n        name: f.name,\n        url: f.url,\n        format: f.format,\n        refresh_interval: f.refreshInterval ?? '6h',\n      })),\n      ...(feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}),\n    };\n  }\n\n  return yaml.dump(config, { lineWidth: -1 });\n}\n","/**\n * Read W3C traceparent from the active OpenTelemetry span, if available.\n *\n * Uses dynamic import so @opentelemetry/api is an optional peer dependency.\n * Returns undefined when OTEL is not installed, no span is active, or the\n * trace context is invalid (all-zero trace ID).\n */\nexport async function getTraceparent(): Promise<string | undefined> {\n  try {\n    const { trace } = await import('@opentelemetry/api');\n    const span = trace.getActiveSpan();\n    const ctx = span?.spanContext();\n    if (!ctx?.traceId || ctx.traceId === '00000000000000000000000000000000') {\n      return undefined;\n    }\n    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, '0');\n    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  SandboxAdapter,\n  SecureConfig,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport {\n  getChecksum,\n  buildVerifyCommand,\n  binaryUrl,\n  PINNED_VERSION,\n} from './integrity.js';\nimport { generateServerConfig } from './config.js';\nimport { ProvisioningError, IntegrityError } from './errors.js';\nimport { serializePolicy, systemPolicyYaml } from '../policies/serialize.js';\nimport { agentDefault } from '../policies/presets.js';\nimport { validatePolicy } from '../policies/schema.js';\nimport { getTraceparent } from './traceparent.js';\n\n// ─── Security mode ordering (strongest to weakest) ────────────\n\nconst SECURITY_MODE_RANK: Record<SecurityMode, number> = {\n  full: 4,\n  landlock: 3,\n  'landlock-only': 2,\n  minimal: 1,\n};\n\nfunction isWeakerThan(detected: SecurityMode, required: SecurityMode): boolean {\n  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];\n}\n\n// ─── Architecture mapping ─────────────────────────────────────\n\nfunction mapArch(uname: string): 'linux_amd64' | 'linux_arm64' {\n  const trimmed = uname.trim();\n  if (trimmed === 'x86_64') return 'linux_amd64';\n  if (trimmed === 'aarch64') return 'linux_arm64';\n  throw new ProvisioningError({\n    phase: 'install',\n    command: 'uname -m',\n    stderr: `Unsupported architecture: ${trimmed}`,\n  });\n}\n\n// ─── Helper: check if binary exists ───────────────────────────\n\nconst AGENTSH_PATHS = ['/usr/local/bin/agentsh', '/usr/bin/agentsh'];\n\nasync function binaryExists(adapter: SandboxAdapter): Promise<boolean> {\n  for (const path of AGENTSH_PATHS) {\n    const found = adapter.fileExists\n      ? await adapter.fileExists(path)\n      : (await adapter.exec('test', ['-f', path])).exitCode === 0;\n    if (found) return true;\n  }\n  return false;\n}\n\n// ─── Helper: sleep ────────────────────────────────────────────\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n// ─── Main provisioning function ───────────────────────────────\n\nexport interface ProvisionResult {\n  sessionId: string;\n  securityMode: SecurityMode;\n  /** When true, the shell shim enforces policy — skip agentsh exec wrapper. */\n  passthrough?: boolean;\n}\n\nexport async function provision(\n  adapter: SandboxAdapter,\n  config: SecureConfig = {},\n): Promise<ProvisionResult> {\n  const {\n    policy: rawPolicy,\n    workspace = '/workspace',\n    watchtower,\n    installStrategy = 'download',\n    agentshVersion = PINNED_VERSION,\n    agentshArch: archOverride,\n    agentshBinaryUrl,\n    agentshChecksum,\n    skipIntegrityCheck = false,\n    minimumSecurityMode,\n    realPaths: realPathsOverride,\n    enforceRedirects = false,\n    traceParent,\n    policyName = 'policy',\n    threatFeeds,\n  } = config;\n\n  // Resolve and validate policy\n  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();\n\n  let securityMode: SecurityMode = 'full';\n\n  if (installStrategy === 'running') {\n    // agentsh is already fully provisioned and running with the shell shim\n    // installed. Commands go through the shim automatically, so we don't\n    // create a new session (which would deadlock the server via nested\n    // agentsh connections). Instead, read the existing session ID from\n    // the environment and use passthrough mode at runtime.