@mastra/code-sdk 0.0.0-aggregate-trace-20261015182851

package/dist/agents/sandbox-filesystem.js

@@ -0,0 +1,581 @@
+import { posix } from "path";
+import { DirectoryNotFoundError, FileExistsError, FileNotFoundError, IsDirectoryError, NotDirectoryError, UnsupportedGrepPatternError } from "@mastra/core/workspace";
+//#region src/agents/sandbox-filesystem.ts
+/**
+* SandboxFilesystem
+*
+* A `WorkspaceFilesystem` that stores files inside a remote `MastraSandbox`
+* (e.g. a Railway VM) rather than on the server host. File operations are
+* implemented by shelling out through the sandbox's `executeCommand`, so the
+* agent's file tools and command tools share one VM and one view of the repo.
+*
+* Paths are workspace-relative (`/src/foo.ts`) and resolve under the sandbox
+* working directory (`basePath`). A traversal guard rejects any path that
+* escapes the workdir, mirroring `LocalFilesystem`'s contained mode.
+*
+* Reads/writes use base64 over the wire so binary content survives the shell.
+*/
+/**
+* Sentinel exit codes used by guard clauses that run before the real command,
+* so shell failures can be mapped to typed filesystem errors.
+*/
+const EXIT_NOT_FOUND = 20;
+const EXIT_IS_DIRECTORY = 21;
+const EXIT_EXISTS = 22;
+const EXIT_NOT_DIRECTORY = 23;
+/** Default per-command deadline so a hung sandbox can't block file tools forever. */
+const COMMAND_TIMEOUT_MS = 3e4;
+/** Single-quote a string for safe POSIX shell interpolation. */
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function isFileContentString(content) {
+	return typeof content === "string";
+}
+function toBuffer(content) {
+	if (isFileContentString(content)) return Buffer.from(content, "utf8");
+	return Buffer.from(content);
+}
+var SandboxFilesystem = class SandboxFilesystem {
+	id;
+	name = "SandboxFilesystem";
+	provider = "sandbox";
+	status = "ready";
+	sandbox;
+	workdirSource;
+	resolvedBase;
+	resolvingBase;
+	constructor(options) {
+		this.sandbox = options.sandbox;
+		this.workdirSource = options.workdir;
+		if (typeof options.workdir === "string") this.resolvedBase = options.workdir;
+		this.id = options.id ?? (typeof options.workdir === "string" ? `sandbox-fs:${options.sandbox.id}:${options.workdir}` : `sandbox-fs:${options.sandbox.id}`);
+	}
+	/** The resolved workspace root; empty until a lazy workdir first resolves. */
+	get basePath() {
+		return this.resolvedBase ?? "";
+	}
+	/** Await (and memoize) the workspace root, resolving a lazy workdir once. */
+	async base() {
+		if (this.resolvedBase) return this.resolvedBase;
+		const source = this.workdirSource;
+		if (typeof source === "string") return this.resolvedBase = source;
+		this.resolvingBase ??= Promise.resolve().then(source).then((resolved) => {
+			if (!resolved) throw new Error("Sandbox workspace root resolution returned an empty path");
+			return this.resolvedBase = resolved;
+		}).finally(() => {
+			this.resolvingBase = void 0;
+		});
+		return this.resolvingBase;
+	}
+	/**
+	* Resolve a workspace path to an absolute path inside the sandbox, enforcing
+	* that it stays within the workdir. Awaits the workspace root first, which
+	* for a lazy workdir may start the VM.
+	*/
+	async resolveAsync(inputPath) {
+		return this.resolveAgainst(await this.base(), inputPath);
+	}
+	/**
+	* Resolve a workspace path against a known base, enforcing that it stays
+	* within the workdir.
+	*
+	* Accepts both workspace-relative paths (`src/foo.ts`, `/src/foo.ts`) and
+	* absolute sandbox paths that already live under the workdir — the agent's
+	* prompt advertises the workdir as its working directory, so tools are
+	* routinely called with fully-qualified paths like `<workdir>/src/foo.ts`.
