@deepagents/context 3.1.0 → 4.0.0

package/dist/lib/sandbox/strace/index.d.ts

@@ -0,0 +1,89 @@
+import type { FileChange } from './file-change.ts';
+export type { FileChange, FileChangeOp } from './file-change.ts';
+export type StraceUnavailableReason = 'ptrace-blocked' | 'strace-missing' | 'trace-unparseable';
+/**
+ * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be
+ * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This
+ * is a hard failure by design — there is no silent degrade to the snapshot
+ * observer.
+ */
+export declare class StraceUnavailableError extends Error {
+    readonly reason: StraceUnavailableReason;
+    readonly diagnostics: string;
+    constructor(reason: StraceUnavailableReason, diagnostics: string);
+}
+/**
+ * Wraps `command` so its filesystem syscalls are traced to `traceFile`. Both
+ * the inner command and this wrapper are re-parsed by a shell (`sh -c`), so the
+ * single-quoting via {@link shellQuote} composes with the backend's own
+ * `sh -c`. strace propagates the traced command's exit code. The `mkdir -p`
+ * runs before strace (so it isn't traced) and self-heals the trace dir per
+ * command — if it ever disappears mid-session, the next command recreates it
+ * rather than strace failing to open `-o` and skipping the command entirely.
+ */
+export declare function buildStraceCommand(command: string, traceFile: string, traceDir: string): string;
+/**
+ * Like {@link buildStraceCommand}, but dumps the (base64) trace inline on stdout
+ * after `sentinel`, then exits with the traced command's code. This lets one
+ * `executeCommand` round-trip carry both the command output and its trace — no
+ * second `readFile` exec to pull the trace out of the container. Pair with
+ * {@link splitTracedOutput}. `sentinel` must be unguessable (a UUID) so the
+ * command's own stdout cannot contain it. `base64` keeps the trace stream-safe
+ * and its stderr is dropped so a missing trace (strace failed) doesn't leak into
+ * the command's stderr.
+ */
+export declare function buildTracedCommand(command: string, traceFile: string, traceDir: string, sentinel: string): string;
+/**
+ * Split {@link buildTracedCommand} output into the command's own stdout and its
+ * decoded strace trace. A missing sentinel (strace produced nothing) yields an
+ * empty trace so the caller degrades to "no changes".
+ */
+export declare function splitTracedOutput(stdout: string, sentinel: string): {
+    stdout: string;
+    trace: string;
+};
+export interface ParseStraceOptions {
+    include: string[];
+    exclude?: string[];
+    traceFile?: string;
+    traceDir?: string;
+}
+/** A path is tracked when it matches an `include` glob and no `exclude` glob. */
+export declare function matchesGlobs(path: string, include: string[], exclude?: string[]): boolean;
+/**
+ * Parse one command's strace output into a coarse `FileChange[]`. Failed
+ * syscalls are skipped; paths are filtered to `destination`; the trace file and
+ * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated
+ * writes to one `write`; a path written then deleted within the command is
+ * treated as transient and dropped.
+ */
+export declare function parseStraceTrace(raw: string, options: ParseStraceOptions): FileChange[];
+/**
+ * The minimal structural surface {@link selfTestStrace} needs from its host.
+ * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:
+ * a remote/docker caller passes its sandbox unchanged (it satisfies this shape
+ * structurally), and an in-process caller (e.g. a daemon running as PID 1
+ * inside the container) implements just these two methods over
+ * `node:child_process` + `node:fs`.
+ */
+export interface StraceHost {
+    executeCommand(command: string): Promise<{
+        exitCode: number;
+        stderr: string;
+    }>;
+    readFile(path: string): Promise<string>;
+}
+/**
+ * One-time probe at sandbox setup. Runs a known create/write/rename sequence
+ * under strace and asserts the trace is clean and parseable. Throws
+ * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is
+ * absent, or the trace is garbled (e.g. amd64 under Rosetta).
+ *
+ * "strace works in this sandbox" is an invariant of the (image + host kernel +
+ * seccomp/caps) — constant across every tool call and chat turn in a given
+ * container — so this is the consumer's once-per-container responsibility (e.g.
+ * a daemon boot gate), NOT a per-tool cost. `createBashTool` /
+ * `withStraceFileChanges` no longer call it.
+ */
+export declare function selfTestStrace(host: StraceHost): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/sandbox/strace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/sandbox/strace/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,CAAC;AAWxB;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM;CAQjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASnC;AAgID,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAKT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,UAAU,EAAE,CAiGd;AASD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,CACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDpE"}

