@finalai/agent-provider 0.1.0

package/dist/modules/sandbox/mcp-search.mjs

@@ -0,0 +1,129 @@
+import { RE2JS } from "re2js";
+import { relativeTo, resolvePosixPath } from "./paths.mjs";
+import { SandboxEntryType } from "./types.mjs";
+const SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
+const DEFAULT_WALK_LIMITS = {
+  maxEntries: 2e4,
+  maxFileBytes: 2 * 1024 * 1024
+};
+const globToRegExp = (glob) => {
+  let out = "";
+  let braceDepth = 0;
+  for (let i = 0; i < glob.length; i += 1) {
+    const char = glob[i] ?? "";
+    if (char === "*") {
+      if (glob[i + 1] === "*") {
+        const slash = glob[i + 2] === "/";
+        out += slash ? "(?:.*/)?" : ".*";
+        i += slash ? 2 : 1;
+      } else {
+        out += "[^/]*";
+      }
+    } else if (char === "?") {
+      out += "[^/]";
+    } else if (char === "[") {
+      const end = glob.indexOf("]", i + 1);
+      if (end < 0) out += "\\[";
+      else {
+        const body = glob.slice(i + 1, end).replace(/^!/, "^").replace(/\\/g, "\\\\");
+        out += `[${body}]`;
+        i = end;
+      }
+    } else if (char === "{") {
+      braceDepth += 1;
+      out += "(?:";
+    } else if (char === "}" && braceDepth > 0) {
+      braceDepth -= 1;
+      out += ")";
+    } else if (char === "," && braceDepth > 0) {
+      out += "|";
+    } else {
+      out += char.replace(/[.+^$()|\\]/g, "\\$&");
+    }
+  }
+  return RE2JS.compile(`^${out}$`);
+};
+const walkTree = async (sandbox, root, options) => {
+  const limits = options.limits ?? DEFAULT_WALK_LIMITS;
+  const queue = [{ path: root, relative: "" }];
+  let seen = 0;
+  while (queue.length > 0) {
+    options.signal?.throwIfAborted();
+    const directory = queue.shift();
+    if (directory == null) break;
+    const entries = await sandbox.readDir({ path: directory.path }).catch(() => []);
+    for (const entry of entries) {
+      seen += 1;
+      if (seen > limits.maxEntries) return { truncated: true };
+      const relative = directory.relative === "" ? entry.name : `${directory.relative}/${entry.name}`;
+      const keepGoing = await options.onEntry({
+        path: entry.path,
+        relative,
+        type: entry.type,
+        size: entry.size
+      });
+      if (!keepGoing) return { truncated: true };
+      if (entry.type === SandboxEntryType.Directory && !SKIPPED_DIRECTORIES.has(entry.name))
+        queue.push({ path: entry.path, relative });
+    }
+  }
+  return { truncated: false };
+};
+const globFiles = async (args) => {
+  const root = resolvePosixPath(args.cwd, args.path ?? ".");
+  const matcher = globToRegExp(
+    args.pattern.startsWith("/") ? relativeTo(root, args.pattern) ?? args.pattern : args.pattern
+  );
+  const paths = [];
+  const { truncated } = await walkTree(args.sandbox, root, {
+    signal: args.signal,
+    onEntry: (entry) => {
+      if (entry.type !== SandboxEntryType.Directory && matcher.test(entry.relative))
+        paths.push(entry.path);
+      return paths.length < args.maxResults;
+    }
+  });
+  return { paths: paths.sort(), truncated };
+};
+const grepFiles = async (args) => {
+  const regex = RE2JS.compile(args.pattern, args.ignoreCase === true ? RE2JS.CASE_INSENSITIVE : 0);
+  const fileFilter = args.glob == null ? null : globToRegExp(args.glob);
+  const root = resolvePosixPath(args.cwd, args.path ?? ".");
+  const matches = [];
+  const searchFile = async (path, relative) => {
+    if (fileFilter != null && !fileFilter.test(relative) && !fileFilter.test(relative.split("/").pop() ?? ""))
+      return;
+    const text = await args.sandbox.readTextFile({ path, abortSignal: args.signal }).catch(() => null);
+    if (text == null || text.includes("\0")) return;
+    const lines = text.split("\n");
+    for (let index = 0; index < lines.length && matches.length < args.maxResults; index += 1) {
+      const lineText = lines[index] ?? "";
+      if (regex.test(lineText))
+        matches.push({ path, line: index + 1, text: lineText.slice(0, 500) });
+    }
+  };
+  const rootStat = await args.sandbox.stat({ path: root });
+  if (rootStat == null) return { matches, truncated: false };
+  if (rootStat.type === SandboxEntryType.File) {
+    await searchFile(root, rootStat.path.split("/").pop() ?? root);
+    return { matches, truncated: matches.length >= args.maxResults };
+  }
+  const { truncated } = await walkTree(args.sandbox, root, {
+    signal: args.signal,
+    onEntry: async (entry) => {
+      if (entry.type === SandboxEntryType.File && (entry.size == null || entry.size <= DEFAULT_WALK_LIMITS.maxFileBytes)) {
+        await searchFile(entry.path, entry.relative);
+      }
+      return matches.length < args.maxResults;
+    }
+  });
+  return { matches, truncated };
+};
+export {
+  DEFAULT_WALK_LIMITS,
+  globFiles,
+  globToRegExp,
+  grepFiles,
+  walkTree
+};
+//# sourceMappingURL=mcp-search.mjs.map

package/dist/modules/sandbox/mcp-search.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/sandbox/mcp-search.ts"],
