@geminixiang/mikan 1.0.0-beta.21 → 1.0.0-beta.22

package/dist/sandbox/identity.js

@@ -1,10 +1,26 @@
-/**
- * Runtime actor identity: the one key that names a conversation's vault dir,
- * docker container and network, and cloudflare sandbox suffix. Everything
- * that needs such a name consumes actorKey(); nothing may re-derive or
- * re-sanitize it — two sanitizers with divergent outputs used to make a
- * container/vault mismatch a silent wrong-identity bug rather than an error.
- */
+import { createHash } from "node:crypto";
+const IDENTITY_HASH_LENGTH = 12;
+export function credentialAuthorizationKey(baseConfig, ids) {
+    if (baseConfig.type === "host")
+        return identityKey("user", ids.userId);
+    if (baseConfig.type === "container")
+        return identityKey("container", baseConfig.container);
+    return identityKey("conversation", ids.conversationId);
+}
+export function legacyExactCredentialAuthorizationKey(baseConfig, ids) {
+    if (baseConfig.type === "host")
+        return ids.userId;
+    if (baseConfig.type === "container")
+        return `container-${baseConfig.container}`;
+    return undefined;
+}
+export function runtimeResourceKey(baseConfig, ids) {
+    if (baseConfig.type === "container")
+        return identityKey("container", baseConfig.container);
+    if (baseConfig.type === "host")
+        return identityKey("user", ids.userId);
+    return identityKey("conversation", ids.conversationId);
+}
 export function sanitizeIdentitySegment(value) {
     const sanitized = value
         .toLowerCase()
@@ -12,25 +28,15 @@ export function sanitizeIdentitySegment(value) {
         .replace(/^-+|-+$/g, "");
     return sanitized || "unknown";
 }
-/**
- * The actor key for a sandbox config: per-conversation for managed sandboxes
- * (image/gondolin/cloudflare/firecracker), the fixed container name for a shared
- * container, and the platform user id on the host.
- */
-export function actorKey(baseConfig, ids) {
-    if (baseConfig.type === "container") {
-        return `container-${baseConfig.container}`;
-    }
-    if (baseConfig.type === "image" ||
-        baseConfig.type === "gondolin" ||
-        baseConfig.type === "cloudflare" ||
-        baseConfig.type === "firecracker") {
-        return sanitizeIdentitySegment(ids.conversationId);
-    }
-    return ids.userId;
+export function scopeCloudflareSandboxId(baseId, resourceKey) {
+    return `${baseId}-${resourceKey}`;
 }
-/** Scope a base cloudflare sandbox id to one actor key. */
-export function scopeCloudflareSandboxId(baseId, actorVaultKey) {
-    return `${baseId}-${sanitizeIdentitySegment(actorVaultKey)}`;
+function identityKey(kind, value) {
+    const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, "") || "unknown";
+    const hash = createHash("sha256")
+        .update(`${kind}\0${value}`)
+        .digest("hex")
+        .slice(0, IDENTITY_HASH_LENGTH);
+    return `${readable}-${hash}`;
 }
 //# sourceMappingURL=identity.js.map

package/dist/sandbox/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,aAAa,UAAU,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,IACE,UAAU,CAAC,IAAI,KAAK,OAAO;QAC3B,UAAU,CAAC,IAAI,KAAK,UAAU;QAC9B,UAAU,CAAC,IAAI,KAAK,YAAY;QAChC,UAAU,CAAC,IAAI,KAAK,aAAa,EACjC,CAAC;QACD,OAAO,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,aAAqB;IAC5E,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,aAAa,CAAC,EAAE,CAAC;AAC/D,CAAC","sourcesContent":["import type { SandboxConfig } from \"./types.js\";\n\n/**\n * Runtime actor identity: the one key that names a conversation's vault dir,\n * docker container and network, and cloudflare sandbox suffix. Everything\n * that needs such a name consumes actorKey(); nothing may re-derive or\n * re-sanitize it — two sanitizers with divergent outputs used to make a\n * container/vault mismatch a silent wrong-identity bug rather than an error.\n */\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\n/**\n * The actor key for a sandbox config: per-conversation for managed sandboxes\n * (image/gondolin/cloudflare/firecracker), the fixed container name for a shared\n * container, and the platform user id on the host.\n */\nexport function actorKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; conversationId: string },\n): string {\n  if (baseConfig.type === \"container\") {\n    return `container-${baseConfig.container}`;\n  }\n  if (\n    baseConfig.type === \"image\" ||\n    baseConfig.type === \"gondolin\" ||\n    baseConfig.type === \"cloudflare\" ||\n    baseConfig.type === \"firecracker\"\n  ) {\n    return sanitizeIdentitySegment(ids.conversationId);\n  }\n  return ids.userId;\n}\n\n/** Scope a base cloudflare sandbox id to one actor key. */\nexport function scopeCloudflareSandboxId(baseId: string, actorVaultKey: string): string {\n  return `${baseId}-${sanitizeIdentitySegment(actorVaultKey)}`;\n}\n"]}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,0BAA0B,CACxC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,aAAa,UAAU,CAAC,SAAS,EAAE,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAmB;IAC1E,OAAO,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA2C,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClC,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { SandboxConfig } from \"./types.js\";\n\nconst IDENTITY_HASH_LENGTH = 12;\n\nexport function credentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; conversationId: string },\n): string {\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  return identityKey(\"conversation\", ids.conversationId);\n}\n\nexport function legacyExactCredentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; conversationId: string },\n): string | undefined {\n  if (baseConfig.type === \"host\") return ids.userId;\n  if (baseConfig.type === \"container\") return `container-${baseConfig.container}`;\n  return undefined;\n}\n\nexport function runtimeResourceKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; conversationId: string },\n): string {\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  return identityKey(\"conversation\", ids.conversationId);\n}\n\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\nexport function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string {\n  return `${baseId}-${resourceKey}`;\n}\n\nfunction identityKey(kind: \"user\" | \"conversation\" | \"container\", value: string): string {\n  const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, \"\") || \"unknown\";\n  const hash = createHash(\"sha256\")\n    .update(`${kind}\\0${value}`)\n    .digest(\"hex\")\n    .slice(0, IDENTITY_HASH_LENGTH);\n  return `${readable}-${hash}`;\n}\n"]}

package/dist/sandbox/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../src/sandbox/image.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAyBrE,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,kBAAkB,CAIlE,CAAC"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../src/sandbox/image.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAyBrE,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,kBAAkB,CAKlE,CAAC"}

package/dist/sandbox/image.js

@@ -21,6 +21,7 @@ async function validateImageSandbox(config) {
 }
 export const imageSandboxAdapter = {
     type: "image",
+    credentials: { env: true, fileMounts: true },
     parse: parseImageSandboxArg,
     validate: validateImageSandbox,
 };

package/dist/sandbox/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/sandbox/image.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAuC;IACrE,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC","sourcesContent":["import type { ImageSandboxConfig, SandboxAdapter } from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple } from \"./utils.js\";\n\nfunction parseImageSandboxArg(value: string): ImageSandboxConfig | undefined {\n  if (!value.startsWith(\"image:\")) {\n    return undefined;\n  }\n\n  const image = value.slice(\"image:\".length);\n  if (!image) {\n    throw new SandboxError(\"Error: image sandbox requires image name (e.g., image:ubuntu:24.04)\");\n  }\n  return { type: \"image\", image };\n}\n\nasync function validateImageSandbox(config: ImageSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n  console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);\n}\n\nexport const imageSandboxAdapter: SandboxAdapter<ImageSandboxConfig> = {\n  type: \"image\",\n  parse: parseImageSandboxArg,\n  validate: validateImageSandbox,\n};\n"]}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/sandbox/image.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAuC;IACrE,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5C,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC","sourcesContent":["import type { ImageSandboxConfig, SandboxAdapter } from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple } from \"./utils.js\";\n\nfunction parseImageSandboxArg(value: string): ImageSandboxConfig | undefined {\n  if (!value.startsWith(\"image:\")) {\n    return undefined;\n  }\n\n  const image = value.slice(\"image:\".length);\n  if (!image) {\n    throw new SandboxError(\"Error: image sandbox requires image name (e.g., image:ubuntu:24.04)\");\n  }\n  return { type: \"image\", image };\n}\n\nasync function validateImageSandbox(config: ImageSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n  console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);\n}\n\nexport const imageSandboxAdapter: SandboxAdapter<ImageSandboxConfig> = {\n  type: \"image\",\n  credentials: { env: true, fileMounts: true },\n  parse: parseImageSandboxArg,\n  validate: validateImageSandbox,\n};\n"]}

