@agimon-ai/po-sandbox 0.0.0-alpha.7 → 0.0.0-alpha.71

package/LICENSE

@@ -1,21 +1,149 @@
-MIT License
-
-Copyright (c) 2026 Vuong Ngo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -1,14 +1,57 @@
 # @agimon-ai/po-sandbox
 
-Run the Po web cockpit, its sessions, and their tools in a container while the browser stays on the host.
+Sandbox layer for Po: registers the `container` sandbox provider on the host, runs one container per
+sandboxed workspace, reports whether a session runs inside a container, and routes brokered providers when a
+launch grants a credential broker.
 
 Part of the [Po distribution](https://www.npmjs.com/package/@agimon-ai/po).
 
+## Status
+
+The host side of per-workspace containers is in place: the `container` provider, the shared image, and the
+container lifecycle. Sessions are not routed into a container yet, so a sandboxed workspace stays unavailable
+for sessions. See [The container plan and current wiring](../../../docs/securities.md#the-container-plan-and-current-wiring)
+for what the current server runtime connects.
+
+### The container provider
+
+When the layer loads on a host server's global scope, it registers the `container` provider in
+`po/workspace-sandboxes` and publishes the `po/workspace-containers` service. A contained server registers
+nothing, so containers never nest.
+
+At hub start, in the background:
+
+1. `docker info` checks the engine. A missing or stopped engine leaves the provider unavailable, with the reason.
+2. The provider needs the Linux Po runtime bundle at `~/.po/container-runtime/<version>/`, with its
+   `container-runtime.json`. Without it the provider reports "The container runtime is not installed." and starts
+   nothing. The json is validated first: only its known keys, and every path inside `/opt/po`. Otherwise the
+   provider reports why and starts nothing. The server runs from its `entry` with all of its `environment`.
+3. The image `po-sandbox:<digest>` is built once if missing: `node:24-bookworm-slim`, git, procps, ripgrep,
+   Chromium libraries and fonts, corepack, and the headless cloak browser at `/opt/cloak`.
+4. For each workspace whose sandbox is `container`, a running container labelled with this hub's `po.owner` and
+   the workspace's `po.workspace` is adopted. Otherwise stale `*.po-v4.lock` files under the workspace's sandbox
+   folder are deleted and a new container starts.
+
+Each container mounts the workspace at its own path, the runtime bundle read-only at `/opt/po`, and
+`P = ~/.po/sandboxes/<workspace>` at its own path with `PO_HOME=P`, so conversations and artifacts stay on host
+disk. Package caches, worktrees and the container home live in named volumes. The container publishes one port on
+host loopback only, runs with `--cap-drop=ALL`, `no-new-privileges` and a pid limit, and gets no credentials, no
+hub token, no engine socket, and no part of the host `~/.po` beyond `P`, the bundle, the three seed files
+(`modes.yaml`, `domains.yaml`, `config.yaml`, read-only) and its own token file (read-only).
+
+Every container runs with `--user`: the host user on Linux, `1000:1000` elsewhere (Docker Desktop maps it to the
+host user on shared folders). A new runtime or git volume is first mounted on a world-writable image folder, so it
+stays writable for that user, as the `/po-home` volume is.
+
+Containers outlive the hub process: a reload, an idle restart (exit 75) or a crash leaves them running, and the
+next start adopts them. A clean user stop stops them: the provider's `onCleanStop` hook in
+`po/workspace-sandboxes` calls `stopAll`. `po/workspace-containers` also exposes `stop` for switching the sandbox
+off.
+
 ## Requirements
 
 - Node.js 24 or newer
-- `@earendil-works/pi-coding-agent` 0.85.0
-- One of `docker`, `podman`, `nerdctl`, or `finch` on the host for the cockpit container
+- `@earendil-works/pi-coding-agent` 1.4.0
 
