@finalai/agent-provider 0.1.0

package/dist/modules/sandbox/mcp.mjs

@@ -0,0 +1,971 @@
+import {
+  createMcpHandler,
+  fromJsonSchema,
+  McpServer,
+  ResourceTemplate
+} from "@modelcontextprotocol/server";
+import * as z from "zod";
+import { SandboxAccess, ToolApproval } from "../manifest.mjs";
+import { bytesToBase64, utf8Decode } from "./bytes.mjs";
+import {
+  createHostedMcpConnections,
+  EMPTY_MCP_CATALOG,
+  hostedTools,
+  SandboxHostedServerKind
+} from "./mcp-hosted.mjs";
+import { globFiles, grepFiles } from "./mcp-search.mjs";
+import { createSandboxShell, SandboxShellMode } from "./mcp-shell.mjs";
+import { resolvePosixPath } from "./paths.mjs";
+import {
+  PortProtocol,
+  SandboxCapability,
+  SandboxEntryType
+} from "./types.mjs";
+import {
+  COMPUTER_USE_SERVER_NAME,
+  SandboxHostedServerKind as SandboxHostedServerKind2,
+  withHostedMcpEndpoints
+} from "./mcp-hosted.mjs";
+import { SandboxShellMode as SandboxShellMode2 } from "./mcp-shell.mjs";
+var SandboxMcpTool = /* @__PURE__ */ ((SandboxMcpTool2) => {
+  SandboxMcpTool2["Run"] = "run";
+  SandboxMcpTool2["Spawn"] = "spawn";
+  SandboxMcpTool2["ProcessOutput"] = "process_output";
+  SandboxMcpTool2["ProcessInput"] = "process_input";
+  SandboxMcpTool2["ProcessTerminate"] = "process_terminate";
+  SandboxMcpTool2["ReadFile"] = "read_file";
+  SandboxMcpTool2["WriteFile"] = "write_file";
+  SandboxMcpTool2["EditFile"] = "edit_file";
+  SandboxMcpTool2["ListDir"] = "list_dir";
+  SandboxMcpTool2["Stat"] = "stat";
+  SandboxMcpTool2["Grep"] = "grep";
+  SandboxMcpTool2["Glob"] = "glob";
+  SandboxMcpTool2["GetHost"] = "get_host";
+  return SandboxMcpTool2;
+})(SandboxMcpTool || {});
+var SandboxMcpScopeKind = /* @__PURE__ */ ((SandboxMcpScopeKind2) => {
+  SandboxMcpScopeKind2["All"] = "all";
+  SandboxMcpScopeKind2["Hosted"] = "hosted";
+  SandboxMcpScopeKind2["ComputerUse"] = "computerUse";
+  SandboxMcpScopeKind2["LocalServer"] = "localServer";
+  return SandboxMcpScopeKind2;
+})(SandboxMcpScopeKind || {});
+const SANDBOX_FILE_RESOURCE_SCHEME = "sandbox-file";
+const objectSchema = (properties, required) => ({
+  type: "object",
+  properties,
+  required,
+  additionalProperties: false
+});
+const str = (description) => ({ type: "string", description });
+const int = (description, minimum = 0) => ({
+  type: "integer",
+  minimum,
+  description
+});
+const envSchema = {
+  type: "object",
+  additionalProperties: { type: "string" },
+  description: "Extra environment variables for this command only."
+};
+const readOnly = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+const mutating = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: false
+};
+const tool = (args) => {
+  const annotations = {
+    title: args.title,
+    ...args.write ? mutating : readOnly
+  };
+  if (args.destructive != null) annotations.destructiveHint = args.destructive;
+  if (args.idempotent != null) annotations.idempotentHint = args.idempotent;
+  return {
+    descriptor: {
+      name: args.name,
+      description: args.description,
+      inputSchema: args.inputSchema,
+      annotations
+    },
+    capability: args.capability,
+    write: args.write,
+    policyKeys: args.policyKeys
+  };
+};
+const BUILT_IN_TOOLS = [
+  tool({
+    name: "run" /* Run */,
+    title: "Run command",
+    description: "Run a shell command in the sandbox and wait for it. The shell persists between calls (cd and exported variables carry over). Returns exit_code, stdout and stderr.",
+    inputSchema: objectSchema(
+      {
+        command: str("The bash command to run."),
+        cwd: str("Directory to run in (absolute, or relative to the working directory)."),
+        timeout_ms: int("Kill the command after this many milliseconds.", 1),
+        env: envSchema
+      },
+      ["command"]
+    ),
+    capability: SandboxCapability.Process,
+    write: true,
+    policyKeys: ["shell", "process"]
+  }),
+  tool({
+    name: "spawn" /* Spawn */,
+    title: "Start background process",
+    description: "Start a long-running command (a server, a watcher) without waiting. Returns process_id; read its output with process_output.",
+    inputSchema: objectSchema(
+      {
+        command: str("The bash command to start."),
+        cwd: str("Directory to run in."),
+        env: envSchema
+      },
+      ["command"]
+    ),
+    capability: SandboxCapability.Process,
+    write: true,
+    policyKeys: ["shell", "process"]
+  }),
+  tool({
+    name: "process_output" /* ProcessOutput */,
+    title: "Read process output",
+    description: "Read output of a process started with spawn, from byte offsets (pass the next_offset values from the previous call). Optionally waits for new output.",
+    inputSchema: objectSchema(
+      {
+        process_id: str("The id returned by spawn."),
+        stdout_offset: int("Byte offset into stdout."),
+        stderr_offset: int("Byte offset into stderr."),
+        max_bytes: int("Maximum bytes per stream to return (default 65536).", 1),
+        wait_ms: int("Wait up to this long for new output or exit (max 30000).")