package/dist/sandbox/index.d.ts

@@ -10,6 +10,7 @@ export { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, Host
 export { SandboxError } from "./errors.js";
 declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<import("./types.js").ImageSandboxConfig>, SandboxAdapter<import("./types.js").GondolinSandboxConfig>, SandboxAdapter<import("./types.js").FirecrackerSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
 export declare function getSandboxAdapters(): readonly [...typeof sandboxAdapters];
+export declare function getSandboxCredentialCapabilities(type: SandboxConfig["type"]): SandboxAdapter["credentials"];
 export declare function parseSandboxArg(value: string): SandboxConfig;
 export declare function validateSandbox(config: SandboxConfig): Promise<void>;
 /**

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAGzE,OAAO,EAAE,wBAAwB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9F,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,QAAA,MAAM,eAAe,kXAOX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CASV;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAMpB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAGzE,OAAO,EAAE,wBAAwB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9F,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,QAAA,MAAM,eAAe,kXAOX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,aAAa,CAAC,CAI/B;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CASV;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAMpB"}

package/dist/sandbox/index.js

@@ -21,6 +21,12 @@ const sandboxAdapterByType = new Map(sandboxAdapters.map((adapter) => [adapter.t
 export function getSandboxAdapters() {
     return sandboxAdapters;
 }
+export function getSandboxCredentialCapabilities(type) {
+    const adapter = sandboxAdapterByType.get(type);
+    if (!adapter)
+        throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);
+    return adapter.credentials;
+}
 export function parseSandboxArg(value) {
     for (const adapter of sandboxAdapters) {
         const config = adapter.parse(value);

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAiC,MAAM,yBAAyB,CAAC;AAYlG,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,wJAAwJ,CAC9L,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,aAA4B,EAC5B,iBAAyB;IAEzB,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { FirecrackerExecutor, firecrackerSandboxAdapter } from \"./firecracker.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { imageSandboxAdapter } from \"./image.js\";\nimport { GondolinExecutor, gondolinSandboxAdapter } from \"./gondolin.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\nexport { configureGondolinRuntime, type GondolinBootstrapOptions } from \"./gondolin-bootstrap.js\";\nimport type { Executor, RuntimePathContext, SandboxAdapter, SandboxConfig } from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport {\n  CloudflareSandboxExecutor,\n  ContainerExecutor,\n  FirecrackerExecutor,\n  HostExecutor,\n  GondolinExecutor,\n};\nexport { SandboxError } from \"./errors.js\";\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  gondolinSandboxAdapter,\n  firecrackerSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'gondolin:default', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n\n  await adapter.validate?.(config);\n}\n\n/**\n * Create an executor that runs commands on host, in Docker, in a microVM, in a Firecracker VM, or through a Cloudflare sandbox bridge.\n */\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n\n/**\n * The runtime path context for a sandbox config before an actor-specific\n * executor is resolved. `image` configs are unresolved by nature (the actor\n * decides the concrete container), but their mount layout is fixed, so path\n * mapping is known without resolving.\n */\nexport function getUnresolvedSandboxPathContext(\n  sandboxConfig: SandboxConfig,\n  hostWorkspaceRoot: string,\n): RuntimePathContext {\n  if (sandboxConfig.type === \"image\") {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAiC,MAAM,yBAAyB,CAAC;AAYlG,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA2B;IAE3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,GAAG,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,wJAAwJ,CAC9L,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,aAA4B,EAC5B,iBAAyB;IAEzB,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { FirecrackerExecutor, firecrackerSandboxAdapter } from \"./firecracker.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { imageSandboxAdapter } from \"./image.js\";\nimport { GondolinExecutor, gondolinSandboxAdapter } from \"./gondolin.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\nexport { configureGondolinRuntime, type GondolinBootstrapOptions } from \"./gondolin-bootstrap.js\";\nimport type { Executor, RuntimePathContext, SandboxAdapter, SandboxConfig } from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport {\n  CloudflareSandboxExecutor,\n  ContainerExecutor,\n  FirecrackerExecutor,\n  HostExecutor,\n  GondolinExecutor,\n};\nexport { SandboxError } from \"./errors.js\";\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  gondolinSandboxAdapter,\n  firecrackerSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nexport function getSandboxCredentialCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"credentials\"] {\n  const adapter = sandboxAdapterByType.get(type);\n  if (!adapter) throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);\n  return adapter.credentials;\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'gondolin:default', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n\n  await adapter.validate?.(config);\n}\n\n/**\n * Create an executor that runs commands on host, in Docker, in a microVM, in a Firecracker VM, or through a Cloudflare sandbox bridge.\n */\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n\n/**\n * The runtime path context for a sandbox config before an actor-specific\n * executor is resolved. `image` configs are unresolved by nature (the actor\n * decides the concrete container), but their mount layout is fixed, so path\n * mapping is known without resolving.\n */\nexport function getUnresolvedSandboxPathContext(\n  sandboxConfig: SandboxConfig,\n  hostWorkspaceRoot: string,\n): RuntimePathContext {\n  if (sandboxConfig.type === \"image\") {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);\n}\n"]}

package/dist/sandbox/types.d.ts

@@ -88,8 +88,13 @@ export interface ExecResult {
     stderr: string;
     code: number;
 }
+export interface SandboxCredentialCapabilities {
+    env: boolean;
+    fileMounts: boolean;
+}
 export interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {
     type: TConfig["type"];
+    credentials: SandboxCredentialCapabilities;
     parse(value: string): TConfig | undefined;
     validate?(config: TConfig): Promise<void>;
     createExecutor?(config: TConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;

package/dist/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAErE;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D;;OAEG;IACH,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAErE;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D;;OAEG;IACH,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}

