@axiom-lattice/gateway 2.1.53 → 2.1.55

package/dist/index.js

@@ -623,11 +623,13 @@ async function getThreadList(request, reply) {
   const tenantId = getTenantId2(request);
   const { assistantId } = request.params;
   const metadataFilter = {};
-  if (request.query.workspaceId) {
-    metadataFilter.workspaceId = request.query.workspaceId;
+  const workspaceId = request.headers["x-workspace-id"];
+  const projectId = request.headers["x-project-id"];
+  if (workspaceId) {
+    metadataFilter.workspaceId = workspaceId;
   }
-  if (request.query.projectId) {
-    metadataFilter.projectId = request.query.projectId;
+  if (projectId) {
+    metadataFilter.projectId = projectId;
   }
   const storeLattice = (0, import_core6.getStoreLattice)("default", "thread");
   const threadStore = storeLattice.store;
@@ -1267,16 +1269,63 @@ async function getHealth(request, reply) {
   }
 }
 
-// src/controllers/skills.ts
+// src/services/skill_service.ts
 var import_core10 = require("@axiom-lattice/core");
-var import_core11 = require("@axiom-lattice/core");
 function getTenantId4(request) {
-  const userTenantId = request.user?.tenantId;
-  if (userTenantId) {
-    return userTenantId;
-  }
-  return request.headers["x-tenant-id"] || "default";
+  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+}
+function getWorkspaceId(request) {
+  return request.headers["x-workspace-id"];
+}
+function getProjectId(request) {
+  return request.headers["x-project-id"];
+}
+function buildContext(request) {
+  return {
+    workspaceId: getWorkspaceId(request),
+    projectId: getProjectId(request)
+  };
 }
+var SkillService = class {
+  constructor() {
+    this.store = new import_core10.SandboxSkillStore();
+  }
+  async getAllSkills(request) {
+    const tenantId = getTenantId4(request);
+    return this.store.getAllSkills(tenantId, buildContext(request));
+  }
+  async getSkillById(request, id) {
+    const tenantId = getTenantId4(request);
+    return this.store.getSkillById(tenantId, id, buildContext(request));
+  }
+  async createSkill(request, id, data) {
+    const tenantId = getTenantId4(request);
+    return this.store.createSkill(tenantId, id, data, buildContext(request));
+  }
+  async updateSkill(request, id, updates) {
+    const tenantId = getTenantId4(request);
+    return this.store.updateSkill(tenantId, id, updates, buildContext(request));
+  }
+  async deleteSkill(request, id) {
+    const tenantId = getTenantId4(request);
+    return this.store.deleteSkill(tenantId, id, buildContext(request));
+  }
+  async searchByMetadata(request, key, value) {
+    const tenantId = getTenantId4(request);
+    return this.store.searchByMetadata(tenantId, key, value, buildContext(request));
+  }
+  async filterByCompatibility(request, compatibility) {
+    const tenantId = getTenantId4(request);
+    return this.store.filterByCompatibility(tenantId, compatibility, buildContext(request));
+  }
+  async filterByLicense(request, license) {
+    const tenantId = getTenantId4(request);
+    return this.store.filterByLicense(tenantId, license, buildContext(request));
+  }
+};
+
+// src/controllers/skills.ts
+var skillService = new SkillService();
 function serializeSkill(skill) {
   const serialized = {
     id: skill.id,
@@ -1287,192 +1336,100 @@ function serializeSkill(skill) {
     metadata: skill.metadata || {},
     content: skill.content,
     subSkills: skill.subSkills,
-    createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : skill.createdAt ? new Date(skill.createdAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
-    updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : skill.updatedAt ? new Date(skill.updatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
   };
   Object.keys(serialized).forEach((key) => {
-    if (serialized[key] === void 0) {
-      delete serialized[key];
-    }
+    if (serialized[key] === void 0) delete serialized[key];
   });
   return serialized;
 }
 async function getSkillList(request, reply) {
   try {
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.getAllSkills(tenantId);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.getAllSkills(request);
     return {
       success: true,
       message: "Successfully retrieved skill list",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to retrieve skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
 async function getSkill(request, reply) {
   try {
-    const tenantId = getTenantId4(request);
     const { id } = request.params;
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const skill = await skillStore.getSkillById(tenantId, id);
+    const skill = await skillService.getSkillById(request, id);
     if (!skill) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully retrieved skill",
-      data: serializeSkill(skill)
-    };
+    return { success: true, message: "Successfully retrieved skill", data: serializeSkill(skill) };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to retrieve skill: ${error.message}`
-    });
+    return reply.status(500).send({ success: false, message: `Failed to retrieve skill: ${error.message}` });
   }
 }
 async function createSkill(request, reply) {
   try {
     const data = request.body;
     if (!data.name) {
-      return reply.status(400).send({
-        success: false,
-        message: "name is required"
-      });
+      return reply.status(400).send({ success: false, message: "name is required" });
     }
     if (!data.description) {
-      return reply.status(400).send({
-        success: false,
-        message: "description is required"
-      });
-    }
-    try {
-      (0, import_core11.validateSkillName)(data.name);
-    } catch (error) {
-      return reply.status(400).send({
-        success: false,
-        message: error.message || "Invalid skill name format"
-      });
+      return reply.status(400).send({ success: false, message: "description is required" });
     }
     const id = request.body.id || data.name;
     if (id !== data.name) {
       return reply.status(400).send({
         success: false,
-        message: `id "${id}" must equal name "${data.name}" (name is used for path addressing)`
-      });
-    }
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (exists) {
-      return reply.status(409).send({
-        success: false,
-        message: `Skill with id "${id}" already exists`
+        message: `id "${id}" must equal name "${data.name}"`
       });
     }
-    const newSkill = await skillStore.createSkill(tenantId, id, data);
+    const skill = await skillService.createSkill(request, id, data);
     return reply.status(201).send({
       success: true,
       message: "Successfully created skill",
-      data: serializeSkill(newSkill)
+      data: serializeSkill(skill)
     });
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to create skill: ${error.message}`
-    });
+    if (error.message?.includes("already exists")) {
+      return reply.status(409).send({ success: false, message: error.message });
+    }
+    if (error.message?.includes("must equal name") || error.message?.includes("Invalid skill name")) {
+      return reply.status(400).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({ success: false, message: `Failed to create skill: ${error.message}` });
   }
 }
 async function updateSkill(request, reply) {
   try {
     const { id } = request.params;
     const updates = request.body;
-    if (updates.name !== void 0) {
-      try {
-        (0, import_core11.validateSkillName)(updates.name);
-      } catch (error) {
-        return reply.status(400).send({
-          success: false,
-          message: error.message || "Invalid skill name format"
-        });
-      }
-    }
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (!exists) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
-    }
-    const updatedSkill = await skillStore.updateSkill(tenantId, id, updates);
-    if (!updatedSkill) {
-      return reply.status(500).send({
-        success: false,
-        message: "Failed to update skill"
-      });
+    const skill = await skillService.updateSkill(request, id, updates);
+    if (!skill) {
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully updated skill",
-      data: serializeSkill(updatedSkill)
-    };
+    return { success: true, message: "Successfully updated skill", data: serializeSkill(skill) };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to update skill: ${error.message}`
-    });
+    if (error.message?.includes("Invalid skill name")) {
+      return reply.status(400).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({ success: false, message: `Failed to update skill: ${error.message}` });
   }
 }
 async function deleteSkill(request, reply) {
   try {
     const { id } = request.params;
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (!exists) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
-    }
-    const deleted = await skillStore.deleteSkill(tenantId, id);
-    if (!deleted) {
-      return reply.status(500).send({
-        success: false,
-        message: "Failed to delete skill"
-      });
+    const result = await skillService.deleteSkill(request, id);
+    if (!result) {
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully deleted skill"
-    };
+    return { success: true, message: "Successfully deleted skill" };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to delete skill: ${error.message}`
-    });
+    return reply.status(500).send({ success: false, message: `Failed to delete skill: ${error.message}` });
   }
 }
 async function searchSkillsByMetadata(request, reply) {
@@ -1482,33 +1439,20 @@ async function searchSkillsByMetadata(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "key and value query parameters are required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.searchByMetadata(tenantId, key, value);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.searchByMetadata(request, key, value);
     return {
       success: true,
       message: "Successfully searched skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to search skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
@@ -1519,33 +1463,20 @@ async function filterSkillsByCompatibility(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "compatibility query parameter is required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.filterByCompatibility(tenantId, compatibility);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.filterByCompatibility(request, compatibility);
     return {
       success: true,
       message: "Successfully filtered skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to filter skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
@@ -1556,39 +1487,26 @@ async function filterSkillsByLicense(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "license query parameter is required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = (0, import_core10.getStoreLattice)("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.filterByLicense(tenantId, license);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.filterByLicense(request, license);
     return {
       success: true,
       message: "Successfully filtered skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to filter skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
 