package/dist/lib/sandbox/strace/index.js

@@ -0,0 +1,285 @@
+// packages/context/src/lib/sandbox/strace/index.ts
+import { randomUUID } from "node:crypto";
+import { posix } from "node:path";
+
+// packages/context/src/lib/sandbox/shell-quote.ts
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// packages/context/src/lib/sandbox/strace/index.ts
+var REASON_HINT = {
+  "ptrace-blocked": "ptrace is denied by the sandbox runtime. Modern Docker permits it by default; on a hardened host, relax the runtime seccomp/ptrace policy (allow the ptrace syscall, or add the SYS_PTRACE capability).",
+  "strace-missing": "strace is not installed in the sandbox image. Bake `strace` into the image.",
+  "trace-unparseable": "strace ran but its output is unusable \u2014 the sandbox is likely running under emulation (e.g. amd64 via Rosetta). Use a native-architecture sandbox."
+};
+var StraceUnavailableError = class extends Error {
+  reason;
+  diagnostics;
+  constructor(reason, diagnostics) {
+    super(
+      `strace file-change tracking unavailable (${reason}): ${REASON_HINT[reason]}`
+    );
+    this.name = "StraceUnavailableError";
+    this.reason = reason;
+    this.diagnostics = diagnostics;
+  }
+};
+var STRACE_FLAGS = "-f -y -qq -e trace=%file,write,pwrite64,writev";
+function buildStraceCommand(command, traceFile, traceDir) {
+  return `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}`;
+}
+function buildTracedCommand(command, traceFile, traceDir, sentinel) {
+  return `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}; __dat_rc=$?; printf '\\n%s\\n' ${shellQuote(sentinel)}; base64 ${shellQuote(traceFile)} 2>/dev/null; rm -f ${shellQuote(traceFile)} 2>/dev/null; exit $__dat_rc`;
+}
+function splitTracedOutput(stdout, sentinel) {
+  const marker = `
+${sentinel}
+`;
+  const at = stdout.indexOf(marker);
+  if (at === -1) return { stdout, trace: "" };
+  const base64 = stdout.slice(at + marker.length);
+  return {
+    stdout: stdout.slice(0, at),
+    trace: base64 ? Buffer.from(base64, "base64").toString("utf8") : ""
+  };
+}
+var CREATE_OR_TRUNC_FLAGS = /O_(CREAT|TRUNC)/;
+var RENAME_SYSCALLS = /* @__PURE__ */ new Set(["rename", "renameat", "renameat2"]);
+var DELETE_SYSCALLS = /* @__PURE__ */ new Set(["unlink", "unlinkat", "rmdir"]);
+var MKDIR_SYSCALLS = /* @__PURE__ */ new Set(["mkdir", "mkdirat"]);
+var LINK_SYSCALLS = /* @__PURE__ */ new Set(["link", "linkat", "symlink", "symlinkat"]);
+var OPEN_SYSCALLS = /* @__PURE__ */ new Set(["open", "openat", "openat2", "creat"]);
+var WRITE_SYSCALLS = /* @__PURE__ */ new Set([
+  "write",
+  "pwrite64",
+  "pwrite",
+  "writev",
+  "pwritev2"
+]);
+var TRUNCATE_SYSCALLS = /* @__PURE__ */ new Set(["truncate", "ftruncate"]);
+function stitchLines(raw) {
+  const pending = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const original of raw.split("\n")) {
+    const line = original.trimEnd();
+    if (!line) continue;
+    const pid = line.match(/^\s*(\d+)\s+/)?.[1] ?? "0";
+    if (/<unfinished \.\.\.>\s*$/.test(line)) {
+      pending.set(pid, line.replace(/<unfinished \.\.\.>\s*$/, ""));
+      continue;
+    }
+    const resumed = line.match(/<\.\.\.\s+\S+\s+resumed>(.*)$/);
+    if (resumed) {
+      const head = pending.get(pid);
+      pending.delete(pid);
+      if (head !== void 0) out.push(head + resumed[1]);
+      continue;
+    }
+    out.push(line);
+  }
+  return out;
+}
+function parseCall(line) {
+  const m = line.match(
+    /^\s*(?:\d+\s+)?([a-z_][a-z0-9_]*)\((.*)\)\s*=\s*(.+?)\s*$/
+  );
+  if (!m) return null;
+  const [, syscall, args, rest] = m;
+  const errnoMatch = rest.match(/^(-?\d+)\s+([A-Z][A-Z0-9_]*)/);
+  if (errnoMatch) {
+    return { syscall, args, retval: errnoMatch[1], errno: errnoMatch[2] };
+  }
+  return { syscall, args, retval: rest.split(/\s+/)[0] };
+}
+var STRACE_ESCAPE = {
+  n: 10,
+  t: 9,
+  r: 13,
+  v: 11,
+  f: 12,
+  '"': 34,
+  "\\": 92
+};
+function decodeStraceString(s) {
+  const bytes = [];
+  for (let i = 0; i < s.length; ) {
+    if (s[i] === "\\" && i + 1 < s.length) {
+      const octal = s.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0];
+      if (octal) {
+        bytes.push(parseInt(octal, 8) & 255);
+        i += 1 + octal.length;
+        continue;
+      }
+      const mapped = STRACE_ESCAPE[s[i + 1]];
+      bytes.push(mapped ?? s.charCodeAt(i + 1));
+      i += 2;
+      continue;
+    }
+    const code = s.charCodeAt(i);
+    if (code < 128) bytes.push(code);
+    else for (const b of Buffer.from(s[i], "utf8")) bytes.push(b);
+    i += 1;
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function quotedStrings(args) {
+  const out = [];
+  const re = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = re.exec(args)) !== null) {
+    out.push(decodeStraceString(m[1]));
+  }
+  return out;
+}
+function dirfdPath(args) {
+  return args.match(/^\s*(?:AT_FDCWD|-?\d+)<([^>]*)>/)?.[1] ?? "/";
+}
+function fdPath(args) {
+  return args.match(/^\s*-?\d+<([^>]*)>/)?.[1] ?? null;
+}
+function openFlags(args) {
+  return args.match(/\bO_[A-Z_]+(?:\|O_[A-Z_]+)*/)?.[0] ?? "";
+}
+function matchesGlobs(path, include, exclude) {
+  return include.some((glob) => posix.matchesGlob(path, glob)) && !exclude?.some((glob) => posix.matchesGlob(path, glob));
+}
+function parseStraceTrace(raw, options) {
+  const { include, exclude, traceDir, traceFile } = options;
+  const now = Date.now();
+  const state = /* @__PURE__ */ new Map();
+  const renames = [];
+  const resolve = (dir, p) => posix.normalize(p.startsWith("/") ? p : posix.join(dir, p));
+  const write = (path) => {
+    state.set(path, "write");
+  };
+  const remove = (path) => {
+    if (state.get(path) === "write") state.delete(path);
+    else state.set(path, "delete");
+  };
+  for (const line of stitchLines(raw)) {
+    const call = parseCall(line);
+    if (!call || call.errno || call.retval === "-1") continue;
+    const { syscall, args } = call;
+    const dir = dirfdPath(args);
+    if (RENAME_SYSCALLS.has(syscall)) {
+      const strings = quotedStrings(args);
+      if (strings.length < 2) continue;
+      const from = resolve(dir, strings[0]);
+      const to = resolve(dir, strings[strings.length - 1]);
+      state.delete(from);
+      renames.push({ from, to });
+      continue;
+    }
+    if (DELETE_SYSCALLS.has(syscall)) {
+      const strings = quotedStrings(args);
+      if (strings.length) remove(resolve(dir, strings[0]));
+      continue;
+    }
+    if (MKDIR_SYSCALLS.has(syscall)) {
+      const strings = quotedStrings(args);
+      if (strings.length) write(resolve(dir, strings[0]));
+      continue;
+    }
+    if (LINK_SYSCALLS.has(syscall)) {
+      const strings = quotedStrings(args);
+      if (strings.length) write(resolve(dir, strings[strings.length - 1]));
+      continue;
+    }
+    if (OPEN_SYSCALLS.has(syscall)) {
+      if (!CREATE_OR_TRUNC_FLAGS.test(openFlags(args))) continue;
+      const strings = quotedStrings(args);
+      if (strings.length) write(resolve(dir, strings[0]));
+      continue;
+    }
+    if (WRITE_SYSCALLS.has(syscall)) {
+      const p = fdPath(args);
+      if (p && Number(call.retval) > 0) write(posix.normalize(p));
+      continue;
+    }
+    if (TRUNCATE_SYSCALLS.has(syscall)) {
+      const p = fdPath(args) ?? quotedStrings(args)[0];
+      if (p) write(resolve(dir, p));
+    }
+  }
+  const keep = (path) => {
+    if (traceFile && path === traceFile) return false;
+    if (traceDir && (path === traceDir || path.startsWith(`${traceDir}/`))) {
+      return false;
+    }
+    if (/^\/(proc|sys|dev)(\/|$)/.test(path)) return false;
+    return matchesGlobs(path, include, exclude);
+  };
+  const changes = [];
+  const emittedRenameTargets = /* @__PURE__ */ new Set();
+  for (const { from, to } of renames) {
+    if (!keep(to)) continue;
+    if (state.get(to) === "delete") continue;
+    changes.push({ op: "rename", path: to, from, timestamp: now });
+    emittedRenameTargets.add(to);
+  }
+  const tail = [];
+  for (const [path, op] of state) {
+    if (emittedRenameTargets.has(path)) continue;
+    if (keep(path)) tail.push({ op, path, timestamp: now });
+  }
+  tail.sort((a, b) => {
+    if (a.path < b.path) return -1;
+    if (a.path > b.path) return 1;
+    return 0;
+  });
+  changes.push(...tail);
+  return changes;
+}
+var PTRACE_DENIED = /strace:[^\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;
+var STRACE_MISSING = /strace:?\s+(?:command\s+)?not found/i;
+async function selfTestStrace(host) {
+  const probeDir = `/tmp/dat-strace-${randomUUID()}`;
+  const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;
+  const q = shellQuote;
+  const sequence = `mkdir -p ${q(probeDir)} && echo hi > ${q(`${probeDir}/a.txt`)} && mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && echo more > ${q(`${probeDir}/c.txt`)}`;
+  const wrapped = buildStraceCommand(sequence, traceFile, "/tmp");
+  let result;
+  let raw = "";
+  try {
+    result = await host.executeCommand(wrapped);
+    raw = await host.readFile(traceFile).catch(() => "");
+    const diagnostics = `exit=${result.exitCode}
+stderr=${result.stderr}
+trace[0:600]=${raw.slice(0, 600)}`;
+    if (PTRACE_DENIED.test(result.stderr)) {
+      throw new StraceUnavailableError("ptrace-blocked", diagnostics);
+    }
+    if (!raw || result.exitCode === 127 || STRACE_MISSING.test(result.stderr)) {
+      throw new StraceUnavailableError("strace-missing", diagnostics);
+    }
+    const changes = parseStraceTrace(raw, {
+      include: [probeDir, `${probeDir}/**`],
+      traceFile
+    });
+    const hasRealFdPath = raw.includes(`<${probeDir}/`);
+    const hasRename = changes.some(
+      (c) => c.op === "rename" && c.from === `${probeDir}/a.txt` && c.path === `${probeDir}/b.txt`
+    );
+    const hasWrite = changes.some((c) => c.op === "write");
+    const allUnderDir = changes.every(
+      (c) => c.path === probeDir || c.path.startsWith(`${probeDir}/`)
+    );
+    if (!hasRealFdPath || !hasRename || !hasWrite || !allUnderDir) {
+      throw new StraceUnavailableError("trace-unparseable", diagnostics);
+    }
+  } finally {
+    void host.executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`).catch(() => {
+    });
+  }
+}
+export {
+  StraceUnavailableError,
+  buildStraceCommand,
+  buildTracedCommand,
+  matchesGlobs,
+  parseStraceTrace,
+  selfTestStrace,
+  splitTracedOutput
+};
+//# sourceMappingURL=index.js.map