+  "sourcesContent": ["import { RE2JS } from 're2js';\nimport { relativeTo, resolvePosixPath } from \"./paths.mjs\";\nimport { SandboxEntryType, type SandboxSessionIface } from \"./types.mjs\";\n\n// grep and glob over the handle's readDir/readTextFile, so they work on every\n// provider and on read-only bindings (no process execution).\n\nconst SKIPPED_DIRECTORIES = new Set(['.git', 'node_modules', '.hg', '.svn']);\n\nexport interface WalkLimitsIface {\n  maxEntries: number;\n  maxFileBytes: number;\n}\n\nexport const DEFAULT_WALK_LIMITS: WalkLimitsIface = {\n  maxEntries: 20_000,\n  maxFileBytes: 2 * 1024 * 1024,\n};\n\n// Converts a glob (`**`, `*`, `?`, `[...]`, `{a,b}`) to an anchored RegExp.\nexport const globToRegExp = (glob: string): { test(input: string): boolean } => {\n  let out = '';\n  let braceDepth = 0;\n  for (let i = 0; i < glob.length; i += 1) {\n    const char = glob[i] ?? '';\n    if (char === '*') {\n      if (glob[i + 1] === '*') {\n        const slash = glob[i + 2] === '/';\n        out += slash ? '(?:.*/)?' : '.*';\n        i += slash ? 2 : 1;\n      } else {\n        out += '[^/]*';\n      }\n    } else if (char === '?') {\n      out += '[^/]';\n    } else if (char === '[') {\n      const end = glob.indexOf(']', i + 1);\n      if (end < 0) out += '\\\\[';\n      else {\n        const body = glob\n          .slice(i + 1, end)\n          .replace(/^!/, '^')\n          .replace(/\\\\/g, '\\\\\\\\');\n        out += `[${body}]`;\n        i = end;\n      }\n    } else if (char === '{') {\n      braceDepth += 1;\n      out += '(?:';\n    } else if (char === '}' && braceDepth > 0) {\n      braceDepth -= 1;\n      out += ')';\n    } else if (char === ',' && braceDepth > 0) {\n      out += '|';\n    } else {\n      out += char.replace(/[.+^$()|\\\\]/g, '\\\\$&');\n    }\n  }\n  return RE2JS.compile(`^${out}$`);\n};\n\nexport interface WalkEntryIface {\n  path: string;\n  relative: string;\n  type: SandboxEntryType;\n  size: number | null;\n}\n\nexport const walkTree = async (\n  sandbox: Pick<SandboxSessionIface, 'readDir'>,\n  root: string,\n  options: {\n    limits?: WalkLimitsIface;\n    signal?: AbortSignal;\n    onEntry: (entry: WalkEntryIface) => boolean | Promise<boolean>;\n  },\n): Promise<{ truncated: boolean }> => {\n  const limits = options.limits ?? DEFAULT_WALK_LIMITS;\n  // Relative paths come from entry names: the sandbox reports its own paths,\n  // which need not sit under `root` as written (a mapped session root, or a\n  // Windows Device).\n  const queue = [{ path: root, relative: '' }];\n  let seen = 0;\n  while (queue.length > 0) {\n    options.signal?.throwIfAborted();\n    const directory = queue.shift();\n    if (directory == null) break;\n    const entries = await sandbox.readDir({ path: directory.path }).catch(() => []);\n    for (const entry of entries) {\n      seen += 1;\n      if (seen > limits.maxEntries) return { truncated: true };\n      const relative =\n        directory.relative === '' ? entry.name : `${directory.relative}/${entry.name}`;\n      const keepGoing = await options.onEntry({\n        path: entry.path,\n        relative,\n        type: entry.type,\n        size: entry.size,\n      });\n      if (!keepGoing) return { truncated: true };\n      if (entry.type === SandboxEntryType.Directory && !SKIPPED_DIRECTORIES.has(entry.name))\n        queue.push({ path: entry.path, relative });\n    }\n  }\n  return { truncated: false };\n};\n\nexport const globFiles = async (args: {\n  sandbox: Pick<SandboxSessionIface, 'readDir'>;\n  cwd: string;\n  pattern: string;\n  path?: string;\n  maxResults: number;\n  signal?: AbortSignal;\n}): Promise<{ paths: string[]; truncated: boolean }> => {\n  const root = resolvePosixPath(args.cwd, args.path ?? '.');\n  const matcher = globToRegExp(\n    args.pattern.startsWith('/') ? (relativeTo(root, args.pattern) ?? args.pattern) : args.pattern,\n  );\n  const paths: string[] = [];\n  const { truncated } = await walkTree(args.sandbox, root, {\n    signal: args.signal,\n    onEntry: (entry) => {\n      if (entry.type !== SandboxEntryType.Directory && matcher.test(entry.relative))\n        paths.push(entry.path);\n      return paths.length < args.maxResults;\n    },\n  });\n  return { paths: paths.sort(), truncated };\n};\n\nexport interface GrepMatchIface {\n  path: string;\n  line: number;\n  text: string;\n}\n\nexport const grepFiles = async (args: {\n  sandbox: Pick<SandboxSessionIface, 'readDir' | 'readTextFile' | 'stat'>;\n  cwd: string;\n  pattern: string;\n  path?: string;\n  glob?: string;\n  ignoreCase?: boolean;\n  maxResults: number;\n  signal?: AbortSignal;\n}): Promise<{ matches: GrepMatchIface[]; truncated: boolean }> => {\n  const regex = RE2JS.compile(args.pattern, args.ignoreCase === true ? RE2JS.CASE_INSENSITIVE : 0);\n  const fileFilter = args.glob == null ? null : globToRegExp(args.glob);\n  const root = resolvePosixPath(args.cwd, args.path ?? '.');\n  const matches: GrepMatchIface[] = [];\n  const searchFile = async (path: string, relative: string) => {\n    if (\n      fileFilter != null &&\n      !fileFilter.test(relative) &&\n      !fileFilter.test(relative.split('/').pop() ?? '')\n    )\n      return;\n    const text = await args.sandbox\n      .readTextFile({ path, abortSignal: args.signal })\n      .catch(() => null);\n    if (text == null || text.includes('\\u0000')) return;\n    const lines = text.split('\\n');\n    for (let index = 0; index < lines.length && matches.length < args.maxResults; index += 1) {\n      const lineText = lines[index] ?? '';\n      if (regex.test(lineText))\n        matches.push({ path, line: index + 1, text: lineText.slice(0, 500) });\n    }\n  };\n  const rootStat = await args.sandbox.stat({ path: root });\n  if (rootStat == null) return { matches, truncated: false };\n  if (rootStat.type === SandboxEntryType.File) {\n    await searchFile(root, rootStat.path.split('/').pop() ?? root);\n    return { matches, truncated: matches.length >= args.maxResults };\n  }\n  const { truncated } = await walkTree(args.sandbox, root, {\n    signal: args.signal,\n    onEntry: async (entry) => {\n      if (\n        entry.type === SandboxEntryType.File &&\n        (entry.size == null || entry.size <= DEFAULT_WALK_LIMITS.maxFileBytes)\n      ) {\n        await searchFile(entry.path, entry.relative);\n      }\n      return matches.length < args.maxResults;\n    },\n  });\n  return { matches, truncated };\n};\n"],