\n    //\n    // Skip detectSecurityMode() — running `agentsh detect` inside a sandbox\n    // where the shell shim is already installed would route the command\n    // through agentsh's exec API, causing the server to try binding port\n    // 18080 again (\"address already in use\"). Default to 'full' since\n    // pre-provisioned environments typically have full capabilities.\n    await healthCheck(adapter);\n\n    securityMode = config.securityMode ?? 'full';\n\n    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: 'securityMode check',\n        stderr: `Security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n      });\n    }\n\n    // Read the existing session ID from config or from the environment\n    let sessionId = config.sessionId;\n    if (!sessionId) {\n      const envResult = await adapter.exec('sh', ['-c', 'echo $AGENTSH_SESSION_ID']);\n      sessionId = envResult.stdout.trim();\n    }\n    if (!sessionId) {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'echo $AGENTSH_SESSION_ID',\n        stderr: 'AGENTSH_SESSION_ID not set — running strategy requires a pre-created session',\n      });\n    }\n\n    return { sessionId, securityMode, passthrough: true };\n  }\n\n  // ─── Phase 1: Binary Installation ───────────────────────────\n\n  // Step 1: Check if binary exists\n  const exists = await binaryExists(adapter);\n\n  if (installStrategy === 'preinstalled') {\n    if (!exists) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: AGENTSH_PATHS.map(p => `test -f ${p}`).join(' || '),\n        stderr: 'Binary not found but installStrategy is preinstalled',\n      });\n    }\n    // Binary exists and strategy is preinstalled, skip to detect\n  } else if (installStrategy === 'download' || installStrategy === 'upload') {\n    // If binary already exists, skip installation but still detect\n    if (!exists) {\n      // Step 2: Detect architecture\n      const arch =\n        archOverride ?? await detectArch(adapter);\n\n      if (installStrategy === 'download') {\n        // Step 3a: Download\n        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      } else {\n        // Step 3b: Upload\n        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      }\n\n      // Step 4: Verify checksum\n      if (!skipIntegrityCheck) {\n        await verifyChecksum(\n          adapter,\n          agentshVersion,\n          arch,\n          agentshChecksum,\n          '/tmp/agentsh.tar.gz',\n        );\n      }\n\n      // Step 5: Install binaries (agentsh + agentsh-shell-shim + agentsh-unixwrap)\n      const binaries = [\n        { src: '/tmp/agentsh', dest: '/usr/local/bin/agentsh' },\n        { src: '/tmp/agentsh-shell-shim', dest: '/usr/bin/agentsh-shell-shim' },\n        { src: '/tmp/agentsh-unixwrap', dest: '/usr/local/bin/agentsh-unixwrap' },\n      ];\n      for (const { src, dest } of binaries) {\n        const installResult = await adapter.exec(\n          'install',\n          ['-m', '0755', src, dest],\n          { sudo: true },\n        );\n        if (installResult.exitCode !== 0) {\n          throw new ProvisioningError({\n            phase: 'install',\n            command: `install -m 0755 ${src} ${dest}`,\n            stderr: installResult.stderr,\n          });\n        }\n      }\n    }\n  }\n\n  // Step 5b: Detect security mode\n  securityMode = await detectSecurityMode(adapter);\n\n  // Check minimum security mode\n  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --json',\n      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n    });\n  }\n\n  // Auto-enable realPaths when FUSE is available (full or landlock modes),\n  // unless the user explicitly set it.