@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/sandbox/host.js

@@ -1,6 +1,9 @@
-import { spawn } from "child_process";
-import { killProcessTree } from "./utils.js";
-import { createMountedRuntimePathContext } from "./path-context.js";
+import { spawn } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from "./utils.js";
+/** Cap on captured output, so a runaway command cannot exhaust the daemon. */
+const MAX_CAPTURE_CHARS = 10 * 1024 * 1024;
 function parseHostSandboxArg(value) {
     if (value === "host") {
         return { type: "host" };
@@ -10,14 +13,8 @@ function parseHostSandboxArg(value) {
 export class HostExecutor {
     async exec(command, options) {
         return new Promise((resolve, reject) => {
-            const shell = process.platform === "win32" ? "cmd" : "sh";
-            const shellArgs = process.platform === "win32" ? ["/c"] : ["-c"];
-            const child = spawn(shell, [...shellArgs, command], {
-                detached: true,
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            let stdout = "";
-            let stderr = "";
+            const child = spawnShell(command, options?.cwd);
+            const capture = captureOutput(child);
             let timedOut = false;
             const timeoutHandle = options?.timeout && options.timeout > 0
                 ? setTimeout(() => {
@@ -25,36 +22,15 @@ export class HostExecutor {
                     killProcessTree(child.pid);
                 }, options.timeout * 1000)
                 : undefined;
-            const onAbort = () => {
+            const unlinkSignal = linkAbortSignal(options?.signal, () => {
                 if (child.pid)
                     killProcessTree(child.pid);
-            };
-            if (options?.signal) {
-                if (options.signal.aborted) {
-                    onAbort();
-                }
-                else {
-                    options.signal.addEventListener("abort", onAbort, { once: true });
-                }
-            }
-            child.stdout?.on("data", (data) => {
-                stdout += data.toString();
-                if (stdout.length > 10 * 1024 * 1024) {
-                    stdout = stdout.slice(0, 10 * 1024 * 1024);
-                }
-            });
-            child.stderr?.on("data", (data) => {
-                stderr += data.toString();
-                if (stderr.length > 10 * 1024 * 1024) {
-                    stderr = stderr.slice(0, 10 * 1024 * 1024);
-                }
             });
             child.on("close", (code) => {
                 if (timeoutHandle)
                     clearTimeout(timeoutHandle);
-                if (options?.signal) {
-                    options.signal.removeEventListener("abort", onAbort);
-                }
+                unlinkSignal();
+                const { stdout, stderr } = capture;
                 if (options?.signal?.aborted) {
                     reject(new Error(`${stdout}\n${stderr}\nCommand aborted`.trim()));
                     return;
@@ -67,6 +43,18 @@ export class HostExecutor {
             });
         });
     }
+    async readFile(path) {
+        return readFile(path, "utf-8");
+    }
+    async readFileBase64(path) {
+        return (await readFile(path)).toString("base64");
+    }
+    async writeFile(path, content) {
+        await mkdir(dirname(path), { recursive: true });
+        const stage = `${path}.mikan-stage`;
+        await writeFile(stage, content, "utf-8");
+        await rename(stage, path);
+    }
     getWorkspacePath(hostPath) {
         return hostPath;
     }
@@ -77,8 +65,29 @@ export class HostExecutor {
         return { type: "host" };
     }
 }
+function spawnShell(command, cwd) {
+    const isWindows = process.platform === "win32";
+    return spawn(isWindows ? "cmd" : "sh", [isWindows ? "/c" : "-c", command], {
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        ...(cwd ? { cwd } : {}),
+    });
+}
+/** Accumulate the child's streams into one capped buffer per stream. */
+function captureOutput(child) {
+    const capture = { stdout: "", stderr: "" };
+    for (const stream of ["stdout", "stderr"]) {
+        child[stream]?.setEncoding("utf8");
+        child[stream]?.on("data", (chunk) => {
+            capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);
+        });
+    }
+    return capture;
+}
 export const hostSandboxAdapter = {
     type: "host",
+    credentials: { env: false, fileMounts: false },
+    workspace: { managedProjection: false },
     parse: parseHostSandboxArg,
     createExecutor: () => new HostExecutor(),
 };

