@mastra/daytona 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,1565 +1,1431 @@
-import { Daytona, SandboxState, DaytonaNotFoundError } from '@daytonaio/sdk';
-import { SandboxProcessManager, MastraSandbox, SandboxNotReadyError, ProcessHandle } from '@mastra/core/workspace';
-import { createHash } from 'crypto';
-
-// src/sandbox/index.ts
-
-// src/utils/compact.ts
+import { Daytona, DaytonaNotFoundError, SandboxState } from "@daytonaio/sdk";
+import { MastraSandbox, ProcessHandle, SandboxNotReadyError, SandboxProcessManager } from "@mastra/core/workspace";
+import { createHash } from "crypto";
+//#region src/utils/compact.ts
+/**
+* Returns a shallow copy of the object with all undefined values removed.
+*/
 function compact(obj) {
-  return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0));
+	return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0));
 }
-
-// src/utils/shell-quote.ts
+//#endregion
+//#region src/utils/shell-quote.ts
+/**
+* Shell-quote a single argument for safe use in a command string.
+*
+* Arguments containing only safe characters are returned as-is.
+* All others are wrapped in single quotes with embedded single quotes escaped.
+*/
 function shellQuote(arg) {
-  if (/^[a-zA-Z0-9._\-/@:=]+$/.test(arg)) return arg;
-  return "'" + arg.replace(/'/g, "'\\''") + "'";
+	if (/^[a-zA-Z0-9._\-/@:=]+$/.test(arg)) return arg;
+	return "'" + arg.replace(/'/g, "'\\''") + "'";
 }
-
-// src/sandbox/mounts/types.ts
-var LOG_PREFIX = "[@mastra/daytona]";
-var SAFE_BUCKET_NAME = /^[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$/;
+//#endregion
+//#region src/sandbox/mounts/types.ts
+const LOG_PREFIX = "[@mastra/daytona]";
+/**
+* Validate a bucket name before interpolating into shell commands.
+* Covers S3, GCS, and S3-compatible (R2, MinIO) naming rules.
+*/
+const SAFE_BUCKET_NAME = /^[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$/;
 function validateBucketName(bucket) {
-  if (!SAFE_BUCKET_NAME.test(bucket)) {
-    throw new Error(
-      `Invalid bucket name: "${bucket}". Bucket names must be 3-63 characters, lowercase alphanumeric, hyphens, or dots.`
-    );
-  }
+	if (!SAFE_BUCKET_NAME.test(bucket)) throw new Error(`Invalid bucket name: "${bucket}". Bucket names must be 3-63 characters, lowercase alphanumeric, hyphens, or dots.`);
 }
+/**
+* Validate an endpoint URL before interpolating into shell commands.
+* Only http and https schemes are allowed.
+*/
 function validateEndpoint(endpoint) {
-  let parsed;
-  try {
-    parsed = new URL(endpoint);
-  } catch {
-    throw new Error(`Invalid endpoint URL: "${endpoint}"`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`Invalid endpoint URL scheme: "${parsed.protocol}". Only http: and https: are allowed.`);
-  }
+	let parsed;
+	try {
+		parsed = new URL(endpoint);
+	} catch {
+		throw new Error(`Invalid endpoint URL: "${endpoint}"`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid endpoint URL scheme: "${parsed.protocol}". Only http: and https: are allowed.`);
 }
+/**
+* Validate and normalize a mount prefix before interpolating into shell commands.
+* Returns the normalized prefix (no leading/trailing slashes).
+*
+* Shell safety is handled by shellQuote() at the call site, so this function
+* only enforces path-level rules (no traversal, no empty result, no control chars).