 // src/controllers/tools.ts
-var import_core12 = require("@axiom-lattice/core");
+var import_core11 = require("@axiom-lattice/core");
 function serializeSchema(schema) {
   if (!schema) {
     return void 0;
@@ -1632,7 +1550,7 @@ function serializeSchema(schema) {
 }
 async function getToolConfigs(request, reply) {
   try {
-    const allLattices = import_core12.toolLatticeManager.getAllLattices();
+    const allLattices = import_core11.toolLatticeManager.getAllLattices();
     const toolConfigs = allLattices.map((lattice) => {
       const config = { ...lattice.config };
       const serializedSchema = config.schema ? serializeSchema(config.schema) : void 0;
@@ -1670,7 +1588,7 @@ async function getToolConfigs(request, reply) {
 }
 
 // src/controllers/data-query.ts
-var import_core13 = require("@axiom-lattice/core");
+var import_core12 = require("@axiom-lattice/core");
 function getTenantId5(request) {
   return request.headers["x-tenant-id"] || "default";
 }
@@ -1701,7 +1619,7 @@ async function executeDataQuery(request, reply) {
         message: "Cannot provide both metrics and customSql. Use one query type only."
       };
     }
-    const storeLattice = (0, import_core13.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core12.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     if (!body.serverKey) {
       reply.code(400);
@@ -1732,14 +1650,14 @@ async function executeDataQuery(request, reply) {
         message: "datasourceId is required"
       };
     }
-    if (!import_core13.metricsServerManager.hasServer(tenantId, body.serverKey)) {
+    if (!import_core12.metricsServerManager.hasServer(tenantId, body.serverKey)) {
       reply.code(400);
       return {
         success: false,
         message: `Metrics server not registered: ${body.serverKey}. Please register the server first.`
       };
     }
-    const client = import_core13.metricsServerManager.getClient(tenantId, body.serverKey);
+    const client = import_core12.metricsServerManager.getClient(tenantId, body.serverKey);
     if (isSemanticQuery) {
       return await executeSemanticQuery(client, body, reply);
     } else {
@@ -2147,7 +2065,7 @@ var getHealthSchema = {
 };
 
 // src/controllers/thread_status.ts
-var import_core14 = require("@axiom-lattice/core");
+var import_core13 = require("@axiom-lattice/core");
 async function removePendingMessageHandler(request, reply) {
   try {
     const { assistant_id, thread_id, message_id } = request.params;
@@ -2160,7 +2078,7 @@ async function removePendingMessageHandler(request, reply) {
     if (!assistant_id) {
       return reply.code(400).send({ error: "Missing assistant_id parameter" });
     }
-    const agent = import_core14.agentInstanceManager.getAgent({
+    const agent = import_core13.agentInstanceManager.getAgent({
       assistant_id,
       thread_id,
       tenant_id,
@@ -2193,11 +2111,8 @@ async function removePendingMessageHandler(request, reply) {
   }
 }
 
-// src/controllers/sandbox.ts
-var import_stream = require("stream");
-
 // src/services/sandbox_service.ts
-var import_core15 = require("@axiom-lattice/core");
+var import_core14 = require("@axiom-lattice/core");
 var ERROR_HTML = `<!DOCTYPE html>
 <html lang="zh-CN">
 <head>
@@ -2289,7 +2204,7 @@ var ERROR_HTML = `<!DOCTYPE html>
       </div>
       <div class="info-item">
         <span class="label">\u9694\u79BB\u7EA7\u522B</span>
-        <span class="value" id="isolatedLevel">-</span>
+        <span class="value" id="vmIsolation">-</span>
       </div>
       <div class="info-item">
         <span class="label">\u9519\u8BEF\u4FE1\u606F</span>
@@ -2302,14 +2217,14 @@ var ERROR_HTML = `<!DOCTYPE html>
     const params = new URLSearchParams(window.location.search);
     document.getElementById('assistantId').textContent = params.get('assistantId') || '-';
     document.getElementById('threadId').textContent = params.get('threadId') || '-';
-    document.getElementById('isolatedLevel').textContent = params.get('isolatedLevel') || '-';
+    document.getElementById('vmIsolation').textContent = params.get('vmIsolation') || '-';
     document.getElementById('errorMsg').textContent = params.get('error') || '\u672A\u77E5\u9519\u8BEF';
   </script>
 </body>
 </html>`;
 var SandboxService = class {
-  getFilesystemIsolatedLevel(tenantId, assistantId) {
-    const agentLattice = import_core15.agentLatticeManager.getAgentLatticeWithTenant(tenantId, assistantId);
+  getFilesystemVmIsolation(tenantId, assistantId) {
+    const agentLattice = import_core14.agentLatticeManager.getAgentLatticeWithTenant(tenantId, assistantId);
     if (!agentLattice) {
       return null;
     }
@@ -2318,27 +2233,26 @@ var SandboxService = class {
       return null;
     }
     const config = filesystemConfig.config;
-    return config?.isolatedLevel || null;
+    return config?.vmIsolation || null;
   }
-  computeSandboxName(assistantId, threadId, isolatedLevel) {
-    let sandboxName;
-    switch (isolatedLevel) {
+  computeSandboxName(assistantId, threadId, vmIsolation, tenantId, workspaceId, projectId) {
+    switch (vmIsolation) {
       case "agent":
-        sandboxName = assistantId;
-        break;
-      case "thread":
-        sandboxName = threadId;
-        break;
+        return (0, import_core14.normalizeSandboxName)(`${tenantId ?? "default"}-${assistantId}`);
+      case "project":
+        return (0, import_core14.normalizeSandboxName)(
+          `${tenantId ?? "default"}-${workspaceId ?? "default"}-${projectId ?? "default"}`
+        );
       case "global":
       default:
-        sandboxName = "global";
-        break;
+        return "global";
     }
-    return (0, import_core15.normalizeSandboxName)(sandboxName);
+  }
+  getBrowserSandboxBaseURL() {
+    return process.env.AGENT_INFRA_SANDBOX_BASE_URL || "http://localhost:8080";
   }
   getTargetUrl(sandboxName) {
-    const sandboxManager = (0, import_core15.getSandBoxManager)();
-    return `${sandboxManager.getBaseURL()}/sandbox/${sandboxName}`;
+    return `${this.getBrowserSandboxBaseURL()}/sandbox/${sandboxName}`;
   }
   async getVncHtml(sandboxName) {
     const response = await fetch(`${this.getTargetUrl(sandboxName)}/vnc/index.html`);
@@ -2374,15 +2288,15 @@ var SandboxService = class {
     );
     return rewritten;
   }
-  generateErrorHtml(assistantId, threadId, isolatedLevel, errorMessage) {
+  generateErrorHtml(assistantId, threadId, vmIsolation, errorMessage) {
     const encodedError = encodeURIComponent(errorMessage);
-    return ERROR_HTML.replace("{assistantId}", assistantId).replace("{threadId}", threadId).replace("{isolatedLevel}", isolatedLevel).replace("{errorMessage}", errorMessage);
+    return ERROR_HTML.replace("{assistantId}", assistantId).replace("{threadId}", threadId).replace("{vmIsolation}", vmIsolation).replace("{errorMessage}", errorMessage);
   }
 };
 var sandboxService = new SandboxService();
 