 ## Install
 
@@ -16,13 +59,10 @@ Part of the [Po distribution](https://www.npmjs.com/package/@agimon-ai/po).
 npm install @agimon-ai/po-sandbox
 ```
 
-The cockpit container is started by the web cockpit (`po`, which runs `po-web`) and requires this package in the
-selected major mode's layers, as shown below.
-
 ## Enable the sandbox
 
-This layer is still in development, so `po init` does not add it to any mode. Opt in by hand:
-name it as a layer in `.po/modes.yaml`, then list that layer on the mode you want it in.
+`po init` writes a `sandbox` layer and adds it to the `copilot` mode. To use it in another mode,
+list the layer on that mode in `.po/modes.yaml`:
 
 ```yaml
 layers:
@@ -36,119 +76,48 @@ majorMode:
     layers: [team, ask-user, task, sandbox]
 ```
 
-A mode without this layer offers no cockpit container, and the cockpit refuses containment rather
-than running uncontained.
-
-## Web cockpit container
-
-With this layer in the selected major mode, the web cockpit can hand over to one long-lived Linux
-container that holds the hub and every session it spawns:
-
-1. The cockpit resolves this package's `./cockpitHarness` export and delegates the container
-   lifecycle.
-2. The layer detects the first available engine in the order `docker`, `podman`, `nerdctl`,
-   `finch` (override with `PO_SANDBOX_ENGINE`), and builds a
-   cockpit image when that tag is not cached. The digest covers the image definition and bridge
-   source. The image installs `@agimon-ai/po-web` from the registry rather than copying the
-   host's platform-specific packages.
-3. It starts a detached container with each configured workspace bind-mounted at its host path,
-   a named home volume, and the cockpit port published on host loopback, then waits until the
-   cockpit inside answers `/api/health`.
-
-The browser stays on the host while bash, file edits, extensions, MCP servers, and skills all
-execute inside the container. `PO_SANDBOX=1` marks every sandboxed process; nesting is refused.
-See [The container plan and current wiring](../../../docs/securities.md#the-container-plan-and-current-wiring)
-for what the current server runtime connects.
-
-Only an allowlisted environment enters the container: terminal and locale variables, proxy
-settings, and `PO_PRESET`. Everything else a shell accumulates stays on the host.
-
-## Engine and runtime selection
-
-The harness invokes each supported engine with Docker-compatible arguments. The engine and its
-VM, if any, must already be running on the host.
-
-`PO_SANDBOX_RUN_FLAGS` passes extra options straight to the engine, which is how you select a
-different isolation runtime without the layer having to know about it:
+## In-session command
 
-```bash
-PO_SANDBOX_RUN_FLAGS=--runtime=runsc po
+```text
+/po-sandbox
 ```
 
-Options must be self-contained (`--flag` or `--flag=value`). A separated value such as
-`--runtime runsc` is refused, because a bare word cannot be told apart from an image name and
-would silently launch a different container.
-
-Alternative isolation runtimes such as Kata or Firecracker are not verified here. Check their
-mount and broker-transport support before relying on them.
-
-## Workspace dev containers
-
-The cockpit container ignores a workspace `.devcontainer` configuration. That file is
-author-controlled and could mount anything, including the container socket, which would make the
-containment claim false.
-
-## Signing in from inside the sandbox
-
-Subscription logins are not brokered. The cockpit container publishes only the cockpit port on
-host loopback, so a `/login` callback that a provider sends to `localhost:<port>` does not reach
-the container. Use a provider API key, which the credential broker below carries. Credentials stored inside the container land in the cockpit home
-volume, so they survive later runs.
-
-## Provider credential broker
+Reports whether the current session runs inside a sandbox container (the server's
+`po/sandbox-identity` says it is contained) or directly on the host.
 