+*/
 function validatePrefix(prefix) {
-  let normalized = prefix;
-  while (normalized.startsWith("/")) normalized = normalized.slice(1);
-  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
-  if (!normalized) {
-    throw new Error("Mount prefix cannot be empty after normalization.");
-  }
-  if (normalized.includes("//") || normalized.split("/").some((s) => s === "." || s === "..")) {
-    throw new Error(`Invalid mount prefix: "${prefix}". Path traversal is not allowed.`);
-  }
-  if (/[\x00-\x1f\x7f]/.test(normalized)) {
-    throw new Error(`Invalid mount prefix: "${prefix}". Control characters are not allowed.`);
-  }
-  return normalized;
+	let normalized = prefix;
+	while (normalized.startsWith("/")) normalized = normalized.slice(1);
+	while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+	if (!normalized) throw new Error("Mount prefix cannot be empty after normalization.");
+	if (normalized.includes("//") || normalized.split("/").some((s) => s === "." || s === "..")) throw new Error(`Invalid mount prefix: "${prefix}". Path traversal is not allowed.`);
+	if (/[\x00-\x1f\x7f]/.test(normalized)) throw new Error(`Invalid mount prefix: "${prefix}". Control characters are not allowed.`);
+	return normalized;
 }
+/**
+* Run a command in the Daytona sandbox.
+*
+* Thin wrapper around `sandbox.process.executeCommand` that converts timeout
+* from milliseconds to seconds and null-coalesces the output string.
+*
+* Does NOT throw on non-zero exit codes — callers should check `exitCode`.
+*/
 async function runCommand(sandbox, command, options) {
-  const result = await sandbox.process.executeCommand(
-    command,
-    void 0,
-    // cwd
-    void 0,
-    // env
-    options?.timeout !== void 0 ? Math.ceil(options.timeout / 1e3) : void 0
-  );
-  return {
-    exitCode: result.exitCode,
-    output: result.result ?? ""
-  };
+	const result = await sandbox.process.executeCommand(command, void 0, void 0, options?.timeout !== void 0 ? Math.ceil(options.timeout / 1e3) : void 0);
+	return {
+		exitCode: result.exitCode,
+		output: result.result ?? ""
+	};
 }
+//#endregion
+//#region src/sandbox/mounts/s3.ts
+/**
+* Mount an S3 bucket using s3fs-fuse.
+*/
 async function mountS3(mountPath, config, ctx) {
-  const { run, writeFile, logger } = ctx;
-  validateBucketName(config.bucket);
-  if (config.endpoint) {
-    validateEndpoint(config.endpoint);
-  }
-  const quotedMountPath = shellQuote(mountPath);
-  const hasAccessKey = !!config.accessKeyId;
-  const hasSecretKey = !!config.secretAccessKey;
-  if (hasAccessKey !== hasSecretKey) {
-    throw new Error("Both accessKeyId and secretAccessKey must be provided together.");
-  }
-  const hasCredentials = hasAccessKey && hasSecretKey;
-  if (!hasCredentials && config.endpoint) {
-    throw new Error(
-      `S3-compatible storage requires credentials. Detected endpoint: ${config.endpoint}. The public_bucket option only works for AWS S3 public buckets, not R2, MinIO, etc.`
-    );
-  }
-  if (config.endpoint) {
-    const endpoint = config.endpoint.replace(/\/$/, "");
-    const connectivityCheck = await run(`curl -sS --max-time 5 ${shellQuote(endpoint)} 2>&1`, 1e4);
-    const checkOutput = connectivityCheck.stdout.trim();
-    if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) {
-      throw new Error(
-        `Cannot reach ${endpoint} from this sandbox. S3-compatible storage mounting requires network access to the configured endpoint, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction.` + (checkOutput ? `
-
-Sandbox network response: ${checkOutput}` : "")
-      );
-    }
-  }
-  const checkResult = await run('which s3fs 2>/dev/null || echo "not found"', 3e4);
-  if (checkResult.stdout.includes("not found")) {
-    logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`);
-    logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install s3fs in your sandbox image`);