 // src/controllers/sandbox.ts
-var import_core16 = require("@axiom-lattice/core");
+var import_core15 = require("@axiom-lattice/core");
 function getFilenameFromPath(path3) {
   const segments = path3.replace(/\/+$/, "").split("/");
   return segments[segments.length - 1] || "download";
@@ -2415,16 +2329,16 @@ function registerSandboxProxyRoutes(app2) {
       console.log("[Sandbox Upload] Route matched:", request.url);
       const { assistantId, threadId } = request.params;
       const tenantId = request.headers["x-tenant-id"] || "default";
-      const isolatedLevel = sandboxService.getFilesystemIsolatedLevel(tenantId, assistantId);
-      if (!isolatedLevel) {
+      const vmIsolation = sandboxService.getFilesystemVmIsolation(tenantId, assistantId);
+      if (!vmIsolation) {
         return reply.status(500).send({ error: "Assistant sandbox config not found" });
       }
       const sandboxName = sandboxService.computeSandboxName(
         assistantId,
         threadId,
-        isolatedLevel
+        vmIsolation
       );
-      const sandboxManager = (0, import_core16.getSandBoxManager)();
+      const sandboxManager = (0, import_core15.getSandBoxManager)();
       const sandbox = await sandboxManager.createSandbox(sandboxName);
       try {
         const data = await request.file();
@@ -2434,17 +2348,14 @@ function registerSandboxProxyRoutes(app2) {
         const buffer = await data.toBuffer();
         const pathEntry = data.fields?.path;
         const pathValue = pathEntry && typeof pathEntry === "object" && "value" in pathEntry ? String(pathEntry.value) : typeof pathEntry === "string" ? pathEntry : void 0;
-        const formData = new FormData();
-        formData.append("file", new Blob([buffer]), data.filename ?? "file");
-        const path3 = `/home/gem/uploads/${pathValue ? pathValue : ""}${data.filename}`;
-        const uploadResult = await sandbox.file.uploadFile({
-          file: buffer,
-          path: path3
-        });
-        if (!uploadResult.ok) {
-          return reply.status(502).send({ error: `Upload error: ${uploadResult.error}` });
+        const filePath = `~/uploads/${pathValue ? pathValue : ""}${data.filename}`;
+        try {
+          await sandbox.file.uploadFile({ file: filePath, data: buffer });
+        } catch (err) {
+          reply.status(500).send({ error: String(err) });
+          return;
         }
-        const relativePath = uploadResult.body?.data?.file_path.replace(`/home/gem`, "");
+        const relativePath = filePath.replace(`~/`, "");
         const result = { id: relativePath, name: data.filename, size: buffer.length };
         return reply.status(200).send({ message: "File uploaded successfully", ...result });
       } catch (error) {
@@ -2462,59 +2373,30 @@ function registerSandboxProxyRoutes(app2) {
       if (!filePath || typeof filePath !== "string") {
         return reply.status(400).send({ error: "Query parameter 'path' is required" });
       }
-      const isolatedLevel = sandboxService.getFilesystemIsolatedLevel(tenantId, assistantId);
-      if (!isolatedLevel) {
-        return reply.status(500).send({ error: "Assistant filesystem isolated level not found" });
+      const vmIsolation = sandboxService.getFilesystemVmIsolation(tenantId, assistantId);
+      if (!vmIsolation) {
+        return reply.status(500).send({ error: "Assistant filesystem vmIsolation not found" });
       }
       const sandboxName = sandboxService.computeSandboxName(
         assistantId,
         threadId,
-        isolatedLevel
+        vmIsolation
       );
-      const sandboxManager = (0, import_core16.getSandBoxManager)();
+      const sandboxManager = (0, import_core15.getSandBoxManager)();
       const sandbox = await sandboxManager.createSandbox(sandboxName);
       try {
-        const resolvedPath = filePath.startsWith("/home/gem") ? filePath : `/home/gem/${filePath.replace(/^\//, "")}`;
+        const resolvedPath = filePath.startsWith("~/") ? filePath : `~/${filePath.replace(/^\//, "")}`;
         const filename = getFilenameFromPath(resolvedPath);
         const inferredContentType = getContentTypeFromFilename(filename);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: resolvedPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            error: `Download error: ${JSON.stringify(downloadResult.error)}`
-          });
-        }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = import_stream.Readable.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          const contentDisposition2 = body.contentDisposition ?? `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-          reply = reply.status(200).type(contentType2).header("Content-Disposition", contentDisposition2).send(nodeStream);
+        try {
+          const buf = await sandbox.file.downloadFile({ file: resolvedPath });
+          const contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+          reply = reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
           return reply;
+        } catch (err) {
+          reply.status(500).send({ error: String(err) });
+          return;
         }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        let contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-          if (res.headers?.get("content-disposition")) contentDisposition = res.headers.get("content-disposition");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ error: "Unexpected download response format" });
-        }
-        reply = reply.status(200).type(contentType).header("Content-Disposition", contentDisposition).send(buf);
-        return reply;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         return reply.status(502).send({ error: `Download proxy error: ${message}` });
@@ -2526,15 +2408,14 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 var fs = __toESM(require("fs/promises"));
 var path = __toESM(require("path"));
-var import_stream2 = require("stream");
+var import_core16 = require("@axiom-lattice/core");
 var import_core17 = require("@axiom-lattice/core");
 var import_core18 = require("@axiom-lattice/core");
-var import_core19 = require("@axiom-lattice/core");
 var import_uuid2 = require("uuid");
 var WorkspaceController = class {
   constructor() {
-    this.workspaceStore = (0, import_core17.getStoreLattice)("default", "workspace").store;
-    this.projectStore = (0, import_core17.getStoreLattice)("default", "project").store;
+    this.workspaceStore = (0, import_core16.getStoreLattice)("default", "workspace").store;
+    this.projectStore = (0, import_core16.getStoreLattice)("default", "project").store;
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -2667,19 +2548,23 @@ var WorkspaceController = class {
       throw new Error("Workspace not found");
     }
     if (workspace.storageType === "sandbox") {
-      const sandboxManager = (0, import_core19.getSandBoxManager)();
-      const sandboxName = "global";
-      const sandbox = await sandboxManager.createSandbox(sandboxName);
+      const sandboxManager = (0, import_core18.getSandBoxManager)();
+      const sandbox = await sandboxManager.getSandboxFromConfig({
+        assistant_id: "",
+        thread_id: "",
+        tenantId,
+        workspaceId,
+        projectId
+      });
       return {
-        backend: new import_core18.SandboxFilesystem({
-          sandboxInstance: sandbox,
-          workingDirectory: `/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`
+        backend: new import_core17.SandboxFilesystem({
+          sandboxInstance: sandbox
         }),
         workspace
       };
     } else {
       return {
-        backend: new import_core18.FilesystemBackend({
+        backend: new import_core17.FilesystemBackend({
           rootDir: `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`,
           virtualMode: true
         }),
@@ -2722,50 +2607,26 @@ var WorkspaceController = class {
     }
     try {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId);
-      const resolvedPath = filePath.startsWith("/") ? filePath : `/${filePath}`;
+      const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core19.getSandBoxManager)();
-        const sandbox = await sandboxManager.createSandbox("global");
-        const realPath = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId, resolvedPath);
+        const sandboxManager = (0, import_core18.getSandBoxManager)();
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = resolvedPath;
         const filename2 = this.getFilenameFromPath(resolvedPath);
         const inferredContentType = this.getMimeType(filename2);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: realPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `Download error: ${JSON.stringify(downloadResult.error)}`
-          });
-        }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = import_stream2.Readable.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          const contentDisposition2 = body.contentDisposition ?? `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
-          return reply.status(200).type(contentType2).header("Content-Disposition", contentDisposition2).send(nodeStream);
-        }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        let contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-          if (res.headers?.get("content-disposition")) contentDisposition = res.headers.get("content-disposition");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ success: false, error: "Unexpected download response format" });
+        try {
+          const buf = await sandbox.file.downloadFile({ file: realPath });
+          const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
+          return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
+        } catch (err) {
+          return reply.status(502).send({ success: false, error: String(err) });
         }
-        return reply.status(200).type(contentType).header("Content-Disposition", contentDisposition).send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId);
       const content = await backend.read(resolvedPath, 0, Infinity);
@@ -2791,36 +2652,27 @@ var WorkspaceController = class {
     }
     try {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId);
-      const resolvedPath = filePath.startsWith("/") ? filePath : `/${filePath}`;
+      const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core19.getSandBoxManager)();
-        const sandbox = await sandboxManager.createSandbox("global");
-        const realPath = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId, resolvedPath);
+        const sandboxManager = (0, import_core18.getSandBoxManager)();
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = resolvedPath;
         const filename2 = this.getFilenameFromPath(resolvedPath);
         const inferredContentType = this.getMimeType(filename2);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: realPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `View error: ${JSON.stringify(downloadResult.error)}`
-          });
-        }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = import_stream2.Readable.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          console.log(`[viewFile] Sandbox returned stream, contentType: ${contentType2}, filename: ${filename2}`);
-          const isHtml2 = contentType2?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
-          if (isHtml2) {
-            console.log(`[viewFile] HTML stream detected, collecting for context injection`);
-            const chunks = [];
-            for await (const chunk of nodeStream) {
-              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-            }
-            let content2 = Buffer.concat(chunks).toString("utf-8");
+        try {
+          const buf = await sandbox.file.downloadFile({ file: realPath });
+          let contentType = inferredContentType;
+          const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
+          let outputBuf = buf;
+          if (isHtml) {
+            console.log(`[viewFile] Injecting AI2APP context for sandbox HTML file: ${filename2}, tenantId: ${tenantId}, contentType: ${contentType}`);
+            let content2 = buf.toString("utf-8");
             const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
               tenantId,
               workspaceId,
@@ -2829,58 +2681,20 @@ var WorkspaceController = class {
             })};</script>`;
             if (content2.toLowerCase().includes("</head>")) {
               content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
-              console.log(`[viewFile] Context script injected before </head> (stream)`);
+              console.log(`[viewFile] Context script injected before </head>`);
             } else if (content2.toLowerCase().includes("<html>")) {
               content2 = content2.replace(/<html>/i, `<html>${contextScript}`);
-              console.log(`[viewFile] Context script injected after <html> (stream)`);
+              console.log(`[viewFile] Context script injected after <html>`);
             } else {
               content2 = contextScript + content2;
-              console.log(`[viewFile] Context script prepended to content (stream)`);
+              console.log(`[viewFile] Context script prepended to content`);
             }
-            return reply.status(200).type(contentType2).header("Content-Disposition", "inline").send(Buffer.from(content2, "utf-8"));
-          }
-          return reply.status(200).type(contentType2).header("Content-Disposition", "inline").send(nodeStream);
-        }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ success: false, error: "Unexpected view response format" });
-        }
-        const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
-        if (isHtml) {
-          console.log(`[viewFile] Injecting AI2APP context for sandbox HTML file: ${filename2}, tenantId: ${tenantId}, contentType: ${contentType}`);
-          let content2 = buf.toString("utf-8");
-          const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
-            tenantId,
-            workspaceId,
-            projectId,
-            timestamp: Date.now()
-          })};</script>`;
-          if (content2.toLowerCase().includes("</head>")) {
-            content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
-            console.log(`[viewFile] Context script injected before </head>`);
-          } else if (content2.toLowerCase().includes("<html>")) {
-            content2 = content2.replace(/<html>/i, `<html>${contextScript}`);
-            console.log(`[viewFile] Context script injected after <html>`);
-          } else {
-            content2 = contextScript + content2;
-            console.log(`[viewFile] Context script prepended to content`);
+            outputBuf = Buffer.from(content2, "utf-8");
           }
-          buf = Buffer.from(content2, "utf-8");
+          return reply.status(200).type(contentType).header("Content-Disposition", "inline").send(outputBuf);
+        } catch (err) {
+          return reply.status(502).send({ success: false, error: String(err) });
         }
-        return reply.status(200).type(contentType).header("Content-Disposition", "inline").send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId);
       const content = await backend.read(resolvedPath, 0, Infinity);
@@ -2959,26 +2773,25 @@ var WorkspaceController = class {
       const filename = data.filename || "file";
       const pathEntry = data.fields?.path;
       const pathValue = pathEntry && typeof pathEntry === "object" && "value" in pathEntry ? String(pathEntry.value) : typeof pathEntry === "string" ? pathEntry : void 0;
-      if (pathValue && !/^[a-zA-Z0-9_./-]+$/.test(pathValue)) {
+      if (pathValue && !/^[a-zA-Z0-9_./~\-]+$/.test(pathValue)) {
         return reply.status(400).send({ success: false, error: "Invalid path parameter" });
       }
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core19.getSandBoxManager)();
-        const sandboxName = "global";
-        const sandbox = await sandboxManager.createSandbox(sandboxName);
-        const baseDir = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId);
-        const realPath = pathValue ? path.join(baseDir, pathValue, filename) : path.join(baseDir, filename);
-        const uploadResult = await sandbox.file.uploadFile({
-          file: buffer,
-          path: realPath
-        }, { timeoutInSeconds: 300 });
-        if (!uploadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `Upload error: ${JSON.stringify(uploadResult.error)}`
-          });
+        const sandboxManager = (0, import_core18.getSandBoxManager)();
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = pathValue ? path.posix.join(pathValue, filename) : filename;
+        try {
+          await sandbox.file.uploadFile({ file: realPath, data: buffer });
+        } catch (err) {
+          return reply.status(500).send({ success: false, error: String(err) });
         }
-        const relativePath = uploadResult.body?.data?.file_path?.replace(path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId), "") || (pathValue ? `/${pathValue}/${filename}` : `/${filename}`);
+        const relativePath = pathValue ? path.posix.join(pathValue, filename) : `/${filename}`;
         const result2 = {
           path: relativePath,
           name: filename,
@@ -3069,7 +2882,7 @@ function registerWorkspaceRoutes(app2) {
 }
 
