@leuduan/lagent 0.1.2 → 44.0.0

package/dist/plugins/providers/door.js

@@ -1 +0,0 @@
-import{a,b,d as c,e as d,f as e,g as f,h as g,i as h,j as i,k as j,l as k,m as l}from"../../chunks/WUUKTSRT.js";import"../../chunks/NDIM7MEW.js";import"../../chunks/34KW6VNQ.js";import"../../chunks/PUSUPTAT.js";import"../../chunks/DDANMY45.js";import"../../chunks/D7E6EWIE.js";export{c as CODEX_PROVIDER_NAME,a as CodexCredentialError,d as DEEPSEEK_RESPONSES_PROVIDER_NAME,f as OPENCODE_COPILOT_PROVIDER_NAME,e as OPENCODE_GO_PROVIDER_NAME,b as codexAuthPath,j as codexProvider,i as deepseekProvider,k as openaiChatProvider,h as openaiResponsesProvider,g as opencodeCopilotProvider,l as opencodeGoProvider};

package/dist/plugins/providers/index.d.ts

@@ -1,6 +0,0 @@
-/**
- * The package's own entry point to the providers: the public door, and `codexBackend`, which the web
- * search tool uses and the package does not offer.
- */
-export * from './door.js';
-export { codexBackend } from './codexAuth.js';

package/dist/plugins/routeContext.js

@@ -1 +0,0 @@
-import{a,b,c}from"../chunks/TOOIB6J2.js";import"../chunks/DRYAN665.js";import"../chunks/2OSESBIL.js";import"../chunks/YLNJXQ3Z.js";import"../chunks/DDANMY45.js";import"../chunks/37YOGDGY.js";import"../chunks/KESCTXGO.js";import"../chunks/TYTQRLTX.js";import"../chunks/D7E6EWIE.js";export{c as renderRoute,b as renderRouteNotice,a as routeContext};

package/dist/plugins/store/durableObject.js

@@ -1 +0,0 @@
-import{a as c}from"../../chunks/AP6Q4EPT.js";import{l as i}from"../../chunks/37YOGDGY.js";import"../../chunks/KESCTXGO.js";import"../../chunks/TYTQRLTX.js";import"../../chunks/D7E6EWIE.js";function o(e){return{exec:t=>{e.sql.exec(t).toArray()},run:(t,...r)=>{e.sql.exec(t,...r).toArray()},all:(t,...r)=>e.sql.exec(t,...r).toArray(),transaction:async t=>{let r=e.transactionSync(t);return await e.sync(),r},close:()=>{}}}var n=new WeakMap;function s(e,t){if(n.has(e))throw new i(t);let r={};return n.set(e,r),{identity:t,release:()=>{n.get(e)===r&&n.delete(e)}}}var l=class extends c{storage;identity;constructor(t,r){super(r.identity),this.storage=t,this.identity=r.identity}connect(){return o(this.storage)}async exclusive(){return s(this.storage,this.identity)}};export{l as DurableObjectJournalStore};

package/dist/plugins/store/sqlite.js

@@ -1 +0,0 @@
-import{a as m}from"../../chunks/AP6Q4EPT.js";import{l as u,m as h}from"../../chunks/37YOGDGY.js";import"../../chunks/KESCTXGO.js";import"../../chunks/TYTQRLTX.js";import"../../chunks/D7E6EWIE.js";import{closeSync as d,mkdirSync as c,openSync as w,realpathSync as f,statSync as p}from"node:fs";import{isAbsolute as M,join as n}from"node:path";import{DatabaseSync as y}from"node:sqlite";var b=class extends m{lockDirectory;busyTimeoutMs;directory;constructor(t,e){super(n(t,"journal.db")),this.directory=t;let{lockDirectory:r,busyTimeoutMs:s}=e;if(!M(r))throw new TypeError(`lockDirectory must be an absolute path: ${r}`);if(!Number.isFinite(s)||s<0)throw new TypeError(`busyTimeoutMs must be a finite number of milliseconds, zero or more: ${s}`);this.lockDirectory=r,this.busyTimeoutMs=s}get databasePath(){return n(this.directory,"journal.db")}connect(){return c(this.directory,{recursive:!0}),new a(this.databasePath,this.busyTimeoutMs)}async exclusive(){c(this.directory,{recursive:!0}),d(w(this.databasePath,"a",384));let t=f(this.databasePath),{dev:e,ino:r}=p(t,{bigint:!0});c(this.lockDirectory,{recursive:!0,mode:448});let s=new y(n(this.lockDirectory,`${e}-${r}.db`));try{s.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE")}catch(i){throw s.close(),l(i)?new u(t):i}return{identity:`sqlite:${e}:${r}`,release:()=>s.close()}}},a=class{db;path;busyTimeoutMs;statements=new Map;writes=Promise.resolve();constructor(t,e){this.path=t,this.busyTimeoutMs=e,this.db=new y(t);try{this.db.exec("PRAGMA journal_mode=WAL")}catch(r){throw this.db.close(),r}}exec(t){this.db.exec(t)}run(t,...e){this.statement(t).run(...e)}all(t,...e){return this.statement(t).all(...e)}transaction(t){let e=()=>this.write(t),r=this.writes.then(e,e);return this.writes=r.catch(()=>{}),r}close(){this.statements.clear(),this.db.close()}statement(t){let e=this.statements.get(t);return e===void 0&&(e=this.db.prepare(t),this.statements.set(t,e)),e}async write(t){await this.beginWrite();try{let e=t();return this.db.exec("COMMIT"),e}catch(e){throw this.rollback(),e}}async beginWrite(){let t=Date.now();for(let e=5;;e=Math.min(e*2,100))try{this.db.exec("BEGIN IMMEDIATE");return}catch(r){if(!l(r))throw r;let s=Date.now()-t;if(s>=this.busyTimeoutMs)throw new h(this.path,s);await new Promise(i=>setTimeout(i,Math.min(e,this.busyTimeoutMs-s)))}}rollback(){if(this.db.isTransaction)try{this.db.exec("ROLLBACK")}catch(t){console.error(t)}}},l=o=>{let t=o?.errcode;return typeof t=="number"&&(t&255)===5};export{b as SqliteJournalStore};