\n  const hasFuse = securityMode === 'full' || securityMode === 'landlock';\n  const realPaths = realPathsOverride ?? hasFuse;\n\n  // Step 6: Install shell shim\n  const shimResult = await adapter.exec(\n    'agentsh',\n    [\n      'shim', 'install-shell',\n      '--root', '/',\n      '--shim', '/usr/bin/agentsh-shell-shim',\n      '--bash',\n      '--i-understand-this-modifies-the-host',\n    ],\n    { sudo: true },\n  );\n  if (shimResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh shim install-shell',\n      stderr: shimResult.stderr,\n    });\n  }\n\n  // ─── Phase 2: Policy & Config ───────────────────────────────\n\n  // Step 7: Create dirs and make writable for file writes\n  const mkdirResult = await adapter.exec(\n    'mkdir',\n    ['-p', '/etc/agentsh/system'],\n    { sudo: true },\n  );\n  if (mkdirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'mkdir -p /etc/agentsh/system',\n      stderr: mkdirResult.stderr,\n    });\n  }\n\n  // Temporarily make writable so adapter.writeFile (which may not support sudo) can write\n  await adapter.exec('chmod', ['-R', '777', '/etc/agentsh/'], { sudo: true });\n\n  await adapter.writeFile(\n    '/etc/agentsh/system/policy.yml',\n    systemPolicyYaml(),\n    { sudo: true },\n  );\n\n  // Step 8: Write user policy\n  await adapter.writeFile(\n    '/etc/agentsh/policy.yml',\n    serializePolicy(policy),\n    { sudo: true },\n  );\n\n  // Step 9: Write server config\n  const serverConfig = generateServerConfig({\n    workspace,\n    watchtower,\n    enforceRedirects,\n    realPaths,\n    threatFeeds,\n  });\n\n  await adapter.writeFile('/etc/agentsh/config.yml', serverConfig, {\n    sudo: true,\n  });\n\n  // Step 10: Set permissions\n  const chmodDirResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'd', '-exec', 'chmod', '555', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodDirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type d -exec chmod 555 {} +',\n      stderr: chmodDirResult.stderr,\n    });\n  }\n\n  const chmodFileResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'f', '-exec', 'chmod', '444', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodFileResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type f -exec chmod 444 {} +',\n      stderr: chmodFileResult.stderr,\n    });\n  }\n\n  const chownResult = await adapter.exec(\n    'chown',\n    ['-R', 'root:root', '/etc/agentsh/'],\n    { sudo: true },\n  );\n  if (chownResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'chown -R root:root /etc/agentsh/',\n      stderr: chownResult.stderr,\n    });\n  }\n\n  // ─── Phase 3: Server Startup ────────────────────────────────\n\n  // Step 10b: Ensure workspace directory exists\n  await adapter.exec('mkdir', ['-p', workspace], { sudo: true });\n\n  // Step 11: Start server\n  const serverResult = await adapter.exec(\n    'agentsh',\n    ['server', '--config', '/etc/agentsh/config.yml'],\n    { detached: true, sudo: true },\n  );\n  if (serverResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'startup',\n      command: 'agentsh server --config /etc/agentsh/config.yml',\n      stderr: serverResult.stderr,\n    });\n  }\n\n  // Step 12: Health check\n  await healthCheck(adapter);\n\n  // Step 13: Create session\n  const sessionResult = await adapter.exec('agentsh', [\n    'session',\n    'create',\n    '--workspace',\n    workspace,\n    '--policy',\n    'policy',\n  ]);\n  if (sessionResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'session',\n      command: 'agentsh session create',\n      stderr: sessionResult.stderr,\n    });\n  }\n\n  let sessionId: string;\n  try {\n    const sessionData = JSON.parse(sessionResult.stdout);\n    sessionId = sessionData.session_id;\n  } catch {\n    // Fallback: parse text output like \"Session session-xxx started\"\n    const match = sessionResult.stdout.match(/Session\\s+(session-[^\\s]+)/);\n    if (match) {\n      sessionId = match[1];\n    } else {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'agentsh session create',\n        stderr: `Failed to parse session output: ${sessionResult.stdout}`,\n      });\n    }\n  }\n\n  // Step 13b: Set trace context if traceParent is provided or OTEL span is active\n  const