@dynamicagents/plugins 0.14.0 → 0.15.0

package/dist/claude-code/placeholder.d.ts

@@ -0,0 +1,12 @@
+/**
+ * What the container is given instead of a credential.
+ *
+ * Claude Code does not validate it locally: a run with this exact value
+ * succeeds, and the container only ever sends the placeholder. The egress
+ * gateway swaps in the real credential on the way out, so a `postinstall` script
+ * that dumps the environment learns this and nothing else.
+ *
+ * Shaped like a real token deliberately: something that looks obviously fake
+ * invites a future reader to "fix" it by putting the real one there.
+ */
+export declare const CREDENTIAL_PLACEHOLDER: string;

package/dist/claude-code/placeholder.js

@@ -0,0 +1,12 @@
+/**
+ * What the container is given instead of a credential.
+ *
+ * Claude Code does not validate it locally: a run with this exact value
+ * succeeds, and the container only ever sends the placeholder. The egress
+ * gateway swaps in the real credential on the way out, so a `postinstall` script
+ * that dumps the environment learns this and nothing else.
+ *
+ * Shaped like a real token deliberately: something that looks obviously fake
+ * invites a future reader to "fix" it by putting the real one there.
+ */
+export const CREDENTIAL_PLACEHOLDER = "sk-ant-oat01-" + "0".repeat(24);

package/dist/claude-code/spec.d.ts

@@ -4,13 +4,13 @@ import { z } from "zod";
  * The Claude Code writer, as data: what the parent's model is offered. The host
  * binds it to a `SubAgent` class whose model is
  * {@link file://./model.ts claudeCodeModel}, and adds the `prepare` and
- * `settle` that claim and release its workspace. A planner is the same spec
+ * `settle` that claim and release its sandbox. A planner is the same spec
  * under another name, description and input, whose model runs under `plan` —
- * see {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+ * see `./model.ts` `ClaudeCodeModelOptions.permissionMode`.
  *
  * A module of its own for its `zod` schemas. `zod` costs a Worker bundle
- * ~460 KiB, and the workspace Durable Object imports this subpath for its
- * egress gateway alone; with `sideEffects: false`, a module nothing it uses
+ * ~460 KiB, and a sandbox Durable Object imports this subpath for its egress
+ * rule and credential pool alone; with `sideEffects: false`, a module nothing it uses
  * reaches is dropped from that bundle whole.
  *
  * It runs **detached**: a session runs for up to its `timeoutMs`, past the

package/dist/claude-code/spec.js

@@ -3,13 +3,13 @@ import { z } from "zod";
  * The Claude Code writer, as data: what the parent's model is offered. The host
  * binds it to a `SubAgent` class whose model is
  * {@link file://./model.ts claudeCodeModel}, and adds the `prepare` and
- * `settle` that claim and release its workspace. A planner is the same spec
+ * `settle` that claim and release its sandbox. A planner is the same spec
  * under another name, description and input, whose model runs under `plan` —
- * see {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+ * see `./model.ts` `ClaudeCodeModelOptions.permissionMode`.
  *
  * A module of its own for its `zod` schemas. `zod` costs a Worker bundle
- * ~460 KiB, and the workspace Durable Object imports this subpath for its
- * egress gateway alone; with `sideEffects: false`, a module nothing it uses
+ * ~460 KiB, and a sandbox Durable Object imports this subpath for its egress
+ * rule and credential pool alone; with `sideEffects: false`, a module nothing it uses
  * reaches is dropped from that bundle whole.
  *
  * It runs **detached**: a session runs for up to its `timeoutMs`, past the