package/dist/sandbox/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAStC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAEjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;gBAClD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { killProcessTree } from \"./utils.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const shell = process.platform === \"win32\" ? \"cmd\" : \"sh\";\n      const shellArgs = process.platform === \"win32\" ? [\"/c\"] : [\"-c\"];\n\n      const child = spawn(shell, [...shellArgs, command], {\n        detached: true,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;gBACzD,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;gBACnC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from \"./utils.js\";\n\n/** Cap on captured output, so a runaway command cannot exhaust the daemon. */\nconst MAX_CAPTURE_CHARS = 10 * 1024 * 1024;\n\ninterface Capture {\n  stdout: string;\n  stderr: string;\n}\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const child = spawnShell(command, options?.cwd);\n      const capture = captureOutput(child);\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const unlinkSignal = linkAbortSignal(options?.signal, () => {\n        if (child.pid) killProcessTree(child.pid);\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        unlinkSignal();\n\n        const { stdout, stderr } = capture;\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  async readFile(path: string): Promise<string> {\n    return readFile(path, \"utf-8\");\n  }\n\n  async readFileBase64(path: string): Promise<string> {\n    return (await readFile(path)).toString(\"base64\");\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true });\n    const stage = `${path}.mikan-stage`;\n    await writeFile(stage, content, \"utf-8\");\n    await rename(stage, path);\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nfunction spawnShell(command: string, cwd?: string): ChildProcess {\n  const isWindows = process.platform === \"win32\";\n  return spawn(isWindows ? \"cmd\" : \"sh\", [isWindows ? \"/c\" : \"-c\", command], {\n    detached: true,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    ...(cwd ? { cwd } : {}),\n  });\n}\n\n/** Accumulate the child's streams into one capped buffer per stream. */\nfunction captureOutput(child: ChildProcess): Capture {\n  const capture: Capture = { stdout: \"\", stderr: \"\" };\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    child[stream]?.setEncoding(\"utf8\");\n    child[stream]?.on(\"data\", (chunk: string) => {\n      capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);\n    });\n  }\n  return capture;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}

package/dist/sandbox/identity.d.ts

@@ -0,0 +1,42 @@
+import type { OfficeAddress } from "../types.js";
+import type { CredentialScope, SandboxConfig } from "./types.js";
+export type { CredentialScope } from "./types.js";
+/**
+ * Vault key for a run. Conversation-scoped sandboxes (image, cloudflare)
+ * key credentials by office key: platform-scoped and
+ * collision-resistant, so two platforms sharing a raw conversation id can
+ * never resolve each other's credentials — and one identity string names the
+ * office across the workspace, the registry, and the vault.
+ *
+ * Host mode keys by user (the host has no execution isolation to scope to)
+ * and container mode by the deployment-chosen container; both are
+ * platform-neutral on purpose and unchanged by ADR 0005.
+ */
+export declare function credentialAuthorizationKey(baseConfig: SandboxConfig, scope: CredentialScope): string;
+export declare function legacyExactCredentialAuthorizationKey(baseConfig: SandboxConfig, scope: CredentialScope): string | undefined;
+/**
+ * The raw-id conversation vault key written before the office migration; the
+ * boot-time vault migration renames these directories to office keys.
+ */
+export declare function legacyConversationCredentialKey(rawConversationId: string): string;
+/**
+ * Sandbox resource identity (container name, cloudflare sandbox scope).
+ * Conversation-scoped backends key by office key (ADR 0005): platform-aware,
+ * so two platforms sharing a raw conversation id can never share a
+ * container, its writable layer, or a cloudflare slot. Containers named
+ * under the previous raw-conversation keys are reaped by the provisioner's
+ * boot reconcile.
+ */
+export declare function runtimeResourceKey(baseConfig: SandboxConfig, ids: {
+    userId: string;
+    address: OfficeAddress;
+}): string;
+/**
+ * The raw-id resource key conversation-scoped sandboxes used before the
+ * office-key migration; the provisioner's boot reconcile uses it to
+ * recognize and reap stale containers.
+ */
+export declare function legacyConversationResourceKey(rawConversationId: string): string;
+export declare function sanitizeIdentitySegment(value: string): string;
+export declare function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/sandbox/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,CAIR;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC9C,MAAM,CAIR;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/sandbox/identity.js

@@ -0,0 +1,77 @@
+import { createHash } from "node:crypto";
+import { officeKey } from "../office/index.js";
+const IDENTITY_HASH_LENGTH = 12;
+/**
+ * Vault key for a run. Conversation-scoped sandboxes (image, cloudflare)
+ * key credentials by office key: platform-scoped and
+ * collision-resistant, so two platforms sharing a raw conversation id can
+ * never resolve each other's credentials — and one identity string names the
+ * office across the workspace, the registry, and the vault.
