@huaweidevtools/aishell-dsh-e2b 0.0.0-stage → 0.0.1-beta.4

package/lib/index.js

@@ -0,0 +1,2545 @@
+import { Sandbox } from "e2b";
+import { createCredentialsStore } from "@huaweidevtools/aishell-dsh-credentials-store";
+import { FOREVER_EXPIRY, clearE2BKey, fingerprint, readE2BKey, readStoredPair, writeE2BKey } from "@huaweidevtools/aishell-dsh-credentials-store/accounts";
+import { sign } from "@huaweidevtools/aishell-dsh-credentials-store/signer";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+
+//#region ../../node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.5/node_modules/@deepseek-ai/cosmokit/lib/index.js
+/** Return true when a value is `null` or `undefined`. */
+function isNullable(value) {
+	return value === null || value === void 0;
+}
+/** Return true for non-array object values. */
+function isPlainObject(data) {
+	return data && typeof data === "object" && !Array.isArray(data);
+}
+/** Filter object entries and return a new object. */
+function filterKeys(object, filter) {
+	return Object.fromEntries(Object.entries(object).filter(([key, value]) => filter(key, value)));
+}
+/** Map object values while preserving the original key set. */
+function mapValues(object, transform) {
+	return Object.fromEntries(Object.entries(object).map(([key, value]) => [key, transform(value, key)]));
+}
+/** Pick selected keys from an object, optionally including `undefined` values. */
+function pick(source, keys, forced) {
+	if (!keys) return { ...source };
+	const result = {};
+	for (const key of keys) if (forced || source[key] !== void 0) result[key] = source[key];
+	return result;
+}
+/** Shared config references used by schema validators and plugin runtimes. */
+const write = Symbol.for("cosmokit.volatile.write");
+function snapshot(value, ancestors = /* @__PURE__ */ new Set()) {
+	if (typeof value === "function") throw new TypeError("volatile config cannot contain functions");
+	if (value === null || typeof value !== "object") return value;
+	if (ancestors.has(value)) throw new TypeError("volatile config cannot contain cycles");
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) return Object.freeze(value.map((item) => snapshot(item, ancestors)));
+		if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) throw new TypeError("volatile config objects must be plain objects or arrays");
+		return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, item]) => [key, snapshot(item, ancestors)])));
+	} finally {
+		ancestors.delete(value);
+	}
+}
+/**
+* Create a detached reference containing an immutable copy of the supplied data.
+* @param value - validated config data; class instances and functions are unsupported.
+* @returns a reference whose value is updated only by its owning runtime.
+*/
+function createVolatile(value) {
+	let current = snapshot(value);
+	return Object.freeze({
+		get: () => current,
+		[write]: (value$1) => {
+			current = value$1;
+		}
+	});
+}
+/**
+* Identify references across ESM/CJS copies of the shared library.
+* @param value - a parsed config value.
+* @returns whether the value implements the shared reference protocol.
+*/
+function isVolatile(value) {
+	return typeof value === "object" && value !== null && write in value;
+}
+/** Test values using `instanceof` with a `toStringTag` fallback. */
+function is(type, value) {
+	if (arguments.length === 1) return (value$1) => is(type, value$1);
+	return type in globalThis && value instanceof globalThis[type] || Object.prototype.toString.call(value).slice(8, -1) === type;
+}
+function isArrayBufferLike(value) {
+	return is("ArrayBuffer", value) || is("SharedArrayBuffer", value);
+}
+function isArrayBufferSource(value) {
+	return isArrayBufferLike(value) || ArrayBuffer.isView(value);
+}
+/** Binary source detection and base64/hex conversion helpers. */
+var Binary;
+(function(Binary$1) {
+	Binary$1.is = isArrayBufferLike;
+	Binary$1.isSource = isArrayBufferSource;
+	function fromSource(source) {
+		if (ArrayBuffer.isView(source)) return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+		else return source;
+	}
+	Binary$1.fromSource = fromSource;
+	function toBase64(source) {
+		source = fromSource(source);
+		if (typeof Buffer !== "undefined") return Buffer.from(source).toString("base64");
+		let binary = "";
+		const bytes = new Uint8Array(source);
+		for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i]);
+		return btoa(binary);
+	}
+	Binary$1.toBase64 = toBase64;
+	function fromBase64(source) {
+		if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "base64"));
+		return Uint8Array.from(atob(source), (c) => c.charCodeAt(0));
+	}
+	Binary$1.fromBase64 = fromBase64;
+	function toHex(source) {
+		source = fromSource(source);
+		if (typeof Buffer !== "undefined") return Buffer.from(source).toString("hex");
+		return Array.from(new Uint8Array(source), (byte) => byte.toString(16).padStart(2, "0")).join("");
+	}
+	Binary$1.toHex = toHex;
+	function fromHex(source) {
+		if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "hex"));
+		const hex = source.length % 2 === 0 ? source : source.slice(0, source.length - 1);
+		const buffer = [];
+		for (let i = 0; i < hex.length; i += 2) buffer.push(parseInt(`${hex[i]}${hex[i + 1]}`, 16));
+		return Uint8Array.from(buffer).buffer;
+	}
+	Binary$1.fromHex = fromHex;
+})(Binary || (Binary = {}));
+/** Decode a base64 string into binary data. */
+const base64ToArrayBuffer = Binary.fromBase64;
+/** Encode binary data as base64. */
+const arrayBufferToBase64 = Binary.toBase64;
+/** Decode a hex string into binary data. */
+const hexToArrayBuffer = Binary.fromHex;
+/** Encode binary data as hex. */
+const arrayBufferToHex = Binary.toHex;
+/** Deep-clone common JavaScript values while preserving prototypes and cycles. */
+function clone(source, refs = /* @__PURE__ */ new Map()) {
+	if (!source || typeof source !== "object") return source;
+	if (is("Date", source)) return new Date(source.valueOf());
+	if (is("RegExp", source)) return new RegExp(source.source, source.flags);
+	if (isArrayBufferLike(source)) return source.slice(0);
+	if (ArrayBuffer.isView(source)) return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+	const cached = refs.get(source);
+	if (cached) return cached;
+	if (Array.isArray(source)) {
+		const result$1 = [];
+		refs.set(source, result$1);
+		source.forEach((value, index) => {
+			result$1[index] = Reflect.apply(clone, null, [value, refs]);
+		});
+		return result$1;
+	}
+	const result = Object.create(Object.getPrototypeOf(source));
+	refs.set(source, result);
+	for (const key of Reflect.ownKeys(source)) {
+		const descriptor = { ...Reflect.getOwnPropertyDescriptor(source, key) };
+		if ("value" in descriptor) descriptor.value = Reflect.apply(clone, null, [descriptor.value, refs]);
+		Reflect.defineProperty(result, key, descriptor);
+	}
+	return result;
+}
+/**
+* Compare values recursively, treating two volatile references as equal regardless of value.
+* Strict comparison distinguishes null/undefined, treats opaque objects by identity,
+* compares URLs by normalized href, treats array holes as undefined, and considers distinct cyclic structures unequal.
+* @param a - first value.
+* @param b - second value.
+* @param strict - whether to require strict data equality outside volatile references.
+* @returns whether the values compare equal.
+*/
+function deepEqual(a, b, strict) {
+	const ancestors = /* @__PURE__ */ new Set();
+	function compare(a$1, b$1) {
+		if (a$1 === b$1) return true;
+		if (isVolatile(a$1) || isVolatile(b$1)) return isVolatile(a$1) && isVolatile(b$1);
+		if (!strict && isNullable(a$1) && isNullable(b$1)) return true;
+		if (typeof a$1 !== typeof b$1 || typeof a$1 !== "object" || !a$1 || !b$1) return false;
+		if (ancestors.has(a$1)) return false;
+		function check(test, then) {
+			return test(a$1) ? test(b$1) ? then(a$1, b$1) : false : test(b$1) ? false : void 0;
+		}
+		ancestors.add(a$1);
+		try {
+			return check(Array.isArray, (a$2, b$2) => {
+				if (a$2.length !== b$2.length) return false;
+				for (let index = 0; index < a$2.length; index++) if (!compare(a$2[index], b$2[index])) return false;
+				return true;
+			}) ?? check(is("Date"), (a$2, b$2) => a$2.valueOf() === b$2.valueOf()) ?? check(is("URL"), (a$2, b$2) => a$2.href === b$2.href) ?? check(is("RegExp"), (a$2, b$2) => a$2.source === b$2.source && a$2.flags === b$2.flags) ?? check(isArrayBufferLike, (a$2, b$2) => {
+				if (a$2.byteLength !== b$2.byteLength) return false;
+				const viewA = new Uint8Array(a$2);
+				const viewB = new Uint8Array(b$2);
+				for (let i = 0; i < viewA.length; i++) if (viewA[i] !== viewB[i]) return false;
+				return true;
+			}) ?? ((!strict || [a$1, b$1].every((value) => Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) && Object.keys({
+				...a$1,
+				...b$1
+			}).every((key) => compare(a$1[key], b$1[key])));
+		} finally {
+			ancestors.delete(a$1);
+		}
+	}
+	return compare(a, b);
+}
+/** Time constants plus parsing and formatting helpers. */
+var Time;
+(function(Time$1) {
+	Time$1.millisecond = 1;
+	Time$1.second = 1e3;
+	Time$1.minute = Time$1.second * 60;
+	Time$1.hour = Time$1.minute * 60;
+	Time$1.day = Time$1.hour * 24;
+	Time$1.week = Time$1.day * 7;
+	let timezoneOffset = (/* @__PURE__ */ new Date()).getTimezoneOffset();
+	function setTimezoneOffset(offset) {
+		timezoneOffset = offset;
+	}
+	Time$1.setTimezoneOffset = setTimezoneOffset;
+	function getTimezoneOffset() {
+		return timezoneOffset;
+	}
+	Time$1.getTimezoneOffset = getTimezoneOffset;
+	function getDateNumber(date = /* @__PURE__ */ new Date(), offset) {
+		if (typeof date === "number") date = new Date(date);
+		if (offset === void 0) offset = timezoneOffset;
+		return Math.floor((date.valueOf() / Time$1.minute - offset) / 1440);
+	}
+	Time$1.getDateNumber = getDateNumber;
+	function fromDateNumber(value, offset) {
+		const date = new Date(value * Time$1.day);
+		if (offset === void 0) offset = timezoneOffset;
+		return new Date(+date + offset * Time$1.minute);
+	}
+	Time$1.fromDateNumber = fromDateNumber;
+	const numeric = /\d+(?:\.\d+)?/.source;
+	const timeRegExp = new RegExp(`^${[
+		"w(?:eek(?:s)?)?",
+		"d(?:ay(?:s)?)?",
+		"h(?:our(?:s)?)?",
+		"m(?:in(?:ute)?(?:s)?)?",
+		"s(?:ec(?:ond)?(?:s)?)?"