package/dist/computer/client.d.ts

@@ -0,0 +1,88 @@
+/**
+ * What the computer tools use of where they run: a filesystem and a shell.
+ * A sandbox's is built by `./sandbox.ts`; the tools are written against this,
+ * so no RPC type reaches them.
+ */
+export interface GrepMatch {
+    path: string;
+    line: number;
+    text: string;
+    context?: {
+        line: number;
+        text: string;
+        isMatch: boolean;
+    }[];
+}
+export interface GrepOptions {
+    ignoreCase?: boolean;
+    regex?: boolean;
+    context?: number;
+    limit?: number;
+    offset?: number;
+    include?: string;
+    exclude?: string[];
+}
+export interface FoundEntry {
+    path: string;
+    type: "file" | "dir";
+}
+export interface StatResult {
+    size: number;
+    mtime: number;
+    isFile: boolean;
+    isDirectory: boolean;
+    isSymbolicLink: boolean;
+}
+export interface DirEntry {
+    name: string;
+    size?: number;
+    mtime?: number;
+    isFile: boolean;
+    isDirectory: boolean;
+}
+export interface ComputerFs {
+    readFile(path: string): Promise<ReadableStream<Uint8Array>>;
+    readFile(path: string, encoding: "utf8"): Promise<string>;
+    stat(path: string): Promise<StatResult>;
+    readdir(path: string, options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<DirEntry[]>;
+    find(directory: string, pattern?: string, options?: {
+        limit?: number;
+        offset?: number;
+        exclude?: string[];
+    }): Promise<FoundEntry[]>;
+    grep(pattern: string, path: string, options?: GrepOptions): Promise<GrepMatch[]>;
+    writeFile(path: string, content: string): Promise<void>;
+    mkdir(path: string, options?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    rm(path: string, options?: {
+        recursive?: boolean;
+        force?: boolean;
+    }): Promise<void>;
+}
+export interface CommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    /** Anything but `completed` is said on the verdict line — see `./render.ts`. */
+    status?: "completed" | "failed" | "cancelled";
+}
+export interface CommandHandle extends Disposable {
+    result(): Promise<CommandResult>;
+    kill(signal?: "SIGTERM"): Promise<void>;
+}
+export interface ComputerRuntime {
+    exec(command: string, options: {
+        cwd: string;
+        encoding: "utf8";
+        timeoutMs: number;
+        env?: Record<string, string>;
+    }): Promise<CommandHandle>;
+}
+export interface ComputerClient extends Disposable {
+    readonly fs: ComputerFs;
+    readonly runtime: ComputerRuntime;
+}

package/dist/computer/client.js

@@ -0,0 +1,6 @@
+/**
+ * What the computer tools use of where they run: a filesystem and a shell.
+ * A sandbox's is built by `./sandbox.ts`; the tools are written against this,
+ * so no RPC type reaches them.
+ */
+export {};

package/dist/computer/context.d.ts

@@ -1,19 +1,19 @@
-import type { WorkspaceClient } from "@cloudflare/computer";
+import type { SandboxAdvisory } from "../sandbox/advisory.js";
+import type { ComputerClient } from "./client.js";
 import { type ExecGate } from "./gate.js";
-import type { WorkspaceAdvisory } from "../workspace/advisory.js";
-import type { ComputerConfig } from "./index.js";
+import type { ComputerToolsConfig } from "./index.js";
 /** What {@link computerContext} hands each group of tools. */
 export interface ComputerContext {
-    config: ComputerConfig;
+    config: ComputerToolsConfig;
     cwd: string;
     timeoutMs: number;
     maxChars: number;
-    workspace: () => Promise<WorkspaceClient>;
+    workspace: () => Promise<ComputerClient>;
     awaitAdvisories: (command: string, signal?: AbortSignal) => Promise<ExecGate>;
     definedEnv: () => Record<string, string> | undefined;
-    inWorkspace: (gerund: string, subject: string, body: (fs: WorkspaceClient["fs"]) => Promise<string>) => Promise<string>;
+    inWorkspace: (gerund: string, subject: string, body: (fs: ComputerClient["fs"]) => Promise<string>) => Promise<string>;
     refuseWrite: () => Promise<string | undefined>;
     scope: () => string;
 }
 /** Takes what {@link file://./index.ts buildComputerTools} takes. */
-export declare function computerContext(workspace: () => Promise<WorkspaceClient>, config: ComputerConfig, advisories?: () => Promise<readonly WorkspaceAdvisory[]>, fsWorkspace?: () => Promise<WorkspaceClient>, lockScope?: () => string): ComputerContext;
+export declare function computerContext(workspace: () => Promise<ComputerClient>, config: ComputerToolsConfig, advisories?: () => Promise<readonly SandboxAdvisory[]>, lockScope?: () => string): ComputerContext;