-    await run("sudo apt-get update -qq 2>&1", 6e4);
-    await run("sudo apt-get install -y s3fs fuse 2>&1 || sudo apt-get install -y s3fs-fuse fuse 2>&1 || true", 12e4);
-    const s3fsCheck = await run('which s3fs 2>/dev/null || echo "not found"', 3e4);
-    if (s3fsCheck.stdout.includes("not found")) {
-      throw new Error("Failed to install s3fs: binary not found after install attempt");
-    }
-  }
-  await run("sudo chmod u+s /usr/bin/fusermount3 /usr/bin/fusermount 2>/dev/null || true", 3e4);
-  const idResult = await run("id -u && id -g", 3e4);
-  const [uid, gid] = idResult.stdout.trim().split("\n");
-  const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
-  if (!validUidGid) {
-    logger.warn(
-      `${LOG_PREFIX} Unexpected uid/gid format: "${idResult.stdout.trim()}" \u2014 mounted files will be owned by root`
-    );
-  }
-  const mountHash = createHash("md5").update(mountPath).digest("hex").slice(0, 8);
-  const credentialsPath = `/tmp/.passwd-s3fs-${mountHash}`;
-  await run(
-    `sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q "^user_allow_other" /etc/fuse.conf 2>/dev/null || echo "user_allow_other" >> /etc/fuse.conf' 2>/dev/null || true`
-  );
-  if (hasCredentials) {
-    await run(`sudo rm -f ${shellQuote(credentialsPath)}`, 3e4);
-    await writeFile(credentialsPath, `${config.accessKeyId}:${config.secretAccessKey}`);
-    await run(`chmod 600 ${shellQuote(credentialsPath)}`, 3e4);
-  }
-  const mountOptions = [];
-  if (hasCredentials) {
-    mountOptions.push(`passwd_file=${credentialsPath}`);
-  } else {
-    mountOptions.push("public_bucket=1");
-    logger.debug(`${LOG_PREFIX} No credentials provided, mounting as public bucket (read-only)`);
-  }
-  mountOptions.push("allow_other");
-  if (validUidGid) {
-    mountOptions.push(`uid=${uid}`, `gid=${gid}`);
-  }
-  if (config.endpoint) {
-    const endpoint = config.endpoint.replace(/\/$/, "");
-    mountOptions.push(`url=${shellQuote(endpoint)}`, "use_path_request_style", "sigv4", "nomultipart");
-  }
-  if (config.readOnly) {
-    mountOptions.push("ro");
-    logger.debug(`${LOG_PREFIX} Mounting as read-only`);
-  }
-  let bucketArg = config.bucket;
-  if (config.prefix) {
-    const normalizedPrefix = validatePrefix(config.prefix);
-    bucketArg = `${config.bucket}:/${normalizedPrefix}`;
-  }
-  const mountCmd = `s3fs ${shellQuote(bucketArg)} ${quotedMountPath} -o ${mountOptions.join(" -o ")}`;
-  logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
-  const result = await run(mountCmd, 6e4);
-  logger.debug(`${LOG_PREFIX} s3fs result:`, {
-    exitCode: result.exitCode,
-    stdout: result.stdout,
-    stderr: result.stderr
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(`Failed to mount S3 bucket: ${result.stderr || result.stdout}`);
-  }
+	const { run, writeFile, logger } = ctx;
+	validateBucketName(config.bucket);
+	if (config.endpoint) validateEndpoint(config.endpoint);
+	const quotedMountPath = shellQuote(mountPath);
+	const hasAccessKey = !!config.accessKeyId;
+	const hasSecretKey = !!config.secretAccessKey;
+	if (hasAccessKey !== hasSecretKey) throw new Error("Both accessKeyId and secretAccessKey must be provided together.");
+	const hasCredentials = hasAccessKey && hasSecretKey;
+	if (!hasCredentials && config.endpoint) throw new Error(`S3-compatible storage requires credentials. Detected endpoint: ${config.endpoint}. The public_bucket option only works for AWS S3 public buckets, not R2, MinIO, etc.`);
+	if (config.endpoint) {
+		const endpoint = config.endpoint.replace(/\/$/, "");
+		const connectivityCheck = await run(`curl -sS --max-time 5 ${shellQuote(endpoint)} 2>&1`, 1e4);
+		const checkOutput = connectivityCheck.stdout.trim();