+      },
+      ["process_id"]
+    ),
+    capability: SandboxCapability.Process,
+    write: false,
+    policyKeys: ["shell", "process"],
+    idempotent: false
+  }),
+  tool({
+    name: "process_input" /* ProcessInput */,
+    title: "Write process input",
+    description: "Write text to the stdin of a process started with spawn; set end to close stdin.",
+    inputSchema: objectSchema(
+      {
+        process_id: str("The id returned by spawn."),
+        data: str("Text to write."),
+        end: { type: "boolean" }
+      },
+      ["process_id"]
+    ),
+    capability: SandboxCapability.Process,
+    write: true,
+    policyKeys: ["shell", "process"],
+    destructive: false
+  }),
+  tool({
+    name: "process_terminate" /* ProcessTerminate */,
+    title: "Terminate process",
+    description: "Stop a process started with spawn.",
+    inputSchema: objectSchema(
+      {
+        process_id: str("The id returned by spawn."),
+        signal: str("Signal name (default SIGTERM).")
+      },
+      ["process_id"]
+    ),
+    capability: SandboxCapability.Process,
+    write: true,
+    policyKeys: ["shell", "process"]
+  }),
+  tool({
+    name: "read_file" /* ReadFile */,
+    title: "Read file",
+    description: "Read a text file. Use offset (1-based line) and limit (line count) for large files; large or binary files also come back as a resource link.",
+    inputSchema: objectSchema(
+      {
+        path: str("File path (absolute, or relative to the working directory)."),
+        offset: int("First line to read (1-based).", 1),
+        limit: int("Number of lines to read.", 1)
+      },
+      ["path"]
+    ),
+    capability: SandboxCapability.Files,
+    write: false,
+    policyKeys: ["files.read", "files"]
+  }),
+  tool({
+    name: "write_file" /* WriteFile */,
+    title: "Write file",
+    description: "Create or overwrite a text file. Parent directories are created.",
+    inputSchema: objectSchema({ path: str("File path."), content: str("Full file content.") }, [
+      "path",
+      "content"
+    ]),
+    capability: SandboxCapability.Files,
+    write: true,
+    policyKeys: ["files.write", "files"]
+  }),
+  tool({
+    name: "edit_file" /* EditFile */,
+    title: "Edit file",
+    description: "Replace an exact string in a file. old_string must occur exactly once unless replace_all is true; include surrounding lines to make it unique.",
+    inputSchema: objectSchema(
+      {
+        path: str("File path."),
+        old_string: str("Exact text to replace."),
+        new_string: str("Replacement text."),
+        replace_all: { type: "boolean", description: "Replace every occurrence." }
+      },
+      ["path", "old_string", "new_string"]
+    ),
+    capability: SandboxCapability.Files,
+    write: true,
+    policyKeys: ["files.write", "files"]
+  }),
+  tool({
+    name: "list_dir" /* ListDir */,
+    title: "List directory",
+    description: "List the entries of a directory (name, type, size).",
+    inputSchema: objectSchema(
+      { path: str("Directory path (default: the working directory).") },
+      []
+    ),
+    capability: SandboxCapability.Files,
+    write: false,
+    policyKeys: ["files.read", "files"]
+  }),
+  tool({
+    name: "stat" /* Stat */,
+    title: "Stat path",
+    description: "Type, size, modification time and mode of a path, or exists: false.",
+    inputSchema: objectSchema({ path: str("Path to inspect.") }, ["path"]),
+    capability: SandboxCapability.Files,
+    write: false,
+    policyKeys: ["files.read", "files"]
+  }),
+  tool({
+    name: "grep" /* Grep */,
+    title: "Search file contents",
+    description: "Search files under a path for a regular expression. Returns path:line:text matches. Skips .git and node_modules.",
+    inputSchema: objectSchema(
+      {
+        pattern: str("JavaScript regular expression."),
+        path: str("File or directory to search (default: the working directory)."),
+        glob: str('Only search files matching this glob (e.g. "*.ts").'),
