@agentuity/server 1.0.14 → 1.0.16

package/src/api/region/create.ts

@@ -103,6 +103,13 @@ export function validateBucketName(name: string): { valid: boolean; error?: stri
 	if (isIPv4Address(name)) {
 		return { valid: false, error: 'bucket name cannot be an IP address' };
 	}
+	// Reserved prefixes (system-generated names)
+	if (name.startsWith('ag-') || name.startsWith('ago-')) {
+		return {
+			valid: false,
+			error: 'bucket names starting with "ag-" or "ago-" are reserved for system use',
+		};
+	}
 	return { valid: true };
 }
 

package/src/api/sandbox/create.ts

@@ -1,6 +1,7 @@
 import type { SandboxCreateOptions, SandboxStatus } from '@agentuity/core';
 import { z } from 'zod';
 import { type APIClient, APIResponseSchema } from '../api';
+import { NPM_PACKAGE_NAME_PATTERN } from './snapshot-build';
 import { API_VERSION, throwSandboxError } from './util';
 
 export const SandboxCreateRequestSchema = z
@@ -86,6 +87,17 @@ export const SandboxCreateRequestSchema = z
 			.array(z.string())
 			.optional()
 			.describe('Apt packages to install when creating the sandbox'),
+		packages: z
+			.array(
+				z
+					.string()
+					.regex(
+						NPM_PACKAGE_NAME_PATTERN,
+						'Invalid npm/bun package specifier: must not contain whitespace, semicolons, backticks, pipes, or dollar signs'
+					)
+			)
+			.optional()
+			.describe('npm/bun packages to install globally when creating the sandbox'),
 		metadata: z
 			.record(z.string(), z.unknown())
 			.optional()
@@ -202,6 +214,9 @@ export async function sandboxCreate(
 	if (options.dependencies && options.dependencies.length > 0) {
 		body.dependencies = options.dependencies;
 	}
+	if (options.packages && options.packages.length > 0) {
+		body.packages = options.packages;
+	}
 	if (options.metadata) {
 		body.metadata = options.metadata;
 	}

package/src/api/sandbox/get.ts

@@ -123,6 +123,10 @@ export const SandboxInfoDataSchema = z
 			.array(z.string())
 			.optional()
 			.describe('Apt packages installed in the sandbox'),
+		packages: z
+			.array(z.string())
+			.optional()
+			.describe('npm/bun packages installed globally in the sandbox'),
 		metadata: z
 			.record(z.string(), z.unknown())
 			.optional()
@@ -209,6 +213,7 @@ export async function sandboxGet(
 			stdoutStreamUrl: resp.data.stdoutStreamUrl,
 			stderrStreamUrl: resp.data.stderrStreamUrl,
 			dependencies: resp.data.dependencies,
+			packages: resp.data.packages,
 			metadata: resp.data.metadata as Record<string, unknown> | undefined,
 			resources: resp.data.resources,
 			cpuTimeMs: resp.data.cpuTimeMs,

package/src/api/sandbox/index.ts

@@ -171,7 +171,7 @@ export {
 	snapshotUpload,
 } from './snapshot';
 export type { SnapshotBuildFile } from './snapshot-build';
-export { SnapshotBuildFileSchema } from './snapshot-build';
+export { SnapshotBuildFileSchema, NPM_PACKAGE_NAME_PATTERN } from './snapshot-build';
 export type { SandboxErrorCode, SandboxErrorContext } from './util';
 export {
 	ExecutionCancelledError,

package/src/api/sandbox/snapshot-build.ts

@@ -1,5 +1,17 @@
 import { z } from 'zod';
 