package/dist/plugins/subAgents/tool.d.ts

@@ -1,38 +0,0 @@
-import { z } from 'zod';
-import type { Tool } from '../../loop/index.js';
-import { type DelegationTarget } from '../delegations/index.js';
-/** Parameters an agent accepts when another agent invokes it as a tool. */
-export declare const SubAgentRequestParameters: z.ZodPreprocess<z.ZodObject<{
-    task: z.ZodString;
-    background: z.ZodDefault<z.ZodBoolean>;
-    provider: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    model: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    thinking_effort: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
-        low: "low";
-        high: "high";
-        none: "none";
-        medium: "medium";
-        max: "max";
-    }>>>;
-}, z.core.$strip>, unknown>;
-/** How an endpoint describes its target to callers. */
-export type EndpointDescription = {
-    readonly toolName: string;
-    readonly description: string;
-};
-/**
- * Delegation, as a tool.
- *
- * One of these is registered per target, a global agent or a role endpoint, so a target is
- * advertised to the model exactly like any other tool and reaching it is an ordinary grant. The
- * child is a normal thread: created with this call as its `origin` and its task in the same
- * write, and driven by `ctx.delegations` until the task settles. The tool only starts: its result
- * names the child's `thread_id`, whether the child answered or failed, and `message_agent` is how a
- * later call continues it.
- *
- * The child is born on the caller's route with the fields the call names folded over it, and keeps
- * that route, so a child started on a cheap model stays on it when continued without naming one.
- */
-export declare const subAgentTool: ({ toolName, description }: EndpointDescription, target: Exclude<DelegationTarget, {
-    kind: "fork";
-}>) => Tool;

package/dist/plugins/tools/index.d.ts

@@ -1,59 +0,0 @@
-import type { Plugin } from '@leuduan/cordis';
-import { z } from 'zod';
-import type { Tool } from '../../loop/index.js';
-/**
- * What the builtin tools are configured with, all of it the host's choice: the spawn environment and
- * the trusted programs the search tools run (`rg`, with `rg: null` for none), what `web_fetch`
- * may reach (`web.privateNetwork`: `refuse` keeps it on the public internet), and the Codex login
- * `web_search` searches through (`web.search`; with `null` there is no `web_search`).
- */
-declare const BuiltinToolsConfigSchema: z.ZodObject<{
-    environment: z.ZodRecord<z.ZodString, z.ZodString>;
-    programs: z.ZodObject<{
-        git: z.ZodString;
-        rg: z.ZodNullable<z.ZodString>;
-    }, z.core.$strict>;
-    web: z.ZodObject<{
-        privateNetwork: z.ZodEnum<{
-            allow: "allow";
-            refuse: "refuse";
-        }>;
-        search: z.ZodNullable<z.ZodObject<{
-            authPath: z.ZodString;
-            refreshTimeoutMs: z.ZodNumber;
-            model: z.ZodString;
-            maxOutputTokens: z.ZodNumber;
-            responseLength: z.ZodEnum<{
-                medium: "medium";
-                short: "short";
-                long: "long";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-}, z.core.$strict>;
-export type BuiltinToolsConfig = z.input<typeof BuiltinToolsConfigSchema>;
-export type { WebSearchConfig } from './web.js';
-/** The builtin tools that read the workspace without changing it. */
-export declare const READ_ONLY_TOOLS: readonly ["read_file", "list_dir", "rg_search", "rg_files"];
-/** The builtin tools that run `rg`, provided only where the host has it (`programs.rg`). */
-export declare const RG_TOOLS: readonly string[];
-/** Builtin tools that fetch and search the web; `web_search` only where the host configures `web.search`. */
-export declare const WEB_TOOLS: readonly ["web_fetch", "web_search"];
-/**
- * Every tool that ships with the engine. Registration is explicit: no import side effects.
- *
- * `ask_question` is deliberately absent — it needs a host that can reach the user, so it ships as
- * the `lagent:ask` plugin instead of as a builtin that would fail wherever nobody is listening.
- * Shell commands ship as the `commands` plugin, which owns their processes.
- *
- * The search tools, `rg_search` and `rg_files`, run the trusted `rg` and take configuration: the
- * {@link BuiltinToolsConfig}. Without `rg` (`programs.rg: null`) neither is provided; nothing searches
- * by another means. Likewise `web_search` searches only through the Codex login `web.search` names.
- */
-export declare const builtinToolsFor: (config: z.output<typeof BuiltinToolsConfigSchema>) => readonly Tool[];
-/**
- * Registers every builtin tool for the life of the plugin. The host names the environment and the
- * trusted programs the search tools run with, what `web_fetch` may reach and what `web_search`
- * searches through; there is no default for any of them.
- */
-export declare const builtinTools: Plugin.Object<BuiltinToolsConfig>;

package/dist/plugins/tools/index.js

@@ -1 +0,0 @@
-import{a,b,c,d,e}from"../../chunks/ENWFSU27.js";import"../../chunks/OVZFGILJ.js";import"../../chunks/JPZFKSWT.js";import"../../chunks/NAOUTU7A.js";import"../../chunks/UKXMCHHT.js";import"../../chunks/WUUKTSRT.js";import"../../chunks/NDIM7MEW.js";import"../../chunks/34KW6VNQ.js";import"../../chunks/PUSUPTAT.js";import"../../chunks/G6RXC3AL.js";import"../../chunks/DXFXAYDN.js";import"../../chunks/YLNJXQ3Z.js";import"../../chunks/DDANMY45.js";import"../../chunks/37YOGDGY.js";import"../../chunks/KESCTXGO.js";import"../../chunks/TYTQRLTX.js";import"../../chunks/D7E6EWIE.js";export{a as READ_ONLY_TOOLS,b as RG_TOOLS,c as WEB_TOOLS,e as builtinTools,d as builtinToolsFor};