package/dist/sandbox/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["export type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | GondolinSandboxConfig\n  | FirecrackerSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface GondolinSandboxConfig {\n  type: \"gondolin\";\n  profile: \"default\" | \"remote\";\n  /** Local-only runtime details supplied after actor/workspace resolution. */\n  image?: string;\n  workspacePath?: string;\n  mounts?: Array<{ source: string; target: string }>;\n  instanceId?: string;\n  resourceKey?: string;\n}\n\nexport interface FirecrackerSandboxConfig {\n  type: \"firecracker\";\n  vmId: string;\n  hostPath: string;\n  sshUser?: string;\n  sshPort?: number;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  /**\n   * Execute a bash command.\n   */\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  /**\n   * Read a runtime file as UTF-8 text. The executor owns the transport, so\n   * file contents never pass through shell argv or extra shell parse layers.\n   */\n  readFile(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Read a runtime file as base64 (for binary content, e.g. images). Same\n   * transport ownership as readFile.\n   */\n  readFileBase64(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Write a runtime file, creating parent directories and replacing via a\n   * staging file so an aborted write never truncates the target. Like\n   * readFile, transport is the executor's concern — content must survive\n   * arbitrary quoting and ARG_MAX limits.\n   */\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;\n\n  /**\n   * Get the workspace path prefix for this executor.\n   * Host: returns the actual path.\n   * Container/Firecracker: returns /workspace.\n   */\n  getWorkspacePath(hostPath: string): string;\n\n  /**\n   * Return explicit host/control-plane/runtime path semantics for this executor.\n   */\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  /**\n   * Get the current sandbox config used by this executor.\n   */\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  /** Host-side workspace root used by mikan's control plane. */\n  hostWorkspaceRoot: string;\n  /** Workspace root as seen by bash/read/write/edit inside the runtime. */\n  runtimeWorkspaceRoot: string;\n  /** Translate a runtime path back to a host path when the runtime is host-backed. */\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  signal?: AbortSignal;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["export type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | GondolinSandboxConfig\n  | FirecrackerSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface GondolinSandboxConfig {\n  type: \"gondolin\";\n  profile: \"default\" | \"remote\";\n  /** Local-only runtime details supplied after actor/workspace resolution. */\n  image?: string;\n  workspacePath?: string;\n  mounts?: Array<{ source: string; target: string }>;\n  instanceId?: string;\n  resourceKey?: string;\n}\n\nexport interface FirecrackerSandboxConfig {\n  type: \"firecracker\";\n  vmId: string;\n  hostPath: string;\n  sshUser?: string;\n  sshPort?: number;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  /**\n   * Execute a bash command.\n   */\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  /**\n   * Read a runtime file as UTF-8 text. The executor owns the transport, so\n   * file contents never pass through shell argv or extra shell parse layers.\n   */\n  readFile(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Read a runtime file as base64 (for binary content, e.g. images). Same\n   * transport ownership as readFile.\n   */\n  readFileBase64(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Write a runtime file, creating parent directories and replacing via a\n   * staging file so an aborted write never truncates the target. Like\n   * readFile, transport is the executor's concern — content must survive\n   * arbitrary quoting and ARG_MAX limits.\n   */\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;\n\n  /**\n   * Get the workspace path prefix for this executor.\n   * Host: returns the actual path.\n   * Container/Firecracker: returns /workspace.\n   */\n  getWorkspacePath(hostPath: string): string;\n\n  /**\n   * Return explicit host/control-plane/runtime path semantics for this executor.\n   */\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  /**\n   * Get the current sandbox config used by this executor.\n   */\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  /** Host-side workspace root used by mikan's control plane. */\n  hostWorkspaceRoot: string;\n  /** Workspace root as seen by bash/read/write/edit inside the runtime. */\n  runtimeWorkspaceRoot: string;\n  /** Translate a runtime path back to a host path when the runtime is host-backed. */\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  signal?: AbortSignal;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxCredentialCapabilities {\n  env: boolean;\n  fileMounts: boolean;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  credentials: SandboxCredentialCapabilities;\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}

package/dist/sessions/session-key.d.ts

@@ -11,8 +11,17 @@
  * asserted here at every derivation instead of being assumed everywhere.
  */
 export declare function assertConversationId(conversationId: string): string;
+/** Validate the opaque scoped suffix without changing its platform value. */
+export declare function assertSessionSuffix(suffix: string): string;
 /** Build a scoped thread session key. */
 export declare function makeThreadSessionKey(conversationId: string, suffix: string): string;
+/**
+ * Validate that a platform-computed session key belongs to its conversation.
+ * The key may be the bare conversation id or one of that conversation's
+ * scoped keys; callers must not be able to select another conversation's
+ * runtime/cache entry.
+ */
+export declare function assertSessionKeyBelongsToConversation(sessionKey: string, conversationId: string): string;
 /**
  * The runtime fallback: honor a platform-computed session key, otherwise
  * scope the event to its thread (or to itself for thread-starting messages).

package/dist/sessions/session-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-key.d.ts","sourceRoot":"","sources":["../../src/sessions/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAQnE;AAED,yCAAyC;AACzC,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,MAAM,CAIT;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE"}
+{"version":3,"file":"session-key.d.ts","sourceRoot":"","sources":["../../src/sessions/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA0BH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,yCAAyC;AACzC,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,MAAM,CAYR;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,MAAM,CAKT;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE"}

package/dist/sessions/session-key.js

@@ -10,23 +10,71 @@
  * only works because conversation ids never contain ":" — that invariant is
  * asserted here at every derivation instead of being assumed everywhere.
  */
+/** Characters that can change host path structure or make identity logs ambiguous. */
+const PATH_SEPARATOR_PATTERN = /[\\/]/;
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint <= 0x1f || codePoint === 0x7f)
+            return true;
+    }
+    return false;
+}
+function assertSafeIdentityPart(value, label) {
+    if (!value || value === "." || value === "..") {
+        throw new Error(`${label} must be a non-empty identity segment (got ${JSON.stringify(value)})`);
+    }
+    if (PATH_SEPARATOR_PATTERN.test(value)) {
+        throw new Error(`${label} must not contain path separators (got ${JSON.stringify(value)})`);
+    }
+    if (containsControlCharacter(value)) {
+        throw new Error(`${label} must not contain control characters (got ${JSON.stringify(value)})`);
+    }
+    return value;
+}
 export function assertConversationId(conversationId) {
+    assertSafeIdentityPart(conversationId, "Conversation id");
     if (conversationId.includes(":")) {
         throw new Error(`Conversation id must not contain ":" (got ${JSON.stringify(conversationId)}); ` +
             "the session-key grammar reserves it for thread suffixes");
     }
     return conversationId;
 }
+/** Validate the opaque scoped suffix without changing its platform value. */
+export function assertSessionSuffix(suffix) {
+    return assertSafeIdentityPart(suffix, "Session suffix");
+}
 /** Build a scoped thread session key. */
 export function makeThreadSessionKey(conversationId, suffix) {
-    return `${assertConversationId(conversationId)}:${suffix}`;
+    return `${assertConversationId(conversationId)}:${assertSessionSuffix(suffix)}`;
+}
+/**
+ * Validate that a platform-computed session key belongs to its conversation.
+ * The key may be the bare conversation id or one of that conversation's
+ * scoped keys; callers must not be able to select another conversation's
+ * runtime/cache entry.
+ */
+export function assertSessionKeyBelongsToConversation(sessionKey, conversationId) {
+    const expectedConversationId = assertConversationId(conversationId);
+    const actualConversationId = conversationIdOf(sessionKey);
+    if (actualConversationId !== expectedConversationId) {
+        throw new Error(`Session key ${JSON.stringify(sessionKey)} does not belong to conversation ` +
+            JSON.stringify(conversationId));
+    }
+    const suffix = threadSuffixOf(sessionKey);
+    if (suffix !== null)
+        assertSessionSuffix(suffix);
+    return sessionKey;
 }
 /**
  * The runtime fallback: honor a platform-computed session key, otherwise
  * scope the event to its thread (or to itself for thread-starting messages).
  */
 export function deriveSessionKey(event) {
-    return (event.sessionKey ?? makeThreadSessionKey(event.conversationId, event.thread_ts ?? event.ts));
+    if (event.sessionKey !== undefined) {
+        return assertSessionKeyBelongsToConversation(event.sessionKey, event.conversationId);
+    }
+    return makeThreadSessionKey(event.conversationId, event.thread_ts ?? event.ts);
 }
 export function isThreadSessionKey(sessionKey) {
     return sessionKey.includes(":");

