@deepagents/context 4.0.0 → 4.1.0

package/dist/lib/sandbox/docker-sandbox-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-sandbox-errors.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/docker-sandbox-errors.ts"],"names":[],"mappings":"AAAA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAKlD;AAED,qBAAa,uBAAwB,SAAQ,kBAAkB;;CAK9D;AAED,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM1D;AAED,qBAAa,mBAAoB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGtB,QAAQ,EAAE,MAAM,EAAE,EAClB,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,KAAK,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM;CAavB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,MAAM,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,YAAa,SAAQ,kBAAkB;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,mBAAmB;CAYtC;AAED,qBAAa,mBAAoB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAG1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM;CAQvB;AAED,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CASlE;AAED,qBAAa,kBAAmB,SAAQ,kBAAkB;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMhD"}
+{"version":3,"file":"docker-sandbox-errors.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/docker-sandbox-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qBAAa,kBAAmB,SAAQ,qBAAqB;gBAC/C,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAIlD;AAED,qBAAa,uBAAwB,SAAQ,kBAAkB;;CAK9D;AAED,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM1D;AAED,qBAAa,mBAAoB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGtB,QAAQ,EAAE,MAAM,EAAE,EAClB,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,KAAK,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM;CAavB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,MAAM,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,YAAa,SAAQ,kBAAkB;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,mBAAmB;CAYtC;AAED,qBAAa,mBAAoB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAG1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM;CAQvB;AAED,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CASlE;AAED,qBAAa,kBAAmB,SAAQ,kBAAkB;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,iBAAkB,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMhD"}

