@agentstep/agent-sdk 0.4.13 → 0.4.15

package/dist/backends/registry.js

@@ -1,53 +1,53 @@
 import {
   listBackends,
   resolveBackend
-} from "../chunk-OGONPLTA.js";
-import "../chunk-UVCPCX74.js";
-import "../chunk-JMDS2RJJ.js";
-import "../chunk-J4NKW3L5.js";
+} from "../chunk-QFUJDBET.js";
+import "../chunk-VS7AMAMU.js";
+import "../chunk-T5VRE77P.js";
+import "../chunk-66CJ6LMV.js";
+import "../chunk-QYSDP6V5.js";
 import "../chunk-B6E6BVNK.js";
-import "../chunk-Y2SC7HU5.js";
-import "../chunk-Q4XYK6FF.js";
+import "../chunk-JDBXIJKG.js";
+import "../chunk-GJBKDPQD.js";
 import "../chunk-K4E66KY5.js";
-import "../chunk-ZA4JVJJE.js";
+import "../chunk-3PLJHZFD.js";
 import "../chunk-Z25I7DRV.js";
-import "../chunk-V4P46OHG.js";
+import "../chunk-P7P2NWZD.js";
 import "../chunk-ETWGCBIQ.js";
-import "../chunk-7XFIUYFM.js";
-import "../chunk-T5VRE77P.js";
-import "../chunk-XLVCC4IB.js";
+import "../chunk-SWIP7JBQ.js";
+import "../chunk-HWWCVD2R.js";
 import "../chunk-JHGJG2Z2.js";
-import "../chunk-TY7XTT5N.js";
-import "../chunk-W3M3ME6B.js";
+import "../chunk-RZXRMPF4.js";
+import "../chunk-XG4UIGDH.js";
+import "../chunk-3W6KEDQE.js";
 import "../chunk-S3JRZFF5.js";
-import "../chunk-ME6IR4T6.js";
-import "../chunk-KDAZ5TBL.js";
-import "../chunk-JZ5RFO77.js";
+import "../chunk-NK2RCTFI.js";
+import "../chunk-5XF65N7J.js";
+import "../chunk-7LQN7NVU.js";
 import "../chunk-CULYZ3VA.js";
-import "../chunk-DFE7VZWD.js";
-import "../chunk-3MNDEAPX.js";
+import "../chunk-RMEX55EU.js";
+import "../chunk-UJDAT42X.js";
+import "../chunk-YSUPRYX2.js";
 import "../chunk-7TSTCMII.js";
+import "../chunk-QQDSHL27.js";
 import "../chunk-DAT55TX2.js";
 import "../chunk-IAF6VMPO.js";
-import "../chunk-2PKJSOXX.js";
-import "../chunk-H74BPBKE.js";
-import "../chunk-2QGVGXIT.js";
-import "../chunk-JFY6EH24.js";
-import "../chunk-G5RQN53K.js";
+import "../chunk-FCULDJQO.js";
+import "../chunk-SIKTYKVO.js";
+import "../chunk-PZWVTEL2.js";
 import "../chunk-CY6AWCC6.js";
 import "../chunk-ALVC7G6R.js";
 import "../chunk-JFYE5BFI.js";
 import "../chunk-NQX7WBA4.js";
-import "../chunk-V364DYC3.js";
 import "../chunk-XBHDQK4Z.js";
-import "../chunk-X7W6S3TE.js";
+import "../chunk-IU457W7Q.js";
 import "../chunk-F4WUVOLE.js";
-import "../chunk-Q5KHBU7P.js";
-import "../chunk-XNK2KUTI.js";
-import "../chunk-N5CUDEUJ.js";
+import "../chunk-QH57EOKP.js";
+import "../chunk-SXE7H3VK.js";
+import "../chunk-LHHBOQUR.js";
 import "../chunk-HFDLUBWN.js";
-import "../chunk-DZDWNOEY.js";
-import "../chunk-5GDMWWYD.js";
+import "../chunk-5GZEX4HV.js";
+import "../chunk-2BDD6OHG.js";
 import "../chunk-EZYKRG4W.js";
 import "../chunk-XZYIH3AF.js";
 import "../chunk-2ESYSVXG.js";