+		if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) throw new Error(`Cannot reach ${endpoint} from this sandbox. S3-compatible storage mounting requires network access to the configured endpoint, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction.` + (checkOutput ? `\n\nSandbox network response: ${checkOutput}` : ""));
+	}
+	if ((await run("which s3fs 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) {
+		logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`);
+		logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install s3fs in your sandbox image`);
+		await run("sudo apt-get update -qq 2>&1", 6e4);
+		await run("sudo apt-get install -y s3fs fuse 2>&1 || sudo apt-get install -y s3fs-fuse fuse 2>&1 || true", 12e4);
+		if ((await run("which s3fs 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) throw new Error("Failed to install s3fs: binary not found after install attempt");
+	}
+	await run("sudo chmod u+s /usr/bin/fusermount3 /usr/bin/fusermount 2>/dev/null || true", 3e4);
+	const idResult = await run("id -u && id -g", 3e4);
+	const [uid, gid] = idResult.stdout.trim().split("\n");
+	const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
+	if (!validUidGid) logger.warn(`${LOG_PREFIX} Unexpected uid/gid format: "${idResult.stdout.trim()}" — mounted files will be owned by root`);
+	const credentialsPath = `/tmp/.passwd-s3fs-${createHash("md5").update(mountPath).digest("hex").slice(0, 8)}`;
+	await run("sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q \"^user_allow_other\" /etc/fuse.conf 2>/dev/null || echo \"user_allow_other\" >> /etc/fuse.conf' 2>/dev/null || true");
+	if (hasCredentials) {
+		await run(`sudo rm -f ${shellQuote(credentialsPath)}`, 3e4);
+		await writeFile(credentialsPath, `${config.accessKeyId}:${config.secretAccessKey}`);
+		await run(`chmod 600 ${shellQuote(credentialsPath)}`, 3e4);
+	}
+	const mountOptions = [];
+	if (hasCredentials) mountOptions.push(`passwd_file=${credentialsPath}`);
+	else {
+		mountOptions.push("public_bucket=1");
+		logger.debug(`${LOG_PREFIX} No credentials provided, mounting as public bucket (read-only)`);
+	}
+	mountOptions.push("allow_other");
+	if (validUidGid) mountOptions.push(`uid=${uid}`, `gid=${gid}`);
+	if (config.endpoint) {
+		const endpoint = config.endpoint.replace(/\/$/, "");
+		mountOptions.push(`url=${shellQuote(endpoint)}`, "use_path_request_style", "sigv4", "nomultipart");
+	}
+	if (config.readOnly) {
+		mountOptions.push("ro");
+		logger.debug(`${LOG_PREFIX} Mounting as read-only`);
+	}
+	let bucketArg = config.bucket;
+	if (config.prefix) {
+		const normalizedPrefix = validatePrefix(config.prefix);
+		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
+	}
+	const mountCmd = `s3fs ${shellQuote(bucketArg)} ${quotedMountPath} -o ${mountOptions.join(" -o ")}`;
+	logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
+	const result = await run(mountCmd, 6e4);
+	logger.debug(`${LOG_PREFIX} s3fs result:`, {
+		exitCode: result.exitCode,
+		stdout: result.stdout,
+		stderr: result.stderr
+	});
+	if (result.exitCode !== 0) throw new Error(`Failed to mount S3 bucket: ${result.stderr || result.stdout}`);
 }
+//#endregion
+//#region src/sandbox/mounts/gcs.ts
+/**
+* Mount a GCS bucket using gcsfuse.
+*/
 async function mountGCS(mountPath, config, ctx) {
-  const { run, writeFile, logger } = ctx;
-  validateBucketName(config.bucket);
-  const quotedMountPath = shellQuote(mountPath);
-  const connectivityCheck = await run("curl -sS --max-time 5 http://storage.googleapis.com 2>&1", 1e4);
-  const checkOutput = connectivityCheck.stdout.trim();
-  if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) {
-    throw new Error(
-      `Cannot reach Google Cloud Storage from this sandbox. GCS mounting requires network access to storage.googleapis.com, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction.` + (checkOutput ? `
-
-Sandbox network response: ${checkOutput}` : "")
-    );
-  }
-  const checkResult = await run('which gcsfuse 2>/dev/null || echo "not found"', 3e4);