package/dist/lib/sandbox/docker-sandbox.d.ts

@@ -1,95 +1,140 @@
 import { type CommandResult } from 'bash-tool';
+import type { CommonSandboxOptions, ContainerEngine, SandboxResources, SandboxVolume } from './container-engine.ts';
+import { ContainerSandboxStrategy } from './container-sandbox.ts';
 import { type Installer } from './installers/installer.ts';
 import type { DisposableSandbox, ExecuteCommandOptions, SandboxProcess, SpawnOptions } from './types.ts';
 export type { CommandResult as ExecResult, Sandbox } from 'bash-tool';
+export type { SandboxBindVolume as DockerBindVolume, SandboxNamedVolume as DockerNamedVolume, SandboxVolume as DockerSandboxVolume, } from './container-engine.ts';
 export { ComposeStartError, ContainerCreationError, DockerNotAvailableError, DockerSandboxError, DockerfileBuildError, type InstallErrorOptions, type InstallKind, InstallError, MissingRuntimeError, PackageInstallError, VolumeCreateError, VolumeInspectError, VolumePathError, VolumeRemoveError, } from './docker-sandbox-errors.ts';
-export interface DockerBindVolume {
-    type: 'bind';
-    hostPath: string;
-    containerPath: string;
-    /** Default: `true`. */
-    readOnly?: boolean;
+export interface DockerResources extends SandboxResources {
+    /**
+     * `--memory-swap` — total memory + swap (e.g. `'1g'`). Without it Docker
+     * allows swap up to 2× `memory`; set it equal to `memory` to forbid swap
+     * entirely. Must be ≥ `memory`.
+     */
+    memorySwap?: string;
+    /** `--shm-size` — size of `/dev/shm` (e.g. `'64m'`). Raise for Chromium/ML workloads. */
+    shmSize?: string;
+    /** `--pids-limit` — cap the container's process count (fork-bomb protection). */
+    pidsLimit?: number;
+    /** `--ulimit` per entry — e.g. `['nofile=1024:2048']`. */
+    ulimits?: string[];
+    /** `--cpuset-cpus` — CPUs the container may run on, e.g. `'0-1'`. */
+    cpusetCpus?: string;
+    /** `--cpu-shares` — relative CPU weight under contention. */
+    cpuShares?: number;
 }
-export interface DockerNamedVolume {
-    type: 'volume';
-    name: string;
-    containerPath: string;
-    /** Default: `true`. */
+/**
+ * Container hardening for `docker run`. All optional — omit for the daemon's
+ * defaults (shared kernel, root user, writable root filesystem).
+ */
+export interface DockerSecurity {
+    /**
+     * `--cap-drop` per entry. `['ALL']` drops every Linux capability — the
+     * baseline for running untrusted code; re-grant via {@link capAdd}.
+     */
+    capDrop?: string[];
+    /** `--cap-add` per entry. Re-grant only what's needed after dropping `ALL`. */
+    capAdd?: string[];
+    /**
+     * `--read-only` — mount the container root filesystem read-only. Writes then
+     * only land in `tmpfs`/volume mounts; pair with a writable `/workspace`
+     * (a {@link tmpfs} entry or volume) or the sandbox's `writeFiles` and the
+     * installer phase will fail.
+     */
     readOnly?: boolean;
-    /** Default: `'external'`. */
-    lifecycle?: 'external' | 'managed';
-    /** Docker volume driver used when `lifecycle` is `'managed'`. */
-    driver?: string;
-    /** Docker volume driver options used when `lifecycle` is `'managed'`. */
-    driverOptions?: Record<string, string>;
-    subPath?: string;
-    noCopy?: boolean;
-    /** Default: `true` for managed volumes created by this sandbox. */
-    removeOnDispose?: boolean;
+    /**
+     * `--user` (`uid[:gid]`) — run as a non-root user. The installer phase
+     * (`apk`/`apt`/`npm -g`/`pip`) needs root, so non-root suits a pre-baked
+     * Dockerfile image rather than the runtime-image + installers path.
+     */
+    user?: string;
+    /**
+     * `--tmpfs` per entry (e.g. `'/tmp'`, `'/workspace:size=64m'`) — ephemeral,
+     * in-memory writable directories. The companion to {@link readOnly}.
+     */
+    tmpfs?: string[];
+    /**
+     * `--security-opt` per entry — e.g. `['seccomp=/path/profile.json']` to apply
+     * a custom seccomp profile, or `['no-new-privileges']`.
+     */
+    securityOpt?: string[];
 }
-export type DockerSandboxVolume = DockerBindVolume | DockerNamedVolume;
-export interface DockerResources {
-    /** e.g. `'1g'`, `'512m'`. */
-    memory?: string;
-    /** Number of CPUs. */
-    cpus?: number;
+/** Networking for `docker run`. */
+export interface DockerNetwork {
+    /**
+     * `--network` — e.g. `'none'` (no network at all; strong isolation for
+     * untrusted code, but breaks network installers), a custom network name, or
+     * `'host'` (shares the host network stack — defeats isolation).
+     */
+    mode?: string;
+    /** `--publish` per entry — e.g. `['8080:80']` to expose a container port. */
+    publish?: string[];
+    /** `--dns` per entry — custom DNS servers. */
+    dns?: string[];
+    /** `--add-host` per entry — e.g. `['db:10.0.0.5']` host-to-IP mappings. */
+    addHost?: string[];
+    /** `--hostname` — the container hostname. */
+    hostname?: string;
 }
 /**
- * Stable identity suffix for the container. When provided, the container
- * is named `sandbox-<name>` instead of getting a randomized
- * `sandbox-<8hex>`. If a container with that name already exists on the
- * host, the sandbox attaches to it: installers, volume preparation, and
- * env are skipped (the pre-existing container is assumed already
- * configured). If it exists but is stopped, it is started first.
- * Otherwise the container is created fresh and installers run as usual.
- *
- * Must match `/^[A-Za-z0-9_.-]+$/`. The full Docker container name
- * (`sandbox-<name>`) is always legal because the prefix begins with an
- * alphanumeric character.
- *
- * Warning: `dispose()` stops (and `--rm` removes) the container regardless
- * of whether it was created or attached to. If two callers in the same