+  "mappings": "AAAA,SAAS,aAAa;AACtB,SAAS,YAAY,wBAAwB;AAC7C,SAAS,wBAAkD;AAK3D,MAAM,sBAAsB,oBAAI,IAAI,CAAC,QAAQ,gBAAgB,OAAO,MAAM,CAAC;AAOpE,MAAM,sBAAuC;AAAA,EAClD,YAAY;AAAA,EACZ,cAAc,IAAI,OAAO;AAC3B;AAGO,MAAM,eAAe,CAAC,SAAmD;AAC9E,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,OAAO,KAAK,CAAC,KAAK;AACxB,QAAI,SAAS,KAAK;AAChB,UAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,cAAM,QAAQ,KAAK,IAAI,CAAC,MAAM;AAC9B,eAAO,QAAQ,aAAa;AAC5B,aAAK,QAAQ,IAAI;AAAA,MACnB,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF,WAAW,SAAS,KAAK;AACvB,aAAO;AAAA,IACT,WAAW,SAAS,KAAK;AACvB,YAAM,MAAM,KAAK,QAAQ,KAAK,IAAI,CAAC;AACnC,UAAI,MAAM,EAAG,QAAO;AAAA,WACf;AACH,cAAM,OAAO,KACV,MAAM,IAAI,GAAG,GAAG,EAChB,QAAQ,MAAM,GAAG,EACjB,QAAQ,OAAO,MAAM;AACxB,eAAO,IAAI,IAAI;AACf,YAAI;AAAA,MACN;AAAA,IACF,WAAW,SAAS,KAAK;AACvB,oBAAc;AACd,aAAO;AAAA,IACT,WAAW,SAAS,OAAO,aAAa,GAAG;AACzC,oBAAc;AACd,aAAO;AAAA,IACT,WAAW,SAAS,OAAO,aAAa,GAAG;AACzC,aAAO;AAAA,IACT,OAAO;AACL,aAAO,KAAK,QAAQ,gBAAgB,MAAM;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,MAAM,QAAQ,IAAI,GAAG,GAAG;AACjC;AASO,MAAM,WAAW,OACtB,SACA,MACA,YAKoC;AACpC,QAAM,SAAS,QAAQ,UAAU;AAIjC,QAAM,QAAQ,CAAC,EAAE,MAAM,MAAM,UAAU,GAAG,CAAC;AAC3C,MAAI,OAAO;AACX,SAAO,MAAM,SAAS,GAAG;AACvB,YAAQ,QAAQ,eAAe;AAC/B,UAAM,YAAY,MAAM,MAAM;AAC9B,QAAI,aAAa,KAAM;AACvB,UAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,MAAM,UAAU,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC;AAC9E,eAAW,SAAS,SAAS;AAC3B,cAAQ;AACR,UAAI,OAAO,OAAO,WAAY,QAAO,EAAE,WAAW,KAAK;AACvD,YAAM,WACJ,UAAU,aAAa,KAAK,MAAM,OAAO,GAAG,UAAU,QAAQ,IAAI,MAAM,IAAI;AAC9E,YAAM,YAAY,MAAM,QAAQ,QAAQ;AAAA,QACtC,MAAM,MAAM;AAAA,QACZ;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,MAAM,MAAM;AAAA,MACd,CAAC;AACD,UAAI,CAAC,UAAW,QAAO,EAAE,WAAW,KAAK;AACzC,UAAI,MAAM,SAAS,iBAAiB,aAAa,CAAC,oBAAoB,IAAI,MAAM,IAAI;AAClF,cAAM,KAAK,EAAE,MAAM,MAAM,MAAM,SAAS,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,EAAE,WAAW,MAAM;AAC5B;AAEO,MAAM,YAAY,OAAO,SAOwB;AACtD,QAAM,OAAO,iBAAiB,KAAK,KAAK,KAAK,QAAQ,GAAG;AACxD,QAAM,UAAU;AAAA,IACd,KAAK,QAAQ,WAAW,GAAG,IAAK,WAAW,MAAM,KAAK,OAAO,KAAK,KAAK,UAAW,KAAK;AAAA,EACzF;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,EAAE,UAAU,IAAI,MAAM,SAAS,KAAK,SAAS,MAAM;AAAA,IACvD,QAAQ,KAAK;AAAA,IACb,SAAS,CAAC,UAAU;AAClB,UAAI,MAAM,SAAS,iBAAiB,aAAa,QAAQ,KAAK,MAAM,QAAQ;AAC1E,cAAM,KAAK,MAAM,IAAI;AACvB,aAAO,MAAM,SAAS,KAAK;AAAA,IAC7B;AAAA,EACF,CAAC;AACD,SAAO,EAAE,OAAO,MAAM,KAAK,GAAG,UAAU;AAC1C;AAQO,MAAM,YAAY,OAAO,SASkC;AAChE,QAAM,QAAQ,MAAM,QAAQ,KAAK,SAAS,KAAK,eAAe,OAAO,MAAM,mBAAmB,CAAC;AAC/F,QAAM,aAAa,KAAK,QAAQ,OAAO,OAAO,aAAa,KAAK,IAAI;AACpE,QAAM,OAAO,iBAAiB,KAAK,KAAK,KAAK,QAAQ,GAAG;AACxD,QAAM,UAA4B,CAAC;AACnC,QAAM,aAAa,OAAO,MAAc,aAAqB;AAC3D,QACE,cAAc,QACd,CAAC,WAAW,KAAK,QAAQ,KACzB,CAAC,WAAW,KAAK,SAAS,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE;AAEhD;AACF,UAAM,OAAO,MAAM,KAAK,QACrB,aAAa,EAAE,MAAM,aAAa,KAAK,OAAO,CAAC,EAC/C,MAAM,MAAM,IAAI;AACnB,QAAI,QAAQ,QAAQ,KAAK,SAAS,IAAQ,EAAG;AAC7C,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,UAAU,QAAQ,SAAS,KAAK,YAAY,SAAS,GAAG;AACxF,YAAM,WAAW,MAAM,KAAK,KAAK;AACjC,UAAI,MAAM,KAAK,QAAQ;AACrB,gBAAQ,KAAK,EAAE,MAAM,MAAM,QAAQ,GAAG,MAAM,SAAS,MAAM,GAAG,GAAG,EAAE,CAAC;AAAA,IACxE;AAAA,EACF;AACA,QAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,MAAM,KAAK,CAAC;AACvD,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,WAAW,MAAM;AACzD,MAAI,SAAS,SAAS,iBAAiB,MAAM;AAC3C,UAAM,WAAW,MAAM,SAAS,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,IAAI;AAC7D,WAAO,EAAE,SAAS,WAAW,QAAQ,UAAU,KAAK,WAAW;AAAA,EACjE;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,SAAS,KAAK,SAAS,MAAM;AAAA,IACvD,QAAQ,KAAK;AAAA,IACb,SAAS,OAAO,UAAU;AACxB,UACE,MAAM,SAAS,iBAAiB,SAC/B,MAAM,QAAQ,QAAQ,MAAM,QAAQ,oBAAoB,eACzD;AACA,cAAM,WAAW,MAAM,MAAM,MAAM,QAAQ;AAAA,MAC7C;AACA,aAAO,QAAQ,SAAS,KAAK;AAAA,IAC/B;AAAA,EACF,CAAC;AACD,SAAO,EAAE,SAAS,UAAU;AAC9B;",
+  "names": []
+}

package/dist/modules/sandbox/mcp-shell.d.mts

@@ -0,0 +1,21 @@
+import type { NetworkSandboxSessionIface, SandboxRunResultIface } from "./types.mjs";
+export declare enum SandboxShellMode {
+    Persistent = "persistent",
+    PerCommand = "per-command"
+}
+export interface ShellRunArgsIface {
+    command: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export interface SandboxShellIface {
+    run(args: ShellRunArgsIface): Promise<SandboxRunResultIface>;
+    close(): Promise<void>;
+    persistent(): boolean;
+}
+export declare const createSandboxShell: (args: {
+    getSandbox: () => Promise<NetworkSandboxSessionIface>;
+    mode?: SandboxShellMode;
+}) => SandboxShellIface;

package/dist/modules/sandbox/mcp-shell.mjs

@@ -0,0 +1,205 @@
+import { bytesToBase64, utf8Encode } from "./bytes.mjs";
+import { shellQuote } from "./paths.mjs";
+var SandboxShellMode = /* @__PURE__ */ ((SandboxShellMode2) => {
+  SandboxShellMode2["Persistent"] = "persistent";
+  SandboxShellMode2["PerCommand"] = "per-command";
+  return SandboxShellMode2;
+})(SandboxShellMode || {});
+const STARTUP_TIMEOUT_MS = 5e3;
+const TIMEOUT_EXIT_CODE = 124;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const randomSentinel = () => `__FINAL_SHELL_${crypto.randomUUID().replace(/-/g, "")}__`;
+const pumpText = async (stream, append) => {
