@deepagents/context 3.0.1 → 4.0.0

package/dist/lib/sandbox/strace/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/sandbox/strace/index.ts", "../../../../src/lib/sandbox/shell-quote.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\n\nimport { shellQuote } from '../shell-quote.ts';\nimport type { FileChange } from './file-change.ts';\n\nexport type { FileChange, FileChangeOp } from './file-change.ts';\n\nexport type StraceUnavailableReason =\n  | 'ptrace-blocked'\n  | 'strace-missing'\n  | 'trace-unparseable';\n\nconst REASON_HINT: Record<StraceUnavailableReason, string> = {\n  'ptrace-blocked':\n    'ptrace is denied by the sandbox runtime. Modern Docker permits it by default; on a hardened host, relax the runtime seccomp/ptrace policy (allow the ptrace syscall, or add the SYS_PTRACE capability).',\n  'strace-missing':\n    'strace is not installed in the sandbox image. Bake `strace` into the image.',\n  'trace-unparseable':\n    'strace ran but its output is unusable \u2014 the sandbox is likely running under emulation (e.g. amd64 via Rosetta). Use a native-architecture sandbox.',\n};\n\n/**\n * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be\n * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This\n * is a hard failure by design \u2014 there is no silent degrade to the snapshot\n * observer.\n */\nexport class StraceUnavailableError extends Error {\n  readonly reason: StraceUnavailableReason;\n  readonly diagnostics: string;\n\n  constructor(reason: StraceUnavailableReason, diagnostics: string) {\n    super(\n      `strace file-change tracking unavailable (${reason}): ${REASON_HINT[reason]}`,\n    );\n    this.name = 'StraceUnavailableError';\n    this.reason = reason;\n    this.diagnostics = diagnostics;\n  }\n}\n\nconst STRACE_FLAGS = '-f -y -qq -e trace=%file,write,pwrite64,writev';\n\n/**\n * Wraps `command` so its filesystem syscalls are traced to `traceFile`. Both\n * the inner command and this wrapper are re-parsed by a shell (`sh -c`), so the\n * single-quoting via {@link shellQuote} composes with the backend's own\n * `sh -c`. strace propagates the traced command's exit code. The `mkdir -p`\n * runs before strace (so it isn't traced) and self-heals the trace dir per\n * command \u2014 if it ever disappears mid-session, the next command recreates it\n * rather than strace failing to open `-o` and skipping the command entirely.\n */\nexport function buildStraceCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}`\n  );\n}\n\n/**\n * Like {@link buildStraceCommand}, but dumps the (base64) trace inline on stdout\n * after `sentinel`, then exits with the traced command's code. This lets one\n * `executeCommand` round-trip carry both the command output and its trace \u2014 no\n * second `readFile` exec to pull the trace out of the container. Pair with\n * {@link splitTracedOutput}. `sentinel` must be unguessable (a UUID) so the\n * command's own stdout cannot contain it. `base64` keeps the trace stream-safe\n * and its stderr is dropped so a missing trace (strace failed) doesn't leak into\n * the command's stderr.\n */\nexport function buildTracedCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n  sentinel: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}; ` +\n    `__dat_rc=$?; ` +\n    `printf '\\\\n%s\\\\n' ${shellQuote(sentinel)}; ` +\n    `base64 ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `rm -f ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `exit $__dat_rc`\n  );\n}\n\n/**\n * Split {@link buildTracedCommand} output into the command's own stdout and its\n * decoded strace trace. A missing sentinel (strace produced nothing) yields an\n * empty trace so the caller degrades to \"no changes\".\n */\nexport function splitTracedOutput(\n  stdout: string,\n  sentinel: string,\n): { stdout: string; trace: string } {\n  const marker = `\\n${sentinel}\\n`;\n  const at = stdout.indexOf(marker);\n  if (at === -1) return { stdout, trace: '' };\n  const base64 = stdout.slice(at + marker.length);\n  return {\n    stdout: stdout.slice(0, at),\n    trace: base64 ? Buffer.from(base64, 'base64').toString('utf8') : '',\n  };\n}\n\n// An open is a definite write only when it creates or truncates. Bare\n// O_WRONLY/O_RDWR/O_APPEND opens are NOT assumed to mutate \u2014 a real write()\n// syscall confirms them \u2014 so read-only-via-O_RDWR (sqlite SELECT, an editor\n// that opens then quits) doesn't produce a phantom `write`.