- * process share a name, the first `dispose()` destroys the container the
- * other one is still using.
+ * Run-configuration for the Docker engine. Extends the common options the shared
+ * skeleton reads with Docker-only `docker run` knobs that only `dockerEngine`
+ * sees.
  */
-type StableContainerName = string;
-export interface RuntimeSandboxOptions {
-    /** Docker image to use (default: `'alpine:latest'`). */
-    image?: string;
+export interface DockerCommonOptions extends CommonSandboxOptions {
+    volumes?: SandboxVolume[];
+    resources?: DockerResources;
     /**
-     * Ordered list of installers run after the container starts. Use
-     * `pkg([...])`, `urlBinary({...})`, `npm(...)`, `pip(...)`,
-     * `githubRelease({...})`, or any custom `Installer` subclass.
+     * `--platform` (e.g. `'linux/amd64'`) — emulated when it differs from the host
+     * arch. For the Dockerfile strategy it also applies to `docker build` and is
+     * folded into the image-build cache key.
      */
-    installers?: Installer[];
-    volumes?: DockerSandboxVolume[];
-    resources?: DockerResources;
-    env?: Record<string, string>;
-    name?: StableContainerName;
+    platform?: string;
     /**
-     * Args appended after the image at `docker run` time.
-     * - `undefined` (default): `['tail', '-f', '/dev/null']` — keeps a bare
-     *   image (e.g. `alpine:latest`) alive so installers and `executeCommand`
-     *   have something to attach to.
-     * - `[]` or `null`: nothing is appended; the image's own `CMD`/`ENTRYPOINT`
-     *   runs as declared (use this when your image already has a long-running
-     *   process, e.g. a daemon).
-     * - A non-empty array: appended verbatim, overriding the image `CMD`.
+     * `--runtime` for `docker run` — selects the OCI runtime that backs the
+     * container (default: the daemon's default, usually `runc`). Set to a
+     * registered runtime such as `'kata-runtime'` (or `'io.containerd.kata.v2'`)
+     * to run the container inside a lightweight VM with its own guest kernel
+     * instead of sharing the host kernel. The runtime must already be installed on
+     * the host and registered in the Docker daemon — and the host must have
+     * hardware virtualization (`/dev/kvm`); it is not provisioned here.
      */
-    command?: readonly string[] | null;
+    runtime?: string;
+    /** Container hardening: capabilities, read-only rootfs, user, tmpfs, security-opt. */
+    security?: DockerSecurity;
+    /** Networking: network mode, published ports, DNS, host mappings, hostname. */
+    network?: DockerNetwork;
     /**
-     * Extra `--security-opt` values for `docker run`. Each entry becomes one
-     * `--security-opt <value>` — e.g. `['seccomp=/path/profile.json']` to apply a
-     * custom seccomp profile (denying a syscall), or `['no-new-privileges']`.
+     * `--gpus` — e.g. `'all'`. Requires the nvidia container runtime on the host
+     * and is incompatible with a `runtime` such as `'kata-runtime'`.
      */
-    securityOpt?: string[];
+    gpus?: string;
     /**
-     * `--platform` for `docker run` (e.g. `'linux/amd64'`). Runs the container
-     * under that platform — emulated when it differs from the host arch.
+     * `--device` per entry — expose a host device, e.g. `['/dev/fuse']`. Passed
+     * through verbatim; the library never injects a device implicitly.
      */
-    platform?: string;
+    devices?: string[];
+    /** `--init` — run an init process as PID 1 that reaps zombie subprocesses. */
+    init?: boolean;
+    /** `--label` — container metadata, emitted as `key=value` per entry. */
+    labels?: Record<string, string>;
+    /** `--sysctl` — kernel parameters, emitted as `key=value` per entry. */
+    sysctls?: Record<string, string>;
+    /** `--entrypoint` — override the image `ENTRYPOINT`. */
+    entrypoint?: string;
+}
+export interface RuntimeSandboxOptions extends DockerCommonOptions {
+    /** Docker image to use (default: `'alpine:latest'`). */
+    image?: string;
+    /**
+     * Ordered list of installers run after the container starts. Use
+     * `pkg([...])`, `urlBinary({...})`, `npm(...)`, `pip(...)`,
+     * `githubRelease({...})`, or any custom `Installer` subclass.
+     */
+    installers?: Installer[];
 }
-export interface DockerfileSandboxOptions {
+export interface DockerfileSandboxOptions extends DockerCommonOptions {
     /** Inline Dockerfile content (contains `\n`) or a path. */
     dockerfile: string;
     /** Build context directory (default: `'.'`). */
@@ -100,31 +145,6 @@ export interface DockerfileSandboxOptions {
      * otherwise runs silently. Default `false`.
      */
     showBuildLogs?: boolean;
-    volumes?: DockerSandboxVolume[];
-    resources?: DockerResources;
-    env?: Record<string, string>;
-    name?: StableContainerName;
-    /**
-     * Args appended after the image at `docker run` time.
-     * - `undefined` (default): `['tail', '-f', '/dev/null']` — keep-alive.
-     * - `[]` or `null`: nothing is appended; the Dockerfile's `CMD`/`ENTRYPOINT`
-     *   runs as declared. Use this when your Dockerfile already declares a
-     *   long-running process (e.g. `CMD ["node", "server.js"]`).
-     * - A non-empty array: appended verbatim, overriding the image `CMD`.
-     */
-    command?: readonly string[] | null;
-    /**
-     * Extra `--security-opt` values for `docker run`. Each entry becomes one
-     * `--security-opt <value>` — e.g. `['seccomp=/path/profile.json']` to apply a
-     * custom seccomp profile (denying a syscall), or `['no-new-privileges']`.
-     */
-    securityOpt?: string[];
-    /**
-     * `--platform` for `docker build` and `docker run` (e.g. `'linux/amd64'`).
