@deepagents/context 4.0.0 → 4.2.0

package/dist/lib/sandbox/microsandbox-sandbox.d.ts

@@ -0,0 +1,93 @@
+import type { SandboxBuilder } from 'microsandbox';
+import type { DisposableSandbox, SandboxReadinessOptions } from './types.ts';
+export declare const MICROSANDBOX_DEFAULT_DESTINATION = "/workspace";
+export interface MicrosandboxSandboxOptions extends SandboxReadinessOptions {
+    /**
+     * Stable sandbox name. When provided, creation uses get-or-create
+     * semantics: attach to the running sandbox of this name, resume it if it is
+     * stopped (rootfs state intact), otherwise create it fresh. `dispose()`
+     * stops the microVM but never removes it — the next
+     * `createMicrosandboxSandbox({ name })` resumes where it left off.
+     *
+     * When omitted, an ephemeral sandbox with a generated name is created and
+     * fully removed on `dispose()`.
+     */
+    name?: string;
+    /** OCI image to boot (default `'alpine'`). Ignored when attaching. */
+    image?: string;
+    /** Number of virtual CPUs. */
+    cpus?: number;
+    /** Memory in MiB. */
+    memory?: number;
+    /** Environment variables baked into the sandbox at boot. */
+    env?: Record<string, string>;
+    /**
+     * Default working directory, created at boot (default `'/workspace'`).
+     * Microsandbox images default to `/`, and common images ship no
+     * `/workspace`, so the factory creates it — pass this same path as
+     * `createBashTool`'s `destination`.
+     */
+    workdir?: string;
+    /**
+     * Replace an existing sandbox with the same name instead of attaching to
+     * it. Requires `name`.
+     */
+    replace?: boolean;
+    /** Per-command timeout in milliseconds for `executeCommand`. */
+    commandTimeout?: number;
+    /**
+     * Escape hatch over the SDK builder for everything without a plain option
+     * (volumes, network policy, secrets, user, idle timeout, …). Applied after
+     * the factory's own setters, so it can override them. Only runs on
+     * creation, not when attaching to an existing sandbox.
+     */
+    configure?: (builder: SandboxBuilder) => SandboxBuilder;
+}
+/**
+ * Named `MicrosandboxSandboxError` (not `MicrosandboxError`) because the SDK
+ * itself exports a `MicrosandboxError` base class and this module is
+ * re-exported through the package barrel.
+ */
+export declare class MicrosandboxSandboxError extends Error {
+    constructor(message: string, cause?: Error);
+}
+export declare class MicrosandboxNotAvailableError extends MicrosandboxSandboxError {
+    constructor(cause?: Error);
+}
+export declare class MicrosandboxCreationError extends MicrosandboxSandboxError {
+    constructor(message: string, cause?: Error);
+}
+export declare class MicrosandboxCommandError extends MicrosandboxSandboxError {
+    constructor(message: string, cause?: Error);
+}
+/**
+ * Creates a sandbox backed by a microsandbox microVM.
+ *
+ * Each sandbox is a hardware-isolated VM with its own Linux kernel, booted
+ * in-process through the SDK's native binding — no daemon, no API key.
+ * Boots standard OCI images in about a second; per-command latency inside a
+ * running sandbox is single-digit milliseconds.
+ *
+ * The factory never touches the SDK's process-global backend selection
+ * (`setDefaultBackend`) — callers targeting the cloud backend configure it
+ * themselves before calling this.
+ *
+ * Requires the optional peer dependency `microsandbox`.
+ *
+ * @example Ephemeral sandbox (removed on dispose)
+ * ```typescript
+ * await using sandbox = await createMicrosandboxSandbox();
+ * const result = await sandbox.executeCommand('echo hello');
+ * ```
+ *
+ * @example Named sandbox (stopped on dispose, resumed on next create)
+ * ```typescript
+ * const sandbox = await createMicrosandboxSandbox({ name: chatId });
+ * const { tools } = await createBashTool({
+ *   sandbox,
+ *   destination: MICROSANDBOX_DEFAULT_DESTINATION,
+ * });
+ * ```
+ */
+export declare function createMicrosandboxSandbox(options?: MicrosandboxSandboxOptions): Promise<DisposableSandbox>;
+//# sourceMappingURL=microsandbox-sandbox.d.ts.map

package/dist/lib/sandbox/microsandbox-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsandbox-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/microsandbox-sandbox.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EACV,iBAAiB,EAIjB,uBAAuB,EAExB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,gCAAgC,eAAe,CAAC;AAO7D,MAAM,WAAW,0BAA2B,SAAQ,uBAAuB;IACzE;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,cAAc,CAAC;CACzD;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAK3C;AAED,qBAAa,6BAA8B,SAAQ,wBAAwB;gBAC7D,KAAK,CAAC,EAAE,KAAK;CAO1B;AAED,qBAAa,yBAA0B,SAAQ,wBAAwB;gBACzD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAI3C;AAED,qBAAa,wBAAyB,SAAQ,wBAAwB;gBACxD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAI3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAiC5B"}

package/dist/lib/sandbox/shell-quote.d.ts

@@ -2,8 +2,8 @@
  * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded
  * `'` with `'\''`. Safe for arbitrary content inside `sh -c`.
  *
- * Lives in its own zero-import module so node-builtins-only consumers (e.g. the
- * lean `./sandbox/strace` leaf entry) can use it without dragging in the
+ * Lives in its own zero-import module so lean consumers such as the
+ * `./sandbox/strace` leaf entry can use it without dragging in the
  * installer/runtime surface.
  */
 export declare function shellQuote(s: string): string;

package/dist/lib/sandbox/strace/index.d.ts

@@ -58,32 +58,17 @@ export declare function matchesGlobs(path: string, include: string[], exclude?:
  * treated as transient and dropped.
  */
 export declare function parseStraceTrace(raw: string, options: ParseStraceOptions): FileChange[];
-/**
- * The minimal structural surface {@link selfTestStrace} needs from its host.
- * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:
- * a remote/docker caller passes its sandbox unchanged (it satisfies this shape
- * structurally), and an in-process caller (e.g. a daemon running as PID 1
- * inside the container) implements just these two methods over
- * `node:child_process` + `node:fs`.
- */
-export interface StraceHost {
-    executeCommand(command: string): Promise<{
-        exitCode: number;
-        stderr: string;
-    }>;
-    readFile(path: string): Promise<string>;
-}
 /**
  * One-time probe at sandbox setup. Runs a known create/write/rename sequence
- * under strace and asserts the trace is clean and parseable. Throws
+ * under strace on the host and asserts the trace is clean and parseable. Throws
  * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is
  * absent, or the trace is garbled (e.g. amd64 under Rosetta).
  *
- * "strace works in this sandbox" is an invariant of the (image + host kernel +
- * seccomp/caps) — constant across every tool call and chat turn in a given
- * container — so this is the consumer's once-per-container responsibility (e.g.
- * a daemon boot gate), NOT a per-tool cost. `createBashTool` /
+ * "strace works here" is an invariant of the (image + host kernel + seccomp/caps)
+ * — constant across every tool call and chat turn in a given container — so this
+ * is the consumer's once-per-container responsibility (e.g. a daemon boot gate
+ * running as PID 1 inside the container), NOT a per-tool cost. `createBashTool` /
  * `withStraceFileChanges` no longer call it.
  */
-export declare function selfTestStrace(host: StraceHost): Promise<void>;
+export declare function selfTestStrace(): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/sandbox/strace/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/sandbox/strace/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,CAAC;AAWxB;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM;CAQjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASnC;AAgID,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAKT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,UAAU,EAAE,CAiGd;AASD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,CACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/sandbox/strace/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,CAAC;AAWxB;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM;CAQjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASnC;AAgID,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAKT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,UAAU,EAAE,CAiGd;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAqDpD"}

package/dist/lib/sandbox/strace/index.js

@@ -1,5 +1,7 @@
 // packages/context/src/lib/sandbox/strace/index.ts
+import spawn from "nano-spawn";
 import { randomUUID } from "node:crypto";
+import { readFile, rm } from "node:fs/promises";
 import { posix } from "node:path";
 