+ *
+ * Host mode keys by user (the host has no execution isolation to scope to)
+ * and container mode by the deployment-chosen container; both are
+ * platform-neutral on purpose and unchanged by ADR 0005.
+ */
+export function credentialAuthorizationKey(baseConfig, scope) {
+    if (baseConfig.type === "host")
+        return identityKey("user", scope.userId);
+    if (baseConfig.type === "container")
+        return identityKey("container", baseConfig.container);
+    return officeKey(scope.address);
+}
+export function legacyExactCredentialAuthorizationKey(baseConfig, scope) {
+    if (baseConfig.type === "host")
+        return scope.userId;
+    if (baseConfig.type === "container")
+        return `container-${baseConfig.container}`;
+    return undefined;
+}
+/**
+ * The raw-id conversation vault key written before the office migration; the
+ * boot-time vault migration renames these directories to office keys.
+ */
+export function legacyConversationCredentialKey(rawConversationId) {
+    return identityKey("conversation", rawConversationId);
+}
+/**
+ * Sandbox resource identity (container name, cloudflare sandbox scope).
+ * Conversation-scoped backends key by office key (ADR 0005): platform-aware,
+ * so two platforms sharing a raw conversation id can never share a
+ * container, its writable layer, or a cloudflare slot. Containers named
+ * under the previous raw-conversation keys are reaped by the provisioner's
+ * boot reconcile.
+ */
+export function runtimeResourceKey(baseConfig, ids) {
+    if (baseConfig.type === "container")
+        return identityKey("container", baseConfig.container);
+    if (baseConfig.type === "host")
+        return identityKey("user", ids.userId);
+    return officeKey(ids.address);
+}
+/**
+ * The raw-id resource key conversation-scoped sandboxes used before the
+ * office-key migration; the provisioner's boot reconcile uses it to
+ * recognize and reap stale containers.
+ */
+export function legacyConversationResourceKey(rawConversationId) {
+    return identityKey("conversation", rawConversationId);
+}
+export function sanitizeIdentitySegment(value) {
+    const sanitized = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return sanitized || "unknown";
+}
+export function scopeCloudflareSandboxId(baseId, resourceKey) {
+    return `${baseId}-${resourceKey}`;
+}
+function identityKey(kind, value) {
+    const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, "") || "unknown";
+    const hash = createHash("sha256")
+        .update(`${kind}\0${value}`)
+        .digest("hex")
+        .slice(0, IDENTITY_HASH_LENGTH);
+    return `${readable}-${hash}`;
+}
+//# sourceMappingURL=identity.js.map

package/dist/sandbox/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAM/C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,aAAa,UAAU,CAAC,SAAS,EAAE,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,iBAAyB;IACvE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,iBAAyB;IACrE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAmB;IAC1E,OAAO,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA2C,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClC,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { officeKey } from \"../office/index.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport type { CredentialScope, SandboxConfig } from \"./types.js\";\n\nexport type { CredentialScope } from \"./types.js\";\n\nconst IDENTITY_HASH_LENGTH = 12;\n\n/**\n * Vault key for a run. Conversation-scoped sandboxes (image, cloudflare)\n * key credentials by office key: platform-scoped and\n * collision-resistant, so two platforms sharing a raw conversation id can\n * never resolve each other's credentials — and one identity string names the\n * office across the workspace, the registry, and the vault.\n *\n * Host mode keys by user (the host has no execution isolation to scope to)\n * and container mode by the deployment-chosen container; both are\n * platform-neutral on purpose and unchanged by ADR 0005.\n */\nexport function credentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string {\n  if (baseConfig.type === \"host\") return identityKey(\"user\", scope.userId);\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  return officeKey(scope.address);\n}\n\nexport function legacyExactCredentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string | undefined {\n  if (baseConfig.type === \"host\") return scope.userId;\n  if (baseConfig.type === \"container\") return `container-${baseConfig.container}`;\n  return undefined;\n}\n\n/**\n * The raw-id conversation vault key written before the office migration; the\n * boot-time vault migration renames these directories to office keys.