+/**
+ * Regex pattern for validating npm/bun package specifiers.
+ * Uses a blocklist approach: rejects shell injection characters while allowing
+ * all legitimate specifier formats (names, scoped packages, URLs, git refs, etc.).
+ *
+ * Valid examples: "typescript", "@types/node", "opencode-ai@1.2.3",
+ *   "https://github.com/user/repo", "git+https://github.com/user/repo.git",
+ *   "github:user/repo", "file:../local-pkg"
+ * Invalid examples: "foo bar", "pkg;rm -rf", "pkg|cat /etc/passwd", "$(evil)"
+ */
+export const NPM_PACKAGE_NAME_PATTERN = /^[^\s;`|$]+$/;
+
 /**
  * Base schema for snapshot build configuration file (agentuity-snapshot.yaml)
  * This is the canonical schema - used for JSON Schema generation.
@@ -22,6 +34,19 @@ export const SnapshotBuildFileBaseSchema = z
 			.describe(
 				'List of apt packages to install. Supports version pinning: package=version or package=version* for prefix matching'
 			),
+		packages: z
+			.array(
+				z
+					.string()
+					.regex(
+						NPM_PACKAGE_NAME_PATTERN,
+						'Invalid npm/bun package specifier: must not contain whitespace, semicolons, backticks, pipes, or dollar signs'
+					)
+			)
+			.optional()
+			.describe(
+				'List of npm/bun packages to install globally via bun install -g. Example: opencode-ai, typescript'
+			),
 		files: z
 			.array(z.string())
 			.optional()
@@ -49,17 +74,18 @@ export const SnapshotBuildFileBaseSchema = z
 
 /**
  * Schema with validation refinement - use this for parsing/validation.
- * Ensures at least one of dependencies, files, or env is specified.
+ * Ensures at least one of dependencies, files, env, or packages is specified.
  */
 export const SnapshotBuildFileSchema = SnapshotBuildFileBaseSchema.refine(
 	(data) => {
 		const hasDependencies = data.dependencies && data.dependencies.length > 0;
 		const hasFiles = data.files && data.files.length > 0;
 		const hasEnv = data.env && Object.keys(data.env).length > 0;
-		return hasDependencies || hasFiles || hasEnv;
+		const hasPackages = data.packages && data.packages.length > 0;
+		return hasDependencies || hasFiles || hasEnv || hasPackages;
 	},
 	{
-		message: 'At least one of dependencies, files, or env must be specified',
+		message: 'At least one of dependencies, files, env, or packages must be specified',
 	}
 );
 

package/src/api/sandbox/snapshot.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { type APIClient, APIResponseSchema, APIResponseSchemaNoData } from '../api';
+import { NPM_PACKAGE_NAME_PATTERN } from './snapshot-build';
 import { API_VERSION, SandboxResponseError, throwSandboxError } from './util';
 
 export const SnapshotFileInfoSchema = z
@@ -594,6 +595,17 @@ const _SnapshotBuildFinalizeParamsSchema = z
 		fileCount: z.number().describe('Number of files in the snapshot'),
 		files: z.array(SnapshotFileInfoSchema).describe('List of files with path and size'),
 		dependencies: z.array(z.string()).optional().describe('List of apt packages to install'),
+		packages: z
+			.array(
+				z
+					.string()
+					.regex(
+						NPM_PACKAGE_NAME_PATTERN,
+						'Invalid npm/bun package specifier: must not contain whitespace, semicolons, backticks, pipes, or dollar signs'
+					)
+			)
+			.optional()
+			.describe('List of npm/bun packages to install globally'),
 		env: z.record(z.string(), z.string()).optional().describe('Environment variables to set'),
 		metadata: z
 			.record(z.string(), z.string())
@@ -671,7 +683,8 @@ export async function snapshotBuildFinalize(
 	client: APIClient,
 	params: SnapshotBuildFinalizeParams
 ): Promise<SnapshotInfo> {
-	const { snapshotId, sizeBytes, fileCount, files, dependencies, env, metadata, orgId } = params;
+	const { snapshotId, sizeBytes, fileCount, files, dependencies, packages, env, metadata, orgId } =
+		params;
 	const queryString = buildQueryString({ orgId });
 	const url = `/sandbox/${API_VERSION}/snapshots/${snapshotId}/finalize${queryString}`;
 
@@ -681,6 +694,7 @@ export async function snapshotBuildFinalize(
 		files,
 	};
 	if (dependencies) body.dependencies = dependencies;
+	if (packages) body.packages = packages;
 	if (env) body.env = env;
 	if (metadata) body.metadata = metadata;
 

package/src/index.ts

@@ -13,6 +13,9 @@ export { createServerFetchAdapter } from './server';
 // schema.ts exports
 export { toJSONSchema } from './schema';
 