package/dist/sessions/session-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-key.js","sourceRoot":"","sources":["../../src/sessions/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,oBAAoB,CAAC,cAAsB;IACzD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK;YAC9E,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,oBAAoB,CAAC,cAAsB,EAAE,MAAc;IACzE,OAAO,GAAG,oBAAoB,CAAC,cAAc,CAAC,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC","sourcesContent":["/**\n * The session-key grammar. A session key is the conversation-scoped runtime\n * identity used to serialize and resume work (see CONTEXT.md):\n *\n *   `conversationId`            — the persistent conversation session\n *   `conversationId:suffix`     — a scoped thread session (suffix = thread\n *                                 ts / message id, opaque to this module)\n *\n * This module owns the convention; nothing else may split on \":\". The grammar\n * only works because conversation ids never contain \":\" — that invariant is\n * asserted here at every derivation instead of being assumed everywhere.\n */\n\nexport function assertConversationId(conversationId: string): string {\n  if (conversationId.includes(\":\")) {\n    throw new Error(\n      `Conversation id must not contain \":\" (got ${JSON.stringify(conversationId)}); ` +\n        \"the session-key grammar reserves it for thread suffixes\",\n    );\n  }\n  return conversationId;\n}\n\n/** Build a scoped thread session key. */\nexport function makeThreadSessionKey(conversationId: string, suffix: string): string {\n  return `${assertConversationId(conversationId)}:${suffix}`;\n}\n\n/**\n * The runtime fallback: honor a platform-computed session key, otherwise\n * scope the event to its thread (or to itself for thread-starting messages).\n */\nexport function deriveSessionKey(event: {\n  sessionKey?: string;\n  conversationId: string;\n  thread_ts?: string;\n  ts: string;\n}): string {\n  return (\n    event.sessionKey ?? makeThreadSessionKey(event.conversationId, event.thread_ts ?? event.ts)\n  );\n}\n\nexport function isThreadSessionKey(sessionKey: string): boolean {\n  return sessionKey.includes(\":\");\n}\n\n/** The conversation a session key belongs to (identity for bare keys). */\nexport function conversationIdOf(sessionKey: string): string {\n  const separator = sessionKey.indexOf(\":\");\n  return separator === -1 ? sessionKey : sessionKey.slice(0, separator);\n}\n\n/** The thread suffix of a scoped key, or null for a bare conversation key. */\nexport function threadSuffixOf(sessionKey: string): string | null {\n  const separator = sessionKey.indexOf(\":\");\n  return separator === -1 ? null : sessionKey.slice(separator + 1);\n}\n"]}
+{"version":3,"file":"session-key.js","sourceRoot":"","sources":["../../src/sessions/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,cAAsB;IACzD,sBAAsB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK;YAC9E,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,oBAAoB,CAAC,cAAsB,EAAE,MAAc;IACzE,OAAO,GAAG,oBAAoB,CAAC,cAAc,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAAkB,EAClB,cAAsB;IAEtB,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,oBAAoB,KAAK,sBAAsB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mCAAmC;YAC1E,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,qCAAqC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC","sourcesContent":["/**\n * The session-key grammar. A session key is the conversation-scoped runtime\n * identity used to serialize and resume work (see CONTEXT.md):\n *\n *   `conversationId`            — the persistent conversation session\n *   `conversationId:suffix`     — a scoped thread session (suffix = thread\n *                                 ts / message id, opaque to this module)\n *\n * This module owns the convention; nothing else may split on \":\". The grammar\n * only works because conversation ids never contain \":\" — that invariant is\n * asserted here at every derivation instead of being assumed everywhere.\n */\n\n/** Characters that can change host path structure or make identity logs ambiguous. */\nconst PATH_SEPARATOR_PATTERN = /[\\\\/]/;\n\nfunction containsControlCharacter(value: string): boolean {\n  for (const character of value) {\n    const codePoint = character.codePointAt(0)!;\n    if (codePoint <= 0x1f || codePoint === 0x7f) return true;\n  }\n  return false;\n}\n\nfunction assertSafeIdentityPart(value: string, label: string): string {\n  if (!value || value === \".\" || value === \"..\") {\n    throw new Error(`${label} must be a non-empty identity segment (got ${JSON.stringify(value)})`);\n  }\n  if (PATH_SEPARATOR_PATTERN.test(value)) {\n    throw new Error(`${label} must not contain path separators (got ${JSON.stringify(value)})`);\n  }\n  if (containsControlCharacter(value)) {\n    throw new Error(`${label} must not contain control characters (got ${JSON.stringify(value)})`);\n  }\n  return value;\n}\n\nexport function assertConversationId(conversationId: string): string {\n  assertSafeIdentityPart(conversationId, \"Conversation id\");\n  if (conversationId.includes(\":\")) {\n    throw new Error(\n      `Conversation id must not contain \":\" (got ${JSON.stringify(conversationId)}); ` +\n        \"the session-key grammar reserves it for thread suffixes\",\n    );\n  }\n  return conversationId;\n}\n\n/** Validate the opaque scoped suffix without changing its platform value. */\nexport function assertSessionSuffix(suffix: string): string {\n  return assertSafeIdentityPart(suffix, \"Session suffix\");\n}\n\n/** Build a scoped thread session key. */\nexport function makeThreadSessionKey(conversationId: string, suffix: string): string {\n  return `${assertConversationId(conversationId)}:${assertSessionSuffix(suffix)}`;\n}\n\n/**\n * Validate that a platform-computed session key belongs to its conversation.\n * The key may be the bare conversation id or one of that conversation's\n * scoped keys; callers must not be able to select another conversation's\n * runtime/cache entry.\n */\nexport function assertSessionKeyBelongsToConversation(\n  sessionKey: string,\n  conversationId: string,\n): string {\n  const expectedConversationId = assertConversationId(conversationId);\n  const actualConversationId = conversationIdOf(sessionKey);\n  if (actualConversationId !== expectedConversationId) {\n    throw new Error(\n      `Session key ${JSON.stringify(sessionKey)} does not belong to conversation ` +\n        JSON.stringify(conversationId),\n    );\n  }\n  const suffix = threadSuffixOf(sessionKey);\n  if (suffix !== null) assertSessionSuffix(suffix);\n  return sessionKey;\n}\n\n/**\n * The runtime fallback: honor a platform-computed session key, otherwise\n * scope the event to its thread (or to itself for thread-starting messages).\n */\nexport function deriveSessionKey(event: {\n  sessionKey?: string;\n  conversationId: string;\n  thread_ts?: string;\n  ts: string;\n}): string {\n  if (event.sessionKey !== undefined) {\n    return assertSessionKeyBelongsToConversation(event.sessionKey, event.conversationId);\n  }\n  return makeThreadSessionKey(event.conversationId, event.thread_ts ?? event.ts);\n}\n\nexport function isThreadSessionKey(sessionKey: string): boolean {\n  return sessionKey.includes(\":\");\n}\n\n/** The conversation a session key belongs to (identity for bare keys). */\nexport function conversationIdOf(sessionKey: string): string {\n  const separator = sessionKey.indexOf(\":\");\n  return separator === -1 ? sessionKey : sessionKey.slice(0, separator);\n}\n\n/** The thread suffix of a scoped key, or null for a bare conversation key. */\nexport function threadSuffixOf(sessionKey: string): string | null {\n  const separator = sessionKey.indexOf(\":\");\n  return separator === -1 ? null : sessionKey.slice(separator + 1);\n}\n"]}

package/dist/sessions/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIjF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO/D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAMjF;AAaD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGvF;AASD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnF;AAkDD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3E"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIjF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAiBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO/D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAMjF;AAaD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGvF;AASD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGnF;AA8DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3E"}