+        ignore_case: { type: "boolean" },
+        max_results: int("Maximum matches (default 200).", 1)
+      },
+      ["pattern"]
+    ),
+    capability: SandboxCapability.Files,
+    write: false,
+    policyKeys: ["files.read", "files"]
+  }),
+  tool({
+    name: "glob" /* Glob */,
+    title: "Find files",
+    description: 'Find files whose path (relative to path) matches a glob such as "**/*.ts".',
+    inputSchema: objectSchema(
+      {
+        pattern: str("Glob pattern."),
+        path: str("Directory to search (default: the working directory)."),
+        max_results: int("Maximum paths (default 500).", 1)
+      },
+      ["pattern"]
+    ),
+    capability: SandboxCapability.Files,
+    write: false,
+    policyKeys: ["files.read", "files"]
+  }),
+  tool({
+    name: "get_host" /* GetHost */,
+    title: "Get port URL",
+    description: "The URL (and any required headers) at which a port served inside the sandbox is reachable.",
+    inputSchema: objectSchema(
+      {
+        port: int("Port number.", 1),
+        protocol: {
+          type: "string",
+          enum: Object.values(PortProtocol),
+          description: "Default http."
+        }
+      },
+      ["port"]
+    ),
+    capability: SandboxCapability.Ports,
+    write: false,
+    policyKeys: ["ports"]
+  })
+];
+const scopeOf = (options) => options.scope ?? { kind: "all" /* All */ };
+const hostedServersOf = (options) => {
+  if (options.access === SandboxAccess.Read) return { computerUse: false, localMcp: false };
+  const capabilities = new Set(options.capabilities);
+  const scope = scopeOf(options);
+  const computerUse = capabilities.has(SandboxCapability.ComputerUse) && scope.kind !== "localServer" /* LocalServer */;
+  const localMcp = capabilities.has(SandboxCapability.LocalMcp) && scope.kind !== "computerUse" /* ComputerUse */;
+  return scope.kind === "localServer" /* LocalServer */ ? { computerUse, localMcp, localServer: scope.server } : { computerUse, localMcp };
+};
+const hostedSpec = (hosted) => {
+  const annotations = { ...mutating, ...hosted.tool.annotations };
+  return {
+    descriptor: { ...hosted.tool, name: hosted.name, annotations },
+    capability: hosted.server.kind === SandboxHostedServerKind.ComputerUse ? SandboxCapability.ComputerUse : SandboxCapability.LocalMcp,
+    write: true,
+    policyKeys: hosted.policyKeys,
+    hosted
+  };
+};
+const toolSpecs = (options) => {
+  const capabilities = new Set(options.capabilities);
+  const builtIn = scopeOf(options).kind === "all" /* All */ ? BUILT_IN_TOOLS.filter((spec) => capabilities.has(spec.capability)) : [];
+  const visible = options.access === SandboxAccess.Read ? builtIn.filter((spec) => !spec.write) : options.access === SandboxAccess.Execute ? builtIn.filter((spec) => !spec.write || spec.capability !== SandboxCapability.Files) : builtIn;
+  const hosted = hostedTools({
+    catalog: options.catalog ?? EMPTY_MCP_CATALOG,
+    ...hostedServersOf(options),
+    taken: new Set(builtIn.map((spec) => spec.descriptor.name))
+  });
+  return [...visible, ...hosted.map(hostedSpec)];
+};
+const sandboxMcpToolDescriptors = (options) => toolSpecs(options).map((spec) => spec.descriptor);
+const sandboxMcpToolPolicyKeys = (options, name) => {
+  const spec = toolSpecs(options).find((candidate) => candidate.descriptor.name === name);
+  return spec == null ? null : [name, ...spec.policyKeys];
+};
+const DEFAULT_LIMITS = {
+  maxOutputChars: 64e3,
+  maxInlineBytes: 256 * 1024,
+  processBufferBytes: 4 * 1024 * 1024,
+  maxProcesses: 32,
+  exitReportGraceMs: 2e3,
+  exitOutputChars: 4e3
+};
+const textResult = (text) => ({ content: [{ type: "text", text }] });
+const jsonResult = (value) => textResult(JSON.stringify(value, null, 2));
+const errorResult = (message) => ({
+  content: [{ type: "text", text: message }],
+  isError: true
+});
+const truncateMiddle = (text, max) => {
+  if (text.length <= max) return text;
+  const half = Math.floor(max / 2);
+  return `${text.slice(0, half)}
+[... ${text.length - max} characters omitted ...]