\n */\nexport function legacyConversationCredentialKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\n/**\n * Sandbox resource identity (container name, cloudflare sandbox scope).\n * Conversation-scoped backends key by office key (ADR 0005): platform-aware,\n * so two platforms sharing a raw conversation id can never share a\n * container, its writable layer, or a cloudflare slot. Containers named\n * under the previous raw-conversation keys are reaped by the provisioner's\n * boot reconcile.\n */\nexport function runtimeResourceKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; address: OfficeAddress },\n): string {\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  return officeKey(ids.address);\n}\n\n/**\n * The raw-id resource key conversation-scoped sandboxes used before the\n * office-key migration; the provisioner's boot reconcile uses it to\n * recognize and reap stale containers.\n */\nexport function legacyConversationResourceKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\nexport function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string {\n  return `${baseId}-${resourceKey}`;\n}\n\nfunction identityKey(kind: \"user\" | \"conversation\" | \"container\", value: string): string {\n  const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, \"\") || \"unknown\";\n  const hash = createHash(\"sha256\")\n    .update(`${kind}\\0${value}`)\n    .digest(\"hex\")\n    .slice(0, IDENTITY_HASH_LENGTH);\n  return `${readable}-${hash}`;\n}\n"]}

package/dist/sandbox/index.d.ts

@@ -1,17 +1,35 @@
 import { ContainerExecutor } from "./container.js";
-import { FirecrackerExecutor } from "./firecracker.js";
 import { CloudflareSandboxExecutor } from "./cloudflare.js";
 import { HostExecutor } from "./host.js";
-import type { Executor, SandboxAdapter, SandboxConfig } from "./types.js";
+import type { Executor, ImageSandboxConfig, RuntimePathContext, SandboxAdapter, SandboxConfig } from "./types.js";
 export type { CloudflareSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter, SandboxConfig, } from "./types.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };
-export { SandboxError } from "./errors.js";
-declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<import("./types.js").ImageSandboxConfig>, SandboxAdapter<import("./types.js").FirecrackerSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
+export { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };
+export { SandboxError } from "./utils.js";
+declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<ImageSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
 export declare function getSandboxAdapters(): readonly [...typeof sandboxAdapters];
+export declare function getSandboxCredentialCapabilities(type: SandboxConfig["type"]): SandboxAdapter["credentials"];
+export declare function getSandboxWorkspaceCapabilities(type: SandboxConfig["type"]): SandboxAdapter["workspace"];
+/**
+ * Only backends with a managed Workspace projection enforce office
+ * visibility (read-only global knowledge, no access to other private
+ * offices). Host, shared-container, and remote backends run every office in
+ * one filesystem and are documented as trusted deployments (ADR 0003), so a
+ * private office there is served with a one-time warning rather than
+ * refused: refusing would take every DM offline on those backends.
+ */
+export declare function assertSandboxSupportsWorkspacePolicy(sandboxConfig: SandboxConfig, visibility: "public" | "private", officeKey: string): void;
 export declare function parseSandboxArg(value: string): SandboxConfig;
 export declare function validateSandbox(config: SandboxConfig): Promise<void>;
 /**
- * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.
+ * Create an executor that runs commands on host, in Docker, or through a
+ * Cloudflare sandbox bridge.
  */
 export declare function createExecutor(config: SandboxConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
+/**
+ * The runtime path context for a sandbox config before an actor-specific
+ * executor is resolved. `image` configs are unresolved by nature (the actor
+ * decides the concrete container), but their mount layout is fixed, so path
+ * mapping is known without resolving.