+// util/mime.ts exports
+export { getContentType, mimeTypes } from './util/mime';
+
 // util/resources.ts exports
 export {
 	validateCPUSpec,

package/src/util/mime.ts

@@ -0,0 +1,109 @@
+/**
+ * Canonical MIME type map and content-type lookup.
+ *
+ * This is the single source of truth for extension → MIME type mappings
+ * used across the CLI (build metadata, generated entry code) and runtime
+ * (serveStatic).
+ */
+
+export const mimeTypes: Record<string, string> = {
+	// Text and code
+	css: 'text/css',
+	csv: 'text/csv',
+	htm: 'text/html',
+	html: 'text/html',
+	ics: 'text/calendar',
+	js: 'application/javascript',
+	mjs: 'application/javascript',
+	cjs: 'application/javascript',
+	json: 'application/json',
+	jsonld: 'application/ld+json',
+	map: 'application/json',
+	md: 'text/markdown',
+	markdown: 'text/markdown',
+	txt: 'text/plain',
+	text: 'text/plain',
+	vcf: 'text/vcard',
+	xml: 'application/xml',
+	yaml: 'text/yaml',
+	yml: 'text/yaml',
+
+	// Images
+	apng: 'image/apng',
+	avif: 'image/avif',
+	bmp: 'image/bmp',
+	gif: 'image/gif',
+	ico: 'image/x-icon',
+	jpeg: 'image/jpeg',
+	jpg: 'image/jpeg',
+	jxl: 'image/jxl',
+	png: 'image/png',
+	svg: 'image/svg+xml',
+	tif: 'image/tiff',
+	tiff: 'image/tiff',
+	webp: 'image/webp',
+
+	// Fonts
+	eot: 'application/vnd.ms-fontobject',
+	otf: 'font/otf',
+	ttf: 'font/ttf',
+	woff: 'font/woff',
+	woff2: 'font/woff2',
+
+	// Audio
+	aac: 'audio/aac',
+	flac: 'audio/flac',
+	m4a: 'audio/mp4',
+	mid: 'audio/midi',
+	midi: 'audio/midi',
+	mp3: 'audio/mpeg',
+	ogg: 'audio/ogg',
+	oga: 'audio/ogg',
+	opus: 'audio/opus',
+	wav: 'audio/wav',
+	weba: 'audio/webm',
+
+	// Video
+	avi: 'video/x-msvideo',
+	m4v: 'video/mp4',
+	mkv: 'video/x-matroska',
+	mov: 'video/quicktime',
+	mp4: 'video/mp4',
+	ogv: 'video/ogg',
+	webm: 'video/webm',
+
+	// Documents and archives
+	doc: 'application/msword',
+	docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+	gz: 'application/gzip',
+	odp: 'application/vnd.oasis.opendocument.presentation',
+	ods: 'application/vnd.oasis.opendocument.spreadsheet',
+	odt: 'application/vnd.oasis.opendocument.text',
+	pdf: 'application/pdf',
+	ppt: 'application/vnd.ms-powerpoint',
+	pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+	rtf: 'application/rtf',
+	tar: 'application/x-tar',
+	xls: 'application/vnd.ms-excel',
+	xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+	zip: 'application/zip',
+	'7z': 'application/x-7z-compressed',
+
+	// Web and application
+	atom: 'application/atom+xml',
+	glb: 'model/gltf-binary',
+	gltf: 'model/gltf+json',
+	rss: 'application/rss+xml',
+	wasm: 'application/wasm',
+	webmanifest: 'application/manifest+json',
+	xsl: 'application/xslt+xml',
+	xslt: 'application/xslt+xml',
+};
+
+export function getContentType(filename: string): string {
+	const ext = filename.split('.').pop()?.toLowerCase();
+	if (ext && ext in mimeTypes) {
+		return mimeTypes[ext]!;
+	}
+	return 'application/octet-stream';
+}