+${text.slice(text.length - half)}`;
+};
+const listRequestSchema = z.object({ method: z.literal("tools/list") });
+const runArgsSchema = z.object({
+  command: z.string().min(1),
+  cwd: z.string().optional(),
+  timeout_ms: z.number().int().positive().optional(),
+  env: z.record(z.string(), z.string()).optional()
+});
+const spawnArgsSchema = runArgsSchema.omit({ timeout_ms: true });
+const processOutputArgsSchema = z.object({
+  process_id: z.string().min(1),
+  stdout_offset: z.number().int().nonnegative().optional(),
+  stderr_offset: z.number().int().nonnegative().optional(),
+  max_bytes: z.number().int().positive().optional(),
+  wait_ms: z.number().int().nonnegative().optional()
+});
+const processInputArgsSchema = z.object({
+  process_id: z.string().min(1),
+  data: z.string().optional(),
+  end: z.boolean().optional()
+});
+const processTerminateArgsSchema = z.object({
+  process_id: z.string().min(1),
+  signal: z.string().optional()
+});
+const readFileArgsSchema = z.object({
+  path: z.string().min(1),
+  offset: z.number().int().positive().optional(),
+  limit: z.number().int().positive().optional()
+});
+const writeFileArgsSchema = z.object({ path: z.string().min(1), content: z.string() });
+const editFileArgsSchema = z.object({
+  path: z.string().min(1),
+  old_string: z.string().min(1),
+  new_string: z.string(),
+  replace_all: z.boolean().optional()
+});
+const pathArgsSchema = z.object({ path: z.string().min(1) });
+const listDirArgsSchema = z.object({ path: z.string().optional() });
+const grepArgsSchema = z.object({
+  pattern: z.string().min(1),
+  path: z.string().optional(),
+  glob: z.string().optional(),
+  ignore_case: z.boolean().optional(),
+  max_results: z.number().int().positive().optional()
+});
+const globArgsSchema = z.object({
+  pattern: z.string().min(1),
+  path: z.string().optional(),
+  max_results: z.number().int().positive().optional()
+});
+const getHostArgsSchema = z.object({
+  port: z.number().int().min(1).max(65535),
+  protocol: z.nativeEnum(PortProtocol).optional()
+});
+const appendOutput = (buffer, chunk, cap) => {
+  buffer.chunks.push(chunk);
+  buffer.size += chunk.byteLength;
+  while (buffer.size > cap && buffer.chunks.length > 1) {
+    const dropped = buffer.chunks.shift();
+    if (dropped == null) break;
+    buffer.size -= dropped.byteLength;
+    buffer.base += dropped.byteLength;
+  }
+};
+const readOutput = (buffer, offset, maxBytes) => {
+  const start = Math.max(offset, buffer.base);
+  const end = buffer.base + buffer.size;
+  const out = new Uint8Array(Math.max(0, Math.min(end - start, maxBytes)));
+  let position = buffer.base;
+  let written = 0;
+  for (const chunk of buffer.chunks) {
+    const chunkEnd = position + chunk.byteLength;
+    if (chunkEnd > start && written < out.byteLength) {
+      const from = Math.max(0, start - position);
+      const take = Math.min(chunk.byteLength - from, out.byteLength - written);
+      out.set(chunk.subarray(from, from + take), written);
+      written += take;
+    }
+    position = chunkEnd;
+  }
+  return {
+    data: utf8Decode(out),
+    offset: start,
+    next_offset: start + written,
+    skipped: start - offset,
+    available: end
+  };
+};
+const createSandboxMcpServer = (args) => {
+  const limits = { ...DEFAULT_LIMITS, ...args.limits };
+  let catalog = args.catalog ?? EMPTY_MCP_CATALOG;
+  let specs = toolSpecs({ ...args, catalog });
+  let byName = new Map(specs.map((spec) => [spec.descriptor.name, spec]));
+  const processes = /* @__PURE__ */ new Map();
+  const served = hostedServersOf(args);
+  let handler = null;
+  let learning = null;
+  let discovering = false;
+  const checked = /* @__PURE__ */ new Set();
+  const asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+  const reportError = (error) => args.onError?.(error);
+  const mergeCatalog = (next) => {
+    const merged = {
+      computerUse: next.computerUse ?? catalog.computerUse,
+      localMcp: next.localMcp ?? catalog.localMcp
+    };
+    if (JSON.stringify(merged) === JSON.stringify(catalog)) return false;
+    catalog = merged;
+    specs = toolSpecs({ ...args, catalog });
+    byName = new Map(specs.map((spec) => [spec.descriptor.name, spec]));
+    handler?.notify.toolsChanged();
+    return true;
+  };
+  const unknownCatalogs = () => ({
+    computerUse: served.computerUse && catalog.computerUse == null,
+    localMcp: served.localMcp && catalog.localMcp == null
+  });
+  const connections = createHostedMcpConnections({
+    getSandbox: () => sandboxFor(),
+    fetch: args.fetch,
+    name: args.name,
+    version: args.version
+  });
+  const learnFrom = (sandbox) => {
+    const needed = unknownCatalogs();
+    if (!needed.computerUse && !needed.localMcp) return Promise.resolve();