 // src/controllers/database-configs.ts
-var import_core20 = require("@axiom-lattice/core");
+var import_core19 = require("@axiom-lattice/core");
 var import_crypto3 = require("crypto");
 function getTenantId6(request) {
   const userTenantId = request.user?.tenantId;
@@ -3081,7 +2894,7 @@ function getTenantId6(request) {
 async function getDatabaseConfigList(request, reply) {
   const tenantId = getTenantId6(request);
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     console.log("Backend: getAllConfigs returned:", configs);
@@ -3112,7 +2925,7 @@ async function getDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3138,7 +2951,7 @@ async function createDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -3151,7 +2964,7 @@ async function createDatabaseConfig(request, reply) {
     const id = body.id || (0, import_crypto3.randomUUID)();
     const config = await store.createConfig(tenantId, id, body);
     try {
-      import_core20.sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
+      import_core19.sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
     } catch (error) {
       console.warn("Failed to auto-register database:", error);
     }
@@ -3174,7 +2987,7 @@ async function updateDatabaseConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -3193,7 +3006,7 @@ async function updateDatabaseConfig(request, reply) {
     }
     if (updates.config) {
       try {
-        import_core20.sqlDatabaseManager.registerDatabase(tenantId, updated.key, updated.config);
+        import_core19.sqlDatabaseManager.registerDatabase(tenantId, updated.key, updated.config);
       } catch (error) {
         console.warn("Failed to re-register database:", error);
       }
@@ -3215,7 +3028,7 @@ async function deleteDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     console.log("Delete request - keyOrId:", keyOrId);
     let config = await store.getConfigByKey(tenantId, keyOrId);
@@ -3242,8 +3055,8 @@ async function deleteDatabaseConfig(request, reply) {
       };
     }
     try {
-      if (import_core20.sqlDatabaseManager.hasDatabase(tenantId, configKey)) {
-        await import_core20.sqlDatabaseManager.removeDatabase(tenantId, configKey);
+      if (import_core19.sqlDatabaseManager.hasDatabase(tenantId, configKey)) {
+        await import_core19.sqlDatabaseManager.removeDatabase(tenantId, configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from SqlDatabaseManager:", error);
@@ -3264,7 +3077,7 @@ async function testDatabaseConnection(request, reply) {
   const tenantId = getTenantId6(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core20.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core19.getStoreLattice)("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3275,16 +3088,16 @@ async function testDatabaseConnection(request, reply) {
       };
     }
     const testKey = `__test_${key}_${Date.now()}`;
-    import_core20.sqlDatabaseManager.registerDatabase(tenantId, testKey, config.config);
+    import_core19.sqlDatabaseManager.registerDatabase(tenantId, testKey, config.config);
     const startTime = Date.now();
-    const db = await import_core20.sqlDatabaseManager.getDatabase(tenantId, testKey);
+    const db = await import_core19.sqlDatabaseManager.getDatabase(tenantId, testKey);
     try {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
       await new Promise((resolve) => setTimeout(resolve, 100));
       await db.disconnect();
-      await import_core20.sqlDatabaseManager.removeDatabase(tenantId, testKey);
+      await import_core19.sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
         success: true,
         message: "Connection test successful",
@@ -3296,7 +3109,7 @@ async function testDatabaseConnection(request, reply) {
     } catch (error) {
       try {
         await db.disconnect();
-        await import_core20.sqlDatabaseManager.removeDatabase(tenantId, testKey);
+        await import_core19.sqlDatabaseManager.removeDatabase(tenantId, testKey);
       } catch {
       }
       return {
@@ -3348,7 +3161,7 @@ function registerDatabaseConfigRoutes(app2) {
 }
 