 // packages/context/src/lib/sandbox/shell-quote.ts
@@ -233,17 +235,24 @@ function parseStraceTrace(raw, options) {
 }
 var PTRACE_DENIED = /strace:[^\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;
 var STRACE_MISSING = /strace:?\s+(?:command\s+)?not found/i;
-async function selfTestStrace(host) {
+async function runOnHost(command) {
+  try {
+    const { stderr } = await spawn("sh", ["-c", command]);
+    return { exitCode: 0, stderr };
+  } catch (error) {
+    const e = error;
+    return { exitCode: e.exitCode ?? 1, stderr: e.stderr };
+  }
+}
+async function selfTestStrace() {
   const probeDir = `/tmp/dat-strace-${randomUUID()}`;
   const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;
   const q = shellQuote;
   const sequence = `mkdir -p ${q(probeDir)} && echo hi > ${q(`${probeDir}/a.txt`)} && mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && echo more > ${q(`${probeDir}/c.txt`)}`;
   const wrapped = buildStraceCommand(sequence, traceFile, "/tmp");
-  let result;
-  let raw = "";
   try {
-    result = await host.executeCommand(wrapped);
-    raw = await host.readFile(traceFile).catch(() => "");
+    const result = await runOnHost(wrapped);
+    const raw = await readFile(traceFile, "utf8").catch(() => "");
     const diagnostics = `exit=${result.exitCode}
 stderr=${result.stderr}
 trace[0:600]=${raw.slice(0, 600)}`;
@@ -269,8 +278,10 @@ trace[0:600]=${raw.slice(0, 600)}`;
       throw new StraceUnavailableError("trace-unparseable", diagnostics);
     }
   } finally {
-    void host.executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`).catch(() => {
-    });
+    await Promise.allSettled([
+      rm(probeDir, { recursive: true, force: true }),
+      rm(traceFile, { force: true })
+    ]);
   }
 }
 export {