-For supported providers with a host API key, the credential broker:
+## Brokered providers
 
-1. Starts a broker on the host and grants the container exactly one route to it.
-2. Replaces the credential variable with a random per-session token.
-3. Redirects the provider's base URL at a loopback bridge inside the container, which forwards
-   raw bytes to the broker.
+When a session's admitted environment names brokered providers (`PO_BROKER_PROVIDERS`) and a
+broker route (`PO_BROKER_SOCKET` or `PO_BROKER_ADDRESS`), the server plugin overrides those
+providers' base URLs so requests go through the broker. The session's credential variables are
+expected to hold the broker's session token, not the real key. With no broker route the layer
+changes nothing.
 
-How the container reaches the broker depends on the engine:
+How a container reaches the broker depends on the engine:
 
 | Host                          | Transport                                   | Why                                                                                |
 | ----------------------------- | ------------------------------------------- | ---------------------------------------------------------------------------------- |
 | Linux                         | Unix socket, bind-mounted, owner-only       | Container and host share a kernel, so no port is needed                            |
 | macOS, Windows, any VM engine | Loopback TCP through `host.docker.internal` | A container in a virtual machine cannot connect to a mounted host socket (ENOTSUP) |
 
-On the TCP path the broker binds `127.0.0.1` on an ephemeral port, so it is never exposed beyond
-the host, and the launch passes `--add-host` so the gateway name resolves on every engine. Another
-local process could reach that port, and the session token is what stops it being useful.
-
-The broker validates the token, swaps in the real key, and streams the provider response back.
-Credentials for providers it cannot carry are withheld from the container rather than passed
-through. Turn the whole mechanism off with `PO_SANDBOX_BROKER=0`.
-
-## In-session command
-
-```text
-/po-sandbox
-```
-
-Reports whether the current session runs inside the sandbox container or directly on the host.
+A socket route goes through a loopback bridge inside the container, because no SDK can dial a
+socket path. A TCP route is addressed directly.
 
 ## Current limits
 
-- The broker carries a curated provider list. OAuth subscription logins are not brokered, and
-  their callbacks cannot reach the cockpit container.
+- Sessions do not run in a container yet, and nothing starts a broker for a session.
+- The broker carries a curated provider list. OAuth subscription logins are not brokered.
 - A host `*_BASE_URL` override is dropped rather than used as the broker's upstream.
-- Compositions that declare local workspace packages cannot load their platform-specific
-  dependencies inside the Linux container; use registry-installed layers for sandboxed work.
-- One container holds every cockpit session, so sessions can read each other's mounted
-  workspaces.
-- Container network access follows the engine's defaults and is not restricted yet.
-- Mounted repositories are writable. Containers do not protect those files from agent edits,
-  and the container engine remains part of the trusted base.
 
 ## Public API
 
 ```ts
 import { DefaultSandboxExtensionService } from '@agimon-ai/po-sandbox';
-import { createCockpitHarness, startCockpitContainer } from '@agimon-ai/po-sandbox/cockpitHarness';
 ```
 
-The service layer is host-neutral. `/extensions/server` registers the in-session command, and
-`/cockpitHarness` owns the web cockpit's container lifecycle and credential broker.
+`DefaultSandboxExtensionService` reports sandbox state from the environment it is given.
+`/extensions/server` registers the in-session command, its Help resources, and the brokered
+provider overrides.
 
 ## Development
 
@@ -167,4 +136,4 @@ Maintained by [Agimon](https://agimon.ai/about).
 
 ## License
 
-MIT
+Business Source License 1.1: free for personal use, organisations under USD 1M revenue, non-profits and education. See [LICENSE](LICENSE) and https://agimon.ai/licensing.