package/dist/computer/context.js

@@ -50,8 +50,9 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-import { DEFAULT_CWD, DEFAULT_TIMEOUT_MS } from "../workspace/exec.js";
 import { withAbort } from "@dynamicagents/core";
+import { DEFAULT_EXEC_TIMEOUT_MS } from "../sandbox/exec.js";
+import { SANDBOX_ROOT } from "../sandbox/header.js";
 import { execGate, writeGate } from "./gate.js";
 /**
  * The machinery every container tool closes over: the resolved config, the
@@ -76,9 +77,9 @@ const DEFAULT_MAX_OUTPUT_CHARS = 16_000;
  */
 const INSTALL_POLL_MS = 3_000;
 /** Takes what {@link file://./index.ts buildComputerTools} takes. */
-export function computerContext(workspace, config, advisories, fsWorkspace = workspace, lockScope) {
-    const cwd = config.cwd ?? DEFAULT_CWD;
-    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+export function computerContext(workspace, config, advisories, lockScope) {
+    const cwd = config.cwd ?? SANDBOX_ROOT;
+    const timeoutMs = config.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
     const maxChars = config.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
     const gateMs = config.installGateMs ?? 90_000;
     const env = config.env;
@@ -92,11 +93,9 @@ export function computerContext(workspace, config, advisories, fsWorkspace = wor
      *
      * **Read for every command, including the ones that need no dependencies.**
      * The filter that spares `cat README.md` from queueing behind an `npm ci`
-     * lives in `execGate`, where it applies per advisory — because a dependency
-     * install and a full workspace are not relevant to the same commands, and one
-     * filter over both leaves a workspace at its ceiling silent for exactly the
-     * commands whose writes it is dropping. The cost is one same-colo RPC per
-     * command, against a class of silent data loss.
+     * lives in `execGate`, where it applies per advisory, so an advisory that
+     * reaches every command is never filtered out by the one that does not. The
+     * cost is one same-colo RPC per command.
      */
     const awaitAdvisories = async (command, signal) => {
         if (!advisories)
@@ -142,8 +141,8 @@ export function computerContext(workspace, config, advisories, fsWorkspace = wor
      *
      * Separate from {@link awaitAdvisories} because the question is different:
      * there is no command to classify and nothing worth waiting for. An install in
-     * flight does not stop a file being written, and the one thing that does —
-     * a workspace that no longer accepts writes — never resolves on its own.
+     * flight does not stop a file being written; only an advisory whose writes do
+     * not persist does, and that never resolves on its own.
      *
      * Fails **open** for the same reason the exec gate does: a read of another
      * Durable Object's state must not take out a working tool.
@@ -181,18 +180,15 @@ export function computerContext(workspace, config, advisories, fsWorkspace = wor
      * only recover from what it is told, so this returns the sentence rather than
      * throwing it.
      *
-     * `bash` deliberately does not use it. That one recognises `EEXEC_LOST`,
-     * logs, and carries an install warning through the failure path — a bespoke
-     * catch saying something this cannot.
-     *
-     * It opens through `fsWorkspace`, which is what makes the context block's
-     * sentence about these tools true: they answer while the container is down.
+     * `bash` deliberately does not use it: it logs, and carries an install
+     * warning through the failure path — a bespoke catch saying something this
+     * cannot.
      */
     const inWorkspace = async (gerund, subject, body) => {
         try {
             const env_1 = { stack: [], error: void 0, hasError: false };
             try {
-                const ws = __addDisposableResource(env_1, await fsWorkspace(), false);
+                const ws = __addDisposableResource(env_1, await workspace(), false);
                 return await body(ws.fs);
             }
             catch (e_1) {