-  if (checkResult.stdout.includes("not found")) {
-    logger.warn(`${LOG_PREFIX} gcsfuse not found, attempting runtime installation...`);
-    logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install gcsfuse in your sandbox image`);
-    await run("sudo apt-get update -qq 2>&1", 6e4);
-    const prepResult = await run("sudo apt-get install -y curl gnupg 2>&1", 12e4);
-    if (prepResult.exitCode !== 0) {
-      throw new Error(
-        `Failed to install gcsfuse prerequisites (curl, gnupg): ${prepResult.stderr || prepResult.stdout}`
-      );
-    }
-    const distroIdResult = await run(
-      'cat /etc/os-release 2>/dev/null | grep "^ID=" | cut -d= -f2 || echo debian',
-      3e4
-    );
-    const distroId = distroIdResult.stdout.trim().replace(/"/g, "") || "debian";
-    const fallbackCodename = distroId === "ubuntu" ? "jammy" : "bookworm";
-    const codenameResult = await run(
-      `cat /etc/os-release 2>/dev/null | grep "^VERSION_CODENAME=" | cut -d= -f2 || echo ${fallbackCodename}`,
-      3e4
-    );
-    const detectedCodename = codenameResult.stdout.trim() || fallbackCodename;
-    if (!/^[a-z0-9][a-z0-9-]*$/.test(detectedCodename)) {
-      throw new Error(`Invalid distro codename for gcsfuse repo: "${detectedCodename}"`);
-    }
-    logger.debug(`${LOG_PREFIX} Detected distro: ${distroId}/${detectedCodename}, fallback: ${fallbackCodename}`);
-    const repoSetup = await run(
-      `sudo mkdir -p /etc/apt/keyrings && curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg -o /tmp/gcsfuse-key.gpg && sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/gcsfuse.gpg /tmp/gcsfuse-key.gpg && echo "deb [signed-by=/etc/apt/keyrings/gcsfuse.gpg] https://packages.cloud.google.com/apt gcsfuse-${detectedCodename} main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list`,
-      3e4
-    );
-    if (repoSetup.exitCode !== 0) {
-      throw new Error(`Failed to set up gcsfuse apt repository: ${repoSetup.stderr || repoSetup.stdout}`);
-    }
-    await run("sudo apt-get update -qq 2>&1 || true", 6e4);
-    let installResult = await run("sudo apt-get install -y gcsfuse 2>&1", 12e4);
-    if (installResult.exitCode !== 0 && detectedCodename !== fallbackCodename) {
-      logger.warn(
-        `${LOG_PREFIX} gcsfuse install failed for "${detectedCodename}", retrying with "${fallbackCodename}" fallback`
-      );
-      await run(
-        `sudo rm -f /etc/apt/sources.list.d/gcsfuse.list && echo "deb [signed-by=/etc/apt/keyrings/gcsfuse.gpg] https://packages.cloud.google.com/apt gcsfuse-${fallbackCodename} main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list`,
-        1e4
-      );
-      await run("sudo apt-get update -qq 2>&1 || true", 6e4);
-      installResult = await run("sudo apt-get install -y gcsfuse 2>&1", 12e4);
-    }
-    const verifyResult = await run('which gcsfuse 2>/dev/null || echo "not found"', 3e4);
-    if (verifyResult.stdout.includes("not found")) {
-      throw new Error(`Failed to install gcsfuse: ${installResult.stderr || installResult.stdout}`);
-    }
-    if (installResult.exitCode !== 0) {
-      logger.warn(
-        `${LOG_PREFIX} gcsfuse install reported dpkg errors (likely fuse post-install in container) but binary is present \u2014 proceeding`
-      );
-    }
-  }
-  const idResult = await run("id -u && id -g", 3e4);
-  const [uid, gid] = idResult.stdout.trim().split("\n");
-  const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
-  if (!validUidGid) {
-    logger.warn(
-      `${LOG_PREFIX} Unexpected uid/gid format: "${idResult.stdout.trim()}" \u2014 mounted files will be owned by root`
-    );
-  }
-  const uidGidFlags = validUidGid ? `--uid=${uid} --gid=${gid}` : "";
-  await run(
-    `sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q "^user_allow_other" /etc/fuse.conf 2>/dev/null || echo "user_allow_other" >> /etc/fuse.conf' 2>/dev/null || true`