 // src/controllers/metrics-configs.ts
-var import_core21 = require("@axiom-lattice/core");
+var import_core20 = require("@axiom-lattice/core");
 var import_crypto4 = require("crypto");
 function getTenantId7(request) {
   const userTenantId = request.user?.tenantId;
@@ -3360,7 +3173,7 @@ function getTenantId7(request) {
 async function getMetricsServerConfigList(request, reply) {
   const tenantId = getTenantId7(request);
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     return {
@@ -3387,7 +3200,7 @@ async function getMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3413,7 +3226,7 @@ async function createMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -3442,7 +3255,7 @@ async function createMetricsServerConfig(request, reply) {
     };
     const config = await store.createConfig(tenantId, id, configData);
     try {
-      import_core21.metricsServerManager.registerServer(tenantId, config.key, config.config);
+      import_core20.metricsServerManager.registerServer(tenantId, config.key, config.config);
     } catch (error) {
       console.warn("Failed to auto-register metrics server:", error);
     }
@@ -3465,7 +3278,7 @@ async function updateMetricsServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -3493,7 +3306,7 @@ async function updateMetricsServerConfig(request, reply) {
     }
     if (updates.config) {
       try {
-        import_core21.metricsServerManager.registerServer(tenantId, updated.key, updated.config);
+        import_core20.metricsServerManager.registerServer(tenantId, updated.key, updated.config);
       } catch (error) {
         console.warn("Failed to re-register metrics server:", error);
       }
@@ -3515,7 +3328,7 @@ async function deleteMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     let config = await store.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -3540,8 +3353,8 @@ async function deleteMetricsServerConfig(request, reply) {
       };
     }
     try {
-      if (import_core21.metricsServerManager.hasServer(tenantId, configKey)) {
-        import_core21.metricsServerManager.removeServer(tenantId, configKey);
+      if (import_core20.metricsServerManager.hasServer(tenantId, configKey)) {
+        import_core20.metricsServerManager.removeServer(tenantId, configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from MetricsServerManager:", error);
@@ -3562,7 +3375,7 @@ async function testMetricsServerConnection(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3573,11 +3386,11 @@ async function testMetricsServerConnection(request, reply) {
       };
     }
     const testKey = `__test_${key}_${Date.now()}`;
-    import_core21.metricsServerManager.registerServer(tenantId, testKey, config.config);
+    import_core20.metricsServerManager.registerServer(tenantId, testKey, config.config);
     try {
-      const client = import_core21.metricsServerManager.getClient(tenantId, testKey);
+      const client = import_core20.metricsServerManager.getClient(tenantId, testKey);
       const result = await client.testConnection();
-      import_core21.metricsServerManager.removeServer(tenantId, testKey);
+      import_core20.metricsServerManager.removeServer(tenantId, testKey);
       return {
         success: true,
         message: result.connected ? "Connection test successful" : "Connection test failed",
@@ -3585,7 +3398,7 @@ async function testMetricsServerConnection(request, reply) {
       };
     } catch (error) {
       try {
-        import_core21.metricsServerManager.removeServer(tenantId, testKey);
+        import_core20.metricsServerManager.removeServer(tenantId, testKey);
       } catch {
       }
       return {
@@ -3613,7 +3426,7 @@ async function listAvailableMetrics(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3623,10 +3436,10 @@ async function listAvailableMetrics(request, reply) {
         message: "Metrics server configuration not found"
       };
     }
-    if (!import_core21.metricsServerManager.hasServer(tenantId, key)) {
-      import_core21.metricsServerManager.registerServer(tenantId, key, config.config);
+    if (!import_core20.metricsServerManager.hasServer(tenantId, key)) {
+      import_core20.metricsServerManager.registerServer(tenantId, key, config.config);
     }
-    const client = import_core21.metricsServerManager.getClient(tenantId, key);
+    const client = import_core20.metricsServerManager.getClient(tenantId, key);
     const metrics = await client.listMetrics();
     return {
       success: true,
@@ -3652,7 +3465,7 @@ async function queryMetricsData(request, reply) {
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3669,10 +3482,10 @@ async function queryMetricsData(request, reply) {
         message: "metricName is required"
       };
     }
-    if (!import_core21.metricsServerManager.hasServer(tenantId, key)) {
-      import_core21.metricsServerManager.registerServer(tenantId, key, config.config);
+    if (!import_core20.metricsServerManager.hasServer(tenantId, key)) {
+      import_core20.metricsServerManager.registerServer(tenantId, key, config.config);
     }
-    const client = import_core21.metricsServerManager.getClient(tenantId, key);
+    const client = import_core20.metricsServerManager.getClient(tenantId, key);
     const result = await client.queryMetricData(metricName, {
       startTime,
       endTime,
@@ -3699,7 +3512,7 @@ async function getDataSources(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3717,7 +3530,7 @@ async function getDataSources(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core21.SemanticMetricsClient(semanticConfig);
+    const client = new import_core20.SemanticMetricsClient(semanticConfig);
     const allDatasources = await client.getDataSources();
     const selectedIds = semanticConfig.selectedDataSources || [];
     const filteredDatasources = selectedIds.length > 0 ? allDatasources.filter((ds) => selectedIds.includes(String(ds.id))) : allDatasources;
@@ -3740,7 +3553,7 @@ async function getDatasourceMetrics(request, reply) {
   const tenantId = getTenantId7(request);
   const { key, datasourceId } = request.params;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3758,7 +3571,7 @@ async function getDatasourceMetrics(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core21.SemanticMetricsClient(semanticConfig);
+    const client = new import_core20.SemanticMetricsClient(semanticConfig);
     const metrics = await client.getDatasourceMetrics(datasourceId);
     return {
       success: true,
@@ -3778,7 +3591,7 @@ async function querySemanticMetrics(request, reply) {
   const { key } = request.params;
   const body = request.body;
   try {
-    const storeLattice = (0, import_core21.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core20.getStoreLattice)("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3803,7 +3616,7 @@ async function querySemanticMetrics(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core21.SemanticMetricsClient(semanticConfig);
+    const client = new import_core20.SemanticMetricsClient(semanticConfig);
     const result = await client.semanticQuery(body);
     const columnNames = result.columns.map((col) => col.name);
     const allDataPoints = [];
@@ -3863,7 +3676,7 @@ async function testSemanticDataSources(request, reply) {
       password: body.password,
       headers: body.headers
     };
-    const client = new import_core21.SemanticMetricsClient(testConfig);
+    const client = new import_core20.SemanticMetricsClient(testConfig);
     const datasources = await client.getDataSources();
     return {
       success: true,
@@ -3899,7 +3712,7 @@ async function testDatasourceMetrics(request, reply) {
       password: body.password,
       headers: body.headers
     };
-    const client = new import_core21.SemanticMetricsClient(testConfig);
+    const client = new import_core20.SemanticMetricsClient(testConfig);
     const metrics = await client.getDatasourceMetrics(datasourceId);
     return {
       success: true,
@@ -3931,7 +3744,7 @@ function registerMetricsServerConfigRoutes(app2) {
 }
 
 // src/controllers/mcp-configs.ts
-var import_core22 = require("@axiom-lattice/core");
+var import_core21 = require("@axiom-lattice/core");
 var import_crypto5 = require("crypto");
 function getTenantId8(request) {
   const userTenantId = request.user?.tenantId;
@@ -3943,7 +3756,7 @@ function getTenantId8(request) {
 async function getMcpServerConfigList(request, reply) {
   const tenantId = getTenantId8(request);
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     return {
@@ -3970,7 +3783,7 @@ async function getMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3996,7 +3809,7 @@ async function createMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -4036,7 +3849,7 @@ async function updateMcpServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -4056,8 +3869,8 @@ async function updateMcpServerConfig(request, reply) {
     }
     if (shouldReconnect) {
       try {
-        if (import_core22.mcpManager.hasServer(key)) {
-          await import_core22.mcpManager.removeServer(key);
+        if (import_core21.mcpManager.hasServer(key)) {
+          await import_core21.mcpManager.removeServer(key);
         }
         await connectAndRegisterTools(updated);
         await store.updateConfig(tenantId, existing.id, { status: "connected" });
@@ -4085,7 +3898,7 @@ async function deleteMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     let config = await store.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -4103,8 +3916,8 @@ async function deleteMcpServerConfig(request, reply) {
       };
     }
     try {
-      if (import_core22.mcpManager.hasServer(configKey)) {
-        await import_core22.mcpManager.removeServer(configKey);
+      if (import_core21.mcpManager.hasServer(configKey)) {
+        await import_core21.mcpManager.removeServer(configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from MCP manager:", error);
@@ -4132,7 +3945,7 @@ async function testMcpServerConnection(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4146,11 +3959,11 @@ async function testMcpServerConnection(request, reply) {
     try {
       const testKey = `__test_${key}_${Date.now()}`;
       const connection = convertToConnection(config.config);
-      import_core22.mcpManager.addServer(testKey, connection);
-      await import_core22.mcpManager.connect();
-      const tools = await import_core22.mcpManager.getAllTools();
+      import_core21.mcpManager.addServer(testKey, connection);
+      await import_core21.mcpManager.connect();
+      const tools = await import_core21.mcpManager.getAllTools();
       const latency = Date.now() - startTime;
-      await import_core22.mcpManager.removeServer(testKey);
+      await import_core21.mcpManager.removeServer(testKey);
       return {
         success: true,
         message: "Connection test successful",
@@ -4185,7 +3998,7 @@ async function listMcpServerTools(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4195,10 +4008,10 @@ async function listMcpServerTools(request, reply) {
         message: "MCP server configuration not found"
       };
     }
-    if (!import_core22.mcpManager.hasServer(key)) {
+    if (!import_core21.mcpManager.hasServer(key)) {
       await connectAndRegisterTools(config);
     }
-    const tools = await import_core22.mcpManager.getAllTools();
+    const tools = await import_core21.mcpManager.getAllTools();
     return {
       success: true,
       message: "Tools retrieved successfully",
@@ -4218,7 +4031,7 @@ async function connectMcpServer(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4239,7 +4052,7 @@ async function connectMcpServer(request, reply) {
     };
   } catch (error) {
     console.error("Failed to connect MCP server:", error);
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (config) {
@@ -4255,7 +4068,7 @@ async function disconnectMcpServer(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core22.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core21.getStoreLattice)("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4265,8 +4078,8 @@ async function disconnectMcpServer(request, reply) {
         message: "MCP server configuration not found"
       };
     }
-    if (import_core22.mcpManager.hasServer(key)) {
-      await import_core22.mcpManager.removeServer(key);
+    if (import_core21.mcpManager.hasServer(key)) {
+      await import_core21.mcpManager.removeServer(key);
     }
     const updated = await store.updateConfig(tenantId, config.id, {
       status: "disconnected"
@@ -4296,10 +4109,10 @@ async function testMcpServerTools(request, reply) {
     }
     const testKey = `__test_${Date.now()}`;
     const connection = convertToConnection(body.config);
-    import_core22.mcpManager.addServer(testKey, connection);
-    await import_core22.mcpManager.connect();
-    const tools = await import_core22.mcpManager.getAllTools();
-    await import_core22.mcpManager.removeServer(testKey);
+    import_core21.mcpManager.addServer(testKey, connection);
+    await import_core21.mcpManager.connect();
+    const tools = await import_core21.mcpManager.getAllTools();
+    await import_core21.mcpManager.removeServer(testKey);
     return {
       success: true,
       message: "Tools retrieved successfully",
@@ -4336,14 +4149,14 @@ function convertToConnection(config) {
 }
 async function connectAndRegisterTools(config) {
   const connection = convertToConnection(config.config);
-  import_core22.mcpManager.addServer(config.key, connection);
-  await import_core22.mcpManager.connect();
-  const allTools = await import_core22.mcpManager.getAllTools();
+  import_core21.mcpManager.addServer(config.key, connection);
+  await import_core21.mcpManager.connect();
+  const allTools = await import_core21.mcpManager.getAllTools();
   const selectedTools = allTools.filter(
     (tool) => config.selectedTools.includes(tool.name)
   );
   for (const tool of selectedTools) {
-    import_core22.toolLatticeManager.registerExistingTool(tool.name, tool);
+    import_core21.toolLatticeManager.registerExistingTool(tool.name, tool);
   }
 }
 function registerMcpServerConfigRoutes(app2) {
@@ -4360,11 +4173,11 @@ function registerMcpServerConfigRoutes(app2) {
 }
 