package/dist/apiContracts.cjs

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#region src/schemas/apiContracts.ts
-/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
+/** This server plugin contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
 const apiContracts = (0, require("@agimon-ai/po-core/apiContracts").defineApiContract)({
 	version: 1,
 	http: [],

package/dist/apiContracts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.cjs","names":["defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/po-core/apiContracts';\n\n/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;;;AAGA,MAAa,gBAAA,4CAAeA,CAAAA,CAAAA,kBAAAA,CAAkB;CAAE,SAAS;CAAG,MAAM,CAAC;CAAG,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}
+{"version":3,"file":"apiContracts.cjs","names":["defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/po-core/apiContracts';\n\n/** This server plugin contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;;;AAGA,MAAa,gBAAA,4CAAeA,CAAAA,CAAAA,kBAAAA,CAAkB;CAAE,SAAS;CAAG,MAAM,CAAC;CAAG,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}

package/dist/apiContracts.d.mts

@@ -1,5 +1,5 @@
 //#region src/schemas/apiContracts.d.ts
-/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
+/** This server plugin contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
 export declare const apiContracts: {
   version: 1;
   protocols?: Record<string, string> | undefined;

package/dist/apiContracts.mjs

@@ -1,6 +1,6 @@
 import { defineApiContract } from "@agimon-ai/po-core/apiContracts";
 //#region src/schemas/apiContracts.ts
-/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
+/** This server plugin contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
 const apiContracts = defineApiContract({
 	version: 1,
 	http: [],

package/dist/apiContracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/po-core/apiContracts';\n\n/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAa,eAAe,kBAAkB;CAAE,SAAS;CAAG,MAAM,CAAC;CAAG,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/po-core/apiContracts';\n\n/** This server plugin contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAa,eAAe,kBAAkB;CAAE,SAAS;CAAG,MAAM,CAAC;CAAG,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}

package/dist/extensionService-628BZd5z.cjs

@@ -0,0 +1,25 @@
+//#region src/services/extensionService/index.ts
+const SANDBOXED_MESSAGE = "Sandboxed session: the agent, extensions, and tools run inside the container.";
+const HOST_MESSAGE = "Host session: the agent runs on the host. Per-workspace containers are not available yet.";
+var DefaultSandboxExtensionService = class {
+	identity;
+	/** `identity` is the server's `po/sandbox-identity`; a host server binds none. */
+	constructor(identity) {
+		this.identity = identity;
+	}
+	async execute() {
+		return {
+			message: this.identity?.contained === true ? SANDBOXED_MESSAGE : HOST_MESSAGE,
+			level: "info"
+		};
+	}
+};
+//#endregion
+Object.defineProperty(exports, "DefaultSandboxExtensionService", {
+	enumerable: true,
+	get: function() {
+		return DefaultSandboxExtensionService;
+	}
+});
+
+//# sourceMappingURL=extensionService-628BZd5z.cjs.map

package/dist/extensionService-628BZd5z.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensionService-628BZd5z.cjs","names":[],"sources":["../src/services/extensionService/index.ts"],"sourcesContent":["import type { PoSandboxIdentity } from '@agimon-ai/po-core/sandboxIdentity';\n\nimport type { SandboxExtensionResult, SandboxExtensionService } from '../../types/extension';\n\nconst SANDBOXED_MESSAGE = 'Sandboxed session: the agent, extensions, and tools run inside the container.';\nconst HOST_MESSAGE = 'Host session: the agent runs on the host. Per-workspace containers are not available yet.';\n\nexport class DefaultSandboxExtensionService implements SandboxExtensionService {\n  private readonly identity: PoSandboxIdentity | undefined;\n\n  /** `identity` is the server's `po/sandbox-identity`; a host server binds none. */\n  constructor(identity: PoSandboxIdentity | undefined) {\n    this.identity = identity;\n  }\n\n  async execute(): Promise<SandboxExtensionResult> {\n    return {\n      message: this.identity?.contained === true ? SANDBOXED_MESSAGE : HOST_MESSAGE,\n      level: 'info',\n    };\n  }\n}\n"],"mappings":";AAIA,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAErB,IAAa,iCAAb,MAA+E;CAC7E;;CAGA,YAAY,UAAyC;EACnD,KAAK,WAAW;CAClB;CAEA,MAAM,UAA2C;EAC/C,OAAO;GACL,SAAS,KAAK,UAAU,cAAc,OAAO,oBAAoB;GACjE,OAAO;EACT;CACF;AACF"}