+	].map((unit) => `(${numeric}${unit})?`).join("")}$`);
+	function parseTime(source) {
+		const capture = timeRegExp.exec(source);
+		if (!capture) return 0;
+		return (parseFloat(capture[1]) * Time$1.week || 0) + (parseFloat(capture[2]) * Time$1.day || 0) + (parseFloat(capture[3]) * Time$1.hour || 0) + (parseFloat(capture[4]) * Time$1.minute || 0) + (parseFloat(capture[5]) * Time$1.second || 0);
+	}
+	Time$1.parseTime = parseTime;
+	function parseDate(date) {
+		const parsed = parseTime(date);
+		if (parsed) date = Date.now() + parsed;
+		else if (/^\d{1,2}(:\d{1,2}){1,2}$/.test(date)) date = `${(/* @__PURE__ */ new Date()).toLocaleDateString()}-${date}`;
+		else if (/^\d{1,2}-\d{1,2}-\d{1,2}(:\d{1,2}){1,2}$/.test(date)) date = `${(/* @__PURE__ */ new Date()).getFullYear()}-${date}`;
+		return date ? new Date(date) : /* @__PURE__ */ new Date();
+	}
+	Time$1.parseDate = parseDate;
+	function format(ms) {
+		const abs = Math.abs(ms);
+		if (abs >= Time$1.day - Time$1.hour / 2) return Math.round(ms / Time$1.day) + "d";
+		else if (abs >= Time$1.hour - Time$1.minute / 2) return Math.round(ms / Time$1.hour) + "h";
+		else if (abs >= Time$1.minute - Time$1.second / 2) return Math.round(ms / Time$1.minute) + "m";
+		else if (abs >= Time$1.second) return Math.round(ms / Time$1.second) + "s";
+		return ms + "ms";
+	}
+	Time$1.format = format;
+	function toDigits(source, length = 2) {
+		return source.toString().padStart(length, "0");
+	}
+	Time$1.toDigits = toDigits;
+	function template(template$1, time = /* @__PURE__ */ new Date()) {
+		return template$1.replace("yyyy", time.getFullYear().toString()).replace("yy", time.getFullYear().toString().slice(2)).replace("MM", toDigits(time.getMonth() + 1)).replace("dd", toDigits(time.getDate())).replace("hh", toDigits(time.getHours())).replace("mm", toDigits(time.getMinutes())).replace("ss", toDigits(time.getSeconds())).replace("SSS", toDigits(time.getMilliseconds(), 3));
+	}
+	Time$1.template = template;
+})(Time || (Time = {}));
+
+//#endregion
+//#region ../../node_modules/.pnpm/@deepseek-ai+schemastery@3.18.4/node_modules/@deepseek-ai/schemastery/lib/index.mjs
+const kSchema = Symbol.for("schemastery");
+const kValidationError = Symbol.for("ValidationError");
+globalThis.__schemastery_index__ ??= 0;
+globalThis.__schemastery_refs__ = void 0;
+var ValidationError = class extends TypeError {
+	options;
+	name = "ValidationError";
+	constructor(message, options) {
+		let prefix = "$";
+		for (const segment of options.path || []) if (typeof segment === "string") prefix += "." + segment;
+		else if (typeof segment === "number") prefix += "[" + segment + "]";
+		else if (typeof segment === "symbol") prefix += `[Symbol(${segment.toString()})]`;
+		if (prefix.startsWith(".")) prefix = prefix.slice(1);
+		super((prefix === "$" ? "" : `${prefix} `) + message);
+		this.options = options;
+	}
+	static is(error) {
+		return !!error?.[kValidationError];
+	}
+};
+Object.defineProperty(ValidationError.prototype, kValidationError, { value: true });
+const Schema = function(options) {
+	const schema = function(data, options$1 = {}) {
+		return Schema.resolve(data, schema, options$1)[0];
+	};
+	if (options.refs) {
+		const refs = mapValues(options.refs, (options$1) => new Schema(options$1));
+		const getRef = (uid) => refs[uid];
+		for (const key in refs) {
+			const options$1 = refs[key];
+			options$1.sKey = getRef(options$1.sKey);
+			options$1.inner = getRef(options$1.inner);
+			options$1.list = options$1.list && options$1.list.map(getRef);
+			options$1.dict = options$1.dict && mapValues(options$1.dict, getRef);
+		}
+		return refs[options.uid];
+	}
+	Object.assign(schema, options);
+	if (typeof schema.callback === "string") try {
+		schema.callback = new Function("return " + schema.callback)();
+	} catch {}
+	Object.defineProperty(schema, "uid", { value: globalThis.__schemastery_index__++ });
+	Object.setPrototypeOf(schema, Schema.prototype);
+	schema.meta ||= {};
+	schema.toString = schema.toString.bind(schema);
+	return schema;
+};
+Schema.prototype = Object.create(Function.prototype);
+Schema.prototype[kSchema] = true;
+Object.defineProperty(Schema.prototype, "~standard", { get() {
+	return {
+		version: 1,
+		vendor: "schemastery",
+		validate: (value) => {
+			try {
+				return { value: Schema.resolve(value, this, {})[0] };
+			} catch (error) {
+				if (ValidationError.is(error)) return { issues: [{
+					message: error.message,
+					path: error.options.path
+				}] };
+				throw error;
+			}
+		}
+	};
+} });
+Schema.ValidationError = ValidationError;
+Schema.prototype.toJSON = function toJSON() {
+	if (globalThis.__schemastery_refs__) {
+		globalThis.__schemastery_refs__[this.uid] ??= JSON.parse(JSON.stringify({ ...this }));
+		return this.uid;
+	}
+	globalThis.__schemastery_refs__ = { [this.uid]: { ...this } };
+	globalThis.__schemastery_refs__[this.uid] = JSON.parse(JSON.stringify({ ...this }));
+	const result = {
+		uid: this.uid,
+		refs: globalThis.__schemastery_refs__
+	};
+	globalThis.__schemastery_refs__ = void 0;
+	return result;
+};
+Schema.prototype.set = function set(key, value) {
+	this.dict[key] = value;
+	return this;
+};
+Schema.prototype.push = function push(value) {
+	this.list.push(value);
+	return this;
+};
+function mergeDesc(original, messages) {
+	const result = typeof original === "string" ? { "": original } : { ...original };
+	for (const locale in messages) {
+		const value = messages[locale];
+		if (value?.$description || value?.$desc) result[locale] = value.$description || value.$desc;
+		else if (typeof value === "string") result[locale] = value;
+	}
+	return result;
+}
+function getInner(value) {
+	return value?.$value ?? value?.$inner;
+}
+function extractKeys(data) {
+	return filterKeys(data ?? {}, (key) => !key.startsWith("$"));
+}
+Schema.prototype.i18n = function i18n(messages) {
+	const schema = Schema(this);
+	const desc = mergeDesc(schema.meta.description, messages);
+	if (Object.keys(desc).length) schema.meta.description = desc;
+	if (schema.dict) schema.dict = mapValues(schema.dict, (inner, key) => {
+		return inner.i18n(mapValues(messages, (data) => getInner(data)?.[key] ?? data?.[key]));
+	});
+	if (schema.list) schema.list = schema.list.map((inner, index) => {
+		return inner.i18n(mapValues(messages, (data = {}) => {
+			if (Array.isArray(getInner(data))) return getInner(data)[index];
+			if (Array.isArray(data)) return data[index];
+			return extractKeys(data);
+		}));
+	});
+	if (schema.inner) schema.inner = schema.inner.i18n(mapValues(messages, (data) => {
+		if (getInner(data)) return getInner(data);
+		return extractKeys(data);
+	}));
+	if (schema.sKey) schema.sKey = schema.sKey.i18n(mapValues(messages, (data) => data?.$key));
+	return schema;
+};
+Schema.prototype.extra = function extra(key, value) {
+	const schema = Schema(this);
+	schema.meta = {
+		...schema.meta,
+		[key]: value
+	};
+	return schema;
+};
+for (const key of [
+	"required",
+	"disabled",
+	"collapse",
+	"hidden",
+	"loose"
+]) Object.assign(Schema.prototype, { [key](value = true) {
+	const schema = Schema(this);
+	schema.meta = {
+		...schema.meta,
+		[key]: value
+	};
+	return schema;
+} });
+Schema.prototype.deprecated = function deprecated() {
+	const schema = Schema(this);
+	schema.meta.badges ||= [];
+	schema.meta.badges.push({
+		text: "deprecated",
+		type: "danger"
+	});
+	return schema;
+};
+Schema.prototype.experimental = function experimental() {
+	const schema = Schema(this);
+	schema.meta.badges ||= [];
+	schema.meta.badges.push({
+		text: "experimental",
+		type: "warning"
+	});
+	return schema;
+};
+Schema.prototype.pattern = function pattern(regexp) {
+	const schema = Schema(this);
+	const pattern$1 = pick(regexp, ["source", "flags"]);
+	schema.meta = {
+		...schema.meta,
+		pattern: pattern$1
+	};
+	return schema;
+};
+Schema.prototype.simplify = function simplify(value) {
+	if (isVolatile(value)) value = value.get();
+	if (deepEqual(value, this.meta.default, this.type === "dict")) return null;
+	if (isNullable(value)) return value;
+	if (this.type === "object" || this.type === "dict") {
+		const result = {};
+		for (const key in value) {
+			const item = (this.type === "object" ? this.dict[key] : this.inner)?.simplify(value[key]);
+			if (this.type === "dict" || !isNullable(item)) result[key] = item;
+		}
+		if (deepEqual(result, this.meta.default, this.type === "dict")) return null;
+		return result;
+	} else if (this.type === "array" || this.type === "tuple") {
+		const result = [];
+		value.forEach((value$1, index) => {
+			const schema = this.type === "array" ? this.inner : this.list[index];
+			const item = schema ? schema.simplify(value$1) : value$1;
+			result.push(item);
+		});
+		return result;
+	} else if (this.type === "intersect") {
+		const result = {};
+		for (const item of this.list) Object.assign(result, item.simplify(value));
+		return result;
+	} else if (this.type === "union") for (const schema of this.list) try {
+		Schema.resolve(value, schema, {});
+		return schema.simplify(value);
+	} catch {}
+	return value;
+};
+Schema.prototype.toString = function toString(inline) {
+	return formatters[this.type]?.(this, inline) ?? `Schema<${this.type}>`;
+};
+Schema.prototype.role = function role(role$1, extra) {
+	const schema = Schema(this);
+	schema.meta = {
+		...schema.meta,
+		role: role$1,
+		extra
+	};
+	return schema;
+};
+for (const key of [
+	"default",
+	"link",
+	"comment",
+	"description",
+	"max",
+	"min",
+	"step"
+]) Object.assign(Schema.prototype, { [key](value) {
+	const schema = Schema(this);
+	schema.meta = {
+		...schema.meta,
+		[key]: value
+	};
+	return schema;
+} });
+Schema.prototype.volatile = function volatile() {
+	if (this.meta.volatile) throw new TypeError("volatile schema is already wrapped");
+	return this.extra("volatile", true);
+};
+const resolvers = {};
+const checkedVolatile = Symbol("checked-volatile-schema");
+function validateVolatileSchema(schema, path = [], blocked = false, seen = /* @__PURE__ */ new Map()) {
+	const states = seen.get(schema) ?? /* @__PURE__ */ new Set();
+	if (states.has(blocked)) return;
+	states.add(blocked);
+	seen.set(schema, states);
+	if (schema.meta?.volatile && blocked) throw new ValidationError("volatile fields require a fixed object path without an enclosing volatile field", { path });
+	const nested = blocked || !!schema.meta?.volatile;
+	if (schema.dict) for (const [key, child] of Object.entries(schema.dict)) validateVolatileSchema(child, [...path, key], nested, seen);
+	if (schema.sKey) validateVolatileSchema(schema.sKey, [...path, "<key>"], true, seen);
+	if (schema.inner && (schema.type !== "lazy" || schema.inner[kSchema])) validateVolatileSchema(schema.inner, [...path, "*"], true, seen);
+	if (schema.list) for (let index = 0; index < schema.list.length; index++) validateVolatileSchema(schema.list[index], [...path, String(index)], true, seen);
+}
+Schema.extend = function extend(type, resolve) {
+	resolvers[type] = resolve;
+};
+Schema.resolve = function resolve(data, schema, options = {}, strict = false) {