 // src/controllers/users.ts
-var import_core23 = require("@axiom-lattice/core");
+var import_core22 = require("@axiom-lattice/core");
 var import_uuid3 = require("uuid");
 var UsersController = class {
   constructor() {
-    this.userStore = (0, import_core23.getStoreLattice)("default", "user").store;
+    this.userStore = (0, import_core22.getStoreLattice)("default", "user").store;
   }
   async listUsers(request, reply) {
     const { email } = request.query;
@@ -4442,11 +4255,11 @@ function registerUserRoutes(app2) {
 }
 
 // src/controllers/tenants.ts
-var import_core24 = require("@axiom-lattice/core");
+var import_core23 = require("@axiom-lattice/core");
 var import_uuid4 = require("uuid");
 var TenantsController = class {
   constructor() {
-    this.tenantStore = (0, import_core24.getStoreLattice)("default", "tenant").store;
+    this.tenantStore = (0, import_core23.getStoreLattice)("default", "tenant").store;
   }
   // ==================== Tenant CRUD ====================
   async listTenants(request, reply) {
@@ -4510,7 +4323,7 @@ function registerTenantRoutes(app2) {
 }
 
 // src/controllers/auth.ts
-var import_core25 = require("@axiom-lattice/core");
+var import_core24 = require("@axiom-lattice/core");
 var import_uuid5 = require("uuid");
 var defaultAuthConfig = {
   autoApproveUsers: true,
@@ -4519,9 +4332,9 @@ var defaultAuthConfig = {
 };
 var AuthController = class {
   constructor(config = {}) {
-    this.userStore = (0, import_core25.getStoreLattice)("default", "user").store;
-    this.tenantStore = (0, import_core25.getStoreLattice)("default", "tenant").store;
-    this.userTenantLinkStore = (0, import_core25.getStoreLattice)("default", "userTenantLink").store;
+    this.userStore = (0, import_core24.getStoreLattice)("default", "user").store;
+    this.tenantStore = (0, import_core24.getStoreLattice)("default", "tenant").store;
+    this.userTenantLinkStore = (0, import_core24.getStoreLattice)("default", "userTenantLink").store;
     this.config = { ...defaultAuthConfig, ...config };
   }
   async register(request, reply) {
@@ -4892,6 +4705,695 @@ function registerAuthRoutes(app2, config) {
   );
 }
 