package/dist/computer/gate.d.ts

@@ -1,32 +1,13 @@
-import { type WorkspaceAdvisory } from "../workspace/advisory.js";
+import { type SandboxAdvisory } from "../sandbox/advisory.js";
 /**
  * What one shell command has to wait for, and what to say when it never ran.
  *
- * {@link file://../workspace/advisory.ts} decides what is true about the workspace and how
+ * {@link file://../sandbox/advisory.ts} decides what is true about the sandbox and how
  * to word it; this file decides what that means for a command about to run.
  * {@link needsDependencies} is the part that cannot move there — it is a
  * question about the *command*, and it is what stops `cat README.md` queueing
  * behind an `npm ci` it has no use for.
- *
- * {@link execLostNote} covers a failure with no advisory behind it: a container
- * replaced underneath a command that was running.
- */
-/**
- * The one `bash` failure that is not the command's fault.
- *
- * An execution running when the container is replaced throws `EEXEC_LOST`.
- * Unexplained, the model receives `Execution "…" was lost when its container
- * runtime was replaced`, reads it as a crash, and goes looking at its command.
- *
- * What it needs is two facts: nothing ran to completion, and the workspace
- * survived because the filesystem is the Durable Object's rather than the
- * container's. So re-run it. `node_modules` is the container's, so the note
- * says the replacement reinstalls it.
- *
- * Matched on `code` rather than the message — the property the package sets
- * deliberately, and the one that survives a reworded string.
  */
-export declare function execLostNote(err: unknown): string | undefined;
 /**
  * What the workspace's advisories mean for a command about to run.
  *
@@ -71,7 +52,7 @@ export interface ExecGate {
  * needs to hear about the ceiling — that is the fact that makes waiting
  * pointless, and reporting only the blockage would send it round the loop again.
  */
-export declare function execGate(advisories: readonly WorkspaceAdvisory[], command: string): ExecGate;
+export declare function execGate(advisories: readonly SandboxAdvisory[], command: string): ExecGate;
 /**
  * Whether a write should happen at all, and what to say when it should not.
  *
@@ -90,7 +71,7 @@ export declare function execGate(advisories: readonly WorkspaceAdvisory[], comma
  * available: the only thing refusing costs is a false "wrote 120 characters",
  * and that message is worse than nothing because it is believed.
  */
-export declare function writeGate(advisories: readonly WorkspaceAdvisory[]): string | undefined;
+export declare function writeGate(advisories: readonly SandboxAdvisory[]): string | undefined;
 /**
  * Does this command plausibly read `node_modules`, and therefore have to wait for
  * a dependency install to finish?

package/dist/computer/gate.js

@@ -1,40 +1,4 @@
-import { renderAdvisory, shapeOf } from "../workspace/advisory.js";
-/**
- * What one shell command has to wait for, and what to say when it never ran.
- *
- * {@link file://../workspace/advisory.ts} decides what is true about the workspace and how
- * to word it; this file decides what that means for a command about to run.
- * {@link needsDependencies} is the part that cannot move there — it is a
- * question about the *command*, and it is what stops `cat README.md` queueing
- * behind an `npm ci` it has no use for.
- *
- * {@link execLostNote} covers a failure with no advisory behind it: a container
- * replaced underneath a command that was running.
- */
-/**
- * The one `bash` failure that is not the command's fault.
- *
- * An execution running when the container is replaced throws `EEXEC_LOST`.
- * Unexplained, the model receives `Execution "…" was lost when its container
- * runtime was replaced`, reads it as a crash, and goes looking at its command.
- *
- * What it needs is two facts: nothing ran to completion, and the workspace
- * survived because the filesystem is the Durable Object's rather than the
- * container's. So re-run it. `node_modules` is the container's, so the note
- * says the replacement reinstalls it.
- *
- * Matched on `code` rather than the message — the property the package sets
- * deliberately, and the one that survives a reworded string.
- */
-export function execLostNote(err) {
-    if (err?.code !== "EEXEC_LOST")
-        return undefined;
-    return ("the container was replaced while this command was running, so it was lost — " +
-        "nothing ran to completion and no output survived. This is infrastructure, " +
-        "not your command: re-run it. The workspace is durable and is exactly as you " +
-        "left it. `node_modules` is not: the replacement reinstalls it, and a " +
-        "command that needs it waits for that.");
-}
+import { renderAdvisory, shapeOf } from "../sandbox/advisory.js";
 /** Which advisories this particular command needs to hear about. */
 function relevantTo(advisories, command) {
     // Computed once for the whole set rather than per advisory: it parses the