package/dist/{chunk-5GDMWWYD.js → chunk-2BDD6OHG.js}

@@ -51,7 +51,7 @@ function runMigrations(db) {
       config_json TEXT NOT NULL,
       state TEXT NOT NULL DEFAULT 'preparing',
       state_message TEXT,
-      template_sprite TEXT,
+      template_sandbox TEXT,
       checkpoint_id TEXT,
       created_at INTEGER NOT NULL,
       archived_at INTEGER
@@ -62,7 +62,7 @@ function runMigrations(db) {
       agent_id TEXT NOT NULL,
       agent_version INTEGER NOT NULL,
       environment_id TEXT NOT NULL,
-      sprite_name TEXT,
+      sandbox_name TEXT,
       -- Legacy name: holds any backend's session id (claude's session_id or
       -- opencode's sessionID). Kept as claude_session_id to avoid schema
       -- churn; see lib/backends/types.ts for the abstraction.
@@ -444,6 +444,14 @@ function runMigrations(db) {
       UNIQUE(vault_id, display_name)
     )
   `);
+  const sessCols3 = db.prepare(`PRAGMA table_info(sessions)`).all();
+  if (sessCols3.some((c) => c.name === "sprite_name")) {
+    db.exec(`ALTER TABLE sessions RENAME COLUMN sprite_name TO sandbox_name`);
+  }
+  const envCols3 = db.prepare(`PRAGMA table_info(environments)`).all();
+  if (envCols3.some((c) => c.name === "template_sprite")) {
+    db.exec(`ALTER TABLE environments RENAME COLUMN template_sprite TO template_sandbox`);
+  }
 }
 var init_migrations = __esm({
   "src/db/migrations.ts"() {

package/dist/{chunk-7YYEE7XR.js → chunk-2BZ2XKJU.js}

@@ -4,14 +4,14 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-2FWZ247V.js";
+} from "./chunk-6IWTDQJN.js";
 import {
   getProxiedTenantId
-} from "./chunk-7BGILLYC.js";
+} from "./chunk-NIOWKTIF.js";
 import {
   getSession,
   updateSessionResources
-} from "./chunk-MBLMAWSE.js";
+} from "./chunk-I5ZA45YL.js";
 import {
   countResources,
   createResource,
@@ -19,11 +19,11 @@ import {
   getResource,
   init_session_resources,
   listResources
-} from "./chunk-LPWEFC55.js";
+} from "./chunk-R5OZHLAD.js";
 import {
   getDb,
   init_client
-} from "./chunk-DZDWNOEY.js";
+} from "./chunk-5GZEX4HV.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-OHYPVKTP.js → chunk-3LG7DRJL.js}

@@ -1,16 +1,16 @@
 import {
   disableUpstreamKey,
   selectNextUpstreamKey
-} from "./chunk-V7OXXKAL.js";
+} from "./chunk-BZ6HFTHU.js";
 import {
   listEntries
-} from "./chunk-UN3LHCWQ.js";
+} from "./chunk-VIGJQU6V.js";
 import {
   getSession
-} from "./chunk-MBLMAWSE.js";
+} from "./chunk-I5ZA45YL.js";
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 
 // src/providers/upstream-keys.ts
 var CONSECUTIVE_FAIL_THRESHOLD = 3;

package/dist/{chunk-ZA4JVJJE.js → chunk-3PLJHZFD.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 
 // src/backends/opencode/auth.ts
 function buildOpencodeAuthEnv() {

package/dist/{chunk-ME6IR4T6.js → chunk-3W6KEDQE.js}

@@ -1,13 +1,13 @@
 // src/backends/gemini/wrapper-script.ts
 var GEMINI_WRAPPER_PATH = "/tmp/.gemini-wrapper";
-var SPRITE_WRAPPER_SCRIPT = [
+var SANDBOX_WRAPPER_SCRIPT = [
   "#!/bin/bash",
   'while IFS= read -r line; do [ -z "$line" ] && break; export "$line"; done',
   'exec gemini "$@"'
 ].join("\n");
-async function installGeminiWrapper(spriteName, provider) {
-  const escaped = SPRITE_WRAPPER_SCRIPT.replace(/'/g, "'\\''");
-  await provider.exec(spriteName, [
+async function installGeminiWrapper(sandboxName, provider) {
+  const escaped = SANDBOX_WRAPPER_SCRIPT.replace(/'/g, "'\\''");
+  await provider.exec(sandboxName, [
     "bash",
     "-c",
     `printf '%s' '${escaped}' > ${GEMINI_WRAPPER_PATH} && chmod +x ${GEMINI_WRAPPER_PATH}`

package/dist/{chunk-PMEF3X3C.js → chunk-46LBKEBE.js}

@@ -8,14 +8,14 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-2FWZ247V.js";
+} from "./chunk-6IWTDQJN.js";
 import {
   snapshotApiMetrics
 } from "./chunk-D2XITRN6.js";
 import {
   getDb,
   init_client
-} from "./chunk-DZDWNOEY.js";
+} from "./chunk-5GZEX4HV.js";
 import {
   badRequest
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-XLMHG3KR.js → chunk-5DHH2PGR.js}

