@axiom-lattice/gateway 2.1.53 → 2.1.55

package/dist/index.mjs

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/index.ts
 import fastify from "fastify";
 import cors from "@fastify/cors";
@@ -591,11 +598,13 @@ async function getThreadList(request, reply) {
   const tenantId = getTenantId2(request);
   const { assistantId } = request.params;
   const metadataFilter = {};
-  if (request.query.workspaceId) {
-    metadataFilter.workspaceId = request.query.workspaceId;
+  const workspaceId = request.headers["x-workspace-id"];
+  const projectId = request.headers["x-project-id"];
+  if (workspaceId) {
+    metadataFilter.workspaceId = workspaceId;
   }
-  if (request.query.projectId) {
-    metadataFilter.projectId = request.query.projectId;
+  if (projectId) {
+    metadataFilter.projectId = projectId;
   }
   const storeLattice = getStoreLattice2("default", "thread");
   const threadStore = storeLattice.store;
@@ -1239,16 +1248,63 @@ async function getHealth(request, reply) {
   }
 }
 
-// src/controllers/skills.ts
-import { getStoreLattice as getStoreLattice3 } from "@axiom-lattice/core";
-import { validateSkillName } from "@axiom-lattice/core";
+// src/services/skill_service.ts
+import { SandboxSkillStore } from "@axiom-lattice/core";
 function getTenantId4(request) {
-  const userTenantId = request.user?.tenantId;
-  if (userTenantId) {
-    return userTenantId;
-  }
-  return request.headers["x-tenant-id"] || "default";
+  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
 }
+function getWorkspaceId(request) {
+  return request.headers["x-workspace-id"];
+}
+function getProjectId(request) {
+  return request.headers["x-project-id"];
+}
+function buildContext(request) {
+  return {
+    workspaceId: getWorkspaceId(request),
+    projectId: getProjectId(request)
+  };
+}
+var SkillService = class {
+  constructor() {
+    this.store = new SandboxSkillStore();
+  }
+  async getAllSkills(request) {
+    const tenantId = getTenantId4(request);
+    return this.store.getAllSkills(tenantId, buildContext(request));
+  }
+  async getSkillById(request, id) {
+    const tenantId = getTenantId4(request);
+    return this.store.getSkillById(tenantId, id, buildContext(request));
+  }
+  async createSkill(request, id, data) {
+    const tenantId = getTenantId4(request);
+    return this.store.createSkill(tenantId, id, data, buildContext(request));
+  }
+  async updateSkill(request, id, updates) {
+    const tenantId = getTenantId4(request);
+    return this.store.updateSkill(tenantId, id, updates, buildContext(request));
+  }
+  async deleteSkill(request, id) {
+    const tenantId = getTenantId4(request);
+    return this.store.deleteSkill(tenantId, id, buildContext(request));
+  }
+  async searchByMetadata(request, key, value) {
+    const tenantId = getTenantId4(request);
+    return this.store.searchByMetadata(tenantId, key, value, buildContext(request));
+  }
+  async filterByCompatibility(request, compatibility) {
+    const tenantId = getTenantId4(request);
+    return this.store.filterByCompatibility(tenantId, compatibility, buildContext(request));
+  }
+  async filterByLicense(request, license) {
+    const tenantId = getTenantId4(request);
+    return this.store.filterByLicense(tenantId, license, buildContext(request));
+  }
+};
+
+// src/controllers/skills.ts
+var skillService = new SkillService();
 function serializeSkill(skill) {
   const serialized = {
     id: skill.id,
@@ -1259,192 +1315,100 @@ function serializeSkill(skill) {
     metadata: skill.metadata || {},
     content: skill.content,
     subSkills: skill.subSkills,
-    createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : skill.createdAt ? new Date(skill.createdAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
-    updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : skill.updatedAt ? new Date(skill.updatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
   };
   Object.keys(serialized).forEach((key) => {
-    if (serialized[key] === void 0) {
-      delete serialized[key];
-    }
+    if (serialized[key] === void 0) delete serialized[key];
   });
   return serialized;
 }
 async function getSkillList(request, reply) {
   try {
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.getAllSkills(tenantId);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.getAllSkills(request);
     return {
       success: true,
       message: "Successfully retrieved skill list",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to retrieve skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
 async function getSkill(request, reply) {
   try {
-    const tenantId = getTenantId4(request);
     const { id } = request.params;
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const skill = await skillStore.getSkillById(tenantId, id);
+    const skill = await skillService.getSkillById(request, id);
     if (!skill) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully retrieved skill",
-      data: serializeSkill(skill)
-    };
+    return { success: true, message: "Successfully retrieved skill", data: serializeSkill(skill) };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to retrieve skill: ${error.message}`
-    });
+    return reply.status(500).send({ success: false, message: `Failed to retrieve skill: ${error.message}` });
   }
 }
 async function createSkill(request, reply) {
   try {
     const data = request.body;
     if (!data.name) {
-      return reply.status(400).send({
-        success: false,
-        message: "name is required"
-      });
+      return reply.status(400).send({ success: false, message: "name is required" });
     }
     if (!data.description) {
-      return reply.status(400).send({
-        success: false,
-        message: "description is required"
-      });
-    }
-    try {
-      validateSkillName(data.name);
-    } catch (error) {
-      return reply.status(400).send({
-        success: false,
-        message: error.message || "Invalid skill name format"
-      });
+      return reply.status(400).send({ success: false, message: "description is required" });
     }
     const id = request.body.id || data.name;
     if (id !== data.name) {
       return reply.status(400).send({
         success: false,
-        message: `id "${id}" must equal name "${data.name}" (name is used for path addressing)`
+        message: `id "${id}" must equal name "${data.name}"`
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (exists) {
-      return reply.status(409).send({
-        success: false,
-        message: `Skill with id "${id}" already exists`
-      });
-    }
-    const newSkill = await skillStore.createSkill(tenantId, id, data);
+    const skill = await skillService.createSkill(request, id, data);
     return reply.status(201).send({
       success: true,
       message: "Successfully created skill",
-      data: serializeSkill(newSkill)
+      data: serializeSkill(skill)
     });
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to create skill: ${error.message}`
-    });
+    if (error.message?.includes("already exists")) {
+      return reply.status(409).send({ success: false, message: error.message });
+    }
+    if (error.message?.includes("must equal name") || error.message?.includes("Invalid skill name")) {
+      return reply.status(400).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({ success: false, message: `Failed to create skill: ${error.message}` });
   }
 }
 async function updateSkill(request, reply) {
   try {
     const { id } = request.params;
     const updates = request.body;
-    if (updates.name !== void 0) {
-      try {
-        validateSkillName(updates.name);
-      } catch (error) {
-        return reply.status(400).send({
-          success: false,
-          message: error.message || "Invalid skill name format"
-        });
-      }
-    }
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (!exists) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
-    }
-    const updatedSkill = await skillStore.updateSkill(tenantId, id, updates);
-    if (!updatedSkill) {
-      return reply.status(500).send({
-        success: false,
-        message: "Failed to update skill"
-      });