+    learning ??= (async () => {
+      try {
+        if (mergeCatalog(await connections.learn(sandbox, needed))) args.onCatalog?.(catalog);
+      } finally {
+        learning = null;
+      }
+    })();
+    return learning;
+  };
+  const sandboxFor = async () => {
+    const sandbox = await args.getSandbox();
+    learnFrom(sandbox).catch((cause) => reportError(asError(cause)));
+    return sandbox;
+  };
+  const beforeList = async (waitForDiscovery = false) => {
+    const needed = unknownCatalogs();
+    if (!needed.computerUse && !needed.localMcp) return;
+    const live = args.peekSandbox?.() ?? null;
+    if (live != null) {
+      const discovered = learnFrom(live).catch((cause) => reportError(asError(cause)));
+      if (waitForDiscovery || scopeOf(args).kind !== "all" /* All */) await discovered;
+      return;
+    }
+    if (discovering) return;
+    discovering = true;
+    sandboxFor().then((sandbox) => learnFrom(sandbox)).catch((cause) => {
+      discovering = false;
+      reportError(asError(cause));
+    });
+  };
+  const checkCatalog = (server) => {
+    const key = server.kind === SandboxHostedServerKind.Local ? `local:${server.name}` : "cu";
+    if (checked.has(key)) return;
+    checked.add(key);
+    void (async () => {
+      const tools = await connections.tools(server);
+      const next = server.kind === SandboxHostedServerKind.ComputerUse ? { computerUse: tools } : catalog.localMcp == null ? {} : { localMcp: { ...catalog.localMcp, [server.name]: tools } };
+      if (mergeCatalog(next)) args.onCatalog?.(catalog);
+    })().catch((cause) => {
+      checked.delete(key);
+      reportError(asError(cause));
+    });
+  };
+  const shell = createSandboxShell({ getSandbox: sandboxFor, mode: args.shell });
+  const isAllowed = async (spec, name, input) => {
+    for (const key of [name, ...spec.policyKeys]) {
+      const decision = args.toolPolicy?.[key];
+      if (decision === ToolApproval.Allow) return true;
+      if (decision === ToolApproval.Ask)
+        return args.approve == null ? false : args.approve(name, input);
+    }
+    return true;
+  };
+  const backgroundProcess = (id) => {
+    const entry = processes.get(id);
+    if (entry == null) throw new Error(`no process ${id}; start one with spawn`);
+    return entry;
+  };
+  const notifyProcess = (entry) => {
+    for (const listener of [...entry.changed]) listener();
+  };
+  const tailOf = (buffer) => {
+    const end = buffer.base + buffer.size;
+    const text = readOutput(
+      buffer,
+      end - limits.exitOutputChars * 4,
+      limits.exitOutputChars * 4
+    ).data;
+    return text.length <= limits.exitOutputChars ? text : text.slice(text.length - limits.exitOutputChars);
+  };
+  let closed = false;
+  const reportExit = (id, entry) => {
+    const report = args.onProcessExit;
+    if (report == null) return;
+    setTimeout(() => {
+      if (closed || entry.exitSeen) return;
+      entry.exitSeen = true;
+      report({
+        processId: id,
+        command: entry.command,
+        exitCode: entry.exitCode,
+        stdout: tailOf(entry.stdout),
+        stderr: tailOf(entry.stderr)
+      });
+    }, limits.exitReportGraceMs);
+  };
+  const pumpOutput = async (entry, stream, buffer) => {
+    const reader = stream.getReader();
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        appendOutput(buffer, value, limits.processBufferBytes);
+        notifyProcess(entry);
+      }
+    } catch {
+    }
+  };
+  const run = async (name, rawArgs, signal) => {
+    switch (name) {
+      case "run" /* Run */: {
+        const input = runArgsSchema.parse(rawArgs);
+        const result = await shell.run({
+          command: input.command,
+          cwd: input.cwd,
+          env: input.env,
+          timeoutMs: input.timeout_ms ?? 12e4,
+          signal
+        });
+        return jsonResult({
+          exit_code: result.exitCode,
+          stdout: truncateMiddle(result.stdout, limits.maxOutputChars),
+          stderr: truncateMiddle(result.stderr, limits.maxOutputChars)
+        });
+      }
+      case "spawn" /* Spawn */: {
+        const input = spawnArgsSchema.parse(rawArgs);
+        if (processes.size >= limits.maxProcesses) {
+          for (const [id2, entry2] of processes)
+            if (entry2.exited && entry2.exitSeen) processes.delete(id2);
+        }
+        if (processes.size >= limits.maxProcesses) {
+          return errorResult(
+            `too many background processes (${limits.maxProcesses}); terminate one first`
+          );
+        }
+        const sandbox = await sandboxFor();
+        const child = await sandbox.spawn({
+          command: input.command,
+          shell: true,