package/dist/lib/sandbox/strace/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/lib/sandbox/strace/index.ts", "../../../../src/lib/sandbox/shell-quote.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\n\nimport { shellQuote } from '../shell-quote.ts';\nimport type { FileChange } from './file-change.ts';\n\nexport type { FileChange, FileChangeOp } from './file-change.ts';\n\nexport type StraceUnavailableReason =\n  | 'ptrace-blocked'\n  | 'strace-missing'\n  | 'trace-unparseable';\n\nconst REASON_HINT: Record<StraceUnavailableReason, string> = {\n  'ptrace-blocked':\n    'ptrace is denied by the sandbox runtime. Modern Docker permits it by default; on a hardened host, relax the runtime seccomp/ptrace policy (allow the ptrace syscall, or add the SYS_PTRACE capability).',\n  'strace-missing':\n    'strace is not installed in the sandbox image. Bake `strace` into the image.',\n  'trace-unparseable':\n    'strace ran but its output is unusable \u2014 the sandbox is likely running under emulation (e.g. amd64 via Rosetta). Use a native-architecture sandbox.',\n};\n\n/**\n * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be\n * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This\n * is a hard failure by design \u2014 there is no silent degrade to the snapshot\n * observer.\n */\nexport class StraceUnavailableError extends Error {\n  readonly reason: StraceUnavailableReason;\n  readonly diagnostics: string;\n\n  constructor(reason: StraceUnavailableReason, diagnostics: string) {\n    super(\n      `strace file-change tracking unavailable (${reason}): ${REASON_HINT[reason]}`,\n    );\n    this.name = 'StraceUnavailableError';\n    this.reason = reason;\n    this.diagnostics = diagnostics;\n  }\n}\n\nconst STRACE_FLAGS = '-f -y -qq -e trace=%file,write,pwrite64,writev';\n\n/**\n * Wraps `command` so its filesystem syscalls are traced to `traceFile`. Both\n * the inner command and this wrapper are re-parsed by a shell (`sh -c`), so the\n * single-quoting via {@link shellQuote} composes with the backend's own\n * `sh -c`. strace propagates the traced command's exit code. The `mkdir -p`\n * runs before strace (so it isn't traced) and self-heals the trace dir per\n * command \u2014 if it ever disappears mid-session, the next command recreates it\n * rather than strace failing to open `-o` and skipping the command entirely.\n */\nexport function buildStraceCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}`\n  );\n}\n\n/**\n * Like {@link buildStraceCommand}, but dumps the (base64) trace inline on stdout\n * after `sentinel`, then exits with the traced command's code. This lets one\n * `executeCommand` round-trip carry both the command output and its trace \u2014 no\n * second `readFile` exec to pull the trace out of the container. Pair with\n * {@link splitTracedOutput}. `sentinel` must be unguessable (a UUID) so the\n * command's own stdout cannot contain it. `base64` keeps the trace stream-safe\n * and its stderr is dropped so a missing trace (strace failed) doesn't leak into\n * the command's stderr.\n */\nexport function buildTracedCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n  sentinel: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}; ` +\n    `__dat_rc=$?; ` +\n    `printf '\\\\n%s\\\\n' ${shellQuote(sentinel)}; ` +\n    `base64 ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `rm -f ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `exit $__dat_rc`\n  );\n}\n\n/**\n * Split {@link buildTracedCommand} output into the command's own stdout and its\n * decoded strace trace. A missing sentinel (strace produced nothing) yields an\n * empty trace so the caller degrades to \"no changes\".\n */\nexport function splitTracedOutput(\n  stdout: string,\n  sentinel: string,\n): { stdout: string; trace: string } {\n  const marker = `\\n${sentinel}\\n`;\n  const at = stdout.indexOf(marker);\n  if (at === -1) return { stdout, trace: '' };\n  const base64 = stdout.slice(at + marker.length);\n  return {\n    stdout: stdout.slice(0, at),\n    trace: base64 ? Buffer.from(base64, 'base64').toString('utf8') : '',\n  };\n}\n\n// An open is a definite write only when it creates or truncates. Bare\n// O_WRONLY/O_RDWR/O_APPEND opens are NOT assumed to mutate \u2014 a real write()\n// syscall confirms them \u2014 so read-only-via-O_RDWR (sqlite SELECT, an editor\n// that opens then quits) doesn't produce a phantom `write`.\nconst CREATE_OR_TRUNC_FLAGS = /O_(CREAT|TRUNC)/;\nconst RENAME_SYSCALLS = new Set(['rename', 'renameat', 'renameat2']);\nconst DELETE_SYSCALLS = new Set(['unlink', 'unlinkat', 'rmdir']);\nconst MKDIR_SYSCALLS = new Set(['mkdir', 'mkdirat']);\nconst LINK_SYSCALLS = new Set(['link', 'linkat', 'symlink', 'symlinkat']);\nconst OPEN_SYSCALLS = new Set(['open', 'openat', 'openat2', 'creat']);\nconst WRITE_SYSCALLS = new Set([\n  'write',\n  'pwrite64',\n  'pwrite',\n  'writev',\n  'pwritev2',\n]);\nconst TRUNCATE_SYSCALLS = new Set(['truncate', 'ftruncate']);\n\ninterface ParsedCall {\n  syscall: string;\n  args: string;\n  retval: string;\n  errno?: string;\n}\n\n/** Reassemble `<unfinished \u2026>` / `<\u2026 resumed>` syscall splits per PID. */\nfunction stitchLines(raw: string): string[] {\n  const pending = new Map<string, string>();\n  const out: string[] = [];\n  for (const original of raw.split('\\n')) {\n    const line = original.trimEnd();\n    if (!line) continue;\n    const pid = line.match(/^\\s*(\\d+)\\s+/)?.[1] ?? '0';\n    if (/<unfinished \\.\\.\\.>\\s*$/.test(line)) {\n      pending.set(pid, line.replace(/<unfinished \\.\\.\\.>\\s*$/, ''));\n      continue;\n    }\n    const resumed = line.match(/<\\.\\.\\.\\s+\\S+\\s+resumed>(.*)$/);\n    if (resumed) {\n      const head = pending.get(pid);\n      pending.delete(pid);\n      if (head !== undefined) out.push(head + resumed[1]);\n      continue;\n    }\n    out.push(line);\n  }\n  return out;\n}\n\nfunction parseCall(line: string): ParsedCall | null {\n  const m = line.match(\n    /^\\s*(?:\\d+\\s+)?([a-z_][a-z0-9_]*)\\((.*)\\)\\s*=\\s*(.+?)\\s*$/,\n  );\n  if (!m) return null;\n  const [, syscall, args, rest] = m;\n  const errnoMatch = rest.match(/^(-?\\d+)\\s+([A-Z][A-Z0-9_]*)/);\n  if (errnoMatch) {\n    return { syscall, args, retval: errnoMatch[1], errno: errnoMatch[2] };\n  }\n  return { syscall, args, retval: rest.split(/\\s+/)[0] };\n}\n\nconst STRACE_ESCAPE: Record<string, number> = {\n  n: 0x0a,\n  t: 0x09,\n  r: 0x0d,\n  v: 0x0b,\n  f: 0x0c,\n  '\"': 0x22,\n  '\\\\': 0x5c,\n};\n\n/**\n * Decode one strace-rendered string. strace emits printable ASCII verbatim and\n * non-printable / non-ASCII bytes as octal `\\NNN`, plus a few `\\x` escapes. We\n * reconstruct the raw byte sequence and decode it as UTF-8 so multi-byte\n * filenames (e.g. `caf\u00E9.txt` \u2192 `\\303\\251`) round-trip instead of being mangled.\n */\nfunction decodeStraceString(s: string): string {\n  const bytes: number[] = [];\n  for (let i = 0; i < s.length; ) {\n    if (s[i] === '\\\\' && i + 1 < s.length) {\n      const octal = s.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0];\n      if (octal) {\n        bytes.push(parseInt(octal, 8) & 0xff);\n        i += 1 + octal.length;\n        continue;\n      }\n      const mapped = STRACE_ESCAPE[s[i + 1]];\n      bytes.push(mapped ?? s.charCodeAt(i + 1));\n      i += 2;\n      continue;\n    }\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes.push(code);\n    else for (const b of Buffer.from(s[i], 'utf8')) bytes.push(b);\n    i += 1;\n  }\n  return Buffer.from(bytes).toString('utf8');\n}\n\nfunction quotedStrings(args: string): string[] {\n  const out: string[] = [];\n  const re = /\"((?:[^\"\\\\]|\\\\.)*)\"/g;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(args)) !== null) {\n    out.push(decodeStraceString(m[1]));\n  }\n  return out;\n}\n\n/** Directory path annotated on the leading dirfd (`AT_FDCWD</cwd>` / `7</dir>`). */\nfunction dirfdPath(args: string): string {\n  return args.match(/^\\s*(?:AT_FDCWD|-?\\d+)<([^>]*)>/)?.[1] ?? '/';\n}\n\n/** Path annotated on the leading fd argument (`-y` output), for write syscalls. */\nfunction fdPath(args: string): string | null {\n  return args.match(/^\\s*-?\\d+<([^>]*)>/)?.[1] ?? null;\n}\n\nfunction openFlags(args: string): string {\n  return args.match(/\\bO_[A-Z_]+(?:\\|O_[A-Z_]+)*/)?.[0] ?? '';\n}\n\nexport interface ParseStraceOptions {\n  include: string[];\n  exclude?: string[];\n  traceFile?: string;\n  traceDir?: string;\n}\n\n/** A path is tracked when it matches an `include` glob and no `exclude` glob. */\nexport function matchesGlobs(\n  path: string,\n  include: string[],\n  exclude?: string[],\n): boolean {\n  return (\n    include.some((glob) => posix.matchesGlob(path, glob)) &&\n    !exclude?.some((glob) => posix.matchesGlob(path, glob))\n  );\n}\n\n/**\n * Parse one command's strace output into a coarse `FileChange[]`. Failed\n * syscalls are skipped; paths are filtered to `destination`; the trace file and\n * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated\n * writes to one `write`; a path written then deleted within the command is\n * treated as transient and dropped.\n */\nexport function parseStraceTrace(\n  raw: string,\n  options: ParseStraceOptions,\n): FileChange[] {\n  const { include, exclude, traceDir, traceFile } = options;\n  const now = Date.now();\n\n  const state = new Map<string, 'write' | 'delete'>();\n  const renames: Array<{ from: string; to: string }> = [];\n\n  const resolve = (dir: string, p: string): string =>\n    posix.normalize(p.startsWith('/') ? p : posix.join(dir, p));\n\n  const write = (path: string) => {\n    state.set(path, 'write');\n  };\n  const remove = (path: string) => {\n    if (state.get(path) === 'write') state.delete(path);\n    else state.set(path, 'delete');\n  };\n\n  for (const line of stitchLines(raw)) {\n    const call = parseCall(line);\n    if (!call || call.errno || call.retval === '-1') continue;\n    const { syscall, args } = call;\n    const dir = dirfdPath(args);\n\n    if (RENAME_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length < 2) continue;\n      const from = resolve(dir, strings[0]);\n      const to = resolve(dir, strings[strings.length - 1]);\n      state.delete(from);\n      renames.push({ from, to });\n      continue;\n    }\n    if (DELETE_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) remove(resolve(dir, strings[0]));\n      continue;\n    }\n    if (MKDIR_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (LINK_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[strings.length - 1]));\n      continue;\n    }\n    if (OPEN_SYSCALLS.has(syscall)) {\n      if (!CREATE_OR_TRUNC_FLAGS.test(openFlags(args))) continue;\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (WRITE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args);\n      if (p && Number(call.retval) > 0) write(posix.normalize(p));\n      continue;\n    }\n    if (TRUNCATE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args) ?? quotedStrings(args)[0];\n      if (p) write(resolve(dir, p));\n    }\n  }\n\n  const keep = (path: string): boolean => {\n    if (traceFile && path === traceFile) return false;\n    if (traceDir && (path === traceDir || path.startsWith(`${traceDir}/`))) {\n      return false;\n    }\n    if (/^\\/(proc|sys|dev)(\\/|$)/.test(path)) return false;\n    return matchesGlobs(path, include, exclude);\n  };\n\n  const changes: FileChange[] = [];\n  const emittedRenameTargets = new Set<string>();\n  for (const { from, to } of renames) {\n    if (!keep(to)) continue;\n    // A later delete of the target supersedes the rename (the tail emits the\n    // delete); otherwise the rename entry already represents the target's final\n    // state, so the tail must NOT also emit a `write` for it (would duplicate).\n    if (state.get(to) === 'delete') continue;\n    changes.push({ op: 'rename', path: to, from, timestamp: now });\n    emittedRenameTargets.add(to);\n  }\n  const tail: FileChange[] = [];\n  for (const [path, op] of state) {\n    if (emittedRenameTargets.has(path)) continue;\n    if (keep(path)) tail.push({ op, path, timestamp: now });\n  }\n  tail.sort((a, b) => {\n    if (a.path < b.path) return -1;\n    if (a.path > b.path) return 1;\n    return 0;\n  });\n  changes.push(...tail);\n  return changes;\n}\n\n// strace prints its own failures to stderr prefixed `strace: `. Anchor on that\n// so a benign command whose output merely contains \"Operation not permitted\" or\n// \"not found\" is not misclassified as a tracer failure.