effectiveTraceParent = traceParent ?? (await getTraceparent());\n  if (effectiveTraceParent) {\n    await adapter.exec('curl', [\n      '-X',\n      'PUT',\n      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,\n      '-H',\n      'Content-Type: application/json',\n      '-d',\n      JSON.stringify({ traceparent: effectiveTraceParent }),\n    ]);\n  }\n\n  // ─── Phase 4: Handoff ───────────────────────────────────────\n\n  // Step 14: Return result\n  return { sessionId, securityMode };\n}\n\n// ─── Phase 1 helpers ──────────────────────────────────────────\n\nasync function detectArch(\n  adapter: SandboxAdapter,\n): Promise<'linux_amd64' | 'linux_arm64'> {\n  const result = await adapter.exec('uname', ['-m']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'uname -m',\n      stderr: result.stderr,\n    });\n  }\n  return mapArch(result.stdout);\n}\n\nasync function downloadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Try curl first\n  const curlResult = await adapter.exec('curl', [\n    '-fsSL',\n    url,\n    '-o',\n    '/tmp/agentsh.tar.gz',\n  ]);\n\n  if (curlResult.exitCode !== 0) {\n    // Fallback to wget (may not be available on all platforms)\n    let wgetResult: ExecResult;\n    try {\n      wgetResult = await adapter.exec('wget', [\n        '-q',\n        url,\n        '-O',\n        '/tmp/agentsh.tar.gz',\n      ]);\n    } catch {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,\n        stderr: curlResult.stderr || 'Download failed (curl failed, wget not available)',\n      });\n    }\n    if (wgetResult.exitCode !== 0) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,\n        stderr: wgetResult.stderr,\n      });\n    }\n  }\n\n  // Extract\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function uploadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Download on host side using fetch (Node 18+)\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: `fetch ${url}`,\n      stderr: `HTTP ${response.status}: ${response.statusText}`,\n    });\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n\n  // Upload tarball to sandbox and extract\n  await adapter.writeFile('/tmp/agentsh.tar.gz', buffer);\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function verifyChecksum(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  checksumOverride: string | undefined,\n  filePath: string,\n): Promise<void> {\n  const expected = getChecksum(version, arch, checksumOverride);\n  const commands = buildVerifyCommand(filePath);\n\n  let actual: string | undefined;\n\n  for (const cmd of commands) {\n    const result = await adapter.exec('sh', ['-c', cmd]);\n    if (result.exitCode === 0 && result.stdout.trim()) {\n      actual = result.stdout.trim();\n      break;\n    }\n  }\n\n  if (actual === undefined) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'sha256sum / shasum / openssl',\n      stderr: 'No checksum tool available in sandbox',\n    });\n  }\n\n  if (actual !== expected) {\n    throw new IntegrityError({\n      expected,\n      actual,\n      message: `Checksum mismatch: expected ${expected}, got ${actual}`,\n    });\n  }\n}\n\nasync function detectSecurityMode(\n  adapter: SandboxAdapter,\n): Promise<SecurityMode> {\n  const result = await adapter.exec('agentsh', ['detect', '--output', 'json']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: result.stderr,\n    });\n  }\n\n  // agentsh detect outputs JSON to stderr\n  const jsonOutput = result.stderr || result.stdout;\n  let parsed: { security_mode: string };\n  try {\n    parsed = JSON.parse(jsonOutput);\n  } catch {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`,\n    });\n  }\n\n  const mode = parsed.security_mode;\n  const validModes: SecurityMode[] = ['full', 'landlock', 'landlock-only', 'minimal'];\n  if (!validModes.includes(mode as SecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Unknown security mode: '${mode}'`,\n    });\n  }\n  return mode as SecurityMode;\n}\n\nasync function healthCheck(adapter: SandboxAdapter): Promise<void> {\n  const maxRetries = 10;\n  