+	if (!schema) return [data];
+	if (!options[checkedVolatile]) {
+		validateVolatileSchema(schema, options.path);
+		options = {
+			...options,
+			[checkedVolatile]: true
+		};
+	}
+	if (schema.meta?.volatile) {
+		const inner = Schema(schema);
+		inner.meta = {
+			...schema.meta,
+			volatile: false
+		};
+		const [value, adapted] = Schema.resolve(data, inner, options, strict);
+		try {
+			return [createVolatile(value), adapted];
+		} catch (error) {
+			throw new ValidationError(error instanceof Error ? error.message : String(error), options);
+		}
+	}
+	if (options.ignore?.(data, schema)) return [data];
+	if (isNullable(data) && schema.type !== "lazy") {
+		if (schema.meta.required) throw new ValidationError(`missing required value`, options);
+		let current = schema;
+		let fallback = schema.meta.default;
+		while (current?.type === "intersect" && isNullable(fallback)) {
+			current = current.list[0];
+			fallback = current?.meta.default;
+		}
+		if (isNullable(fallback)) return [data];
+		data = clone(fallback);
+	}
+	const callback = resolvers[schema.type];
+	if (!callback) throw new ValidationError(`unsupported type "${schema.type}"`, options);
+	try {
+		return callback(data, schema, options, strict);
+	} catch (error) {
+		if (!schema.meta.loose) throw error;
+		return [schema.meta.default];
+	}
+};
+Schema.from = function from(source) {
+	if (isNullable(source)) return Schema.any();
+	else if ([
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof source)) return Schema.const(source).required();
+	else if (source[kSchema]) return source;
+	else if (typeof source === "function") switch (source) {
+		case String: return Schema.string().required();
+		case Number: return Schema.number().required();
+		case Boolean: return Schema.boolean().required();
+		case Function: return Schema.function().required();
+		default: return Schema.is(source).required();
+	}
+	else throw new TypeError(`cannot infer schema from ${source}`);
+};
+Schema.lazy = function lazy(builder) {
+	const toJSON = () => {
+		if (!schema.inner[kSchema]) {
+			schema.inner = schema.builder();
+			schema.inner.meta = {
+				...schema.meta,
+				...schema.inner.meta
+			};
+		}
+		return schema.inner.toJSON();
+	};
+	const schema = new Schema({
+		type: "lazy",
+		builder,
+		inner: { toJSON }
+	});
+	return schema;
+};
+Schema.natural = function natural() {
+	return Schema.number().step(1).min(0);
+};
+Schema.percent = function percent() {
+	return Schema.number().step(.01).min(0).max(1).role("slider");
+};
+Schema.date = function date() {
+	return Schema.union([Schema.is(Date), Schema.transform(Schema.string().role("datetime"), (value, options) => {
+		const date$1 = new Date(value);
+		if (isNaN(+date$1)) throw new ValidationError(`invalid date "${value}"`, options);
+		return date$1;
+	}, true)]);
+};
+Schema.regExp = function regExp(flag = "") {
+	return Schema.union([Schema.is(RegExp), Schema.transform(Schema.string().role("regexp", { flag }), (value, options) => {
+		try {
+			return new RegExp(value, flag);
+		} catch (e) {
+			throw new ValidationError(e.message, options);
+		}
+	}, true)]);
+};
+Schema.arrayBuffer = function arrayBuffer(encoding) {
+	return Schema.union([
+		Schema.is(ArrayBuffer),
+		Schema.is(SharedArrayBuffer),
+		Schema.transform(Schema.any(), (value, options) => {
+			if (Binary.isSource(value)) return Binary.fromSource(value);
+			throw new ValidationError(`expected ArrayBufferSource but got ${value}`, options);
+		}, true),
+		...encoding ? [Schema.transform(Schema.string(), (value, options) => {
+			try {
+				return encoding === "base64" ? Binary.fromBase64(value) : Binary.fromHex(value);
+			} catch (e) {
+				throw new ValidationError(e.message, options);
+			}
+		}, true)] : []
+	]);
+};
+Schema.extend("lazy", (data, schema, options, strict) => {
+	if (!schema.inner[kSchema]) {
+		schema.inner = schema.builder();
+		schema.inner.meta = {
+			...schema.meta,
+			...schema.inner.meta
+		};
+		validateVolatileSchema(schema.inner, options.path, true);
+	}
+	return Schema.resolve(data, schema.inner, options, strict);
+});
+Schema.extend("any", (data) => {
+	return [data];
+});
+Schema.extend("never", (data, _, options) => {
+	throw new ValidationError(`expected nullable but got ${data}`, options);
+});
+Schema.extend("const", (data, { value }, options) => {
+	if (deepEqual(data, value)) return [value];
+	throw new ValidationError(`expected ${value} but got ${data}`, options);
+});
+function checkWithinRange(data, meta, description, options, skipMin = false) {
+	const { max = Infinity, min = -Infinity } = meta;
+	if (data > max) throw new ValidationError(`expected ${description} <= ${max} but got ${data}`, options);
+	if (data < min && !skipMin) throw new ValidationError(`expected ${description} >= ${min} but got ${data}`, options);
+}
+Schema.extend("string", (data, { meta }, options) => {
+	if (typeof data !== "string") throw new ValidationError(`expected string but got ${data}`, options);
+	if (meta.pattern) {
+		const regexp = new RegExp(meta.pattern.source, meta.pattern.flags);
+		if (!regexp.test(data)) throw new ValidationError(`expect string to match regexp ${regexp}`, options);
+	}
+	checkWithinRange(data.length, meta, "string length", options);
+	return [data];
+});
+function decimalShift(data, digits) {
+	const str = data.toString();
+	if (str.includes("e")) return data * Math.pow(10, digits);
+	const index = str.indexOf(".");
+	if (index === -1) return data * Math.pow(10, digits);
+	const frac = str.slice(index + 1);
+	const integer = str.slice(0, index);
+	if (frac.length <= digits) return +(integer + frac.padEnd(digits, "0"));
+	return +(integer + frac.slice(0, digits) + "." + frac.slice(digits));
+}
+function isMultipleOf(data, min, step) {
+	step = Math.abs(step);
+	if (!/^\d+\.\d+$/.test(step.toString())) return (data - min) % step === 0;
+	const index = step.toString().indexOf(".");
+	const digits = step.toString().slice(index + 1).length;
+	return Math.abs(decimalShift(data, digits) - decimalShift(min, digits)) % decimalShift(step, digits) === 0;
+}
+Schema.extend("number", (data, { meta }, options) => {
+	if (typeof data !== "number") throw new ValidationError(`expected number but got ${data}`, options);
+	checkWithinRange(data, meta, "number", options);
+	const { step } = meta;
+	if (step && !isMultipleOf(data, meta.min ?? 0, step)) throw new ValidationError(`expected number multiple of ${step} but got ${data}`, options);
+	return [data];
+});
+Schema.extend("boolean", (data, _, options) => {
+	if (typeof data === "boolean") return [data];
+	throw new ValidationError(`expected boolean but got ${data}`, options);
+});
+Schema.extend("bitset", (data, { bits, meta }, options) => {
+	let value = 0, keys = [];
+	if (typeof data === "number") {
+		value = data;
+		for (const key in bits) if (data & bits[key]) keys.push(key);
+	} else if (Array.isArray(data)) {
+		keys = data;
+		for (const key of keys) {
+			if (typeof key !== "string") throw new ValidationError(`expected string but got ${key}`, options);
+			if (key in bits) value |= bits[key];
+		}
+	} else throw new ValidationError(`expected number or array but got ${data}`, options);
+	if (value === meta.default) return [value];
+	return [value, keys];
+});
+Schema.extend("function", (data, _, options) => {
+	if (typeof data === "function") return [data];
+	throw new ValidationError(`expected function but got ${data}`, options);
+});
+Schema.extend("is", (data, { constructor }, options) => {
+	if (typeof constructor === "function") {
+		if (data instanceof constructor) return [data];
+		throw new ValidationError(`expected ${constructor.name} but got ${data}`, options);
+	} else {
+		if (isNullable(data)) throw new ValidationError(`expected ${constructor} but got ${data}`, options);
+		let prototype = Object.getPrototypeOf(data);
+		while (prototype) {
+			if (prototype.constructor?.name === constructor) return [data];
+			prototype = Object.getPrototypeOf(prototype);
+		}
+		throw new ValidationError(`expected ${constructor} but got ${data}`, options);
+	}
+});
+function property(data, key, schema, options) {
+	try {
+		const [value, adapted] = Schema.resolve(data[key], schema, {
+			...options,
+			path: [...options.path || [], key]
+		});
+		if (adapted !== void 0) data[key] = adapted;
+		return value;
+	} catch (e) {
+		if (!options?.autofix) throw e;
+		delete data[key];
+		return schema.meta.volatile ? createVolatile(schema.meta.default) : schema.meta.default;
+	}
+}
+Schema.extend("array", (data, { inner, meta }, options) => {
+	if (!Array.isArray(data)) throw new ValidationError(`expected array but got ${data}`, options);
+	checkWithinRange(data.length, meta, "array length", options, !isNullable(inner.meta.default));
+	return [data.map((_, index) => property(data, index, inner, options))];
+});
+Schema.extend("dict", (data, { inner, sKey }, options, strict) => {
+	if (!isPlainObject(data)) throw new ValidationError(`expected object but got ${data}`, options);
+	const result = {};
+	for (const key in data) {
+		let rKey;
+		try {
+			rKey = Schema.resolve(key, sKey, options)[0];
+		} catch (error) {
+			if (strict) continue;
+			throw error;
+		}
+		result[rKey] = property(data, key, inner, options);
+		data[rKey] = data[key];
+		if (key !== rKey) delete data[key];
+	}
+	return [result];
+});
+Schema.extend("tuple", (data, { list }, options, strict) => {
+	if (!Array.isArray(data)) throw new ValidationError(`expected array but got ${data}`, options);
+	const result = list.map((inner, index) => property(data, index, inner, options));
+	if (strict) return [result];
+	result.push(...data.slice(list.length));
+	return [result];
+});
+function merge(result, data) {
+	for (const key in data) {
+		if (key in result) continue;
+		result[key] = data[key];
+	}
+}
+Schema.extend("object", (data, { dict }, options, strict) => {
+	if (!isPlainObject(data)) throw new ValidationError(`expected object but got ${data}`, options);
+	const result = {};
+	for (const key in dict) {
+		const value = property(data, key, dict[key], options);
+		if (!isNullable(value) || key in data) result[key] = value;
+	}
+	if (!strict) merge(result, data);
+	return [result];
+});
+Schema.extend("union", (data, { list, toString }, options, strict) => {
+	const messages = [];
+	for (const inner of list) try {
+		return Schema.resolve(data, inner, options, strict);
+	} catch (error) {
+		messages.push(error);
+	}
+	throw new ValidationError(`expected ${toString()} but got ${JSON.stringify(data)}`, options);
+});
+Schema.extend("intersect", (data, { list, toString }, options, strict) => {
+	if (!list.length) return [data];
+	let result;
+	for (const inner of list) {
+		const value = Schema.resolve(data, inner, options, true)[0];
+		if (isNullable(value)) continue;
+		if (isNullable(result)) result = value;
+		else if (typeof result !== typeof value) throw new ValidationError(`expected ${toString()} but got ${JSON.stringify(data)}`, options);
+		else if (typeof value === "object") merge(result ??= {}, value);