\nconst CREATE_OR_TRUNC_FLAGS = /O_(CREAT|TRUNC)/;\nconst RENAME_SYSCALLS = new Set(['rename', 'renameat', 'renameat2']);\nconst DELETE_SYSCALLS = new Set(['unlink', 'unlinkat', 'rmdir']);\nconst MKDIR_SYSCALLS = new Set(['mkdir', 'mkdirat']);\nconst LINK_SYSCALLS = new Set(['link', 'linkat', 'symlink', 'symlinkat']);\nconst OPEN_SYSCALLS = new Set(['open', 'openat', 'openat2', 'creat']);\nconst WRITE_SYSCALLS = new Set([\n  'write',\n  'pwrite64',\n  'pwrite',\n  'writev',\n  'pwritev2',\n]);\nconst TRUNCATE_SYSCALLS = new Set(['truncate', 'ftruncate']);\n\ninterface ParsedCall {\n  syscall: string;\n  args: string;\n  retval: string;\n  errno?: string;\n}\n\n/** Reassemble `<unfinished \u2026>` / `<\u2026 resumed>` syscall splits per PID. */\nfunction stitchLines(raw: string): string[] {\n  const pending = new Map<string, string>();\n  const out: string[] = [];\n  for (const original of raw.split('\\n')) {\n    const line = original.trimEnd();\n    if (!line) continue;\n    const pid = line.match(/^\\s*(\\d+)\\s+/)?.[1] ?? '0';\n    if (/<unfinished \\.\\.\\.>\\s*$/.test(line)) {\n      pending.set(pid, line.replace(/<unfinished \\.\\.\\.>\\s*$/, ''));\n      continue;\n    }\n    const resumed = line.match(/<\\.\\.\\.\\s+\\S+\\s+resumed>(.*)$/);\n    if (resumed) {\n      const head = pending.get(pid);\n      pending.delete(pid);\n      if (head !== undefined) out.push(head + resumed[1]);\n      continue;\n    }\n    out.push(line);\n  }\n  return out;\n}\n\nfunction parseCall(line: string): ParsedCall | null {\n  const m = line.match(\n    /^\\s*(?:\\d+\\s+)?([a-z_][a-z0-9_]*)\\((.*)\\)\\s*=\\s*(.+?)\\s*$/,\n  );\n  if (!m) return null;\n  const [, syscall, args, rest] = m;\n  const errnoMatch = rest.match(/^(-?\\d+)\\s+([A-Z][A-Z0-9_]*)/);\n  if (errnoMatch) {\n    return { syscall, args, retval: errnoMatch[1], errno: errnoMatch[2] };\n  }\n  return { syscall, args, retval: rest.split(/\\s+/)[0] };\n}\n\nconst STRACE_ESCAPE: Record<string, number> = {\n  n: 0x0a,\n  t: 0x09,\n  r: 0x0d,\n  v: 0x0b,\n  f: 0x0c,\n  '\"': 0x22,\n  '\\\\': 0x5c,\n};\n\n/**\n * Decode one strace-rendered string. strace emits printable ASCII verbatim and\n * non-printable / non-ASCII bytes as octal `\\NNN`, plus a few `\\x` escapes. We\n * reconstruct the raw byte sequence and decode it as UTF-8 so multi-byte\n * filenames (e.g. `caf\u00E9.txt` \u2192 `\\303\\251`) round-trip instead of being mangled.\n */\nfunction decodeStraceString(s: string): string {\n  const bytes: number[] = [];\n  for (let i = 0; i < s.length; ) {\n    if (s[i] === '\\\\' && i + 1 < s.length) {\n      const octal = s.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0];\n      if (octal) {\n        bytes.push(parseInt(octal, 8) & 0xff);\n        i += 1 + octal.length;\n        continue;\n      }\n      const mapped = STRACE_ESCAPE[s[i + 1]];\n      bytes.push(mapped ?? s.charCodeAt(i + 1));\n      i += 2;\n      continue;\n    }\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes.push(code);\n    else for (const b of Buffer.from(s[i], 'utf8')) bytes.push(b);\n    i += 1;\n  }\n  return Buffer.from(bytes).toString('utf8');\n}\n\nfunction quotedStrings(args: string): string[] {\n  const out: string[] = [];\n  const re = /\"((?:[^\"\\\\]|\\\\.)*)\"/g;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(args)) !== null) {\n    out.push(decodeStraceString(m[1]));\n  }\n  return out;\n}\n\n/** Directory path annotated on the leading dirfd (`AT_FDCWD</cwd>` / `7</dir>`). */\nfunction dirfdPath(args: string): string {\n  return args.match(/^\\s*(?:AT_FDCWD|-?\\d+)<([^>]*)>/)?.[1] ?? '/';\n}\n\n/** Path annotated on the leading fd argument (`-y` output), for write syscalls. */\nfunction fdPath(args: string): string | null {\n  return args.match(/^\\s*-?\\d+<([^>]*)>/)?.[1] ?? null;\n}\n\nfunction openFlags(args: string): string {\n  return args.match(/\\bO_[A-Z_]+(?:\\|O_[A-Z_]+)*/)?.[0] ?? '';\n}\n\nexport interface ParseStraceOptions {\n  include: string[];\n  exclude?: string[];\n  traceFile?: string;\n  traceDir?: string;\n}\n\n/** A path is tracked when it matches an `include` glob and no `exclude` glob. */\nexport function matchesGlobs(\n  path: string,\n  include: string[],\n  exclude?: string[],\n): boolean {\n  return (\n    include.some((glob) => posix.matchesGlob(path, glob)) &&\n    !exclude?.some((glob) => posix.matchesGlob(path, glob))\n  );\n}\n\n/**\n * Parse one command's strace output into a coarse `FileChange[]`. Failed\n * syscalls are skipped; paths are filtered to `destination`; the trace file and\n * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated\n * writes to one `write`; a path written then deleted within the command is\n * treated as transient and dropped.