const delayMs = 500;\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await adapter.exec('curl', [\n      '-sf',\n      'http://127.0.0.1:18080/health',\n    ]);\n    if (result.exitCode === 0) {\n      return;\n    }\n    if (i < maxRetries - 1) {\n      await sleep(delayMs);\n    }\n  }\n\n  throw new ProvisioningError({\n    phase: 'startup',\n    command: 'curl http://127.0.0.1:18080/health',\n    stderr: 'Health check failed after 10 attempts',\n  });\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport { RuntimeError } from './errors.js';\nimport { getTraceparent } from './traceparent.js';\n\n/** Build env object with TRACEPARENT if an OTEL span is active. */\nasync function traceEnv(): Promise<Record<string, string> | undefined> {\n  const tp = await getTraceparent();\n  return tp ? { TRACEPARENT: tp } : undefined;\n}\n\n/** Parse the JSON envelope from `agentsh exec --output json`. */\nfunction parseExecJson(raw: ExecResult): ExecResult {\n  try {\n    const json = JSON.parse(raw.stdout);\n    const result = json.result ?? {};\n    return {\n      exitCode: result.exit_code ?? raw.exitCode,\n      stdout: result.stdout ?? '',\n      stderr: result.stderr ?? result.error?.message ?? '',\n    };\n  } catch {\n    // If not valid JSON, return as-is (e.g. mock adapters)\n    return raw;\n  }\n}\n\nexport function createSecuredSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n  options?: { passthrough?: boolean },\n): SecuredSandbox {\n  if (options?.passthrough) {\n    return createPassthroughSandbox(adapter, sessionId, securityMode);\n  }\n  return createAgentshSandbox(adapter, sessionId, securityMode);\n}\n\n/**\n * Passthrough mode: the shell shim enforces policy on every command,\n * so we run commands directly through the adapter without wrapping\n * them in `agentsh exec`. Used with the 'running' install strategy.\n */\nfunction createPassthroughSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const result = await adapter.exec('bash', ['-c', command], {\n        cwd: opts?.cwd,\n      });\n      return result;\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const result = await adapter.exec('sh', [\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const result = await adapter.exec('cat', [path]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\n/** Standard mode: wraps commands in `agentsh exec` for policy enforcement. */\nfunction createAgentshSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const args = [\n        'exec',\n        '--output',\n        'json',\n        sessionId,\n        '--',\n        'bash',\n        '-c',\n        command,\n      ];\n      const env = await traceEnv();\n      const execOpts = { cwd: opts?.cwd, env };\n      const result = await adapter.exec('agentsh', args, execOpts);\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command,\n          stderr: result.stderr,\n        });\n      }\n      return parseExecJson(result);\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const args = [\n        'exec',\n        sessionId,\n        '--',\n        'sh',\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `writeFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const args = ['exec', sessionId, '--', 'cat', path];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `readFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\nfunction isTransportFailure(result: ExecResult): boolean {\n  return result.exitCode === 127 && result.stderr.includes('agentsh');\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecureConfig,\n} from './core/types.js';\nimport { provision } from './core/provision.js';\nimport { createSecuredSandbox } from './core/runtime.js';\n\nexport async function secureSandbox(\n  adapter: SandboxAdapter,\n  config?: SecureConfig,\n): Promise<SecuredSandbox> {\n  const resolvedConfig = config ?? {};\n  const { sessionId, securityMode, passthrough } = await provision(adapter, {\n    workspace: '/workspace',\n    ...resolvedConfig,\n  });\n  