+	*/
+	resolveAgainst(basePath, inputPath) {
+		const base = posix.normalize(basePath);
+		const normalizedInput = posix.normalize(inputPath);
+		const rel = normalizedInput === base ? "" : normalizedInput.startsWith(`${base}/`) ? normalizedInput.slice(base.length + 1) : inputPath.startsWith("/") ? inputPath.slice(1) : inputPath;
+		const resolved = posix.normalize(posix.join(base, rel));
+		if (resolved !== base && !resolved.startsWith(`${base}/`)) throw new Error(`Path escapes workspace root: ${inputPath}`);
+		return resolved;
+	}
+	resolveAbsolutePath(inputPath) {
+		if (!this.resolvedBase) return void 0;
+		return this.resolveAgainst(this.resolvedBase, inputPath);
+	}
+	async exec(script) {
+		return this.sandbox.executeCommand("sh", ["-c", script], {
+			timeout: COMMAND_TIMEOUT_MS,
+			maxRetainedBytes: Infinity
+		});
+	}
+	/**
+	* Lexical guard catches `..` traversal, but a symlink inside the workdir can
+	* still point outside it. After resolving a path that refers to an existing
+	* entry, verify its realpath is still contained in the workdir.
+	*
+	* Canonicalization tries `realpath`, then `readlink -f` (GNU/busybox), then
+	* `cd && pwd -P` for directories — covering GNU hosts, macOS/BSD, and
+	* busybox. If the path exists but cannot be canonicalized we fail CLOSED:
+	* returning without a check would let a symlink bypass containment.
+	*/
+	async assertContainedRealpath(abs, inputPath) {
+		const result = await this.exec([
+			`p=${shellQuote(abs)}`,
+			`if [ ! -e "$p" ] && [ ! -L "$p" ]; then exit ${EXIT_NOT_FOUND}; fi`,
+			`root=$(cd ${shellQuote(this.basePath)} 2>/dev/null && pwd -P)`,
+			`[ -n "$root" ] || exit 1`,
+			`rp=$(realpath "$p" 2>/dev/null) || rp=$(readlink -f "$p" 2>/dev/null) || { [ -d "$p" ] && rp=$(cd "$p" 2>/dev/null && pwd -P); }`,
+			`[ -n "$rp" ] || exit 1`,
+			`printf '%s\\n%s' "$root" "$rp"`
+		].join("\n"));
+		if (result.exitCode === EXIT_NOT_FOUND) return;
+		const [root, real] = result.stdout.split("\n").map((s) => s.trim());
+		if (result.exitCode !== 0 || !root || !real) throw new Error(`Unable to verify path stays within workspace root: ${inputPath}`);
+		if (real !== root && !real.startsWith(`${root}/`)) throw new Error(`Path escapes workspace root (symlink): ${inputPath}`);
+	}
+	/**
+	* Guard for write destinations. The lexical guard catches `..`, but a symlink
+	* inside the workdir can redirect a write outside it. For an existing target
+	* we check its realpath; for a not-yet-existing target we check the realpath
+	* of its nearest existing ancestor directory, since a symlinked parent is the
+	* escape vector (e.g. `link -> /etc` then writing `link/passwd`).