@@ -5,6 +5,11 @@ import {
   childSpan,
   newTrace
 } from "./chunk-AU4NAQGA.js";
+import {
+  buildErrorPayload,
+  classifyError,
+  init_errors
+} from "./chunk-H6TQGV4L.js";
 import {
   injectMcpAuthHeaders
 } from "./chunk-SV2B3P6B.js";
@@ -16,37 +21,22 @@ import {
 } from "./chunk-72BKGVBE.js";
 import {
   loadSessionSecrets
-} from "./chunk-X3U7IVTN.js";
-import {
-  buildErrorPayload,
-  classifyError,
-  init_errors
-} from "./chunk-H6TQGV4L.js";
+} from "./chunk-7OAMTB47.js";
 import {
   isProxied
-} from "./chunk-7BGILLYC.js";
+} from "./chunk-NIOWKTIF.js";
 import {
   acquireForFirstTurn,
   installSkills,
   provisionResources
-} from "./chunk-4BYPJFC5.js";
+} from "./chunk-JOAEFGXZ.js";
 import {
   BLOCKED_ENV_KEYS
-} from "./chunk-3WJMUX5B.js";
+} from "./chunk-DO4WVWW7.js";
 import {
   appendEvent,
   appendEventsBatch
-} from "./chunk-MXRGQRFX.js";
-import {
-  listEvents,
-  markUserEventProcessed
-} from "./chunk-AHHH4PYB.js";
-import {
-  getBySession
-} from "./chunk-AKRE4OEL.js";
-import {
-  resolveContainerProvider
-} from "./chunk-5A6E4F5D.js";
+} from "./chunk-BMPB7XJH.js";
 import {
   bumpSessionStats,
   getOutcomeCriteria,
@@ -57,16 +47,26 @@ import {
   setOutcomeCriteria,
   updateSessionMutable,
   updateSessionStatus
-} from "./chunk-MBLMAWSE.js";
+} from "./chunk-I5ZA45YL.js";
+import {
+  listEvents,
+  markUserEventProcessed
+} from "./chunk-O45IQUWS.js";
+import {
+  getBySession
+} from "./chunk-EFOIR7R3.js";
+import {
+  resolveContainerProvider
+} from "./chunk-JSLEB2ED.js";
 import {
   getEnvironment
-} from "./chunk-XTZ5RQDF.js";
+} from "./chunk-NUO56TF7.js";
 import {
   getAgent
-} from "./chunk-BAH4JSTO.js";
+} from "./chunk-JEI7I3EH.js";
 import {
   resolveBackend
-} from "./chunk-OGONPLTA.js";
+} from "./chunk-QFUJDBET.js";
 import {
   PERMISSION_BRIDGE_PENDING_PATH,
   PERMISSION_BRIDGE_REQUEST_PATH,
@@ -77,7 +77,7 @@ import {
 } from "./chunk-XBHDQK4Z.js";
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 import {
   init_clock,
   nowMs
@@ -181,14 +181,17 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
   if (row && row.title == null) {
     const firstText = inputs.find((i) => i.kind === "text");
     if (firstText?.text) {
-      updateSessionMutable(sessionId, { title: firstText.text.slice(0, 60) });
+      const sanitized = firstText.text.replace(/[\x00-\x1F\x7F\u200B-\u200F\u2028-\u202F\uFEFF]/g, "").replace(/^Image(?=[A-Z])/g, "").replace(/\s+/g, " ").trim();
+      if (sanitized) {
+        updateSessionMutable(sessionId, { title: sanitized.slice(0, 60) });
+      }
     }
   }
   console.log(`[driver] ${sessionId} acquiring container...`);
-  let spriteName;
+  let sandboxName;
   try {
-    spriteName = await acquireForFirstTurn(sessionId);
-    console.log(`[driver] ${sessionId} container ready: ${spriteName}`);
+    sandboxName = await acquireForFirstTurn(sessionId);
+    console.log(`[driver] ${sessionId} container ready: ${sandboxName}`);
     const latestAgent = getAgent(session.agent.id);
     if (latestAgent && latestAgent.skills && latestAgent.skills.length > 0) {
       const currentSkills = new Map((agent.skills ?? []).map((s) => [s.name, s.content.length]));
@@ -199,7 +202,7 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
         console.log(`[driver] ${sessionId} injecting ${newSkills.length} new skill(s)...`);
         const envRow = getEnvironment(session.environment_id);
         const sp = await resolveContainerProvider(envRow?.config?.provider);
-        await installSkills(spriteName, sp, newSkills, agent.engine);
+        await installSkills(sandboxName, sp, newSkills, agent.engine);
         console.log(`[driver] ${sessionId} skills injected`);
       }
     }
@@ -207,7 +210,7 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
     if (freshSession2?.resources && freshSession2.resources.length > 0) {
       const envRow = getEnvironment(session.environment_id);
       const sp = await resolveContainerProvider(envRow?.config?.provider);
-      await provisionResources(spriteName, freshSession2.resources, sp);
+      await provisionResources(sandboxName, freshSession2.resources, sp);
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -271,7 +274,7 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
     let ollamaHostPort;
     if (!turnBuild.env.OLLAMA_HOST) {
       const envRow = getEnvironment(session.environment_id);
-      const provName = envRow?.config?.provider ?? "sprites";
+      const provName = envRow?.config?.provider ?? "docker";
       if (provName === "docker" || provName === "podman") {
         ollamaHostPort = "host.docker.internal:11434";