+    const skill = await skillService.updateSkill(request, id, updates);
+    if (!skill) {
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully updated skill",
-      data: serializeSkill(updatedSkill)
-    };
+    return { success: true, message: "Successfully updated skill", data: serializeSkill(skill) };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to update skill: ${error.message}`
-    });
+    if (error.message?.includes("Invalid skill name")) {
+      return reply.status(400).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({ success: false, message: `Failed to update skill: ${error.message}` });
   }
 }
 async function deleteSkill(request, reply) {
   try {
     const { id } = request.params;
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const exists = await skillStore.hasSkill(tenantId, id);
-    if (!exists) {
-      return reply.status(404).send({
-        success: false,
-        message: "Skill not found"
-      });
-    }
-    const deleted = await skillStore.deleteSkill(tenantId, id);
-    if (!deleted) {
-      return reply.status(500).send({
-        success: false,
-        message: "Failed to delete skill"
-      });
+    const result = await skillService.deleteSkill(request, id);
+    if (!result) {
+      return reply.status(404).send({ success: false, message: "Skill not found" });
     }
-    return {
-      success: true,
-      message: "Successfully deleted skill"
-    };
+    return { success: true, message: "Successfully deleted skill" };
   } catch (error) {
-    return reply.status(500).send({
-      success: false,
-      message: `Failed to delete skill: ${error.message}`
-    });
+    return reply.status(500).send({ success: false, message: `Failed to delete skill: ${error.message}` });
   }
 }
 async function searchSkillsByMetadata(request, reply) {
@@ -1454,33 +1418,20 @@ async function searchSkillsByMetadata(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "key and value query parameters are required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.searchByMetadata(tenantId, key, value);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.searchByMetadata(request, key, value);
     return {
       success: true,
       message: "Successfully searched skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to search skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
@@ -1491,33 +1442,20 @@ async function filterSkillsByCompatibility(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "compatibility query parameter is required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.filterByCompatibility(tenantId, compatibility);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.filterByCompatibility(request, compatibility);
     return {
       success: true,
       message: "Successfully filtered skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to filter skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
@@ -1528,33 +1466,20 @@ async function filterSkillsByLicense(request, reply) {
       return reply.status(400).send({
         success: false,
         message: "license query parameter is required",
-        data: {
-          records: [],
-          total: 0
-        }
+        data: { records: [], total: 0 }
       });
     }
-    const tenantId = getTenantId4(request);
-    const storeLattice = getStoreLattice3("default", "skill");
-    const skillStore = storeLattice.store;
-    const skills = await skillStore.filterByLicense(tenantId, license);
-    const serializedSkills = skills.map(serializeSkill);
+    const skills = await skillService.filterByLicense(request, license);
     return {
       success: true,
       message: "Successfully filtered skills",
-      data: {
-        records: serializedSkills,
-        total: serializedSkills.length
-      }
+      data: { records: skills.map(serializeSkill), total: skills.length }
     };
   } catch (error) {
     return reply.status(500).send({
       success: false,
       message: `Failed to filter skills: ${error.message}`,
-      data: {
-        records: [],
-        total: 0
-      }
+      data: { records: [], total: 0 }
     });
   }
 }
@@ -1643,7 +1568,7 @@ async function getToolConfigs(request, reply) {
 
 // src/controllers/data-query.ts
 import {
-  getStoreLattice as getStoreLattice4,
+  getStoreLattice as getStoreLattice3,
   metricsServerManager
 } from "@axiom-lattice/core";
 function getTenantId5(request) {
@@ -1676,7 +1601,7 @@ async function executeDataQuery(request, reply) {
         message: "Cannot provide both metrics and customSql. Use one query type only."
       };
     }
-    const storeLattice = getStoreLattice4("default", "metrics");
+    const storeLattice = getStoreLattice3("default", "metrics");
     const store = storeLattice.store;
     if (!body.serverKey) {
       reply.code(400);
@@ -2168,11 +2093,8 @@ async function removePendingMessageHandler(request, reply) {
   }
 }
 
-// src/controllers/sandbox.ts
-import { Readable } from "stream";
-
 // src/services/sandbox_service.ts
-import { agentLatticeManager as agentLatticeManager3, getSandBoxManager, normalizeSandboxName } from "@axiom-lattice/core";
+import { agentLatticeManager as agentLatticeManager3, normalizeSandboxName } from "@axiom-lattice/core";
 var ERROR_HTML = `<!DOCTYPE html>
 <html lang="zh-CN">
 <head>
@@ -2264,7 +2186,7 @@ var ERROR_HTML = `<!DOCTYPE html>
       </div>
       <div class="info-item">
         <span class="label">\u9694\u79BB\u7EA7\u522B</span>
-        <span class="value" id="isolatedLevel">-</span>
+        <span class="value" id="vmIsolation">-</span>
       </div>
       <div class="info-item">
         <span class="label">\u9519\u8BEF\u4FE1\u606F</span>
@@ -2277,13 +2199,13 @@ var ERROR_HTML = `<!DOCTYPE html>
     const params = new URLSearchParams(window.location.search);
     document.getElementById('assistantId').textContent = params.get('assistantId') || '-';
     document.getElementById('threadId').textContent = params.get('threadId') || '-';
-    document.getElementById('isolatedLevel').textContent = params.get('isolatedLevel') || '-';
+    document.getElementById('vmIsolation').textContent = params.get('vmIsolation') || '-';
     document.getElementById('errorMsg').textContent = params.get('error') || '\u672A\u77E5\u9519\u8BEF';
   </script>
 </body>
 </html>`;
 var SandboxService = class {
-  getFilesystemIsolatedLevel(tenantId, assistantId) {
+  getFilesystemVmIsolation(tenantId, assistantId) {
     const agentLattice = agentLatticeManager3.getAgentLatticeWithTenant(tenantId, assistantId);
     if (!agentLattice) {
       return null;
@@ -2293,27 +2215,26 @@ var SandboxService = class {
       return null;
     }
     const config = filesystemConfig.config;
-    return config?.isolatedLevel || null;
+    return config?.vmIsolation || null;
   }
-  computeSandboxName(assistantId, threadId, isolatedLevel) {
-    let sandboxName;
-    switch (isolatedLevel) {
+  computeSandboxName(assistantId, threadId, vmIsolation, tenantId, workspaceId, projectId) {
+    switch (vmIsolation) {
       case "agent":
-        sandboxName = assistantId;
-        break;
-      case "thread":
-        sandboxName = threadId;
-        break;
+        return normalizeSandboxName(`${tenantId ?? "default"}-${assistantId}`);
+      case "project":
+        return normalizeSandboxName(
+          `${tenantId ?? "default"}-${workspaceId ?? "default"}-${projectId ?? "default"}`
+        );
       case "global":
       default:
-        sandboxName = "global";
-        break;
+        return "global";
     }
-    return normalizeSandboxName(sandboxName);
+  }
+  getBrowserSandboxBaseURL() {
+    return process.env.AGENT_INFRA_SANDBOX_BASE_URL || "http://localhost:8080";
   }
   getTargetUrl(sandboxName) {
-    const sandboxManager = getSandBoxManager();
-    return `${sandboxManager.getBaseURL()}/sandbox/${sandboxName}`;
+    return `${this.getBrowserSandboxBaseURL()}/sandbox/${sandboxName}`;
   }
   async getVncHtml(sandboxName) {
     const response = await fetch(`${this.getTargetUrl(sandboxName)}/vnc/index.html`);
@@ -2349,9 +2270,9 @@ var SandboxService = class {
     );
     return rewritten;
   }
-  generateErrorHtml(assistantId, threadId, isolatedLevel, errorMessage) {