package/dist/extensionService-Cz9QRLJ5.mjs

@@ -0,0 +1,20 @@
+//#region src/services/extensionService/index.ts
+const SANDBOXED_MESSAGE = "Sandboxed session: the agent, extensions, and tools run inside the container.";
+const HOST_MESSAGE = "Host session: the agent runs on the host. Per-workspace containers are not available yet.";
+var DefaultSandboxExtensionService = class {
+	identity;
+	/** `identity` is the server's `po/sandbox-identity`; a host server binds none. */
+	constructor(identity) {
+		this.identity = identity;
+	}
+	async execute() {
+		return {
+			message: this.identity?.contained === true ? SANDBOXED_MESSAGE : HOST_MESSAGE,
+			level: "info"
+		};
+	}
+};
+//#endregion
+export { DefaultSandboxExtensionService as t };
+
+//# sourceMappingURL=extensionService-Cz9QRLJ5.mjs.map

package/dist/extensionService-Cz9QRLJ5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensionService-Cz9QRLJ5.mjs","names":[],"sources":["../src/services/extensionService/index.ts"],"sourcesContent":["import type { PoSandboxIdentity } from '@agimon-ai/po-core/sandboxIdentity';\n\nimport type { SandboxExtensionResult, SandboxExtensionService } from '../../types/extension';\n\nconst SANDBOXED_MESSAGE = 'Sandboxed session: the agent, extensions, and tools run inside the container.';\nconst HOST_MESSAGE = 'Host session: the agent runs on the host. Per-workspace containers are not available yet.';\n\nexport class DefaultSandboxExtensionService implements SandboxExtensionService {\n  private readonly identity: PoSandboxIdentity | undefined;\n\n  /** `identity` is the server's `po/sandbox-identity`; a host server binds none. */\n  constructor(identity: PoSandboxIdentity | undefined) {\n    this.identity = identity;\n  }\n\n  async execute(): Promise<SandboxExtensionResult> {\n    return {\n      message: this.identity?.contained === true ? SANDBOXED_MESSAGE : HOST_MESSAGE,\n      level: 'info',\n    };\n  }\n}\n"],"mappings":";AAIA,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAErB,IAAa,iCAAb,MAA+E;CAC7E;;CAGA,YAAY,UAAyC;EACnD,KAAK,WAAW;CAClB;CAEA,MAAM,UAA2C;EAC/C,OAAO;GACL,SAAS,KAAK,UAAU,cAAc,OAAO,oBAAoB;GACjE,OAAO;EACT;CACF;AACF"}

package/dist/extensions/mcp.cjs

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 let _agimon_ai_po_core_mcpFacet = require("@agimon-ai/po-core/mcpFacet");
-let _agimon_ai_po_core_serverFacet = require("@agimon-ai/po-core/serverFacet");
-//#region src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp.ts
-var po_use_sandbox_mcp_default = (0, _agimon_ai_po_core_mcpFacet.defineMcpSkill)({
-	name: "po-use-sandbox",
-	description: "Use @agimon-ai/po-sandbox: Container sandbox for Po launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host",
-	read: () => (0, _agimon_ai_po_core_serverFacet.readPackageResource)(require("url").pathToFileURL(__filename).href, "src/prompts/po-use-sandbox/SKILL.md")
+let _agimon_ai_po_core_serverPlugin = require("@agimon-ai/po-core/serverPlugin");
+//#region src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp.ts
+var help_how_to_sandbox_mcp_default = (0, _agimon_ai_po_core_mcpFacet.defineMcpSkill)({
+	name: "help-how-to-sandbox",
+	description: "Use @agimon-ai/po-sandbox: Sandbox building blocks for Po: container engine detection, the sandbox image, and a host credential broker for per-workspace containers, which are not wired yet",
+	read: () => (0, _agimon_ai_po_core_serverPlugin.readPackageResource)(require("url").pathToFileURL(__filename).href, "src/prompts/help-how-to-sandbox/SKILL.md")
 });
 //#endregion
 //#region generated/mcp.ts
@@ -16,7 +16,7 @@ const at = (value, context) => typeof value === "function" ? value(context) : va
 const mcp = (0, _agimon_ai_po_core_mcpFacet.defineMcpPlugin)({
 	name: "@agimon-ai/po-sandbox",
 	session: (context) => ({ get skills() {
-		return [at(po_use_sandbox_mcp_default, context)];
+		return [at(help_how_to_sandbox_mcp_default, context)];
 	} })
 });
 //#endregion