package/dist/plugins/verify/facts.d.ts

@@ -1,356 +0,0 @@
-import { z } from 'zod';
-import { type PluginJournal } from '../../journal/index.js';
-import { type Refusal, type StopVerdict } from '../../loop/index.js';
-import type { Seq } from '../../models/index.js';
-import type { ReadonlyState } from '../../util/foldState.js';
-/** The verify preset's id. */
-export declare const VERIFY_PRESET = "verify";
-/** Times a thread is sent back to verify, since its last change, the person's last message or a requirement's arming, before its answer is rejected. */
-export declare const VERIFY_REMINDERS = 2;
-/** A verification: the command text `run_command` must be given, and the absolute directory it must run in. */
-export type Verification = {
-    readonly command: string;
-    readonly cwd: string;
-};
-/** What the model is told up front: the verification this conversation finishes with. Neither a change nor a reminder. */
-export declare const notice: {
-    record: (value: {
-        command: string;
-        cwd: string;
-    }) => import("../../models/index.js").ExtensionRecord;
-    parse: (value: {
-        command: string;
-        cwd: string;
-    }) => {
-        command: string;
-        cwd: string;
-    };
-    entry: (value: {
-        command: string;
-        cwd: string;
-    }, options: import("../../journal/journal.js").AppendOptions) => {
-        type: "ext";
-        data: {
-            plugin: string;
-            instance_id: string;
-            kind: string;
-            version: number;
-            data: z.core.util.JSONType;
-        };
-        options: import("../../journal/journal.js").AppendOptions;
-    };
-    append(journal: PluginJournal, value: {
-        command: string;
-        cwd: string;
-    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../models/index.js").JournalEvent<"ext">>;
-    read(event: import("../../models/index.js").JournalEvent): {
-        command: string;
-        cwd: string;
-    } | undefined;
-    contribution(message: {
-        role?: import("../../models/index.js").InputRole;
-        content: string | readonly import("../../llm/content.js").ContentPartInput[];
-    }, value: {
-        command: string;
-        cwd: string;
-    }, options?: {
-        sourceSeqs?: readonly Seq[];
-    }): import("../../models/index.js").StepContribution;
-    matchesSource(record: import("../../util/json.js").DeepReadonly<import("../../models/index.js").ExtensionRecord>): boolean;
-    rejection(reason: string, value: {
-        command: string;
-        cwd: string;
-    }): {
-        decision: "reject";
-        reason: string;
-        source: import("../../models/index.js").ExtensionRecord;
-    };
-    readContribution: (event: import("../../models/index.js").JournalEvent) => {
-        command: string;
-        cwd: string;
-    } | undefined;
-    readSource: (source: import("../../util/json.js").DeepReadonly<import("../../models/index.js").ExtensionRecord> | null) => {
-        command: string;
-        cwd: string;
-    } | undefined;
-    told: import("../../journal/projection.js").PluginProjection<import("../../kit/extension.js").ToldNotices<{
-        command: string;
-        cwd: string;
-    }>>;
-    projection<State>(fold: {
-        key: string;
-        init(): State;
-        apply(state: State, value: {
-            command: string;
-            cwd: string;
-        }, event: import("../../models/index.js").JournalEvent<"ext">): State;
-        onFork?: "inherit" | "reset";
-    }): import("../../journal/projection.js").PluginProjection<State>;
-};
-/** An `edit_files` or `run_command` call the model asked for, until its result lands. */
-type TrackedCall = {
-    /** A `run_command`'s command, by {@link commandKey}, and the directory it runs in; `null` for an `edit_files` call. */
-    readonly run: PlacedRun | null;
-    /** Its latest allowed `tool/authorization` row: the moment it may have begun. `null` while it has none. */
-    allowedAt: Seq | null;
-};
-/** A `run_command` call as it is placed: its key, and the directory, when the thread's cwd is known. */
-type PlacedRun = {
-    readonly key: string;
-    readonly cwd: string | null;
-};
-/** What the thread's runs of one command text in one directory came to. */
-type CommandFacts = {
-    /** The latest result row of an allowed run, whatever its outcome. */
-    resultAt: Seq | null;
-    /** The latest result row of an allowed run that did not pass. */
-    failedAt: Seq | null;
-    /** The latest allowed attempt of a run that passed: everything settled before it is proven. */
-    provenAt: Seq | null;
-    /** The latest `tool/authorization` row of a call of it, and whether policy denied it. */
-    decision: {
-        readonly seq: Seq;
-        readonly denied: boolean;
-    } | null;
-};
-/**
- * What every gate needs of a thread, folded from its rows whatever the gate's verification is: the
- * calls in flight, and what each command run, each other change and the person came to. A gate
- * judges its own verification from these when it is asked, so one fold serves every configuration.
- */
-export type VerifyFacts = {
-    /** The thread's cwd, from its spawn row: what a `run_command` without `workdir` runs in. */
-    threadCwd: string | null;
-    calls: Map<string, TrackedCall>;
-    /** The latest row settling a change no verification could be: an `edit_files` result, a background command's start or end. */
-    changedAt: Seq | null;
-    /** Each command text and directory run, by {@link commandKey}. */
-    commands: Map<string, CommandFacts>;
-    /** The person's latest message. */
-    personAt: Seq | null;
-    /**
-     * The reminder rows of each verification, by {@link commandKey}, since the last row that starts
-     * its count over: the person writing, or a change other than a run of that verification.
-     */
-    reminders: Map<string, Seq[]>;
-};
-/** A command text and the directory it runs in, as one key; a directory not known never matches a verification. */
-export declare const commandKey: (command: string, cwd: string | null) => string;
-export declare const verifyFacts: import("../../journal/projection.js").PluginProjection<VerifyFacts>;
-/**
- * What a thread's catalog entry says of its changes, for a caller above it whose work it is
- * ({@link delegatedChange}), contributed for every thread while the `verify` service is mounted. A
- * thread whose facts cannot be read reads `unavailable`, which nothing reads as "none".
- */
-export declare const changes: import("../../services/contributions.js").ContributionDefinition<{
-    changed_at: number | null;
-}>;
-/** The last change a thread's delegated work made, or why it cannot be read. */
-export type DelegatedChange = {
-    readonly at: Seq | null;
-} | {
-    readonly unreadable: string;
-};
-/**
- * The last change made by the work `threadId` delegated ({@link lastChange}): each thread
- * its calls started, at any depth, from its facts when it is loaded, else its catalog entry, so it
- * holds across a restart; or why one of them cannot be read, which fails closed. A thread an owner
- * assigned (an assignment origin, such as a workflow's isolated participant) is that owner's work,
- * judged by its own verification, so neither it nor anything under it is the caller's.
- *
- * Row seqs are one journal's, assigned in append order whichever thread a row belongs to, so a