package/dist/computer/index.d.ts

@@ -1,41 +1,51 @@
 import type { ToolSet } from "ai";
 import type { AgentPlugin } from "@dynamicagents/core";
-import type { WorkspaceClient } from "@cloudflare/computer";
-import type { WorkspaceAdvisory } from "../workspace/advisory.js";
-import type { WorkspaceClientConfig } from "../workspace/exec.js";
+import type { SandboxAdvisory } from "../sandbox/advisory.js";
+import type { ComputerClient } from "./client.js";
 /**
- * `@dynamicagents/plugins/computer` — an agent's tools over a container
- * workspace: `bash`, `grep` and `edit`, and `computerWorkspace`, the agent's own
+ * `@dynamicagents/plugins/computer` — an agent's tools over a `/sandbox`
+ * container: `bash`, `grep` and `edit`, and `computerWorkspace`, the agent's own
  * `this.workspace`, which Think's `read`, `write`, `delete`, `find` and `list`
  * go through.
  *
- * The workspace itself — the Durable Object, its container, its git, its
- * install — is `@dynamicagents/plugins/workspace`. This plugin reaches it only
- * through that subpath's client modules, never its object, so an agent that
- * holds the tools carries no container backend and no isomorphic-git.
+ * The container itself — the Durable Object, its git, its install — is
+ * `@dynamicagents/plugins/sandbox`. This plugin reaches it over RPC, never
+ * through its object, so an agent that holds the tools carries no container
+ * backend.
  *
- * The agent's own workspace has to be this one — `computerWorkspace` — or
+ * The agent's own workspace has to be the sandbox's — `computerWorkspace` — or
  * Think's `read` and `write` would work on a different tree from `bash`. The
- * plugin refuses to start otherwise; see `./proxy.ts`.
- *
- * ## The dependency tree is not in the workspace
- *
- * The one thing to internalise before reading further. A package root's
- * `node_modules` is a bind mount of the container's disk, so installs never
- * sync, and a new container reinstalls — see `/workspace`'s
- * `container-deps.ts`. The file tools read the workspace, so they refuse it;
- * `bash` reaches it. `paths.ts` owns what a path may be and what walks drop.
+ * plugin refuses to start otherwise; see `./proxy.ts`. `paths.ts` owns what a
+ * path may be and what walks drop.
  */
 /**
  * The helpers this plugin's own tests reach for, re-exported from the one
  * entry point. `verify:exports` treats `./computer` as one realm, so what it
  * exports must not move when the files behind it do.
  */
-export { isGitInternal, SESSION_STATE_DIR, WALK_SKIPS } from "./paths.js";
-export { packBlocks, renderGrepMatches, renderResult, syncPendingNote } from "./render.js";
+export { isGitInternal, WALK_SKIPS } from "./paths.js";
+export { packBlocks, renderGrepMatches, renderResult } from "./render.js";
 export { execGate, needsDependencies, writeGate, type ExecGate } from "./gate.js";
-export { computerWorkspace, isComputerWorkspace } from "./proxy.js";
-export interface ComputerConfig extends WorkspaceClientConfig {
+export { sandboxClient, computerWorkspace, type SandboxComputerConfig, type SandboxComputerHost } from "./sandbox.js";
+export type { ComputerClient } from "./client.js";
+/** How the tools run: the shell, the limits, the environment. */
+export interface ComputerToolsConfig {
+    /** Working directory for every command. Defaults to `/workspace`. */
+    cwd?: string;
+    /**
+     * Run every command through this shell, e.g. `"bash"`. Unset, the command
+     * string goes to the runtime as-is and lands on whatever `/bin/sh` is.
+     *
+     * Worth setting, because "whatever `/bin/sh` is" is **dash** on Debian and
+     * Ubuntu, and a model writing shell writes *bash*. `${PIPESTATUS[0]}` is the