\nconst PTRACE_DENIED =\n  /strace:[^\\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;\nconst STRACE_MISSING = /strace:?\\s+(?:command\\s+)?not found/i;\n\n/**\n * The minimal structural surface {@link selfTestStrace} needs from its host.\n * Deliberately narrower than `DisposableSandbox` so the probe can run anywhere:\n * a remote/docker caller passes its sandbox unchanged (it satisfies this shape\n * structurally), and an in-process caller (e.g. a daemon running as PID 1\n * inside the container) implements just these two methods over\n * `node:child_process` + `node:fs`.\n */\nexport interface StraceHost {\n  executeCommand(\n    command: string,\n  ): Promise<{ exitCode: number; stderr: string }>;\n  readFile(path: string): Promise<string>;\n}\n\n/**\n * One-time probe at sandbox setup. Runs a known create/write/rename sequence\n * under strace and asserts the trace is clean and parseable. Throws\n * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is\n * absent, or the trace is garbled (e.g. amd64 under Rosetta).\n *\n * \"strace works in this sandbox\" is an invariant of the (image + host kernel +\n * seccomp/caps) \u2014 constant across every tool call and chat turn in a given\n * container \u2014 so this is the consumer's once-per-container responsibility (e.g.\n * a daemon boot gate), NOT a per-tool cost. `createBashTool` /\n * `withStraceFileChanges` no longer call it.\n */\nexport async function selfTestStrace(host: StraceHost): Promise<void> {\n  const probeDir = `/tmp/dat-strace-${randomUUID()}`;\n  const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;\n  const q = shellQuote;\n  const sequence =\n    `mkdir -p ${q(probeDir)} && ` +\n    `echo hi > ${q(`${probeDir}/a.txt`)} && ` +\n    `mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && ` +\n    `echo more > ${q(`${probeDir}/c.txt`)}`;\n  const wrapped = buildStraceCommand(sequence, traceFile, '/tmp');\n\n  let result: { exitCode: number; stderr: string } | undefined;\n  let raw = '';\n  try {\n    result = await host.executeCommand(wrapped);\n    raw = await host.readFile(traceFile).catch(() => '');\n\n    const diagnostics = `exit=${result.exitCode}\\nstderr=${result.stderr}\\ntrace[0:600]=${raw.slice(0, 600)}`;\n\n    // Order matters: a ptrace block makes strace error on stderr AND emit no\n    // trace, so check the ptrace signal (stderr only) before the empty-trace\n    // strace-missing check, or a blocked ptrace would be mislabelled.\n    if (PTRACE_DENIED.test(result.stderr)) {\n      throw new StraceUnavailableError('ptrace-blocked', diagnostics);\n    }\n    if (!raw || result.exitCode === 127 || STRACE_MISSING.test(result.stderr)) {\n      throw new StraceUnavailableError('strace-missing', diagnostics);\n    }\n\n    // Scope to the probe dir; the exact-path `traceFile` exclusion drops the\n    // sibling trace file that lives under /tmp alongside it.\n    const changes = parseStraceTrace(raw, {\n      include: [probeDir, `${probeDir}/**`],\n      traceFile,\n    });\n    const hasRealFdPath = raw.includes(`<${probeDir}/`);\n    const hasRename = changes.some(\n      (c) =>\n        c.op === 'rename' &&\n        c.from === `${probeDir}/a.txt` &&\n        c.path === `${probeDir}/b.txt`,\n    );\n    const hasWrite = changes.some((c) => c.op === 'write');\n    const allUnderDir = changes.every(\n      (c) => c.path === probeDir || c.path.startsWith(`${probeDir}/`),\n    );\n    if (!hasRealFdPath || !hasRename || !hasWrite || !allUnderDir) {\n      throw new StraceUnavailableError('trace-unparseable', diagnostics);\n    }\n  } finally {\n    void host\n      .executeCommand(`rm -rf ${q(probeDir)} ${q(traceFile)}`)\n      .catch(() => {});\n  }\n}\n", "/**\n * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded\n * `'` with `'\\''`. Safe for arbitrary content inside `sh -c`.\n *\n * Lives in its own zero-import module so node-builtins-only consumers (e.g. the\n * lean `./sandbox/strace` leaf entry) can use it without dragging in the\n * installer/runtime surface.\n */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n"],
-  "mappings": ";AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;;;ACOf,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;;;ADGA,IAAM,cAAuD;AAAA,EAC3D,kBACE;AAAA,EACF,kBACE;AAAA,EACF,qBACE;AACJ;AAQO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,QAAiC,aAAqB;AAChE;AAAA,MACE,4CAA4C,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AACF;AAEA,IAAM,eAAe;AAWd,SAAS,mBACd,SACA,WACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC;AAEtF;AAYO,SAAS,mBACd,SACA,WACA,UACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC,oCAE7D,WAAW,QAAQ,CAAC,YAC/B,WAAW,SAAS,CAAC,uBACtB,WAAW,SAAS,CAAC;AAGlC;AAOO,SAAS,kBACd,QACA,UACmC;AACnC,QAAM,SAAS;AAAA,EAAK,QAAQ;AAAA;AAC5B,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,MAAI,OAAO,GAAI,QAAO,EAAE,QAAQ,OAAO,GAAG;AAC1C,QAAM,SAAS,OAAO,MAAM,KAAK,OAAO,MAAM;AAC9C,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,IAC1B,OAAO,SAAS,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,IAAI;AAAA,EACnE;AACF;AAMA,IAAM,wBAAwB;AAC9B,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,WAAW,CAAC;AACnE,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,OAAO,CAAC;AAC/D,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,SAAS,CAAC;AACnD,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,WAAW,CAAC;AACxE,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,OAAO,CAAC;AACpE,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBAAoB,oBAAI,IAAI,CAAC,YAAY,WAAW,CAAC;AAU3D,SAAS,YAAY,KAAuB;AAC1C,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,MAAgB,CAAC;AACvB,aAAW,YAAY,IAAI,MAAM,IAAI,GAAG;AACtC,UAAM,OAAO,SAAS,QAAQ;AAC9B,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,KAAK,MAAM,cAAc,IAAI,CAAC,KAAK;AAC/C,QAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,cAAQ,IAAI,KAAK,KAAK,QAAQ,2BAA2B,EAAE,CAAC;AAC5D;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,+BAA+B;AAC1D,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,OAAW,KAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,KAAK,IAAI;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAI,KAAK;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,MAAM,IAAI,IAAI;AAChC,QAAM,aAAa,KAAK,MAAM,8BAA8B;AAC5D,MAAI,YAAY;AACd,WAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,CAAC,GAAG,OAAO,WAAW,CAAC,EAAE;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,CAAC,EAAE;AACvD;AAEA,IAAM,gBAAwC;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,KAAK;AAAA,EACL,MAAM;AACR;AAQA,SAAS,mBAAmB,GAAmB;AAC7C,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,EAAE,UAAU;AAC9B,QAAI,EAAE,CAAC,MAAM,QAAQ,IAAI,IAAI,EAAE,QAAQ;AACrC,YAAM,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,aAAa,IAAI,CAAC;AAC5D,UAAI,OAAO;AACT,cAAM,KAAK,SAAS,OAAO,CAAC,IAAI,GAAI;AACpC,aAAK,IAAI,MAAM;AACf;AAAA,MACF;AACA,YAAM,SAAS,cAAc,EAAE,IAAI,CAAC,CAAC;AACrC,YAAM,KAAK,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC;AACxC,WAAK;AACL;AAAA,IACF;AACA,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,OAAM,KAAK,IAAI;AAAA,QAC3B,YAAW,KAAK,OAAO,KAAK,EAAE,CAAC,GAAG,MAAM,EAAG,OAAM,KAAK,CAAC;AAC5D,SAAK;AAAA,EACP;AACA,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,MAAM;AAC3C;AAEA,SAAS,cAAc,MAAwB;AAC7C,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,IAAI,OAAO,MAAM;AACnC,QAAI,KAAK,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAAA,EACnC;AACA,SAAO;AACT;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,iCAAiC,IAAI,CAAC,KAAK;AAC/D;AAGA,SAAS,OAAO,MAA6B;AAC3C,SAAO,KAAK,MAAM,oBAAoB,IAAI,CAAC,KAAK;AAClD;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,6BAA6B,IAAI,CAAC,KAAK;AAC3D;AAUO,SAAS,aACd,MACA,SACA,SACS;AACT,SACE,QAAQ,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC,KACpD,CAAC,SAAS,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC;AAE1D;AASO,SAAS,iBACd,KACA,SACc;AACd,QAAM,EAAE,SAAS,SAAS,UAAU,UAAU,IAAI;AAClD,QAAM,MAAM,KAAK,IAAI;AAErB,QAAM,QAAQ,oBAAI,IAAgC;AAClD,QAAM,UAA+C,CAAC;AAEtD,QAAM,UAAU,CAAC,KAAa,MAC5B,MAAM,UAAU,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;AAE5D,QAAM,QAAQ,CAAC,SAAiB;AAC9B,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACA,QAAM,SAAS,CAAC,SAAiB;AAC/B,QAAI,MAAM,IAAI,IAAI,MAAM,QAAS,OAAM,OAAO,IAAI;AAAA,QAC7C,OAAM,IAAI,MAAM,QAAQ;AAAA,EAC/B;AAEA,aAAW,QAAQ,YAAY,GAAG,GAAG;AACnC,UAAM,OAAO,UAAU,IAAI;AAC3B,QAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAM;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,UAAM,MAAM,UAAU,IAAI;AAE1B,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,SAAS,EAAG;AACxB,YAAM,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpC,YAAM,KAAK,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC;AACnD,YAAM,OAAO,IAAI;AACjB,cAAQ,KAAK,EAAE,MAAM,GAAG,CAAC;AACzB;AAAA,IACF;AACA,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,QAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC,CAAC;AACnE;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,UAAI,CAAC,sBAAsB,KAAK,UAAU,IAAI,CAAC,EAAG;AAClD,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,IAAI,OAAO,IAAI;AACrB,UAAI,KAAK,OAAO,KAAK,MAAM,IAAI,EAAG,OAAM,MAAM,UAAU,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,OAAO,GAAG;AAClC,YAAM,IAAI,OAAO,IAAI,KAAK,cAAc,IAAI,EAAE,CAAC;AAC/C,UAAI,EAAG,OAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,SAA0B;AACtC,QAAI,aAAa,SAAS,UAAW,QAAO;AAC5C,QAAI,aAAa,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,IAAI;AACtE,aAAO;AAAA,IACT;AACA,QAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO;AACjD,WAAO,aAAa,MAAM,SAAS,OAAO;AAAA,EAC5C;AAEA,QAAM,UAAwB,CAAC;AAC/B,QAAM,uBAAuB,oBAAI,IAAY;AAC7C,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,QAAI,CAAC,KAAK,EAAE,EAAG;AAIf,QAAI,MAAM,IAAI,EAAE,MAAM,SAAU;AAChC,YAAQ,KAAK,EAAE,IAAI,UAAU,MAAM,IAAI,MAAM,WAAW,IAAI,CAAC;AAC7D,yBAAqB,IAAI,EAAE;AAAA,EAC7B;AACA,QAAM,OAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,EAAE,KAAK,OAAO;AAC9B,QAAI,qBAAqB,IAAI,IAAI,EAAG;AACpC,QAAI,KAAK,IAAI,EAAG,MAAK,KAAK,EAAE,IAAI,MAAM,WAAW,IAAI,CAAC;AAAA,EACxD;AACA,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,KAAK,GAAG,IAAI;AACpB,SAAO;AACT;AAKA,IAAM,gBACJ;AACF,IAAM,iBAAiB;AA6BvB,eAAsB,eAAe,MAAiC;AACpE,QAAM,WAAW,mBAAmB,WAAW,CAAC;AAChD,QAAM,YAAY,mBAAmB,WAAW,CAAC;AACjD,QAAM,IAAI;AACV,QAAM,WACJ,YAAY,EAAE,QAAQ,CAAC,iBACV,EAAE,GAAG,QAAQ,QAAQ,CAAC,UAC7B,EAAE,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,QAAQ,CAAC,mBACvC,EAAE,GAAG,QAAQ,QAAQ,CAAC;AACvC,QAAM,UAAU,mBAAmB,UAAU,WAAW,MAAM;AAE9D,MAAI;AACJ,MAAI,MAAM;AACV,MAAI;AACF,aAAS,MAAM,KAAK,eAAe,OAAO;AAC1C,UAAM,MAAM,KAAK,SAAS,SAAS,EAAE,MAAM,MAAM,EAAE;AAEnD,UAAM,cAAc,QAAQ,OAAO,QAAQ;AAAA,SAAY,OAAO,MAAM;AAAA,eAAkB,IAAI,MAAM,GAAG,GAAG,CAAC;AAKvG,QAAI,cAAc,KAAK,OAAO,MAAM,GAAG;AACrC,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AACA,QAAI,CAAC,OAAO,OAAO,aAAa,OAAO,eAAe,KAAK,OAAO,MAAM,GAAG;AACzE,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AAIA,UAAM,UAAU,iBAAiB,KAAK;AAAA,MACpC,SAAS,CAAC,UAAU,GAAG,QAAQ,KAAK;AAAA,MACpC;AAAA,IACF,CAAC;AACD,UAAM,gBAAgB,IAAI,SAAS,IAAI,QAAQ,GAAG;AAClD,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MACC,EAAE,OAAO,YACT,EAAE,SAAS,GAAG,QAAQ,YACtB,EAAE,SAAS,GAAG,QAAQ;AAAA,IAC1B;AACA,UAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACrD,UAAM,cAAc,QAAQ;AAAA,MAC1B,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,IAChE;AACA,QAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC7D,YAAM,IAAI,uBAAuB,qBAAqB,WAAW;AAAA,IACnE;AAAA,EACF,UAAE;AACA,SAAK,KACF,eAAe,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EACtD,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AACF;",