+		else if (result !== value) throw new ValidationError(`expected ${toString()} but got ${JSON.stringify(data)}`, options);
+	}
+	if (!strict && isPlainObject(data)) merge(result, data);
+	return [result];
+});
+Schema.extend("transform", (data, { inner, callback, preserve }, options) => {
+	const [result, adapted = data] = Schema.resolve(data, inner, options, true);
+	if (preserve) return [callback(result)];
+	else return [callback(result), callback(adapted)];
+});
+const formatters = {};
+function defineMethod(name$1, keys, format) {
+	formatters[name$1] = format;
+	Object.assign(Schema, { [name$1](...args) {
+		const schema = new Schema({ type: name$1 });
+		keys.forEach((key, index) => {
+			switch (key) {
+				case "sKey":
+					schema.sKey = args[index] ?? Schema.string();
+					break;
+				case "inner":
+					schema.inner = Schema.from(args[index]);
+					break;
+				case "list":
+					schema.list = args[index].map(Schema.from);
+					break;
+				case "dict":
+					schema.dict = mapValues(args[index], Schema.from);
+					break;
+				case "bits":
+					schema.bits = {};
+					for (const key$1 in args[index]) {
+						if (typeof args[index][key$1] !== "number") continue;
+						schema.bits[key$1] = args[index][key$1];
+					}
+					break;
+				case "callback": {
+					const callback = schema.callback = args[index];
+					callback["toJSON"] ||= () => callback.toString();
+					break;
+				}
+				case "constructor": {
+					const constructor = schema.constructor = args[index];
+					if (typeof constructor === "function") constructor["toJSON"] ||= () => constructor["name"];
+					break;
+				}
+				default: schema[key] = args[index];
+			}
+		});
+		if (name$1 === "object" || name$1 === "dict") schema.meta.default = {};
+		else if (name$1 === "array" || name$1 === "tuple") schema.meta.default = [];
+		else if (name$1 === "bitset") schema.meta.default = 0;
+		return schema;
+	} });
+}
+defineMethod("is", ["constructor"], ({ constructor }) => {
+	if (typeof constructor === "function") return constructor.name;
+	else return constructor;
+});
+defineMethod("any", [], () => "any");
+defineMethod("never", [], () => "never");
+defineMethod("const", ["value"], ({ value }) => typeof value === "string" ? JSON.stringify(value) : value);
+defineMethod("string", [], () => "string");
+defineMethod("number", [], () => "number");
+defineMethod("boolean", [], () => "boolean");
+defineMethod("bitset", ["bits"], () => "bitset");
+defineMethod("function", [], () => "function");
+defineMethod("array", ["inner"], ({ inner }) => `${inner.toString(true)}[]`);
+defineMethod("dict", ["inner", "sKey"], ({ inner, sKey }) => `{ [key: ${sKey.toString()}]: ${inner.toString()} }`);
+defineMethod("tuple", ["list"], ({ list }) => `[${list.map((inner) => inner.toString()).join(", ")}]`);
+defineMethod("object", ["dict"], ({ dict }) => {
+	if (Object.keys(dict).length === 0) return "{}";
+	return `{ ${Object.entries(dict).map(([key, inner]) => {
+		return `${key}${inner.meta.required ? "" : "?"}: ${inner.toString()}`;
+	}).join(", ")} }`;
+});
+defineMethod("union", ["list"], ({ list }, inline) => {
+	const result = list.map(({ toString: format }) => format()).join(" | ");
+	return inline ? `(${result})` : result;
+});
+defineMethod("intersect", ["list"], ({ list }) => {
+	return `${list.map((inner) => inner.toString(true)).join(" & ")}`;
+});
+defineMethod("transform", [
+	"inner",
+	"callback",
+	"preserve"
+], ({ inner }, isInner) => inner.toString(isInner));
+
+//#endregion
+//#region src/client.ts
+/**
+* How many pages of a list response to follow before giving up.
+*
+* The gateway pages at 100 and reports more with a cursor, so this is a bound
+* of 1000 sandboxes. It exists to stop a filter that matches nothing from
+* walking an entire account one page at a time; no deployment this plugin is
+* used against should reach it.
+*/
+const MAX_LIST_PAGES = 10;
+/**
+* The template to start from when the caller names none.
+*
+* Not the SDK's own default. The SDK resolves an omitted template to `"base"`,
+* a name from the hosted service; this gateway's templates are its own, and it
+* answers `"base"` with `404 sandbox unknown was not found` — a message that
+* reads like a missing sandbox rather than an unknown template, which is what
+* makes it worth pinning here rather than discovering at the first create.
+*
+* `"default"` is what this gateway provisions.
+*/
+const DEFAULT_TEMPLATE = "default";
+/** Builds and caches SDK handles, one per sandbox id. */
+var SandboxClient = class {
+	constructor(options) {
+		this.handles = new Map();
+		this.options = options;
+	}
+	/**
+	* The live handle for one sandbox.
+	*
+	* @param sandboxId - the sandbox to address.
+	* @returns the cached handle, or a newly connected one.
+	*/
+	async handle(sandboxId) {
+		const cached = this.handles.get(sandboxId);
+		if (cached !== void 0) return cached;
+		const connected = await this.connect(sandboxId);
+		this.handles.set(sandboxId, connected);
+		return connected;
+	}
+	/**
+	* Create a sandbox and cache its handle.
+	*
+	* @param template - the template name or id; {@link DEFAULT_TEMPLATE} when
+	*   omitted.
+	* @param options - create options forwarded to the SDK.
+	* @returns the created sandbox handle.
+	*/
+	async create(template, options) {
+		const common = {
+			domain: this.options.resolveDomain(),
+			requestTimeoutMs: this.options.resolveRequestTimeoutMs(),
+			...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+			...options.envs === void 0 ? {} : { envs: options.envs },
+			...options.metadata === void 0 ? {} : { metadata: options.metadata }
+		};
+		const resolved = template ?? DEFAULT_TEMPLATE;
+		const sandbox = await this.runWithKeyRefresh(options.signal, (apiKey, signal) => Sandbox.create(resolved, {
+			...common,
+			apiKey,
+			...signal === void 0 ? {} : { signal }
+		}));
+		this.handles.set(sandbox.sandboxId, sandbox);
+		return sandbox;
+	}
+	/**
+	* Find the sandboxes carrying one metadata pair.
+	*
+	* The SDK encodes the pair into the `metadata` query parameter and the
+	* gateway forwards it to the upstream unchanged, so this is the mechanism a
+	* restarted process uses to rediscover the sandbox a conversation was
+	* working in.
+	*
+	* The search follows the pagination cursor. A single page would be enough
+	* for the common case, but not for a busy account: the gateway pages at 100
+	* and reports more with a cursor, and a conversation's own sandbox is not
+	* ordered ahead of the others — so on the day an account holds more than a
+	* page, the one sandbox the caller is looking for is as likely as any to be
+	* on a later page, and a single-page search would report "none".
+	*
+	* @param metadata - the pair to match; a sandbox must carry all of it.
+	* @param signal - caller cancellation.
+	* @returns one row per matching sandbox.
+	*/
+	async findByMetadata(metadata, signal) {
+		const domain = this.options.resolveDomain();
+		const requestTimeoutMs = this.options.resolveRequestTimeoutMs();
+		const items = await this.runWithKeyRefresh(signal, async (apiKey) => {
+			const paginator = Sandbox.list({
+				apiKey,
+				domain,
+				requestTimeoutMs,
+				query: { metadata }
+			});
+			const found = [];
+			for (let page = 0; page < MAX_LIST_PAGES && paginator.hasNext; page += 1) found.push(...await paginator.nextItems());
+			return found;
+		});
+		return items.map((item) => ({
+			sandboxId: item.sandboxId,
+			state: item.state
+		}));
+	}
+	/**
+	* List the sandboxes this account currently has.
+	*
+	* Follows the pagination cursor, for the same reason the metadata search
+	* does: the gateway pages at 100, and a caller asking what it has should not
+	* be told "these are all of them" when they are the first hundred.
+	*
+	* @param signal - caller cancellation.
+	* @returns one row per sandbox, in the shape the tool renders.
+	*/
+	async list(signal) {
+		const domain = this.options.resolveDomain();
+		const requestTimeoutMs = this.options.resolveRequestTimeoutMs();
+		const items = await this.runWithKeyRefresh(signal, async (apiKey) => {
+			const paginator = Sandbox.list({
+				apiKey,
+				domain,
+				requestTimeoutMs
+			});
+			const all = [];
+			for (let page = 0; page < MAX_LIST_PAGES && paginator.hasNext; page += 1) all.push(...await paginator.nextItems());
+			return all;
+		});
+		return items.map((item) => ({
+			sandboxId: item.sandboxId,
+			templateId: item.templateId,
+			state: item.state,
+			startedAt: item.startedAt.toISOString(),
+			endAt: item.endAt.toISOString()
+		}));
+	}
+	/**
+	* Drop a handle for a sandbox that no longer exists.
+	*
+	* Called after a kill, so a later call against the same id re-resolves
+	* rather than reusing an endpoint the gateway has already torn down.
+	*
+	* @param sandboxId - the sandbox whose handle to drop.
+	*/
+	forget(sandboxId) {
+		this.handles.delete(sandboxId);
+	}
+	/** Connect to an existing sandbox. */
+	async connect(sandboxId) {
+		const domain = this.options.resolveDomain();
+		const requestTimeoutMs = this.options.resolveRequestTimeoutMs();
+		return this.runWithKeyRefresh(void 0, (apiKey, signal) => Sandbox.connect(sandboxId, {
+			apiKey,
+			domain,
+			requestTimeoutMs,
+			...signal === void 0 ? {} : { signal }
+		}));
+	}
+	/**
+	* Run one SDK call, retrying once against a freshly fetched key when the
+	* gateway rejects the one in hand.
+	*
+	* The key is handed to the callback rather than captured by it. A callback
+	* that closed over the first key would "retry" by presenting that same
+	* rejected key again — a loop that looks like a refresh and is not one.
+	*
+	* The retry is deliberately narrow: only an authentication failure clears
+	* the cache, and only once. A key that fails for any other reason — a
+	* sandbox that does not exist, a rate limit — is not evidence about the key,
+	* and refreshing on it would rotate the tenant for no reason.
+	*/
+	async runWithKeyRefresh(signal, run) {
+		const apiKey = await this.options.keys.get(signal);
+		try {
+			return await run(apiKey, signal);
+		} catch (error) {
+			if (!isAuthenticationFailure(error)) throw error;
+			this.options.keys.invalidate();
+			const replacement = await this.options.keys.get(signal);
+			return run(replacement, signal);
+		}
+	}
+};
+/**
+* Whether an error is the gateway refusing the credential.
+*
+* The SDK's `AuthenticationError` does not extend `SandboxError`, so a check
+* for `SandboxError` alone would miss exactly this case — which is the case
+* that has a remedy.
+*/
+function isAuthenticationFailure(error) {
+	if (error === null || typeof error !== "object") return false;
+	return error.constructor?.name === "AuthenticationError";
+}
+
+//#endregion
+//#region src/credentials.ts
+/**
+* Open a credential store.
+*
+* Takes no options: the service name is fixed in the store package, because a
+* per-plugin choice of namespace is how a writer and a reader end up looking at
+* different stores.
+*/
+function openCredentialStore() {
+	return createCredentialsStore();
+}
+/**
+* Read the current credentials.