+  const decoder = new TextDecoder();
+  const reader = stream.getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      append(decoder.decode(value, { stream: true }));
+    }
+  } catch {
+  }
+};
+const createSandboxShell = (args) => {
+  let mode = args.mode ?? "persistent" /* Persistent */;
+  let live = null;
+  let queue = Promise.resolve();
+  const notify = (shell) => {
+    const changed = shell.changed;
+    shell.changed = null;
+    changed?.();
+  };
+  const start = async (sandbox) => {
+    const process = await sandbox.spawn({
+      command: "bash",
+      args: ["--noprofile", "--norc"],
+      cwd: sandbox.defaultWorkingDirectory
+    });
+    const shell = {
+      process,
+      stdout: "",
+      stderr: "",
+      exited: false,
+      exitCode: null,
+      changed: null
+    };
+    void pumpText(process.stdout, (text) => {
+      shell.stdout += text;
+      notify(shell);
+    });
+    void pumpText(process.stderr, (text) => {
+      shell.stderr += text;
+      notify(shell);
+    });
+    process.wait().then(
+      (result) => {
+        shell.exited = true;
+        shell.exitCode = result.exitCode;
+        notify(shell);
+      },
+      () => {
+        shell.exited = true;
+        notify(shell);
+      }
+    );
+    return shell;
+  };
+  const waitFor = (shell, done, deadline) => new Promise((resolve) => {
+    const timer = deadline == null ? null : setTimeout(() => resolve(done()), Math.max(0, deadline - Date.now()));
+    const check = () => {
+      if (done() || shell.exited) {
+        if (timer != null) clearTimeout(timer);
+        resolve(done());
+        return;
+      }
+      shell.changed = check;
+    };
+    check();
+  });
+  const exchange = async (shell, run) => {
+    const sentinel = randomSentinel();
+    const exports = Object.entries(run.env ?? {}).filter(([key]) => ENV_NAME.test(key)).map(([key, value]) => `export ${key}=${shellQuote(value)}
+`).join("");
+    const cd = run.cwd == null ? "" : `cd -- ${shellQuote(run.cwd)} && `;
+    const inner = `${cd}{
+${run.command}
+}`;
+    const body = exports === "" ? inner : `(
+${exports}${inner}
+)`;
+    const script = `eval "$(printf '%s' '${bytesToBase64(utf8Encode(body))}' | base64 -d)" < /dev/null
+__final_status=$?
+printf '\\n%s %d\\n' '${sentinel}' "$__final_status"
+printf '\\n%s\\n' '${sentinel}' >&2
+`;
+    shell.stdout = "";
+    shell.stderr = "";
+    try {
+      await shell.process.write(script);
+    } catch {
+      return null;
+    }
+    const stdoutMarker = new RegExp(`\\n${sentinel} (\\d+)\\n`);
+    const stderrMarker = `
+${sentinel}
+`;
+    const finished = () => stdoutMarker.test(shell.stdout) && shell.stderr.includes(stderrMarker);
+    const deadline = run.timeoutMs == null ? null : Date.now() + run.timeoutMs;
+    const ok = await waitFor(shell, finished, deadline);
+    if (!ok) {
+      if (!shell.exited) return { timedOut: true };
+      return null;
+    }
+    const match = stdoutMarker.exec(shell.stdout);
+    const stdoutEnd = match?.index ?? shell.stdout.length;
+    const stderrEnd = shell.stderr.indexOf(stderrMarker);
+    return {
+      exitCode: Number(match?.[1] ?? "1"),
+      stdout: shell.stdout.slice(0, stdoutEnd),
+      stderr: shell.stderr.slice(0, stderrEnd < 0 ? shell.stderr.length : stderrEnd)
+    };
+  };
+  const runOnce = async (sandbox, run) => sandbox.run({
+    command: run.command,
+    shell: true,
+    cwd: run.cwd,
+    env: run.env,
+    timeoutMs: run.timeoutMs,
+    abortSignal: run.signal
+  });
+  const runPersistent = async (run) => {
+    run.signal?.throwIfAborted();
+    const sandbox = await args.getSandbox();
+    if (mode === "per-command" /* PerCommand */) return runOnce(sandbox, run);
+    const fresh = live == null || live.exited;
+    if (fresh) {
+      try {
+        live = await start(sandbox);
+      } catch {
+        mode = "per-command" /* PerCommand */;
+        return runOnce(sandbox, run);
+      }
+      const probe = await exchange(live, { command: "true", timeoutMs: STARTUP_TIMEOUT_MS });
+      if (probe == null || "timedOut" in probe) {
+        await live.process.kill().catch(() => void 0);
+        live = null;
+        mode = "per-command" /* PerCommand */;
+        return runOnce(sandbox, run);
+      }
+    }
+    const shell = live;
+    if (shell == null) return runOnce(sandbox, run);
+    const abort = () => {
+      void shell.process.kill().catch(() => void 0);
+    };
+    run.signal?.addEventListener("abort", abort, { once: true });
+    let result;
+    try {
+      result = await exchange(shell, run);
+    } finally {
+      run.signal?.removeEventListener("abort", abort);
+    }
+    if (run.signal?.aborted === true) {
+      live = null;
+      run.signal.throwIfAborted();
+    }
+    if (result == null) {
+      live = null;
+      return { exitCode: shell.exitCode ?? 1, stdout: shell.stdout, stderr: shell.stderr };
+    }
+    if ("timedOut" in result) {
+      const partial = { stdout: shell.stdout, stderr: shell.stderr };
+      await shell.process.kill().catch(() => void 0);
+      live = null;
+      return {
+        exitCode: TIMEOUT_EXIT_CODE,
+        stdout: partial.stdout,
+        stderr: `${partial.stderr}
+[timed out after ${run.timeoutMs ?? 0} ms; the shell was restarted]`
+      };
+    }
+    return result;
+  };
+  return {
+    run: (run) => {
+      const next = queue.then(
+        () => runPersistent(run),
+        () => runPersistent(run)
+      );
+      queue = next.catch(() => void 0);
+      return next;