+// src/channels/lark/routes.ts
+var import_core26 = require("@axiom-lattice/core");
+var import_pg_stores = require("@axiom-lattice/pg-stores");
+
+// src/channels/lark/parser.ts
+function parseLarkMessageEvent(payload) {
+  const raw = payload;
+  if (raw.header?.event_type !== "im.message.receive_v1") {
+    return null;
+  }
+  const message = raw.event?.message;
+  const openId = raw.event?.sender?.sender_id?.open_id;
+  if (!message || !openId || message.message_type !== "text") {
+    return null;
+  }
+  const parsedContent = parseLarkTextContent(message.content);
+  if (!message.message_id || !message.chat_id || !parsedContent) {
+    return null;
+  }
+  return {
+    messageId: message.message_id,
+    openId,
+    chatId: message.chat_id,
+    chatType: normalizeChatType(message.chat_type),
+    text: parsedContent
+  };
+}
+function parseLarkTextContent(content) {
+  if (!content) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(content);
+    return typeof parsed.text === "string" ? parsed.text : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeChatType(chatType) {
+  return chatType === "p2p" ? "direct" : "group";
+}
+
+// src/channels/lark/controller.ts
+function createLarkEventHandler(dependencies) {
+  return async function handleLarkEvent2(request, reply) {
+    const installationId = request.params?.installationId;
+    if (!installationId) {
+      reply.status(400).send({ success: false, message: "Missing installationId" });
+      return;
+    }
+    const config = await dependencies.getInstallationConfig(installationId);
+    if (!config) {
+      reply.status(404).send({ success: false, message: "Lark installation not found" });
+      return;
+    }
+    const body = dependencies.parseRequestBody(
+      request.body,
+      config.encryptKey
+    );
+    if (!dependencies.verifyParsedBody(body, config)) {
+      reply.status(401).send({ success: false, message: "Invalid Lark request" });
+      return;
+    }
+    if (body.type === "url_verification" && body.challenge) {
+      reply.status(200).send({ challenge: body.challenge });
+      return;
+    }
+    const parsed = dependencies.parseEvent(request.body);
+    if (!parsed) {
+      reply.status(200).send({ success: true, ignored: true });
+      return;
+    }
+    const receipt = await dependencies.claimInboundReceipt({
+      channel: "lark",
+      channelAppId: config.appId,
+      externalMessageId: parsed.messageId,
+      tenantId: config.tenantId
+    });
+    if (!receipt.accepted) {
+      reply.status(200).send(
+        receipt.status === "processing" ? { success: true, processing: true } : { success: true, duplicate: true }
+      );
+      return;
+    }
+    try {
+      const { threadId } = await dependencies.resolveThread({
+        channel: "lark",
+        channelAppId: config.appId,
+        tenantId: config.tenantId,
+        assistantId: config.assistantId,
+        mappingMode: config.mappingMode,
+        openId: parsed.openId,
+        chatId: parsed.chatId,
+        chatType: parsed.chatType,
+        messageId: parsed.messageId,
+        workspaceId: config.workspaceId,
+        projectId: config.projectId
+      });
+      const text = await dependencies.runAgentAndCollectText({
+        tenantId: config.tenantId,
+        assistantId: config.assistantId,
+        threadId,
+        text: parsed.text,
+        workspaceId: config.workspaceId,
+        projectId: config.projectId
+      });
+      await dependencies.sendTextReply({
+        chatId: parsed.chatId,
+        text,
+        config
+      });
+      await dependencies.markInboundReceiptCompleted({
+        channel: "lark",
+        channelAppId: config.appId,
+        externalMessageId: parsed.messageId,
+        tenantId: config.tenantId,
+        threadId
+      });
+      reply.status(200).send({ success: true, threadId });
+    } catch (error) {
+      await dependencies.markInboundReceiptFailed({
+        channel: "lark",
+        channelAppId: config.appId,
+        externalMessageId: parsed.messageId,
+        tenantId: config.tenantId
+      });
+      throw error;
+    }
+  };
+}
+var handleLarkEvent = createLarkEventHandler({
+  getInstallationConfig: async () => null,
+  parseRequestBody: (body) => body || {},
+  verifyParsedBody: () => true,
+  parseEvent: parseLarkMessageEvent,
+  claimInboundReceipt: async () => ({ accepted: true, status: "processing" }),
+  markInboundReceiptCompleted: async () => void 0,
+  markInboundReceiptFailed: async () => void 0,
+  resolveThread: async () => ({ threadId: "" }),
+  runAgentAndCollectText: async () => "",
+  sendTextReply: async () => void 0
+});
+
+// src/channels/lark/config.ts
+function loadLarkIngressConfig() {
+  return {
+    enabled: process.env.LARK_ENABLED !== "false",
+    appId: process.env.LARK_APP_ID || "",
+    appSecret: process.env.LARK_APP_SECRET || "",
+    verificationToken: process.env.LARK_VERIFICATION_TOKEN,
+    encryptKey: process.env.LARK_ENCRYPT_KEY,
+    tenantId: process.env.LARK_TENANT_ID || "default",
+    assistantId: process.env.LARK_ASSISTANT_ID || "default_agent",
+    workspaceId: process.env.LARK_WORKSPACE_ID,
+    projectId: process.env.LARK_PROJECT_ID,
+    mappingMode: process.env.LARK_MAPPING_MODE || "hybrid"
+  };
+}
+function isLarkIngressEnabled(config) {
+  return config.enabled;
+}
+
+// src/channels/lark/mapping-service.ts
+var import_crypto6 = require("crypto");
+function createChannelThreadMappingService(deps) {
+  return {
+    async getOrCreateThread(input) {
+      const externalSubjectKey = buildExternalSubjectKey(input);
+      const existing = await deps.mappingStore.getMappingBySubject({
+        channel: input.channel,
+        channelAppId: input.channelAppId,
+        tenantId: input.tenantId,
+        assistantId: input.assistantId,
+        externalSubjectKey
+      });
+      if (existing) {
+        return { threadId: existing.threadId };
+      }
+      const threadId = (deps.uuid || import_crypto6.randomUUID)();
+      await deps.threadStore.createThread(input.tenantId, input.assistantId, threadId, {
+        metadata: {
+          tenantId: input.tenantId,
+          workspaceId: input.workspaceId,
+          projectId: input.projectId,
+          channel: input.channel,
+          larkChatId: input.chatId,
+          larkOpenId: input.openId
+        }
+      });
+      try {
+        await deps.mappingStore.createMapping({
+          channel: input.channel,
+          channelAppId: input.channelAppId,
+          tenantId: input.tenantId,
+          assistantId: input.assistantId,
+          mappingMode: input.mappingMode,
+          externalSubjectType: resolveSubjectType(input.mappingMode, input.chatType) === "user" ? "user" : "chat",
+          externalSubjectKey,
+          larkOpenId: input.openId,
+          larkChatId: input.chatId,
+          larkMessageId: input.messageId,
+          threadId
+        });
+      } catch (error) {
+        if (!isUniqueViolation(error)) {
+          throw error;
+        }
+        const canonical = await deps.mappingStore.getMappingBySubject({
+          channel: input.channel,
+          channelAppId: input.channelAppId,
+          tenantId: input.tenantId,
+          assistantId: input.assistantId,
+          externalSubjectKey
+        });
+        if (!canonical) {
+          throw error;
+        }
+        await deps.threadStore.deleteThread(input.tenantId, threadId);
+        return { threadId: canonical.threadId };
+      }
+      return { threadId };
+    }
+  };
+}
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+function buildExternalSubjectKey(input) {
+  const subjectType = resolveSubjectType(input.mappingMode, input.chatType);
+  const subjectValue = subjectType === "user" ? input.openId : input.chatId;
+  return [
+    input.channel,
+    input.channelAppId,
+    `tenant:${input.tenantId}`,
+    `assistant:${input.assistantId}`,
+    `${subjectType}:${subjectValue}`
+  ].join(":");
+}
+function resolveSubjectType(mappingMode, chatType) {
+  if (mappingMode === "user") {
+    return "user";
+  }
+  if (mappingMode === "group") {
+    return "chat";
+  }
+  return chatType === "direct" ? "user" : "chat";
+}
+
+// src/channels/lark/runner.ts
+var import_core25 = require("@axiom-lattice/core");
+var import_protocols4 = require("@axiom-lattice/protocols");
+
+// src/channels/lark/aggregator.ts
+var import_protocols3 = require("@axiom-lattice/protocols");
+function aggregateLarkReply(messageId, chunks) {
+  return chunks.filter(
+    (chunk) => chunk.type === import_protocols3.MessageChunkTypes.AI && chunk.data.id === messageId
+  ).map((chunk) => chunk.data.content || "").join("").trim();
+}
+
+// src/channels/lark/runner.ts
+async function runAgentAndCollectLarkReply(input) {
+  const agent = import_core25.agentInstanceManager.getAgent({
+    tenant_id: input.tenantId,
+    assistant_id: input.assistantId,
+    thread_id: input.threadId,
+    workspace_id: input.workspaceId,
+    project_id: input.projectId
+  });
+  const result = await agent.addMessage({
+    input: {
+      message: input.text
+    }
+  });
+  const chunks = [];
+  const stream = agent.chunkStream(result.messageId, [
+    import_protocols4.MessageChunkTypes.MESSAGE_COMPLETED
+  ]);
+  for await (const chunk of stream) {
+    chunks.push(chunk);
+  }
+  return aggregateLarkReply(result.messageId, chunks);
+}
+
+// src/channels/lark/sender.ts
+function createLarkSender(config, client = createDefaultLarkClient(config)) {
+  return {
+    async sendTextReply(input) {
+      const response = await client.im.v1.message.create({
+        params: {
+          receive_id_type: "chat_id"
+        },
+        data: {
+          receive_id: input.chatId,
+          msg_type: "text",
+          content: JSON.stringify({ text: input.text })
+        }
+      });
+      if (response.code && response.code !== 0) {
+        throw new Error("Failed to send Lark reply");
+      }
+    }
+  };
+}
+function createDefaultLarkClient(config) {
+  const Lark = require("@larksuiteoapi/node-sdk");
+  return new Lark.Client({
+    appId: config.appId,
+    appSecret: config.appSecret
+  });
+}
+
+// src/channels/lark/verification.ts
+var import_crypto7 = __toESM(require("crypto"));
+function parseLarkRequestBody(body, encryptKey) {
+  const parsed = body || {};
+  if (encryptKey && typeof parsed.encrypt === "string") {
+    return decryptLarkPayload(encryptKey, parsed.encrypt);
+  }
+  return parsed;
+}
+function decryptLarkPayload(encryptKey, encryptedPayload) {
+  const key = import_crypto7.default.createHash("sha256").update(encryptKey).digest();
+  const buffer = Buffer.from(encryptedPayload, "base64");
+  const iv = buffer.subarray(0, 16);
+  const ciphertext = buffer.subarray(16);
+  const decipher = import_crypto7.default.createDecipheriv("aes-256-cbc", key, iv);
+  const plaintext = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final()
+  ]).toString("utf8");
+  return JSON.parse(plaintext);
+}
+function createLarkRequestVerifier(config) {
+  return function verifyRequest(request) {
+    const body = parseLarkRequestBody(request.body, config.encryptKey);
+    return verifyLarkParsedBody(body, config);
+  };
+}
+function verifyLarkParsedBody(body, config) {
+  if (!config.verificationToken) {
+    return true;
+  }
+  return extractVerificationToken(body) === config.verificationToken;
+}
+function extractVerificationToken(body) {
+  if (typeof body.token === "string") {
+    return body.token;
+  }
+  if (typeof body.header?.token === "string") {
+    return body.header.token;
+  }
+  return void 0;
+}
+
+// src/channels/lark/routes.ts
+function registerLarkChannelRoutes(app2, dependencies) {
+  const config = loadLarkIngressConfig();
+  if (!dependencies && !isLarkIngressEnabled(config)) {
+    return;
+  }
+  const handlerDependencies = dependencies || createDefaultLarkDependencies();
+  app2.post(
+    "/api/channels/lark/installations/:installationId/events",
+    createLarkEventHandler({
+      ...handlerDependencies
+    })
+  );
+}
+function createDefaultLarkDependencies() {
+  const installationStore = new import_pg_stores.PostgreSQLChannelInstallationStore({
+    poolConfig: getDatabaseUrl()
+  });
+  const threadStore = (0, import_core26.getStoreLattice)("default", "thread").store;
+  const mappingStore = new import_pg_stores.ChannelIdentityMappingStore({
+    poolConfig: getDatabaseUrl()
+  });
+  const mappingService = createChannelThreadMappingService({
+    mappingStore,
+    threadStore
+  });
+  return {
+    getInstallationConfig: async (installationId) => {
+      const installation = await installationStore.getInstallationById(
+        installationId
+      );
+      if (!installation || installation.channel !== "lark") {
+        return null;
+      }
+      return {
+        enabled: true,
+        installationId: installation.id,
+        tenantId: installation.tenantId,
+        assistantId: installation.config.assistantId,
+        appId: installation.config.appId,
+        appSecret: installation.config.appSecret,
+        verificationToken: installation.config.verificationToken,
+        encryptKey: installation.config.encryptKey,
+        workspaceId: installation.config.workspaceId,