+  generateErrorHtml(assistantId, threadId, vmIsolation, errorMessage) {
     const encodedError = encodeURIComponent(errorMessage);
-    return ERROR_HTML.replace("{assistantId}", assistantId).replace("{threadId}", threadId).replace("{isolatedLevel}", isolatedLevel).replace("{errorMessage}", errorMessage);
+    return ERROR_HTML.replace("{assistantId}", assistantId).replace("{threadId}", threadId).replace("{vmIsolation}", vmIsolation).replace("{errorMessage}", errorMessage);
   }
 };
 var sandboxService = new SandboxService();
@@ -2390,14 +2311,14 @@ function registerSandboxProxyRoutes(app2) {
       console.log("[Sandbox Upload] Route matched:", request.url);
       const { assistantId, threadId } = request.params;
       const tenantId = request.headers["x-tenant-id"] || "default";
-      const isolatedLevel = sandboxService.getFilesystemIsolatedLevel(tenantId, assistantId);
-      if (!isolatedLevel) {
+      const vmIsolation = sandboxService.getFilesystemVmIsolation(tenantId, assistantId);
+      if (!vmIsolation) {
         return reply.status(500).send({ error: "Assistant sandbox config not found" });
       }
       const sandboxName = sandboxService.computeSandboxName(
         assistantId,
         threadId,
-        isolatedLevel
+        vmIsolation
       );
       const sandboxManager = getSandBoxManager2();
       const sandbox = await sandboxManager.createSandbox(sandboxName);
@@ -2409,17 +2330,14 @@ function registerSandboxProxyRoutes(app2) {
         const buffer = await data.toBuffer();
         const pathEntry = data.fields?.path;
         const pathValue = pathEntry && typeof pathEntry === "object" && "value" in pathEntry ? String(pathEntry.value) : typeof pathEntry === "string" ? pathEntry : void 0;
-        const formData = new FormData();
-        formData.append("file", new Blob([buffer]), data.filename ?? "file");
-        const path3 = `/home/gem/uploads/${pathValue ? pathValue : ""}${data.filename}`;
-        const uploadResult = await sandbox.file.uploadFile({
-          file: buffer,
-          path: path3
-        });
-        if (!uploadResult.ok) {
-          return reply.status(502).send({ error: `Upload error: ${uploadResult.error}` });
+        const filePath = `~/uploads/${pathValue ? pathValue : ""}${data.filename}`;
+        try {
+          await sandbox.file.uploadFile({ file: filePath, data: buffer });
+        } catch (err) {
+          reply.status(500).send({ error: String(err) });
+          return;
         }
-        const relativePath = uploadResult.body?.data?.file_path.replace(`/home/gem`, "");
+        const relativePath = filePath.replace(`~/`, "");
         const result = { id: relativePath, name: data.filename, size: buffer.length };
         return reply.status(200).send({ message: "File uploaded successfully", ...result });
       } catch (error) {
@@ -2437,59 +2355,30 @@ function registerSandboxProxyRoutes(app2) {
       if (!filePath || typeof filePath !== "string") {
         return reply.status(400).send({ error: "Query parameter 'path' is required" });
       }
-      const isolatedLevel = sandboxService.getFilesystemIsolatedLevel(tenantId, assistantId);
-      if (!isolatedLevel) {
-        return reply.status(500).send({ error: "Assistant filesystem isolated level not found" });
+      const vmIsolation = sandboxService.getFilesystemVmIsolation(tenantId, assistantId);
+      if (!vmIsolation) {
+        return reply.status(500).send({ error: "Assistant filesystem vmIsolation not found" });
       }
       const sandboxName = sandboxService.computeSandboxName(
         assistantId,
         threadId,
-        isolatedLevel
+        vmIsolation
       );
       const sandboxManager = getSandBoxManager2();
       const sandbox = await sandboxManager.createSandbox(sandboxName);
       try {
-        const resolvedPath = filePath.startsWith("/home/gem") ? filePath : `/home/gem/${filePath.replace(/^\//, "")}`;
+        const resolvedPath = filePath.startsWith("~/") ? filePath : `~/${filePath.replace(/^\//, "")}`;
         const filename = getFilenameFromPath(resolvedPath);
         const inferredContentType = getContentTypeFromFilename(filename);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: resolvedPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            error: `Download error: ${JSON.stringify(downloadResult.error)}`
-          });
-        }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = Readable.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          const contentDisposition2 = body.contentDisposition ?? `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-          reply = reply.status(200).type(contentType2).header("Content-Disposition", contentDisposition2).send(nodeStream);
+        try {
+          const buf = await sandbox.file.downloadFile({ file: resolvedPath });
+          const contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+          reply = reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
           return reply;
+        } catch (err) {
+          reply.status(500).send({ error: String(err) });
+          return;
         }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        let contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-          if (res.headers?.get("content-disposition")) contentDisposition = res.headers.get("content-disposition");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ error: "Unexpected download response format" });
-        }
-        reply = reply.status(200).type(contentType).header("Content-Disposition", contentDisposition).send(buf);
-        return reply;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         return reply.status(502).send({ error: `Download proxy error: ${message}` });
@@ -2501,15 +2390,14 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 import * as fs from "fs/promises";
 import * as path from "path";
-import { Readable as Readable2 } from "stream";
-import { getStoreLattice as getStoreLattice5 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice4 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv4 } from "uuid";
 var WorkspaceController = class {
   constructor() {
-    this.workspaceStore = getStoreLattice5("default", "workspace").store;
-    this.projectStore = getStoreLattice5("default", "project").store;
+    this.workspaceStore = getStoreLattice4("default", "workspace").store;
+    this.projectStore = getStoreLattice4("default", "project").store;
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -2643,12 +2531,16 @@ var WorkspaceController = class {
     }
     if (workspace.storageType === "sandbox") {
       const sandboxManager = getSandBoxManager3();
-      const sandboxName = "global";
-      const sandbox = await sandboxManager.createSandbox(sandboxName);
+      const sandbox = await sandboxManager.getSandboxFromConfig({
+        assistant_id: "",
+        thread_id: "",
+        tenantId,
+        workspaceId,
+        projectId
+      });
       return {
         backend: new SandboxFilesystem({
-          sandboxInstance: sandbox,
-          workingDirectory: `/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`
+          sandboxInstance: sandbox
         }),
         workspace
       };
@@ -2697,50 +2589,26 @@ var WorkspaceController = class {
     }
     try {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId);
-      const resolvedPath = filePath.startsWith("/") ? filePath : `/${filePath}`;
+      const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
         const sandboxManager = getSandBoxManager3();
-        const sandbox = await sandboxManager.createSandbox("global");
-        const realPath = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId, resolvedPath);
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = resolvedPath;
         const filename2 = this.getFilenameFromPath(resolvedPath);
         const inferredContentType = this.getMimeType(filename2);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: realPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `Download error: ${JSON.stringify(downloadResult.error)}`
-          });
+        try {