+    },
+    close: async () => {
+      const shell = live;
+      live = null;
+      await shell?.process.kill().catch(() => void 0);
+    },
+    persistent: () => mode === "persistent" /* Persistent */ && live != null
+  };
+};
+export {
+  SandboxShellMode,
+  createSandboxShell
+};
+//# sourceMappingURL=mcp-shell.mjs.map

package/dist/modules/sandbox/mcp-shell.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/sandbox/mcp-shell.ts"],
+  "sourcesContent": ["import { bytesToBase64, utf8Encode } from \"./bytes.mjs\";\nimport { shellQuote } from \"./paths.mjs\";\nimport type {\n  NetworkSandboxSessionIface,\n  SandboxProcessIface,\n  SandboxRunResultIface,\n} from \"./types.mjs\";\n\n// A persistent bash per MCP projection, so `cd`, exported variables and shell\n// state survive between `run` calls and no command pays a fresh `bash -lc`. Commands run one at a time; each is sent base64\n// encoded and `eval`ed with stdin from /dev/null, then a random sentinel line\n// carrying the exit status marks the end of its stdout and stderr. A command\n// that exits the shell ends it; the next command starts a new one. Sandboxes\n// without bash fall back to one `run` per command.\n\nexport enum SandboxShellMode {\n  Persistent = 'persistent',\n  PerCommand = 'per-command',\n}\n\nexport interface ShellRunArgsIface {\n  command: string;\n  cwd?: string;\n  env?: Record<string, string>;\n  timeoutMs?: number;\n  signal?: AbortSignal;\n}\n\nexport interface SandboxShellIface {\n  run(args: ShellRunArgsIface): Promise<SandboxRunResultIface>;\n  close(): Promise<void>;\n  // Whether the persistent shell is in use (false after a fallback).\n  persistent(): boolean;\n}\n\nconst STARTUP_TIMEOUT_MS = 5_000;\nconst TIMEOUT_EXIT_CODE = 124;\nconst ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\ninterface LiveShellIface {\n  process: SandboxProcessIface;\n  stdout: string;\n  stderr: string;\n  exited: boolean;\n  exitCode: number | null;\n  changed: (() => void) | null;\n}\n\nconst randomSentinel = () => `__FINAL_SHELL_${crypto.randomUUID().replace(/-/g, '')}__`;\n\nconst pumpText = async (stream: ReadableStream<Uint8Array>, append: (text: string) => void) => {\n  const decoder = new TextDecoder();\n  const reader = stream.getReader();\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      append(decoder.decode(value, { stream: true }));\n    }\n  } catch {\n    // The process or connection went away; `exited` reports it.\n  }\n};\n\nexport const createSandboxShell = (args: {\n  getSandbox: () => Promise<NetworkSandboxSessionIface>;\n  mode?: SandboxShellMode;\n}): SandboxShellIface => {\n  let mode = args.mode ?? SandboxShellMode.Persistent;\n  let live: LiveShellIface | null = null;\n  let queue: Promise<unknown> = Promise.resolve();\n\n  const notify = (shell: LiveShellIface) => {\n    const changed = shell.changed;\n    shell.changed = null;\n    changed?.();\n  };\n\n  const start = async (sandbox: NetworkSandboxSessionIface): Promise<LiveShellIface> => {\n    const process = await sandbox.spawn({\n      command: 'bash',\n      args: ['--noprofile', '--norc'],\n      cwd: sandbox.defaultWorkingDirectory,\n    });\n    const shell: LiveShellIface = {\n      process,\n      stdout: '',\n      stderr: '',\n      exited: false,\n      exitCode: null,\n      changed: null,\n    };\n    void pumpText(process.stdout, (text) => {\n      shell.stdout += text;\n      notify(shell);\n    });\n    void pumpText(process.stderr, (text) => {\n      shell.stderr += text;\n      notify(shell);\n    });\n    process.wait().then(\n      (result) => {\n        shell.exited = true;\n        shell.exitCode = result.exitCode;\n        notify(shell);\n      },\n      () => {\n        shell.exited = true;\n        notify(shell);\n      },\n    );\n    return shell;\n  };\n\n  const waitFor = (\n    shell: LiveShellIface,\n    done: () => boolean,\n    deadline: number | null,\n  ): Promise<boolean> =>\n    new Promise<boolean>((resolve) => {\n      const timer =\n        deadline == null\n          ? null\n          : setTimeout(() => resolve(done()), Math.max(0, deadline - Date.now()));\n      const check = () => {\n        if (done() || shell.exited) {\n          if (timer != null) clearTimeout(timer);\n          resolve(done());\n          return;\n        }\n        shell.changed = check;\n      };\n      check();\n    });\n\n  // Sends one framed command and collects its output. Returns null when the\n  // shell died before reporting (so the caller can fall back or restart).\n  const exchange = async (\n    shell: LiveShellIface,\n    run: ShellRunArgsIface,\n  ): Promise<SandboxRunResultIface | { timedOut: true } | null> => {\n    const sentinel = randomSentinel();\n    const exports = Object.entries(run.env ?? {})\n      .filter(([key]) => ENV_NAME.test(key))\n      .map(([key, value]) => `export ${key}=${shellQuote(value)}\\n`)\n      .join('');\n    const cd = run.cwd == null ? '' : `cd -- ${shellQuote(run.cwd)} && `;\n    // Per-command variables must not leak into later commands: use a subshell.\n    const inner = `${cd}{\\n${run.command}\\n}`;\n    const body = exports === '' ? inner : `(\\n${exports}${inner}\\n)`;\n    const script =\n      `eval \"$(printf '%s' '${bytesToBase64(utf8Encode(body))}' | base64 -d)\" < /dev/null\\n` +\n      `__final_status=$?\\n` +\n      `printf '\\\\n%s %d\\\\n' '${sentinel}' \"$__final_status\"\\n` +\n      `printf '\\\\n%s\\\\n' '${sentinel}' >&2\\n`;\n    shell.stdout = '';\n    shell.stderr = '';\n    try {\n      await shell.process.write(script);\n    } catch {\n      // stdin is gone: the shell exited (or never ran).