+  "sourcesContent": ["import spawn, { type SubprocessError } from 'nano-spawn';\nimport { randomUUID } from 'node:crypto';\nimport { readFile, rm } from 'node:fs/promises';\nimport { posix } from 'node:path';\n\nimport { shellQuote } from '../shell-quote.ts';\nimport type { FileChange } from './file-change.ts';\n\nexport type { FileChange, FileChangeOp } from './file-change.ts';\n\nexport type StraceUnavailableReason =\n  | 'ptrace-blocked'\n  | 'strace-missing'\n  | 'trace-unparseable';\n\nconst REASON_HINT: Record<StraceUnavailableReason, string> = {\n  'ptrace-blocked':\n    'ptrace is denied by the sandbox runtime. Modern Docker permits it by default; on a hardened host, relax the runtime seccomp/ptrace policy (allow the ptrace syscall, or add the SYS_PTRACE capability).',\n  'strace-missing':\n    'strace is not installed in the sandbox image. Bake `strace` into the image.',\n  'trace-unparseable':\n    'strace ran but its output is unusable \u2014 the sandbox is likely running under emulation (e.g. amd64 via Rosetta). Use a native-architecture sandbox.',\n};\n\n/**\n * Thrown by {@link selfTestStrace} when per-command strace tracking cannot be\n * used. `reason` lets callers branch (fix-image vs fix-caps vs fix-arch). This\n * is a hard failure by design \u2014 there is no silent degrade to the snapshot\n * observer.\n */\nexport class StraceUnavailableError extends Error {\n  readonly reason: StraceUnavailableReason;\n  readonly diagnostics: string;\n\n  constructor(reason: StraceUnavailableReason, diagnostics: string) {\n    super(\n      `strace file-change tracking unavailable (${reason}): ${REASON_HINT[reason]}`,\n    );\n    this.name = 'StraceUnavailableError';\n    this.reason = reason;\n    this.diagnostics = diagnostics;\n  }\n}\n\nconst STRACE_FLAGS = '-f -y -qq -e trace=%file,write,pwrite64,writev';\n\n/**\n * Wraps `command` so its filesystem syscalls are traced to `traceFile`. Both\n * the inner command and this wrapper are re-parsed by a shell (`sh -c`), so the\n * single-quoting via {@link shellQuote} composes with the backend's own\n * `sh -c`. strace propagates the traced command's exit code. The `mkdir -p`\n * runs before strace (so it isn't traced) and self-heals the trace dir per\n * command \u2014 if it ever disappears mid-session, the next command recreates it\n * rather than strace failing to open `-o` and skipping the command entirely.\n */\nexport function buildStraceCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}`\n  );\n}\n\n/**\n * Like {@link buildStraceCommand}, but dumps the (base64) trace inline on stdout\n * after `sentinel`, then exits with the traced command's code. This lets one\n * `executeCommand` round-trip carry both the command output and its trace \u2014 no\n * second `readFile` exec to pull the trace out of the container. Pair with\n * {@link splitTracedOutput}. `sentinel` must be unguessable (a UUID) so the\n * command's own stdout cannot contain it. `base64` keeps the trace stream-safe\n * and its stderr is dropped so a missing trace (strace failed) doesn't leak into\n * the command's stderr.\n */\nexport function buildTracedCommand(\n  command: string,\n  traceFile: string,\n  traceDir: string,\n  sentinel: string,\n): string {\n  return (\n    `mkdir -p ${shellQuote(traceDir)} 2>/dev/null; ` +\n    `strace ${STRACE_FLAGS} -o ${shellQuote(traceFile)} -- sh -c ${shellQuote(command)}; ` +\n    `__dat_rc=$?; ` +\n    `printf '\\\\n%s\\\\n' ${shellQuote(sentinel)}; ` +\n    `base64 ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `rm -f ${shellQuote(traceFile)} 2>/dev/null; ` +\n    `exit $__dat_rc`\n  );\n}\n\n/**\n * Split {@link buildTracedCommand} output into the command's own stdout and its\n * decoded strace trace. A missing sentinel (strace produced nothing) yields an\n * empty trace so the caller degrades to \"no changes\".\n */\nexport function splitTracedOutput(\n  stdout: string,\n  sentinel: string,\n): { stdout: string; trace: string } {\n  const marker = `\\n${sentinel}\\n`;\n  const at = stdout.indexOf(marker);\n  if (at === -1) return { stdout, trace: '' };\n  const base64 = stdout.slice(at + marker.length);\n  return {\n    stdout: stdout.slice(0, at),\n    trace: base64 ? Buffer.from(base64, 'base64').toString('utf8') : '',\n  };\n}\n\n// An open is a definite write only when it creates or truncates. Bare\n// O_WRONLY/O_RDWR/O_APPEND opens are NOT assumed to mutate \u2014 a real write()\n// syscall confirms them \u2014 so read-only-via-O_RDWR (sqlite SELECT, an editor\n// that opens then quits) doesn't produce a phantom `write`.\nconst CREATE_OR_TRUNC_FLAGS = /O_(CREAT|TRUNC)/;\nconst RENAME_SYSCALLS = new Set(['rename', 'renameat', 'renameat2']);\nconst DELETE_SYSCALLS = new Set(['unlink', 'unlinkat', 'rmdir']);\nconst MKDIR_SYSCALLS = new Set(['mkdir', 'mkdirat']);\nconst LINK_SYSCALLS = new Set(['link', 'linkat', 'symlink', 'symlinkat']);\nconst OPEN_SYSCALLS = new Set(['open', 'openat', 'openat2', 'creat']);\nconst WRITE_SYSCALLS = new Set([\n  'write',\n  'pwrite64',\n  'pwrite',\n  'writev',\n  'pwritev2',\n]);\nconst TRUNCATE_SYSCALLS = new Set(['truncate', 'ftruncate']);\n\ninterface ParsedCall {\n  syscall: string;\n  args: string;\n  retval: string;\n  errno?: string;\n}\n\n/** Reassemble `<unfinished \u2026>` / `<\u2026 resumed>` syscall splits per PID. */\nfunction stitchLines(raw: string): string[] {\n  const pending = new Map<string, string>();\n  const out: string[] = [];\n  for (const original of raw.split('\\n')) {\n    const line = original.trimEnd();\n    if (!line) continue;\n    const pid = line.match(/^\\s*(\\d+)\\s+/)?.[1] ?? '0';\n    if (/<unfinished \\.\\.\\.>\\s*$/.test(line)) {\n      pending.set(pid, line.replace(/<unfinished \\.\\.\\.>\\s*$/, ''));\n      continue;\n    }\n    const resumed = line.match(/<\\.\\.\\.\\s+\\S+\\s+resumed>(.*)$/);\n    if (resumed) {\n      const head = pending.get(pid);\n      pending.delete(pid);\n      if (head !== undefined) out.push(head + resumed[1]);\n      continue;\n    }\n    out.push(line);\n  }\n  return out;\n}\n\nfunction parseCall(line: string): ParsedCall | null {\n  const m = line.match(\n    /^\\s*(?:\\d+\\s+)?([a-z_][a-z0-9_]*)\\((.*)\\)\\s*=\\s*(.+?)\\s*$/,\n  );\n  if (!m) return null;\n  const [, syscall, args, rest] = m;\n  const errnoMatch = rest.match(/^(-?\\d+)\\s+([A-Z][A-Z0-9_]*)/);\n  if (errnoMatch) {\n    return { syscall, args, retval: errnoMatch[1], errno: errnoMatch[2] };\n  }\n  return { syscall, args, retval: rest.split(/\\s+/)[0] };\n}\n\nconst STRACE_ESCAPE: Record<string, number> = {\n  n: 0x0a,\n  t: 0x09,\n  r: 0x0d,\n  v: 0x0b,\n  f: 0x0c,\n  '\"': 0x22,\n  '\\\\': 0x5c,\n};\n\n/**\n * Decode one strace-rendered string. strace emits printable ASCII verbatim and\n * non-printable / non-ASCII bytes as octal `\\NNN`, plus a few `\\x` escapes. We\n * reconstruct the raw byte sequence and decode it as UTF-8 so multi-byte\n * filenames (e.g. `caf\u00E9.txt` \u2192 `\\303\\251`) round-trip instead of being mangled.\n */\nfunction decodeStraceString(s: string): string {\n  const bytes: number[] = [];\n  for (let i = 0; i < s.length; ) {\n    if (s[i] === '\\\\' && i + 1 < s.length) {\n      const octal = s.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0];\n      if (octal) {\n        bytes.push(parseInt(octal, 8) & 0xff);\n        i += 1 + octal.length;\n        continue;\n      }\n      const mapped = STRACE_ESCAPE[s[i + 1]];\n      bytes.push(mapped ?? s.charCodeAt(i + 1));\n      i += 2;\n      continue;\n    }\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes.push(code);\n    else for (const b of Buffer.from(s[i], 'utf8')) bytes.push(b);\n    i += 1;\n  }\n  return Buffer.from(bytes).toString('utf8');\n}\n\nfunction quotedStrings(args: string): string[] {\n  const out: string[] = [];\n  const re = /\"((?:[^\"\\\\]|\\\\.)*)\"/g;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(args)) !== null) {\n    out.push(decodeStraceString(m[1]));\n  }\n  return out;\n}\n\n/** Directory path annotated on the leading dirfd (`AT_FDCWD</cwd>` / `7</dir>`). */\nfunction dirfdPath(args: string): string {\n  return args.match(/^\\s*(?:AT_FDCWD|-?\\d+)<([^>]*)>/)?.[1] ?? '/';\n}\n\n/** Path annotated on the leading fd argument (`-y` output), for write syscalls. */\nfunction fdPath(args: string): string | null {\n  return args.match(/^\\s*-?\\d+<([^>]*)>/)?.[1] ?? null;\n}\n\nfunction openFlags(args: string): string {\n  return args.match(/\\bO_[A-Z_]+(?:\\|O_[A-Z_]+)*/)?.[0] ?? '';\n}\n\nexport interface ParseStraceOptions {\n  include: string[];\n  exclude?: string[];\n  traceFile?: string;\n  traceDir?: string;\n}\n\n/** A path is tracked when it matches an `include` glob and no `exclude` glob. */\nexport function matchesGlobs(\n  path: string,\n  include: string[],\n  exclude?: string[],\n): boolean {\n  return (\n    include.some((glob) => posix.matchesGlob(path, glob)) &&\n    !exclude?.some((glob) => posix.matchesGlob(path, glob))\n  );\n}\n\n/**\n * Parse one command's strace output into a coarse `FileChange[]`. Failed\n * syscalls are skipped; paths are filtered to `destination`; the trace file and\n * `/proc`,`/sys`,`/dev` are excluded. Per-path final state collapses repeated\n * writes to one `write`; a path written then deleted within the command is\n * treated as transient and dropped.\n */\nexport function parseStraceTrace(\n  raw: string,\n  options: ParseStraceOptions,\n): FileChange[] {\n  const { include, exclude, traceDir, traceFile } = options;\n  const now = Date.now();\n\n  const state = new Map<string, 'write' | 'delete'>();\n  const renames: Array<{ from: string; to: string }> = [];\n\n  const resolve = (dir: string, p: string): string =>\n    posix.normalize(p.startsWith('/') ? p : posix.join(dir, p));\n\n  const write = (path: string) => {\n    state.set(path, 'write');\n  };\n  const remove = (path: string) => {\n    if (state.get(path) === 'write') state.delete(path);\n    else state.set(path, 'delete');\n  };\n\n  for (const line of stitchLines(raw)) {\n    const call = parseCall(line);\n    if (!call || call.errno || call.retval === '-1') continue;\n    const { syscall, args } = call;\n    const dir = dirfdPath(args);\n\n    if (RENAME_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length < 2) continue;\n      const from = resolve(dir, strings[0]);\n      const to = resolve(dir, strings[strings.length - 1]);\n      state.delete(from);\n      renames.push({ from, to });\n      continue;\n    }\n    if (DELETE_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) remove(resolve(dir, strings[0]));\n      continue;\n    }\n    if (MKDIR_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (LINK_SYSCALLS.has(syscall)) {\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[strings.length - 1]));\n      continue;\n    }\n    if (OPEN_SYSCALLS.has(syscall)) {\n      if (!CREATE_OR_TRUNC_FLAGS.test(openFlags(args))) continue;\n      const strings = quotedStrings(args);\n      if (strings.length) write(resolve(dir, strings[0]));\n      continue;\n    }\n    if (WRITE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args);\n      if (p && Number(call.retval) > 0) write(posix.normalize(p));\n      continue;\n    }\n    if (TRUNCATE_SYSCALLS.has(syscall)) {\n      const p = fdPath(args) ?? quotedStrings(args)[0];\n      if (p) write(resolve(dir, p));\n    }\n  }\n\n  const keep = (path: string): boolean => {\n    if (traceFile && path === traceFile) return false;\n    if (traceDir && (path === traceDir || path.startsWith(`${traceDir}/`))) {\n      return false;\n    }\n    if (/^\\/(proc|sys|dev)(\\/|$)/.test(path)) return false;\n    return matchesGlobs(path, include, exclude);\n  };\n\n  const changes: FileChange[] = [];\n  const emittedRenameTargets = new Set<string>();\n  for (const { from, to } of renames) {\n    if (!keep(to)) continue;\n    // A later delete of the target supersedes the rename (the tail emits the\n    // delete); otherwise the rename entry already represents the target's final\n    // state, so the tail must NOT also emit a `write` for it (would duplicate).\n    if (state.get(to) === 'delete') continue;\n    changes.push({ op: 'rename', path: to, from, timestamp: now });\n    emittedRenameTargets.add(to);\n  }\n  const tail: FileChange[] = [];\n  for (const [path, op] of state) {\n    if (emittedRenameTargets.has(path)) continue;\n    if (keep(path)) tail.push({ op, path, timestamp: now });\n  }\n  tail.sort((a, b) => {\n    if (a.path < b.path) return -1;\n    if (a.path > b.path) return 1;\n    return 0;\n  });\n  changes.push(...tail);\n  return changes;\n}\n\n// strace prints its own failures to stderr prefixed `strace: `. Anchor on that\n// so a benign command whose output merely contains \"Operation not permitted\" or\n// \"not found\" is not misclassified as a tracer failure.