+ */
+export declare function getUnresolvedSandboxPathContext(sandboxConfig: SandboxConfig, hostWorkspaceRoot: string): RuntimePathContext;
 //# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,QAAA,MAAM,eAAe,sTAMX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CASV"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAG7D,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+B1C,QAAA,MAAM,eAAe,kOAKX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAQD,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,aAAa,CAAC,CAE/B;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,WAAW,CAAC,CAE7B;AAID;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,QAAQ,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,IAAI,CASN;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAMV;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAMpB"}

package/dist/sandbox/index.js

@@ -1,22 +1,76 @@
 import { ContainerExecutor, containerSandboxAdapter } from "./container.js";
-import { FirecrackerExecutor, firecrackerSandboxAdapter } from "./firecracker.js";
 import { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from "./cloudflare.js";
 import { HostExecutor, hostSandboxAdapter } from "./host.js";
-import { imageSandboxAdapter } from "./image.js";
-import { SandboxError } from "./errors.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };
-export { SandboxError } from "./errors.js";
+import { createMountedRuntimePathContext, execSimple, SandboxError } from "./utils.js";
+import * as log from "../log.js";
+export { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };
+export { SandboxError } from "./utils.js";
+function parseImageSandboxArg(value) {
+    if (!value.startsWith("image:")) {
+        return undefined;
+    }
+    const image = value.slice("image:".length);
+    if (!image) {
+        throw new SandboxError("Error: image sandbox requires image name (e.g., image:ubuntu:24.04)");
+    }
+    return { type: "image", image };
+}
+async function validateImageSandbox(config) {
+    try {
+        await execSimple("docker", ["--version"]);
+    }
+    catch {
+        throw new SandboxError("Error: Docker is not installed or not in PATH");
+    }
+    console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);
+}
+const imageSandboxAdapter = {
+    type: "image",
+    credentials: { env: true, fileMounts: true },
+    workspace: { managedProjection: true },
+    parse: parseImageSandboxArg,
+    validate: validateImageSandbox,
+};
 const sandboxAdapters = [
     hostSandboxAdapter,
     containerSandboxAdapter,
     imageSandboxAdapter,
-    firecrackerSandboxAdapter,
     cloudflareSandboxAdapter,
 ];
 const sandboxAdapterByType = new Map(sandboxAdapters.map((adapter) => [adapter.type, adapter]));
 export function getSandboxAdapters() {
     return sandboxAdapters;
 }
+function requireSandboxAdapter(type) {
+    const adapter = sandboxAdapterByType.get(type);
+    if (!adapter)
+        throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);
+    return adapter;
+}
+export function getSandboxCredentialCapabilities(type) {
+    return requireSandboxAdapter(type).credentials;
+}
+export function getSandboxWorkspaceCapabilities(type) {
+    return requireSandboxAdapter(type).workspace;
+}
+const warnedUnenforcedPrivacy = new Set();
+/**
+ * Only backends with a managed Workspace projection enforce office
+ * visibility (read-only global knowledge, no access to other private
+ * offices). Host, shared-container, and remote backends run every office in
+ * one filesystem and are documented as trusted deployments (ADR 0003), so a
+ * private office there is served with a one-time warning rather than
+ * refused: refusing would take every DM offline on those backends.
+ */
+export function assertSandboxSupportsWorkspacePolicy(sandboxConfig, visibility, officeKey) {
+    const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);
+    if (capabilities.managedProjection || visibility === "public")
+        return;
+    if (warnedUnenforcedPrivacy.has(officeKey))
+        return;
+    warnedUnenforcedPrivacy.add(officeKey);
+    log.logWarning(`Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`, "host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs");
+}
 export function parseSandboxArg(value) {
     for (const adapter of sandboxAdapters) {
         const config = adapter.parse(value);
@@ -27,26 +81,32 @@ export function parseSandboxArg(value) {
     if (value.startsWith("docker:")) {
         throw new SandboxError(`Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`);
     }
-    throw new SandboxError(`Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`);
+    throw new SandboxError(`Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`);
 }
 export async function validateSandbox(config) {
-    const adapter = sandboxAdapterByType.get(config.type);
-    if (!adapter) {
-        throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);
-    }
-    await adapter.validate?.(config);
+    await requireSandboxAdapter(config.type).validate?.(config);
 }
 /**
- * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.
+ * Create an executor that runs commands on host, in Docker, or through a
+ * Cloudflare sandbox bridge.
  */
 export function createExecutor(config, env, ensureReady) {
-    const adapter = sandboxAdapterByType.get(config.type);
-    if (!adapter) {
-        throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);
-    }
+    const adapter = requireSandboxAdapter(config.type);
     if (!adapter.createExecutor) {
         throw new SandboxError("Error: image sandbox must resolve to a concrete container executor");
     }
     return adapter.createExecutor(config, env, ensureReady);
 }
+/**
+ * The runtime path context for a sandbox config before an actor-specific
+ * executor is resolved. `image` configs are unresolved by nature (the actor
+ * decides the concrete container), but their mount layout is fixed, so path
+ * mapping is known without resolving.