\n      return null;\n    }\n    const stdoutMarker = new RegExp(`\\\\n${sentinel} (\\\\d+)\\\\n`);\n    const stderrMarker = `\\n${sentinel}\\n`;\n    const finished = () => stdoutMarker.test(shell.stdout) && shell.stderr.includes(stderrMarker);\n    const deadline = run.timeoutMs == null ? null : Date.now() + run.timeoutMs;\n    const ok = await waitFor(shell, finished, deadline);\n    if (!ok) {\n      if (!shell.exited) return { timedOut: true };\n      return null;\n    }\n    const match = stdoutMarker.exec(shell.stdout);\n    const stdoutEnd = match?.index ?? shell.stdout.length;\n    const stderrEnd = shell.stderr.indexOf(stderrMarker);\n    return {\n      exitCode: Number(match?.[1] ?? '1'),\n      stdout: shell.stdout.slice(0, stdoutEnd),\n      stderr: shell.stderr.slice(0, stderrEnd < 0 ? shell.stderr.length : stderrEnd),\n    };\n  };\n\n  const runOnce = async (sandbox: NetworkSandboxSessionIface, run: ShellRunArgsIface) =>\n    sandbox.run({\n      command: run.command,\n      shell: true,\n      cwd: run.cwd,\n      env: run.env,\n      timeoutMs: run.timeoutMs,\n      abortSignal: run.signal,\n    });\n\n  const runPersistent = async (run: ShellRunArgsIface): Promise<SandboxRunResultIface> => {\n    run.signal?.throwIfAborted();\n    const sandbox = await args.getSandbox();\n    if (mode === SandboxShellMode.PerCommand) return runOnce(sandbox, run);\n    const fresh = live == null || live.exited;\n    if (fresh) {\n      try {\n        live = await start(sandbox);\n      } catch {\n        mode = SandboxShellMode.PerCommand;\n        return runOnce(sandbox, run);\n      }\n      // Probe once so a sandbox without bash falls back instead of hanging.\n      const probe = await exchange(live, { command: 'true', timeoutMs: STARTUP_TIMEOUT_MS });\n      if (probe == null || 'timedOut' in probe) {\n        await live.process.kill().catch(() => undefined);\n        live = null;\n        mode = SandboxShellMode.PerCommand;\n        return runOnce(sandbox, run);\n      }\n    }\n    const shell = live;\n    if (shell == null) return runOnce(sandbox, run);\n    const abort = (): void => {\n      void shell.process.kill().catch(() => undefined);\n    };\n    run.signal?.addEventListener('abort', abort, { once: true });\n    let result: Awaited<ReturnType<typeof exchange>>;\n    try {\n      result = await exchange(shell, run);\n    } finally {\n      run.signal?.removeEventListener('abort', abort);\n    }\n    if (run.signal?.aborted === true) {\n      live = null;\n      run.signal.throwIfAborted();\n    }\n    if (result == null) {\n      // The command ended the shell (`exit`); report what it printed.\n      live = null;\n      return { exitCode: shell.exitCode ?? 1, stdout: shell.stdout, stderr: shell.stderr };\n    }\n    if ('timedOut' in result) {\n      const partial = { stdout: shell.stdout, stderr: shell.stderr };\n      await shell.process.kill().catch(() => undefined);\n      live = null;\n      return {\n        exitCode: TIMEOUT_EXIT_CODE,\n        stdout: partial.stdout,\n        stderr: `${partial.stderr}\\n[timed out after ${run.timeoutMs ?? 0} ms; the shell was restarted]`,\n      };\n    }\n    return result;\n  };\n\n  return {\n    run: (run) => {\n      const next = queue.then(\n        () => runPersistent(run),\n        () => runPersistent(run),\n      );\n      queue = next.catch(() => undefined);\n      return next;\n    },\n    close: async () => {\n      const shell = live;\n      live = null;\n      await shell?.process.kill().catch(() => undefined);\n    },\n    persistent: () => mode === SandboxShellMode.Persistent && live != null,\n  };\n};\n"],
+  "mappings": "AAAA,SAAS,eAAe,kBAAkB;AAC1C,SAAS,kBAAkB;AAcpB,IAAK,mBAAL,kBAAKA,sBAAL;AACL,EAAAA,kBAAA,gBAAa;AACb,EAAAA,kBAAA,gBAAa;AAFH,SAAAA;AAAA,GAAA;AAoBZ,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAC1B,MAAM,WAAW;AAWjB,MAAM,iBAAiB,MAAM,iBAAiB,OAAO,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAEnF,MAAM,WAAW,OAAO,QAAoC,WAAmC;AAC7F,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,OAAO,UAAU;AAChC,MAAI;AACF,eAAS;AACP,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,aAAO,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,IAChD;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,qBAAqB,CAAC,SAGV;AACvB,MAAI,OAAO,KAAK,QAAQ;AACxB,MAAI,OAA8B;AAClC,MAAI,QAA0B,QAAQ,QAAQ;AAE9C,QAAM,SAAS,CAAC,UAA0B;AACxC,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU;AAChB,cAAU;AAAA,EACZ;AAEA,QAAM,QAAQ,OAAO,YAAiE;AACpF,UAAM,UAAU,MAAM,QAAQ,MAAM;AAAA,MAClC,SAAS;AAAA,MACT,MAAM,CAAC,eAAe,QAAQ;AAAA,MAC9B,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,QAAwB;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AACA,SAAK,SAAS,QAAQ,QAAQ,CAAC,SAAS;AACtC,YAAM,UAAU;AAChB,aAAO,KAAK;AAAA,IACd,CAAC;AACD,SAAK,SAAS,QAAQ,QAAQ,CAAC,SAAS;AACtC,YAAM,UAAU;AAChB,aAAO,KAAK;AAAA,IACd,CAAC;AACD,YAAQ,KAAK,EAAE;AAAA,MACb,CAAC,WAAW;AACV,cAAM,SAAS;AACf,cAAM,WAAW,OAAO;AACxB,eAAO,KAAK;AAAA,MACd;AAAA,MACA,MAAM;AACJ,cAAM,SAAS;AACf,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,CACd,OACA,MACA,aAEA,IAAI,QAAiB,CAAC,YAAY;AAChC,UAAM,QACJ,YAAY,OACR,OACA,WAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAC1E,UAAM,QAAQ,MAAM;AAClB,UAAI,KAAK,KAAK,MAAM,QAAQ;AAC1B,YAAI,SAAS,KAAM,cAAa,KAAK;AACrC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACA,YAAM,UAAU;AAAA,IAClB;AACA,UAAM;AAAA,EACR,CAAC;AAIH,QAAM,WAAW,OACf,OACA,QAC+D;AAC/D,UAAM,WAAW,eAAe;AAChC,UAAM