+          const buf = await sandbox.file.downloadFile({ file: realPath });
+          const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
+          return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
+        } catch (err) {
+          return reply.status(502).send({ success: false, error: String(err) });
         }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = Readable2.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          const contentDisposition2 = body.contentDisposition ?? `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
-          return reply.status(200).type(contentType2).header("Content-Disposition", contentDisposition2).send(nodeStream);
-        }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        let contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-          if (res.headers?.get("content-disposition")) contentDisposition = res.headers.get("content-disposition");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ success: false, error: "Unexpected download response format" });
-        }
-        return reply.status(200).type(contentType).header("Content-Disposition", contentDisposition).send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId);
       const content = await backend.read(resolvedPath, 0, Infinity);
@@ -2766,36 +2634,27 @@ var WorkspaceController = class {
     }
     try {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId);
-      const resolvedPath = filePath.startsWith("/") ? filePath : `/${filePath}`;
+      const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
         const sandboxManager = getSandBoxManager3();
-        const sandbox = await sandboxManager.createSandbox("global");
-        const realPath = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId, resolvedPath);
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = resolvedPath;
         const filename2 = this.getFilenameFromPath(resolvedPath);
         const inferredContentType = this.getMimeType(filename2);
-        const downloadResult = await sandbox.file.downloadFile({
-          path: realPath
-        });
-        if (!downloadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `View error: ${JSON.stringify(downloadResult.error)}`
-          });
-        }
-        const body = downloadResult.body;
-        if (typeof body?.stream === "function") {
-          const webStream = body.stream();
-          const nodeStream = Readable2.fromWeb(webStream);
-          const contentType2 = body.contentType ?? inferredContentType;
-          console.log(`[viewFile] Sandbox returned stream, contentType: ${contentType2}, filename: ${filename2}`);
-          const isHtml2 = contentType2?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
-          if (isHtml2) {
-            console.log(`[viewFile] HTML stream detected, collecting for context injection`);
-            const chunks = [];
-            for await (const chunk of nodeStream) {
-              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-            }
-            let content2 = Buffer.concat(chunks).toString("utf-8");
+        try {
+          const buf = await sandbox.file.downloadFile({ file: realPath });
+          let contentType = inferredContentType;
+          const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
+          let outputBuf = buf;
+          if (isHtml) {
+            console.log(`[viewFile] Injecting AI2APP context for sandbox HTML file: ${filename2}, tenantId: ${tenantId}, contentType: ${contentType}`);
+            let content2 = buf.toString("utf-8");
             const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
               tenantId,
               workspaceId,
@@ -2804,58 +2663,20 @@ var WorkspaceController = class {
             })};</script>`;
             if (content2.toLowerCase().includes("</head>")) {
               content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
-              console.log(`[viewFile] Context script injected before </head> (stream)`);
+              console.log(`[viewFile] Context script injected before </head>`);
             } else if (content2.toLowerCase().includes("<html>")) {
               content2 = content2.replace(/<html>/i, `<html>${contextScript}`);
-              console.log(`[viewFile] Context script injected after <html> (stream)`);
+              console.log(`[viewFile] Context script injected after <html>`);
             } else {
               content2 = contextScript + content2;
-              console.log(`[viewFile] Context script prepended to content (stream)`);
+              console.log(`[viewFile] Context script prepended to content`);
             }
-            return reply.status(200).type(contentType2).header("Content-Disposition", "inline").send(Buffer.from(content2, "utf-8"));
-          }
-          return reply.status(200).type(contentType2).header("Content-Disposition", "inline").send(nodeStream);
-        }
-        const bodyUnknown = downloadResult.body;
-        let buf;
-        let contentType = inferredContentType;
-        if (bodyUnknown instanceof ArrayBuffer) {
-          buf = Buffer.from(bodyUnknown);
-        } else if (bodyUnknown instanceof Buffer) {
-          buf = bodyUnknown;
-        } else if (bodyUnknown && typeof bodyUnknown.arrayBuffer === "function") {
-          const res = bodyUnknown;
-          buf = Buffer.from(await res.arrayBuffer());
-          if (res.headers?.get("content-type")) contentType = res.headers.get("content-type");
-        } else if (bodyUnknown && typeof bodyUnknown.blob === "function") {
-          const blob = await bodyUnknown.blob();
-          buf = Buffer.from(await blob.arrayBuffer());
-        } else {
-          return reply.status(502).send({ success: false, error: "Unexpected view response format" });
-        }
-        const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
-        if (isHtml) {
-          console.log(`[viewFile] Injecting AI2APP context for sandbox HTML file: ${filename2}, tenantId: ${tenantId}, contentType: ${contentType}`);
-          let content2 = buf.toString("utf-8");
-          const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
-            tenantId,
-            workspaceId,
-            projectId,
-            timestamp: Date.now()
-          })};</script>`;
-          if (content2.toLowerCase().includes("</head>")) {
-            content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
-            console.log(`[viewFile] Context script injected before </head>`);
-          } else if (content2.toLowerCase().includes("<html>")) {
-            content2 = content2.replace(/<html>/i, `<html>${contextScript}`);
-            console.log(`[viewFile] Context script injected after <html>`);
-          } else {
-            content2 = contextScript + content2;
-            console.log(`[viewFile] Context script prepended to content`);
+            outputBuf = Buffer.from(content2, "utf-8");
           }
-          buf = Buffer.from(content2, "utf-8");
+          return reply.status(200).type(contentType).header("Content-Disposition", "inline").send(outputBuf);
+        } catch (err) {
+          return reply.status(502).send({ success: false, error: String(err) });
         }
-        return reply.status(200).type(contentType).header("Content-Disposition", "inline").send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId);
       const content = await backend.read(resolvedPath, 0, Infinity);
@@ -2934,26 +2755,25 @@ var WorkspaceController = class {
       const filename = data.filename || "file";
       const pathEntry = data.fields?.path;
       const pathValue = pathEntry && typeof pathEntry === "object" && "value" in pathEntry ? String(pathEntry.value) : typeof pathEntry === "string" ? pathEntry : void 0;
-      if (pathValue && !/^[a-zA-Z0-9_./-]+$/.test(pathValue)) {
+      if (pathValue && !/^[a-zA-Z0-9_./~\-]+$/.test(pathValue)) {
         return reply.status(400).send({ success: false, error: "Invalid path parameter" });
       }
       if (workspace.storageType === "sandbox") {
         const sandboxManager = getSandBoxManager3();
-        const sandboxName = "global";
-        const sandbox = await sandboxManager.createSandbox(sandboxName);