package/dist/lib/sandbox/strace/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/sandbox/strace/index.ts", "../../../../src/lib/sandbox/shell-quote.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\n\nimport { shellQuote } from '../shell-quote.ts';\nimport type { FileChange } from './file-change.ts';\n\nexport type { FileChange, FileChangeOp } from './file-change.ts';\n\nexport type StraceUnavailableReason =\n  | 'ptrace-blocked'\n  | 'strace-missing'\n  | 'trace-unparseable';\n\nconst REASON_HINT: Record<StraceUnavailableReason, string> = {\n  'ptrace-blocked':\n    'ptrace is denied by the sandbox runtime. Modern Docker permits it by default; on a hardened host, relax the runtime seccomp/ptrace policy (allow the ptrace syscall, or add the SYS_PTRACE capability).',\n  'strace-missing':\n    'strace is not installed in the sandbox image. Bake `strace` into the image.',\n  'trace-unparseable':\n    'strace ran but its output is unusable \u2014 the sandbox is likely running under emulation (e.g. amd64 via Rosetta). Use a native-architecture sandbox.',\n};\n\n/**\n * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be\n * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This\n * is a hard failure by design \u2014 there is no silent degrade to the snapshot\n * observer.\n */\nexport class StraceUnavailableError extends Error {\n  readonly reason: StraceUnavailableReason;\n  readonly diagnostics: string;\n\n  constructor(reason: StraceUnavailableReason, diagnostics: string) {\n    super(\n      `strace file-change tracking unavailable (${reason}): ${REASON_HINT[reason]}`,\n    );\n    this.name = 'StraceUnavailableError';\n    this.reason = reason;\n    this.diagnostics = diagnostics;\n  }\n}\n\nconst STRACE_FLAGS = '-f -y -qq -e trace=%file,write,pwrite64,writev';\n\n/**\n * Wraps `command` so its filesystem syscalls are traced to `traceFile`. Both\n * the inner command and this wrapper are re-parsed by a shell (`sh -c`), so the\n * single-quoting via {@link shellQuote} composes with the backend's own\n * `sh -c`. strace propagates the traced command's exit code. The `mkdir -p`\n * runs before strace (so it isn't traced) and self-heals the trace dir per\n * command \u2014 if it ever disappears mid-session, the next command recreates it\n * rather than strace failing to open `-o` and skipping the command entirely.\n */\nexport function buildStraceCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}`\n  );\n}\n\n/**\n * Like {@link buildStraceCommand}, but dumps the (base64) trace inline on stdout\n * after `sentinel`, then exits with the traced command's code. This lets one\n * `executeCommand` round-trip carry both the command output and its trace \u2014 no\n * second `readFile` exec to pull the trace out of the container. Pair with\n * {@link splitTracedOutput}. `sentinel` must be unguessable (a UUID) so the\n * command's own stdout cannot contain it. `base64` keeps the trace stream-safe\n * and its stderr is dropped so a missing trace (strace failed) doesn't leak into\n * the command's stderr.\n */\nexport function buildTracedCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n  sentinel: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}; ` +\n    `__dat_rc=$?; ` +\n    `printf '\\\\n%s\\\\n' ${shellQuote(sentinel)}; ` +\n    `base64 ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `rm -f ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `exit $__dat_rc`\n  );\n}\n\n/**\n * Split {@link buildTracedCommand} output into the command's own stdout and its\n * decoded strace trace. A missing sentinel (strace produced nothing) yields an\n * empty trace so the caller degrades to \"no changes\".\n */\nexport function splitTracedOutput(\n  stdout: string,\n  sentinel: string,\n): { stdout: string; trace: string } {\n  const marker = `\\n${sentinel}\\n`;\n  const at = stdout.indexOf(marker);\n  if (at === -1) return { stdout, trace: '' };\n  const base64 = stdout.slice(at + marker.length);\n  return {\n    stdout: stdout.slice(0, at),\n    trace: base64 ? Buffer.from(base64, 'base64').toString('utf8') : '',\n  };\n}\n\n// An open is a definite write only when it creates or truncates. Bare\n// O_WRONLY/O_RDWR/O_APPEND opens are NOT assumed to mutate \u2014 a real write()\n// syscall confirms them \u2014 so read-only-via-O_RDWR (sqlite SELECT, an editor\n// that opens then quits) doesn't produce a phantom `write`.\nconst CREATE_OR_TRUNC_FLAGS = /O_(CREAT|TRUNC)/;\nconst RENAME_SYSCALLS = new Set(['rename', 'renameat', 'renameat2']);\nconst DELETE_SYSCALLS = new Set(['unlink', 'unlinkat', 'rmdir']);\nconst MKDIR_SYSCALLS = new Set(['mkdir', 'mkdirat']);\nconst LINK_SYSCALLS = new Set(['link', 'linkat', 'symlink', 'symlinkat']);\nconst OPEN_SYSCALLS = new Set(['open', 'openat', 'openat2', 'creat']);\nconst WRITE_SYSCALLS = new Set([\n  'write',\n  'pwrite64',\n  'pwrite',\n  'writev',\n  'pwritev2',\n]);\nconst TRUNCATE_SYSCALLS = new Set(['truncate', 'ftruncate']);\n\ninterface ParsedCall {\n  syscall: string;\n  args: string;\n  retval: string;\n  errno?: string;\n}\n\n/** Reassemble `<unfinished \u2026>` / `<\u2026 resumed>` syscall splits per PID. */\nfunction stitchLines(raw: string): string[] {\n  const pending = new Map<string, string>();\n  const out: string[] = [];\n  for (const original of raw.split('\\n')) {\n    const line = original.trimEnd();\n    if (!line) continue;\n    const pid = line.match(/^\\s*(\\d+)\\s+/)?.[1] ?? '0';\n    if (/<unfinished \\.\\.\\.>\\s*$/.test(line)) {\n      pending.set(pid, line.replace(/<unfinished \\.\\.\\.>\\s*$/, ''));\n      continue;\n    }\n    const resumed = line.match(/<\\.\\.\\.\\s+\\S+\\s+resumed>(.*)$/);\n    if (resumed) {\n      const head = pending.get(pid);\n      pending.delete(pid);\n      if (head !== undefined) out.push(head + resumed[1]);\n      continue;\n    }\n    out.push(line);\n  }\n  return out;\n}\n\nfunction parseCall(line: string): ParsedCall | null {\n  const m = line.match(\n    /^\\s*(?:\\d+\\s+)?