       } else if (provName === "apple-container" || provName === "apple-firecracker") {
@@ -328,19 +331,19 @@ ${turnBuild.stdin}`;
   });
   if (agent.engine === "claude" && toolResults.length > 0) {
     const { TOOL_BRIDGE_RESPONSE_PATH, TOOL_BRIDGE_PENDING_PATH } = await import("./backends/claude/tool-bridge.js");
-    const spriteName2 = getSessionRow(sessionId)?.sprite_name;
-    if (spriteName2) {
+    const sandboxName2 = getSessionRow(sessionId)?.sandbox_name;
+    if (sandboxName2) {
       for (const r of toolResults) {
         const responseJson = JSON.stringify({ content: r.content });
         await provider.exec(
-          spriteName2,
+          sandboxName2,
           ["bash", "-c", `cat > ${TOOL_BRIDGE_RESPONSE_PATH}`],
           { stdin: responseJson, secrets }
         ).catch((err) => {
           console.warn(`[driver] failed to write tool bridge response:`, err);
         });
         await provider.exec(
-          spriteName2,
+          sandboxName2,
           ["rm", "-f", TOOL_BRIDGE_PENDING_PATH],
           { secrets }
         ).catch(() => {
@@ -357,7 +360,7 @@ ${turnBuild.stdin}`;
   });
   let exec;
   try {
-    exec = await provider.startExec(spriteName, {
+    exec = await provider.startExec(sandboxName, {
       argv,
       stdin,
       signal: controller.signal,
@@ -379,7 +382,7 @@ ${turnBuild.stdin}`;
   let permissionPollTimer = null;
   if (agent.confirmation_mode) {
     permissionPollTimer = setInterval(() => {
-      void checkPermissionSentinel(sessionId, spriteName, provider).catch(
+      void checkPermissionSentinel(sessionId, sandboxName, provider).catch(
         (err) => {
           console.warn(`[driver] permission sentinel check failed:`, err);
         }
@@ -511,12 +514,12 @@ ${turnBuild.stdin}`;
     result?.usage
   );
   const sessionRowForSync = getSessionRow(sessionId);
-  if (sessionRowForSync?.sprite_name && !isProxied(sessionId)) {
+  if (sessionRowForSync?.sandbox_name && !isProxied(sessionId)) {
     try {
       const { syncContainerFiles } = await import("./sync/container-file-sync.js");
       const syncResult = await syncContainerFiles({
         sessionId,
-        spriteName: sessionRowForSync.sprite_name,
+        sandboxName: sessionRowForSync.sandbox_name,
         provider,
         secrets
       });
@@ -541,7 +544,7 @@ ${turnBuild.stdin}`;
       emit("session.status_idle", { stop_reason: formatStopReason("custom_tool_call", customToolEventIds) }, { at: now });
       updateSessionStatus(sessionId, "idle", "custom_tool_call");
       const { TOOL_BRIDGE_RESPONSE_PATH, TOOL_BRIDGE_PENDING_PATH } = await import("./backends/claude/tool-bridge.js");
-      const sprName = getSessionRow(sessionId)?.sprite_name;
+      const sprName = getSessionRow(sessionId)?.sandbox_name;
       if (sprName) {
         const responseJson = JSON.stringify({ content: [{ type: "text", text: serverToolResult.text }] });
         const envForSession = getEnvironment(session.environment_id);
@@ -691,11 +694,11 @@ function getPendingConfirmations() {
   if (!gd.__caPendingConfirmations) gd.__caPendingConfirmations = /* @__PURE__ */ new Set();
   return gd.__caPendingConfirmations;
 }
-async function checkPermissionSentinel(sessionId, spriteName, provider) {
+async function checkPermissionSentinel(sessionId, sandboxName, provider) {
   if (getPendingConfirmations().has(sessionId)) return;
   try {
     const result = await provider.exec(
-      spriteName,
+      sandboxName,
       ["test", "-f", PERMISSION_BRIDGE_PENDING_PATH]
     );
     if (result.exit_code !== 0) return;
@@ -705,7 +708,7 @@ async function checkPermissionSentinel(sessionId, spriteName, provider) {
   let request;
   try {
     const result = await provider.exec(
-      spriteName,
+      sandboxName,
       ["cat", PERMISSION_BRIDGE_REQUEST_PATH]
     );
     request = JSON.parse(result.stdout);
@@ -727,8 +730,8 @@ async function checkPermissionSentinel(sessionId, spriteName, provider) {
 }
 async function writePermissionResponse(sessionId, result, denyMessage) {
   const row = getSessionRow(sessionId);
-  if (!row?.sprite_name) {
-    console.warn(`[driver] no sprite for session ${sessionId}, cannot write permission response`);
+  if (!row?.sandbox_name) {
+    console.warn(`[driver] no sandbox for session ${sessionId}, cannot write permission response`);
     return;
   }
   const env = getEnvironment(row.environment_id);
@@ -740,7 +743,7 @@ async function writePermissionResponse(sessionId, result, denyMessage) {
   });
   try {
     await provider.exec(
-      row.sprite_name,
+      row.sandbox_name,
       ["bash", "-c", `cat > ${PERMISSION_BRIDGE_RESPONSE_PATH}`],
       { stdin: response, secrets: permSecrets }
     );