- * descendant's change and the caller's verification attempt compare directly: a change whose row
- * was written before the attempt settled before the verification began.
- */
-export declare function delegatedChange(journal: PluginJournal, threadId: string): DelegatedChange;
-/** What one verification's gate judges from a thread's facts. */
-type Judgment = {
-    /** The latest row settling a possible change, the thread's own or its delegated work's: a verification that passed is not one. */
-    readonly mutatedAt: Seq | null;
-    /** The allowed attempt of the latest verification that passed. */
-    readonly provenAt: Seq | null;
-    /** Whether policy denied the latest verification attempt since the person last wrote or the requirement armed. */
-    readonly denied: boolean;
-    /** Reminders since the last change other than a verification run, the person's last message, or the arming. */
-    readonly reminders: number;
-};
-/**
- * One verification's judgment of a thread's facts, `delegatedAt` the last change its delegated work
- * made: one starts the count of reminders over as the thread's own change does, which its fold
- * already did for its own.
- */
-export declare function judgment(facts: ReadonlyState<VerifyFacts>, verification: Verification, armedAt: Seq | null, delegatedAt: Seq | null): Judgment;
-/**
- * A verification owed for one assignment, recorded on the thread serving it: the assignment's
- * identity (its owner, id and participant generation, as an assignment origin names them), the
- * input whose claim activates it, and the pinned verification. Its identity is the assignment's.
- */
-declare const RequirementSchema: z.ZodObject<{
-    owner: z.ZodString;
-    assignment: z.ZodString;
-    generation: z.ZodNumber;
-    input: z.ZodString;
-    command: z.ZodString;
-    cwd: z.ZodString;
-}, z.core.$strict>;
-export type RequirementInput = z.input<typeof RequirementSchema>;
-export type Requirement = z.output<typeof RequirementSchema>;
-declare const requirement: {
-    record: (value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }) => import("../../models/index.js").ExtensionRecord;
-    parse: (value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }) => {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    };
-    entry: (value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }, options: import("../../journal/journal.js").AppendOptions) => {
-        type: "ext";
-        data: {
-            plugin: string;
-            instance_id: string;
-            kind: string;
-            version: number;
-            data: z.core.util.JSONType;
-        };
-        options: import("../../journal/journal.js").AppendOptions;
-    };
-    append(journal: PluginJournal, value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../models/index.js").JournalEvent<"ext">>;
-    read(event: import("../../models/index.js").JournalEvent): {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    } | undefined;
-    contribution(message: {
-        role?: import("../../models/index.js").InputRole;
-        content: string | readonly import("../../llm/content.js").ContentPartInput[];
-    }, value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }, options?: {
-        sourceSeqs?: readonly Seq[];
-    }): import("../../models/index.js").StepContribution;
-    matchesSource(record: import("../../util/json.js").DeepReadonly<import("../../models/index.js").ExtensionRecord>): boolean;
-    rejection(reason: string, value: {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }): {
-        decision: "reject";
-        reason: string;
-        source: import("../../models/index.js").ExtensionRecord;
-    };
-    readContribution: (event: import("../../models/index.js").JournalEvent) => {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    } | undefined;
-    readSource: (source: import("../../util/json.js").DeepReadonly<import("../../models/index.js").ExtensionRecord> | null) => {
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    } | undefined;
-    told: import("../../journal/projection.js").PluginProjection<import("../../kit/extension.js").ToldNotices<{
-        owner: string;
-        assignment: string;
-        generation: number;
-        input: string;
-        command: string;
-        cwd: string;
-    }>>;
-    projection<State>(fold: {
-        key: string;
-        init(): State;
-        apply(state: State, value: {
-            owner: string;
-            assignment: string;
-            generation: number;
-            input: string;
-            command: string;
-            cwd: string;
-        }, event: import("../../models/index.js").JournalEvent<"ext">): State;
-        onFork?: "inherit" | "reset";
-    }): import("../../journal/projection.js").PluginProjection<State>;
-};
-/** `value` validated as a requirement, its directory normalized as a placed run's is. */
-export declare function requirementValue(value: RequirementInput): Requirement;
-/**
- * The rows recording `value` on `threadId`, decided inside its write: one row for a requirement
- * not recorded yet; none for one recorded already exactly so (a replay renews nothing); a refusal
- * for one recorded under its identity otherwise. A thread being opened has none recorded.
- */
-export declare function requirementRows(journal: PluginJournal, threadId: string, opening: boolean, parsed: Requirement): ReturnType<typeof requirement.entry>[] | {
-    refuse: Refusal;
-};
-/**
- * The requirement in force on a thread: the one armed last, with the moment it armed, the later of
- * its input's claim and its own row (so one recorded after the claim arms at its row); `null` while
- * none has armed. A participant serves one assignment at a time, so a later arming supersedes every
- * earlier requirement: two of them, pinned to different commands, would otherwise each count the
- * other's runs as changes and never both pass. A requirement lives for the assignment that armed it:
- * a delegation task opened on the thread after it armed, a successor assignment owing no
- * verification included, retires it. Row seqs are one journal's, so the two compare directly.
- */
-export declare function inForce(journal: PluginJournal, threadId: string): {
-    verification: Verification;
-    at: Seq;
-} | null;
-/**
- * The gate's say on a thread's answer for one verification, `armedAt` the moment its latest
- * requirement armed, if one did, and `delegated` the last change its delegated work made
- * ({@link delegatedChange}). What must be proven is everything settled before the barrier, the
- * later of the last possible change, the thread's own or its delegated work's, and that arming, kept
- * apart: an arming is no change, and a thread that changed nothing still owes its requirement a
- * pass. It holds the answer until a verification whose allowed attempt came after the barrier
- * passed, sending the model back at most {@link VERIFY_REMINDERS} times since the last change other
- * than a verification run, the person's last message or the arming, then rejecting; it rejects at
- * once when policy denied the latest attempt since the person last wrote or the requirement armed,
- * and when the delegated work's changes cannot be read.
- */
-export declare function verdict(facts: ReadonlyState<VerifyFacts>, verification: Verification, armedAt: Seq | null, delegated: DelegatedChange): StopVerdict | undefined;
-export {};

