@ct-agents/worker 0.1.9 → 0.2.1

package/src/leased-item-runner.ts

@@ -0,0 +1,85 @@
+export const DEFAULT_WORK_LEASE_RENEW_INTERVAL_MS = 60_000;
+
+export type LeasedItemRenewal = {
+  intervalMs?: number;
+  renew(): Promise<boolean>;
+  onError?: (error: unknown) => void | Promise<void>;
+};
+
+export type RunLeasedItemInput<TExecution> = {
+  renewal?: LeasedItemRenewal;
+  execute(): Promise<TExecution>;
+  complete(execution: TExecution): Promise<boolean>;
+  completeRejectedError(execution: TExecution): Error;
+};
+
+function normalizeRenewInterval(value: number | undefined) {
+  return typeof value === 'number' && Number.isInteger(value) && value > 0
+    ? value
+    : DEFAULT_WORK_LEASE_RENEW_INTERVAL_MS;
+}
+
+function delay(ms: number, signal: AbortSignal): Promise<void> {
+  if (signal.aborted) {
+    return Promise.resolve();
+  }
+  return new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener('abort', finish, { once: true });
+    if (signal.aborted) {
+      finish();
+    }
+  });
+}
+
+async function reportRenewError(
+  onError: LeasedItemRenewal['onError'],
+  error: unknown,
+) {
+  try {
+    await onError?.(error);
+  } catch {
+    // 观测回调不能中断仍持有 lease 的业务执行；下一周期继续尝试 renew。
+  }
+}
+
+async function renewUntilStopped(renewal: LeasedItemRenewal, signal: AbortSignal) {
+  const intervalMs = normalizeRenewInterval(renewal.intervalMs);
+  while (!signal.aborted) {
+    await delay(intervalMs, signal);
+    if (signal.aborted) {
+      return;
+    }
+    try {
+      if (!await renewal.renew()) {
+        return;
+      }
+    } catch (error) {
+      await reportRenewError(renewal.onError, error);
+    }
+  }
+}
+
+/** 组合单个 leased item 的续租、执行、完成和续租协程收口。 */
+export async function runLeasedItem<TExecution>(
+  input: RunLeasedItemInput<TExecution>,
+): Promise<void> {
+  const renewController = new AbortController();
+  const renewal = input.renewal
+    ? renewUntilStopped(input.renewal, renewController.signal)
+    : Promise.resolve();
+  try {
+    const execution = await input.execute();
+    if (!await input.complete(execution)) {
+      throw input.completeRejectedError(execution);
+    }
+  } finally {
+    renewController.abort();
+    await renewal;
+  }
+}

package/src/platform-api-path.ts

@@ -0,0 +1,5 @@
+export const PLATFORM_API_BASE_PATH = '/api/v1';
+
+export function platformApiPath(path: '' | `/${string}`): string {
+  return `${PLATFORM_API_BASE_PATH}${path}`;
+}

package/src/resources/database/postgres.ts

@@ -1,8 +1,6 @@
 import { z } from 'zod';
-import type {
-  Database,
-  ResourceDefinition,
-} from '@ct-agents/protocol';
+import type { Database } from '@ct-agents/protocol';
+import type { EnvironmentWorkerResourceImplementation } from '../../index.js';
 
 export type PostgresQueryResult = {
   rows: unknown[];
@@ -38,46 +36,37 @@ export type PostgresDatabaseOptions = {
   maxRows?: number;
 };
 
-export type CreatePostgresDatabaseResourceDefinitionInput = {
+export type CreatePostgresDatabaseResourceImplementationInput = {
   createConnection: PostgresConnectionFactory;
 };
 
 export const postgresDatabaseOptionsSchema = z.object({
-  connectionString: z.string().trim().min(1, 'connectionString 为必填字段'),
+  connectionString: z.string().trim().min(1, 'connectionString 为必填字段').meta({ secret: true }),
   allowWrite: z.boolean().optional(),
   maxRows: z.number().int().positive().optional(),
 }).strict();
 