package/dist/{chunk-6QDHS2MR.js → chunk-5GIZLWWF.js}

@@ -1,6 +1,6 @@
 import {
   buildOpenApiDocument
-} from "./chunk-BM34UHSS.js";
+} from "./chunk-Y27R572J.js";
 
 // src/handlers/openapi.ts
 function originFromRequest(request) {

package/dist/{chunk-DZDWNOEY.js → chunk-5GZEX4HV.js}

@@ -1,7 +1,7 @@
 import {
   init_migrations,
   runMigrations
-} from "./chunk-5GDMWWYD.js";
+} from "./chunk-2BDD6OHG.js";
 import {
   __esm
 } from "./chunk-2ESYSVXG.js";

package/dist/{chunk-V364DYC3.js → chunk-5XF65N7J.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 
 // src/backends/codex/auth.ts
 function buildCodexAuthEnv() {

package/dist/{chunk-6UXT3RG5.js → chunk-64ZLFLMN.js}

@@ -1,6 +1,6 @@
 import {
   SUPPORTED_PROVIDERS
-} from "./chunk-OHYPVKTP.js";
+} from "./chunk-3LG7DRJL.js";
 import {
   addUpstreamKey,
   deleteUpstreamKey,
@@ -8,20 +8,20 @@ import {
   enableUpstreamKey,
   getUpstreamKey,
   listUpstreamKeys
-} from "./chunk-V7OXXKAL.js";
+} from "./chunk-BZ6HFTHU.js";
 import {
   requireGlobalAdmin
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-RL6XEYOD.js";
+} from "./chunk-MHQXDTJB.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-2FWZ247V.js";
+} from "./chunk-6IWTDQJN.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-JMDS2RJJ.js → chunk-66CJ6LMV.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 
 // src/backends/pi/auth.ts
 function buildPiAuthEnv() {