package/dist/plugins/workflows/submit.d.ts

@@ -1,8 +0,0 @@
-import type { Context } from '@leuduan/cordis';
-import { type Governance } from './policy.js';
-/**
- * Mounts submission on the application root: `submit_workflow_output`, registered in the root's
- * scope and granted to no agent (each instance root's and participant child's activation grants it,
- * `policy.ts`), and the stop check that reminds a thread to submit.
- */
-export declare function acceptSubmissions(ctx: Context, governance: Governance): void;

package/dist/plugins/workspaceContext.js

@@ -1 +0,0 @@
-import{a,b,c}from"../chunks/ADHERZLW.js";import"../chunks/RK3VP2Q4.js";import"../chunks/DRYAN665.js";import"../chunks/2OSESBIL.js";import"../chunks/YLNJXQ3Z.js";import"../chunks/DDANMY45.js";import"../chunks/37YOGDGY.js";import"../chunks/KESCTXGO.js";import"../chunks/TYTQRLTX.js";import"../chunks/D7E6EWIE.js";export{c as renderEnvironmentInfo,b as renderWorkspaceNotice,a as workspaceContext};

package/dist/presets/agents.d.ts

@@ -1,7 +0,0 @@
-import type { AgentDefinitionInput } from '../models/index.js';
-/** The builtin tools define these; the compositions here name them. */
-export { READ_ONLY_TOOLS, WEB_TOOLS } from '../plugins/tools/index.js';
-/** Tools that create or modify files. */
-export declare const WRITE_TOOLS: readonly ["edit_files"];
-/** `base`'s one agent, registered with no grants: a preset equips it. */
-export declare const mainAgent: AgentDefinitionInput;

package/dist/presets/base.d.ts

@@ -1,10 +0,0 @@
-import type { Plugin } from '@leuduan/cordis';
-/**
- * The plumbing a host mounts on the root beside `core` and a provider: one
- * `main` agent, granted nothing; the workspace notice; output truncation; and writes and started
- * commands held for confirmation. It registers no tools and decides nothing about what an agent
- * can do: a host registers the tools beside it, ungranted (`builtinTools`, `commands`), and a preset
- * such as `codexPreset` grants them. Root-only, since it registers an agent; mount it before any
- * thread activates.
- */
-export declare const base: Plugin.Object<undefined>;

package/dist/presets/index.d.ts

@@ -1,4 +0,0 @@
-export * from './agents.js';
-export * from './base.js';
-export * from './codex.js';
-export * from './prompts.js';