\n */\nexport function parseStraceTrace(\n  raw: string,\n  options: ParseStraceOptions,\n): FileChange[] {\n  const { include, exclude, traceDir, traceFile } = options;\n  const now = Date.now();\n\n  const state = new Map<string, 'write' | 'delete'>();\n  const renames: Array<{ from: string; to: string }> = [];\n\n  const resolve = (dir: string, p: string): string =>\n    posix.normalize(p.startsWith('/') ? p : posix.join(dir, p));\n\n  const write = (path: string) => {\n    state.set(path, 'write');\n  };\n  const remove = (path: string) => {\n    if (state.get(path) === 'write') state.delete(path);\n    else state.set(path, 'delete');\n  };\n\n  for (const line of stitchLines(raw)) {\n    const call = parseCall(line);\n    if (!call || call.errno || call.retval === '-1') continue;\n    const { syscall, args } = call;\n    const dir = dirfdPath(args);\n\n    if (RENAME_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length < 2) continue;\n      const from = resolve(dir, strings[0]);\n      const to = resolve(dir, strings[strings.length - 1]);\n      state.delete(from);\n      renames.push({ from, to });\n      continue;\n    }\n    if (DELETE_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) remove(resolve(dir, strings[0]));\n      continue;\n    }\n    if (MKDIR_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (LINK_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[strings.length - 1]));\n      continue;\n    }\n    if (OPEN_SYSCALLS.has(syscall)) {\n      if (!CREATE_OR_TRUNC_FLAGS.test(openFlags(args))) continue;\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (WRITE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args);\n      if (p && Number(call.retval) > 0) write(posix.normalize(p));\n      continue;\n    }\n    if (TRUNCATE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args) ?? quotedStrings(args)[0];\n      if (p) write(resolve(dir, p));\n    }\n  }\n\n  const keep = (path: string): boolean => {\n    if (traceFile && path === traceFile) return false;\n    if (traceDir && (path === traceDir || path.startsWith(`${traceDir}/`))) {\n      return false;\n    }\n    if (/^\\/(proc|sys|dev)(\\/|$)/.test(path)) return false;\n    return matchesGlobs(path, include, exclude);\n  };\n\n  const changes: FileChange[] = [];\n  const emittedRenameTargets = new Set<string>();\n  for (const { from, to } of renames) {\n    if (!keep(to)) continue;\n    // A later delete of the target supersedes the rename (the tail emits the\n    // delete); otherwise the rename entry already represents the target's final\n    // state, so the tail must NOT also emit a `write` for it (would duplicate).\n    if (state.get(to) === 'delete') continue;\n    changes.push({ op: 'rename', path: to, from, timestamp: now });\n    emittedRenameTargets.add(to);\n  }\n  const tail: FileChange[] = [];\n  for (const [path, op] of state) {\n    if (emittedRenameTargets.has(path)) continue;\n    if (keep(path)) tail.push({ op, path, timestamp: now });\n  }\n  tail.sort((a, b) => {\n    if (a.path < b.path) return -1;\n    if (a.path > b.path) return 1;\n    return 0;\n  });\n  changes.push(...tail);\n  return changes;\n}\n\n// strace prints its own failures to stderr prefixed `strace: `. Anchor on that\n// so a benign command whose output merely contains \"Operation not permitted\" or\n// \"not found\" is not misclassified as a tracer failure.\nconst PTRACE_DENIED =\n  /strace:[^\\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;\nconst STRACE_MISSING = /strace:?\\s+(?:command\\s+)?not found/i;\n\n/**\n * The minimal structural surface {@link selfTestStrace} needs from its host.\n * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:\n * a remote/docker caller passes its sandbox unchanged (it satisfies this shape\n * structurally), and an in-process caller (e.g. a daemon running as PID 1\n * inside the container) implements just these two methods over\n * `node:child_process` + `node:fs`.\n */\nexport interface StraceHost {\n  executeCommand(\n    command: string,\n  ): Promise<{ exitCode: number; stderr: string }>;\n  readFile(path: string): Promise<string>;\n}\n\n/**\n * One-time probe at sandbox setup. Runs a known create/write/rename sequence\n * under strace and asserts the trace is clean and parseable. Throws\n * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is\n * absent, or the trace is garbled (e.g. amd64 under Rosetta).\n *\n * \"strace works in this sandbox\" is an invariant of the (image + host kernel +\n * seccomp/caps) \u2014 constant across every tool call and chat turn in a given\n * container \u2014 so this is the consumer's once-per-container responsibility (e.g.\n * a daemon boot gate), NOT a per-tool cost. `createBashTool` /\n * `withStraceFileChanges` no longer call it.