package/dist/{chunk-2FWZ247V.js → chunk-6IWTDQJN.js}

@@ -3,14 +3,14 @@ import {
   recordApiRequest
 } from "./chunk-D2XITRN6.js";
 import {
-  authenticate
-} from "./chunk-VVH5DQ2C.js";
+  authenticateAndIntercept
+} from "./chunk-PWWRWR75.js";
 import {
   checkAndBump
 } from "./chunk-HVUWXUUI.js";
 import {
   ensureInitialized
-} from "./chunk-CX4VNHL6.js";
+} from "./chunk-AH7DAJU5.js";
 import {
   captureException
 } from "./chunk-3MQ2FWXS.js";
@@ -26,7 +26,12 @@ async function routeWrap(request, handler) {
   let status = 500;
   try {
     await ensureInitialized();
-    const auth = await authenticate(request);
+    const result = await authenticateAndIntercept(request);
+    if (result.kind === "response") {
+      status = result.response.status;
+      return result.response;
+    }
+    const auth = result.auth;
     const retryAfter = await checkAndBump(auth.keyId, auth.rateLimitRpm);
     if (retryAfter != null) {
       const err = tooManyRequests(

package/dist/{chunk-TQHS4W74.js → chunk-6OL43KT2.js}

@@ -4,7 +4,7 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-2FWZ247V.js";
+} from "./chunk-6IWTDQJN.js";
 
 // src/handlers/license.ts
 function handleGetLicense(request) {

package/dist/{chunk-JZ5RFO77.js → chunk-7LQN7NVU.js}

@@ -1,11 +1,11 @@
 import {
   installCodexWrapper
-} from "./chunk-DFE7VZWD.js";
+} from "./chunk-RMEX55EU.js";
 
 // src/backends/codex/setup.ts
 var SENTINEL_NAME = ".claude-agents-codex-installed";
-async function prepareCodexOnSprite(spriteName, provider) {
-  await installCodexWrapper(spriteName, provider);
+async function prepareCodexOnSandbox(sandboxName, provider) {
+  await installCodexWrapper(sandboxName, provider);
   const script = [
     "set -euo pipefail",
     `SENTINEL="$HOME/${SENTINEL_NAME}"`,
@@ -16,7 +16,7 @@ async function prepareCodexOnSprite(spriteName, provider) {
     "/usr/local/bin/codex --version || $PREFIX/bin/codex --version",
     'touch "$SENTINEL"'
   ].join(" && ");
-  const result = await provider.exec(spriteName, ["bash", "-c", script], {
+  const result = await provider.exec(sandboxName, ["bash", "-c", script], {
     timeoutMs: 5 * 6e4
   });
   if (result.exit_code !== 0) {
@@ -27,5 +27,5 @@ async function prepareCodexOnSprite(spriteName, provider) {
 }
 
 export {
-  prepareCodexOnSprite
+  prepareCodexOnSandbox
 };

package/dist/{chunk-X3U7IVTN.js → chunk-7OAMTB47.js}

@@ -1,9 +1,9 @@
 import {
   listCredentialsWithTokens
-} from "./chunk-HWTECG57.js";
+} from "./chunk-J4TYHQQG.js";
 import {
   listEntries
-} from "./chunk-UN3LHCWQ.js";
+} from "./chunk-VIGJQU6V.js";
 
 // src/sessions/secrets.ts
 function loadSessionSecrets(vaultIds) {

package/dist/{chunk-I3AP3LEY.js → chunk-ACKMNK3C.js}

@@ -1,18 +1,18 @@
 import {
   onAfterCommit
-} from "./chunk-MXRGQRFX.js";
-import {
-  listEventsByTrace
-} from "./chunk-AHHH4PYB.js";
+} from "./chunk-BMPB7XJH.js";
 import {
   getSessionRow
-} from "./chunk-MBLMAWSE.js";
+} from "./chunk-I5ZA45YL.js";
+import {
+  listEventsByTrace
+} from "./chunk-O45IQUWS.js";
 import {
   getAgent
-} from "./chunk-BAH4JSTO.js";
+} from "./chunk-JEI7I3EH.js";
 import {
   getConfig
-} from "./chunk-Q5KHBU7P.js";
+} from "./chunk-QH57EOKP.js";
 
 // src/observability/otlp.ts
 import { createHash } from "crypto";

package/dist/{chunk-IJEZAD5O.js → chunk-ADK2TYO4.js}

@@ -5,10 +5,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-XNK2KUTI.js";
+} from "./chunk-SXE7H3VK.js";
 import {
   schema_exports
-} from "./chunk-N5CUDEUJ.js";
+} from "./chunk-LHHBOQUR.js";
 import {
   init_clock,
   nowMs