-        const baseDir = path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId);
-        const realPath = pathValue ? path.join(baseDir, pathValue, filename) : path.join(baseDir, filename);
-        const uploadResult = await sandbox.file.uploadFile({
-          file: buffer,
-          path: realPath
-        }, { timeoutInSeconds: 300 });
-        if (!uploadResult.ok) {
-          return reply.status(502).send({
-            success: false,
-            error: `Upload error: ${JSON.stringify(uploadResult.error)}`
-          });
+        const sandbox = await sandboxManager.getSandboxFromConfig({
+          assistant_id: "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        });
+        const realPath = pathValue ? path.posix.join(pathValue, filename) : filename;
+        try {
+          await sandbox.file.uploadFile({ file: realPath, data: buffer });
+        } catch (err) {
+          return reply.status(500).send({ success: false, error: String(err) });
         }
-        const relativePath = uploadResult.body?.data?.file_path?.replace(path.join("/home/gem/tenants", tenantId, "workspaces", workspaceId, projectId), "") || (pathValue ? `/${pathValue}/${filename}` : `/${filename}`);
+        const relativePath = pathValue ? path.posix.join(pathValue, filename) : `/${filename}`;
         const result2 = {
           path: relativePath,
           name: filename,
@@ -3045,7 +2865,7 @@ function registerWorkspaceRoutes(app2) {
 
 // src/controllers/database-configs.ts
 import {
-  getStoreLattice as getStoreLattice6,
+  getStoreLattice as getStoreLattice5,
   sqlDatabaseManager
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID3 } from "crypto";
@@ -3059,7 +2879,7 @@ function getTenantId6(request) {
 async function getDatabaseConfigList(request, reply) {
   const tenantId = getTenantId6(request);
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     console.log("Backend: getAllConfigs returned:", configs);
@@ -3090,7 +2910,7 @@ async function getDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3116,7 +2936,7 @@ async function createDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -3152,7 +2972,7 @@ async function updateDatabaseConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -3193,7 +3013,7 @@ async function deleteDatabaseConfig(request, reply) {
   const tenantId = getTenantId6(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     console.log("Delete request - keyOrId:", keyOrId);
     let config = await store.getConfigByKey(tenantId, keyOrId);
@@ -3242,7 +3062,7 @@ async function testDatabaseConnection(request, reply) {
   const tenantId = getTenantId6(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice6("default", "database");
+    const storeLattice = getStoreLattice5("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3327,7 +3147,7 @@ function registerDatabaseConfigRoutes(app2) {
 
 // src/controllers/metrics-configs.ts
 import {
-  getStoreLattice as getStoreLattice7,
+  getStoreLattice as getStoreLattice6,
   metricsServerManager as metricsServerManager2,
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
@@ -3342,7 +3162,7 @@ function getTenantId7(request) {
 async function getMetricsServerConfigList(request, reply) {
   const tenantId = getTenantId7(request);
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     return {
@@ -3369,7 +3189,7 @@ async function getMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3395,7 +3215,7 @@ async function createMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -3447,7 +3267,7 @@ async function updateMetricsServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -3497,7 +3317,7 @@ async function deleteMetricsServerConfig(request, reply) {
   const tenantId = getTenantId7(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     let config = await store.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -3544,7 +3364,7 @@ async function testMetricsServerConnection(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3595,7 +3415,7 @@ async function listAvailableMetrics(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3634,7 +3454,7 @@ async function queryMetricsData(request, reply) {
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3681,7 +3501,7 @@ async function getDataSources(request, reply) {
   const tenantId = getTenantId7(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3722,7 +3542,7 @@ async function getDatasourceMetrics(request, reply) {
   const tenantId = getTenantId7(request);
   const { key, datasourceId } = request.params;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3760,7 +3580,7 @@ async function querySemanticMetrics(request, reply) {
   const { key } = request.params;
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice7("default", "metrics");
+    const storeLattice = getStoreLattice6("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3914,7 +3734,7 @@ function registerMetricsServerConfigRoutes(app2) {
 
 // src/controllers/mcp-configs.ts
 import {
-  getStoreLattice as getStoreLattice8,
+  getStoreLattice as getStoreLattice7,
   mcpManager,
   toolLatticeManager as toolLatticeManager2
 } from "@axiom-lattice/core";
@@ -3929,7 +3749,7 @@ function getTenantId8(request) {
 async function getMcpServerConfigList(request, reply) {
   const tenantId = getTenantId8(request);
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     return {
@@ -3956,7 +3776,7 @@ async function getMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -3982,7 +3802,7 @@ async function createMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -4022,7 +3842,7 @@ async function updateMcpServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -4071,7 +3891,7 @@ async function deleteMcpServerConfig(request, reply) {
   const tenantId = getTenantId8(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     let config = await store.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -4118,7 +3938,7 @@ async function testMcpServerConnection(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4171,7 +3991,7 @@ async function listMcpServerTools(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4204,7 +4024,7 @@ async function connectMcpServer(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4225,7 +4045,7 @@ async function connectMcpServer(request, reply) {
     };
   } catch (error) {
     console.error("Failed to connect MCP server:", error);
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (config) {
@@ -4241,7 +4061,7 @@ async function disconnectMcpServer(request, reply) {
   const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "mcp");
+    const storeLattice = getStoreLattice7("default", "mcp");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -4346,11 +4166,11 @@ function registerMcpServerConfigRoutes(app2) {
 }
 
 // src/controllers/users.ts
-import { getStoreLattice as getStoreLattice9 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice8 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
 var UsersController = class {
   constructor() {
-    this.userStore = getStoreLattice9("default", "user").store;
+    this.userStore = getStoreLattice8("default", "user").store;
   }
   async listUsers(request, reply) {
     const { email } = request.query;
@@ -4428,11 +4248,11 @@ function registerUserRoutes(app2) {
 }
 
 // src/controllers/tenants.ts
-import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice9 } from "@axiom-lattice/core";
 import { v4 as uuidv43 } from "uuid";
 var TenantsController = class {
   constructor() {
-    this.tenantStore = getStoreLattice10("default", "tenant").store;
+    this.tenantStore = getStoreLattice9("default", "tenant").store;
   }
   // ==================== Tenant CRUD ====================
   async listTenants(request, reply) {
@@ -4496,7 +4316,7 @@ function registerTenantRoutes(app2) {
 }
 
 // src/controllers/auth.ts
-import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
 import { v4 as uuidv44 } from "uuid";
 var defaultAuthConfig = {
   autoApproveUsers: true,
@@ -4505,9 +4325,9 @@ var defaultAuthConfig = {
 };
 var AuthController = class {
   constructor(config = {}) {
-    this.userStore = getStoreLattice11("default", "user").store;