package/dist/extensions/mcp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.cjs","names":["defineMcpSkill","readPackageResource","defineMcpPlugin","skillPoUseSandbox"],"sources":["../../src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp.ts","../../generated/mcp.ts"],"sourcesContent":["import { defineMcpSkill } from '@agimon-ai/po-core/mcpFacet';\nimport { readPackageResource } from '@agimon-ai/po-core/serverFacet';\n\nexport default defineMcpSkill({\n  name: 'po-use-sandbox',\n  description:\n    'Use @agimon-ai/po-sandbox: Container sandbox for Po launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host',\n  read: () => readPackageResource(import.meta.url, 'src/prompts/po-use-sandbox/SKILL.md'),\n});\n","// Generated by @agimon-ai/po-build. Do not edit by hand.\nimport { defineMcpPlugin, type PoMcpSessionPlugin } from '@agimon-ai/po-core/mcpFacet';\n\nimport skillPoUseSandbox from '../src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp';\n\ntype Factory<T, C> = (context: C) => T;\nconst at = <T, C>(value: T | Factory<T, C>, context: C): T =>\n  typeof value === 'function' ? (value as Factory<T, C>)(context) : value;\n\nexport const mcp = defineMcpPlugin({\n  name: '@agimon-ai/po-sandbox',\n  session: (context) => ({\n    get skills(): PoMcpSessionPlugin['skills'] { return [at(skillPoUseSandbox, context)]; },\n  }) satisfies PoMcpSessionPlugin,\n});\n\nexport default mcp;\n"],"mappings":";;;;;;;AAGA,IAAA,8BAAA,GAAeA,4BAAAA,eAAAA,CAAe;CAC5B,MAAM;CACN,aACE;CACF,aAAA,GAAYC,+BAAAA,oBAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,MAAqC,qCAAqC;AACxF,CAAC;;;ACFD,MAAM,MAAY,OAA0B,YAC1C,OAAO,UAAU,aAAc,MAAwB,OAAO,IAAI;AAEpE,MAAa,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB;CACjC,MAAM;CACN,UAAU,aAAa,EACrB,IAAI,SAAuC;EAAE,OAAO,CAAC,GAAGC,4BAAmB,OAAO,CAAC;CAAG,EACxF;AACF,CAAC"}
+{"version":3,"file":"mcp.cjs","names":["defineMcpSkill","readPackageResource","defineMcpPlugin","skillHelpHowToSandbox"],"sources":["../../src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp.ts","../../generated/mcp.ts"],"sourcesContent":["import { defineMcpSkill } from '@agimon-ai/po-core/mcpFacet';\nimport { readPackageResource } from '@agimon-ai/po-core/serverPlugin';\n\nexport default defineMcpSkill({\n  name: 'help-how-to-sandbox',\n  description:\n    'Use @agimon-ai/po-sandbox: Sandbox building blocks for Po: container engine detection, the sandbox image, and a host credential broker for per-workspace containers, which are not wired yet',\n  read: () => readPackageResource(import.meta.url, 'src/prompts/help-how-to-sandbox/SKILL.md'),\n});\n","// Generated by @agimon-ai/po-build. Do not edit by hand.\nimport { defineMcpPlugin, type PoMcpSessionPlugin } from '@agimon-ai/po-core/mcpFacet';\n\nimport skillHelpHowToSandbox from '../src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp';\n\ntype Factory<T, C> = (context: C) => T;\nconst at = <T, C>(value: T | Factory<T, C>, context: C): T =>\n  typeof value === 'function' ? (value as Factory<T, C>)(context) : value;\n\nexport const mcp = defineMcpPlugin({\n  name: '@agimon-ai/po-sandbox',\n  session: (context) => ({\n    get skills(): PoMcpSessionPlugin['skills'] { return [at(skillHelpHowToSandbox, context)]; },\n  }) satisfies PoMcpSessionPlugin,\n});\n\nexport default mcp;\n"],"mappings":";;;;;;;AAGA,IAAA,mCAAA,GAAeA,4BAAAA,eAAAA,CAAe;CAC5B,MAAM;CACN,aACE;CACF,aAAA,GAAYC,gCAAAA,oBAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,MAAqC,0CAA0C;AAC7F,CAAC;;;ACFD,MAAM,MAAY,OAA0B,YAC1C,OAAO,UAAU,aAAc,MAAwB,OAAO,IAAI;AAEpE,MAAa,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB;CACjC,MAAM;CACN,UAAU,aAAa,EACrB,IAAI,SAAuC;EAAE,OAAO,CAAC,GAAGC,iCAAuB,OAAO,CAAC;CAAG,EAC5F;AACF,CAAC"}