package/dist/sandbox/index.js

@@ -1,4 +0,0 @@
-import{a as Q,b as Z}from"../chunks/CDQG7RKA.js";import{c as b}from"../chunks/G6RXC3AL.js";import{b as T,c as z}from"../chunks/GQGNVSKB.js";import{c as J}from"../chunks/DXFXAYDN.js";import{b as V,c as Y,e as K}from"../chunks/DRYAN665.js";import{d as v}from"../chunks/2OSESBIL.js";import"../chunks/YLNJXQ3Z.js";import{d as E}from"../chunks/DDANMY45.js";import{d as X}from"../chunks/37YOGDGY.js";import"../chunks/KESCTXGO.js";import"../chunks/TYTQRLTX.js";import"../chunks/D7E6EWIE.js";import{createRequire as st}from"node:module";import{dirname as it,join as at}from"node:path";import{randomUUID as Ye}from"node:crypto";import{homedir as Ke}from"node:os";import{isAbsolute as O}from"node:path";import{Service as xe}from"@leuduan/cordis";import{z as i}from"zod";import{Worker as Ae}from"node:worker_threads";var A=class{worker;pending=new Map;nextId=1;ended=null;closing=!1;onDeath;constructor(e,n,r){this.onDeath=r,this.worker=new Ae(e,{env:n}),this.worker.on("message",o=>this.settle(o)),this.worker.on("error",o=>this.end(new Error(`The sandbox worker failed: ${o.message}`))),this.worker.on("exit",o=>this.end(new Error(`The sandbox worker exited with code ${o}`)))}get alive(){return this.ended===null&&!this.closing}request(e,n){if(this.ended!==null)return Promise.reject(this.ended);if(this.closing)return Promise.reject(new Error("The sandbox worker is shutting down"));let{signal:r}=n;if(r?.aborted)return Promise.reject(r.reason instanceof Error?r.reason:new Error("aborted"));let o=this.nextId++;return new Promise((s,a)=>{let d=p=>{this.pending.delete(o)&&(clearTimeout(l),c(),e.type==="wrap"&&this.send({type:"cancel",id:o}),a(p))},m=()=>d(r?.reason instanceof Error?r.reason:new Error("aborted")),l=setTimeout(()=>d(new Error(`The sandbox worker did not answer ${e.type} within ${n.timeoutMs} ms`)),n.timeoutMs),c=()=>r?.removeEventListener("abort",m);r?.addEventListener("abort",m,{once:!0}),this.pending.set(o,{resolve:s,reject:a,timer:l,cleanup:c}),this.send({...e,id:o})})}async terminate(){this.closing=!0,this.rejectAll(new Error("The sandbox worker is shutting down")),await this.worker.terminate()}unref(){this.worker.unref()}send(e){try{this.worker.postMessage(e)}catch(n){this.end(new Error(`The sandbox worker could not be reached: ${n instanceof Error?n.message:n}`))}}settle(e){let n=this.pending.get(e.id);n!==void 0&&(this.pending.delete(e.id),clearTimeout(n.timer),n.cleanup(),e.ok?n.resolve(e.value):n.reject(new Error(e.error)))}end(e){this.ended===null&&(this.ended=e,this.rejectAll(e),this.closing||this.onDeath(e))}rejectAll(e){let n=[...this.pending.values()];this.pending.clear();for(let r of n)clearTimeout(r.timer),r.cleanup(),r.reject(e)}};import{createHash as M,randomUUID as Se}from"node:crypto";import{existsSync as De,linkSync as ke,lstatSync as te,mkdirSync as ne,readdirSync as _e,readFileSync as q,unlinkSync as re,writeFileSync as $e}from"node:fs";import{join as g}from"node:path";var ee=t=>g(t,".srt"),Re=(t,e)=>g(t,"scratch",M("sha256").update(e).digest("hex"));function L(t){try{ne(t,{mode:448})}catch(n){if(!E(n,"EEXIST"))throw n}let e=te(t);if(!e.isDirectory()||e.uid!==process.getuid?.())throw new Error(`${t} is not a directory owned by this user`)}function oe(t){return ne(t,{recursive:!0,mode:448}),L(ee(t)),ee(t)}function C(t,e){L(g(t,"scratch"));let n=Re(t,e);return L(n),n}function se(t){let e=[];for(let n of _e(t)){let r=/^srt-mux-(\d+)-[0-9a-z]+\.sock$/.exec(n);if(!(r===null||Oe(Number(r[1]))))try{re(g(t,n)),e.push(n)}catch{}}return e}function Oe(t){if(t===process.pid)return!0;try{return process.kill(t,0),!0}catch(e){return E(e,"EPERM")}}function ie(t,e){let n=q(e),r=M("sha256").update(n).digest("hex"),o=g(t,`srt-proxy-agent-${r}.jar`);if(!De(o)){let a=g(t,`.publish-${Se()}.tmp`);$e(a,n,{flag:"wx",mode:292});try{ke(a,o)}catch(d){if(!E(d,"EEXIST"))throw d}finally{re(a)}}if(!te(o).isFile()||M("sha256").update(q(o)).digest("hex")!==r)throw new Error(`${o} exists and is not the Java agent it is named for`);return{path:o,sha256:r}}import{createHash as Ne}from"node:crypto";import{existsSync as ce,realpathSync as de}from"node:fs";import{basename as Pe,dirname as ae,isAbsolute as je,join as x,resolve as Me}from"node:path";var Le=/^(LD_.*|DYLD_.*|BASH_ENV|ENV|SHELLOPTS|BASHOPTS|BASH_FUNC_.*)$/;function le(t){let e=Object.keys(t).filter(n=>Le.test(n));if(e.length>0)throw new Error(`The command sandbox refuses an environment that sets ${e.join(", ")}: they run code before the sandbox holds`)}var H=128*1024;function h(t){let e=Me(t),n=[];for(;!ce(e)&&ae(e)!==e;)n.unshift(Pe(e)),e=ae(e);return x(de.native(e),...n)}var u=t=>({path:t,literal:!0}),Ce=/[*?[\]]/,He=["__GLOBSTAR_SLASH__","__GLOBSTAR__"];function he(t){if(!je(t))throw new Error(`The command sandbox needs an absolute root, not ${t}`);let e=h(t);if(Ce.test(e)||He.some(n=>e.includes(n)))throw new Error(`The command sandbox refuses ${e} as a root: its name holds glob characters, which sandbox-runtime would read as a pattern`);return e}var Ie=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],Ue=[".vscode",".idea",".claude/commands",".claude/agents"];function We(t){let e=[];for(let n of Ie)e.push(u(x(t,n)),`${t}/**/${n}`);for(let n of Ue)e.push(u(x(t,n)),`${t}/**/${n}/**`);return e.push(u(x(t,".git/hooks")),`${t}/**/.git/hooks/**`),e.push(u(x(t,".git/config")),`${t}/**/.git/config`),e}var Be=["env","which","log","/bin/sh","/usr/bin/sandbox-exec"];function me(t){let e=t.split(":"),n=Be.flatMap(r=>(r.startsWith("/")?[r]:e.map(o=>x(o,r))).filter(o=>ce(o)).map(o=>de.native(o)));return[...e,...n]}function I(t,e,n){let r=(o,s)=>b(o,s)||b(s,o);for(let o of t){let s=e.find(a=>r(a,o));if(s!==void 0)throw new Error(`The command sandbox refuses to let commands write ${o}: it overlaps ${s}, which the sandbox runs before confinement`);if(r(n,o))throw new Error(`The command sandbox refuses to let commands write ${o}: it overlaps the temporary root`)}}function ue(t,e,n){return{allowWrite:[e,...t.allowWrite,n].map(u),denyWrite:[...