,UAAU,OAAO,QAAQ,IAAI,OAAO,CAAC,CAAC,EACzC,OAAO,CAAC,CAAC,GAAG,MAAM,SAAS,KAAK,GAAG,CAAC,EACpC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,UAAU,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,CAAI,EAC5D,KAAK,EAAE;AACV,UAAM,KAAK,IAAI,OAAO,OAAO,KAAK,SAAS,WAAW,IAAI,GAAG,CAAC;AAE9D,UAAM,QAAQ,GAAG,EAAE;AAAA,EAAM,IAAI,OAAO;AAAA;AACpC,UAAM,OAAO,YAAY,KAAK,QAAQ;AAAA,EAAM,OAAO,GAAG,KAAK;AAAA;AAC3D,UAAM,SACJ,wBAAwB,cAAc,WAAW,IAAI,CAAC,CAAC;AAAA;AAAA,wBAE9B,QAAQ;AAAA,qBACX,QAAQ;AAAA;AAChC,UAAM,SAAS;AACf,UAAM,SAAS;AACf,QAAI;AACF,YAAM,MAAM,QAAQ,MAAM,MAAM;AAAA,IAClC,QAAQ;AAEN,aAAO;AAAA,IACT;AACA,UAAM,eAAe,IAAI,OAAO,MAAM,QAAQ,YAAY;AAC1D,UAAM,eAAe;AAAA,EAAK,QAAQ;AAAA;AAClC,UAAM,WAAW,MAAM,aAAa,KAAK,MAAM,MAAM,KAAK,MAAM,OAAO,SAAS,YAAY;AAC5F,UAAM,WAAW,IAAI,aAAa,OAAO,OAAO,KAAK,IAAI,IAAI,IAAI;AACjE,UAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,QAAQ;AAClD,QAAI,CAAC,IAAI;AACP,UAAI,CAAC,MAAM,OAAQ,QAAO,EAAE,UAAU,KAAK;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,aAAa,KAAK,MAAM,MAAM;AAC5C,UAAM,YAAY,OAAO,SAAS,MAAM,OAAO;AAC/C,UAAM,YAAY,MAAM,OAAO,QAAQ,YAAY;AACnD,WAAO;AAAA,MACL,UAAU,OAAO,QAAQ,CAAC,KAAK,GAAG;AAAA,MAClC,QAAQ,MAAM,OAAO,MAAM,GAAG,SAAS;AAAA,MACvC,QAAQ,MAAM,OAAO,MAAM,GAAG,YAAY,IAAI,MAAM,OAAO,SAAS,SAAS;AAAA,IAC/E;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,SAAqC,QAC1D,QAAQ,IAAI;AAAA,IACV,SAAS,IAAI;AAAA,IACb,OAAO;AAAA,IACP,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,EACnB,CAAC;AAEH,QAAM,gBAAgB,OAAO,QAA2D;AACtF,QAAI,QAAQ,eAAe;AAC3B,UAAM,UAAU,MAAM,KAAK,WAAW;AACtC,QAAI,SAAS,+BAA6B,QAAO,QAAQ,SAAS,GAAG;AACrE,UAAM,QAAQ,QAAQ,QAAQ,KAAK;AACnC,QAAI,OAAO;AACT,UAAI;AACF,eAAO,MAAM,MAAM,OAAO;AAAA,MAC5B,QAAQ;AACN,eAAO;AACP,eAAO,QAAQ,SAAS,GAAG;AAAA,MAC7B;AAEA,YAAM,QAAQ,MAAM,SAAS,MAAM,EAAE,SAAS,QAAQ,WAAW,mBAAmB,CAAC;AACrF,UAAI,SAAS,QAAQ,cAAc,OAAO;AACxC,cAAM,KAAK,QAAQ,KAAK,EAAE,MAAM,MAAM,MAAS;AAC/C,eAAO;AACP,eAAO;AACP,eAAO,QAAQ,SAAS,GAAG;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,QAAQ;AACd,QAAI,SAAS,KAAM,QAAO,QAAQ,SAAS,GAAG;AAC9C,UAAM,QAAQ,MAAY;AACxB,WAAK,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IACjD;AACA,QAAI,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC3D,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,OAAO,GAAG;AAAA,IACpC,UAAE;AACA,UAAI,QAAQ,oBAAoB,SAAS,KAAK;AAAA,IAChD;AACA,QAAI,IAAI,QAAQ,YAAY,MAAM;AAChC,aAAO;AACP,UAAI,OAAO,eAAe;AAAA,IAC5B;AACA,QAAI,UAAU,MAAM;AAElB,aAAO;AACP,aAAO,EAAE,UAAU,MAAM,YAAY,GAAG,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;AAAA,IACrF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,UAAU,EAAE,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;AAC7D,YAAM,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,MAAS;AAChD,aAAO;AACP,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,QAAQ;AAAA,QAChB,QAAQ,GAAG,QAAQ,MAAM;AAAA,mBAAsB,IAAI,aAAa,CAAC;AAAA,MACnE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,QAAQ;AACZ,YAAM,OAAO,MAAM;AAAA,QACjB,MAAM,cAAc,GAAG;AAAA,QACvB,MAAM,cAAc,GAAG;AAAA,MACzB;AACA,cAAQ,KAAK,MAAM,MAAM,MAAS;AAClC,aAAO;AAAA,IACT;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,QAAQ;AACd,aAAO;AACP,YAAM,OAAO,QAAQ,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IACnD;AAAA,IACA,YAAY,MAAM,SAAS,iCAA+B,QAAQ;AAAA,EACpE;AACF;",
+  "names": ["SandboxShellMode"]
+}

package/dist/modules/sandbox/mcp-testing.d.mts

@@ -0,0 +1,11 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import type { McpChannelEndpointIface } from "./types.mjs";
+export interface InProcessMcpChannelHooksIface {
+    onConnect?: () => void;
+    failReceive?: () => boolean;
+}
+export declare const createInProcessMcpChannelEndpoint: (args: {
+    name: string;
+    register: (server: McpServer) => void;
+    hooks?: InProcessMcpChannelHooksIface;
+}) => McpChannelEndpointIface;

package/dist/modules/sandbox/mcp-testing.mjs

@@ -0,0 +1,33 @@
+import { InMemoryTransport, parseJSONRPCMessage } from "@modelcontextprotocol/client";
+import { McpServer } from "@modelcontextprotocol/server";
+import { jsonValueSchema } from "../json.mjs";
+const createInProcessMcpChannelEndpoint = (args) => ({
+  name: args.name,
+  connect: async () => {
+    args.hooks?.onConnect?.();
+    const server = new McpServer({ name: args.name, version: "1" });
+    args.register(server);
+    const [ours, theirs] = InMemoryTransport.createLinkedPair();
+    await server.connect(theirs);
+    const inbox = [];
+    ours.onmessage = (message) => {
+      inbox.push(jsonValueSchema.parse(JSON.parse(JSON.stringify(message))));
+    };
+    await ours.start();
+    return {
+      send: async (message) => ours.send(parseJSONRPCMessage(message)),
+      receive: async () => {
+        if (args.hooks?.failReceive?.() === true) throw new Error("the MCP pipe broke");
+        return inbox.splice(0);
+      },
+      close: async () => {
+        await ours.close();
+        await server.close();
+      }
+    };
+  }
+});
+export {
+  createInProcessMcpChannelEndpoint
+};
+//# sourceMappingURL=mcp-testing.mjs.map

package/dist/modules/sandbox/mcp-testing.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/sandbox/mcp-testing.ts"],