\nconst PTRACE_DENIED =\n  /strace:[^\\n]*(?:PTRACE_TRACEME|ptrace|Operation not permitted|EPERM)/i;\nconst STRACE_MISSING = /strace:?\\s+(?:command\\s+)?not found/i;\n\n/**\n * Run `command` on the host via `sh -c`, flattening nano-spawn's\n * throw-on-nonzero contract into `{ exitCode, stderr }`. The probe must read\n * both even on failure \u2014 a missing strace exits 127, a blocked ptrace exits\n * non-zero with its diagnosis on stderr \u2014 which nano-spawn surfaces by rejecting\n * with a {@link SubprocessError} (its `exitCode` is undefined only when the\n * process never started or a signal killed it, hence the `?? 1`).\n */\nasync function runOnHost(\n  command: string,\n): Promise<{ exitCode: number; stderr: string }> {\n  try {\n    const { stderr } = await spawn('sh', ['-c', command]);\n    return { exitCode: 0, stderr };\n  } catch (error) {\n    const e = error as SubprocessError;\n    return { exitCode: e.exitCode ?? 1, stderr: e.stderr };\n  }\n}\n\n/**\n * One-time probe at sandbox setup. Runs a known create/write/rename sequence\n * under strace on the host and asserts the trace is clean and parseable. Throws\n * {@link StraceUnavailableError} (hard-fail) when ptrace is blocked, strace is\n * absent, or the trace is garbled (e.g. amd64 under Rosetta).\n *\n * \"strace works here\" is an invariant of the (image + host kernel + seccomp/caps)\n * \u2014 constant across every tool call and chat turn in a given container \u2014 so this\n * is the consumer's once-per-container responsibility (e.g. a daemon boot gate\n * running as PID 1 inside the container), NOT a per-tool cost. `createBashTool` /\n * `withStraceFileChanges` no longer call it.\n */\nexport async function selfTestStrace(): Promise<void> {\n  const probeDir = `/tmp/dat-strace-${randomUUID()}`;\n  const traceFile = `/tmp/dat-strace-${randomUUID()}.trace`;\n  const q = shellQuote;\n  const sequence =\n    `mkdir -p ${q(probeDir)} && ` +\n    `echo hi > ${q(`${probeDir}/a.txt`)} && ` +\n    `mv ${q(`${probeDir}/a.txt`)} ${q(`${probeDir}/b.txt`)} && ` +\n    `echo more > ${q(`${probeDir}/c.txt`)}`;\n  const wrapped = buildStraceCommand(sequence, traceFile, '/tmp');\n\n  try {\n    const result = await runOnHost(wrapped);\n    const raw = await readFile(traceFile, 'utf8').catch(() => '');\n\n    const diagnostics = `exit=${result.exitCode}\\nstderr=${result.stderr}\\ntrace[0:600]=${raw.slice(0, 600)}`;\n\n    // Order matters: a ptrace block makes strace error on stderr AND emit no\n    // trace, so check the ptrace signal (stderr only) before the empty-trace\n    // strace-missing check, or a blocked ptrace would be mislabelled.\n    if (PTRACE_DENIED.test(result.stderr)) {\n      throw new StraceUnavailableError('ptrace-blocked', diagnostics);\n    }\n    if (!raw || result.exitCode === 127 || STRACE_MISSING.test(result.stderr)) {\n      throw new StraceUnavailableError('strace-missing', diagnostics);\n    }\n\n    // Scope to the probe dir; the exact-path `traceFile` exclusion drops the\n    // sibling trace file that lives under /tmp alongside it.\n    const changes = parseStraceTrace(raw, {\n      include: [probeDir, `${probeDir}/**`],\n      traceFile,\n    });\n    const hasRealFdPath = raw.includes(`<${probeDir}/`);\n    const hasRename = changes.some(\n      (c) =>\n        c.op === 'rename' &&\n        c.from === `${probeDir}/a.txt` &&\n        c.path === `${probeDir}/b.txt`,\n    );\n    const hasWrite = changes.some((c) => c.op === 'write');\n    const allUnderDir = changes.every(\n      (c) => c.path === probeDir || c.path.startsWith(`${probeDir}/`),\n    );\n    if (!hasRealFdPath || !hasRename || !hasWrite || !allUnderDir) {\n      throw new StraceUnavailableError('trace-unparseable', diagnostics);\n    }\n  } finally {\n    await Promise.allSettled([\n      rm(probeDir, { recursive: true, force: true }),\n      rm(traceFile, { force: true }),\n    ]);\n  }\n}\n", "/**\n * POSIX shell single-quote escape: wrap in `'...'`, replace any embedded\n * `'` with `'\\''`. Safe for arbitrary content inside `sh -c`.\n *\n * Lives in its own zero-import module so lean consumers such as the\n * `./sandbox/strace` leaf entry can use it without dragging in the\n * installer/runtime surface.\n */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n"],
+  "mappings": ";AAAA,OAAO,WAAqC;AAC5C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,UAAU;AAC7B,SAAS,aAAa;;;ACKf,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;;;ADKA,IAAM,cAAuD;AAAA,EAC3D,kBACE;AAAA,EACF,kBACE;AAAA,EACF,qBACE;AACJ;AAQO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,QAAiC,aAAqB;AAChE;AAAA,MACE,4CAA4C,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AACF;AAEA,IAAM,eAAe;AAWd,SAAS,mBACd,SACA,WACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC;AAEtF;AAYO,SAAS,mBACd,SACA,WACA,UACA,UACQ;AACR,SACE,YAAY,WAAW,QAAQ,CAAC,wBACtB,YAAY,OAAO,WAAW,SAAS,CAAC,aAAa,WAAW,OAAO,CAAC,oCAE7D,WAAW,QAAQ,CAAC,YAC/B,WAAW,SAAS,CAAC,uBACtB,WAAW,SAAS,CAAC;AAGlC;AAOO,SAAS,kBACd,QACA,UACmC;AACnC,QAAM,SAAS;AAAA,EAAK,QAAQ;AAAA;AAC5B,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,MAAI,OAAO,GAAI,QAAO,EAAE,QAAQ,OAAO,GAAG;AAC1C,QAAM,SAAS,OAAO,MAAM,KAAK,OAAO,MAAM;AAC9C,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,IAC1B,OAAO,SAAS,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,IAAI;AAAA,EACnE;AACF;AAMA,IAAM,wBAAwB;AAC9B,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,WAAW,CAAC;AACnE,IAAM,kBAAkB,oBAAI,IAAI,CAAC,UAAU,YAAY,OAAO,CAAC;AAC/D,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,SAAS,CAAC;AACnD,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,WAAW,CAAC;AACxE,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,UAAU,WAAW,OAAO,CAAC;AACpE,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBAAoB,oBAAI,IAAI,CAAC,YAAY,WAAW,CAAC;AAU3D,SAAS,YAAY,KAAuB;AAC1C,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,MAAgB,CAAC;AACvB,aAAW,YAAY,IAAI,MAAM,IAAI,GAAG;AACtC,UAAM,OAAO,SAAS,QAAQ;AAC9B,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,KAAK,MAAM,cAAc,IAAI,CAAC,KAAK;AAC/C,QAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,cAAQ,IAAI,KAAK,KAAK,QAAQ,2BAA2B,EAAE,CAAC;AAC5D;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,+BAA+B;AAC1D,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,OAAW,KAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,KAAK,IAAI;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAI,KAAK;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,MAAM,IAAI,IAAI;AAChC,QAAM,aAAa,KAAK,MAAM,8BAA8B;AAC5D,MAAI,YAAY;AACd,WAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,CAAC,GAAG,OAAO,WAAW,CAAC,EAAE;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,CAAC,EAAE;AACvD;AAEA,IAAM,gBAAwC;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,KAAK;AAAA,EACL,MAAM;AACR;AAQA,SAAS,mBAAmB,GAAmB;AAC7C,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,EAAE,UAAU;AAC9B,QAAI,EAAE,CAAC,MAAM,QAAQ,IAAI,IAAI,EAAE,QAAQ;AACrC,YAAM,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,aAAa,IAAI,CAAC;AAC5D,UAAI,OAAO;AACT,cAAM,KAAK,SAAS,OAAO,CAAC,IAAI,GAAI;AACpC,aAAK,IAAI,MAAM;AACf;AAAA,MACF;AACA,YAAM,SAAS,cAAc,EAAE,IAAI,CAAC,CAAC;AACrC,YAAM,KAAK,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC;AACxC,WAAK;AACL;AAAA,IACF;AACA,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,OAAM,KAAK,IAAI;AAAA,QAC3B,YAAW,KAAK,OAAO,KAAK,EAAE,CAAC,GAAG,MAAM,EAAG,OAAM,KAAK,CAAC;AAC5D,SAAK;AAAA,EACP;AACA,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,MAAM;AAC3C;AAEA,SAAS,cAAc,MAAwB;AAC7C,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,IAAI,OAAO,MAAM;AACnC,QAAI,KAAK,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAAA,EACnC;AACA,SAAO;AACT;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,iCAAiC,IAAI,CAAC,KAAK;AAC/D;AAGA,SAAS,OAAO,MAA6B;AAC3C,SAAO,KAAK,MAAM,oBAAoB,IAAI,CAAC,KAAK;AAClD;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,MAAM,6BAA6B,IAAI,CAAC,KAAK;AAC3D;AAUO,SAAS,aACd,MACA,SACA,SACS;AACT,SACE,QAAQ,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC,KACpD,CAAC,SAAS,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,IAAI,CAAC;AAE1D;AASO,SAAS,iBACd,KACA,SACc;AACd,QAAM,EAAE,SAAS,SAAS,UAAU,UAAU,IAAI;AAClD,QAAM,MAAM,KAAK,IAAI;AAErB,QAAM,QAAQ,oBAAI,IAAgC;AAClD,QAAM,UAA+C,CAAC;AAEtD,QAAM,UAAU,CAAC,KAAa,MAC5B,MAAM,UAAU,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;AAE5D,QAAM,QAAQ,CAAC,SAAiB;AAC9B,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACA,QAAM,SAAS,CAAC,SAAiB;AAC/B,QAAI,MAAM,IAAI,IAAI,MAAM,QAAS,OAAM,OAAO,IAAI;AAAA,QAC7C,OAAM,IAAI,MAAM,QAAQ;AAAA,EAC/B;AAEA,aAAW,QAAQ,YAAY,GAAG,GAAG;AACnC,UAAM,OAAO,UAAU,IAAI;AAC3B,QAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAM;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,UAAM,MAAM,UAAU,IAAI;AAE1B,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,SAAS,EAAG;AACxB,YAAM,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpC,YAAM,KAAK,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC;AACnD,YAAM,OAAO,IAAI;AACjB,cAAQ,KAAK,EAAE,MAAM,GAAG,CAAC;AACzB;AAAA,IACF;AACA,QAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,QAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,QAAQ,SAAS,CAAC,CAAC,CAAC;AACnE;AAAA,IACF;AACA,QAAI,cAAc,IAAI,OAAO,GAAG;AAC9B,UAAI,CAAC,sBAAsB,KAAK,UAAU,IAAI,CAAC,EAAG;AAClD,YAAM,UAAU,cAAc,IAAI;AAClC,UAAI,QAAQ,OAAQ,OAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC;AAClD;AAAA,IACF;AACA,QAAI,eAAe,IAAI,OAAO,GAAG;AAC/B,YAAM,IAAI,OAAO,IAAI;AACrB,UAAI,KAAK,OAAO,KAAK,MAAM,IAAI,EAAG,OAAM,MAAM,UAAU,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,OAAO,GAAG;AAClC,YAAM,IAAI,OAAO,IAAI,KAAK,cAAc,IAAI,EAAE,CAAC;AAC/C,UAAI,EAAG,OAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,SAA0B;AACtC,QAAI,aAAa,SAAS,UAAW,QAAO;AAC5C,QAAI,aAAa,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,IAAI;AACtE,aAAO;AAAA,IACT;AACA,QAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO;AACjD,WAAO,aAAa,MAAM,SAAS,OAAO;AAAA,EAC5C;AAEA,QAAM,UAAwB,CAAC;AAC/B,QAAM,uBAAuB,oBAAI,IAAY;AAC7C,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,QAAI,CAAC,KAAK,EAAE,EAAG;AAIf,QAAI,MAAM,IAAI,EAAE,MAAM,SAAU;AAChC,YAAQ,KAAK,EAAE,IAAI,UAAU,MAAM,IAAI,MAAM,WAAW,IAAI,CAAC;AAC7D,yBAAqB,IAAI,EAAE;AAAA,EAC7B;AACA,QAAM,OAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,EAAE,KAAK,OAAO;AAC9B,QAAI,qBAAqB,IAAI,IAAI,EAAG;AACpC,QAAI,KAAK,IAAI,EAAG,MAAK,KAAK,EAAE,IAAI,MAAM,WAAW,IAAI,CAAC;AAAA,EACxD;AACA,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,KAAK,GAAG,IAAI;AACpB,SAAO;AACT;AAKA,IAAM,gBACJ;AACF,IAAM,iBAAiB;AAUvB,eAAe,UACb,SAC+C;AAC/C,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,MAAM,MAAM,CAAC,MAAM,OAAO,CAAC;AACpD,WAAO,EAAE,UAAU,GAAG,OAAO;AAAA,EAC/B,SAAS,OAAO;AACd,UAAM,IAAI;AACV,WAAO,EAAE,UAAU,EAAE,YAAY,GAAG,QAAQ,EAAE,OAAO;AAAA,EACvD;AACF;AAcA,eAAsB,iBAAgC;AACpD,QAAM,WAAW,mBAAmB,WAAW,CAAC;AAChD,QAAM,YAAY,mBAAmB,WAAW,CAAC;AACjD,QAAM,IAAI;AACV,QAAM,WACJ,YAAY,EAAE,QAAQ,CAAC,iBACV,EAAE,GAAG,QAAQ,QAAQ,CAAC,UAC7B,EAAE,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,QAAQ,CAAC,mBACvC,EAAE,GAAG,QAAQ,QAAQ,CAAC;AACvC,QAAM,UAAU,mBAAmB,UAAU,WAAW,MAAM;AAE9D,MAAI;AACF,UAAM,SAAS,MAAM,UAAU,OAAO;AACtC,UAAM,MAAM,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE;AAE5D,UAAM,cAAc,QAAQ,OAAO,QAAQ;AAAA,SAAY,OAAO,MAAM;AAAA,eAAkB,IAAI,MAAM,GAAG,GAAG,CAAC;AAKvG,QAAI,cAAc,KAAK,OAAO,MAAM,GAAG;AACrC,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AACA,QAAI,CAAC,OAAO,OAAO,aAAa,OAAO,eAAe,KAAK,OAAO,MAAM,GAAG;AACzE,YAAM,IAAI,uBAAuB,kBAAkB,WAAW;AAAA,IAChE;AAIA,UAAM,UAAU,iBAAiB,KAAK;AAAA,MACpC,SAAS,CAAC,UAAU,GAAG,QAAQ,KAAK;AAAA,MACpC;AAAA,IACF,CAAC;AACD,UAAM,gBAAgB,IAAI,SAAS,IAAI,QAAQ,GAAG;AAClD,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MACC,EAAE,OAAO,YACT,EAAE,SAAS,GAAG,QAAQ,YACtB,EAAE,SAAS,GAAG,QAAQ;AAAA,IAC1B;AACA,UAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACrD,UAAM,cAAc,QAAQ;AAAA,MAC1B,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,IAChE;AACA,QAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC7D,YAAM,IAAI,uBAAuB,qBAAqB,WAAW;AAAA,IACnE;AAAA,EACF,UAAE;AACA,UAAM,QAAQ,WAAW;AAAA,MACvB,GAAG,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MAC7C,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/lib/sandbox/types.d.ts