[...t.denyWrite,t.dataDir,...t.conveniences,"/tmp/claude","/private/tmp/claude",t.privateDirectory].map(u),...We(e)],denyRead:t.denyRead.map(u)}}var U=['if [ -n "${LAGENT_SANDBOX_PATH+x}" ]; then PATH=$LAGENT_SANDBOX_PATH; export PATH; else unset PATH; fi',"TMPDIR=$LAGENT_SANDBOX_TMPDIR; export TMPDIR",'set -- "$LAGENT_SANDBOX_COMMAND"',"unset LAGENT_SANDBOX_PATH LAGENT_SANDBOX_TMPDIR LAGENT_SANDBOX_COMMAND",'exec /bin/sh -c "$1"'].join("; ");function fe(t,e,n,r){let{PATH:o,...s}=t;return{...s,PATH:e,LAGENT_SANDBOX_TMPDIR:n,LAGENT_SANDBOX_COMMAND:r,...o===void 0?{}:{LAGENT_SANDBOX_PATH:o}}}var S="lagent-srt",Ge="5",pe=t=>`${S}/${Ge} sandbox-runtime/${t}`;function we(t){return`sha256:${Ne("sha256").update(X({...t,bootstrap:U})).digest("hex")}`}function ge(t){let e=t.filesystem.allowWrite.length===0?"":`, in ${t.filesystem.allowWrite.join(", ")}`,{network:n}=t,r=n.mode==="unrestricted"?"They have unrestricted network access.":n.allowedDomains.length===0?"They have no network access.":`They reach the network only through a proxy, and only these hosts: ${n.allowedDomains.join(", ")}; any other host is refused with HTTP 403. Tools that ignore HTTP_PROXY cannot connect. Refused requests are usually, not always, listed after the command's output.`;return[`run_command and start_command run in an OS sandbox. They can write only inside the conversation's working directory${e}, and in $TMPDIR. Writes elsewhere fail with "Operation not permitted", which is all a refused write reports. Inside the working directory, git hooks, .git/config, shell startup files and editor settings cannot be written from a command.`,r,"A refusal is the sandbox, not a fault to work around: say what you needed instead."].join(" ")}import{z as W}from"zod";var f=Z({name:"lagent:sandbox",authority:"conversation",initial:"confined",modes:["confined","unconfined"]});function k(t,e){if(t.journal.summary(e)===void 0)throw new Error(`Unknown thread: ${e}`);return f.recorded(t.journal,f.authorityOf(t,e))}var Fe=(t,e)=>f.recorded(t,e),Xe=W.strictObject({mode:W.enum(["confined","unconfined"]),guidance:W.string().nullable()}),Je=V({plugin:"lagent:sandbox",kind:"notice",version:1,schema:Xe}),ze="The sandbox is off: commands you start from now on run with the user's full permissions and network; commands already preparing or running keep the confinement they started with.",Ve="Commands you start from now on are sandboxed; commands already preparing or running keep how they were launched.",B="The sandbox is unavailable on this host: run_command and start_command are refused for this conversation.";function _(t,e){K(t,{event:Je,agents:"all",rank:1,current:n=>{try{return e(n.threadId)}catch(r){if(r instanceof Q)return;throw r}},render:(n,r,{notices:o})=>{let s=Y(o)?.value??null;return n.mode==="unconfined"?(r??(s?.mode==="confined"?s:null))?.mode==="confined"?ze:null:n.guidance===null?null:n.guidance===B?n.guidance:`${Ve} ${n.guidance}`}})}var D=new WeakMap;function $(t,e){let n=t.reflect.target,r=D.get(n);if(r!==void 0)throw new Error(`${e} cannot mount: ${r} already owns this application's sandbox, and the two exclude each other`);D.set(n,e),t.effect(()=>()=>{D.get(n)===e&&D.delete(n)})}var y=i.string().refine(O,{message:"Expected an absolute path"}),be=i.url({protocol:/^https?$/}).refine(t=>new URL(t).username===""&&new URL(t).password==="",{message:"A parent proxy URL carrying credentials is not supported"}),Ee=i.strictObject({worker:i.union([i.instanceof(URL),i.string().min(1)]),searchPath:i.string().refine(t=>t.split(":").every(O),{message:"Every searchPath entry must be absolute"}),tmpRoot:y,javaAgentJar:y,unconfined:i.enum(["allowed","refused"]),filesystem:i.strictObject({allowWrite:i.array(y),denyRead:i.array(y),denyWrite:i.array(y)}),network:i.discriminatedUnion("mode",[i.strictObject({mode:i.literal("allowlist"),allowedDomains:i.array(i.string().min(1)),deniedDomains:i.array(i.string().min(1)),parentProxy:i.union([i.literal("none"),i.strictObject({http:be.optional(),https:be.optional(),noProxy:i.string().optional()})])}),i.strictObject({mode:i.literal("unrestricted")})]),drainTimeoutMs:i.number().int().positive().default(2e4)});function Qe(t){if(t.mode==="unrestricted")return{deniedDomains:[]};let{parentProxy:e}=t;return{allowedDomains:t.allowedDomains,deniedDomains:t.deniedDomains,...e==="none"?{}:{parentProxy:e}}}function Ze(t,e,n){return t==="allowlist"?e.isCopy?[]:[`sandbox-runtime does not advertise the Java agent copy ${n}`]:e.flags===0?[]:["sandbox-runtime advertises a Java agent although the network is unrestricted"]}var R=3e4,qe=15e3,et=5e3,ye=!1,N=class extends xe{static inject=["threadDirs","launches","journal","threads"];guidance;config;dataDir;state="new";failure=null;admitting=!0;client=null;host=null;handle;releasing=null;constructor(e,n){super(e,"sandbox"),this.dataDir=e.threadDirs.require("sandbox"),v(e,"sandbox"),this.config=Ee.parse(n),this.guidance=ge(this.config),$(e,"sandbox"),_(e,r=>{let o=this.mode(r);return{mode:o,guidance:o==="confined"?this.guidance:null}}),this.handle=e.launches.handle(this),e.fiber.beforeUnload(()=>this.closeAndRelease())}async[xe.init](){try{await this.start()}catch(e){this.state="failed",this.admitting=!1;let n=this.releaseHandle();throw this.announceFailure(),await n,await this.client?.terminate(),this.client=null,e}return()=>this.release()}get unconfined(){return this.config.unconfined}get health(){return this.state==="ready"&&this.admitting?"ready":"failed"}mode(e){return this.config.unconfined==="refused"?"confined":f.of(this.ctx,e)}async setMode(e,n){this.refuseGated(n);let r=this.ctx.journal.summary(e);if(r===void 0)throw new Error(`Unknown thread: ${e}`);if(r.origin!==null)throw new Error(`Thread ${e} is in its conversation's sandbox mode`);await f.set(this.ctx,e,n)}opening(e){return this.refuseGated(e),f.opening(e)}refuseGated(e){if(e==="unconfined"&&this.config.unconfined==="refused")throw new Error("This host refuses unconfined commands")}async prepare(e){if(this.requireOpen(),this.ctx.journal.summary(e.threadId)===void 0)throw new Error(`The command sandbox cannot launch for unknown thread ${e.threadId}`);if(!O(e.workdir))throw new Error(`The command sandbox needs an absolute workdir, not ${e.workdir}`);return this.mode(e.threadId)==="unconfined"?this.plain(e):this.build(e,!1)}plain(e){let n=this.host;if(n===null)throw new Error("The command sandbox is not running");return{argv:["/bin/sh","-c",e.program.shell],cwd:e.workdir,env:e.environment,provenance:{launcher:S,version:n.version,policy:T},violations:async()=>null}}async start(){if(process.platform!