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,iBAAiB;AAEvB,IAAM,YAAoD;AAAA,EAC/D,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AAAA,EACA,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AACF;AAQO,SAAS,YACd,SACA,MACA,UACQ;AACR,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,OAAO;AAC1C,MAAI,oBAAoB,iBAAiB,IAAI,GAAG;AAC9C,WAAO,iBAAiB,IAAI;AAAA,EAC9B;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,mCAAmC,OAAO;AAAA,EACrD,CAAC;AACH;AAMO,SAAS,mBAAmB,UAA4B;AAC7D,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,UACd,SACA,MACA,aACQ;AACR,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,SAAO,4DAA4D,OAAO,YAAY,OAAO,IAAI,IAAI;AACvG;;;ACzEA,OAAO,UAAU;AAeV,IAAM,qBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,OAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAkC;AAAA,IACtC,QAAQ;AAAA,MACN,MAAM;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,SAAS;AAAA,MACP,SAAS;AAAA,MACT,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,MAAI,KAAK,WAAY,QAAO,aAAa,KAAK;AAC9C,MAAI,KAAK,iBAAkB,QAAO,oBAAoB;AACtD,MAAI,KAAK,UAAW,QAAO,aAAa;AAGxC,QAAM,QAAQ,KAAK,gBAAgB,QAAQ,SAAa,KAAK,eAAe;AAC5E,MAAI,OAAO;AACT,WAAO,eAAe;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,MAAM,IAAI,QAAM;AAAA,QAC3B,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,QAAQ,EAAE;AAAA,QACV,kBAAkB,EAAE,mBAAmB;AAAA,MACzC,EAAE;AAAA,MACF,GAAI,MAAM,WAAW,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,QAAQ,EAAE,WAAW,GAAG,CAAC;AAC5C;;;ACjFA,eAAsB,iBAA8C;AAClE,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,mBAAoB;AACnD,UAAM,OAAO,MAAM,cAAc;AACjC,UAAM,MAAM,MAAM,YAAY;AAC9B,QAAI,CAAC,KAAK,WAAW,IAAI,YAAY,oCAAoC;AACvE,aAAO;AAAA,IACT;AACA,UAAM,SAAS,IAAI,cAAc,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAChE,WAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACCA,IAAM,qBAAmD;AAAA,EACvD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,SAAS;AACX;AAEA,SAAS,aAAa,UAAwB,UAAiC;AAC7E,SAAO,mBAAmB,QAAQ,IAAI,mBAAmB,QAAQ;AACnE;AAIA,SAAS,QAAQ,OAA8C;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,SAAU,QAAO;AACjC,MAAI,YAAY,UAAW,QAAO;AAClC,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,6BAA6B,OAAO;AAAA,EAC9C,CAAC;AACH;AAIA,IAAM,gBAAgB,CAAC,0BAA0B,kBAAkB;AAEnE,eAAe,aAAa,SAA2C;AACrE,aAAW,QAAQ,eAAe;AAChC,UAAM,QAAQ,QAAQ,aAClB,MAAM,QAAQ,WAAW,IAAI,KAC5B,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa;AAC5D,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAIA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,SACA,SAAuB,CAAC,GACE;AAC1B,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAGJ,QAAM,SAAS,YAAY,eAAe,SAAS,IAAI,aAAa;AAEpE,MAAI,eAA6B;AAEjC,MAAI,oBAAoB,WAAW;AAYjC,UAAM,YAAY,OAAO;AAEzB,mBAAe,OAAO,gBAAgB;AAEtC,QAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,kBAAkB,YAAY,8BAA8B,mBAAmB;AAAA,MACzF,CAAC;AAAA,IACH;AAGA,QAAIA,aAAY,OAAO;AACvB,QAAI,CAACA,YAAW;AACd,YAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,0BAA0B,CAAC;AAC7E,MAAAA,aAAY,UAAU,OAAO,KAAK;AAAA,IACpC;AACA,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,WAAAA,YAAW,cAAc,aAAa,KAAK;AAAA,EACtD;AAKA,QAAM,SAAS,MAAM,aAAa,OAAO;AAEzC,MAAI,oBAAoB,gBAAgB;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,IAAI,OAAK,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM;AAAA,QAC3D,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EAEF,WAAW,oBAAoB,cAAc,oBAAoB,UAAU;AAEzE,QAAI,CAAC,QAAQ;AAEX,YAAM,OACJ,gBAAgB,MAAM,WAAW,OAAO;AAE1C,UAAI,oBAAoB,YAAY;AAElC,cAAM,eAAe,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACtE,OAAO;AAEL,cAAM,aAAa,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACpE;AAGA,UAAI,CAAC,oBAAoB;AACvB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW;AAAA,QACf,EAAE,KAAK,gBAAgB,MAAM,yBAAyB;AAAA,QACtD,EAAE,KAAK,2BAA2B,MAAM,8BAA8B;AAAA,QACtE,EAAE,KAAK,yBAAyB,MAAM,kCAAkC;AAAA,MAC1E;AACA,iBAAW,EAAE,KAAK,KAAK,KAAK,UAAU;AACpC,cAAM,gBAAgB,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,CAAC,MAAM,QAAQ,KAAK,IAAI;AAAA,UACxB,EAAE,MAAM,KAAK;AAAA,QACf;AACA,YAAI,cAAc,aAAa,GAAG;AAChC,gBAAM,IAAI,kBAAkB;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS,mBAAmB,GAAG,IAAI,IAAI;AAAA,YACvC,QAAQ,cAAc;AAAA,UACxB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