+          cwd: input.cwd,
+          env: input.env
+        });
+        const id = `p${crypto.randomUUID().slice(0, 8)}`;
+        const entry = {
+          process: child,
+          stdout: { chunks: [], base: 0, size: 0 },
+          stderr: { chunks: [], base: 0, size: 0 },
+          exitCode: null,
+          exited: false,
+          changed: /* @__PURE__ */ new Set(),
+          command: input.command,
+          exitSeen: false
+        };
+        processes.set(id, entry);
+        void pumpOutput(entry, child.stdout, entry.stdout);
+        void pumpOutput(entry, child.stderr, entry.stderr);
+        child.wait().then(
+          (result) => {
+            entry.exited = true;
+            entry.exitCode = result.exitCode;
+            notifyProcess(entry);
+            reportExit(id, entry);
+          },
+          () => {
+            entry.exited = true;
+            notifyProcess(entry);
+            reportExit(id, entry);
+          }
+        );
+        return jsonResult({ process_id: id, pid: child.pid });
+      }
+      case "process_output" /* ProcessOutput */: {
+        const input = processOutputArgsSchema.parse(rawArgs);
+        const entry = backgroundProcess(input.process_id);
+        const stdoutOffset = input.stdout_offset ?? 0;
+        const stderrOffset = input.stderr_offset ?? 0;
+        const hasNews = () => entry.exited || entry.stdout.base + entry.stdout.size > stdoutOffset || entry.stderr.base + entry.stderr.size > stderrOffset;
+        const waitMs = Math.min(input.wait_ms ?? 0, 3e4);
+        if (waitMs > 0 && !hasNews()) {
+          await new Promise((resolve) => {
+            const done = () => {
+              clearTimeout(timer);
+              entry.changed.delete(listener);
+              signal?.removeEventListener("abort", done);
+              resolve();
+            };
+            const listener = () => {
+              if (hasNews()) done();
+            };
+            const timer = setTimeout(done, waitMs);
+            entry.changed.add(listener);
+            signal?.addEventListener("abort", done, { once: true });
+          });
+        }
+        const maxBytes = input.max_bytes ?? 65536;
+        if (entry.exited) entry.exitSeen = true;
+        return jsonResult({
+          stdout: readOutput(entry.stdout, stdoutOffset, maxBytes),
+          stderr: readOutput(entry.stderr, stderrOffset, maxBytes),
+          running: !entry.exited,
+          exit_code: entry.exitCode
+        });
+      }
+      case "process_input" /* ProcessInput */: {
+        const input = processInputArgsSchema.parse(rawArgs);
+        const entry = backgroundProcess(input.process_id);
+        await entry.process.write(input.data ?? "", { end: input.end === true });
+        return jsonResult({ written: input.data?.length ?? 0, stdin_closed: input.end === true });
+      }
+      case "process_terminate" /* ProcessTerminate */: {
+        const input = processTerminateArgsSchema.parse(rawArgs);
+        const entry = backgroundProcess(input.process_id);
+        entry.exitSeen = true;
+        await entry.process.kill(input.signal);
+        const result = await entry.process.wait().catch(() => ({ exitCode: entry.exitCode ?? -1 }));
+        processes.delete(input.process_id);
+        return jsonResult({ process_id: input.process_id, exit_code: result.exitCode });
+      }
+      case "read_file" /* ReadFile */: {
+        const input = readFileArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const path = resolvePosixPath(sandbox.defaultWorkingDirectory, input.path);
+        const stat = await sandbox.stat({ path, abortSignal: signal });
+        if (stat == null) return errorResult(`${path}: no such file`);
+        if (stat.type === SandboxEntryType.Directory)
+          return errorResult(`${path} is a directory; use list_dir`);
+        const link = {
+          type: "resource_link",
+          uri: `${SANDBOX_FILE_RESOURCE_SCHEME}://${encodeURI(path)}`,
+          name: path.split("/").pop() ?? path,
+          size: stat.size
+        };
+        const ranged = input.offset != null || input.limit != null;
+        const startLine = input.offset ?? 1;
+        const endLine = input.limit == null ? void 0 : startLine + input.limit - 1;
+        if (!ranged && stat.size > limits.maxInlineBytes) {
+          const head = await sandbox.readTextFile({
+            path,
+            startLine: 1,
+            endLine: 200,
+            abortSignal: signal
+          }) ?? "";
+          return {
+            content: [
+              {
+                type: "text",
+                text: `${path} is ${stat.size} bytes, too large to return whole. First 200 lines below; read more with offset and limit, or fetch the resource.