+     * one that costs most — a bash builtin a model reaches for to read a piped exit
+     * code, which dash fails with exit 2, after the command it wrapped has already
+     * run. Set it only if the image actually has that shell: a missing one fails
+     * *every* command rather than the bash-flavoured ones.
+     */
+    shell?: string;
+    /** Per-command timeout. Defaults to ten minutes. */
+    timeoutMs?: number;
     /**
      * Output ceiling per command, in **characters**. Defaults to 16,000.
      *
@@ -66,11 +76,6 @@ export interface ComputerConfig extends WorkspaceClientConfig {
      * Environment merged into every command **these tools** run — a registry host,
      * a `CI` flag, proxy settings. Host-supplied and never model input.
      *
-     * "These tools" is exact: `/workspace`'s `workspaceExec` deliberately does not
-     * merge it, so a proxy set here does not reach the git that
-     * `@dynamicagents/plugins/repo` runs through that export. The reasoning, and
-     * how a host opts in explicitly, is written up there.
-     *
      * ## Put no secret here
      *
      * *Every* command gets this environment, and `bash`'s command is written by
@@ -88,26 +93,22 @@ export interface ComputerConfig extends WorkspaceClientConfig {
      *
      * Do not hand the agent the credential; hand it the *action*. Keep the secret
      * on the Worker and expose one tool that makes the call it is for.
-     * `@dynamicagents/plugins/repo` is the worked example: it holds a GitHub token, calls
-     * the API from the Worker, and runs clone, fetch and push on the host's side of
-     * the boundary. **No command in its container is ever given that token.**
+     * `@dynamicagents/plugins/repo-github` is the worked example: it holds a GitHub token, calls
+     * the API from the Worker, and its container's git holds a placeholder the
+     * egress swaps. **No command in its container is ever given that token.**
      */
     env?: () => Record<string, string | undefined>;
 }
 /**
- * @param workspace Opens the workspace for a command: container started, CA
- *   installed.
- * @param fsWorkspace Opens it for the file tools, which touch nothing but the
- *   host's SQLite. Defaults to {@link workspace}, so a host with one way in
- *   behaves as before. See {@link openWorkspaceFs}.
- * @param lockScope Names the workspace a write locks within — see
+ * @param workspace Opens the sandbox for a call.
+ * @param lockScope Names the sandbox a write locks within — see
  *   {@link file://./file-lock.ts}. Defaults to this tool set alone.
  */
-export declare function buildComputerTools(workspace: () => Promise<WorkspaceClient>, config: ComputerConfig, advisories?: () => Promise<readonly WorkspaceAdvisory[]>, fsWorkspace?: () => Promise<WorkspaceClient>, lockScope?: () => string): ToolSet;
+export declare function buildComputerTools(workspace: () => Promise<ComputerClient>, config: ComputerToolsConfig, advisories?: () => Promise<readonly SandboxAdvisory[]>, lockScope?: () => string): ToolSet;
 /**
- * The container plugin. Its tools reach the workspace through the agent's own
- * `computerWorkspace` — the one Think's `read` and `write` use — so the two can
- * never resolve different ones. `config` answers everything else: the shell,
- * the limits, the environment.
+ * The container plugin over a `/sandbox` object. Its tools reach the sandbox
+ * through the agent's own `computerWorkspace` — the one Think's `read` and
+ * `write` use — so the two can never resolve different ones. `config` answers
+ * everything else.
  */
-export declare function computer(config: ComputerConfig): AgentPlugin;
+export declare function computer(config: ComputerToolsConfig): AgentPlugin;