+*
+* AK and SK are read as a pair: half a pair reads as no credentials rather
+* than an error, so a partially-configured machine gets the "authenticate
+* first" message instead of a signing failure with no remedy. The
+* SecurityToken is optional and is omitted from the object entirely when
+* absent — an empty string would sign as a third header the gateway then
+* rejects.
+*
+* Called per request, never captured: that is what makes a credential saved
+* from the credential form apply to the next call.
+*
+* @param store - the credential store to read.
+* @returns the credentials, or `undefined` when the pair is incomplete.
+*/
+function readCredentials(store) {
+	return readStoredPair(store);
+}
+
+//#endregion
+//#region src/sandbox-key.ts
+/** Path of the key endpoint: POST creates, GET lists. */
+const KEYS_PATH = "/e2b/keys";
+/** An error the model can act on, carrying the endpoint's own message. */
+var SandboxKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SandboxKeyError";
+	}
+};
+/**
+* Whether a stored key may still be used for the credentials in hand.
+*
+* - No credentials → no, whatever the key says: nothing granted under a
+*   credential set that has since been cleared may still be presented.
+* - No fingerprint on the key (an older build) → yes. Rotating it would orphan
+*   every sandbox made before this build, and that is worse than the gap it
+*   closes; the 401 fallback still catches a dead key.
+* - Otherwise → the fingerprint must equal the current AK's.
+*
+* @param stored - the key read from the store.
+* @param credentials - the credentials in hand, or `undefined` when cleared.
+* @returns `true` when the key belongs to the current credentials.
+*/
+function matchesFingerprint(stored, credentials) {
+	if (credentials === void 0) return false;
+	if (stored.akFingerprint === void 0) return true;
+	return stored.akFingerprint === fingerprint(credentials.ak);
+}
+/**
+* Convert the stored bundle section into this module's shape.
+*
+* Returns `undefined` when there is no usable key: a corrupt section should
+* lead to a new key, not to a half-parsed value presented to the gateway.
+*
+* The section is decoded by the shared store module, so this function only
+* renames fields — it never parses JSON.
+*
+* @param section - the e2b section read from the store.
+* @returns the key, or `undefined` when there is none.
+*/
+function fromStoredSection(section) {
+	if (section === void 0) return void 0;
+	return {
+		key: section.api_key,
+		expiresAt: section.expired_at,
+		...section.ak_fingerprint === void 0 ? {} : { akFingerprint: section.ak_fingerprint }
+	};
+}
+/**
+* Whether a stored key is past its expiry.
+*
+* @param key - the stored key.
+* @param now - the instant to compare against.
+* @returns `true` when the key should be replaced.
+*/
+function isExpired(key, now) {
+	const at = Date.parse(key.expiresAt);
+	if (Number.isNaN(at)) return false;
+	return at <= now;
+}
+/** The stored form of one key, as the bundle keeps it. */
+function toStoredSection(key) {
+	return {
+		api_key: key.key,
+		expired_at: key.expiresAt,
+		...key.akFingerprint === void 0 ? {} : { ak_fingerprint: key.akFingerprint }
+	};
+}
+/** One key, read from the store and replaced when it expires or is refused. */
+var SandboxKeySource = class {
+	constructor(options) {
+		this.options = options;
+		this.fetchImpl = options.fetchImpl ?? fetch;
+	}
+	/**
+	* Return a usable API key.
+	*
+	* A key is used only while it is unexpired **and** still belongs to the
+	* credentials in hand — see the module comment on why the second check
+	* exists and why a mismatch does not delete the stored entry.
+	*
+	* @param signal - caller cancellation, forwarded to the fetch.
+	* @returns the key to present as `X-API-KEY`.
+	* @throws {SandboxKeyError} when no credentials are stored, so nothing can
+	*   be created to replace a key the current credentials do not own.
+	*/
+	async get(signal) {
+		const now = Date.now();
+		const credentials = this.options.readCredentials();
+		if (this.current !== void 0 && !isExpired(this.current, now) && matchesFingerprint(this.current, credentials)) return this.current.key;
+		const stored = fromStoredSection(readE2BKey(this.options.store));
+		if (stored !== void 0 && !isExpired(stored, now) && matchesFingerprint(stored, credentials)) {
+			this.current = stored;
+			return stored.key;
+		}
+		this.current = void 0;
+		this.pending ??= this.createKey(credentials, signal);
+		try {
+			this.current = await this.pending;
+			return this.current.key;
+		} finally {
+			this.pending = void 0;
+		}
+	}
+	/**
+	* Forget the key, so the next {@link get} creates a new one.
+	*
+	* Called when the gateway refuses the key as unauthenticated — the one
+	* signal that it has stopped working earlier than its expiry said. The
+	* replacement is a different key, and therefore a different tenant: sandboxes
+	* created under the old one stop being reachable through this plugin.
+	*/
+	invalidate() {
+		this.current = void 0;
+		clearE2BKey(this.options.store);
+	}
+	/**
+	* Create a key, store it, and return it.
+	*
+	* @param credentials - the pair to sign with; already read by {@link get},
+	*   so the fingerprint recorded on the key is the one it was minted under.
+	* @param signal - caller cancellation, forwarded to the fetch.
+	*/
+	async createKey(credentials, signal) {
+		if (credentials === void 0) throw new SandboxKeyError("未进行华为云 IAM 认证，请认证后重试。 / Not authenticated with Huawei Cloud IAM. Please authenticate, then retry.");
+		const url = new URL(`${this.options.baseUrl}${KEYS_PATH}`);
+		const headers = sign("POST", url.host, url.pathname, {}, "", credentials);
+		const timeout = AbortSignal.timeout(this.options.timeoutMs);
+		const composed = signal === void 0 ? timeout : AbortSignal.any([signal, timeout]);
+		let response;
+		try {
+			response = await this.fetchImpl(url, {
+				method: "POST",
+				headers: {
+					host: headers.host,
+					"x-sdk-date": headers["x-sdk-date"],
+					Authorization: headers.Authorization,
+					...headers["x-security-token"] === void 0 ? {} : { "x-security-token": headers["x-security-token"] }
+				},
+				signal: composed
+			});
+		} catch (error) {
+			throw new SandboxKeyError(`aishell-e2b: cannot reach the sandbox key service at ${this.options.baseUrl}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (!response.ok) throw new SandboxKeyError(await describeFailure(response));
+		const created = {
+			...await readCreatedKey(response),
+			akFingerprint: fingerprint(credentials.ak)
+		};
+		try {
+			writeE2BKey(this.options.store, toStoredSection(created));
+		} catch (error) {}
+		return created;
+	}
+};
+/**
+* Turn a failing response into a message naming what the operator can do.
+*
+* Three conditions carry different instructions and must not be flattened:
+*
+*   - `1010` — the account holds too many keys; delete one, then retry.
+*   - `1008` — too many creates recently; wait, then retry.
+*   - `2001`/401 — the signature was refused; check the stored AK/SK.
+*/
+async function describeFailure(response) {
+	let code = "";
+	let message = "";
+	try {
+		const parsed = await response.json();
+		if (typeof parsed.error_code === "string") code = parsed.error_code;
+		if (typeof parsed.error_msg === "string") message = parsed.error_msg;
+	} catch {}
+	if (code === "AISHELL.1010") return "aishell-e2b: this account already holds the maximum number of sandbox keys. Delete one that is no longer in use, then retry.";
+	if (code === "AISHELL.1008") return "aishell-e2b: too many sandbox keys were created recently. Retry shortly.";
+	if (code === "AISHELL.2001" || response.status === 401 || response.status === 403) return "aishell-e2b: the sandbox key service rejected the request signature. Check the stored access key and secret key, then retry.";
+	if (code === "AISHELL.3003") return "aishell-e2b: the sandbox key service is not ready right now. Retry shortly.";
+	const detail = message === "" ? "" : `: ${message}`;
+	return `aishell-e2b: the sandbox key service failed with HTTP ${response.status}${code === "" ? "" : ` (${code})`}${detail}`;
+}
+/**
+* Read the created key out of the response body.
+*
+* The plaintext appears exactly once, in this response — the service keeps only
+* a hash — so a body that does not carry one is a failure, not something to
+* retry against a later read.
+*/
+async function readCreatedKey(response) {
+	let parsed;
+	try {
+		parsed = await response.json();
+	} catch (error) {
+		throw new SandboxKeyError(`aishell-e2b: the sandbox key service returned a body that is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const body = parsed;
+	const key = body?.api_key;
+	if (typeof key !== "string" || key === "") throw new SandboxKeyError("aishell-e2b: the sandbox key service returned no usable key.");
+	const expiresAt = typeof body?.expires_at === "string" && body.expires_at !== "" ? body.expires_at : FOREVER_EXPIRY;
+	return {
+		key,
+		expiresAt
+	};
+}
+
+//#endregion
+//#region src/sandbox-registry.ts
+/**
+* The sandbox a conversation works in.
+*
+* One conversation, one sandbox. That is the whole model: there is no
+* "which sandbox did you mean" question for the tools to ask, because there is
+* only ever one answer, and no `sandboxId` parameter for the model to get
+* wrong. The tools act on *the* sandbox, and creating one is the explicit act
+* that binds it to the conversation.
+*
+* ## Why the binding is created explicitly, never lazily
+*
+* A tool that quietly created a sandbox on first use would have to choose the
+* template and the lifetime itself, and those are exactly the two facts the
+* operator should be deciding — a preview page wants a different lifetime from
+* a debugging session, and that choice is the reason the create tool takes
+* parameters at all. A lazy create would move that decision into the plugin
+* and out of the conversation, where nobody can see it or correct it.
+*
+* So a tool with no sandbox bound fails, and names `aishell__sandbox_create` as the way
+* forward. The failure is cheap and legible; a silently invented sandbox is
+* neither.
+*
+* ## Why the binding survives a restart
+*
+* The mapping cannot live in memory alone. A plugin restart — a reload, a
+* crash, a profile edit — would otherwise orphan a running sandbox: the model
+* would find no binding, create a second sandbox, and the first would keep
+* billing until its lifetime expired, with nothing in the conversation
+* accounting for it.
+*
+* So the sandbox carries its conversation in its own `metadata` at creation,
+* and the registry rebuilds the binding by querying for it. The gateway
+* forwards `metadata` filters to the upstream unchanged, and
+* `Sandbox.list({ query: { metadata } })` is ordinary SDK surface, so the
+* recovery needs nothing from either service.
+*
+* A recovered binding is refused if the sandbox is not running. A paused
+* sandbox is not adopted: connecting to it would resume it and silently
+* restart its clock, which is a billing decision nobody asked for.
+*
+* @module @huaweidevtools/aishell-dsh-e2b/sandbox-registry
+*/
+/** The metadata key a sandbox carries its owning conversation under. */
+const SESSION_METADATA_KEY = "aishell-session";
+/** In-memory bindings plus the lookup used to rebuild them. */
+var SandboxRegistry = class {
+	constructor(find) {
+		this.bySession = new Map();
+		this.find = find;
+	}
+	/**
+	* Bind a sandbox to its conversation.
+	*
+	* @param sessionId - the owning conversation, or `undefined` for a call that
+	*   ran outside one. Such a call is recorded nowhere: without a conversation
+	*   to key on, there would be nothing to bind later calls to.
+	* @param sandboxId - the sandbox to bind.
+	*/
+	bind(sessionId, sandboxId) {
+		if (sessionId === void 0 || sessionId === "") return;
+		this.bySession.set(sessionId, sandboxId);
+	}
+	/**
+	* The sandbox this conversation is bound to, recovering the binding if this
+	* process has not seen one.