\n */\nexport async function selfTestStrace(host: StraceHost): Promise<void> {\n  const probeDir = `/tmp/dat-strace-${randomUUID()}`;\n  const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;\n  const q = shellQuote;\n  const sequence =\n    `mkdir -p ${q(probeDir)} && ` +\n    `echo hi > ${q(`${probeDir}/a.txt`)} && ` +\n    `mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && ` +\n    `echo more > ${q(`${probeDir}/c.txt`)}`;\n  const wrapped = buildStraceCommand(sequence, traceFile, '/tmp');\n\n  let result: { exitCode: number; stderr: string } | undefined;\n  let raw = '';\n  try {\n    result = await host.executeCommand(wrapped);\n    raw = await host.readFile(traceFile).catch(() => '');\n\n    const diagnostics = `exit=${result.exitCode}\\nstderr=${result.stderr}\\ntrace[0:600]=${raw.slice(0, 600)}`;\n\n    // Order matters: a ptrace block makes strace error on stderr AND emit no\n    // trace, so check the ptrace signal (stderr only) before the empty-trace\n    // strace-missing check, or a blocked ptrace would be mislabelled.\n    if (PTRACE_DENIED.test(result.stderr)) {\n      throw new StraceUnavailableError('ptrace-blocked', diagnostics);\n    }\n    if (!raw || result.exitCode === 127 || STRACE_MISSING.test(result.stderr)) {\n      throw new StraceUnavailableError('strace-missing', diagnostics);\n    }\n\n    // Scope to the probe dir; the exact-path `traceFile` exclusion drops the\n    // sibling trace file that lives under /tmp alongside it.\n    const changes = parseStraceTrace(raw, {\n      include: [probeDir, `${probeDir}/**`],\n      traceFile,\n    });\n    const hasRealFdPath = raw.includes(`<${probeDir}/`);\n    const hasRename = changes.some(\n      (c) =>\n        c.op === 'rename' &&\n        c.from === `${probeDir}/a.txt` &&\n        c.path === `${probeDir}/b.txt`,\n    );\n    const hasWrite = changes.some((c) => c.op === 'write');\n    const allUnderDir = changes.every(\n      (c) => c.path === probeDir || c.path.startsWith(`${probeDir}/`),\n    );\n    if (!hasRealFdPath || !hasRename || !hasWrite || !allUnderDir) {\n      throw new StraceUnavailableError('trace-unparseable', diagnostics);\n    }\n  } finally {\n    void host\n      .executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`)\n      .catch(() => {});\n  }\n}\n", "/**\n * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded\n * `'` with `'\\''`. Safe for arbitrary content inside `sh -c`.\n *\n * Lives in its own zero-import module so node-builtins-only consumers (e.g. the\n * lean `./sandbox/strace` leaf entry) can use it without dragging in the\n * installer/runtime surface.\n */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n"],
+  "mappings": ";AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;;;ACOf,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;;;ADGA,IAAM,cAAuD;AAAA,EAC3D,kBACE;AAAA,EACF,kBACE;AAAA,EACF,qBACE;AACJ;AAQO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,QAAiC,aAAqB;AAChE;AAAA,MACE,4CAA4C,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AACF;AAEA,IAAM,eAAe;AAWd,SAAS,mBACd,SACA,WACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC;AAEtF;AAYO,SAAS,mBACd,SACA,WACA,UACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC,oCAE7D,WAAW,QAAQ,CAAC,YAC/B,WAAW,SAAS,CAAC,uBACtB,WAAW,SAAS,CAAC;AAGlC;AAOO,SAAS,kBACd,QACA,UACmC;AACnC,QAAM,SAAS;AAAA,EAAK,QAAQ;AAAA;AAC5B,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,MAAI,OAAO,GAAI,QAAO,EAAE,QAAQ,OAAO,GAAG;AAC1C,QAAM,SAAS,OAAO,MAAM,KAAK,OAAO,MAAM;AAC9C,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,IAC1B,OAAO,SAAS,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,IAAI;AAAA,EACnE;AACF;AAMA,IAAM,wBAAwB;AAC9B,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,WAAW,CAAC;AACnE,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,OAAO,CAAC;AAC/D,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,SAAS,CAAC;AACnD,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,WAAW,CAAC;AACxE,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,OAAO,CAAC;AACpE,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBAAoB,oBAAI,IAAI,CAAC,YAAY,WAAW,CAAC;AAU3D,SAAS,YAAY,KAAuB;AAC1C,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,MAAgB,CAAC;AACvB,aAAW,YAAY,IAAI,MAAM,IAAI,GAAG;AACtC,UAAM,OAAO,SAAS,QAAQ;AAC9B,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,KAAK,MAAM,cAAc,IAAI,CAAC,KAAK;AAC/C,QAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,cAAQ,IAAI,KAAK,KAAK,QAAQ,2BAA2B,EAAE,CAAC;AAC5D;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,+BAA+B;AAC1D,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,OAAW,KAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,KAAK,IAAI;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAI,KAAK;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,MAAM,IAAI,IAAI;AAChC,QAAM,aAAa,KAAK,MAAM,8BAA8B;AAC5D,MAAI,YAAY;AACd,WAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,CAAC,GAAG,OAAO,WAAW,CAAC,EAAE;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,CAAC,EAAE;AACvD;AAEA,IAAM,gBAAwC;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,KAAK;AAAA,EACL,MAAM;AACR;AAQA,SAAS,mBAAmB,GAAmB;AAC7C,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,EAAE,UAAU;AAC9B,QAAI,EAAE,CAAC,MAAM,QAAQ,IAAI,IAAI,EAAE,QAAQ;AACrC,YAAM,