+
+${truncateMiddle(head, limits.maxOutputChars)}`
+              },
+              link
+            ]
+          };
+        }
+        const text = await sandbox.readTextFile({
+          path,
+          startLine: ranged ? startLine : void 0,
+          endLine,
+          abortSignal: signal
+        });
+        if (text == null) return errorResult(`${path}: no such file`);
+        if (text.includes("\0")) {
+          return {
+            content: [
+              { type: "text", text: `${path} is a binary file (${stat.size} bytes).` },
+              link
+            ]
+          };
+        }
+        return textResult(
+          truncateMiddle(text, Math.max(limits.maxOutputChars, limits.maxInlineBytes))
+        );
+      }
+      case "write_file" /* WriteFile */: {
+        const input = writeFileArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const path = resolvePosixPath(sandbox.defaultWorkingDirectory, input.path);
+        await sandbox.writeTextFile({ path, content: input.content, abortSignal: signal });
+        return textResult(
+          `Wrote ${new TextEncoder().encode(input.content).byteLength} bytes to ${path}`
+        );
+      }
+      case "edit_file" /* EditFile */: {
+        const input = editFileArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const path = resolvePosixPath(sandbox.defaultWorkingDirectory, input.path);
+        const text = await sandbox.readTextFile({ path, abortSignal: signal });
+        if (text == null) return errorResult(`${path}: no such file`);
+        const count = text.split(input.old_string).length - 1;
+        if (count === 0) return errorResult(`old_string was not found in ${path}`);
+        if (count > 1 && input.replace_all !== true) {
+          return errorResult(
+            `old_string occurs ${count} times in ${path}; add surrounding context or set replace_all`
+          );
+        }
+        const next = input.replace_all === true ? text.split(input.old_string).join(input.new_string) : text.replace(input.old_string, () => input.new_string);
+        await sandbox.writeTextFile({ path, content: next, abortSignal: signal });
+        return textResult(
+          `Replaced ${input.replace_all === true ? count : 1} occurrence(s) in ${path}`
+        );
+      }
+      case "list_dir" /* ListDir */: {
+        const input = listDirArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const path = resolvePosixPath(sandbox.defaultWorkingDirectory, input.path ?? ".");
+        const entries = await sandbox.readDir({ path, abortSignal: signal });
+        return jsonResult({
+          path,
+          entries: entries.map((entry) => ({
+            name: entry.name,
+            type: entry.type,
+            size: entry.size
+          }))
+        });
+      }
+      case "stat" /* Stat */: {
+        const input = pathArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const path = resolvePosixPath(sandbox.defaultWorkingDirectory, input.path);
+        const stat = await sandbox.stat({ path, abortSignal: signal });
+        return jsonResult(stat == null ? { path, exists: false } : { exists: true, ...stat });
+      }
+      case "grep" /* Grep */: {
+        const input = grepArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const result = await grepFiles({
+          sandbox,
+          cwd: sandbox.defaultWorkingDirectory,
+          pattern: input.pattern,
+          path: input.path,
+          glob: input.glob,
+          ignoreCase: input.ignore_case,
+          maxResults: input.max_results ?? 200,
+          signal
+        });
+        const lines = result.matches.map((match) => `${match.path}:${match.line}:${match.text}`);
+        if (result.truncated) lines.push("[results truncated]");
+        return textResult(lines.length === 0 ? "No matches." : lines.join("\n"));
+      }
+      case "glob" /* Glob */: {
+        const input = globArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const result = await globFiles({
+          sandbox,
+          cwd: sandbox.defaultWorkingDirectory,
+          pattern: input.pattern,
+          path: input.path,
+          maxResults: input.max_results ?? 500,
+          signal
+        });
+        const lines = [...result.paths];
+        if (result.truncated) lines.push("[results truncated]");
+        return textResult(lines.length === 0 ? "No files matched." : lines.join("\n"));
+      }
+      case "get_host" /* GetHost */: {
+        const input = getHostArgsSchema.parse(rawArgs);
+        const sandbox = await sandboxFor();
+        const endpoint = await sandbox.getPortEndpoint({
+          port: input.port,