([a-z_][a-z0-9_]*)\\((.*)\\)\\s*=\\s*(.+?)\\s*$/,\n  );\n  if (!m) return null;\n  const [, syscall, args, rest] = m;\n  const errnoMatch = rest.match(/^(-?\\d+)\\s+([A-Z][A-Z0-9_]*)/);\n  if (errnoMatch) {\n    return { syscall, args, retval: errnoMatch[1], errno: errnoMatch[2] };\n  }\n  return { syscall, args, retval: rest.split(/\\s+/)[0] };\n}\n\nconst STRACE_ESCAPE: Record<string, number> = {\n  n: 0x0a,\n  t: 0x09,\n  r: 0x0d,\n  v: 0x0b,\n  f: 0x0c,\n  '\"': 0x22,\n  '\\\\': 0x5c,\n};\n\n/**\n * Decode one strace-rendered string. strace emits printable ASCII verbatim and\n * non-printable / non-ASCII bytes as octal `\\NNN`, plus a few `\\x` escapes. We\n * reconstruct the raw byte sequence and decode it as UTF-8 so multi-byte\n * filenames (e.g. `caf\u00E9.txt` \u2192 `\\303\\251`) round-trip instead of being mangled.\n */\nfunction decodeStraceString(s: string): string {\n  const bytes: number[] = [];\n  for (let i = 0; i < s.length; ) {\n    if (s[i] === '\\\\' && i + 1 < s.length) {\n      const octal = s.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0];\n      if (octal) {\n        bytes.push(parseInt(octal, 8) & 0xff);\n        i += 1 + octal.length;\n        continue;\n      }\n      const mapped = STRACE_ESCAPE[s[i + 1]];\n      bytes.push(mapped ?? s.charCodeAt(i + 1));\n      i += 2;\n      continue;\n    }\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes.push(code);\n    else for (const b of Buffer.from(s[i], 'utf8')) bytes.push(b);\n    i += 1;\n  }\n  return Buffer.from(bytes).toString('utf8');\n}\n\nfunction quotedStrings(args: string): string[] {\n  const out: string[] = [];\n  const re = /\"((?:[^\"\\\\]|\\\\.)*)\"/g;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(args)) !== null) {\n    out.push(decodeStraceString(m[1]));\n  }\n  return out;\n}\n\n/** Directory path annotated on the leading dirfd (`AT_FDCWD</cwd>` / `7</dir>`). */\nfunction dirfdPath(args: string): string {\n  return args.match(/^\\s*(?:AT_FDCWD|-?\\d+)<([^>]*)>/)?.[1] ?? '/';\n}\n\n/** Path annotated on the leading fd argument (`-y` output), for write syscalls. */\nfunction fdPath(args: string): string | null {\n  return args.match(/^\\s*-?\\d+<([^>]*)>/)?.[1] ?? null;\n}\n\nfunction openFlags(args: string): string {\n  return args.match(/\\bO_[A-Z_]+(?:\\|O_[A-Z_]+)*/)?.[0] ?? '';\n}\n\nexport interface ParseStraceOptions {\n  include: string[];\n  exclude?: string[];\n  traceFile?: string;\n  traceDir?: string;\n}\n\n/** A path is tracked when it matches an `include` glob and no `exclude` glob. */\nexport function matchesGlobs(\n  path: string,\n  include: string[],\n  exclude?: string[],\n): boolean {\n  return (\n    include.some((glob) => posix.matchesGlob(path, glob)) &&\n    !exclude?.some((glob) => posix.matchesGlob(path, glob))\n  );\n}\n\n/**\n * Parse one command's strace output into a coarse `FileChange[]`. Failed\n * syscalls are skipped; paths are filtered to `destination`; the trace file and\n * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated\n * writes to one `write`; a path written then deleted within the command is\n * treated as transient and dropped.\n */\nexport function parseStraceTrace(\n  raw: string,\n  options: ParseStraceOptions,\n): FileChange[] {\n  const { include, exclude, traceDir, traceFile } = options;\n  const now = Date.now();\n\n  const state = new Map<string, 'write' | 'delete'>();\n  const renames: Array<{ from: string; to: string }> = [];\n\n  const resolve = (dir: string, p: string): string =>\n    posix.normalize(p.startsWith('/') ? p : posix.join(dir, p));\n\n  const write = (path: string) => {\n    state.set(path, 'write');\n  };\n  const remove = (path: string) => {\n    if (state.get(path) === 'write') state.delete(path);\n    else state.set(path, 'delete');\n  };\n\n  for (const line of stitchLines(raw)) {\n    const call = parseCall(line);\n    if (!call || call.errno || call.retval === '-1') continue;\n    const { syscall, args } = call;\n    const dir = dirfdPath(args);\n\n    if (RENAME_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length < 2) continue;\n      const from = resolve(dir, strings[0]);\n      const to = resolve(dir, strings[strings.length - 1]);\n      state.delete(from);\n      renames.push({ from, to });\n      continue;\n    }\n    if (DELETE_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) remove(resolve(dir, strings[0]));\n      continue;\n    }\n    if (MKDIR_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (LINK_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[strings.length - 1]));\n      continue;\n    }\n    if (OPEN_SYSCALLS.has(syscall)) {\n      if (!CREATE_OR_TRUNC_FLAGS.test(openFlags(args))) continue;\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (WRITE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args);\n      if (p && Number(call.retval) > 0) write(posix.normalize(p));\n      continue;\n    }\n    if (TRUNCATE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args) ?? quotedStrings(args)[0];\n      if (p) write(resolve(dir, p));\n    }\n  }\n\n  const keep = (path: string): boolean => {\n    if (traceFile && path === traceFile) return false;\n    if (traceDir && (path === traceDir || path.startsWith(`${traceDir}/`))) {\n      return false;\n    }\n    if (/^\\/(proc|sys|dev)(\\/|$)/.test(path)) return false;\n    return matchesGlobs(path, include, exclude);\n  };\n\n  const changes: FileChange[] = [];\n  const emittedRenameTargets = new Set<string>();\n  for (const { from, to } of renames) {\n    if (!keep(to)) continue;\n    // A later delete of the target supersedes the rename (the tail emits the\n    // delete); otherwise the rename entry already represents the target's final\n    // state, so the tail must NOT also emit a `write` for it (would duplicate).