@@ -35,9 +35,9 @@ export interface SandboxProcess {
  * no-op `dispose()`.
  *
  * `spawn` is optional: only backends that can honestly expose unbuffered
- * stdio (e.g. docker-sandbox) implement it. Callers feature-detect with
- * `if (!sandbox.spawn) ...` — no silent fallback that aggregates output
- * and flushes on completion.
+ * stdio (e.g. Docker or Apple Container sandboxes) implement it. Callers
+ * feature-detect with `if (!sandbox.spawn) ...` — no silent fallback that
+ * aggregates output and flushes on completion.
  */
 export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand'>, AsyncDisposable {
     executeCommand(command: string, options?: ExecuteCommandOptions): Promise<CommandResult>;
@@ -49,6 +49,25 @@ export interface DisposableSandbox extends Omit<UpstreamSandbox, 'executeCommand
      */
     dispose(): Promise<void>;
 }
+/**
+ * Readiness option accepted by every sandbox factory. Readiness is workload
+ * policy supplied by the caller — the hook runs once after boot and gates the
+ * factory's return; on failure the sandbox is disposed and the error
+ * propagates, so callers either receive a sandbox that satisfies their
+ * readiness condition or no sandbox at all. Recurring health monitoring stays
+ * the caller's responsibility.
+ *
+ * @example
+ * ```typescript
+ * const sandbox = await createMicrosandboxSandbox({
+ *   name: 'demo',
+ *   readiness: (sandbox) => startDaemon(sandbox),
+ * });
+ * ```
+ */
+export interface SandboxReadinessOptions {
+    readiness?: (sandbox: DisposableSandbox) => void | Promise<void>;
+}
 /**
  * Declarative skill upload: a host directory whose contents are copied into
  * the sandbox at startup. The factory also parses each skill's frontmatter