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,aAAa,IAAI,CAAC;AAC5D,UAAI,OAAO;AACT,cAAM,KAAK,SAAS,OAAO,CAAC,IAAI,GAAI;AACpC,aAAK,IAAI,MAAM;AACf;AAAA,MACF;AACA,YAAM,SAAS,cAAc,EAAE,IAAI,CAAC,CAAC;AACrC,YAAM,KAAK,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC;AACxC,WAAK;AACL;AAAA,IACF;AACA,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,OAAM,KAAK,IAAI;AAAA,QAC3B,YAAW,KAAK,OAAO,KAAK,EAAE,CAAC,GAAG,MAAM,EAAG,OAAM,KAAK,CAAC;AAC5D,SAAK;AAAA,EACP;AACA,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,MAAM;AAC3C;AAEA,SAAS,cAAc,MAAwB;AAC7C,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,IAAI,OAAO,MAAM;AACnC,QAAI,KAAK,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAAA,EACnC;AACA,SAAO;AACT;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,iCAAiC,IAAI,CAAC,KAAK;AAC/D;AAGA,SAAS,OAAO,MAA6B;AAC3C,SAAO,KAAK,MAAM,oBAAoB,IAAI,CAAC,KAAK;AAClD;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,6BAA6B,IAAI,CAAC,KAAK;AAC3D;AAUO,SAAS,aACd,MACA,SACA,SACS;AACT,SACE,QAAQ,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC,KACpD,CAAC,SAAS,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC;AAE1D;AASO,SAAS,iBACd,KACA,SACc;AACd,QAAM,EAAE,SAAS,SAAS,UAAU,UAAU,IAAI;AAClD,QAAM,MAAM,KAAK,IAAI;AAErB,QAAM,QAAQ,oBAAI,IAAgC;AAClD,QAAM,UAA+C,CAAC;AAEtD,QAAM,UAAU,CAAC,KAAa,MAC5B,MAAM,UAAU,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;AAE5D,QAAM,QAAQ,CAAC,SAAiB;AAC9B,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACA,QAAM,SAAS,CAAC,SAAiB;AAC/B,QAAI,MAAM,IAAI,IAAI,MAAM,QAAS,OAAM,OAAO,IAAI;AAAA,QAC7C,OAAM,IAAI,MAAM,QAAQ;AAAA,EAC/B;AAEA,aAAW,QAAQ,YAAY,GAAG,GAAG;AACnC,UAAM,OAAO,UAAU,IAAI;AAC3B,QAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAM;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,UAAM,MAAM,UAAU,IAAI;AAE1B,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,SAAS,EAAG;AACxB,YAAM,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpC,YAAM,KAAK,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC;AACnD,YAAM,OAAO,IAAI;AACjB,cAAQ,KAAK,EAAE,MAAM,GAAG,CAAC;AACzB;AAAA,IACF;AACA,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,QAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC,CAAC;AACnE;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,UAAI,CAAC,sBAAsB,KAAK,UAAU,IAAI,CAAC,EAAG;AAClD,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,IAAI,OAAO,IAAI;AACrB,UAAI,KAAK,OAAO,KAAK,MAAM,IAAI,EAAG,OAAM,MAAM,UAAU,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,OAAO,GAAG;AAClC,YAAM,IAAI,OAAO,IAAI,KAAK,cAAc,IAAI,EAAE,CAAC;AAC/C,UAAI,EAAG,OAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,SAA0B;AACtC,QAAI,aAAa,SAAS,UAAW,QAAO;AAC5C,QAAI,aAAa,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,IAAI;AACtE,aAAO;AAAA,IACT;AACA,QAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO;AACjD,WAAO,aAAa,MAAM,SAAS,OAAO;AAAA,EAC5C;AAEA,QAAM,UAAwB,CAAC;AAC/B,QAAM,uBAAuB,oBAAI,IAAY;AAC7C,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,QAAI,CAAC,KAAK,EAAE,EAAG;AAIf,QAAI,MAAM,IAAI,EAAE,MAAM,SAAU;AAChC,YAAQ,KAAK,EAAE,IAAI,UAAU,MAAM,IAAI,MAAM,WAAW,IAAI,CAAC;AAC7D,yBAAqB,IAAI,EAAE;AAAA,EAC7B;AACA,QAAM,OAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,EAAE,KAAK,OAAO;AAC9B,QAAI,qBAAqB,IAAI,IAAI,EAAG;AACpC,QAAI,KAAK,IAAI,EAAG,MAAK,KAAK,EAAE,IAAI,MAAM,WAAW,IAAI,CAAC;AAAA,EACxD;AACA,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,KAAK,GAAG,IAAI;AACpB,SAAO;AACT;AAKA,IAAM,gBACJ;AACF,IAAM,iBAAiB;AA6BvB,eAAsB,eAAe,MAAiC;AACpE,QAAM,WAAW,mBAAmB,WAAW,CAAC;AAChD,QAAM,YAAY,mBAAmB,WAAW,CAAC;AACjD,QAAM,IAAI;AACV,QAAM,WACJ,YAAY,EAAE,QAAQ,CAAC,iBACV,EAAE,GAAG,QAAQ,QAAQ,CAAC,UAC7B,EAAE,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,QAAQ,CAAC,mBACvC,EAAE,GAAG,QAAQ,QAAQ,CAAC;AACvC,QAAM,UAAU,mBAAmB,UAAU,WAAW,MAAM;AAE9D,MAAI;AACJ,MAAI,MAAM;AACV,MAAI;AACF,aAAS,MAAM,KAAK,eAAe,OAAO;AAC1C,UAAM,MAAM,KAAK,SAAS,SAAS,EAAE,MAAM,MAAM,EAAE;AAEnD,UAAM,cAAc,QAAQ,OAAO,QAAQ;AAAA,SAAY,OAAO,MAAM;AAAA,eAAkB,IAAI,MAAM,GAAG,GAAG,CAAC;AAKvG,QAAI,cAAc,KAAK,OAAO,MAAM,GAAG;AACrC,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AACA,QAAI,CAAC,OAAO,OAAO,aAAa,OAAO,eAAe,KAAK,OAAO,MAAM,GAAG;AACzE,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AAIA,UAAM,UAAU,iBAAiB,KAAK;AAAA,MACpC,SAAS,CAAC,UAAU,GAAG,QAAQ,KAAK;AAAA,MACpC;AAAA,IACF,CAAC;AACD,UAAM,gBAAgB,IAAI,SAAS,IAAI,QAAQ,GAAG;AAClD,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MACC,EAAE,OAAO,YACT,EAAE,SAAS,GAAG,QAAQ,YACtB,EAAE,SAAS,GAAG,QAAQ;AAAA,IAC1B;AACA,UAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACrD,UAAM,cAAc,QAAQ;AAAA,MAC1B,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,IAChE;AACA,QAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC7D,YAAM,IAAI,uBAAuB,qBAAqB,WAAW;AAAA,IACnE;AAAA,EACF,UAAE;AACA,SAAK,KACF,eAAe,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EACtD,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AACF;",
+  "names": []
+}