+        projectId: installation.config.projectId,
+        mappingMode: installation.config.mappingMode
+      };
+    },
+    parseRequestBody: (body, encryptKey) => parseLarkRequestBody(body, encryptKey),
+    verifyParsedBody: (body, config) => {
+      if (!config.verificationToken) {
+        return true;
+      }
+      return createLarkRequestVerifier(config)({
+        body
+      });
+    },
+    parseEvent: parseLarkMessageEvent,
+    claimInboundReceipt: (input) => mappingStore.claimInboundReceipt(input),
+    markInboundReceiptCompleted: (input) => mappingStore.markInboundReceiptCompleted(input),
+    markInboundReceiptFailed: (input) => mappingStore.markInboundReceiptFailed(input),
+    resolveThread: (input) => mappingService.getOrCreateThread(input),
+    runAgentAndCollectText: ({ tenantId, assistantId, threadId, text, workspaceId, projectId }) => runAgentAndCollectLarkReply({
+      tenantId,
+      assistantId,
+      threadId,
+      text,
+      workspaceId,
+      projectId
+    }),
+    sendTextReply: async ({ chatId, text, config }) => {
+      const sender = createLarkSender({
+        appId: config.appId,
+        appSecret: config.appSecret
+      });
+      await sender.sendTextReply({ chatId, text });
+    }
+  };
+}
+function getDatabaseUrl() {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for Lark channel ingress");
+  }
+  return databaseUrl;
+}
+
+// src/channels/routes.ts
+var channelRouteRegistrars = [
+  (app2, dependencies) => registerLarkChannelRoutes(app2, dependencies.lark)
+];
+function registerChannelRoutes(app2, dependencies = {}) {
+  for (const registerRoutes of channelRouteRegistrars) {
+    registerRoutes(app2, dependencies);
+  }
+}
+
+// src/controllers/channel-installations.ts
+var import_crypto8 = require("crypto");
+function getTenantId9(request) {
+  const userTenantId = request.user?.tenantId;
+  if (userTenantId) {
+    return userTenantId;
+  }
+  return request.headers["x-tenant-id"] || "default";
+}
+function getInstallationStore() {
+  const { PostgreSQLChannelInstallationStore: PostgreSQLChannelInstallationStore2 } = require("@axiom-lattice/pg-stores");
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for channel installation store");
+  }
+  return new PostgreSQLChannelInstallationStore2({
+    poolConfig: databaseUrl
+  });
+}
+async function getChannelInstallationList(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { channel } = request.query;
+  try {
+    const store = getInstallationStore();
+    const installations = await store.getInstallationsByTenant(tenantId, channel);
+    return {
+      success: true,
+      message: "Channel installations retrieved successfully",
+      data: {
+        records: installations,
+        total: installations.length
+      }
+    };
+  } catch (error) {
+    console.error("Failed to get channel installations:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installations",
+      data: {
+        records: [],
+        total: 0
+      }
+    };
+  }
+}
+async function getChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  try {
+    const store = getInstallationStore();
+    const installation = await store.getInstallationById(installationId);
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (installation.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation retrieved successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to get channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installation"
+    };
+  }
+}
+async function createChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const body = request.body;
+  try {
+    if (!body.channel) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Channel type is required"
+      };
+    }
+    if (!body.config) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Configuration is required"
+      };
+    }
+    if (body.channel === "lark") {
+      const larkConfig = body.config;
+      if (!larkConfig.appId || !larkConfig.appSecret) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "appId and appSecret are required for Lark installations"
+        };
+      }
+      if (!larkConfig.assistantId) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "assistantId is required for Lark installations"
+        };
+      }
+    }
+    const store = getInstallationStore();
+    const installationId = body.id || (0, import_crypto8.randomUUID)();
+    const installation = await store.createInstallation(
+      tenantId,
+      installationId,
+      body
+    );
+    reply.code(201);
+    return {
+      success: true,
+      message: "Channel installation created successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to create channel installation:", error);
+    if (error.message?.includes("duplicate") || error.code === "23505") {
+      reply.code(409);
+      return {
+        success: false,
+        message: "Channel installation with this ID already exists"
+      };
+    }
+    return {
+      success: false,
+      message: "Failed to create channel installation"
+    };
+  }
+}
+async function updateChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  const body = request.body;
+  try {
+    const store = getInstallationStore();
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    const installation = await store.updateInstallation(
+      tenantId,
+      installationId,
+      body
+    );
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation updated successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to update channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to update channel installation"
+    };
+  }
+}
+async function deleteChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  try {
+    const store = getInstallationStore();
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    const deleted = await store.deleteInstallation(tenantId, installationId);
+    if (!deleted) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation deleted successfully"
+    };
+  } catch (error) {
+    console.error("Failed to delete channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to delete channel installation"
+    };
+  }
+}
+
+// src/routes/channel-installations.ts
+function registerChannelInstallationRoutes(app2) {
+  app2.get("/api/channel-installations", getChannelInstallationList);
+  app2.get("/api/channel-installations/:installationId", getChannelInstallation);
+  app2.post("/api/channel-installations", createChannelInstallation);
+  app2.put("/api/channel-installations/:installationId", updateChannelInstallation);
+  app2.delete("/api/channel-installations/:installationId", deleteChannelInstallation);
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2) => {
   app2.post("/api/runs", createRun);
@@ -5027,6 +5529,8 @@ var registerLatticeRoutes = (app2) => {
     autoApproveUsers: process.env.AUTO_APPROVE_USERS !== "false",
     allowTenantRegistration: process.env.ALLOW_TENANT_REGISTRATION !== "false"
   });
+  registerChannelRoutes(app2);
+  registerChannelInstallationRoutes(app2);
   app2.delete(
     "/api/assistants/:assistant_id/threads/:thread_id/pending-messages/:message_id",
     removePendingMessageHandler
@@ -5096,7 +5600,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-var import_core26 = require("@axiom-lattice/core");
+var import_core27 = require("@axiom-lattice/core");
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -5111,18 +5615,18 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = import_core26.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core26.QueueMode.STEER);
+    const agent = import_core27.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core27.QueueMode.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
-        import_core26.eventBus.publish(callback_event, {
+        import_core27.eventBus.publish(callback_event, {
           success: true,
           state: evt.state,
           config: { assistant_id, thread_id, tenant_id }
         });
       });
       agent.subscribeOnce("message:interrupted", (evt) => {
-        import_core26.eventBus.publish(callback_event, {
+        import_core27.eventBus.publish(callback_event, {
           success: true,
           state: evt.state,
           config: { assistant_id, thread_id, tenant_id }
@@ -5146,7 +5650,7 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      import_core26.eventBus.publish(callback_event, {
+      import_core27.eventBus.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error),
         config: { assistant_id, thread_id, tenant_id }
@@ -5184,7 +5688,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    import_core26.eventBus.subscribe(import_core26.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    import_core27.eventBus.subscribe(import_core27.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -5303,7 +5807,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        import_core26.eventBus.publish(taskRequest.callback_event, {
+        import_core27.eventBus.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error),
           config: {
@@ -5323,26 +5827,26 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core27 = require("@axiom-lattice/core");
-var import_protocols3 = require("@axiom-lattice/protocols");
+var import_core28 = require("@axiom-lattice/core");
+var import_protocols5 = require("@axiom-lattice/protocols");
 process.on("unhandledRejection", (reason, promise) => {
   console.error("\u672A\u5904\u7406\u7684Promise\u62D2\u7EDD:", reason);
 });
 var DEFAULT_LOGGER_CONFIG = {
   name: "default",
   description: "Default logger for lattice-gateway service",
-  type: import_protocols3.LoggerType.PINO,
+  type: import_protocols5.LoggerType.PINO,
   serviceName: "lattice/gateway",
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core27.loggerLatticeManager.hasLattice("default")) {
-    import_core27.loggerLatticeManager.removeLattice("default");
+  if (import_core28.loggerLatticeManager.hasLattice("default")) {
+    import_core28.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core27.registerLoggerLattice)("default", config);
-  return (0, import_core27.getLoggerLattice)("default");
+  (0, import_core28.registerLoggerLattice)("default", config);
+  return (0, import_core28.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -5434,6 +5938,22 @@ app.setErrorHandler((error, request, reply) => {
     error: error.message || "\u670D\u52A1\u5668\u5185\u90E8\u9519\u8BEF"
   });
 });
+function getConfiguredSandboxProvider() {
+  const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox";
+  return (0, import_core28.createSandboxProvider)({
+    type: sandboxProviderType,
+    remoteBaseURL: process.env.SANDBOX_BASE_URL,
+    microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
+    e2bApiKey: process.env.E2B_API_KEY,
+    e2bTemplate: process.env.E2B_TEMPLATE,
+    e2bTimeoutMs: process.env.E2B_TIMEOUT_MS ? parseInt(process.env.E2B_TIMEOUT_MS, 10) : void 0,
+    daytonaApiKey: process.env.DAYTONA_API_KEY,
+    daytonaApiUrl: process.env.DAYTONA_API_URL,
+    daytonaTarget: process.env.DAYTONA_TARGET,
+    daytonaTimeout: process.env.DAYTONA_TIMEOUT ? parseInt(process.env.DAYTONA_TIMEOUT, 10) : void 0,
+    daytonaVolumeName: process.env.DAYTONA_VOLUME_NAME
+  });
+}
 var start = async (config) => {
   try {
     if (config?.loggerConfig) {
@@ -5449,19 +5969,16 @@ var start = async (config) => {
     app.decorate("loggerLattice", loggerLattice);
     registerLatticeRoutes(app);
     try {
-      const storeLattice = (0, import_core27.getStoreLattice)("default", "database");
+      const storeLattice = (0, import_core28.getStoreLattice)("default", "database");
       const store = storeLattice.store;
-      import_core27.sqlDatabaseManager.setConfigStore(store);
+      import_core28.sqlDatabaseManager.setConfigStore(store);
       logger.info("Database config store set for SqlDatabaseManager");
     } catch (error) {
       logger.warn("Failed to set database config store: " + (error instanceof Error ? error.message : String(error)));
     }
-    if (!import_core27.sandboxLatticeManager.hasLattice("default")) {
-      const sandboxBaseURL = process.env.SANDBOX_BASE_URL || "http://localhost:8080";
-      import_core27.sandboxLatticeManager.registerLattice("default", {
-        baseURL: sandboxBaseURL
-      });
-      logger.info(`Registered sandbox manager with baseURL: ${sandboxBaseURL}`);
+    if (!import_core28.sandboxLatticeManager.hasLattice("default")) {
+      import_core28.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+      logger.info("Registered sandbox manager from env configuration");
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     await app.listen({ port: target_port, host: "0.0.0.0" });
@@ -5481,7 +5998,7 @@ var start = async (config) => {
     }
     try {
       logger.info("Starting agent instance recovery...");
-      const restoreStats = await import_core27.agentInstanceManager.restore();
+      const restoreStats = await import_core28.agentInstanceManager.restore();
       logger.info(`Agent recovery complete: ${restoreStats.restored} threads restored, ${restoreStats.errors} errors`);
     } catch (error) {
       logger.error("Agent recovery failed", { error });