=="darwin")throw new Error(`The command sandbox supports macOS only; on ${process.platform}, sandbox-runtime's launches sharing a directory can remove each other's protective mount points`);if(ye)throw new Error("The command sandbox starts once per process: sandbox-runtime keeps process-wide state and is never restarted, so restart the host");ye=!0,this.state="starting";let{config:e}=this,n=h(e.tmpRoot),r=h(this.dataDir);if(b(n,r))throw new Error("tmpRoot must be outside the data directory, which commands may not write");let o=e.searchPath.split(":").map(h).join(":"),s=me(o),a=e.filesystem.allowWrite.map(h);I(a,s,n);let d=e.filesystem.denyWrite.map(h),m=e.filesystem.denyRead.map(h),l=Ke(),c=oe(n);se(c);let p=ie(c,e.javaAgentJar),P=new A(e.worker,{PATH:o,HOME:l,TMPDIR:c,CLAUDE_CODE_TMPDIR:c},j=>this.onWorkerDeath(j));this.client=P;let G=j=>({path:j,literal:!0}),Te={network:Qe(e.network),filesystem:{denyRead:m.map(G),allowWrite:[],denyWrite:[...d,r].map(G)},javaAgentJarPath:p.path},w=await P.request({type:"init",config:Te,expect:{tmpdir:c,home:l}},{timeoutMs:R}),F=[...w.supported?[]:["this platform is not supported"],...w.errors,...w.warnings,...Ze(e.network.mode,w.javaAgent,p.path)];if(F.length>0)throw new Error(`The command sandbox cannot start here: ${F.join("; ")}`);if(this.host={tmpRoot:n,cwd:process.cwd(),home:l,searchPath:o,trusted:s,extraRoots:e.filesystem.allowWrite,facts:{allowWrite:a,denyWrite:d,denyRead:m,dataDir:r,conveniences:w.conveniences,privateDirectory:c},version:pe(w.version),javaAgentSha256:p.sha256},await this.selfCheck(n),!P.alive||this.failure!==null)throw new Error(`The command sandbox worker ended while it started${this.failure===null?"":`: ${this.failure.message}`}`);this.state="ready"}async selfCheck(e){let n=C(e,"self-check"),r=await this.build({program:{shell:"exit 0"},workdir:n,root:n,scratch:"self-check",environment:{},signal:AbortSignal.timeout(R)},!0),o=await J({command:r.argv,cwd:r.cwd,env:r.env,signal:AbortSignal.timeout(R),timeoutMs:R});if(o.exitCode!==0){let s=o.exitSignal===null?`exit code ${o.exitCode}`:`signal ${o.exitSignal}`;throw new Error(`The command sandbox could not run a confined command: ${o.output.trim()||s}`)}}requireOpen(){if(this.state==="failed")throw new Error(`The command sandbox failed${this.failure===null?"":`: ${this.failure.message}`}. Commands cannot run unconfined; it stays failed until lagent restarts.`);if(this.state==="new"||this.state==="starting")throw new Error("The command sandbox is still starting");if(this.state!=="ready"||!this.admitting)throw new Error("The command sandbox is shutting down")}async build(e,n){let r=this.host,o=this.client;if(r===null||o===null)throw new Error("The command sandbox is not running");if(le(e.environment),!O(e.workdir))throw new Error(`The command sandbox needs an absolute workdir, not ${e.workdir}`);if(Buffer.byteLength(e.program.shell)>H)throw new Error(`The command sandbox refuses a command longer than ${H} bytes`);if(process.cwd()!==r.cwd)throw new Error(`The host changed its working directory from ${r.cwd} to ${process.cwd()}: the command sandbox refuses to launch`);let s=he(e.root),a=r.extraRoots.map(h);I(n?a:[s,...a],r.trusted,r.tmpRoot);let d=C(r.tmpRoot,e.scratch),m={...r.facts,allowWrite:a},l=ue(m,s,d),c=Ye();return{argv:["/bin/sh","-c",`exec ${await o.request({type:"wrap",command:U,commandId:c,commandText:e.program.shell.slice(0,1e3),config:{filesystem:l}},{timeoutMs:qe,signal:e.signal})}`],cwd:e.workdir,env:fe(e.environment,r.searchPath,d,e.program.shell),provenance:{launcher:S,version:r.version,policy:we({filesystem:l,network:this.config.network,searchPath:r.searchPath,cwd:r.cwd,home:r.home,conveniences:r.facts.conveniences,javaAgent:r.javaAgentSha256,version:r.version})},violations:()=>this.violationsOf(c)}}async violationsOf(e){if(this.client===null)return null;let n=await this.client.request({type:"violations",commandId:e},{timeoutMs:z});return n.length===0?null:`<sandbox_violations>
-${n.join(`
-`)}
-</sandbox_violations>`}onWorkerDeath(e){this.failure??=e,this.state==="ready"&&(this.state="failed",this.admitting=!1,this.ctx.reportError(e),this.releaseHandle(),this.announceFailure())}announceFailure(){this.ctx.parallel("lagent/sandbox/health","failed").catch(e=>this.ctx.reportError(e))}async closeAndRelease(){this.admitting=!1,this.state==="ready"&&(this.state="stopping"),await this.releaseHandle()}releaseHandle(){return this.releasing??=this.handle.release(this.config.drainTimeoutMs).then(e=>(e||this.ctx.reportError(new Error(`A command could not be confirmed stopped within ${this.config.drainTimeoutMs} ms: a confined process may still run, so the sandbox worker is kept until the process exits`)),e)),this.releasing}async release(){let e=this.client;if(e!==null){if(!await this.releaseHandle()){e.unref();return}e.alive&&await e.request({type:"reset"},{timeoutMs:et}).catch(()=>{}),await e.terminate(),this.client=null}}};import{z as ve}from"zod";var tt=ve.strictObject({drainTimeoutMs:ve.number().int().positive()}),nt="lagent-sandbox-absent",rt="1",ot={name:"lagent:sandbox-absent",inject:["journal","threads","launches"],apply(t,e){v(t,"sandboxAbsent");let n=tt.parse(e);$(t,"sandboxAbsent");let r=t.launches.handle({async prepare(s){if(k(t,s.threadId)==="confined")throw new Error("This conversation is sandboxed, and the host started without a sandbox, so its commands are refused.");return{argv:["/bin/sh","-c",s.program.shell],cwd:s.workdir,env:s.environment,provenance:{launcher:nt,version:rt,policy:T},violations:async()=>null}}}),o=null;t.fiber.beforeUnload(()=>(o??=r.release(n.drainTimeoutMs).then(s=>(s||t.reportError(new Error(`A command could not be confirmed stopped within ${n.drainTimeoutMs} ms`)),s)),o.then(()=>{}))),_(t,s=>k(t,s)==="confined"?{mode:"confined",guidance:B}:{mode:"unconfined",guidance:null})}};var zt=N,Vt=new URL("./worker.js",import.meta.url);function Yt(){let t=st(import.meta.url).resolve("@anthropic-ai/sandbox-runtime/package.json");return at(it(t),"vendor","java-proxy-agent","srt-proxy-agent.jar")}export{Ee as SandboxConfigSchema,zt as sandbox,ot as sandboxAbsent,k as sandboxRecorded,Fe as sandboxRecordedOn,Vt as sandboxWorker,Yt as srtJavaAgentJar};