-export function createPostgresDatabaseResourceDefinition(
-  input: CreatePostgresDatabaseResourceDefinitionInput,
-): ResourceDefinition<Database, PostgresDatabaseOptions> {
+export function createPostgresDatabaseResourceImplementation(
+  input: CreatePostgresDatabaseResourceImplementationInput,
+): EnvironmentWorkerResourceImplementation<Database, PostgresDatabaseOptions> {
   return {
-    id: 'database',
-    title: '数据库',
-    description: 'worker 侧 PostgreSQL database resource。',
-    implementations: [
-      {
-        id: 'postgres',
-        title: 'PostgreSQL',
-        description: '通过 worker 本地注入的 PostgreSQL 查询函数访问数据库。',
-        optionsSchema: postgresDatabaseOptionsSchema,
-        optionsJsonSchema: z.toJSONSchema(postgresDatabaseOptionsSchema),
-        factory: (options) => {
-          const parsed = postgresDatabaseOptionsSchema.parse(options);
-          const connection = input.createConnection(parsed.connectionString, {
-            allowWrite: parsed.allowWrite ?? false,
-            maxRows: parsed.maxRows,
-          });
-          if (!connection.withConnection) {
-            throw new Error('PostgreSQL database resource 需要提供 withConnection，不能使用无状态 pool.query');
-          }
-          return createPostgresDatabase({
-            ...parsed,
-            connection,
-          });
-        },
-      },
-    ],
+    title: 'PostgreSQL',
+    description: '通过 worker 本地注入的 PostgreSQL 查询函数访问数据库。',
+    options: postgresDatabaseOptionsSchema,
+    factory: (options) => {
+      const parsed = postgresDatabaseOptionsSchema.parse(options);
+      const connection = input.createConnection(parsed.connectionString, {
+        allowWrite: parsed.allowWrite ?? false,
+        maxRows: parsed.maxRows,
+      });
+      if (!connection.withConnection) {
+        throw new Error('PostgreSQL database resource 需要提供 withConnection，不能使用无状态 pool.query');
+      }
+      return createPostgresDatabase({
+        ...parsed,
+        connection,
+      });
+    },
   };
 }
 
@@ -95,6 +84,10 @@ export function createPostgresDatabase(input: PostgresDatabaseOptions & {
     query: async (sql, params, options) => {
       const query = input.connection?.query ?? input.query;
       const withConnection = input.connection?.withConnection ?? input.withConnection;
+      const maxRows = resolveMaxRows(input.maxRows, options?.maxRows);
+      const effectiveOptions = options || maxRows !== undefined
+        ? { ...options, ...(maxRows !== undefined ? { maxRows } : {}) }
+        : undefined;
       if (!query) {
         throw new Error('PostgreSQL database resource 缺少 query 实现');
       }
@@ -102,17 +95,23 @@ export function createPostgresDatabase(input: PostgresDatabaseOptions & {
         if (input.allowWrite !== true) {
           throw new Error('当前 database resource 未允许写 SQL');
         }
-        return query(sql, params, options);
+        return query(sql, params, effectiveOptions);
       }
 
       if (!withConnection) {
         throw new Error('readOnly 查询需要同连接 withConnection 实现，不能使用无状态 pool.query');
       }
-      return withConnection(async (connection) => executeReadOnlyQuery(connection, sql, params, options.maxRows));
+      return withConnection(async (connection) => executeReadOnlyQuery(connection, sql, params, maxRows));
     },
   };
 }
 
+function resolveMaxRows(configured: number | undefined, requested: number | undefined) {
+  if (configured === undefined) return requested;
+  if (requested === undefined) return configured;
+  return Math.min(configured, requested);
+}
+
 async function executeReadOnlyQuery(
   connection: PostgresConnectionExecutor,
   sql: string,

package/src/resources/platform-proxy.ts

@@ -1,4 +1,4 @@
-import type { Database } from '@ct-agents/protocol';
+import { platformApiPath } from '../platform-api-path.js';
 
 export type PlatformResourceProxyInput = {
   baseUrl: string;
@@ -17,10 +17,6 @@ export type PlatformResourceProxyInput = {
   fetchImpl?: typeof fetch;
 };
 