+	*
+	* @param sessionId - the calling conversation.
+	* @param signal - caller cancellation, forwarded to the lookup.
+	* @returns the sandbox id, or `undefined` when the conversation has none.
+	*/
+	async resolve(sessionId, signal) {
+		if (sessionId === void 0 || sessionId === "") return void 0;
+		const known = this.bySession.get(sessionId);
+		if (known !== void 0) return known;
+		const found = await this.find({ [SESSION_METADATA_KEY]: sessionId }, signal);
+		const running = found.find((candidate) => candidate.state === "running");
+		if (running === void 0) return void 0;
+		this.bySession.set(sessionId, running.sandboxId);
+		return running.sandboxId;
+	}
+	/**
+	* The sandbox bound right now, without a lookup.
+	*
+	* Used where a call has already resolved the binding and needs it again
+	* without a second round trip.
+	*
+	* @param sessionId - the calling conversation.
+	* @returns the bound sandbox id, or `undefined`.
+	*/
+	bound(sessionId) {
+		if (sessionId === void 0 || sessionId === "") return void 0;
+		return this.bySession.get(sessionId);
+	}
+	/**
+	* Drop a binding, because the sandbox it names no longer exists.
+	*
+	* @param sandboxId - the sandbox that is gone.
+	*/
+	forget(sandboxId) {
+		for (const [session, bound] of this.bySession) if (bound === sandboxId) this.bySession.delete(session);
+	}
+};
+/** The metadata a new sandbox carries so its conversation can be recovered. */
+function sessionMetadata(sessionId, extra) {
+	const tags = { ...extra };
+	if (sessionId !== void 0 && sessionId !== "") tags[SESSION_METADATA_KEY] = sessionId;
+	return Object.keys(tags).length === 0 ? void 0 : tags;
+}
+/**
+* The message a tool gets when the conversation has no sandbox.
+*
+* Names the remedy, and deliberately does not offer to create one: the model
+* chooses the template and the lifetime, and it cannot do that from inside a
+* tool that was asked to write a file.
+*/
+const NO_SANDBOX_MESSAGE = "aishell-e2b: this conversation has no sandbox. Call aishell__sandbox_create first, choosing the lifetime the work needs.";
+/**
+* The message a tool gets when a sandbox existed but is now gone.
+*
+* Distinct from {@link NO_SANDBOX_MESSAGE} because the remedy differs: the
+* binding is stale rather than absent, and the model should know the previous
+* sandbox's contents are not recoverable — creating a new one starts empty.
+*/
+const SANDBOX_GONE_MESSAGE = "aishell-e2b: the sandbox this conversation was using no longer exists (it was deleted or its lifetime expired). Its contents are gone. Call aishell__sandbox_create to start a new one.";
+
+//#endregion
+//#region src/errors.ts
+/**
+* Turning SDK failures into messages the model can act on.
+*
+* Two properties decide the shape here.
+*
+* **A non-zero exit is not an error.** The SDK's foreground `commands.run`
+* rejects with `CommandExitError` when a command exits non-zero, carrying the
+* exit code and both streams. Reporting that as a tool failure tells the model
+* "the tool broke" when the truth is "the command ran and returned 1" — which
+* for a build, a test run, or a `grep` with no match is the ordinary outcome.
+* Callers convert it to a normal result instead; see `tools.ts`.
+*
+* **The error hierarchy does not share a root.** `AuthenticationError`,
+* `BuildError` and `VolumeError` do not extend `SandboxError`, so matching on
+* `SandboxError` alone would let exactly the failures with remedies fall
+* through to a generic message. Matching is therefore by constructor name,
+* which is stable across the SDK's own re-bundling and needs no import of a
+* class the package may rename.
+*
+* @module @huaweidevtools/aishell-dsh-e2b/errors
+*/
+/** A failure whose text is already the message the model should see. */
+var SandboxToolError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SandboxToolError";
+	}
+};
+/** The remedy each SDK failure carries, keyed by its constructor name. */
+const REMEDIES = {
+	AuthenticationError: "the sandbox gateway rejected the API key. Re-authenticate with Huawei Cloud, then retry.",
+	SandboxNotFoundError: "no such sandbox. It may have expired. Call aishell__sandbox_list to see the sandboxes this account currently has, or aishell__sandbox_create to make a new one.",
+	FileNotFoundError: "no such file in the sandbox. Call aishell__sandbox_files_list to see what is there.",
+	RateLimitError: "the sandbox service is rate limiting; retry shortly.",
+	NotEnoughSpaceError: "the sandbox is out of disk space.",
+	InvalidArgumentError: "the sandbox service rejected an argument.",
+	TemplateError: "the sandbox template does not support this operation. This usually means the sandbox's envd is older than the feature requires.",
+	TimeoutError: "the request timed out. A sandbox that has expired reports this too.",
+	GitAuthError: "git authentication failed inside the sandbox.",
+	GitUpstreamError: "the git remote rejected the operation inside the sandbox.",
+	BuildError: "a template build failed.",
+	VolumeError: "a volume operation failed.",
+	SandboxError: "the sandbox service reported an error."
+};
+/**
+* Render one thrown value as the message a tool should fail with.
+*
+* @param error - whatever was thrown.
+* @param context - what the call was doing, prefixed for orientation.
+* @returns the message to surface.
+*/
+function describeSandboxError(error, context) {
+	if (error instanceof SandboxToolError) return error.message;
+	const name$1 = errorName(error);
+	const remedy = REMEDIES[name$1];
+	const detail = error instanceof Error ? error.message : String(error);
+	const body = detail === "" ? "" : `: ${detail}`;
+	return remedy === void 0 ? `aishell-e2b: ${context} failed${body}` : `aishell-e2b: ${context} failed — ${remedy}${body}`;
+}
+/** The constructor name of a thrown value, or `''` for a non-object. */
+function errorName(error) {
+	if (error === null || typeof error !== "object") return "";
+	return error.constructor?.name ?? "";
+}
+/**
+* Whether a thrown value is a command that ran and exited non-zero.
+*
+* Kept separate from {@link describeSandboxError} because it is not a failure:
+* see the module comment.
+*/
+function isCommandExitError(error) {
+	return errorName(error) === "CommandExitError";
+}
+
+//#endregion
+//#region src/tools.ts
+/**
+* The sandbox this call acts on, or a failure naming the way forward.
+*
+* Recovery is attempted on every call, not only in `aishell__sandbox_create`: a plugin
+* restart between two calls would otherwise strand a running sandbox, and the
+* model would create a second one while the first kept billing.
+*
+* @param deps - the tool dependencies.
+* @param sessionId - the calling conversation, from the execution context.
+* @param signal - caller cancellation, forwarded to the recovery lookup.
+* @returns the bound sandbox id.
+*/
+async function requireSandboxId(deps, sessionId, signal) {
+	const id = await deps.registry.resolve(sessionId, signal);
+	if (id === void 0) throw new SandboxToolError(NO_SANDBOX_MESSAGE);
+	return id;
+}
+/**
+* Translate a failure about the sandbox itself into the message that fits.
+*
+* A sandbox that has expired is not the same situation as a conversation that
+* never had one, and the distinction is worth the trouble: the first means the
+* work in it is gone and a replacement starts empty, which the model has to
+* know before it decides to continue.
+*
+* @param error - the thrown value.
+* @param context - what the call was doing.
+* @returns the message to fail with.
+*/
+function describeBoundError(error, context) {
+	return errorName(error) === "SandboxNotFoundError" ? SANDBOX_GONE_MESSAGE : describeSandboxError(error, context);
+}
+/** Project one sandbox's identity and lifetime into a JSON-safe object. */
+function describeInfo(info) {
+	return {
+		sandboxId: info.sandboxId,
+		templateId: info.templateId,
+		state: info.state,
+		startedAt: info.startedAt.toISOString(),
+		endAt: info.endAt.toISOString(),
+		cpuCount: info.cpuCount,
+		memoryMB: info.memoryMB,
+		envdVersion: info.envdVersion,
+		...info.metadata === void 0 ? {} : { metadata: info.metadata }
+	};
+}
+/** How much of a command's output a result carries before it is elided. */
+const OUTPUT_LIMIT = 3e4;
+/** Keep a stream useful without letting one command flood the context. */
+function clip(text) {
+	if (text.length <= OUTPUT_LIMIT) return {
+		text,
+		truncated: false
+	};
+	return {
+		text: text.slice(0, OUTPUT_LIMIT),
+		truncated: true
+	};
+}
+/**
+* Reject a map whose values are not strings.
+*
+* The tool's schema can only say "an object" — the harness schema DSL has no
+* way to constrain the value type of a free-form map — while both the sandbox
+* service and the SDK require string values. Without this check a number or a
+* nested object would be stringified somewhere downstream and surface as a
+* command that behaves oddly, far from the call that caused it.
+*/
+function stringMap(value, field) {
+	for (const [key, entry] of Object.entries(value)) if (typeof entry !== "string") throw new SandboxToolError(`aishell-e2b: ${field}.${key} must be a string, got ${typeof entry}.`);
+	return value;
+}
+/** The session id a tool call runs under, from its execution context. */
+function sessionOf(exec) {
+	return exec.agent?.session?.id;
+}
+/**
+* Register every sandbox tool.
+*
+* @param ctx - the plugin context, providing the tool registry.
+* @param deps - the shared dependencies.
+* @returns disposers for the registrations.
+*/
+function registerSandboxTools(ctx, deps) {
+	const definitions = [
+		createSandboxTool(deps),
+		listSandboxesTool(deps),
+		sandboxInfoTool(deps),
+		killSandboxTool(deps),
+		setSandboxTimeoutTool(deps),
+		runCommandTool(deps),
+		killCommandTool(deps),
+		writeFileTool(deps),
+		readFileTool(deps),
+		downloadFileTool(deps, ctx),
+		listFilesTool(deps),
+		getPortUrlTool(deps)
+	];
+	return definitions.map((definition) => ctx.tools.register(definition));
+}
+/** The output schema every sandbox-describing tool shares. */
+const SANDBOX_DESCRIPTION_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	properties: {
+		sandboxId: {
+			type: "string",
+			required: true
+		},
+		templateId: {
+			type: "string",
+			required: true
+		},
+		state: {
+			type: "string",
+			required: true
+		},
+		startedAt: {
+			type: "string",
+			required: true
+		},
+		endAt: {
+			type: "string",
+			required: true
+		},
+		cpuCount: {
+			type: "integer",
+			required: true
+		},
+		memoryMB: {
+			type: "integer",
+			required: true
+		},
+		envdVersion: {
+			type: "string",
+			required: true
+		},
+		metadata: {
+			type: "object",
+			additionalProperties: true
+		}
+	}
+};
+/** The one-line rendering every sandbox-describing tool shares. */
+function renderSandboxDescription(value) {
+	return [{
+		type: "text",
+		text: `Sandbox ${value.sandboxId} is ${value.state}, expires at ${value.endAt}.`
+	}];
+}
+function createSandboxTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_create",
+		description: "Create a sandbox for this conversation: a disposable Linux environment that runs for a bounded time and is then deleted along with everything in it. This binds the sandbox to the conversation — the other sandbox tools act on it without being told which one. Creating a second one replaces the binding; the first keeps running until its lifetime expires, so delete it with aishell__sandbox_kill when it is no longer needed.",
+		parameters: {
+			template: {
+				type: "string",
+				description: "Template name or id to start from. Defaults to the service's base template."