-     * Builds and runs under that platform — emulated when it differs from the
-     * host arch. Folded into the image-build cache key.
-     */
-    platform?: string;
 }
 export interface ComposeSandboxOptions {
     compose: string;
@@ -134,134 +154,18 @@ export interface ComposeSandboxOptions {
 export type DockerSandboxOptions = RuntimeSandboxOptions | DockerfileSandboxOptions | ComposeSandboxOptions;
 export declare function isDockerfileOptions(opts: DockerSandboxOptions): opts is DockerfileSandboxOptions;
 export declare function isComposeOptions(opts: DockerSandboxOptions): opts is ComposeSandboxOptions;
-interface StrategyContext {
-    containerId: string;
-    image: string;
-}
-export interface DockerSandboxStrategyArgs {
-    volumes?: DockerSandboxVolume[];
-    resources?: DockerResources;
-    env?: Record<string, string>;
-    name?: StableContainerName;
-    /** See {@link RuntimeSandboxOptions.command}. */
-    command?: readonly string[] | null;
-    /** See {@link RuntimeSandboxOptions.securityOpt}. */
-    securityOpt?: string[];
-    /** See {@link RuntimeSandboxOptions.platform}. */
-    platform?: string;
-}
-/**
- * Template Method base for sandbox creation strategies. Subclasses choose
- * the image and define post-start configuration; the base owns container
- * lifecycle, exec, and file I/O.
- */
-export declare abstract class DockerSandboxStrategy {
-    protected context: StrategyContext;
-    protected volumes: DockerSandboxVolume[];
-    protected resources: DockerResources;
-    protected env: Record<string, string>;
-    protected name?: StableContainerName;
-    protected command?: readonly string[] | null;
-    protected securityOpt: string[];
-    protected platform?: string;
-    private createdVolumes;
-    constructor(args?: DockerSandboxStrategyArgs);
-    create(): Promise<DisposableSandbox>;
-    private namedContainerId;
-    protected defaultContainerId(): string;
-    protected acquireContainer(image: string): Promise<{
-        containerId: string;
-        attached: boolean;
-    }>;
-    private startStoppedContainer;
-    protected inspectContainer(containerId: string): Promise<'running' | 'stopped' | 'absent'>;
-    private isMissingContainerError;
-    private isNameConflictError;
-    protected prepareVolumes(): Promise<void>;
-    protected validateVolumes(): void;
-    private validateMountValue;
-    protected buildDockerArgs(image: string, containerId: string): string[];
-    protected buildVolumeMountArg(volume: DockerSandboxVolume): string;
-    private inspectVolume;
-    private volumeExists;
-    private createVolume;
-    private cleanupCreatedVolumes;
-    private cleanupCreatedVolumesAfterFailure;
-    private getDockerErrorMessage;
-    private isDockerUnavailableError;
-    private isMissingVolumeInspectError;
-    protected startContainer(image: string, containerId: string): Promise<void>;
-    protected stopContainer(containerId: string): Promise<void>;
-    protected exec(command: string, options?: ExecuteCommandOptions): Promise<CommandResult>;
-    protected spawnProcess(command: string, options?: SpawnOptions): SandboxProcess;
-    protected createSandboxMethods(): DisposableSandbox;
-    protected abstract getImage(): Promise<string>;
-    protected abstract configure(): Promise<void>;
-}
-export interface RuntimeStrategyArgs extends DockerSandboxStrategyArgs {
-    image?: string;
-    installers?: Installer[];
-}
-/**
- * Starts a vanilla image and runs the supplied installers in order.
- *
- * @example
- * ```ts
- * new RuntimeStrategy({
- *   image: 'alpine:latest',
- *   installers: [
- *     pkg(['curl', 'jq']),
- *     urlBinary({ name: 'presenterm', url: {...} }),
- *     npm('prettier', { ensureRuntime: true }),
- *   ],
- * });
- * ```
- */
-export declare class RuntimeStrategy extends DockerSandboxStrategy {
-    private image;
-    private installers;
-    constructor(args?: RuntimeStrategyArgs);
-    protected getImage(): Promise<string>;
-    protected configure(): Promise<void>;
-}
-export interface DockerfileStrategyArgs extends DockerSandboxStrategyArgs {
-    dockerfile: string;
-    context?: string;
-    showBuildLogs?: boolean;
-}
-/**
- * Builds a custom image from a Dockerfile (with content-hash caching).
- * Runs no post-start configuration — the Dockerfile defines the image.
- */
-export declare class DockerfileStrategy extends DockerSandboxStrategy {
-    private imageTag;
-    private dockerfile;
-    private dockerContext;
-    private showBuildLogs;
-    constructor(args: DockerfileStrategyArgs);
-    private computeImageTag;
-    private isInlineDockerfile;
-    protected getImage(): Promise<string>;
-    protected configure(): Promise<void>;
-    private imageExists;
-    private buildImage;
-    /**
-     * Run a build command with stdio inherited so its output streams live to the
-     * parent terminal. On failure the build error is already on screen; the
-     * rejection just carries the exit code.
-     */
-    private runStreamed;
-}
+export declare const dockerEngine: ContainerEngine<DockerCommonOptions>;
 export interface ComposeStrategyArgs {
     compose: string;
     service: string;
     resources?: DockerResources;
 }
 /**
- * Manages multi-container environments via `docker compose`.
- * Commands run inside the named service; `dispose()` brings the whole stack down.
+ * Manages multi-container environments via `docker compose`. Docker-only — not
+ * part of the engine bridge. Commands run inside the named service; `dispose()`
+ * brings the whole stack down.
  */
-export declare class ComposeStrategy extends DockerSandboxStrategy {
+export declare class ComposeStrategy extends ContainerSandboxStrategy {
     private projectName;
     private composeFile;
     private service;