+          protocol: input.protocol
+        });
+        return jsonResult({ url: endpoint.url, headers: endpoint.headers ?? {} });
+      }
+      default:
+        return errorResult(`unknown tool ${name}`);
+    }
+  };
+  const callTool = async (name, rawArgs, signal) => {
+    const spec = byName.get(name);
+    if (spec == null) return errorResult(`unknown tool ${name}`);
+    if (!await isAllowed(spec, name, rawArgs)) return errorResult(`${name} was not approved`);
+    try {
+      if (spec.hosted != null) {
+        try {
+          return await connections.call(spec.hosted.server, spec.hosted.tool.name, rawArgs);
+        } finally {
+          checkCatalog(spec.hosted.server);
+        }
+      }
+      return await run(name, rawArgs, signal);
+    } catch (error) {
+      if (error instanceof z.ZodError)
+        return errorResult(`invalid arguments: ${z.prettifyError(error)}`);
+      return errorResult(error instanceof Error ? error.message : String(error));
+    }
+  };
+  const readResource = async (uri) => {
+    const path = decodeURI(uri.pathname);
+    const spec = byName.get("read_file" /* ReadFile */);
+    if (spec == null || !await isAllowed(spec, "read_file" /* ReadFile */, { path }))
+      throw new Error(`${path}: file read was not approved`);
+    const sandbox = await sandboxFor();
+    const bytes = await sandbox.readBinaryFile({ path });
+    if (bytes == null) throw new Error(`${path}: no such file`);
+    const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    if (!text.includes("\0") && !text.includes("\uFFFD")) {
+      return { contents: [{ uri: uri.href, mimeType: "text/plain", text }] };
+    }
+    return {
+      contents: [
+        { uri: uri.href, mimeType: "application/octet-stream", blob: bytesToBase64(bytes) }
+      ]
+    };
+  };
+  const buildServer = () => {
+    const server = new McpServer(
+      { name: args.name ?? "final-sandbox", version: args.version ?? "1" },
+      // The hosted servers' tools can follow the first list (see beforeList).
+      {
+        capabilities: {
+          tools: { listChanged: served.computerUse || served.localMcp },
+          resources: {}
+        }
+      }
+    );
+    for (const spec of specs) {
+      server.registerTool(
+        spec.descriptor.name,
+        {
+          title: spec.descriptor.annotations?.title,
+          description: spec.descriptor.description,
+          inputSchema: fromJsonSchema(spec.descriptor.inputSchema),
+          annotations: spec.descriptor.annotations
+        },
+        (input, ctx) => callTool(spec.descriptor.name, input, ctx.mcpReq.signal)
+      );
+    }
+    if (args.capabilities.includes(SandboxCapability.Files)) {
+      server.registerResource(
+        "sandbox-file",
+        new ResourceTemplate(`${SANDBOX_FILE_RESOURCE_SCHEME}://{+path}`, { list: void 0 }),
+        { description: "A file in the sandbox, by absolute path." },
+        (uri) => readResource(uri)
+      );
+    }
+    return server;
+  };
+  const isListRequest = async (request) => {
+    if (request.method !== "POST") return false;
+    try {
+      const body = await request.clone().json();
+      return (Array.isArray(body) ? body : [body]).some(
+        (message) => listRequestSchema.safeParse(message).success
+      );
+    } catch {
+      return false;
+    }
+  };
+  const getHandler = () => {
+    handler ??= createMcpHandler(() => buildServer(), { onerror: args.onError });
+    return handler;
+  };
+  return {
+    get descriptors() {
+      return specs.map((spec) => spec.descriptor);
+    },
+    fetch: async (request) => {
+      if (await isListRequest(request)) await beforeList();
+      return getHandler().fetch(request);
+    },
+    listTools: () => specs.map((spec) => spec.descriptor),
+    refreshTools: async () => {
+      await beforeList(true);
+      return specs.map((spec) => spec.descriptor);
+    },
+    updateCatalog: (next) => {
+      mergeCatalog(next);
+    },
+    callTool,
+    close: async () => {
+      closed = true;
+      await shell.close();
+      for (const entry of processes.values()) await entry.process.kill().catch(() => void 0);
+      processes.clear();
+      await connections.close();
+      await handler?.close();
+    }
+  };
+};
+export {
+  COMPUTER_USE_SERVER_NAME,
+  SANDBOX_FILE_RESOURCE_SCHEME,
+  SandboxHostedServerKind2 as SandboxHostedServerKind,
+  SandboxMcpScopeKind,
+  SandboxMcpTool,
+  SandboxShellMode2 as SandboxShellMode,
+  createSandboxMcpServer,
+  sandboxMcpToolDescriptors,
+  sandboxMcpToolPolicyKeys,
+  withHostedMcpEndpoints
+};
+//# sourceMappingURL=mcp.mjs.map