,MAAM,mBAAmB,OAAO;AAG/C,MAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,IAClG,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,iBAAiB,UAAU,iBAAiB;AAC5D,QAAM,YAAY,qBAAqB;AAGvC,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B;AAAA,IACA;AAAA,MACE;AAAA,MAAQ;AAAA,MACR;AAAA,MAAU;AAAA,MACV;AAAA,MAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,WAAW,aAAa,GAAG;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAKA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,qBAAqB;AAAA,IAC5B,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAGA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,OAAO,eAAe,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,iBAAiB;AAAA,IACjB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,eAAe,qBAAqB;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,UAAU,2BAA2B,cAAc;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,eAAe,aAAa,GAAG;AACjC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,eAAe;AAAA,IACzB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,gBAAgB,aAAa,GAAG;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gBAAgB;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,aAAa,eAAe;AAAA,IACnC,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAKA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,KAAK,CAAC;AAG7D,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC;AAAA,IACA,CAAC,UAAU,YAAY,yBAAyB;AAAA,IAChD,EAAE,UAAU,MAAM,MAAM,KAAK;AAAA,EAC/B;AACA,MAAI,aAAa,aAAa,GAAG;AAC/B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,OAAO;AAGzB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,WAAW;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,cAAc,aAAa,GAAG;AAChC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,cAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,KAAK,MAAM,cAAc,MAAM;AACnD,gBAAY,YAAY;AAAA,EAC1B,QAAQ;AAEN,UAAM,QAAQ,cAAc,OAAO,MAAM,4BAA4B;AACrE,QAAI,OAAO;AACT,kBAAY,MAAM,CAAC;AAAA,IACrB,OAAO;AACL,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,mCAAmC,cAAc,MAAM;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,uBAAuB,eAAgB,MAAM,eAAe;AAClE,MAAI,sBAAsB;AACxB,UAAM,QAAQ,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,mCAAmC,SAAS;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,UAAU,EAAE,aAAa,qBAAqB,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAKA,SAAO,EAAE,WAAW,aAAa;AACnC;AAIA,eAAe,WACb,SACwC;AACxC,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC;AACjD,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,OAAO,MAAM;AAC9B;AAEA,eAAe,eACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,aAAa,GAAG;AAE7B,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,GAAG;AAAA,QAC1B,QAAQ,WAAW,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,GAAG;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,WAAW,GAAG;AAAA,QACvB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,aACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS,SAAS,GAAG;AAAA,MACrB,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAGvD,QAAM,QAAQ,UAAU,uBAAuB,MAAM;AACrD,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,eACb,SACA,SACA,MACA,kBACA,UACe;AACf,QAAM,WAAW,YAAY,SAAS,MAAM,gBAAgB;AAC5D,QAAM,WAAW,mBAAmB,QAAQ;AAE5C,MAAI;AAEJ,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;AACnD,QAAI,OAAO,aAAa,KAAK,OAAO,OAAO,KAAK,GAAG;AACjD,eAAS,OAAO,OAAO,KAAK;AAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA,SAAS,+BAA+B,QAAQ,SAAS,MAAM;AAAA,IACjE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBACb,SACuB;AACvB,QAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,CAAC,UAAU,YAAY,MAAM,CAAC;AAC3E,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,QAAM,aAAa,OAAO,UAAU,OAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gCAAgC,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,IAClE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,aAA6B,CAAC,QAAQ,YAAY,iBAAiB,SAAS;AAClF,MAAI,CAAC,WAAW,SAAS,IAAoB,GAAG;AAC9C,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,IAAI;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,YAAY,SAAwC;AACjE,QAAM,aAAa;AACnB,QAAM,UAAU;AAEhB