package/dist/sessions/store.js

@@ -1,11 +1,11 @@
 import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, rmSync } from "fs";
-import { basename, dirname, join } from "path";
+import { lstatSync, mkdirSync, rmSync } from "fs";
+import { basename, dirname, join, relative, resolve, sep } from "path";
 import { SessionStore } from "../harness/index.js";
 import { isRecord, parseJsonValue, readTextFileIfExists } from "../utils/file-guards.js";
 import { atomicWritePrivateFile } from "../utils/fs-atomic.js";
 import { isPlatformHistorySession } from "./metadata.js";
-import { threadSuffixOf } from "./session-key.js";
+import { assertSessionSuffix, threadSuffixOf } from "./session-key.js";
 /**
  * Returns the shared session directory for a conversation.
  * Channel sessions use a current pointer within this directory.
@@ -47,7 +47,21 @@ export function extractSessionUuid(sessionFile) {
  * "channelId:threadId" → "threadId", "channelId" → "channelId"
  */
 export function extractSessionSuffix(sessionKey) {
-    return threadSuffixOf(sessionKey) ?? sessionKey;
+    return assertSessionSuffix(threadSuffixOf(sessionKey) ?? sessionKey);
+}
+/**
+ * Resolve one child path and prove it remains inside its owning directory.
+ * Identity validation is the first guard; containment is defense in depth for
+ * every session path derived from platform-controlled values.
+ */
+function resolveChildPath(root, child) {
+    const resolvedRoot = resolve(root);
+    const resolvedChild = resolve(resolvedRoot, child);
+    const relation = relative(resolvedRoot, resolvedChild);
+    if (!relation || relation === ".." || relation.startsWith(`..${sep}`)) {
+        throw new Error(`Session path escapes its owning directory: ${JSON.stringify(child)}`);
+    }
+    return resolvedChild;
 }
 /**
  * Creates an empty timestamped file and updates the "current" pointer.
@@ -113,7 +127,16 @@ function writeSessionHeader(sessionFile, cwd, sessionId = randomUUID()) {
  * Returns the fixed session file path for a Slack thread.
  */
 export function getThreadSessionFile(channelDir, sessionKey) {
-    return join(getChannelSessionDir(channelDir), `${extractSessionSuffix(sessionKey)}.jsonl`);
+    const sessionDir = getChannelSessionDir(channelDir);
+    return resolveChildPath(sessionDir, `${extractSessionSuffix(sessionKey)}.jsonl`);
+}
+function isRegularSessionFile(sessionFile) {
+    try {
+        return lstatSync(sessionFile).isFile();
+    }
+    catch {
+        return false;
+    }
 }
 function hasSessionHeader(sessionFile) {
     try {
@@ -158,7 +181,12 @@ function getCurrentSessionPath(sessionDir) {
     const filename = readTextFileIfExists(pointerFile)?.trim();
     if (!filename)
         return null;
-    return join(sessionDir, filename);
+    try {
+        return resolveChildPath(sessionDir, filename);
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Try to resolve an existing current session file.
@@ -166,7 +194,7 @@ function getCurrentSessionPath(sessionDir) {
  */
 export function tryResolveCurrentSession(sessionDir) {
     const fullPath = getCurrentSessionPath(sessionDir);
-    if (fullPath && existsSync(fullPath) && hasSessionHeader(fullPath))
+    if (fullPath && isRegularSessionFile(fullPath) && hasSessionHeader(fullPath))
         return fullPath;
     return null;
 }
@@ -175,7 +203,7 @@ export function tryResolveCurrentSession(sessionDir) {
  * Returns the file path if found, or null if no valid thread session exists yet.
  */
 export function tryResolveThreadSession(sessionFile) {
-    return existsSync(sessionFile) && hasSessionHeader(sessionFile) ? sessionFile : null;
+    return isRegularSessionFile(sessionFile) && hasSessionHeader(sessionFile) ? sessionFile : null;
 }
 /**
  * Resolve the channel's current session file path.