-  );
-  let onlyDirFlag = "";
-  if (config.prefix) {
-    const normalizedPrefix = validatePrefix(config.prefix);
-    onlyDirFlag = `--only-dir=${shellQuote(normalizedPrefix)} `;
-  }
-  const hasCredentials = !!config.serviceAccountKey;
-  const implicitDirsFlag = "--implicit-dirs";
-  let mountCmd;
-  if (hasCredentials) {
-    const mountHash = createHash("md5").update(mountPath).digest("hex").slice(0, 8);
-    const keyPath = `/tmp/gcs-key-${mountHash}.json`;
-    await run(`sudo rm -f ${shellQuote(keyPath)}`, 3e4);
-    await writeFile(keyPath, config.serviceAccountKey);
-    await run(`chmod 600 ${shellQuote(keyPath)}`, 3e4);
-    mountCmd = `gcsfuse --key-file=${shellQuote(keyPath)} ${implicitDirsFlag} ${onlyDirFlag}-o allow_other ${uidGidFlags} ${shellQuote(config.bucket)} ${quotedMountPath}`;
-  } else {
-    logger.debug(`${LOG_PREFIX} No credentials provided, mounting GCS as public bucket (read-only)`);
-    mountCmd = `gcsfuse --anonymous-access ${implicitDirsFlag} ${onlyDirFlag}-o allow_other ${uidGidFlags} ${shellQuote(config.bucket)} ${quotedMountPath}`;
-  }
-  logger.debug(`${LOG_PREFIX} Mounting GCS:`, mountCmd);
-  const result = await run(mountCmd, 6e4);
-  logger.debug(`${LOG_PREFIX} gcsfuse result:`, {
-    exitCode: result.exitCode,
-    stdout: result.stdout,
-    stderr: result.stderr
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(`Failed to mount GCS bucket: ${result.stderr || result.stdout}`);
-  }
+	const { run, writeFile, logger } = ctx;
+	validateBucketName(config.bucket);
+	const quotedMountPath = shellQuote(mountPath);
+	const connectivityCheck = await run("curl -sS --max-time 5 http://storage.googleapis.com 2>&1", 1e4);
+	const checkOutput = connectivityCheck.stdout.trim();
+	if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) throw new Error("Cannot reach Google Cloud Storage from this sandbox. GCS mounting requires network access to storage.googleapis.com, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction." + (checkOutput ? `\n\nSandbox network response: ${checkOutput}` : ""));
+	if ((await run("which gcsfuse 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) {
+		logger.warn(`${LOG_PREFIX} gcsfuse not found, attempting runtime installation...`);
+		logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install gcsfuse in your sandbox image`);
+		await run("sudo apt-get update -qq 2>&1", 6e4);
+		const prepResult = await run("sudo apt-get install -y curl gnupg 2>&1", 12e4);
+		if (prepResult.exitCode !== 0) throw new Error(`Failed to install gcsfuse prerequisites (curl, gnupg): ${prepResult.stderr || prepResult.stdout}`);
+		const distroId = (await run("cat /etc/os-release 2>/dev/null | grep \"^ID=\" | cut -d= -f2 || echo debian", 3e4)).stdout.trim().replace(/"/g, "") || "debian";
+		const fallbackCodename = distroId === "ubuntu" ? "jammy" : "bookworm";
+		const detectedCodename = (await run(`cat /etc/os-release 2>/dev/null | grep "^VERSION_CODENAME=" | cut -d= -f2 || echo ${fallbackCodename}`, 3e4)).stdout.trim() || fallbackCodename;
+		if (!/^[a-z0-9][a-z0-9-]*$/.test(detectedCodename)) throw new Error(`Invalid distro codename for gcsfuse repo: "${detectedCodename}"`);
+		logger.debug(`${LOG_PREFIX} Detected distro: ${distroId}/${detectedCodename}, fallback: ${fallbackCodename}`);
+		const repoSetup = await run(`sudo mkdir -p /etc/apt/keyrings && curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg -o /tmp/gcsfuse-key.gpg && sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/gcsfuse.gpg /tmp/gcsfuse-key.gpg && echo "deb [signed-by=/etc/apt/keyrings/gcsfuse.gpg] https://packages.cloud.google.com/apt gcsfuse-${detectedCodename} main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list`, 3e4);
+		if (repoSetup.exitCode !== 0) throw new Error(`Failed to set up gcsfuse apt repository: ${repoSetup.stderr || repoSetup.stdout}`);