package/dist/computer/index.js

@@ -1,84 +1,64 @@
 import { definePlugin, PluginSetupError } from "@dynamicagents/core";
-import { openWorkspace, openWorkspaceFs } from "../workspace/open.js";
 import { workspaceRoute } from "./proxy.js";
 import { computerContext } from "./context.js";
 import { execTools } from "./tools-exec.js";
 import { fileTools } from "./tools-file.js";
 import { grepTools } from "./tools-grep.js";
 /**
- * `@dynamicagents/plugins/computer` — an agent's tools over a container
- * workspace: `bash`, `grep` and `edit`, and `computerWorkspace`, the agent's own
+ * `@dynamicagents/plugins/computer` — an agent's tools over a `/sandbox`
+ * container: `bash`, `grep` and `edit`, and `computerWorkspace`, the agent's own
  * `this.workspace`, which Think's `read`, `write`, `delete`, `find` and `list`
  * go through.
  *
- * The workspace itself — the Durable Object, its container, its git, its
- * install — is `@dynamicagents/plugins/workspace`. This plugin reaches it only
- * through that subpath's client modules, never its object, so an agent that
- * holds the tools carries no container backend and no isomorphic-git.
+ * The container itself — the Durable Object, its git, its install — is
+ * `@dynamicagents/plugins/sandbox`. This plugin reaches it over RPC, never
+ * through its object, so an agent that holds the tools carries no container
+ * backend.
  *
- * The agent's own workspace has to be this one — `computerWorkspace` — or
+ * The agent's own workspace has to be the sandbox's — `computerWorkspace` — or
  * Think's `read` and `write` would work on a different tree from `bash`. The
- * plugin refuses to start otherwise; see `./proxy.ts`.
- *
- * ## The dependency tree is not in the workspace
- *
- * The one thing to internalise before reading further. A package root's
- * `node_modules` is a bind mount of the container's disk, so installs never
- * sync, and a new container reinstalls — see `/workspace`'s
- * `container-deps.ts`. The file tools read the workspace, so they refuse it;
- * `bash` reaches it. `paths.ts` owns what a path may be and what walks drop.
+ * plugin refuses to start otherwise; see `./proxy.ts`. `paths.ts` owns what a
+ * path may be and what walks drop.
  */
 /**
  * The helpers this plugin's own tests reach for, re-exported from the one
  * entry point. `verify:exports` treats `./computer` as one realm, so what it
  * exports must not move when the files behind it do.
  */
-export { isGitInternal, SESSION_STATE_DIR, WALK_SKIPS } from "./paths.js";
-export { packBlocks, renderGrepMatches, renderResult, syncPendingNote } from "./render.js";
+export { isGitInternal, WALK_SKIPS } from "./paths.js";
+export { packBlocks, renderGrepMatches, renderResult } from "./render.js";
 export { execGate, needsDependencies, writeGate } from "./gate.js";
-export { computerWorkspace, isComputerWorkspace } from "./proxy.js";
+export { sandboxClient, computerWorkspace } from "./sandbox.js";
 /**
- * @param workspace Opens the workspace for a command: container started, CA
- *   installed.
- * @param fsWorkspace Opens it for the file tools, which touch nothing but the
- *   host's SQLite. Defaults to {@link workspace}, so a host with one way in
- *   behaves as before. See {@link openWorkspaceFs}.
- * @param lockScope Names the workspace a write locks within — see
+ * @param workspace Opens the sandbox for a call.
+ * @param lockScope Names the sandbox a write locks within — see
  *   {@link file://./file-lock.ts}. Defaults to this tool set alone.
  */
-export function buildComputerTools(workspace, config, advisories, fsWorkspace = workspace, lockScope) {
-    const ctx = computerContext(workspace, config, advisories, fsWorkspace, lockScope);
+export function buildComputerTools(workspace, config, advisories, lockScope) {
+    const ctx = computerContext(workspace, config, advisories, lockScope);
     return {
         ...execTools(ctx),
         ...fileTools(ctx),
         ...grepTools(ctx)
     };
 }
+/** What the model is told about the container, once per turn. */
 const CONTEXT = [
     "You have a Linux container with a shell, a package manager and network access:",
     "- `bash` runs any shell command — builds, tests, installs, git.",
     "- `read` / `write` / `edit` / `delete` work on files; `edit` replaces an exact unique string and is the right tool for a small change.",
     "- `grep` searches file contents; `list` lists a directory; `find` finds files by glob.",