package/dist/lib/sandbox/types.d.ts

@@ -1,7 +1,6 @@
 import type { Tool } from 'ai';
 import type { BashToolkit, CommandResult, Sandbox as UpstreamSandbox } from 'bash-tool';
 import type { SkillPathMapping } from '../skills/types.ts';
-import type { FileEvent } from './file-events.ts';
 /**
  * Options accepted by `DisposableSandbox.executeCommand`. Currently only
  * `signal` (cooperative cancellation); shaped as an object so we can add
@@ -40,9 +39,14 @@ export interface SandboxProcess {
  * `if (!sandbox.spawn) ...` — no silent fallback that aggregates output
  * and flushes on completion.
  */
-export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand'> {
+export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand'>, AsyncDisposable {
     executeCommand(command: string, options?: ExecuteCommandOptions): Promise<CommandResult>;
     spawn?(command: string, options?: SpawnOptions): SandboxProcess;
+    /**
+     * Release the backend's external resources. Called explicitly, or
+     * automatically at scope exit via `await using` — every backend also
+     * implements `[Symbol.asyncDispose]`, which delegates here.
+     */
     dispose(): Promise<void>;
 }
 /**
@@ -80,12 +84,5 @@ export interface AgentSandbox extends Omit<BashToolkit, 'bash' | 'tools' | 'sand
         bash: WrappedBashTool;
     };
     sandbox: DisposableSandbox;
-    /**
-     * Drain and return file events observed since the last `drain()`. The
-     * observation root is the `destination` passed to `createBashTool`; every
-     * `executeCommand` / `writeFiles` call is bracketed by a snapshot, and
-     * `readFile` records a `read` event.
-     */
-    drainFileEvents(): FileEvent[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/lib/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,eAAe,EACf,gBAAgB,CACjB;IACC,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;OAKG;IACH,eAAe,IAAI,SAAS,EAAE,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,eAAe;IAChE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}

package/dist/lib/sandbox/virtual-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAsC5B"}
+{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA0C5B"}

package/dist/lib/save/reminder-eval.d.ts

@@ -0,0 +1,19 @@
+import { type ConditionalReminder, type ReminderResolution, type WhenContext } from '../fragments/message/user.ts';
+export interface FiredReminder {
+    config: ConditionalReminder;
+    resolved: ReminderResolution;
+    /** Once-ids `once()` collected while this config's `when()` evaluated to fire. */
+    onceIds: string[];
+}
+/**
+ * Evaluate conditional reminders against a single `whenCtx` and return the ones
+ * that fired with non-empty resolved text.
+ *
+ * Each predicate and each async text resolver is isolated: a throwing/rejecting
+ * `when()` or reminder text is treated as "did not fire" and logged, never
+ * propagated. This is the single evaluation core shared by the save pipeline
+ * and the steer loop, so a misbehaving user predicate can never tear down a
+ * save or an in-flight assistant turn.
+ */
+export declare function evaluateFiredReminders(configs: ConditionalReminder[], whenCtx: WhenContext): Promise<FiredReminder[]>;
+//# sourceMappingURL=reminder-eval.d.ts.map

package/dist/lib/save/reminder-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reminder-eval.d.ts","sourceRoot":"","sources":["../../../src/lib/save/reminder-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAEjB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,kFAAkF;IAClF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,mBAAmB,EAAE,EAC9B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,aAAa,EAAE,CAAC,CAiD1B"}