-    this.tenantStore = getStoreLattice11("default", "tenant").store;
-    this.userTenantLinkStore = getStoreLattice11("default", "userTenantLink").store;
+    this.userStore = getStoreLattice10("default", "user").store;
+    this.tenantStore = getStoreLattice10("default", "tenant").store;
+    this.userTenantLinkStore = getStoreLattice10("default", "userTenantLink").store;
     this.config = { ...defaultAuthConfig, ...config };
   }
   async register(request, reply) {
@@ -4878,6 +4698,698 @@ function registerAuthRoutes(app2, config) {
   );
 }
 
+// src/channels/lark/routes.ts
+import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
+import {
+  ChannelIdentityMappingStore,
+  PostgreSQLChannelInstallationStore
+} from "@axiom-lattice/pg-stores";
+
+// src/channels/lark/parser.ts
+function parseLarkMessageEvent(payload) {
+  const raw = payload;
+  if (raw.header?.event_type !== "im.message.receive_v1") {
+    return null;
+  }
+  const message = raw.event?.message;
+  const openId = raw.event?.sender?.sender_id?.open_id;
+  if (!message || !openId || message.message_type !== "text") {
+    return null;
+  }
+  const parsedContent = parseLarkTextContent(message.content);
+  if (!message.message_id || !message.chat_id || !parsedContent) {
+    return null;
+  }
+  return {
+    messageId: message.message_id,
+    openId,
+    chatId: message.chat_id,
+    chatType: normalizeChatType(message.chat_type),
+    text: parsedContent
+  };
+}
+function parseLarkTextContent(content) {
+  if (!content) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(content);
+    return typeof parsed.text === "string" ? parsed.text : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeChatType(chatType) {
+  return chatType === "p2p" ? "direct" : "group";
+}
+
+// src/channels/lark/controller.ts
+function createLarkEventHandler(dependencies) {
+  return async function handleLarkEvent2(request, reply) {
+    const installationId = request.params?.installationId;
+    if (!installationId) {
+      reply.status(400).send({ success: false, message: "Missing installationId" });
+      return;
+    }
+    const config = await dependencies.getInstallationConfig(installationId);
+    if (!config) {
+      reply.status(404).send({ success: false, message: "Lark installation not found" });
+      return;
+    }
+    const body = dependencies.parseRequestBody(
+      request.body,
+      config.encryptKey
+    );
+    if (!dependencies.verifyParsedBody(body, config)) {
+      reply.status(401).send({ success: false, message: "Invalid Lark request" });
+      return;
+    }
+    if (body.type === "url_verification" && body.challenge) {
+      reply.status(200).send({ challenge: body.challenge });
+      return;
+    }
+    const parsed = dependencies.parseEvent(request.body);
+    if (!parsed) {
+      reply.status(200).send({ success: true, ignored: true });
+      return;
+    }
+    const receipt = await dependencies.claimInboundReceipt({
+      channel: "lark",
+      channelAppId: config.appId,
+      externalMessageId: parsed.messageId,
+      tenantId: config.tenantId
+    });
+    if (!receipt.accepted) {
+      reply.status(200).send(
+        receipt.status === "processing" ? { success: true, processing: true } : { success: true, duplicate: true }
+      );
+      return;
+    }
+    try {
+      const { threadId } = await dependencies.resolveThread({
+        channel: "lark",
+        channelAppId: config.appId,
+        tenantId: config.tenantId,
+        assistantId: config.assistantId,
+        mappingMode: config.mappingMode,
+        openId: parsed.openId,
+        chatId: parsed.chatId,
+        chatType: parsed.chatType,
+        messageId: parsed.messageId,
+        workspaceId: config.workspaceId,
+        projectId: config.projectId
+      });
+      const text = await dependencies.runAgentAndCollectText({
+        tenantId: config.tenantId,
+        assistantId: config.assistantId,
+        threadId,
+        text: parsed.text,
+        workspaceId: config.workspaceId,
+        projectId: config.projectId
+      });
+      await dependencies.sendTextReply({
+        chatId: parsed.chatId,
+        text,
+        config
+      });
+      await dependencies.markInboundReceiptCompleted({
+        channel: "lark",
+        channelAppId: config.appId,
+        externalMessageId: parsed.messageId,
+        tenantId: config.tenantId,
+        threadId
+      });
+      reply.status(200).send({ success: true, threadId });
+    } catch (error) {
+      await dependencies.markInboundReceiptFailed({
+        channel: "lark",
+        channelAppId: config.appId,
+        externalMessageId: parsed.messageId,
+        tenantId: config.tenantId
+      });
+      throw error;
+    }
+  };
+}
+var handleLarkEvent = createLarkEventHandler({
+  getInstallationConfig: async () => null,
+  parseRequestBody: (body) => body || {},
+  verifyParsedBody: () => true,
+  parseEvent: parseLarkMessageEvent,
+  claimInboundReceipt: async () => ({ accepted: true, status: "processing" }),
+  markInboundReceiptCompleted: async () => void 0,
+  markInboundReceiptFailed: async () => void 0,
+  resolveThread: async () => ({ threadId: "" }),
+  runAgentAndCollectText: async () => "",
+  sendTextReply: async () => void 0
+});
+
+// src/channels/lark/config.ts
+function loadLarkIngressConfig() {
+  return {
+    enabled: process.env.LARK_ENABLED !== "false",
+    appId: process.env.LARK_APP_ID || "",
+    appSecret: process.env.LARK_APP_SECRET || "",
+    verificationToken: process.env.LARK_VERIFICATION_TOKEN,
+    encryptKey: process.env.LARK_ENCRYPT_KEY,
+    tenantId: process.env.LARK_TENANT_ID || "default",
+    assistantId: process.env.LARK_ASSISTANT_ID || "default_agent",
+    workspaceId: process.env.LARK_WORKSPACE_ID,
+    projectId: process.env.LARK_PROJECT_ID,
+    mappingMode: process.env.LARK_MAPPING_MODE || "hybrid"
+  };
+}
+function isLarkIngressEnabled(config) {
+  return config.enabled;
+}
+
+// src/channels/lark/mapping-service.ts
+import { randomUUID as randomUUID6 } from "crypto";
+function createChannelThreadMappingService(deps) {
+  return {
+    async getOrCreateThread(input) {
+      const externalSubjectKey = buildExternalSubjectKey(input);
+      const existing = await deps.mappingStore.getMappingBySubject({
+        channel: input.channel,
+        channelAppId: input.channelAppId,
+        tenantId: input.tenantId,
+        assistantId: input.assistantId,
+        externalSubjectKey
+      });
+      if (existing) {
+        return { threadId: existing.threadId };
+      }
+      const threadId = (deps.uuid || randomUUID6)();
+      await deps.threadStore.createThread(input.tenantId, input.assistantId, threadId, {
+        metadata: {
+          tenantId: input.tenantId,
+          workspaceId: input.workspaceId,
+          projectId: input.projectId,
+          channel: input.channel,
+          larkChatId: input.chatId,
+          larkOpenId: input.openId
+        }
+      });
+      try {
+        await deps.mappingStore.createMapping({
+          channel: input.channel,
+          channelAppId: input.channelAppId,
+          tenantId: input.tenantId,
+          assistantId: input.assistantId,
+          mappingMode: input.mappingMode,
+          externalSubjectType: resolveSubjectType(input.mappingMode, input.chatType) === "user" ? "user" : "chat",
+          externalSubjectKey,
+          larkOpenId: input.openId,
+          larkChatId: input.chatId,
+          larkMessageId: input.messageId,
+          threadId
+        });
+      } catch (error) {
+        if (!isUniqueViolation(error)) {
+          throw error;
+        }
+        const canonical = await deps.mappingStore.getMappingBySubject({
+          channel: input.channel,
+          channelAppId: input.channelAppId,
+          tenantId: input.tenantId,
+          assistantId: input.assistantId,
+          externalSubjectKey
+        });
+        if (!canonical) {
+          throw error;
+        }
+        await deps.threadStore.deleteThread(input.tenantId, threadId);
+        return { threadId: canonical.threadId };
+      }
+      return { threadId };
+    }
+  };
+}
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+function buildExternalSubjectKey(input) {