package/dist/extensions/mcp.mjs

@@ -1,10 +1,10 @@
 import { defineMcpPlugin, defineMcpSkill } from "@agimon-ai/po-core/mcpFacet";
-import { readPackageResource } from "@agimon-ai/po-core/serverFacet";
-//#region src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp.ts
-var po_use_sandbox_mcp_default = defineMcpSkill({
-	name: "po-use-sandbox",
-	description: "Use @agimon-ai/po-sandbox: Container sandbox for Po launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host",
-	read: () => readPackageResource(import.meta.url, "src/prompts/po-use-sandbox/SKILL.md")
+import { readPackageResource } from "@agimon-ai/po-core/serverPlugin";
+//#region src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp.ts
+var help_how_to_sandbox_mcp_default = defineMcpSkill({
+	name: "help-how-to-sandbox",
+	description: "Use @agimon-ai/po-sandbox: Sandbox building blocks for Po: container engine detection, the sandbox image, and a host credential broker for per-workspace containers, which are not wired yet",
+	read: () => readPackageResource(import.meta.url, "src/prompts/help-how-to-sandbox/SKILL.md")
 });
 //#endregion
 //#region generated/mcp.ts
@@ -12,7 +12,7 @@ const at = (value, context) => typeof value === "function" ? value(context) : va
 const mcp = defineMcpPlugin({
 	name: "@agimon-ai/po-sandbox",
 	session: (context) => ({ get skills() {
-		return [at(po_use_sandbox_mcp_default, context)];
+		return [at(help_how_to_sandbox_mcp_default, context)];
 	} })
 });
 //#endregion