+		await run("sudo apt-get update -qq 2>&1 || true", 6e4);
+		let installResult = await run("sudo apt-get install -y gcsfuse 2>&1", 12e4);
+		if (installResult.exitCode !== 0 && detectedCodename !== fallbackCodename) {
+			logger.warn(`${LOG_PREFIX} gcsfuse install failed for "${detectedCodename}", retrying with "${fallbackCodename}" fallback`);
+			await run(`sudo rm -f /etc/apt/sources.list.d/gcsfuse.list && echo "deb [signed-by=/etc/apt/keyrings/gcsfuse.gpg] https://packages.cloud.google.com/apt gcsfuse-${fallbackCodename} main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list`, 1e4);
+			await run("sudo apt-get update -qq 2>&1 || true", 6e4);
+			installResult = await run("sudo apt-get install -y gcsfuse 2>&1", 12e4);
+		}
+		if ((await run("which gcsfuse 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) throw new Error(`Failed to install gcsfuse: ${installResult.stderr || installResult.stdout}`);
+		if (installResult.exitCode !== 0) logger.warn(`${LOG_PREFIX} gcsfuse install reported dpkg errors (likely fuse post-install in container) but binary is present — proceeding`);
+	}
+	const idResult = await run("id -u && id -g", 3e4);
+	const [uid, gid] = idResult.stdout.trim().split("\n");
+	const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
+	if (!validUidGid) logger.warn(`${LOG_PREFIX} Unexpected uid/gid format: "${idResult.stdout.trim()}" — mounted files will be owned by root`);
+	const uidGidFlags = validUidGid ? `--uid=${uid} --gid=${gid}` : "";
+	await run("sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q \"^user_allow_other\" /etc/fuse.conf 2>/dev/null || echo \"user_allow_other\" >> /etc/fuse.conf' 2>/dev/null || true");
+	let onlyDirFlag = "";
+	if (config.prefix) onlyDirFlag = `--only-dir=${shellQuote(validatePrefix(config.prefix))} `;
+	const hasCredentials = !!config.serviceAccountKey;
+	const implicitDirsFlag = "--implicit-dirs";
+	let mountCmd;
+	if (hasCredentials) {
+		const keyPath = `/tmp/gcs-key-${createHash("md5").update(mountPath).digest("hex").slice(0, 8)}.json`;
+		await run(`sudo rm -f ${shellQuote(keyPath)}`, 3e4);
+		await writeFile(keyPath, config.serviceAccountKey);
+		await run(`chmod 600 ${shellQuote(keyPath)}`, 3e4);
+		mountCmd = `gcsfuse --key-file=${shellQuote(keyPath)} ${implicitDirsFlag} ${onlyDirFlag}-o allow_other ${uidGidFlags} ${shellQuote(config.bucket)} ${quotedMountPath}`;
+	} else {
+		logger.debug(`${LOG_PREFIX} No credentials provided, mounting GCS as public bucket (read-only)`);
+		mountCmd = `gcsfuse --anonymous-access ${implicitDirsFlag} ${onlyDirFlag}-o allow_other ${uidGidFlags} ${shellQuote(config.bucket)} ${quotedMountPath}`;
+	}
+	logger.debug(`${LOG_PREFIX} Mounting GCS:`, mountCmd);
+	const result = await run(mountCmd, 6e4);
+	logger.debug(`${LOG_PREFIX} gcsfuse result:`, {
+		exitCode: result.exitCode,
+		stdout: result.stdout,
+		stderr: result.stderr
+	});
+	if (result.exitCode !== 0) throw new Error(`Failed to mount GCS bucket: ${result.stderr || result.stdout}`);
 }
-var SAFE_CONTAINER_NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
-var BLOBFUSE2_GITHUB_DEB = "https://github.com/Azure/azure-storage-fuse/releases/download/blobfuse2-2.5.1/blobfuse2-2.5.1-Ubuntu-22.04.x86_64.deb";
+//#endregion
+//#region src/sandbox/mounts/azure.ts
+const SAFE_CONTAINER_NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+const BLOBFUSE2_GITHUB_DEB = "https://github.com/Azure/azure-storage-fuse/releases/download/blobfuse2-2.5.1/blobfuse2-2.5.1-Ubuntu-22.04.x86_64.deb";
 function validateContainerName(name) {
-  if (!SAFE_CONTAINER_NAME.test(name) || name.includes("--")) {
-    throw new Error(
-      `Invalid Azure container name: "${name}". Container names must be 3-63 lowercase alphanumeric characters or hyphens, with no consecutive hyphens.`
-    );
-  }