-export type PlatformDatabaseProxyResourceInput = Omit<PlatformResourceProxyInput, 'slot'> & {
-  slot?: string;
-};
-
 export type InvokePlatformResourceProxyInput = PlatformResourceProxyInput & {
   method: string;
   args?: unknown[] | Record<string, unknown>;
@@ -92,7 +88,10 @@ export async function invokePlatformResourceProxy(input: InvokePlatformResourceP
   const requestTimeoutMs = input.requestTimeoutMs ?? (input.timeoutMs ? input.timeoutMs + 5_000 : 35_000);
   const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
   try {
-    const response = await fetchImpl(`${baseUrl}/v1/environments/${encodeURIComponent(input.environmentId)}/resources/${encodeURIComponent(input.slot)}/invoke`, {
+    const environmentId = encodeURIComponent(input.environmentId);
+    const slot = encodeURIComponent(input.slot);
+    const path = platformApiPath(`/environments/${environmentId}/resources/${slot}/invoke`);
+    const response = await fetchImpl(`${baseUrl}${path}`, {
       method: 'POST',
       headers,
       body: JSON.stringify(body),
@@ -101,7 +100,7 @@ export async function invokePlatformResourceProxy(input: InvokePlatformResourceP
     return await parseProxyEnvelope(response);
   } catch (error) {
     if (isAbortError(error)) {
-      throw new Error('平台 resource proxy 请求超时');
+      throw new Error('平台 resource proxy 请求超时', { cause: error });
     }
     throw error;
   } finally {
@@ -138,32 +137,6 @@ export function createPlatformResourceProxy<TResource extends object>(
   }) as TResource;
 }
 
-/**
- * 创建通过平台 Resource proxy 访问的 database resource。
- *
- * worker 只持有 environment key，不持有平台内置 resource 的原始密钥。
- */
-export function createPlatformDatabaseProxyResource(input: PlatformDatabaseProxyResourceInput): Database {
-  const slot = input.slot?.trim() || 'database';
-
-  return {
-    async query(sql, params, options) {
-      const timeoutMs = options?.timeoutMs ?? input.timeoutMs;
-      return invokePlatformResourceProxy({
-        ...input,
-        slot,
-        method: 'query',
-        args: {
-          sql,
-          ...(params !== undefined ? { params: Array.from(params) } : {}),
-          ...(options !== undefined ? { options } : {}),
-        },
-        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-      });
-    },
-  };
-}
-
 function isAbortError(error: unknown) {
   return error instanceof DOMException && error.name === 'AbortError';
 }

package/src/resources/text-generation/index.ts

@@ -7,6 +7,7 @@ import type {
   TextGenerationResource,
   TextGenerationResult,
 } from '@ct-agents/protocol';
+import { ModelOutputError, ModelProviderError } from '@ct-agents/harness';
 import { runAnthropic } from '@ct-agents/harness/llm/anthropic-provider.js';
 import type {
   NormalizedModelOutput,
@@ -18,6 +19,8 @@ import type { EnvironmentWorkerResourceImplementation } from '../../index.js';
 
 const DEFAULT_MAX_OUTPUT_TOKENS = 4_096;
 const DEFAULT_TIMEOUT_MS = 60_000;
+const DEFAULT_PROVIDER = 'anthropic' as const;
+const DEFAULT_MODEL = 'deepseek-v4-flash';
 const MAX_PROMPT_BYTES = 512 * 1_024;
 const MAX_SYSTEM_PROMPT_BYTES = 32 * 1_024;
 const MAX_RESPONSE_BYTES = 1_024 * 1_024;
@@ -115,6 +118,28 @@ function classifyProviderError(error: unknown): {
   message: string;
   retryable: boolean;
 } {
+  if (error instanceof ModelOutputError) {
+    const isCompletedEmpty = error.diagnostic.stage === 'response_completion'
+      && [
+        'completed_empty',
+        'end_turn',
+        'stop_sequence',
+        'tool_use',
+        'refusal',
+        'missing',
+      ].includes(error.diagnostic.completionReason);
+    return isCompletedEmpty
+      ? {
+          code: 'TEXT_GENERATION_EMPTY_RESPONSE',
+          message: '模型服务返回了空文本',
+          retryable: false,
+        }
+      : {
+          code: 'TEXT_GENERATION_PROVIDER_ERROR',
+          message: '模型服务返回了非预期错误',
+          retryable: true,
+        };
+  }
   const status = readHttpStatus(error);
   if (status === 400 || status === 404 || status === 422) {
     return {
@@ -147,7 +172,7 @@ function classifyProviderError(error: unknown): {
   return {
     code: 'TEXT_GENERATION_PROVIDER_ERROR',
     message: '模型服务返回了非预期错误',
-    retryable: status === undefined,
+    retryable: status === undefined && !(error instanceof ModelProviderError),
   };
 }
 