+			},
+			timeoutMs: {
+				type: "number",
+				description: "Lifetime in MILLISECONDS (the TypeScript SDK counts milliseconds; the Python SDK counts seconds). The sandbox and everything in it are deleted when this expires. Default 300000 (5 minutes). Choose it from what the work needs: a page to look at once needs minutes, a working session longer."
+			},
+			envs: {
+				type: "object",
+				additionalProperties: true,
+				description: "Environment variables every command in the sandbox starts with."
+			},
+			metadata: {
+				type: "object",
+				additionalProperties: true,
+				description: "Extra key/value labels for finding this sandbox later with aishell__sandbox_list. The conversation tag is added automatically."
+			}
+		},
+		output: {
+			schema: SANDBOX_DESCRIPTION_SCHEMA,
+			render: (_args, value) => [{
+				type: "text",
+				text: `Sandbox ${value.sandboxId} is ${value.state} (${String(value.cpuCount)} vCPU, ${String(value.memoryMB)} MB), expires at ${value.endAt}.`
+			}]
+		},
+		timeoutMs: 12e4,
+		async execute(args, exec) {
+			const input = args;
+			const sessionId = sessionOf(exec);
+			try {
+				const metadata = sessionMetadata(sessionId, input.metadata === void 0 ? void 0 : stringMap(input.metadata, "metadata"));
+				const sandbox = await deps.client.create(input.template, {
+					...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+					...input.envs === void 0 ? {} : { envs: stringMap(input.envs, "envs") },
+					...metadata === void 0 ? {} : { metadata },
+					signal: exec.signal
+				});
+				deps.registry.bind(sessionId, sandbox.sandboxId);
+				return describeInfo(await sandbox.getInfo({ signal: exec.signal }));
+			} catch (error) {
+				throw new SandboxToolError(describeSandboxError(error, "aishell__sandbox_create"));
+			}
+		}
+	});
+}
+function listSandboxesTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_list",
+		description: "List the sandboxes this account currently has. Reports sandboxes from every conversation, not just this one.",
+		parameters: {},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: { sandboxes: {
+					type: "array",
+					required: true,
+					items: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							sandboxId: {
+								type: "string",
+								required: true
+							},
+							templateId: {
+								type: "string",
+								required: true
+							},
+							state: {
+								type: "string",
+								required: true
+							},
+							startedAt: {
+								type: "string",
+								required: true
+							},
+							endAt: {
+								type: "string",
+								required: true
+							}
+						}
+					}
+				} }
+			},
+			render: (_args, value) => {
+				const rows = value.sandboxes;
+				if (rows.length === 0) return [{
+					type: "text",
+					text: "No sandboxes."
+				}];
+				const lines = rows.map((row) => `${row.sandboxId}  ${row.state}  expires ${row.endAt}  (${row.templateId})`);
+				return [{
+					type: "text",
+					text: lines.join("\n")
+				}];
+			}
+		},
+		timeoutMs: 6e4,
+		async execute(_args, exec) {
+			try {
+				return { sandboxes: await deps.client.list(exec.signal) };
+			} catch (error) {
+				throw new SandboxToolError(describeSandboxError(error, "aishell__sandbox_list"));
+			}
+		}
+	});
+}
+function sandboxInfoTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_info",
+		description: "Report this conversation's sandbox: its state, resources, and expiry time.",
+		parameters: {},
+		output: {
+			schema: SANDBOX_DESCRIPTION_SCHEMA,
+			render: (_args, value) => renderSandboxDescription(value)
+		},
+		timeoutMs: 6e4,
+		async execute(_args, exec) {
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				return describeInfo(await handle.getInfo({ signal: exec.signal }));
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_info"));
+			}
+		}
+	});
+}
+function killSandboxTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_kill",
+		description: "Delete this conversation's sandbox immediately, discarding everything in it, and release the conversation's binding to it. Do this when the work is done rather than waiting for the lifetime to expire.",
+		parameters: {},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					sandboxId: {
+						type: "string",
+						required: true
+					},
+					killed: {
+						type: "boolean",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.killed ? `Sandbox ${value.sandboxId} deleted.` : `Sandbox ${value.sandboxId} was already gone.`
+			}]
+		},
+		timeoutMs: 6e4,
+		async execute(_args, exec) {
+			const sessionId = sessionOf(exec);
+			const sandboxId = await requireSandboxId(deps, sessionId, exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				await handle.kill({ signal: exec.signal });
+				deps.client.forget(sandboxId);
+				deps.registry.forget(sandboxId);
+				return {
+					sandboxId,
+					killed: true
+				};
+			} catch (error) {
+				if (errorName(error) === "SandboxNotFoundError") {
+					deps.client.forget(sandboxId);
+					deps.registry.forget(sandboxId);
+					return {
+						sandboxId,
+						killed: false
+					};
+				}
+				throw new SandboxToolError(describeSandboxError(error, "aishell__sandbox_kill"));
+			}
+		}
+	});
+}
+function setSandboxTimeoutTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_set_timeout",
+		description: "Change how long this conversation's sandbox stays alive, measured from now. Use it to extend a sandbox that is still needed, or to shorten one that is not.",
+		parameters: { timeoutMs: {
+			type: "number",
+			required: true,
+			description: "New lifetime in MILLISECONDS from now. The service caps this at 24 hours for a pro account and 1 hour for a hobby account."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					sandboxId: {
+						type: "string",
+						required: true
+					},
+					endAt: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Sandbox ${value.sandboxId} now expires at ${value.endAt}.`
+			}]
+		},
+		timeoutMs: 6e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				await handle.setTimeout(input.timeoutMs, { signal: exec.signal });
+				const info = await handle.getInfo({ signal: exec.signal });
+				return {
+					sandboxId,
+					endAt: info.endAt.toISOString()
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_set_timeout"));
+			}
+		}
+	});
+}
+function runCommandTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_commands_run",
+		description: "Run a shell command in this conversation's sandbox. A command that exits non-zero is reported with its exit code and output rather than failing the tool, so a build error or a test failure reads as a result. Set background to start a long-running process (a server, for example) and get its pid back immediately.",
+		parameters: {
+			command: {
+				type: "string",
+				required: true,
+				description: "Shell command to run, executed by bash inside the sandbox."
+			},
+			cwd: {
+				type: "string",
+				description: "Working directory inside the sandbox."
+			},
+			envs: {
+				type: "object",
+				additionalProperties: true,
+				description: "Environment variables for this command, added to the sandbox's own."
+			},
+			timeoutMs: {
+				type: "number",
+				description: "How long to let the command run, in MILLISECONDS. Default 60000."
+			},
+			background: {
+				type: "boolean",
+				description: "Start the command and return its pid without waiting. Use it for a server that should keep running, and stop it later with aishell__sandbox_commands_kill."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					exitCode: { type: "integer" },
+					stdout: { type: "string" },
+					stderr: { type: "string" },
+					outputTruncated: { type: "boolean" },
+					pid: { type: "integer" }
+				}
+			},
+			render: (_args, value) => {
+				if (value.pid !== void 0) return [{
+					type: "text",
+					text: `Started in the background with pid ${String(value.pid)}.`
+				}];
+				const parts = [`exit ${String(value.exitCode ?? "?")}`];
+				if (value.stdout) parts.push(`stdout:\n${value.stdout}`);
+				if (value.stderr) parts.push(`stderr:\n${value.stderr}`);
+				if (value.outputTruncated) parts.push("(output truncated)");
+				return [{
+					type: "text",
+					text: parts.join("\n")
+				}];
+			}
+		},
+		timeoutMs: 3e5,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				const options = {
+					...input.cwd === void 0 ? {} : { cwd: input.cwd },
+					...input.envs === void 0 ? {} : { envs: stringMap(input.envs, "envs") },
+					...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+					signal: exec.signal
+				};
+				if (input.background === true) {
+					const process = await handle.commands.run(input.command, {
+						...options,
+						background: true
+					});
+					return { pid: process.pid };
+				}
+				try {
+					const result = await handle.commands.run(input.command, options);
+					const out = clip(result.stdout);
+					const err = clip(result.stderr);
+					return {
+						exitCode: result.exitCode,
+						stdout: out.text,
+						stderr: err.text,
+						outputTruncated: out.truncated || err.truncated
+					};
+				} catch (error) {
+					if (isCommandExitError(error)) {
+						const out = clip(String(error.stdout));
+						const err = clip(String(error.stderr));
+						return {
+							exitCode: error.exitCode,
+							stdout: out.text,
+							stderr: err.text,
+							outputTruncated: out.truncated || err.truncated
+						};
+					}
+					throw error;
+				}
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_commands_run"));
+			}
+		}
+	});
+}
+function killCommandTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_commands_kill",
+		description: "Stop a process running in this conversation's sandbox, by the pid aishell__sandbox_commands_run returned for a background command. Use it to stop a server started earlier — for example to free its port or to restart it with different settings — without deleting the whole sandbox and everything in it.",
+		parameters: { pid: {
+			type: "integer",
+			required: true,
+			description: "Process id, as returned by a background aishell__sandbox_commands_run."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					pid: {
+						type: "integer",
+						required: true
+					},
+					killed: {
+						type: "boolean",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.killed ? `Process ${String(value.pid)} stopped.` : `No process ${String(value.pid)} was running.`
+			}]
+		},
+		timeoutMs: 6e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				const killed = await handle.commands.kill(input.pid, { signal: exec.signal });
+				return {
+					pid: input.pid,
+					killed
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_commands_kill"));
+			}
+		}
+	});
+}
+function writeFileTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_files_write",
+		description: "Write a text file in this conversation's sandbox, creating parent directories as needed. Use it to put source, configuration, or a static page where a command can read it.",
+		parameters: {
+			path: {
+				type: "string",
+				required: true,
+				description: "Absolute path inside the sandbox, e.g. /home/user/site/index.html."
+			},
+			content: {
+				type: "string",
+				required: true,
+				description: "Full file content, written as UTF-8 text."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					path: {
+						type: "string",
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Wrote ${String(value.bytes)} bytes to ${String(value.path)}.`
+			}]
+		},
+		timeoutMs: 12e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				await handle.files.write(input.path, input.content);
+				return {
+					path: input.path,
+					bytes: Buffer.byteLength(input.content, "utf8")
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_files_write"));
+			}
+		}
+	});
+}
+function readFileTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_files_read",
+		description: "Read a file from this conversation's sandbox and return its contents. Text is returned as text; ask for base64 to inspect a binary file.",
+		parameters: {
+			path: {
+				type: "string",
+				required: true,
+				description: "Absolute path inside the sandbox."