package/dist/extensions/mcp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.mjs","names":["skillPoUseSandbox"],"sources":["../../src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp.ts","../../generated/mcp.ts"],"sourcesContent":["import { defineMcpSkill } from '@agimon-ai/po-core/mcpFacet';\nimport { readPackageResource } from '@agimon-ai/po-core/serverFacet';\n\nexport default defineMcpSkill({\n  name: 'po-use-sandbox',\n  description:\n    'Use @agimon-ai/po-sandbox: Container sandbox for Po launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host',\n  read: () => readPackageResource(import.meta.url, 'src/prompts/po-use-sandbox/SKILL.md'),\n});\n","// Generated by @agimon-ai/po-build. Do not edit by hand.\nimport { defineMcpPlugin, type PoMcpSessionPlugin } from '@agimon-ai/po-core/mcpFacet';\n\nimport skillPoUseSandbox from '../src/extensions/workspaces/sessions/(backend)/skill/po-use-sandbox.mcp';\n\ntype Factory<T, C> = (context: C) => T;\nconst at = <T, C>(value: T | Factory<T, C>, context: C): T =>\n  typeof value === 'function' ? (value as Factory<T, C>)(context) : value;\n\nexport const mcp = defineMcpPlugin({\n  name: '@agimon-ai/po-sandbox',\n  session: (context) => ({\n    get skills(): PoMcpSessionPlugin['skills'] { return [at(skillPoUseSandbox, context)]; },\n  }) satisfies PoMcpSessionPlugin,\n});\n\nexport default mcp;\n"],"mappings":";;;AAGA,IAAA,6BAAe,eAAe;CAC5B,MAAM;CACN,aACE;CACF,YAAY,oBAAoB,YAAY,KAAK,qCAAqC;AACxF,CAAC;;;ACFD,MAAM,MAAY,OAA0B,YAC1C,OAAO,UAAU,aAAc,MAAwB,OAAO,IAAI;AAEpE,MAAa,MAAM,gBAAgB;CACjC,MAAM;CACN,UAAU,aAAa,EACrB,IAAI,SAAuC;EAAE,OAAO,CAAC,GAAGA,4BAAmB,OAAO,CAAC;CAAG,EACxF;AACF,CAAC"}
+{"version":3,"file":"mcp.mjs","names":["skillHelpHowToSandbox"],"sources":["../../src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp.ts","../../generated/mcp.ts"],"sourcesContent":["import { defineMcpSkill } from '@agimon-ai/po-core/mcpFacet';\nimport { readPackageResource } from '@agimon-ai/po-core/serverPlugin';\n\nexport default defineMcpSkill({\n  name: 'help-how-to-sandbox',\n  description:\n    'Use @agimon-ai/po-sandbox: Sandbox building blocks for Po: container engine detection, the sandbox image, and a host credential broker for per-workspace containers, which are not wired yet',\n  read: () => readPackageResource(import.meta.url, 'src/prompts/help-how-to-sandbox/SKILL.md'),\n});\n","// Generated by @agimon-ai/po-build. Do not edit by hand.\nimport { defineMcpPlugin, type PoMcpSessionPlugin } from '@agimon-ai/po-core/mcpFacet';\n\nimport skillHelpHowToSandbox from '../src/extensions/workspaces/sessions/(backend)/skill/help-how-to-sandbox.mcp';\n\ntype Factory<T, C> = (context: C) => T;\nconst at = <T, C>(value: T | Factory<T, C>, context: C): T =>\n  typeof value === 'function' ? (value as Factory<T, C>)(context) : value;\n\nexport const mcp = defineMcpPlugin({\n  name: '@agimon-ai/po-sandbox',\n  session: (context) => ({\n    get skills(): PoMcpSessionPlugin['skills'] { return [at(skillHelpHowToSandbox, context)]; },\n  }) satisfies PoMcpSessionPlugin,\n});\n\nexport default mcp;\n"],"mappings":";;;AAGA,IAAA,kCAAe,eAAe;CAC5B,MAAM;CACN,aACE;CACF,YAAY,oBAAoB,YAAY,KAAK,0CAA0C;AAC7F,CAAC;;;ACFD,MAAM,MAAY,OAA0B,YAC1C,OAAO,UAAU,aAAc,MAAwB,OAAO,IAAI;AAEpE,MAAa,MAAM,gBAAgB;CACjC,MAAM;CACN,UAAU,aAAa,EACrB,IAAI,SAAuC;EAAE,OAAO,CAAC,GAAGA,iCAAuB,OAAO,CAAC;CAAG,EAC5F;AACF,CAAC"}