\n    if (state.get(to) === 'delete') continue;\n    changes.push({ op: 'rename', path: to, from, timestamp: now });\n    emittedRenameTargets.add(to);\n  }\n  const tail: FileChange[] = [];\n  for (const [path, op] of state) {\n    if (emittedRenameTargets.has(path)) continue;\n    if (keep(path)) tail.push({ op, path, timestamp: now });\n  }\n  tail.sort((a, b) => {\n    if (a.path < b.path) return -1;\n    if (a.path > b.path) return 1;\n    return 0;\n  });\n  changes.push(...tail);\n  return changes;\n}\n\n// strace prints its own failures to stderr prefixed `strace: `. Anchor on that\n// so a benign command whose output merely contains \"Operation not permitted\" or\n// \"not found\" is not misclassified as a tracer failure.\nconst PTRACE_DENIED =\n  /strace:[^\\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;\nconst STRACE_MISSING = /strace:?\\s+(?:command\\s+)?not found/i;\n\n/**\n * The minimal structural surface {@link selfTestStrace} needs from its host.\n * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:\n * a remote/docker caller passes its sandbox unchanged (it satisfies this shape\n * structurally), and an in-process caller (e.g. a daemon running as PID 1\n * inside the container) implements just these two methods over\n * `node:child_process` + `node:fs`.\n */\nexport interface StraceHost {\n  executeCommand(\n    command: string,\n  ): Promise<{ exitCode: number; stderr: string }>;\n  readFile(path: string): Promise<string>;\n}\n\n/**\n * One-time probe at sandbox setup. Runs a known create/write/rename sequence\n * under strace and asserts the trace is clean and parseable. Throws\n * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is\n * absent, or the trace is garbled (e.g. amd64 under Rosetta).\n *\n * \"strace works in this sandbox\" is an invariant of the (image + host kernel +\n * seccomp/caps) \u2014 constant across every tool call and chat turn in a given\n * container \u2014 so this is the consumer's once-per-container responsibility (e.g.\n * a daemon boot gate), NOT a per-tool cost. `createBashTool` /\n * `withStraceFileChanges` no longer call it.\n */\nexport async function selfTestStrace(host: StraceHost): Promise<void> {\n  const probeDir = `/tmp/dat-strace-${randomUUID()}`;\n  const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;\n  const q = shellQuote;\n  const sequence =\n    `mkdir -p ${q(probeDir)} && ` +\n    `echo hi > ${q(`${probeDir}/a.txt`)} && ` +\n    `mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && ` +\n    `echo more > ${q(`${probeDir}/c.txt`)}`;\n  const wrapped = buildStraceCommand(sequence, traceFile, '/tmp');\n\n  let result: { exitCode: number; stderr: string } | undefined;\n  let raw = '';\n  try {\n    result = await host.executeCommand(wrapped);\n    raw = await host.readFile(traceFile).catch(() => '');\n\n    const diagnostics = `exit=${result.exitCode}\\nstderr=${result.stderr}\\ntrace[0:600]=${raw.slice(0, 600)}`;\n\n    // Order matters: a ptrace block makes strace error on stderr AND emit no\n    // trace, so check the ptrace signal (stderr only) before the empty-trace\n    // strace-missing check, or a blocked ptrace would be mislabelled.\n    if (PTRACE_DENIED.test(result.stderr)) {\n      throw new StraceUnavailableError('ptrace-blocked', diagnostics);\n    }\n    if (!raw || result.exitCode === 127 || STRACE_MISSING.test(result.stderr)) {\n      throw new StraceUnavailableError('strace-missing', diagnostics);\n    }\n\n    // Scope to the probe dir; the exact-path `traceFile` exclusion drops the\n    // sibling trace file that lives under /tmp alongside it.\n    const changes = parseStraceTrace(raw, {\n      include: [probeDir, `${probeDir}/**`],\n      traceFile,\n    });\n    const hasRealFdPath = raw.includes(`<${probeDir}/`);\n    const hasRename = changes.some(\n      (c) =>\n        c.op === 'rename' &&\n        c.from === `${probeDir}/a.txt` &&\n        c.path === `${probeDir}/b.txt`,\n    );\n    const hasWrite = changes.some((c) => c.op === 'write');\n    const allUnderDir = changes.every(\n      (c) => c.path === probeDir || c.path.startsWith(`${probeDir}/`),\n    );\n    if (!hasRealFdPath || !hasRename || !hasWrite || !allUnderDir) {\n      throw new StraceUnavailableError('trace-unparseable', diagnostics);\n    }\n  } finally {\n    void host\n      .executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`)\n      .catch(() => {});\n  }\n}\n", "/**\n * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded\n * `'` with `'\\''`. Safe for arbitrary content inside `sh -c`.\n *\n * Lives in its own zero-import module so node-builtins-only consumers (e.g. the\n * lean `./sandbox/strace` leaf entry) can use it without dragging in the\n * installer/runtime surface.\n */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n"],
+  "mappings": ";AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;;;ACOf,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;;;ADGA,IAAM,cAAuD;AAAA,EAC3D,kBACE;AAAA,EACF,kBACE;AAAA,EACF,qBACE;AACJ;AAQO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,QAAiC,aAAqB;AAChE;AAAA,MACE,4CAA4C,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AACF;AAEA,IAAM,eAAe;AAWd,SAAS,mBACd,SACA,WACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC;AAEtF;AAYO,SAAS,mBACd,SACA,WACA,UACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC,oCAE7D,WAAW,QAAQ,CAAC,YAC/B,WAAW,SAAS,CAAC,uBACtB,WAAW,SAAS,CAAC;AAGlC;AAOO,SAAS,kBACd,QACA,UACmC;AACnC,QAAM,SAAS;AAAA,EAAK,QAAQ;AAAA;AAC5B,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,MAAI,OAAO,GAAI,QAAO,EAAE,QAAQ,OAAO,GAAG;AAC1C,QAAM,SAAS,OAAO,MAAM,KAAK,OAAO,MAAM;AAC9C,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,IAC1B,OAAO,SAAS,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,IAAI;AAAA,EACnE;AACF;AAMA,IAAM,wBAAwB;AAC9B,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,WAAW,CAAC;AACnE,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,OAAO,CAAC;AAC/D,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,SAAS,CAAC;AACnD,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,WAAW,CAAC;AACxE,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,OAAO,CAAC;AACpE,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBAAoB,oBAAI,IAAI,CAAC,YAAY,WAAW,CAAC;AAU3D,SAAS,YAAY,KAAuB;AAC1C,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,MAAgB,CAAC;AACvB,aAAW,YAAY,IAAI,MAAM,IAAI,GAAG;AACtC,UAAM,OAAO,SAAS,QAAQ;AAC9B,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,KAAK,MAAM,cAAc,IAAI,CAAC,KAAK;AAC/C,QAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,cAAQ,IAAI,KAAK,KAAK,QAAQ,2BAA2B,EAAE,CAAC;AAC5D;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,+BAA+B;AAC1D,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,OAAW,KAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,KAAK,IAAI;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAI,KAAK;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,MAAM,IAAI,IAAI;AAChC,QAAM,aAAa,KAAK,MAAM,8BAA8B;AAC5D,MAAI,YAAY;AACd,WAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,CAAC,GAAG,OAAO,WAAW,CAAC,EAAE;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,CAAC,EAAE;AACvD;AAEA,IAAM,gBAAwC;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,KAAK;AAAA,EACL,MAAM;AACR;AAQA,SAAS,mBAAmB,GAAmB;AAC7C,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,EAAE,UAAU;AAC9B,QAAI,EAAE,CAAC,MAAM,QAAQ,IAAI,IAAI,EAAE,QAAQ;AACrC,YAAM,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,aAAa,IAAI,CAAC;AAC5D,UAAI,OAAO;AACT,cAAM,KAAK,SAAS,OAAO,CAAC,IAAI,GAAI;AACpC,aAAK,IAAI,MAAM;AACf;AAAA,MACF;AACA,YAAM,SAAS,cAAc,EAAE,IAAI,CAAC,CAAC;AACrC,YAAM,KAAK,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC;AACxC,WAAK;AACL;AAAA,IACF;AACA,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,OAAM,KAAK,IAAI;AAAA,QAC3B,YAAW,KAAK,OAAO,KAAK,EAAE,CAAC,GAAG,MAAM,EAAG,OAAM,KAAK,CAAC;AAC5D,SAAK;AAAA,EACP;AACA,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,MAAM;AAC3C;AAEA,SAAS,cAAc,MAAwB;AAC7C,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,IAAI,OAAO,MAAM;AACnC,QAAI,KAAK,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAAA,EACnC;AACA,SAAO;AACT;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,iCAAiC,IAAI,CAAC,KAAK;AAC/D;AAGA,SAAS,OAAO,MAA6B;AAC3C,SAAO,KAAK,MAAM,oBAAoB,IAAI,CAAC,KAAK;AAClD;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,6BAA6B,IAAI,CAAC,KAAK;AAC3D;AAUO,SAAS,aACd,MACA,SACA,SACS;AACT,SACE,QAAQ,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC,KACpD,CAAC,SAAS,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC;AAE1D;AASO,SAAS,iBACd,KACA,SACc;AACd,QAAM,EAAE,SAAS,SAAS,UAAU,UAAU,IAAI;AAClD,QAAM,MAAM,KAAK,IAAI;AAErB,QAAM,QAAQ,oBAAI,IAAgC;AAClD,QAAM,UAA+C,CAAC;AAEtD,QAAM,UAAU,CAAC,KAAa,MAC5B,MAAM,UAAU,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;AAE5D,QAAM,QAAQ,CAAC,SAAiB;AAC9B,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACA,QAAM,SAAS,CAAC,SAAiB;AAC/B,QAAI,MAAM,IAAI,IAAI,MAAM,QAAS,OAAM,OAAO,IAAI;AAAA,QAC7C,OAAM,IAAI,MAAM,QAAQ;AAAA,EAC/B;AAEA,aAAW,QAAQ,YAAY,GAAG,GAAG;AACnC,UAAM,OAAO,UAAU,IAAI;AAC3B,QAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAM;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,UAAM,MAAM,UAAU,IAAI;AAE1B,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,SAAS,EAAG;AACxB,YAAM,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpC,YAAM,KAAK,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC;AACnD,YAAM,OAAO,IAAI;AACjB,cAAQ,KAAK,EAAE,MAAM,GAAG,CAAC;AACzB;AAAA,IACF;AACA,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,QAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC,CAAC;AACnE;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,UAAI,CAAC,sBAAsB,KAAK,UAAU,IAAI,CAAC,EAAG;AAClD,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,IAAI,OAAO,IAAI;AACrB,UAAI,KAAK,OAAO,KAAK,MAAM,IAAI,EAAG,OAAM,MAAM,UAAU,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,OAAO,GAAG;AAClC,YAAM,IAAI,OAAO,IAAI,KAAK,cAAc,IAAI,EAAE,CAAC;AAC/C,UAAI,EAAG,OAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,SAA0B;AACtC,QAAI,aAAa,SAAS,UAAW,QAAO;AAC5C,QAAI,aAAa,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,IAAI;AACtE,aAAO;AAAA,IACT;AACA,QAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO;AACjD,WAAO,aAAa,MAAM,SAAS,OAAO;AAAA,EAC5C;AAEA,QAAM,UAAwB,CAAC;AAC/B,QAAM,uBAAuB,oBAAI,IAAY;AAC7C,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,QAAI,CAAC,KAAK,EAAE,EAAG;AAIf,QAAI,MAAM,IAAI,EAAE,MAAM,SAAU;AAChC,YAAQ,KAAK,EAAE,IAAI,UAAU,MAAM,IAAI,MAAM,WAAW,IAAI,CAAC;AAC7D,yBAAqB,IAAI,EAAE;AAAA,EAC7B;AACA,QAAM,OAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,EAAE,KAAK,OAAO;AAC9B,QAAI,qBAAqB,IAAI,IAAI,EAAG;AACpC,QAAI,KAAK,IAAI,EAAG,MAAK,KAAK,EAAE,IAAI,MAAM,WAAW,IAAI,CAAC;AAAA,EACxD;AACA,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,KAAK,GAAG,IAAI;AACpB,SAAO;AACT;AAKA,IAAM,gBACJ;AACF,IAAM,iBAAiB;AA6BvB,eAAsB,eAAe,MAAiC;AACpE,QAAM,WAAW,mBAAmB,WAAW,CAAC;AAChD,QAAM,YAAY,mBAAmB,WAAW,CAAC;AACjD,QAAM,IAAI;AACV,QAAM,WACJ,YAAY,EAAE,QAAQ,CAAC,iBACV,EAAE,GAAG,QAAQ,QAAQ,CAAC,UAC7B,EAAE,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,QAAQ,CAAC,mBACvC,EAAE,GAAG,QAAQ,QAAQ,CAAC;AACvC,QAAM,UAAU,mBAAmB,UAAU,WAAW,MAAM;AAE9D,MAAI;AACJ,MAAI,MAAM;AACV,MAAI;AACF,aAAS,MAAM,KAAK,eAAe,OAAO;AAC1C,UAAM,MAAM,KAAK,SAAS,SAAS,EAAE,MAAM,MAAM,EAAE;AAEnD,UAAM,cAAc,QAAQ,OAAO,QAAQ;AAAA,SAAY,OAAO,MAAM;AAAA,eAAkB,IAAI,MAAM,GAAG,GAAG,CAAC;AAKvG,QAAI,cAAc,KAAK,OAAO,MAAM,GAAG;AACrC,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AACA,QAAI,CAAC,OAAO,OAAO,aAAa,OAAO,eAAe,KAAK,OAAO,MAAM,GAAG;AACzE,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AAIA,UAAM,UAAU,iBAAiB,KAAK;AAAA,MACpC,SAAS,CAAC,UAAU,GAAG,QAAQ,KAAK;AAAA,MACpC;AAAA,IACF,CAAC;AACD,UAAM,gBAAgB,IAAI,SAAS,IAAI,QAAQ,GAAG;AAClD,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MACC,EAAE,OAAO,YACT,EAAE,SAAS,GAAG,QAAQ,YACtB,EAAE,SAAS,GAAG,QAAQ;AAAA,IAC1B;AACA,UAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACrD,UAAM,cAAc,QAAQ;AAAA,MAC1B,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,IAChE;AACA,QAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC7D,YAAM,IAAI,uBAAuB,qBAAqB,WAAW;AAAA,IACnE;AAAA,EACF,UAAE;AACA,SAAK,KACF,eAAe,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EACtD,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AACF;",
+  "names": []
+}