+  "sourcesContent": ["import { InMemoryTransport, parseJSONRPCMessage } from '@modelcontextprotocol/client';\nimport { McpServer } from '@modelcontextprotocol/server';\nimport { jsonValueSchema, type JsonValue } from \"../json.mjs\";\nimport type { McpChannelEndpointIface, McpChannelIface } from \"./types.mjs\";\n\n// A sandbox-hosted MCP server as a channel endpoint backed by an in-process MCP\n// server, as a provider whose backend relays a pipe to the sandbox's server\n// would hand it over. For tests of hosts and providers.\n\nexport interface InProcessMcpChannelHooksIface {\n  onConnect?: () => void;\n  // Fails `receive` while it returns true (a broken pipe).\n  failReceive?: () => boolean;\n}\n\nexport const createInProcessMcpChannelEndpoint = (args: {\n  name: string;\n  register: (server: McpServer) => void;\n  hooks?: InProcessMcpChannelHooksIface;\n}): McpChannelEndpointIface => ({\n  name: args.name,\n  connect: async (): Promise<McpChannelIface> => {\n    args.hooks?.onConnect?.();\n    const server = new McpServer({ name: args.name, version: '1' });\n    args.register(server);\n    const [ours, theirs] = InMemoryTransport.createLinkedPair();\n    await server.connect(theirs);\n    const inbox: JsonValue[] = [];\n    ours.onmessage = (message) => {\n      inbox.push(jsonValueSchema.parse(JSON.parse(JSON.stringify(message))));\n    };\n    await ours.start();\n    return {\n      send: async (message) => ours.send(parseJSONRPCMessage(message)),\n      receive: async () => {\n        if (args.hooks?.failReceive?.() === true) throw new Error('the MCP pipe broke');\n        return inbox.splice(0);\n      },\n      close: async () => {\n        await ours.close();\n        await server.close();\n      },\n    };\n  },\n});\n"],
+  "mappings": "AAAA,SAAS,mBAAmB,2BAA2B;AACvD,SAAS,iBAAiB;AAC1B,SAAS,uBAAuC;AAazC,MAAM,oCAAoC,CAAC,UAIlB;AAAA,EAC9B,MAAM,KAAK;AAAA,EACX,SAAS,YAAsC;AAC7C,SAAK,OAAO,YAAY;AACxB,UAAM,SAAS,IAAI,UAAU,EAAE,MAAM,KAAK,MAAM,SAAS,IAAI,CAAC;AAC9D,SAAK,SAAS,MAAM;AACpB,UAAM,CAAC,MAAM,MAAM,IAAI,kBAAkB,iBAAiB;AAC1D,UAAM,OAAO,QAAQ,MAAM;AAC3B,UAAM,QAAqB,CAAC;AAC5B,SAAK,YAAY,CAAC,YAAY;AAC5B,YAAM,KAAK,gBAAgB,MAAM,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC;AAAA,IACvE;AACA,UAAM,KAAK,MAAM;AACjB,WAAO;AAAA,MACL,MAAM,OAAO,YAAY,KAAK,KAAK,oBAAoB,OAAO,CAAC;AAAA,MAC/D,SAAS,YAAY;AACnB,YAAI,KAAK,OAAO,cAAc,MAAM,KAAM,OAAM,IAAI,MAAM,oBAAoB;AAC9E,eAAO,MAAM,OAAO,CAAC;AAAA,MACvB;AAAA,MACA,OAAO,YAAY;AACjB,cAAM,KAAK,MAAM;AACjB,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/sandbox/mcp.d.mts

@@ -0,0 +1,83 @@
+import type { FetchLike } from '@modelcontextprotocol/client';
+import { type CallToolResult } from '@modelcontextprotocol/server';
+import type { JsonObject } from "../json.mjs";
+import { SandboxAccess, ToolApproval, type ToolDescriptorIface } from "../manifest.mjs";
+import { SandboxShellMode } from "./mcp-shell.mjs";
+import { SandboxCapability, type NetworkSandboxSessionIface, type SandboxMcpCatalogIface } from "./types.mjs";
+export { COMPUTER_USE_SERVER_NAME, SandboxHostedServerKind, withHostedMcpEndpoints, type SandboxHostedServer, } from "./mcp-hosted.mjs";
+export { SandboxShellMode } from "./mcp-shell.mjs";
+export declare enum SandboxMcpTool {
+    Run = "run",
+    Spawn = "spawn",
+    ProcessOutput = "process_output",
+    ProcessInput = "process_input",
+    ProcessTerminate = "process_terminate",
+    ReadFile = "read_file",
+    WriteFile = "write_file",
+    EditFile = "edit_file",
+    ListDir = "list_dir",
+    Stat = "stat",
+    Grep = "grep",
+    Glob = "glob",
+    GetHost = "get_host"
+}
+export declare enum SandboxMcpScopeKind {
+    All = "all",
+    Hosted = "hosted",
+    ComputerUse = "computerUse",
+    LocalServer = "localServer"
+}
+export type SandboxMcpScope = {
+    kind: SandboxMcpScopeKind.All | SandboxMcpScopeKind.Hosted | SandboxMcpScopeKind.ComputerUse;
+} | {
+    kind: SandboxMcpScopeKind.LocalServer;
+    server: string;
+};
+export declare const SANDBOX_FILE_RESOURCE_SCHEME = "sandbox-file";
+export interface SandboxMcpDescriptorOptionsIface {
+    capabilities: readonly SandboxCapability[];
+    access?: SandboxAccess;
+    catalog?: SandboxMcpCatalogIface;
+    scope?: SandboxMcpScope;
+}
+export declare const sandboxMcpToolDescriptors: (options: SandboxMcpDescriptorOptionsIface) => ToolDescriptorIface[];
+export declare const sandboxMcpToolPolicyKeys: (options: SandboxMcpDescriptorOptionsIface, name: string) => string[] | null;
+export interface CreateSandboxMcpServerArgsIface extends SandboxMcpDescriptorOptionsIface {
+    getSandbox: () => Promise<NetworkSandboxSessionIface>;
+    toolPolicy?: Record<string, ToolApproval>;
+    approve?: (toolName: string, args: JsonObject) => Promise<boolean>;
+    shell?: SandboxShellMode;
+    name?: string;
+    version?: string;
+    fetch?: FetchLike;
+    limits?: Partial<SandboxMcpLimitsIface>;
+    onError?: (error: Error) => void;
+    peekSandbox?: () => NetworkSandboxSessionIface | null;
+    onCatalog?: (catalog: SandboxMcpCatalogIface) => void;
+    onProcessExit?: (exit: SandboxProcessExitIface) => void;
+}
+export interface SandboxProcessExitIface {
+    processId: string;
+    command: string;
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface SandboxMcpLimitsIface {
+    maxOutputChars: number;
+    maxInlineBytes: number;
+    processBufferBytes: number;
+    maxProcesses: number;
+    exitReportGraceMs: number;
+    exitOutputChars: number;
+}
+export interface SandboxMcpServerIface {
+    readonly descriptors: readonly ToolDescriptorIface[];
+    fetch(request: Request): Promise<Response>;
+    listTools(): ToolDescriptorIface[];
+    refreshTools(): Promise<ToolDescriptorIface[]>;
+    updateCatalog(catalog: SandboxMcpCatalogIface): void;
+    callTool(name: string, args: JsonObject, signal?: AbortSignal): Promise<CallToolResult>;
+    close(): Promise<void>;
+}
+export declare const createSandboxMcpServer: (args: CreateSandboxMcpServerArgsIface) => SandboxMcpServerIface;