package/dist/lib/save/save-pipeline.d.ts

@@ -1,28 +1,22 @@
-import type { ChainSummary } from '../chain-summary.ts';
 import type { ContextFragment } from '../fragments.ts';
 import type { ContextStore } from '../store/store.ts';
-import type { BaseWhenCtx, ReminderTargetHandler } from './reminder-target-handler.ts';
 export interface SavePipelineEngine {
     readonly store: ContextStore;
     readonly chatId: string;
-    readonly branchName: string;
     getActiveBranch(): {
         id: string;
         headMessageId: string | null;
     };
     commitHead(headMessageId: string): Promise<void>;
     rewindForUpdate(parentId: string): Promise<void>;
-    getChainSummary(): Promise<ChainSummary>;
-    buildBaseWhenCtx(chain: ChainSummary): BaseWhenCtx;
 }
 export interface SaveResult {
     headMessageId: string | undefined;
 }
 export declare class SavePipeline {
     #private;
-    constructor(engine: SavePipelineEngine, pending: ContextFragment[], fragments: ContextFragment[]);
+    constructor(engine: SavePipelineEngine, pending: ContextFragment[]);
     applyUpdateBranching(shouldBranch: boolean): Promise<this>;
-    evaluateReminders(handlers: ReminderTargetHandler[]): Promise<this>;
     persist(): Promise<SaveResult>;
 }
 //# sourceMappingURL=save-pipeline.d.ts.map

package/dist/lib/save/save-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"save-pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/save/save-pipeline.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAQvD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAEnE,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,eAAe,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,qBAAa,YAAY;;gBAOrB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,eAAe,EAAE,EAC1B,SAAS,EAAE,eAAe,EAAE;IAOxB,oBAAoB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAyEnE,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;CA6CrC"}
+{"version":3,"file":"save-pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/save/save-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,eAAe,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,qBAAa,YAAY;;gBAKX,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE;IAK5D,oBAAoB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;CA6CrC"}

package/dist/lib/skills/skill-reminder.d.ts

@@ -1,5 +1,5 @@
-import { type UserReminder } from '../fragments/message/user.ts';
+import type { ContextFragment } from '../fragments.ts';
 import { type ClassifierOptions, type IClassifier } from '../fragments/reminders/classifier.ts';
 import type { SkillMetadata } from './types.ts';
-export declare function skillsReminder(skillsOrClassifier: SkillMetadata[] | IClassifier<SkillMetadata>, options?: ClassifierOptions): UserReminder;
+export declare function skillsReminder(skillsOrClassifier: SkillMetadata[] | IClassifier<SkillMetadata>, options?: ClassifierOptions): ContextFragment;
 //# sourceMappingURL=skill-reminder.d.ts.map

package/dist/lib/skills/skill-reminder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-reminder.d.ts","sourceRoot":"","sources":["../../../src/lib/skills/skill-reminder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,wBAAgB,cAAc,CAC5B,kBAAkB,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,aAAa,CAAC,EAChE,OAAO,CAAC,EAAE,iBAAiB,GAC1B,YAAY,CAUd"}
+{"version":3,"file":"skill-reminder.d.ts","sourceRoot":"","sources":["../../../src/lib/skills/skill-reminder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,wBAAgB,cAAc,CAC5B,kBAAkB,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,aAAa,CAAC,EAChE,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CAajB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepagents/context",
-  "version": "3.0.1",
+  "version": "4.0.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -31,6 +31,11 @@
       "types": "./dist/lib/tracing/index.d.ts",
       "import": "./dist/lib/tracing/index.js",
       "default": "./dist/lib/tracing/index.js"
+    },
+    "./sandbox/strace": {
+      "types": "./dist/lib/sandbox/strace/index.d.ts",
+      "import": "./dist/lib/sandbox/strace/index.js",
+      "default": "./dist/lib/sandbox/strace/index.js"
     }
   },
   "files": [
@@ -44,7 +49,7 @@
   "dependencies": {
     "@ai-sdk/groq": "^3.0.36",
     "@ai-sdk/provider": "^3.0.10",
-    "@deepagents/agent": "3.0.1",
+    "@deepagents/agent": "4.0.0",
     "ai": "^6.0.174",
     "bash-tool": "^1.3.16",
     "chalk": "^5.6.0",

package/dist/lib/sandbox/file-events.d.ts

@@ -1,42 +0,0 @@
-import type { DisposableSandbox } from './types.ts';
-export type FileEventOp = 'read' | 'write' | 'delete' | 'modify';
-export interface FileEvent {
-    path: string;
-    op: FileEventOp;
-    timestamp: number;
-}
-export interface ObserveOptions {
-    destination: string;
-}
-export interface SandboxObserver {
-    sandbox: DisposableSandbox;
-    drain(): FileEvent[];
-}
-export declare class SnapshotFailedError extends Error {
-    readonly stderr: string;
-    constructor(message: string, stderr: string);
-}
-/**
- * Wraps a `Sandbox` with file-event observation rooted at `destination`.
- *
- * - `executeCommand` and `writeFiles` are bracketed by `find -print0` +
- *   `sha256sum` snapshots; hash diff produces write/modify/delete events.
- * - `readFile` records a `read` event on success.
- * - `spawn` (when the backend exposes it) is bracketed similarly: the
- *   before-snapshot resolves before the inner spawn starts (via a
- *   lazy `ReadableStream`), and the returned `exit` Promise resolves only
- *   after the after-snapshot is recorded. The after-snapshot runs when the
- *   OS reports child exit; data still buffered in stdio after that point
- *   is *not* observed — write events for files flushed only on stream
- *   close may be missed.
- * - If `destination` does not exist in the sandbox at snapshot time, the
- *   snapshot is treated as empty (graceful — supports observation rooted at
- *   paths that the sandbox will create later). Snapshot command failures
- *   (e.g. permission denied, missing `find`) throw `SnapshotFailedError`
- *   from `executeCommand`/`writeFiles`, but are silently dropped on `spawn`
- *   because the caller's signal already comes via `exit`.
- * - Single-flight by convention. Concurrent `executeCommand` calls are not
- *   serialized internally and will produce interleaved diffs.
- */
-export declare function observeSandboxFileEvents(sandbox: DisposableSandbox, options: ObserveOptions): SandboxObserver;
-//# sourceMappingURL=file-events.d.ts.map