package/dist/lib/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,eAAe;IAChE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,OAAO,IAAI,eAAe,EAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,eAAe;IAChE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAChE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,WAAW,EACX,MAAM,GAAG,OAAO,GAAG,SAAS,CAC7B;IACC,+DAA+D;IAC/D,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACtE,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}

package/dist/lib/sandbox/virtual-sandbox.d.ts

@@ -1,6 +1,6 @@
 import { type CustomCommand, type IFileSystem } from 'just-bash';
-import type { DisposableSandbox } from './types.ts';
-export interface CreateVirtualSandboxOptions {
+import type { DisposableSandbox, SandboxReadinessOptions } from './types.ts';
+export interface CreateVirtualSandboxOptions extends SandboxReadinessOptions {
     fs: IFileSystem;
     cwd?: string;
     env?: Record<string, string>;

package/dist/lib/sandbox/virtual-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA0C5B"}
+{"version":3,"file":"virtual-sandbox.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/virtual-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE7E,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAoD5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepagents/context",
-  "version": "4.0.0",
+  "version": "4.2.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -47,10 +47,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@ai-sdk/groq": "^3.0.36",
-    "@ai-sdk/provider": "^3.0.10",
-    "@deepagents/agent": "4.0.0",
-    "ai": "^6.0.174",
+    "@ai-sdk/groq": "^3.0.47",
+    "@ai-sdk/provider": "^3.0.13",
+    "@deepagents/agent": "4.2.0",
+    "ai": "^6.0.218",
     "bash-tool": "^1.3.16",
     "chalk": "^5.6.0",
     "dedent": "^1.7.0",
@@ -61,20 +61,23 @@
     "stringcase": "^4.3.1",
     "tiny-tfidf": "^1.0.0",
     "yaml": "^2.8.0",
-    "zod": "^3.25.76 || ^4.0.0"
+    "zod": "^3.25.76 || ^4.0.0",
+    "@ai-sdk/openai": "^3.0.80",
+    "@deepagents/test": "0.15.0"
   },
   "devDependencies": {
     "@daytona/sdk": "^0.175.0",
     "@types/debug": "^4.1.12",
     "@types/mssql": "^12.3.0",
     "@types/pg": "^8.20.0",
-    "nock": "^14.0.14",
-    "pg-boss": "^12.18.2"
+    "microsandbox": "^0.6.4",
+    "nock": "^14.0.14"
   },
   "peerDependencies": {
     "@daytona/sdk": "^0.175.0",
     "@rivet-dev/agent-os-common": "^0.0.260331072558",
     "@rivet-dev/agent-os-core": ">=0.1.0",
+    "microsandbox": "^0.6.4",
     "mssql": "^12.5.2",
     "pg": "^8.20.0"
   },
@@ -82,6 +85,9 @@
     "@daytona/sdk": {
       "optional": true
     },
+    "microsandbox": {
+      "optional": true
+    },
     "mssql": {
       "optional": true
     },