+	*/
+	async assertContainedDest(abs, inputPath) {
+		await this.assertContainedRealpath(abs, inputPath);
+		const parent = posix.dirname(abs);
+		if (parent && parent !== abs) await this.assertContainedRealpath(parent, inputPath);
+	}
+	async execOk(script, context) {
+		const result = await this.exec(script);
+		if (result.exitCode !== 0) throw new Error(`${context} failed (exit ${result.exitCode}): ${result.stderr.trim() || result.stdout.trim()}`);
+		return result;
+	}
+	async readFile(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(abs, path);
+		const result = await this.exec(`if [ -d ${shellQuote(abs)} ]; then exit ${EXIT_IS_DIRECTORY}; elif [ ! -e ${shellQuote(abs)} ]; then exit ${EXIT_NOT_FOUND}; fi; base64 < ${shellQuote(abs)}`);
+		if (result.exitCode === EXIT_IS_DIRECTORY) throw new IsDirectoryError(path);
+		if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(path);
+		if (result.exitCode !== 0) throw new Error(`readFile ${path} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+		const buffer = Buffer.from(result.stdout.replace(/\s/g, ""), "base64");
+		if (options?.encoding) return buffer.toString(options.encoding);
+		return buffer;
+	}
+	async writeFile(path, content, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedDest(abs, path);
+		const b64 = toBuffer(content).toString("base64");
+		const dir = posix.dirname(abs);
+		const mkdir = options?.recursive === false ? "" : `mkdir -p ${shellQuote(dir)} && `;
+		if (options?.overwrite === false) {
+			const result = await this.exec(`${mkdir}{ (set -C; printf %s ${shellQuote(b64)} | base64 -d > ${shellQuote(abs)}) 2>/dev/null || { [ -e ${shellQuote(abs)} ] && exit ${EXIT_EXISTS} || exit 1; }; }`);
+			if (result.exitCode === EXIT_EXISTS) throw new FileExistsError(path);
+			if (result.exitCode !== 0) throw new Error(`writeFile ${path} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+			return;
+		}
+		await this.execOk(`${mkdir}printf %s ${shellQuote(b64)} | base64 -d > ${shellQuote(abs)}`, `writeFile ${path}`);
+	}
+	async appendFile(path, content) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedDest(abs, path);
+		const b64 = toBuffer(content).toString("base64");
+		await this.execOk(`mkdir -p ${shellQuote(posix.dirname(abs))} && printf %s ${shellQuote(b64)} | base64 -d >> ${shellQuote(abs)}`, `appendFile ${path}`);
+	}
+	async deleteFile(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(posix.dirname(abs), path);
+		if (options?.force) {
+			await this.execOk(`rm -f ${shellQuote(abs)}`, `deleteFile ${path}`);
+			return;
+		}
+		const result = await this.exec(`if [ ! -e ${shellQuote(abs)} ]; then exit ${EXIT_NOT_FOUND}; fi; rm ${shellQuote(abs)}`);
+		if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(path);
+		if (result.exitCode !== 0) throw new Error(`deleteFile ${path} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+	}
+	async copyFile(src, dest, options) {
+		const srcAbs = await this.resolveAsync(src);
+		const destAbs = await this.resolveAsync(dest);
+		await this.assertContainedRealpath(srcAbs, src);
+		await this.assertContainedDest(destAbs, dest);
+		const recursive = options?.recursive ? "-r " : "";
+		if (options?.overwrite === false) {
+			const result = await this.exec([
+				`src=${shellQuote(srcAbs)}`,
+				`dest=${shellQuote(destAbs)}`,
+				`if [ ! -e "$src" ] && [ ! -L "$src" ]; then exit ${EXIT_NOT_FOUND}; fi`,
+				`mkdir -p ${shellQuote(posix.dirname(destAbs))} || exit 1`,
+				`if [ -d "$src" ]; then`,
+				`  mkdir "$dest" 2>/dev/null || exit ${EXIT_EXISTS}`,
+				`  cp -R "$src"/. "$dest"/`,
+				`else`,
+				`  tmp="$dest.__cptmp$$"`,
+				`  cp "$src" "$tmp" || exit 1`,
+				`  ln "$tmp" "$dest" 2>/dev/null || { rm -f "$tmp"; [ -e "$dest" ] && exit ${EXIT_EXISTS} || exit 1; }`,
+				`  rm -f "$tmp"`,
+				`fi`
+			].join("\n"));
+			if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(src);
+			if (result.exitCode === EXIT_EXISTS) throw new FileExistsError(dest);
+			if (result.exitCode !== 0) throw new Error(`copyFile ${src} -> ${dest} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+			return;
+		}
+		const result = await this.exec(`if [ ! -e ${shellQuote(srcAbs)} ]; then exit ${EXIT_NOT_FOUND}; fi; mkdir -p ${shellQuote(posix.dirname(destAbs))} && cp ${recursive}${shellQuote(srcAbs)} ${shellQuote(destAbs)}`);
+		if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(src);
+		if (result.exitCode !== 0) throw new Error(`copyFile ${src} -> ${dest} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+	}