package/dist/lib/sandbox/types.d.ts

@@ -39,9 +39,14 @@ export interface SandboxProcess {
  * `if (!sandbox.spawn) ...` — no silent fallback that aggregates output
  * and flushes on completion.
  */
-export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand'> {
+export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand'>, AsyncDisposable {
     executeCommand(command: string, options?: ExecuteCommandOptions): Promise<CommandResult>;
     spawn?(command: string, options?: SpawnOptions): SandboxProcess;
+    /**
+     * Release the backend's external resources. Called explicitly, or
+     * automatically at scope exit via `await using` — every backend also
+     * implements `[Symbol.asyncDispose]`, which delegates here.
+     */
     dispose(): Promise<void>;
 }
 /**

package/dist/lib/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,eAAe,EACf,gBAAgB,CACjB;IACC,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,eAAe;IAChE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}

package/dist/lib/sandbox/virtual-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAsC5B"}
+{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA0C5B"}

package/dist/lib/save/save-pipeline.d.ts

@@ -1,34 +1,22 @@
-import type { ChainSummary } from '../chain-summary.ts';
 import type { ContextFragment } from '../fragments.ts';
-import { type BaseWhenCtx } from '../fragments/message/user.ts';
 import type { ContextStore } from '../store/store.ts';
 export interface SavePipelineEngine {
     readonly store: ContextStore;
     readonly chatId: string;
-    readonly branchName: string;
     getActiveBranch(): {
         id: string;
         headMessageId: string | null;
     };
     commitHead(headMessageId: string): Promise<void>;
     rewindForUpdate(parentId: string): Promise<void>;
-    getChainSummary(): Promise<ChainSummary>;
-    buildBaseWhenCtx(chain: ChainSummary): BaseWhenCtx;
 }
 export interface SaveResult {
     headMessageId: string | undefined;
 }
 export declare class SavePipeline {
     #private;
-    constructor(engine: SavePipelineEngine, pending: ContextFragment[], fragments: ContextFragment[]);
+    constructor(engine: SavePipelineEngine, pending: ContextFragment[]);
     applyUpdateBranching(shouldBranch: boolean): Promise<this>;
-    /**
-     * Fold any fired `target: 'user'` conditional reminders into the last pending
-     * user message. `steer` reminders fire mid-loop via the engine's prepareStep
-     * hook and `tool-output` reminders wrap at tool-execution time, so neither is
-     * handled here — the save pipeline only carries user-message reminders.
-     */
-    evaluateUserReminders(): Promise<this>;
     persist(): Promise<SaveResult>;
 }
 //# sourceMappingURL=save-pipeline.d.ts.map