package/dist/sessions/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,GAAW;IACvE,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,YAAY,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACjF,OAAO,wBAAwB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,sBAAsB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrC,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,GAAW;IACtE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,kBAAkB,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAChD,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,GAAW;IACjE,IAAI,mCAAmC,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAS,GAAG,UAAU,EAAE;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,GAAG,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,eAAuB;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;IACnD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,WAAmB,EAAE,GAAW;IAC7E,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB,EAAE,GAAW,EAAE,SAAS,GAAG,UAAU,EAAE;IACpF,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,0EAA0E;IAC1E,0CAA0C;IAC1C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,GAAG,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mCAAmC,CAAC,WAAmB;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAE1B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,cAAc,CACnB,IAAI,EACJ,CAAC,KAAK,EAA8B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EACtD,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,OAAO,UAAU,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,wBAAwB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import { randomUUID } from \"crypto\";\nimport { existsSync, mkdirSync, rmSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport { SessionStore } from \"../harness/index.js\";\nimport { isRecord, parseJsonValue, readTextFileIfExists } from \"../utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"../utils/fs-atomic.js\";\nimport { isPlatformHistorySession } from \"./metadata.js\";\nimport { threadSuffixOf } from \"./session-key.js\";\nexport type { ResolvedSessionScope, ThreadRootMessage } from \"./types.js\";\n\n/**\n * Returns the shared session directory for a conversation.\n * Channel sessions use a current pointer within this directory.\n * Thread sessions are stored as fixed files within the same directory.\n */\nexport function getChannelSessionDir(channelDir: string): string {\n  return join(channelDir, \"sessions\");\n}\n\n/**\n * Resolves the current active session file for a session directory.\n * Reads the \"current\" pointer file; creates a new session if none exists\n * or the pointed-to file is missing.\n */\nexport function resolveSessionFile(sessionDir: string): string {\n  const existing = tryResolveCurrentSession(sessionDir);\n  if (existing) return existing;\n  return createNewSessionFile(sessionDir);\n}\n\n/**\n * Resolve the current active session file for a session directory.\n * Creates a fully initialized persistent session with the provided cwd when none exists.\n */\nexport function resolveManagedSessionFile(sessionDir: string, cwd: string): string {\n  const existingPath = getCurrentSessionPath(sessionDir);\n  if (existingPath && !isPlatformHistorySession(existingPath)) return existingPath;\n  return createManagedSessionFile(sessionDir, cwd);\n}\n\n/**\n * Extracts the short UUID from a session file path.\n * e.g. \"2026-04-05T00-00_7b54cf90.jsonl\" → \"7b54cf90\"\n */\nexport function extractSessionUuid(sessionFile: string): string {\n  return basename(sessionFile).replace(\".jsonl\", \"\").split(\"_\").pop()!;\n}\n\n/**\n * Extracts the thread/suffix part of a session key.\n * \"channelId:threadId\" → \"threadId\", \"channelId\" → \"channelId\"\n */\nexport function extractSessionSuffix(sessionKey: string): string {\n  return threadSuffixOf(sessionKey) ?? sessionKey;\n}\n\n/**\n * Creates an empty timestamped file and updates the \"current\" pointer.\n * Used only by tests for placeholder-file scenarios.\n *\n * Order matters: write the session file first, then atomic-rename the pointer\n * last so a crash mid-create never leaves \"current\" pointing at a missing file.\n */\nexport function createNewSessionFile(sessionDir: string): string {\n  mkdirSync(sessionDir, { recursive: true });\n  const filename = createSessionFilename();\n  const filePath = join(sessionDir, filename);\n  atomicWritePrivateFile(filePath, \"\");\n  atomicWritePrivateFile(join(sessionDir, \"current\"), filename);\n  return filePath;\n}\n\n/**\n * Creates a new persistent session file with a proper SessionManager header and cwd.\n * Also updates the \"current\" pointer. Header is written before the pointer flips so a\n * partial create cannot leave \"current\" pointing at a missing file.\n */\nexport function createManagedSessionFile(sessionDir: string, cwd: string): string {\n  mkdirSync(sessionDir, { recursive: true });\n  const sessionId = randomUUID();\n  const sessionFile = join(sessionDir, createSessionFilename(sessionId));\n  writeSessionHeader(sessionFile, cwd, sessionId);\n  setCurrentPointer(sessionDir, sessionFile);\n  return sessionFile;\n}\n\n/**\n * Open a session file with an explicit cwd, even if the file does not exist yet.\n * This avoids SessionStore.open() falling back to process.cwd() for fresh sessions.\n */\nexport function openManagedSession(sessionFile: string, cwd: string): SessionStore {\n  if (shouldRecreatePreinitializedSession(sessionFile)) {\n    rmSync(sessionFile, { force: true });\n  }\n\n  return SessionStore.open(sessionFile, cwd);\n}\n\nfunction createSessionFilename(sessionId = randomUUID()): string {\n  const timestamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  return `${timestamp}_${sessionId.slice(0, 8)}.jsonl`;\n}\n\nfunction setCurrentPointer(sessionDir: string, sessionFilePath: string): void {\n  const filename = sessionFilePath.split(\"/\").pop()!;\n  mkdirSync(sessionDir, { recursive: true });\n  atomicWritePrivateFile(join(sessionDir, \"current\"), filename);\n}\n\n/**\n * Creates or overwrites a fixed-path session file with a valid session header.\n */\nexport function createManagedSessionFileAtPath(sessionFile: string, cwd: string): string {\n  writeSessionHeader(sessionFile, cwd);\n  return sessionFile;\n}\n\nfunction writeSessionHeader(sessionFile: string, cwd: string, sessionId = randomUUID()): void {\n  mkdirSync(dirname(sessionFile), { recursive: true });\n  // The header format (and its version) is owned by the harness store; this\n  // layer only decides the path and the id.\n  SessionStore.create(sessionFile, cwd, { id: sessionId });\n}\n\n/**\n * Returns the fixed session file path for a Slack thread.\n */\nexport function getThreadSessionFile(channelDir: string, sessionKey: string): string {\n  return join(getChannelSessionDir(channelDir), `${extractSessionSuffix(sessionKey)}.jsonl`);\n}\n\nfunction hasSessionHeader(sessionFile: string): boolean {\n  try {\n    const raw = readTextFileIfExists(sessionFile);\n    if (raw === undefined) return false;\n    const lines = raw.split(\"\\n\");\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (!trimmed) continue;\n      const entry = parseSessionEntry(trimmed);\n      return entry.type === \"session\";\n    }\n  } catch {\n    return false;\n  }\n  return false;\n}\n\nfunction shouldRecreatePreinitializedSession(sessionFile: string): boolean {\n  try {\n    const raw = readTextFileIfExists(sessionFile);\n    if (raw === undefined) return false;\n    const entries = raw\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter(Boolean)\n      .map(parseSessionEntry);\n\n    return entries.length === 1 && entries[0]?.type === \"session\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseSessionEntry(line: string): { type?: string } {\n  return parseJsonValue(\n    line,\n    (value): value is { type?: string } => isRecord(value),\n    (detail) => (detail === \"unexpected JSON shape\" ? \"expected a JSON object\" : detail),\n  );\n}\n\nfunction getCurrentSessionPath(sessionDir: string): string | null {\n  const pointerFile = join(sessionDir, \"current\");\n  const filename = readTextFileIfExists(pointerFile)?.trim();\n  if (!filename) return null;\n  return join(sessionDir, filename);\n}\n\n/**\n * Try to resolve an existing current session file.\n * Returns null if no current pointer exists or the pointed file has no valid session header.\n */\nexport function tryResolveCurrentSession(sessionDir: string): string | null {\n  const fullPath = getCurrentSessionPath(sessionDir);\n  if (fullPath && existsSync(fullPath) && hasSessionHeader(fullPath)) return fullPath;\n  return null;\n}\n\n/**\n * Try to resolve an existing thread session file.\n * Returns the file path if found, or null if no valid thread session exists yet.\n */\nexport function tryResolveThreadSession(sessionFile: string): string | null {\n  return existsSync(sessionFile) && hasSessionHeader(sessionFile) ? sessionFile : null;\n}\n\n/**\n * Resolve the channel's current session file path.\n * Returns null if no channel session exists.