+  const subjectType = resolveSubjectType(input.mappingMode, input.chatType);
+  const subjectValue = subjectType === "user" ? input.openId : input.chatId;
+  return [
+    input.channel,
+    input.channelAppId,
+    `tenant:${input.tenantId}`,
+    `assistant:${input.assistantId}`,
+    `${subjectType}:${subjectValue}`
+  ].join(":");
+}
+function resolveSubjectType(mappingMode, chatType) {
+  if (mappingMode === "user") {
+    return "user";
+  }
+  if (mappingMode === "group") {
+    return "chat";
+  }
+  return chatType === "direct" ? "user" : "chat";
+}
+
+// src/channels/lark/runner.ts
+import { agentInstanceManager as agentInstanceManager5 } from "@axiom-lattice/core";
+import { MessageChunkTypes as MessageChunkTypes3 } from "@axiom-lattice/protocols";
+
+// src/channels/lark/aggregator.ts
+import { MessageChunkTypes as MessageChunkTypes2 } from "@axiom-lattice/protocols";
+function aggregateLarkReply(messageId, chunks) {
+  return chunks.filter(
+    (chunk) => chunk.type === MessageChunkTypes2.AI && chunk.data.id === messageId
+  ).map((chunk) => chunk.data.content || "").join("").trim();
+}
+
+// src/channels/lark/runner.ts
+async function runAgentAndCollectLarkReply(input) {
+  const agent = agentInstanceManager5.getAgent({
+    tenant_id: input.tenantId,
+    assistant_id: input.assistantId,
+    thread_id: input.threadId,
+    workspace_id: input.workspaceId,
+    project_id: input.projectId
+  });
+  const result = await agent.addMessage({
+    input: {
+      message: input.text
+    }
+  });
+  const chunks = [];
+  const stream = agent.chunkStream(result.messageId, [
+    MessageChunkTypes3.MESSAGE_COMPLETED
+  ]);
+  for await (const chunk of stream) {
+    chunks.push(chunk);
+  }
+  return aggregateLarkReply(result.messageId, chunks);
+}
+
+// src/channels/lark/sender.ts
+function createLarkSender(config, client = createDefaultLarkClient(config)) {
+  return {
+    async sendTextReply(input) {
+      const response = await client.im.v1.message.create({
+        params: {
+          receive_id_type: "chat_id"
+        },
+        data: {
+          receive_id: input.chatId,
+          msg_type: "text",
+          content: JSON.stringify({ text: input.text })
+        }
+      });
+      if (response.code && response.code !== 0) {
+        throw new Error("Failed to send Lark reply");
+      }
+    }
+  };
+}
+function createDefaultLarkClient(config) {
+  const Lark = __require("@larksuiteoapi/node-sdk");
+  return new Lark.Client({
+    appId: config.appId,
+    appSecret: config.appSecret
+  });
+}
+
+// src/channels/lark/verification.ts
+import crypto2 from "crypto";
+function parseLarkRequestBody(body, encryptKey) {
+  const parsed = body || {};
+  if (encryptKey && typeof parsed.encrypt === "string") {
+    return decryptLarkPayload(encryptKey, parsed.encrypt);
+  }
+  return parsed;
+}
+function decryptLarkPayload(encryptKey, encryptedPayload) {
+  const key = crypto2.createHash("sha256").update(encryptKey).digest();
+  const buffer = Buffer.from(encryptedPayload, "base64");
+  const iv = buffer.subarray(0, 16);
+  const ciphertext = buffer.subarray(16);
+  const decipher = crypto2.createDecipheriv("aes-256-cbc", key, iv);
+  const plaintext = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final()
+  ]).toString("utf8");
+  return JSON.parse(plaintext);
+}
+function createLarkRequestVerifier(config) {
+  return function verifyRequest(request) {
+    const body = parseLarkRequestBody(request.body, config.encryptKey);
+    return verifyLarkParsedBody(body, config);
+  };
+}
+function verifyLarkParsedBody(body, config) {
+  if (!config.verificationToken) {
+    return true;
+  }
+  return extractVerificationToken(body) === config.verificationToken;
+}
+function extractVerificationToken(body) {
+  if (typeof body.token === "string") {
+    return body.token;
+  }
+  if (typeof body.header?.token === "string") {
+    return body.header.token;
+  }
+  return void 0;
+}
+
+// src/channels/lark/routes.ts
+function registerLarkChannelRoutes(app2, dependencies) {
+  const config = loadLarkIngressConfig();
+  if (!dependencies && !isLarkIngressEnabled(config)) {
+    return;
+  }
+  const handlerDependencies = dependencies || createDefaultLarkDependencies();
+  app2.post(
+    "/api/channels/lark/installations/:installationId/events",
+    createLarkEventHandler({
+      ...handlerDependencies
+    })
+  );
+}
+function createDefaultLarkDependencies() {
+  const installationStore = new PostgreSQLChannelInstallationStore({
+    poolConfig: getDatabaseUrl()
+  });
+  const threadStore = getStoreLattice11("default", "thread").store;
+  const mappingStore = new ChannelIdentityMappingStore({
+    poolConfig: getDatabaseUrl()
+  });
+  const mappingService = createChannelThreadMappingService({
+    mappingStore,
+    threadStore
+  });
+  return {
+    getInstallationConfig: async (installationId) => {
+      const installation = await installationStore.getInstallationById(
+        installationId
+      );
+      if (!installation || installation.channel !== "lark") {
+        return null;
+      }
+      return {
+        enabled: true,
+        installationId: installation.id,
+        tenantId: installation.tenantId,
+        assistantId: installation.config.assistantId,
+        appId: installation.config.appId,
+        appSecret: installation.config.appSecret,
+        verificationToken: installation.config.verificationToken,
+        encryptKey: installation.config.encryptKey,
+        workspaceId: installation.config.workspaceId,
+        projectId: installation.config.projectId,
+        mappingMode: installation.config.mappingMode
+      };
+    },
+    parseRequestBody: (body, encryptKey) => parseLarkRequestBody(body, encryptKey),
+    verifyParsedBody: (body, config) => {
+      if (!config.verificationToken) {
+        return true;
+      }
+      return createLarkRequestVerifier(config)({
+        body
+      });
+    },
+    parseEvent: parseLarkMessageEvent,
+    claimInboundReceipt: (input) => mappingStore.claimInboundReceipt(input),
+    markInboundReceiptCompleted: (input) => mappingStore.markInboundReceiptCompleted(input),
+    markInboundReceiptFailed: (input) => mappingStore.markInboundReceiptFailed(input),
+    resolveThread: (input) => mappingService.getOrCreateThread(input),
+    runAgentAndCollectText: ({ tenantId, assistantId, threadId, text, workspaceId, projectId }) => runAgentAndCollectLarkReply({
+      tenantId,
+      assistantId,
+      threadId,
+      text,
+      workspaceId,
+      projectId
+    }),
+    sendTextReply: async ({ chatId, text, config }) => {
+      const sender = createLarkSender({
+        appId: config.appId,
+        appSecret: config.appSecret
+      });
+      await sender.sendTextReply({ chatId, text });
+    }
+  };
+}
+function getDatabaseUrl() {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for Lark channel ingress");
+  }
+  return databaseUrl;
+}
+
+// src/channels/routes.ts
+var channelRouteRegistrars = [
+  (app2, dependencies) => registerLarkChannelRoutes(app2, dependencies.lark)
+];
+function registerChannelRoutes(app2, dependencies = {}) {
+  for (const registerRoutes of channelRouteRegistrars) {
+    registerRoutes(app2, dependencies);
+  }
+}
+
+// src/controllers/channel-installations.ts
+import { randomUUID as randomUUID7 } from "crypto";
+function getTenantId9(request) {
+  const userTenantId = request.user?.tenantId;
+  if (userTenantId) {
+    return userTenantId;
+  }
+  return request.headers["x-tenant-id"] || "default";
+}
+function getInstallationStore() {
+  const { PostgreSQLChannelInstallationStore: PostgreSQLChannelInstallationStore2 } = __require("@axiom-lattice/pg-stores");
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for channel installation store");
+  }
+  return new PostgreSQLChannelInstallationStore2({
+    poolConfig: databaseUrl
+  });
+}
+async function getChannelInstallationList(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { channel } = request.query;
+  try {
+    const store = getInstallationStore();
+    const installations = await store.getInstallationsByTenant(tenantId, channel);
+    return {