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ;AAAA,MACxC;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,OAAO,aAAa,GAAG;AACzB;AAAA,IACF;AACA,QAAI,IAAI,aAAa,GAAG;AACtB,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,EACV,CAAC;AACH;;;AC3lBA,eAAe,WAAwD;AACrE,QAAM,KAAK,MAAM,eAAe;AAChC,SAAO,KAAK,EAAE,aAAa,GAAG,IAAI;AACpC;AAGA,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,WAAO;AAAA,MACL,UAAU,OAAO,aAAa,IAAI;AAAA,MAClC,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO,UAAU,OAAO,OAAO,WAAW;AAAA,IACpD;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,SACA,WACA,cACA,SACgB;AAChB,MAAI,SAAS,aAAa;AACxB,WAAO,yBAAyB,SAAS,WAAW,YAAY;AAAA,EAClE;AACA,SAAO,qBAAqB,SAAS,WAAW,YAAY;AAC9D;AAOA,SAAS,yBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,OAAO,GAAG;AAAA,QACzD,KAAK,MAAM;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC;AAC/C,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,qBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ;AAC3D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,aAAa,IAAI;AAAA,UAC1B,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,CAAC,QAAQ,WAAW,MAAM,OAAO,IAAI;AAClD,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,YAAY,IAAI;AAAA,UACzB,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,OAAO,aAAa,OAAO,OAAO,OAAO,SAAS,SAAS;AACpE;;;AC5LA,eAAsB,cACpB,SACA,QACyB;AACzB,QAAM,iBAAiB,UAAU,CAAC;AAClC,QAAM,EAAE,WAAW,cAAc,YAAY,IAAI,MAAM,UAAU,SAAS;AAAA,IACxE,WAAW;AAAA,IACX,GAAG;AAAA,EACL,CAAC;AACD,SAAO,qBAAqB,SAAS,WAAW,cAAc,EAAE,YAAY,CAAC;AAC/E;","names":["sessionId"]}

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { E as ExecResult, c as SecurityMode, b as SecuredSandbox } from '../types-BwEbraFo.js';
+import { E as ExecResult, c as SecurityMode, b as SecuredSandbox } from '../types-Cz86hRBQ.js';
 
 interface MockConfig {
     commands?: Record<string, ExecResult>;

package/dist/{types-BwEbraFo.d.ts → types-Cz86hRBQ.d.ts}

@@ -118,8 +118,9 @@ interface SecureConfig {
      * - 'download': Download from GitHub releases inside the sandbox. Default.
      * - 'upload': Library downloads on host, uploads via adapter.writeFile().
      * - 'running': agentsh is already fully provisioned and running.
-     *   Skips install, shim, policy, config, and server startup.
-     *   Only detects security mode, runs health check, and creates session.
+     *   Skips install, shim, policy, config, server startup, and security
+     *   detection. Defaults securityMode to 'full' (override via securityMode).
+     *   Runs health check and reads the existing session from the environment.
      */
     installStrategy?: InstallStrategy;
     /** Override agentsh binary version. Default: pinned per library release. */
@@ -135,6 +136,12 @@ interface SecureConfig {
      * Only use if you are providing your own binary via a trusted channel.
      */
     skipIntegrityCheck?: boolean;
+    /**
+     * Override the detected security mode. Only used with installStrategy 'running',
+     * where `agentsh detect` is skipped (it would conflict with the running server).
+     * Default for 'running': 'full'. Ignored for other install strategies.
+     */
+    securityMode?: SecurityMode;
     /**
      * Minimum acceptable security mode. If `agentsh detect` reports a
      * weaker mode, provisioning fails with ProvisioningError.
@@ -165,6 +172,12 @@ interface SecureConfig {
      * Default: 'policy' (matches the file written by other install strategies).
      */
     policyName?: string;
+    /**
+     * Existing agentsh session ID. Only used with installStrategy 'running'.
+     * If not provided, reads $AGENTSH_SESSION_ID from the sandbox environment.
+     * Use this when the sandbox exec API doesn't inherit shell profile env vars.
+     */
+    sessionId?: string;
     /**
      * Threat intelligence feeds for blocking known-malicious domains.
      * Default: enabled with URLhaus and Phishing.Database feeds.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsh/secure-sandbox",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/canyonroad/agentsh-secure-sandbox"