+	async moveFile(src, dest, options) {
+		const srcAbs = await this.resolveAsync(src);
+		const destAbs = await this.resolveAsync(dest);
+		await this.assertContainedRealpath(srcAbs, src);
+		await this.assertContainedDest(destAbs, dest);
+		if (options?.overwrite === false) {
+			const result = await this.exec([
+				`src=${shellQuote(srcAbs)}`,
+				`dest=${shellQuote(destAbs)}`,
+				`if [ ! -e "$src" ] && [ ! -L "$src" ]; then exit ${EXIT_NOT_FOUND}; fi`,
+				`mkdir -p ${shellQuote(posix.dirname(destAbs))} || exit 1`,
+				`mv -n "$src" "$dest" 2>/dev/null || exit 1`,
+				`if [ -e "$src" ] || [ -L "$src" ]; then exit ${EXIT_EXISTS}; fi`
+			].join("\n"));
+			if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(src);
+			if (result.exitCode === EXIT_EXISTS) throw new FileExistsError(dest);
+			if (result.exitCode !== 0) throw new Error(`moveFile ${src} -> ${dest} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+			return;
+		}
+		const result = await this.exec(`if [ ! -e ${shellQuote(srcAbs)} ]; then exit ${EXIT_NOT_FOUND}; fi; mkdir -p ${shellQuote(posix.dirname(destAbs))} && mv ${shellQuote(srcAbs)} ${shellQuote(destAbs)}`);
+		if (result.exitCode === EXIT_NOT_FOUND) throw new FileNotFoundError(src);
+		if (result.exitCode !== 0) throw new Error(`moveFile ${src} -> ${dest} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+	}
+	async mkdir(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedDest(abs, path);
+		const flag = options?.recursive === false ? "" : "-p ";
+		await this.execOk(`mkdir ${flag}${shellQuote(abs)}`, `mkdir ${path}`);
+	}
+	async rmdir(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(posix.dirname(abs), path);
+		if (options?.recursive) {
+			const force = options?.force ? "-f " : "";
+			await this.execOk(`rm -r ${force}${shellQuote(abs)}`, `rmdir ${path}`);
+			return;
+		}
+		if ((await this.exec(`rmdir ${shellQuote(abs)}`)).exitCode !== 0 && !options?.force) throw new Error(`Directory not empty or not found: ${path}`);
+	}
+	async readdir(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(abs, path);
+		if (options?.recursive) {
+			const result = await this.exec(`test -d ${shellQuote(abs)} && find ${shellQuote(abs)} -mindepth 1 ${options.maxDepth ? `-maxdepth ${Number(options.maxDepth)} ` : ""}2>/dev/null | while IFS= read -r f; do if [ -d "$f" ]; then printf 'd\\t%s\\n' "$f"; else printf 'f\\t%s\\n' "$f"; fi; done`);
+			if (result.exitCode !== 0) throw new Error(`Directory not found: ${path}`);
+			return this.parseFindOutput(result.stdout, abs, options);
+		}
+		const result = await this.exec(`cd ${shellQuote(abs)} 2>/dev/null && for f in * .[!.]*; do [ -e "$f" ] || continue; if [ -d "$f" ]; then printf 'd\\t%s\\n' "$f"; else printf 'f\\t%s\\n' "$f"; fi; done`);
+		if (result.exitCode !== 0) throw new Error(`Directory not found: ${path}`);
+		return this.parseListOutput(result.stdout, options);
+	}
+	parseListOutput(stdout, options) {
+		const entries = [];
+		for (const line of stdout.split("\n")) {
+			if (!line) continue;
+			const tab = line.indexOf("	");
+			if (tab < 0) continue;
+			const type = line.slice(0, tab) === "d" ? "directory" : "file";
+			const name = line.slice(tab + 1);
+			if (!name || name === "." || name === "..") continue;
+			if (type === "file" && !this.matchesExtension(name, options?.extension)) continue;
+			entries.push({
+				name,
+				type
+			});
+		}
+		return entries;
+	}
+	parseFindOutput(stdout, base, options) {
+		const entries = [];
+		for (const line of stdout.split("\n")) {
+			if (!line) continue;
+			const tab = line.indexOf("	");
+			if (tab < 0) continue;
+			const type = line.slice(0, tab) === "d" ? "directory" : "file";
+			const fullPath = line.slice(tab + 1);
+			const name = posix.relative(base, fullPath);
+			if (!name) continue;
+			if (type === "file" && !this.matchesExtension(name, options?.extension)) continue;
+			entries.push({
+				name,
+				type
+			});
+		}
+		return entries;
+	}
+	matchesExtension(name, extension) {
+		if (!extension) return true;
+		return (Array.isArray(extension) ? extension : [extension]).some((ext) => name.endsWith(ext));
+	}
+	/**
+	* Walk the tree in a single sandbox command instead of one readdir round
+	* trip per directory. Uses `find` with a portable classification loop
+	* (`find -printf` is GNU-only and fails on macOS/BSD hosts). `find` does
+	* not follow symlinked directories by default, matching the host-side
+	* walker's no-recursion-into-symlinks behavior.