-    // The reason to prefer them is the one thing the model cannot infer from a
-    // tool description: these read the durable workspace directly, so they are
-    // the only tools that still answer while the container is unavailable.
-    "Search with `grep` and `find` rather than running them through `bash`. They read the workspace directly, so they keep working while the container is restarting or an install is still running, and they come back with line numbers and a bounded result instead of a wall of text.",
+    "Search with `grep` and `find` rather than running them through `bash`: they come back with line numbers and a bounded result instead of a wall of text.",
     "Command output is truncated from the middle when large, so run targeted commands and read specific files rather than printing everything.",
-    // Both halves of this matter and they pull in opposite directions, which
-    // is why they are stated together rather than left for the model to work
-    // out from a confusing result.
-    "The checkout is durable: it survives between tasks and is still there after the container restarts, so it may already contain work from an earlier task — check before assuming it is empty.",
-    "`node_modules` is not durable: it lives on the container's disk, so a new container reinstalls it, and the file tools cannot see inside it — use `bash` there. It is a mount point, so `rm -rf node_modules` fails; `npm ci` clears it itself.",
-    // Stated up front rather than left to a refusal, so the model does not spend
-    // a turn discovering it. The destination matters as much as the rule: a
-    // prohibition with nowhere to go gets worked around.
+    "The checkout is the container's own disk, and it is kept between tasks: a stopped container starts again from it, so it may already contain work from an earlier task — check before assuming it is empty.",
+    "`node_modules` is on that disk beside the checkout and is kept with it. The file tools leave it out — use `bash` there.",
     "`.git` is off limits to these tools, and searches and recursive listings skip it. It is git's internal state — reading it tells you less than the repository tools do, and writing it corrupts the checkout. Repository work goes through the repo tools (`repo_status`, `repo_diff`, `repo_commit`, `repo_push`); if a task needs git state you cannot get that way, say so in your result rather than reaching into `.git` yourself."
 ].join("\n");
 /**
- * The container plugin. Its tools reach the workspace through the agent's own
- * `computerWorkspace` — the one Think's `read` and `write` use — so the two can
- * never resolve different ones. `config` answers everything else: the shell,
- * the limits, the environment.
+ * The container plugin over a `/sandbox` object. Its tools reach the sandbox
+ * through the agent's own `computerWorkspace` — the one Think's `read` and
+ * `write` use — so the two can never resolve different ones. `config` answers
+ * everything else.
  */
 export function computer(config) {
     return definePlugin({
@@ -93,15 +73,14 @@ export function computer(config) {
                     "would work on a different tree. Set it on the agent class: " +
                     "`override workspace = computerWorkspace(config, () => this.pluginContext().runtime())`.");
             // Resolved per call, not memoized: the name belongs to the turn — a
-            // sub-agent's comes from `runtime()`, see `/workspace`'s `WORKSPACE_RUNTIME_KEY` —
-            // and a stale stub would silently route a second caller's commands into
-            // the first caller's files.
-            const host = () => route.host(route.name());
-            return buildComputerTools(() => openWorkspace(host()), config, 
+            // sub-agent's comes from `runtime()`, see `/sandbox`'s
+            // `SANDBOX_RUNTIME_KEY` — and a stale one would silently route a second
+            // caller's commands into the first caller's files.
+            return buildComputerTools(() => route.open(route.name()), config, 
             // No try/catch here: `buildComputerTools` fails the gate open itself,
             // so wrapping again would only make it look like the guarantee lives in
             // two places.
-            () => host().advisories(), () => openWorkspaceFs(host()), route.name);
+            () => route.advisories(route.name()), route.name);
         },
         context: [{ provider: { get: async () => CONTEXT } }]
     });