package/dist/lib/sandbox/docker-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAkB/C,OAAO,EACL,KAAK,SAAS,EAEf,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EAErB,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,IAAI,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,mBAAmB,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,GACzB,IAAI,IAAI,wBAAwB,CAElC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,oBAAoB,GACzB,IAAI,IAAI,qBAAqB,CAE/B;AAED,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,iDAAiD;IACjD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,8BAAsB,qBAAqB;IACzC,SAAS,CAAC,OAAO,EAAG,eAAe,CAAC;IACpC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACzC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,cAAc,CAAqB;gBAE/B,IAAI,GAAE,yBAA8B;IA2B1C,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAqB1C,OAAO,CAAC,gBAAgB;IAIxB,SAAS,CAAC,kBAAkB,IAAI,MAAM;cAItB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;YAyCxC,qBAAqB;cAenB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAyB5C,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,mBAAmB;cAIX,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IA6B/C,SAAS,CAAC,eAAe,IAAI,IAAI;IA2DjC,OAAO,CAAC,kBAAkB;IAgB1B,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IAwCvE,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM;YAoBpD,aAAa;YAYb,YAAY;YAeZ,YAAY;YAqBZ,qBAAqB;YAgBrB,iCAAiC;IAa/C,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,2BAA2B;cAInB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;cAsBA,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAQjD,IAAI,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;IA0BzB,SAAS,CAAC,YAAY,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc;IAYjB,SAAS,CAAC,oBAAoB,IAAI,iBAAiB;IAkDnD,SAAS,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAC9C,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;CAC9C;AAiED,MAAM,WAAW,mBAAoB,SAAQ,yBAAyB;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,eAAgB,SAAQ,qBAAqB;IACxD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAc;gBAEpB,IAAI,GAAE,mBAAwB;cAc1B,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;cAI3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;CAM3C;AAED,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAU;gBAEnB,IAAI,EAAE,sBAAsB;IAgBxC,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,kBAAkB;cAIV,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;cAQ3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;YAI5B,WAAW;YASX,UAAU;IAgCxB;;;;OAIG;IACH,OAAO,CAAC,WAAW;CAepB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,qBAAqB;IACxD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,mBAAmB;IAOrC,OAAO,CAAC,kBAAkB;cAMV,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;cAIlB,cAAc,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;cAoBG,kBAAkB,IAAI,MAAM;cAI/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAIjB,IAAI,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;cAkCN,YAAY,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc;cAkBQ,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,OAAO,EAAE,oBAAoB,EAC7B,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAOZ"}
+{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAO/C,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EAGf,gBAAgB,EAChB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EAGzB,MAAM,wBAAwB,CAAC;AAYhC,OAAO,EACL,KAAK,SAAS,EAEf,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,IAAI,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EACV,iBAAiB,IAAI,gBAAgB,EACrC,kBAAkB,IAAI,iBAAiB,EACvC,aAAa,IAAI,mBAAmB,GACrC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,GACzB,IAAI,IAAI,wBAAwB,CAElC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,oBAAoB,GACzB,IAAI,IAAI,qBAAqB,CAE/B;AAuED,eAAO,MAAM,YAAY,EAAE,eAAe,CAAC,mBAAmB,CA4P7D,CAAC;AAsBF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,wBAAwB;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,mBAAmB;IAOrC,OAAO,CAAC,kBAAkB;cAMV,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;cAIlB,cAAc,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;cAoBG,kBAAkB,IAAI,MAAM;cAI/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAIjB,IAAI,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;cA8BN,YAAY,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc;cAkBQ,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAoB5B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,OAAO,EAAE,oBAAoB,EAC7B,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAOZ"}