@@ -350,7 +375,7 @@ export function createTextGenerationResourceImplementation(
 
 export function createTextGenerationResourceDefinition(
   dependencies: TextGenerationResourceDependencies = {},
-): ResourceDefinition<TextGenerationResource, TextGenerationOptions> {
+): ResourceDefinition<TextGenerationResource> {
   return {
     id: 'textGeneration',
     title: '模型文本生成',
@@ -360,6 +385,12 @@ export function createTextGenerationResourceDefinition(
       title: '模型 Provider API',
       description: '通过 OpenAI 或 Anthropic 兼容 API 生成文本。',
       supportedExecutionModes: ['hosted', 'self_hosted'],
+      defaultOptions: {
+        provider: DEFAULT_PROVIDER,
+        defaultModel: DEFAULT_MODEL,
+        maxOutputTokens: DEFAULT_MAX_OUTPUT_TOKENS,
+        timeoutMs: DEFAULT_TIMEOUT_MS,
+      },
       optionsSchema: textGenerationOptionsSchema,
       optionsJsonSchema: z.toJSONSchema(textGenerationOptionsSchema),
       factory: (options) => createTextGenerationResource(

package/src/resources/web-search/tavily.ts

@@ -391,7 +391,7 @@ export function createTavilyWebSearchResourceImplementation(
 
 export function createTavilyWebSearchResourceDefinition(
   dependencies: TavilyWebSearchDependencies = {},
-): ResourceDefinition<WebSearchResource, TavilyWebSearchOptions> {
+): ResourceDefinition<WebSearchResource> {
   return {
     id: 'webSearch',
     title: '互联网搜索',
@@ -401,6 +401,7 @@ export function createTavilyWebSearchResourceDefinition(
       title: 'Tavily',
       description: '通过 Tavily 官方 Search API 搜索公开互联网内容。',
       supportedExecutionModes: ['hosted', 'self_hosted'],
+      defaultOptions: { timeoutMs: 30_000 },
       optionsSchema: tavilyWebSearchOptionsSchema,
       optionsJsonSchema: z.toJSONSchema(tavilyWebSearchOptionsSchema),
       factory: (options) => createTavilyWebSearchResource(tavilyWebSearchOptionsSchema.parse(options), dependencies),

package/src/sandbox/docker.ts

@@ -6,84 +6,13 @@ import type {
   Sandbox,
   SandboxHandle,
 } from '@ct-agents/protocol';
-
-type DockerContainer = {
-  id?: string;
-  start(): Promise<unknown>;
-  exec(options: DockerExecCreateOptions): Promise<DockerExec>;
-  remove(options?: { force?: boolean; v?: boolean }): Promise<unknown>;
-};
-
-type DockerExec = {
-  start(options?: { hijack?: boolean; stdin?: boolean }): Promise<DockerReadableStream>;
-  inspect(): Promise<{ ExitCode?: number | null; Running?: boolean }>;
-};
-
-type DockerReadableStream = NodeJS.ReadableStream & {
-  destroy?: () => void;
-};
-
-type DockerClient = {
-  createContainer(options: DockerCreateContainerOptions): Promise<DockerContainer>;
-  listContainers?(options?: { all?: boolean; filters?: Record<string, string[]> }): Promise<Array<{ Id?: string; id?: string }>>;
-  getContainer?(id: string): Pick<DockerContainer, 'remove'>;
-};
-
-type DockerExecCreateOptions = {
-  Cmd: string[];
-  AttachStdout: boolean;
-  AttachStderr: boolean;
-  Tty: boolean;
-  User?: string;
-  WorkingDir?: string;
-};
-
-type DockerCreateContainerOptions = {
-  Image: string;
-  name?: string;
-  User: string;
-  WorkingDir: string;
-  Cmd: string[];
-  Tty: boolean;
-  OpenStdin: boolean;
-  NetworkDisabled: boolean;
-  Labels: Record<string, string>;
-  HostConfig: {
-    Runtime?: string;
-    CapDrop: string[];
-    SecurityOpt: string[];
-    ReadonlyRootfs: boolean;
-    NetworkMode: 'none';
-    AutoRemove: boolean;
-    CpuQuota?: number;
-    Memory?: number;
-    PidsLimit?: number;
-    Tmpfs: Record<string, string>;
-  };
-};
-
-export type DockerSandboxRuntime = 'runsc' | 'runc';
-
-export type DockerSandboxOptions = {
-  docker: DockerClient;
-  image: string;
-  runtime?: DockerSandboxRuntime;
-  ownerId?: string;
-  nodeEnv?: string;
-  user?: string;
-  workspaceDir?: string;
-  tmpSize?: string;
-  workspaceSize?: string;
-  cpuQuota?: number;
-  memoryBytes?: number;
-  pidsLimit?: number;
-  defaultMaxOutputBytes?: number;
-  defaultFileTimeoutMs?: number;
-};
-
-export type CreateDockerSandboxOptions = Omit<DockerSandboxOptions, 'runtime'> & {
-  useGvisor?: boolean;
-};
+import type {
+  CreateDockerSandboxOptions,
+  DockerClient,
+  DockerContainer,
+  DockerSandboxOptions,
+  DockerSandboxRuntime,
+} from './types.js';
 