+	*/
+	async walk(path, options) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(abs, path);
+		const maxDepth = options?.maxDepth !== void 0 && Number.isFinite(options.maxDepth) ? `-maxdepth ${Math.max(0, Math.floor(options.maxDepth))} ` : "";
+		const hiddenPrune = options?.includeHidden ? "" : `-name '.*' -prune -o `;
+		const script = `root=${shellQuote(abs)}\n[ -e "$root" ] || [ -L "$root" ] || exit ${EXIT_NOT_FOUND}\n[ -d "$root" ] || exit ${EXIT_NOT_DIRECTORY}\nfind "$root" -mindepth 1 ${maxDepth}${hiddenPrune}-print 2>/dev/null | while IFS= read -r f; do if [ -L "$f" ]; then if [ -d "$f" ]; then t=D; else t=F; fi; printf '%s\\t%s\\t%s\\n' "$t" "$f" "$(readlink "$f")"; elif [ -d "$f" ]; then printf 'd\\t%s\\n' "$f"; else printf 'f\\t%s\\n' "$f"; fi; done`;
+		const result = await this.exec(script);
+		if (result.exitCode === EXIT_NOT_FOUND) throw new DirectoryNotFoundError(path);
+		if (result.exitCode === EXIT_NOT_DIRECTORY) throw new NotDirectoryError(path);
+		if (result.exitCode !== 0) throw new Error(`walk ${path} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+		const entries = [];
+		for (const line of result.stdout.split("\n")) {
+			if (!line) continue;
+			const tab = line.indexOf("	");
+			if (tab < 0) continue;
+			const flag = line.slice(0, tab);
+			const isSymlink = flag === "D" || flag === "F";
+			let fullPath = line.slice(tab + 1);
+			let symlinkTarget;
+			if (isSymlink) {
+				const tab2 = fullPath.lastIndexOf("	");
+				if (tab2 >= 0) {
+					symlinkTarget = fullPath.slice(tab2 + 1) || void 0;
+					fullPath = fullPath.slice(0, tab2);
+				}
+			}
+			const rel = posix.relative(abs, fullPath);
+			if (!rel || rel.startsWith("..")) continue;
+			entries.push({
+				name: posix.basename(rel),
+				type: flag === "d" || flag === "D" ? "directory" : "file",
+				...isSymlink ? {
+					isSymlink: true,
+					...symlinkTarget ? { symlinkTarget } : {}
+				} : {},
+				path: rel
+			});
+		}
+		return entries;
+	}
+	/**
+	* Content search executed inside the sandbox in one command. Prefers
+	* ripgrep (`rg --json`) when installed; otherwise falls back to
+	* `grep -rnE`. Patterns the ERE fallback can't express (PCRE-style classes,
+	* word boundaries, lookarounds, non-greedy quantifiers) throw
+	* {@link UnsupportedGrepPatternError} so callers use their host-side walk.
+	*
+	* Callers are expected to apply their own gitignore/hidden/glob filtering
+	* to the returned paths; both engines run with ignore rules disabled so
+	* results are a superset of what any host-side filter would keep.