+ */
+export function getUnresolvedSandboxPathContext(sandboxConfig, hostWorkspaceRoot) {
+    if (sandboxConfig.type === "image") {
+        return createMountedRuntimePathContext(hostWorkspaceRoot, "/workspace");
+    }
+    return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);
+}
 //# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAY3C,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,oIAAoI,CAC1K,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { FirecrackerExecutor, firecrackerSandboxAdapter } from \"./firecracker.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { imageSandboxAdapter } from \"./image.js\";\nimport { SandboxError } from \"./errors.js\";\nimport type { Executor, SandboxAdapter, SandboxConfig } from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };\nexport { SandboxError } from \"./errors.js\";\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  firecrackerSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n\n  await adapter.validate?.(config);\n}\n\n/**\n * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.\n */\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAkBjC,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,mBAAmB,GAAuC;IAC9D,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5C,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;IACtC,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA2B;IACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,GAAG,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAClD,aAA4B,EAC5B,UAAgC,EAChC,SAAiB;IAEjB,MAAM,YAAY,GAAG,+BAA+B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,iBAAiB,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IACtE,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACnD,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,GAAG,CAAC,UAAU,CACZ,YAAY,aAAa,CAAC,IAAI,kDAAkD,SAAS,EAAE,EAC3F,gHAAgH,CACjH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,iGAAiG,CACvI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,aAA4B,EAC5B,iBAAyB;IAEzB,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { createMountedRuntimePathContext, execSimple, SandboxError } from \"./utils.js\";\nimport * as log from \"../log.js\";\nimport type {\n  Executor,\n  ImageSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };\nexport { SandboxError } from \"./utils.js\";\n\nfunction parseImageSandboxArg(value: string): ImageSandboxConfig | undefined {\n  if (!value.startsWith(\"image:\")) {\n    return undefined;\n  }\n\n  const image = value.slice(\"image:\".length);\n  if (!image) {\n    throw new SandboxError(\"Error: image sandbox requires image name (e.g., image:ubuntu:24.04)\");\n  }\n  return { type: \"image\", image };\n}\n\nasync function validateImageSandbox(config: ImageSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n  console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);\n}\n\nconst imageSandboxAdapter: SandboxAdapter<ImageSandboxConfig> = {\n  type: \"image\",\n  credentials: { env: true, fileMounts: true },\n  workspace: { managedProjection: true },\n  parse: parseImageSandboxArg,\n  validate: validateImageSandbox,\n};\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nfunction requireSandboxAdapter(type: SandboxConfig[\"type\"]): SandboxAdapter {\n  const adapter = sandboxAdapterByType.get(type);\n  if (!adapter) throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);\n  return adapter;\n}\n\nexport function getSandboxCredentialCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"credentials\"] {\n  return requireSandboxAdapter(type).credentials;\n}\n\nexport function getSandboxWorkspaceCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"workspace\"] {\n  return requireSandboxAdapter(type).workspace;\n}\n\nconst warnedUnenforcedPrivacy = new Set<string>();\n\n/**\n * Only backends with a managed Workspace projection enforce office\n * visibility (read-only global knowledge, no access to other private\n * offices). Host, shared-container, and remote backends run every office in\n * one filesystem and are documented as trusted deployments (ADR 0003), so a\n * private office there is served with a one-time warning rather than\n * refused: refusing would take every DM offline on those backends.\n */\nexport function assertSandboxSupportsWorkspacePolicy(\n  sandboxConfig: SandboxConfig,\n  visibility: \"public\" | \"private\",\n  officeKey: string,\n): void {\n  const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);\n  if (capabilities.managedProjection || visibility === \"public\") return;\n  if (warnedUnenforcedPrivacy.has(officeKey)) return;\n  warnedUnenforcedPrivacy.add(officeKey);\n  log.logWarning(\n    `Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`,\n    \"host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs\",\n  );\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  await requireSandboxAdapter(config.type).validate?.(config);\n}\n\n/**\n * Create an executor that runs commands on host, in Docker, or through a\n * Cloudflare sandbox bridge.\n */\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = requireSandboxAdapter(config.type);\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n\n/**\n * The runtime path context for a sandbox config before an actor-specific\n * executor is resolved. `image` configs are unresolved by nature (the actor\n * decides the concrete container), but their mount layout is fixed, so path\n * mapping is known without resolving.\n */\nexport function getUnresolvedSandboxPathContext(\n  sandboxConfig: SandboxConfig,\n  hostWorkspaceRoot: string,\n): RuntimePathContext {\n  if (sandboxConfig.type === \"image\") {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);\n}\n"]}