+      success: true,
+      message: "Channel installations retrieved successfully",
+      data: {
+        records: installations,
+        total: installations.length
+      }
+    };
+  } catch (error) {
+    console.error("Failed to get channel installations:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installations",
+      data: {
+        records: [],
+        total: 0
+      }
+    };
+  }
+}
+async function getChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  try {
+    const store = getInstallationStore();
+    const installation = await store.getInstallationById(installationId);
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (installation.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation retrieved successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to get channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installation"
+    };
+  }
+}
+async function createChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const body = request.body;
+  try {
+    if (!body.channel) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Channel type is required"
+      };
+    }
+    if (!body.config) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Configuration is required"
+      };
+    }
+    if (body.channel === "lark") {
+      const larkConfig = body.config;
+      if (!larkConfig.appId || !larkConfig.appSecret) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "appId and appSecret are required for Lark installations"
+        };
+      }
+      if (!larkConfig.assistantId) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "assistantId is required for Lark installations"
+        };
+      }
+    }
+    const store = getInstallationStore();
+    const installationId = body.id || randomUUID7();
+    const installation = await store.createInstallation(
+      tenantId,
+      installationId,
+      body
+    );
+    reply.code(201);
+    return {
+      success: true,
+      message: "Channel installation created successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to create channel installation:", error);
+    if (error.message?.includes("duplicate") || error.code === "23505") {
+      reply.code(409);
+      return {
+        success: false,
+        message: "Channel installation with this ID already exists"
+      };
+    }
+    return {
+      success: false,
+      message: "Failed to create channel installation"
+    };
+  }
+}
+async function updateChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  const body = request.body;
+  try {
+    const store = getInstallationStore();
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    const installation = await store.updateInstallation(
+      tenantId,
+      installationId,
+      body
+    );
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation updated successfully",
+      data: installation
+    };
+  } catch (error) {
+    console.error("Failed to update channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to update channel installation"
+    };
+  }
+}
+async function deleteChannelInstallation(request, reply) {
+  const tenantId = getTenantId9(request);
+  const { installationId } = request.params;
+  try {
+    const store = getInstallationStore();
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied"
+      };
+    }
+    const deleted = await store.deleteInstallation(tenantId, installationId);
+    if (!deleted) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found"
+      };
+    }
+    return {
+      success: true,
+      message: "Channel installation deleted successfully"
+    };
+  } catch (error) {
+    console.error("Failed to delete channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to delete channel installation"
+    };
+  }
+}
+
+// src/routes/channel-installations.ts
+function registerChannelInstallationRoutes(app2) {
+  app2.get("/api/channel-installations", getChannelInstallationList);
+  app2.get("/api/channel-installations/:installationId", getChannelInstallation);
+  app2.post("/api/channel-installations", createChannelInstallation);
+  app2.put("/api/channel-installations/:installationId", updateChannelInstallation);
+  app2.delete("/api/channel-installations/:installationId", deleteChannelInstallation);
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2) => {
   app2.post("/api/runs", createRun);
@@ -5013,6 +5525,8 @@ var registerLatticeRoutes = (app2) => {
     autoApproveUsers: process.env.AUTO_APPROVE_USERS !== "false",
     allowTenantRegistration: process.env.ALLOW_TENANT_REGISTRATION !== "false"
   });
+  registerChannelRoutes(app2);
+  registerChannelInstallationRoutes(app2);
   app2.delete(
     "/api/assistants/:assistant_id/threads/:thread_id/pending-messages/:message_id",
     removePendingMessageHandler
@@ -5082,7 +5596,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-import { eventBus as eventBus2, AGENT_TASK_EVENT, agentInstanceManager as agentInstanceManager5, QueueMode as QueueMode2 } from "@axiom-lattice/core";
+import { eventBus as eventBus2, AGENT_TASK_EVENT, agentInstanceManager as agentInstanceManager6, QueueMode as QueueMode2 } from "@axiom-lattice/core";
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -5097,7 +5611,7 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = agentInstanceManager5.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    const agent = agentInstanceManager6.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
     await agent.addMessage({ input, command, custom_run_config: runConfig }, QueueMode2.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
@@ -5316,7 +5830,8 @@ import {
   sandboxLatticeManager as sandboxLatticeManager2,
   sqlDatabaseManager as sqlDatabaseManager2,
   getStoreLattice as getStoreLattice12,
-  agentInstanceManager as agentInstanceManager6
+  agentInstanceManager as agentInstanceManager7,
+  createSandboxProvider
 } from "@axiom-lattice/core";
 import {
   LoggerType
@@ -5430,6 +5945,22 @@ app.setErrorHandler((error, request, reply) => {
     error: error.message || "\u670D\u52A1\u5668\u5185\u90E8\u9519\u8BEF"
   });
 });
+function getConfiguredSandboxProvider() {
+  const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox";
+  return createSandboxProvider({
+    type: sandboxProviderType,
+    remoteBaseURL: process.env.SANDBOX_BASE_URL,
+    microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
+    e2bApiKey: process.env.E2B_API_KEY,
+    e2bTemplate: process.env.E2B_TEMPLATE,
+    e2bTimeoutMs: process.env.E2B_TIMEOUT_MS ? parseInt(process.env.E2B_TIMEOUT_MS, 10) : void 0,
+    daytonaApiKey: process.env.DAYTONA_API_KEY,
+    daytonaApiUrl: process.env.DAYTONA_API_URL,
+    daytonaTarget: process.env.DAYTONA_TARGET,
+    daytonaTimeout: process.env.DAYTONA_TIMEOUT ? parseInt(process.env.DAYTONA_TIMEOUT, 10) : void 0,
+    daytonaVolumeName: process.env.DAYTONA_VOLUME_NAME
+  });
+}
 var start = async (config) => {
   try {
     if (config?.loggerConfig) {
@@ -5453,11 +5984,8 @@ var start = async (config) => {
       logger.warn("Failed to set database config store: " + (error instanceof Error ? error.message : String(error)));
     }
     if (!sandboxLatticeManager2.hasLattice("default")) {
-      const sandboxBaseURL = process.env.SANDBOX_BASE_URL || "http://localhost:8080";
-      sandboxLatticeManager2.registerLattice("default", {
-        baseURL: sandboxBaseURL
-      });
-      logger.info(`Registered sandbox manager with baseURL: ${sandboxBaseURL}`);
+      sandboxLatticeManager2.registerLattice("default", getConfiguredSandboxProvider());
+      logger.info("Registered sandbox manager from env configuration");
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     await app.listen({ port: target_port, host: "0.0.0.0" });
@@ -5477,7 +6005,7 @@ var start = async (config) => {
     }
     try {
       logger.info("Starting agent instance recovery...");
-      const restoreStats = await agentInstanceManager6.restore();
+      const restoreStats = await agentInstanceManager7.restore();
       logger.info(`Agent recovery complete: ${restoreStats.restored} threads restored, ${restoreStats.errors} errors`);
     } catch (error) {
       logger.error("Agent recovery failed", { error });