+	*/
+	async grep(options) {
+		const abs = await this.resolveAsync(options.path);
+		await this.assertContainedRealpath(abs, options.path);
+		if (await this.hasRipgrep()) return this.grepWithRipgrep(abs, options);
+		return this.grepWithPosixGrep(abs, options);
+	}
+	rgCheck;
+	hasRipgrep() {
+		this.rgCheck ??= this.exec("command -v rg >/dev/null 2>&1").then((r) => r.exitCode === 0, () => false);
+		return this.rgCheck;
+	}
+	async grepWithRipgrep(abs, options) {
+		const args = [
+			"rg --json --no-ignore --hidden",
+			`-g ${shellQuote("!.git/**")}`,
+			options.caseSensitive ? "" : "-i",
+			options.maxCountPerFile !== void 0 ? `-m ${Math.max(1, Math.floor(options.maxCountPerFile))}` : "",
+			options.contextLines ? `-C ${Math.max(0, Math.floor(options.contextLines))}` : "",
+			`-e ${shellQuote(options.pattern)}`,
+			shellQuote(abs)
+		].filter(Boolean).join(" ");
+		const result = await this.exec(args);
+		if (result.exitCode === 1) return [];
+		const results = this.parseRipgrepJson(result.stdout, abs, options);
+		if (result.exitCode !== 0 && results.length === 0) throw new UnsupportedGrepPatternError(options.pattern);
+		return results;
+	}
+	parseRipgrepJson(stdout, abs, options) {
+		const files = /* @__PURE__ */ new Map();
+		for (const line of stdout.split("\n")) {
+			if (!line) continue;
+			let event;
+			try {
+				event = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (event.type !== "match" && event.type !== "context") continue;
+			const filePath = event.data?.path?.text;
+			const lineNumber = event.data?.line_number;
+			if (!filePath || !lineNumber) continue;
+			let state = files.get(filePath);
+			if (!state) {
+				state = {
+					matches: [],
+					linesByNumber: /* @__PURE__ */ new Map()
+				};
+				files.set(filePath, state);
+			}
+			const text = (event.data?.lines?.text ?? "").replace(/\r?\n$/, "");
+			state.linesByNumber.set(lineNumber, text);
+			if (event.type === "match") {
+				const byteStart = event.data?.submatches?.[0]?.start ?? 0;
+				const column = Buffer.from(text, "utf8").subarray(0, byteStart).toString("utf8").length;
+				state.matches.push({
+					line: lineNumber,
+					column,
+					text,
+					lineNumber
+				});
+			}
+		}
+		const contextLines = options.contextLines ?? 0;
+		const results = [];
+		for (const [filePath, state] of files) {
+			if (state.matches.length === 0) continue;
+			const rel = posix.relative(abs, filePath) || posix.basename(filePath);
+			const matches = state.matches.map(({ lineNumber, ...match }) => {
+				if (contextLines <= 0) return match;
+				const before = [];
+				for (let n = lineNumber - 1; n >= Math.max(1, lineNumber - contextLines); n--) {
+					const t = state.linesByNumber.get(n);
+					if (t === void 0) break;
+					before.unshift(t);
+				}
+				const after = [];
+				for (let n = lineNumber + 1; n <= lineNumber + contextLines; n++) {
+					const t = state.linesByNumber.get(n);
+					if (t === void 0) break;
+					after.push(t);
+				}
+				return {
+					...match,
+					before,
+					after
+				};
+			});
+			results.push({
+				path: rel,
+				matches
+			});
+		}
+		return this.applyTotalCap(results, options.maxTotalMatches);
+	}
+	/**
+	* Patterns whose meaning differs between POSIX ERE and JS RegExp. The grep
+	* runs with ERE but match columns are recomputed with JS, so anything that
+	* only one side understands (PCRE classes, lookarounds, lazy quantifiers,
+	* POSIX bracket classes, GNU word anchors) must fall back to the host walk.