package/dist/lib/save/save-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"save-pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/save/save-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,KAAK,WAAW,EAKjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAKnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,eAAe,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,qBAAa,YAAY;;gBAOrB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,eAAe,EAAE,EAC1B,SAAS,EAAE,eAAe,EAAE;IAOxB,oBAAoB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBhE;;;;;OAKG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CtC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;CA6CrC"}
+{"version":3,"file":"save-pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/save/save-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,eAAe,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,qBAAa,YAAY;;gBAKX,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE;IAK5D,oBAAoB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;CA6CrC"}

package/dist/lib/skills/skill-reminder.d.ts

@@ -1,5 +1,5 @@
-import { type UserReminder } from '../fragments/message/user.ts';
+import type { ContextFragment } from '../fragments.ts';
 import { type ClassifierOptions, type IClassifier } from '../fragments/reminders/classifier.ts';
 import type { SkillMetadata } from './types.ts';
-export declare function skillsReminder(skillsOrClassifier: SkillMetadata[] | IClassifier<SkillMetadata>, options?: ClassifierOptions): UserReminder;
+export declare function skillsReminder(skillsOrClassifier: SkillMetadata[] | IClassifier<SkillMetadata>, options?: ClassifierOptions): ContextFragment;
 //# sourceMappingURL=skill-reminder.d.ts.map

package/dist/lib/skills/skill-reminder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-reminder.d.ts","sourceRoot":"","sources":["../../../src/lib/skills/skill-reminder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,wBAAgB,cAAc,CAC5B,kBAAkB,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,aAAa,CAAC,EAChE,OAAO,CAAC,EAAE,iBAAiB,GAC1B,YAAY,CAUd"}
+{"version":3,"file":"skill-reminder.d.ts","sourceRoot":"","sources":["../../../src/lib/skills/skill-reminder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,wBAAgB,cAAc,CAC5B,kBAAkB,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,aAAa,CAAC,EAChE,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CAajB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepagents/context",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -31,6 +31,11 @@
       "types": "./dist/lib/tracing/index.d.ts",
       "import": "./dist/lib/tracing/index.js",
       "default": "./dist/lib/tracing/index.js"
+    },
+    "./sandbox/strace": {
+      "types": "./dist/lib/sandbox/strace/index.d.ts",
+      "import": "./dist/lib/sandbox/strace/index.js",
+      "default": "./dist/lib/sandbox/strace/index.js"
     }
   },
   "files": [
@@ -44,7 +49,7 @@
   "dependencies": {
     "@ai-sdk/groq": "^3.0.36",
     "@ai-sdk/provider": "^3.0.10",
-    "@deepagents/agent": "3.1.0",
+    "@deepagents/agent": "4.0.0",
     "ai": "^6.0.174",
     "bash-tool": "^1.3.16",
     "chalk": "^5.6.0",

package/dist/lib/sandbox/file-changes.d.ts

@@ -1,83 +0,0 @@
-import type { DisposableSandbox } from './types.ts';
-/**
- * A single filesystem mutation observed for one tool call. Ops are
- * deliberately coarse: strace cannot distinguish a brand-new file from an
- * overwrite within a single command (both are `O_CREAT|O_TRUNC`), so
- * content-touching syscalls collapse to `write`. `delete` and `rename` are
- * unambiguous. Reads are not tracked — strace's syscall filter excludes them.
- */
-export type FileChangeOp = 'write' | 'delete' | 'rename';
-export interface FileChange {
-    op: FileChangeOp;
-    path: string;
-    /** Source path for a `rename`. */
-    from?: string;
-    timestamp: number;
-}
-export type StraceUnavailableReason = 'ptrace-blocked' | 'strace-missing' | 'trace-unparseable';
-/**
- * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be
- * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This
- * is a hard failure by design — there is no silent degrade to the snapshot
- * observer.
- */
-export declare class StraceUnavailableError extends Error {
-    readonly reason: StraceUnavailableReason;
-    readonly diagnostics: string;
-    constructor(reason: StraceUnavailableReason, diagnostics: string);
-}
-export interface ParseStraceOptions {
-    destination: string;
-    traceFile?: string;
-    traceDir?: string;
-}
-/**
- * Parse one command's strace output into a coarse `FileChange[]`. Failed
- * syscalls are skipped; paths are filtered to `destination`; the trace file and
- * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated
- * writes to one `write`; a path written then deleted within the command is
- * treated as transient and dropped.
- */
-export declare function parseStraceTrace(raw: string, options: ParseStraceOptions): FileChange[];
-export interface TraceFileChangesOptions {
-    destination: string;
-    onFileChanges?: (changes: FileChange[]) => void | Promise<void>;
-    /**
-     * Called when `onFileChanges` throws on the `spawn` path — its only failure
-     * signal, since spawn has no tool result and no exception catcher upstream. A
-     * throw on the tool-call path fails the command instead, so it never reaches
-     * here. Defaults to `console.warn`.
-     */
-    onError?: (error: unknown) => void;
-    traceDir?: string;
-}
-/**
- * Decorates a sandbox so each `executeCommand` is traced and its filesystem
- * mutations parsed into a per-call `FileChange[]`. Per-call attribution is
- * structural — one trace file per `callId` — so it is safe under concurrent
- * tool calls. Each call's manifest is surfaced two stateless ways: attached to
- * the tool result via the bash-meta channel (`meta.fileChanges`, hidden from the
- * model) and passed to `onFileChanges`. No buffer is retained.
- *
- * `readFile` passes through unchanged; `writeFiles` is observed directly (it
- * mutates outside strace's view) — each written file under the observation root
- * becomes a `write` change fed to onFileChanges. `dispose` also sweeps the trace
- * dir. `spawn` is traced the same way — its trace is read when the process exits
- * (strace is the top process, so the trace is fully flushed by then). `spawn`
- * carries no bash-meta scope, so its changes go to `onFileChanges` only.
- *
- * The trace file is always swept once parsed. A throwing `onFileChanges` on the
- * tool-call path propagates to `withBashExceptionCatch` one level up: a caller's
- * `BashException` becomes the tool result (via its `format()`), any other error
- * fails the tool call. The `spawn` path has no exception catcher, so its throw is
- * isolated and surfaced only via `onError` (exit result preserved).
- */
-export declare function traceFileChanges(sandbox: DisposableSandbox, options: TraceFileChangesOptions): DisposableSandbox;
-/**
- * One-time probe at sandbox setup. Runs a known create/write/rename sequence
- * under strace and asserts the trace is clean and parseable. Throws
- * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is
- * absent, or the trace is garbled (e.g. amd64 under Rosetta).
- */
-export declare function selfTestStrace(sandbox: DisposableSandbox): Promise<void>;
-//# sourceMappingURL=file-changes.d.ts.map