 export class DockerSandbox implements Sandbox {
   readonly kind = 'docker' as const;

package/src/sandbox/index.ts

@@ -3,3 +3,4 @@ export * from './local-process.js';
 export * from './manager.js';
 export * from './resources-def.js';
 export * from './resources.js';
+export type * from './types.js';

package/src/sandbox/local-process.ts

@@ -8,12 +8,7 @@ import type {
   Sandbox,
   SandboxHandle,
 } from '@ct-agents/protocol';
-
-export type LocalProcessSandboxOptions = {
-  rootDir?: string;
-  nodeEnv?: string;
-  defaultMaxOutputBytes?: number;
-};
+import type { LocalProcessSandboxOptions } from './types.js';
 
 const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
 

package/src/sandbox/manager.ts

@@ -1,13 +1,7 @@
 import type {
-  Sandbox,
   SandboxHandle,
 } from '@ct-agents/protocol';
-
-export type SandboxManagerOptions = {
-  sandbox: Sandbox & { reapOrphanedContainers?: () => Promise<number> };
-  now?: () => number;
-  releaseTimeoutMs?: number;
-};
+import type { SandboxManagerOptions } from './types.js';
 
 type SandboxEntry = {
   handlePromise: Promise<SandboxHandle>;

package/src/sandbox/resources-def.ts

@@ -3,25 +3,6 @@ import type {
   ResourceDefinition,
   Sandbox,
 } from '@ct-agents/protocol';
-
-export type SandboxLifecycle = 'session' | 'work-item';
-
-export type SandboxResourceOptions = {
-  allowedCommands?: string[];
-  deniedCommands?: string[];
-  requireApproval?: boolean;
-  timeoutMs?: number;
-  sandboxLifecycle?: SandboxLifecycle;
-  workspaceRoot?: string;
-  readPaths?: string[];
-  writePaths?: string[];
-  limits?: {
-    cpu?: number;
-    memoryMb?: number;
-    processes?: number;
-  };
-};
-
 export const sandboxResourceOptionsSchema = z.object({
   allowedCommands: z.array(z.string().trim().min(1)).optional(),
   deniedCommands: z.array(z.string().trim().min(1)).optional(),
@@ -38,7 +19,7 @@ export const sandboxResourceOptionsSchema = z.object({
   }).strict().optional(),
 }).strict();
 
-export function createSandboxResourceDefinition(): ResourceDefinition<Sandbox, SandboxResourceOptions> {
+export function createSandboxResourceDefinition(): ResourceDefinition<Sandbox> {
   return {
     id: 'sandbox',
     title: 'Sandbox',
@@ -48,6 +29,7 @@ export function createSandboxResourceDefinition(): ResourceDefinition<Sandbox, S
         id: 'local-process',
         title: 'Local process',
         description: '本地开发用 sandbox 声明；生产应替换为隔离实现。',
+        defaultOptions: {},
         optionsSchema: sandboxResourceOptionsSchema,
         optionsJsonSchema: z.toJSONSchema(sandboxResourceOptionsSchema),
         factory: () => {

package/src/sandbox/resources.ts

@@ -1,21 +1,9 @@
 import type {
-  Database,
-  MemoryResource,
   ResourceSlots,
-  SandboxHandle,
-  SkillResource,
   ToolWorkItem,
 } from '@ct-agents/protocol';
 import type { ResolveResources } from '../index.js';
-
-export type CreateSandboxResolveResourcesInput = {
-  manager: {
-    forSession(input: { sessionId: string }): Promise<SandboxHandle>;
-  };
-  database?: Database;
-  skills?: SkillResource;
-  memory?: MemoryResource;
-};
+import type { CreateSandboxResolveResourcesInput } from './types.js';
 