+			},
+			format: {
+				type: "string",
+				enum: ["text", "base64"],
+				description: "How to return the bytes. Default text."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					path: {
+						type: "string",
+						required: true
+					},
+					format: {
+						type: "string",
+						required: true
+					},
+					content: {
+						type: "string",
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					truncated: {
+						type: "boolean",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.truncated ? `${value.path} (first ${String(value.bytes)} bytes, truncated):\n${value.content}` : `${value.path}:\n${value.content}`
+			}]
+		},
+		timeoutMs: 12e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				if (input.format === "base64") {
+					const bytes = await handle.files.read(input.path, { format: "bytes" });
+					const clipped$1 = bytes.byteLength > OUTPUT_LIMIT ? bytes.subarray(0, OUTPUT_LIMIT) : bytes;
+					return {
+						path: input.path,
+						format: "base64",
+						content: Buffer.from(clipped$1).toString("base64"),
+						bytes: clipped$1.byteLength,
+						truncated: clipped$1.byteLength !== bytes.byteLength
+					};
+				}
+				const text = await handle.files.read(input.path, { format: "text" });
+				const clipped = clip(text);
+				return {
+					path: input.path,
+					format: "text",
+					content: clipped.text,
+					bytes: Buffer.byteLength(clipped.text, "utf8"),
+					truncated: clipped.truncated
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_files_read"));
+			}
+		}
+	});
+}
+function downloadFileTool(deps, ctx) {
+	return defineTool({
+		name: "aishell__sandbox_files_download",
+		description: "Copy a file out of this conversation's sandbox into the local workspace. Text is written as text. A binary file cannot be written to the local workspace — the harness filesystem accepts text only — so for one of those this returns base64 instead and reports that it had to; read those with aishell__sandbox_files_read and format base64 if that is what you wanted.",
+		parameters: {
+			path: {
+				type: "string",
+				required: true,
+				description: "Absolute path inside the sandbox."
+			},
+			localPath: {
+				type: "string",
+				required: true,
+				description: "Destination path in the local workspace. Ignored for a binary file, which cannot be written there."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					path: {
+						type: "string",
+						required: true
+					},
+					localPath: { type: "string" },
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					encoding: {
+						type: "string",
+						required: true
+					},
+					content: { type: "string" }
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.encoding === "text" ? `Copied ${value.path} (${String(value.bytes)} bytes) to ${String(value.localPath)}.` : `${value.path} is binary (${String(value.bytes)} bytes) and cannot be written to the local workspace. Its contents are base64 above.`
+			}]
+		},
+		timeoutMs: 12e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				const bytes = await handle.files.read(input.path, { format: "bytes" });
+				if (isProbablyBinary(bytes)) {
+					const clipped = bytes.byteLength > OUTPUT_LIMIT ? bytes.subarray(0, OUTPUT_LIMIT) : bytes;
+					return {
+						path: input.path,
+						bytes: bytes.byteLength,
+						encoding: "base64",
+						content: Buffer.from(clipped).toString("base64")
+					};
+				}
+				const fs = deps.resolveFs() ?? ctx.get("fs");
+				if (fs === void 0) return {
+					path: input.path,
+					bytes: bytes.byteLength,
+					encoding: "base64",
+					content: Buffer.from(bytes).toString("base64")
+				};
+				const text = Buffer.from(bytes).toString("utf8");
+				const target = await fs.resolve(input.localPath, { signal: exec.signal });
+				await fs.writeText(target, text, void 0, exec.signal);
+				return {
+					path: input.path,
+					localPath: fs.processPath(target),
+					bytes: bytes.byteLength,
+					encoding: "text"
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_files_download"));
+			}
+		}
+	});
+}
+/**
+* Whether bytes look like something the local workspace cannot hold.
+*
+* The harness filesystem writes UTF-8 text, so the question is only whether
+* these bytes survive a round trip through it. A NUL byte settles it: no text
+* file contains one, and every common binary format does. A UTF-8 decode
+* failure settles it the other way. Everything else is treated as text, which
+* is the permissive direction — a misread text file is recoverable, a binary
+* file mangled by decoding is not.
+*
+* @param bytes - the file's contents.
+* @returns whether the bytes should be returned encoded instead of written.
+*/
+function isProbablyBinary(bytes) {
+	if (bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) return false;
+	if (bytes.includes(0)) return true;
+	try {
+		new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		return false;
+	} catch {
+		return true;
+	}
+}
+function listFilesTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_files_list",
+		description: "List the entries in a directory of this conversation's sandbox.",
+		parameters: {
+			path: {
+				type: "string",
+				required: true,
+				description: "Absolute directory path."
+			},
+			depth: {
+				type: "number",
+				description: "How many levels below the directory to include. Default 1."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					path: {
+						type: "string",
+						required: true
+					},
+					entries: {
+						type: "array",
+						required: true,
+						items: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								name: {
+									type: "string",
+									required: true
+								},
+								path: {
+									type: "string",
+									required: true
+								},
+								type: {
+									type: "string",
+									required: true
+								},
+								size: { type: "integer" }
+							}
+						}
+					}
+				}
+			},
+			render: (_args, value) => {
+				const entries = value.entries;
+				if (entries.length === 0) return [{
+					type: "text",
+					text: `${value.path} is empty.`
+				}];
+				const lines = entries.map((entry) => `${entry.type === "dir" ? "d" : "-"} ${entry.name}${entry.size === void 0 ? "" : `  ${String(entry.size)} bytes`}`);
+				return [{
+					type: "text",
+					text: lines.join("\n")
+				}];
+			}
+		},
+		timeoutMs: 6e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				const options = input.depth === void 0 ? void 0 : { depth: input.depth };
+				const entries = await handle.files.list(input.path, options);
+				return {
+					path: input.path,
+					entries: entries.map((entry) => ({
+						name: entry.name,
+						path: entry.path,
+						type: entry.type === void 0 ? "unknown" : String(entry.type),
+						...entry.type === "file" ? { size: entry.size } : {}
+					}))
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_files_list"));
+			}
+		}
+	});
+}
+function getPortUrlTool(deps) {
+	return defineTool({
+		name: "aishell__sandbox_get_port_url",
+		description: "Get the public URL for a port a process is listening on inside this conversation's sandbox — the address to open a server running there. The URL resolves to the sandbox and stops working when the sandbox is deleted or expires.",
+		parameters: { port: {
+			type: "integer",
+			required: true,
+			description: "Port the process listens on inside the sandbox, e.g. 3000."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					url: {
+						type: "string",
+						required: true
+					},
+					sandboxId: {
+						type: "string",
+						required: true
+					},
+					port: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Port ${String(value.port)} is reachable at ${value.url}.`
+			}]
+		},
+		timeoutMs: 6e4,
+		async execute(args, exec) {
+			const input = args;
+			const sandboxId = await requireSandboxId(deps, sessionOf(exec), exec.signal);
+			try {
+				const handle = await deps.client.handle(sandboxId);
+				return {
+					url: `https://${handle.getHost(input.port)}`,
+					sandboxId,
+					port: input.port
+				};
+			} catch (error) {
+				throw new SandboxToolError(describeBoundError(error, "aishell__sandbox_get_port_url"));
+			}
+		}
+	});
+}
+
+//#endregion
+//#region src/prompt.ts
+/** Position of the tier guidance in the assembled context. */
+const SANDBOX_PROMPT_ORDER = 110;
+/** Name this contribution registers under; unique across the assembled prompt. */
+const SANDBOX_SECTION_NAME = "aishell:e2b";
+/** What the model reads about which tier to use. */
+const SANDBOX_GUIDANCE = `A sandbox is a Linux environment running remotely. It exists for a bounded time, then is deleted along with everything in it. What it gives you that this machine does not is a public address.
+
+That is the clearest signal: when the work has to be deployed somewhere reachable and the user wants a URL they can open — a web app, a demo, a service, a static page — use the sandbox tools (aishell__sandbox_*). Put the files there with aishell__sandbox_files_write, start the server with aishell__sandbox_commands_run and background: true, then call aishell__sandbox_get_port_url and give the user that address.
+
+At the other end, a production system belongs in real infrastructure, deployed with the Terraform tools (aishell__terraform_* and their neighbours). It will cost money, it should keep running, and it will be operated. The sandbox is the wrong tier for it not because it is small but because it is deliberately short-lived — the address stops working when it expires.
+
+So: a page or a demo, or anything that should end in a URL to open, is a sandbox. A system to run and keep running is Terraform.
+
+If the request does not make clear which of these it is, ask the user before choosing. Say what the difference amounts to for them: a sandbox is throwaway and costs nothing to discard, while Terraform provisions real resources that are billed and meant to keep running. Follow what they pick.
+
+A sandbox is often the right place to work something out before committing real resources to it.
+
+This conversation works in at most one sandbox at a time. Create it with aishell__sandbox_create before the tools that use it, and choose its lifetime there — the value should match what the work needs, since the sandbox and its contents are deleted when it expires.`;
+/**
+* Register the guidance section.
+*
+* Deferred behind `ctx.inject` rather than declared in this plugin's own
+* `inject`: the guidance is an enhancement, and a deployment without a system
+* prompt should lose it rather than fail to mount.
+*
+* @param ctx - host context.
+*/
+function registerSandboxGuidance(ctx) {
+	ctx.inject(["systemPrompt"], (scope) => {
+		scope.systemPrompt.section({
+			name: SANDBOX_SECTION_NAME,
+			order: SANDBOX_PROMPT_ORDER,
+			interpolate: false,
+			text: ({ scope: renderScope }) => ctx.tools.get("aishell__sandbox_create", renderScope) === void 0 ? "" : SANDBOX_GUIDANCE
+		});
+	});
+}
+
+//#endregion
+//#region src/index.ts
+/** The provisioning service the API key is fetched from. */
+const DEFAULT_API_BASE_URL = "https://openapi.aishell.openbuildlab.com";
+/** The sandbox gateway's domain — the value an E2B client calls `E2B_DOMAIN`. */
+const DEFAULT_DOMAIN = "aishell.openbuildlab.com";
+/** Default per-request timeout for both the key fetch and SDK calls. */
+const DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+/**
+* Settings schema for this entry.
+*
+* Both URLs are Volatile: they are deployment facts that differ between a
+* staging and a production profile, and a change should apply to the next call
+* rather than requiring a restart.
+*/
+const Config = Schema.object({
+	apiBaseUrl: Schema.string().default(DEFAULT_API_BASE_URL).volatile(),
+	domain: Schema.string().default(DEFAULT_DOMAIN).volatile(),
+	requestTimeoutMs: Schema.number().step(1).min(1).default(DEFAULT_REQUEST_TIMEOUT_MS).volatile()
+});
+const name = "aishell-e2b";
+/**
+* Required services: the tool registry alone.
+*
+* The filesystem and the system prompt are both optional and taken through
+* `ctx.inject` / `ctx.get` — a deployment without a filesystem loses one
+* tool's destination, and one without a system prompt loses the guidance
+* section, neither of which should stop the sandbox tools from registering.
+*/
+const inject = ["tools"];
+function apply(ctx, config) {
+	const store = openCredentialStore();
+	const keys = new SandboxKeySource({
+		baseUrl: config.apiBaseUrl.get(),
+		readCredentials: () => readCredentials(store),
+		store,
+		timeoutMs: config.requestTimeoutMs.get()
+	});
+	const client = new SandboxClient({
+		resolveDomain: () => config.domain.get(),
+		keys,
+		resolveRequestTimeoutMs: () => config.requestTimeoutMs.get()
+	});
+	const registry = new SandboxRegistry(
+		// Recovering a binding after a restart is a metadata query, so the
+		// registry asks the gateway through the same client every tool uses.
+		(metadata, signal) => client.findByMetadata(metadata, signal)
+);
+	const disposers = registerSandboxTools(ctx, {
+		client,
+		registry,
+		resolveFs: () => ctx.get("fs")
+	});
+	ctx.effect(() => () => {
+		for (const dispose of disposers) dispose();
+	}, "aishell-e2b: tools");
+	ctx.effect(() => ctx.on("aishell/credentials-updated", () => {
+		keys.invalidate();
+	}), "aishell-e2b: credential changes");
+	registerSandboxGuidance(ctx);
+}
+
+//#endregion
+export { Config, SANDBOX_GUIDANCE, SANDBOX_PROMPT_ORDER, SANDBOX_SECTION_NAME, apply, inject, name };
+//# sourceMappingURL=index.js.map