package/dist/lib/sandbox/index.d.ts

@@ -1,9 +1,13 @@
 export * from './abort.ts';
 export * from './agent-os-sandbox.ts';
+export * from './apple-container-sandbox.ts';
 export * from './bash-exception.ts';
 export * from './bash-meta.ts';
 export * from './bash-tool.ts';
 export * from './binary-bridges.ts';
+export * from './container-engine.ts';
+export * from './container-sandbox.ts';
+export * from './container-sandbox-errors.ts';
 export * from './daytona-sandbox.ts';
 export * from './docker-sandbox.ts';
 export * from './strace/file-changes.ts';

package/dist/lib/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,UAAU,CAAC;AACzB,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,UAAU,CAAC;AACzB,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC"}

package/dist/lib/sandbox/shell-quote.d.ts

@@ -2,8 +2,8 @@
  * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded
  * `'` with `'\''`. Safe for arbitrary content inside `sh -c`.
  *
- * Lives in its own zero-import module so node-builtins-only consumers (e.g. the
- * lean `./sandbox/strace` leaf entry) can use it without dragging in the
+ * Lives in its own zero-import module so lean consumers such as the
+ * `./sandbox/strace` leaf entry can use it without dragging in the
  * installer/runtime surface.
  */
 export declare function shellQuote(s: string): string;