+	*/
+	static ERE_UNSUPPORTED = /\\[dDwWsSbB<>]|\(\?|[*+?}]\?|\[:[a-z]+:\]/;
+	async grepWithPosixGrep(abs, options) {
+		if (SandboxFilesystem.ERE_UNSUPPORTED.test(options.pattern)) throw new UnsupportedGrepPatternError(options.pattern);
+		let jsRegex;
+		try {
+			jsRegex = new RegExp(options.pattern, options.caseSensitive ? "" : "i");
+		} catch {
+			throw new UnsupportedGrepPatternError(options.pattern);
+		}
+		if (options.contextLines) throw new UnsupportedGrepPatternError(options.pattern);
+		const args = [
+			"grep -rnIE",
+			options.caseSensitive ? "" : "-i",
+			options.maxCountPerFile !== void 0 ? `-m ${Math.max(1, Math.floor(options.maxCountPerFile))}` : "",
+			"--",
+			shellQuote(options.pattern),
+			shellQuote(abs)
+		].filter(Boolean).join(" ");
+		const result = await this.exec(args);
+		if (result.exitCode === 1) return [];
+		if (result.exitCode !== 0) throw new UnsupportedGrepPatternError(options.pattern);
+		const byFile = /* @__PURE__ */ new Map();
+		for (const line of result.stdout.split("\n")) {
+			if (!line) continue;
+			const parsed = /^(.*?):(\d+):(.*)$/.exec(line);
+			if (!parsed) continue;
+			const rel = posix.relative(abs, parsed[1]) || posix.basename(parsed[1]);
+			const text = parsed[3];
+			const column = jsRegex.exec(text)?.index;
+			if (column === void 0) throw new UnsupportedGrepPatternError(options.pattern);
+			let matches = byFile.get(rel);
+			if (!matches) {
+				matches = [];
+				byFile.set(rel, matches);
+			}
+			matches.push({
+				line: Number(parsed[2]),
+				column,
+				text
+			});
+		}
+		const results = [...byFile.entries()].map(([path, matches]) => ({
+			path,
+			matches
+		}));
+		return this.applyTotalCap(results, options.maxTotalMatches);
+	}
+	applyTotalCap(results, maxTotal) {
+		if (maxTotal === void 0) return results;
+		const capped = [];
+		let total = 0;
+		for (const file of results) {
+			if (total >= maxTotal) break;
+			const remaining = maxTotal - total;
+			const matches = file.matches.slice(0, remaining);
+			total += matches.length;
+			capped.push({
+				path: file.path,
+				matches
+			});
+		}
+		return capped;
+	}
+	async exists(path) {
+		const abs = await this.resolveAsync(path);
+		return (await this.exec(`test -e ${shellQuote(abs)}`)).exitCode === 0;
+	}
+	async stat(path) {
+		const abs = await this.resolveAsync(path);
+		await this.assertContainedRealpath(abs, path);
+		const result = await this.exec(`stat -c '%F|%s|%Y|%W' ${shellQuote(abs)} 2>/dev/null || stat -f '%HT|%z|%m|%B' ${shellQuote(abs)}`);
+		if (result.exitCode !== 0) throw new FileNotFoundError(path);
+		const [kind, sizeStr, mtimeStr, ctimeStr] = result.stdout.trim().split("|");
+		const type = kind && kind.toLowerCase().includes("directory") ? "directory" : "file";
+		const size = Number(sizeStr) || 0;
+		const mtime = Number(mtimeStr) || 0;
+		const ctime = Number(ctimeStr);
+		return {
+			name: posix.basename(abs),
+			path: `/${posix.relative(this.basePath, abs)}`,
+			type,
+			size: type === "directory" ? 0 : size,
+			modifiedAt: /* @__PURE__ */ new Date(mtime * 1e3),
+			createdAt: /* @__PURE__ */ new Date((ctime > 0 ? ctime : mtime) * 1e3)
+		};
+	}
+	async init() {
+		await this.execOk(`mkdir -p ${shellQuote(await this.base())}`, "init workdir");
+	}
+	async destroy() {}
+	async isReady() {
+		return (await this.exec(`test -d ${shellQuote(await this.base())}`)).exitCode === 0;
+	}
+	getInfo() {
+		return {
+			id: this.id,
+			name: this.name,
+			provider: this.provider,
+			status: this.status,
+			metadata: {
+				basePath: this.basePath,
+				sandboxId: this.sandbox.id
+			}
+		};
+	}
+	getInstructions() {
+		return `Files are stored in a remote sandbox at ${this.basePath}. Use absolute workspace paths like /src/index.ts. All reads, writes and commands run inside the same sandbox.`;
+	}
+};
+//#endregion
+export { SandboxFilesystem };
+
+//# sourceMappingURL=sandbox-filesystem.js.map