\n */\nexport function resolveChannelSessionFile(channelDir: string): string | null {\n  return tryResolveCurrentSession(getChannelSessionDir(channelDir));\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,GAAW;IACvE,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,YAAY,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACjF,OAAO,wBAAwB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,mBAAmB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,sBAAsB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrC,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,GAAW;IACtE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,kBAAkB,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAChD,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,GAAW;IACjE,IAAI,mCAAmC,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAS,GAAG,UAAU,EAAE;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,GAAG,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,eAAuB;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;IACnD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,WAAmB,EAAE,GAAW;IAC7E,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB,EAAE,GAAW,EAAE,SAAS,GAAG,UAAU,EAAE;IACpF,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,0EAA0E;IAC1E,0CAA0C;IAC1C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,gBAAgB,CAAC,UAAU,EAAE,GAAG,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mCAAmC,CAAC,WAAmB;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAE1B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,cAAc,CACnB,IAAI,EACJ,CAAC,KAAK,EAA8B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EACtD,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,OAAO,oBAAoB,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,wBAAwB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import { randomUUID } from \"crypto\";\nimport { lstatSync, mkdirSync, rmSync } from \"fs\";\nimport { basename, dirname, join, relative, resolve, sep } from \"path\";\nimport { SessionStore } from \"../harness/index.js\";\nimport { isRecord, parseJsonValue, readTextFileIfExists } from \"../utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"../utils/fs-atomic.js\";\nimport { isPlatformHistorySession } from \"./metadata.js\";\nimport { assertSessionSuffix, threadSuffixOf } from \"./session-key.js\";\nexport type { ResolvedSessionScope, ThreadRootMessage } from \"./types.js\";\n\n/**\n * Returns the shared session directory for a conversation.\n * Channel sessions use a current pointer within this directory.\n * Thread sessions are stored as fixed files within the same directory.\n */\nexport function getChannelSessionDir(channelDir: string): string {\n  return join(channelDir, \"sessions\");\n}\n\n/**\n * Resolves the current active session file for a session directory.\n * Reads the \"current\" pointer file; creates a new session if none exists\n * or the pointed-to file is missing.\n */\nexport function resolveSessionFile(sessionDir: string): string {\n  const existing = tryResolveCurrentSession(sessionDir);\n  if (existing) return existing;\n  return createNewSessionFile(sessionDir);\n}\n\n/**\n * Resolve the current active session file for a session directory.\n * Creates a fully initialized persistent session with the provided cwd when none exists.\n */\nexport function resolveManagedSessionFile(sessionDir: string, cwd: string): string {\n  const existingPath = getCurrentSessionPath(sessionDir);\n  if (existingPath && !isPlatformHistorySession(existingPath)) return existingPath;\n  return createManagedSessionFile(sessionDir, cwd);\n}\n\n/**\n * Extracts the short UUID from a session file path.\n * e.g. \"2026-04-05T00-00_7b54cf90.jsonl\" → \"7b54cf90\"\n */\nexport function extractSessionUuid(sessionFile: string): string {\n  return basename(sessionFile).replace(\".jsonl\", \"\").split(\"_\").pop()!;\n}\n\n/**\n * Extracts the thread/suffix part of a session key.\n * \"channelId:threadId\" → \"threadId\", \"channelId\" → \"channelId\"\n */\nexport function extractSessionSuffix(sessionKey: string): string {\n  return assertSessionSuffix(threadSuffixOf(sessionKey) ?? sessionKey);\n}\n\n/**\n * Resolve one child path and prove it remains inside its owning directory.\n * Identity validation is the first guard; containment is defense in depth for\n * every session path derived from platform-controlled values.\n */\nfunction resolveChildPath(root: string, child: string): string {\n  const resolvedRoot = resolve(root);\n  const resolvedChild = resolve(resolvedRoot, child);\n  const relation = relative(resolvedRoot, resolvedChild);\n  if (!relation || relation === \"..\" || relation.startsWith(`..${sep}`)) {\n    throw new Error(`Session path escapes its owning directory: ${JSON.stringify(child)}`);\n  }\n  return resolvedChild;\n}\n\n/**\n * Creates an empty timestamped file and updates the \"current\" pointer.\n * Used only by tests for placeholder-file scenarios.\n *\n * Order matters: write the session file first, then atomic-rename the pointer\n * last so a crash mid-create never leaves \"current\" pointing at a missing file.\n */\nexport function createNewSessionFile(sessionDir: string): string {\n  mkdirSync(sessionDir, { recursive: true });\n  const filename = createSessionFilename();\n  const filePath = join(sessionDir, filename);\n  atomicWritePrivateFile(filePath, \"\");\n  atomicWritePrivateFile(join(sessionDir, \"current\"), filename);\n  return filePath;\n}\n\n/**\n * Creates a new persistent session file with a proper SessionManager header and cwd.\n * Also updates the \"current\" pointer. Header is written before the pointer flips so a\n * partial create cannot leave \"current\" pointing at a missing file.\n */\nexport function createManagedSessionFile(sessionDir: string, cwd: string): string {\n  mkdirSync(sessionDir, { recursive: true });\n  const sessionId = randomUUID();\n  const sessionFile = join(sessionDir, createSessionFilename(sessionId));\n  writeSessionHeader(sessionFile, cwd, sessionId);\n  setCurrentPointer(sessionDir, sessionFile);\n  return sessionFile;\n}\n\n/**\n * Open a session file with an explicit cwd, even if the file does not exist yet.\n * This avoids SessionStore.open() falling back to process.cwd() for fresh sessions.\n */\nexport function openManagedSession(sessionFile: string, cwd: string): SessionStore {\n  if (shouldRecreatePreinitializedSession(sessionFile)) {\n    rmSync(sessionFile, { force: true });\n  }\n\n  return SessionStore.open(sessionFile, cwd);\n}\n\nfunction createSessionFilename(sessionId = randomUUID()): string {\n  const timestamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  return `${timestamp}_${sessionId.slice(0, 8)}.jsonl`;\n}\n\nfunction setCurrentPointer(sessionDir: string, sessionFilePath: string): void {\n  const filename = sessionFilePath.split(\"/\").pop()!;\n  mkdirSync(sessionDir, { recursive: true });\n  atomicWritePrivateFile(join(sessionDir, \"current\"), filename);\n}\n\n/**\n * Creates or overwrites a fixed-path session file with a valid session header.\n */\nexport function createManagedSessionFileAtPath(sessionFile: string, cwd: string): string {\n  writeSessionHeader(sessionFile, cwd);\n  return sessionFile;\n}\n\nfunction writeSessionHeader(sessionFile: string, cwd: string, sessionId = randomUUID()): void {\n  mkdirSync(dirname(sessionFile), { recursive: true });\n  // The header format (and its version) is owned by the harness store; this\n  // layer only decides the path and the id.\n  SessionStore.create(sessionFile, cwd, { id: sessionId });\n}\n\n/**\n * Returns the fixed session file path for a Slack thread.\n */\nexport function getThreadSessionFile(channelDir: string, sessionKey: string): string {\n  const sessionDir = getChannelSessionDir(channelDir);\n  return resolveChildPath(sessionDir, `${extractSessionSuffix(sessionKey)}.jsonl`);\n}\n\nfunction isRegularSessionFile(sessionFile: string): boolean {\n  try {\n    return lstatSync(sessionFile).isFile();\n  } catch {\n    return false;\n  }\n}\n\nfunction hasSessionHeader(sessionFile: string): boolean {\n  try {\n    const raw = readTextFileIfExists(sessionFile);\n    if (raw === undefined) return false;\n    const lines = raw.split(\"\\n\");\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (!trimmed) continue;\n      const entry = parseSessionEntry(trimmed);\n      return entry.type === \"session\";\n    }\n  } catch {\n    return false;\n  }\n  return false;\n}\n\nfunction shouldRecreatePreinitializedSession(sessionFile: string): boolean {\n  try {\n    const raw = readTextFileIfExists(sessionFile);\n    if (raw === undefined) return false;\n    const entries = raw\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter(Boolean)\n      .map(parseSessionEntry);\n\n    return entries.length === 1 && entries[0]?.type === \"session\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseSessionEntry(line: string): { type?: string } {\n  return parseJsonValue(\n    line,\n    (value): value is { type?: string } => isRecord(value),\n    (detail) => (detail === \"unexpected JSON shape\" ? \"expected a JSON object\" : detail),\n  );\n}\n\nfunction getCurrentSessionPath(sessionDir: string): string | null {\n  const pointerFile = join(sessionDir, \"current\");\n  const filename = readTextFileIfExists(pointerFile)?.trim();\n  if (!filename) return null;\n  try {\n    return resolveChildPath(sessionDir, filename);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Try to resolve an existing current session file.\n * Returns null if no current pointer exists or the pointed file has no valid session header.\n */\nexport function tryResolveCurrentSession(sessionDir: string): string | null {\n  const fullPath = getCurrentSessionPath(sessionDir);\n  if (fullPath && isRegularSessionFile(fullPath) && hasSessionHeader(fullPath)) return fullPath;\n  return null;\n}\n\n/**\n * Try to resolve an existing thread session file.\n * Returns the file path if found, or null if no valid thread session exists yet.\n */\nexport function tryResolveThreadSession(sessionFile: string): string | null {\n  return isRegularSessionFile(sessionFile) && hasSessionHeader(sessionFile) ? sessionFile : null;\n}\n\n/**\n * Resolve the channel's current session file path.\n * Returns null if no channel session exists.\n */\nexport function resolveChannelSessionFile(channelDir: string): string | null {\n  return tryResolveCurrentSession(getChannelSessionDir(channelDir));\n}\n"]}