package/dist/lib/sandbox/strace/index.d.ts

@@ -58,32 +58,17 @@ export declare function matchesGlobs(path: string, include: string[], exclude?:
  * treated as transient and dropped.
  */
 export declare function parseStraceTrace(raw: string, options: ParseStraceOptions): FileChange[];
-/**
- * The minimal structural surface {@link selfTestStrace} needs from its host.
- * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:
- * a remote/docker caller passes its sandbox unchanged (it satisfies this shape
- * structurally), and an in-process caller (e.g. a daemon running as PID 1
- * inside the container) implements just these two methods over
- * `node:child_process` + `node:fs`.
- */
-export interface StraceHost {
-    executeCommand(command: string): Promise<{
-        exitCode: number;
-        stderr: string;
-    }>;
-    readFile(path: string): Promise<string>;
-}
 /**
  * One-time probe at sandbox setup. Runs a known create/write/rename sequence
- * under strace and asserts the trace is clean and parseable. Throws
+ * under strace on the host and asserts the trace is clean and parseable. Throws
  * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is
  * absent, or the trace is garbled (e.g. amd64 under Rosetta).
  *
- * "strace works in this sandbox" is an invariant of the (image + host kernel +
- * seccomp/caps) — constant across every tool call and chat turn in a given
- * container — so this is the consumer's once-per-container responsibility (e.g.
- * a daemon boot gate), NOT a per-tool cost. `createBashTool` /
+ * "strace works here" is an invariant of the (image + host kernel + seccomp/caps)
+ * — constant across every tool call and chat turn in a given container — so this
+ * is the consumer's once-per-container responsibility (e.g. a daemon boot gate
+ * running as PID 1 inside the container), NOT a per-tool cost. `createBashTool` /
  * `withStraceFileChanges` no longer call it.
  */
-export declare function selfTestStrace(host: StraceHost): Promise<void>;
+export declare function selfTestStrace(): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/sandbox/strace/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/sandbox/strace/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,CAAC;AAWxB;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM;CAQjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASnC;AAgID,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAKT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,UAAU,EAAE,CAiGd;AASD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,CACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/sandbox/strace/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,CAAC;AAWxB;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM;CAQjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASnC;AAgID,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAKT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,UAAU,EAAE,CAiGd;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAqDpD"}

package/dist/lib/sandbox/strace/index.js

@@ -1,5 +1,7 @@
 // packages/context/src/lib/sandbox/strace/index.ts
+import spawn from "nano-spawn";
 import { randomUUID } from "node:crypto";
+import { readFile, rm } from "node:fs/promises";
 import { posix } from "node:path";
 
 // packages/context/src/lib/sandbox/shell-quote.ts
@@ -233,17 +235,24 @@ function parseStraceTrace(raw, options) {
 }
 var PTRACE_DENIED = /strace:[^\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;
 var STRACE_MISSING = /strace:?\s+(?:command\s+)?not found/i;
-async function selfTestStrace(host) {
+async function runOnHost(command) {
+  try {
+    const { stderr } = await spawn("sh", ["-c", command]);
+    return { exitCode: 0, stderr };
+  } catch (error) {
+    const e = error;
+    return { exitCode: e.exitCode ?? 1, stderr: e.stderr };
+  }
+}
+async function selfTestStrace() {
   const probeDir = `/tmp/dat-strace-${randomUUID()}`;
   const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;
   const q = shellQuote;
   const sequence = `mkdir -p ${q(probeDir)} && echo hi > ${q(`${probeDir}/a.txt`)} && mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && echo more > ${q(`${probeDir}/c.txt`)}`;
   const wrapped = buildStraceCommand(sequence, traceFile, "/tmp");
-  let result;
-  let raw = "";
   try {
-    result = await host.executeCommand(wrapped);
-    raw = await host.readFile(traceFile).catch(() => "");
+    const result = await runOnHost(wrapped);
+    const raw = await readFile(traceFile, "utf8").catch(() => "");
     const diagnostics = `exit=${result.exitCode}
 stderr=${result.stderr}
 trace[0:600]=${raw.slice(0, 600)}`;
@@ -269,8 +278,10 @@ trace[0:600]=${raw.slice(0, 600)}`;
       throw new StraceUnavailableError("trace-unparseable", diagnostics);
     }
   } finally {
-    void host.executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`).catch(() => {
-    });
+    await Promise.allSettled([
+      rm(probeDir, { recursive: true, force: true }),
+      rm(traceFile, { force: true })
+    ]);
   }
 }
 export {