package/dist/lib/sandbox/file-events.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-events.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/file-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAY,MAAM,YAAY,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,IAAI,SAAS,EAAE,CAAC;CACtB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AA+ED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,cAAc,GACtB,eAAe,CA0FjB"}

package/dist/lib/save/reminder-target-handler.d.ts

@@ -1,36 +0,0 @@
-import type { UIMessage } from 'ai';
-import type { ChainSummary } from '../chain-summary.ts';
-import type { ContextFragment } from '../fragments.ts';
-import type { ConditionalReminder, ReminderResolution, ReminderTarget, WhenContext } from '../fragments/message/user.ts';
-export type BaseWhenCtx = Omit<WhenContext, 'content' | 'currentMessage' | 'lastAssistantMessage' | 'lastAssistantMessages'>;
-export interface PreparedCarrier {
-    message: UIMessage;
-    fragmentIndex: number;
-}
-export interface ReminderHandlerInput {
-    pending: ContextFragment[];
-    base: BaseWhenCtx;
-    chain: ChainSummary;
-    sharedUserMessage?: UIMessage & {
-        role: 'user';
-    };
-}
-export interface ReminderApplyInput {
-    pending: ContextFragment[];
-    carrier: PreparedCarrier;
-    fired: ConditionalReminder[];
-    resolved: ReminderResolution[];
-}
-export interface PreparedHandler {
-    whenCtx: WhenContext;
-    carrier: PreparedCarrier;
-    sharedUserMessage?: UIMessage & {
-        role: 'user';
-    };
-}
-export interface ReminderTargetHandler {
-    readonly target: ReminderTarget;
-    prepare(input: ReminderHandlerInput): PreparedHandler | null;
-    apply(input: ReminderApplyInput): void;
-}
-//# sourceMappingURL=reminder-target-handler.d.ts.map

package/dist/lib/save/reminder-target-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reminder-target-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/save/reminder-target-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,WAAW,EACT,SAAS,GACT,gBAAgB,GAChB,sBAAsB,GACtB,uBAAuB,CAC1B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,SAAS,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,iBAAiB,CAAC,EAAE,SAAS,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,iBAAiB,CAAC,EAAE,SAAS,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,GAAG,IAAI,CAAC;IAC7D,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACxC"}

package/dist/lib/save/tool-output-target-handler.d.ts

@@ -1,7 +0,0 @@
-import type { PreparedHandler, ReminderApplyInput, ReminderHandlerInput, ReminderTargetHandler } from './reminder-target-handler.ts';
-export declare class ToolOutputTargetHandler implements ReminderTargetHandler {
-    readonly target: 'tool-output';
-    prepare({ pending, base, chain, sharedUserMessage, }: ReminderHandlerInput): PreparedHandler | null;
-    apply({ pending, carrier, resolved }: ReminderApplyInput): void;
-}
-//# sourceMappingURL=tool-output-target-handler.d.ts.map

package/dist/lib/save/tool-output-target-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-output-target-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/save/tool-output-target-handler.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,uBAAwB,YAAW,qBAAqB;IACnE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAA0B;IAExD,OAAO,CAAC,EACN,OAAO,EACP,IAAI,EACJ,KAAK,EACL,iBAAiB,GAClB,EAAE,oBAAoB,GAAG,eAAe,GAAG,IAAI;IAkChD,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,IAAI;CAmBhE"}

package/dist/lib/save/user-target-handler.d.ts

@@ -1,7 +0,0 @@
-import type { PreparedHandler, ReminderApplyInput, ReminderHandlerInput, ReminderTargetHandler } from './reminder-target-handler.ts';
-export declare class UserTargetHandler implements ReminderTargetHandler {
-    readonly target: 'user';
-    prepare({ pending, base, chain, }: ReminderHandlerInput): PreparedHandler | null;
-    apply({ pending, carrier, fired, resolved }: ReminderApplyInput): void;
-}
-//# sourceMappingURL=user-target-handler.d.ts.map

package/dist/lib/save/user-target-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-target-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/save/user-target-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,iBAAkB,YAAW,qBAAqB;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAmB;IAE1C,OAAO,CAAC,EACN,OAAO,EACP,IAAI,EACJ,KAAK,GACN,EAAE,oBAAoB,GAAG,eAAe,GAAG,IAAI;IA2BhD,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,IAAI;CAiBvE"}