package/dist/tools/sandbox.js

@@ -1,5 +1,5 @@
 import { Type } from "@sinclair/typebox";
-import { actorKey } from "../sandbox/identity.js";
+import { runtimeResourceKey } from "../sandbox/identity.js";
 const sandboxSchema = Type.Object({
     action: Type.Union([Type.Literal("status"), Type.Literal("set")], {
         description: "Use status to inspect current limits, or set to apply temporary limits.",
@@ -29,7 +29,7 @@ export function createSandboxTool(controller) {
                 !controller.resourceController) {
                 throw new Error("The sandbox tool only supports image:* and gondolin:* managed sandboxes");
             }
-            const containerKey = actorKey(controller.sandbox, {
+            const containerKey = runtimeResourceKey(controller.sandbox, {
                 userId: sandboxContext.userId,
                 conversationId: sandboxContext.conversationId,
             });

package/dist/tools/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/tools/sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE;QAChE,WAAW,EAAE,yEAAyE;KACvF,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,2DAA2D;KACzE,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,wEAAwE;KACtF,CAAC,CACH;CACF,CAAC,CAAC;AAkBH,MAAM,UAAU,iBAAiB,CAAC,UAAiC;IAIjE,IAAI,cAAc,GAA8B,IAAI,CAAC;IAErD,MAAM,IAAI,GAAoC;QAC5C,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,0JAA0J;QAC5J,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAyB,EAAE,MAAoB,EAAE,EAAE;YACtF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IACE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC/E,CAAC,UAAU,CAAC,kBAAkB,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE;gBAChD,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACnF,OAAO,UAAU,CACf,8BAA8B,YAAY,KAAK,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,sEAAsE,CACjJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAC1E,OAAO,UAAU,CACf,sBAAsB,YAAY,KAAK,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAC3G,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,iBAAiB,EAAE,CAAC,OAA2B,EAAE,EAAE;YACjD,cAAc,GAAG,OAAO,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAyB;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkC;IACtD,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,WAAW,aAAa,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAI9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnE,CAAC","sourcesContent":["import type { AgentTool } from \"@earendil-works/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { ResourceLimits, SandboxResourceController } from \"../types.js\";\nimport { actorKey } from \"../sandbox/identity.js\";\n\nconst sandboxSchema = Type.Object({\n  action: Type.Union([Type.Literal(\"status\"), Type.Literal(\"set\")], {\n    description: \"Use status to inspect current limits, or set to apply temporary limits.\",\n  }),\n  cpus: Type.Optional(\n    Type.String({\n      description: \"CPU limit for action=set, for example '0.5', '1', or '2'.\",\n    }),\n  ),\n  memory: Type.Optional(\n    Type.String({\n      description: \"Docker memory limit for action=set, for example '512m', '1g', or '4g'.\",\n    }),\n  ),\n});\n\ntype SandboxToolParams = {\n  action: \"status\" | \"set\";\n  cpus?: string;\n  memory?: string;\n};\n\ninterface SandboxToolContext {\n  userId: string;\n  conversationId: string;\n}\n\ninterface SandboxToolController {\n  sandbox: SandboxConfig;\n  resourceController?: Pick<SandboxResourceController, \"getLimitStatus\" | \"setLimits\">;\n}\n\nexport function createSandboxTool(controller: SandboxToolController): {\n  tool: AgentTool<typeof sandboxSchema>;\n  setSandboxContext: (context: SandboxToolContext) => void;\n} {\n  let sandboxContext: SandboxToolContext | null = null;\n\n  const tool: AgentTool<typeof sandboxSchema> = {\n    name: \"sandbox\",\n    label: \"sandbox\",\n    description:\n      \"Inspect or temporarily set CPU/memory limits for the current managed sandbox. Limits apply to this conversation's runtime and are cleared when it stops.\",\n    parameters: sandboxSchema,\n    execute: async (_toolCallId: string, params: SandboxToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n      if (!sandboxContext) {\n        throw new Error(\"Sandbox context not configured\");\n      }\n      if (\n        (controller.sandbox.type !== \"image\" && controller.sandbox.type !== \"gondolin\") ||\n        !controller.resourceController\n      ) {\n        throw new Error(\"The sandbox tool only supports image:* and gondolin:* managed sandboxes\");\n      }\n\n      const containerKey = actorKey(controller.sandbox, {\n        userId: sandboxContext.userId,\n        conversationId: sandboxContext.conversationId,\n      });\n\n      if (params.action === \"set\") {\n        const limits = normalizeLimits(params);\n        const status = await controller.resourceController.setLimits(containerKey, limits);\n        return textResult(\n          `Updated sandbox limits for ${containerKey}: ${formatLimits(status.limits)}. These temporary limits are cleared when the sandbox runtime stops.`,\n        );\n      }\n\n      const status = controller.resourceController.getLimitStatus(containerKey);\n      return textResult(\n        `Sandbox limits for ${containerKey}: ${formatLimits(status.limits)}${status.boosted ? \" (boosted)\" : \"\"}.`,\n      );\n    },\n  };\n\n  return {\n    tool,\n    setSandboxContext: (context: SandboxToolContext) => {\n      sandboxContext = context;\n    },\n  };\n}\n\nfunction normalizeLimits(params: SandboxToolParams): ResourceLimits {\n  const cpus = normalizeLimitValue(\"cpus\", params.cpus);\n  const memory = normalizeLimitValue(\"memory\", params.memory);\n  if (!cpus && !memory) {\n    throw new Error(\"action=set requires cpus and/or memory\");\n  }\n  return { ...(cpus ? { cpus } : {}), ...(memory ? { memory } : {}) };\n}\n\nfunction normalizeLimitValue(name: string, value: string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  if (!/^[A-Za-z0-9_.-]+$/.test(trimmed)) {\n    throw new Error(`${name} must not contain whitespace or shell metacharacters`);\n  }\n  return trimmed;\n}\n\nfunction formatLimits(limits: ResourceLimits | undefined): string {\n  return `CPU ${limits?.cpus ?? \"unlimited\"} / Memory ${limits?.memory ?? \"unlimited\"}`;\n}\n\nfunction textResult(text: string): {\n  content: Array<{ type: \"text\"; text: string }>;\n  details: undefined;\n} {\n  return { content: [{ type: \"text\", text }], details: undefined };\n}\n"]}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/tools/sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE;QAChE,WAAW,EAAE,yEAAyE;KACvF,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,2DAA2D;KACzE,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,wEAAwE;KACtF,CAAC,CACH;CACF,CAAC,CAAC;AAkBH,MAAM,UAAU,iBAAiB,CAAC,UAAiC;IAIjE,IAAI,cAAc,GAA8B,IAAI,CAAC;IAErD,MAAM,IAAI,GAAoC;QAC5C,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,0JAA0J;QAC5J,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAyB,EAAE,MAAoB,EAAE,EAAE;YACtF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IACE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC/E,CAAC,UAAU,CAAC,kBAAkB,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE;gBAC1D,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACnF,OAAO,UAAU,CACf,8BAA8B,YAAY,KAAK,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,sEAAsE,CACjJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAC1E,OAAO,UAAU,CACf,sBAAsB,YAAY,KAAK,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAC3G,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,iBAAiB,EAAE,CAAC,OAA2B,EAAE,EAAE;YACjD,cAAc,GAAG,OAAO,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAyB;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkC;IACtD,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,WAAW,aAAa,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAI9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnE,CAAC","sourcesContent":["import type { AgentTool } from \"@earendil-works/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { ResourceLimits, SandboxResourceController } from \"../types.js\";\nimport { runtimeResourceKey } from \"../sandbox/identity.js\";\n\nconst sandboxSchema = Type.Object({\n  action: Type.Union([Type.Literal(\"status\"), Type.Literal(\"set\")], {\n    description: \"Use status to inspect current limits, or set to apply temporary limits.\",\n  }),\n  cpus: Type.Optional(\n    Type.String({\n      description: \"CPU limit for action=set, for example '0.5', '1', or '2'.\",\n    }),\n  ),\n  memory: Type.Optional(\n    Type.String({\n      description: \"Docker memory limit for action=set, for example '512m', '1g', or '4g'.\",\n    }),\n  ),\n});\n\ntype SandboxToolParams = {\n  action: \"status\" | \"set\";\n  cpus?: string;\n  memory?: string;\n};\n\ninterface SandboxToolContext {\n  userId: string;\n  conversationId: string;\n}\n\ninterface SandboxToolController {\n  sandbox: SandboxConfig;\n  resourceController?: Pick<SandboxResourceController, \"getLimitStatus\" | \"setLimits\">;\n}\n\nexport function createSandboxTool(controller: SandboxToolController): {\n  tool: AgentTool<typeof sandboxSchema>;\n  setSandboxContext: (context: SandboxToolContext) => void;\n} {\n  let sandboxContext: SandboxToolContext | null = null;\n\n  const tool: AgentTool<typeof sandboxSchema> = {\n    name: \"sandbox\",\n    label: \"sandbox\",\n    description:\n      \"Inspect or temporarily set CPU/memory limits for the current managed sandbox. Limits apply to this conversation's runtime and are cleared when it stops.\",\n    parameters: sandboxSchema,\n    execute: async (_toolCallId: string, params: SandboxToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n      if (!sandboxContext) {\n        throw new Error(\"Sandbox context not configured\");\n      }\n      if (\n        (controller.sandbox.type !== \"image\" && controller.sandbox.type !== \"gondolin\") ||\n        !controller.resourceController\n      ) {\n        throw new Error(\"The sandbox tool only supports image:* and gondolin:* managed sandboxes\");\n      }\n\n      const containerKey = runtimeResourceKey(controller.sandbox, {\n        userId: sandboxContext.userId,\n        conversationId: sandboxContext.conversationId,\n      });\n\n      if (params.action === \"set\") {\n        const limits = normalizeLimits(params);\n        const status = await controller.resourceController.setLimits(containerKey, limits);\n        return textResult(\n          `Updated sandbox limits for ${containerKey}: ${formatLimits(status.limits)}. These temporary limits are cleared when the sandbox runtime stops.`,\n        );\n      }\n\n      const status = controller.resourceController.getLimitStatus(containerKey);\n      return textResult(\n        `Sandbox limits for ${containerKey}: ${formatLimits(status.limits)}${status.boosted ? \" (boosted)\" : \"\"}.`,\n      );\n    },\n  };\n\n  return {\n    tool,\n    setSandboxContext: (context: SandboxToolContext) => {\n      sandboxContext = context;\n    },\n  };\n}\n\nfunction normalizeLimits(params: SandboxToolParams): ResourceLimits {\n  const cpus = normalizeLimitValue(\"cpus\", params.cpus);\n  const memory = normalizeLimitValue(\"memory\", params.memory);\n  if (!cpus && !memory) {\n    throw new Error(\"action=set requires cpus and/or memory\");\n  }\n  return { ...(cpus ? { cpus } : {}), ...(memory ? { memory } : {}) };\n}\n\nfunction normalizeLimitValue(name: string, value: string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  if (!/^[A-Za-z0-9_.-]+$/.test(trimmed)) {\n    throw new Error(`${name} must not contain whitespace or shell metacharacters`);\n  }\n  return trimmed;\n}\n\nfunction formatLimits(limits: ResourceLimits | undefined): string {\n  return `CPU ${limits?.cpus ?? \"unlimited\"} / Memory ${limits?.memory ?? \"unlimited\"}`;\n}\n\nfunction textResult(text: string): {\n  content: Array<{ type: \"text\"; text: string }>;\n  details: undefined;\n} {\n  return { content: [{ type: \"text\", text }], details: undefined };\n}\n"]}