 export function createSandboxResolveResources(input: CreateSandboxResolveResourcesInput): ResolveResources {
   return async (item: ToolWorkItem): Promise<ResourceSlots> => {

package/src/sandbox/types.ts

@@ -0,0 +1,124 @@
+import type {
+  Database,
+  MemoryResource,
+  Sandbox,
+  SandboxHandle,
+  SkillResource,
+} from '@ct-agents/protocol';
+
+export type SandboxManagerOptions = {
+  sandbox: Sandbox & { reapOrphanedContainers?: () => Promise<number> };
+  now?: () => number;
+  releaseTimeoutMs?: number;
+};
+
+export type LocalProcessSandboxOptions = {
+  rootDir?: string;
+  nodeEnv?: string;
+  defaultMaxOutputBytes?: number;
+};
+
+export type DockerContainer = {
+  id?: string;
+  start(): Promise<unknown>;
+  exec(options: DockerExecCreateOptions): Promise<DockerExec>;
+  remove(options?: { force?: boolean; v?: boolean }): Promise<unknown>;
+};
+
+export type DockerExec = {
+  start(options?: { hijack?: boolean; stdin?: boolean }): Promise<DockerReadableStream>;
+  inspect(): Promise<{ ExitCode?: number | null; Running?: boolean }>;
+};
+
+export type DockerReadableStream = NodeJS.ReadableStream & {
+  destroy?: () => void;
+};
+
+export type DockerClient = {
+  createContainer(options: DockerCreateContainerOptions): Promise<DockerContainer>;
+  listContainers?(options?: { all?: boolean; filters?: Record<string, string[]> }): Promise<Array<{ Id?: string; id?: string }>>;
+  getContainer?(id: string): Pick<DockerContainer, 'remove'>;
+};
+
+export type DockerExecCreateOptions = {
+  Cmd: string[];
+  AttachStdout: boolean;
+  AttachStderr: boolean;
+  Tty: boolean;
+  User?: string;
+  WorkingDir?: string;
+};
+
+export type DockerCreateContainerOptions = {
+  Image: string;
+  name?: string;
+  User: string;
+  WorkingDir: string;
+  Cmd: string[];
+  Tty: boolean;
+  OpenStdin: boolean;
+  NetworkDisabled: boolean;
+  Labels: Record<string, string>;
+  HostConfig: {
+    Runtime?: string;
+    CapDrop: string[];
+    SecurityOpt: string[];
+    ReadonlyRootfs: boolean;
+    NetworkMode: 'none';
+    AutoRemove: boolean;
+    CpuQuota?: number;
+    Memory?: number;
+    PidsLimit?: number;
+    Tmpfs: Record<string, string>;
+  };
+};
+
+export type DockerSandboxRuntime = 'runsc' | 'runc';
+
+export type DockerSandboxOptions = {
+  docker: DockerClient;
+  image: string;
+  runtime?: DockerSandboxRuntime;
+  ownerId?: string;
+  nodeEnv?: string;
+  user?: string;
+  workspaceDir?: string;
+  tmpSize?: string;
+  workspaceSize?: string;
+  cpuQuota?: number;
+  memoryBytes?: number;
+  pidsLimit?: number;
+  defaultMaxOutputBytes?: number;
+  defaultFileTimeoutMs?: number;
+};
+
+export type CreateDockerSandboxOptions = Omit<DockerSandboxOptions, 'runtime'> & {
+  useGvisor?: boolean;
+};
+
+export type SandboxLifecycle = 'session' | 'work-item';
+
+export type SandboxResourceOptions = {
+  allowedCommands?: string[];
+  deniedCommands?: string[];
+  requireApproval?: boolean;
+  timeoutMs?: number;
+  sandboxLifecycle?: SandboxLifecycle;
+  workspaceRoot?: string;
+  readPaths?: string[];
+  writePaths?: string[];
+  limits?: {
+    cpu?: number;
+    memoryMb?: number;
+    processes?: number;
+  };
+};
+
+export type CreateSandboxResolveResourcesInput = {
+  manager: {
+    forSession(input: { sessionId: string }): Promise<SandboxHandle>;
+  };
+  database?: Database;
+  skills?: SkillResource;
+  memory?: MemoryResource;
+};