+	if (!SAFE_CONTAINER_NAME.test(name) || name.includes("--")) throw new Error(`Invalid Azure container name: "${name}". Container names must be 3-63 lowercase alphanumeric characters or hyphens, with no consecutive hyphens.`);
 }
 function parseConnectionString(cs) {
-  const out = {};
-  for (const part of cs.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    const key = part.slice(0, eq).trim();
-    const value = part.slice(eq + 1).trim();
-    if (!value) continue;
-    if (key === "AccountName") out.accountName = value;
-    else if (key === "AccountKey") out.accountKey = value;
-    else if (key === "SharedAccessSignature") out.sasToken = value;
-    else if (key === "BlobEndpoint") out.endpoint = value;
-    else if (key === "EndpointSuffix") out.endpointSuffix = value;
-    else if (key === "DefaultEndpointsProtocol") out.protocol = value;
-  }
-  if (!out.endpoint && out.accountName) {
-    out.endpoint = `${out.protocol || "https"}://${out.accountName}.blob.${out.endpointSuffix || "core.windows.net"}`;
-  }
-  return out;
+	const out = {};
+	for (const part of cs.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		const key = part.slice(0, eq).trim();
+		const value = part.slice(eq + 1).trim();
+		if (!value) continue;
+		if (key === "AccountName") out.accountName = value;
+		else if (key === "AccountKey") out.accountKey = value;
+		else if (key === "SharedAccessSignature") out.sasToken = value;
+		else if (key === "BlobEndpoint") out.endpoint = value;
+		else if (key === "EndpointSuffix") out.endpointSuffix = value;
+		else if (key === "DefaultEndpointsProtocol") out.protocol = value;
+	}
+	if (!out.endpoint && out.accountName) out.endpoint = `${out.protocol || "https"}://${out.accountName}.blob.${out.endpointSuffix || "core.windows.net"}`;
+	return out;
 }
 function yamlString(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
 function parseOsRelease(output) {
-  const values = {};
-  for (const line of output.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq);
-    const value = line.slice(eq + 1).trim().replace(/^"|"$/g, "");
-    values[key] = value;
-  }
-  return values;
+	const values = {};
+	for (const line of output.split("\n")) {
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq);
+		values[key] = line.slice(eq + 1).trim().replace(/^"|"$/g, "");
+	}
+	return values;
 }
 function resolveMicrosoftAptRepos(osReleaseOutput) {
-  const osRelease = parseOsRelease(osReleaseOutput);
-  const distroId = osRelease.ID || "ubuntu";
-  const codename = osRelease.VERSION_CODENAME || (distroId === "debian" ? "bookworm" : "jammy");
-  const versionId = osRelease.VERSION_ID || (distroId === "debian" ? "12" : "22.04");
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(codename)) {
-    throw new Error(`Invalid distro codename for blobfuse2 repo: "${codename}"`);
-  }
-  if (!/^\d+(?:\.\d+)?$/.test(versionId)) {
-    throw new Error(`Invalid distro version for blobfuse2 repo: "${versionId}"`);
-  }
-  if (distroId === "debian") {
-    const repos = [
-      { repoUrl: `https://packages.microsoft.com/debian/${versionId.split(".")[0]}/prod`, suite: codename }
-    ];
-    if (versionId.split(".")[0] !== "12" || codename !== "bookworm") {
-      repos.push({ repoUrl: "https://packages.microsoft.com/debian/12/prod", suite: "bookworm" });
-    }
-    return repos;
-  }
-  if (distroId === "ubuntu") {
-    const repos = [{ repoUrl: `https://packages.microsoft.com/ubuntu/${versionId}/prod`, suite: codename }];
-    if (versionId !== "24.04" || codename !== "noble") {
-      repos.push({ repoUrl: "https://packages.microsoft.com/ubuntu/24.04/prod", suite: "noble" });
-    }
-    if (versionId !== "22.04" || codename !== "jammy") {
-      repos.push({ repoUrl: "https://packages.microsoft.com/ubuntu/22.04/prod", suite: "jammy" });
-    }
-    return repos;
-  }
-  throw new Error(`Unsupported distro for blobfuse2 runtime installation: "${distroId}"`);
+	const osRelease = parseOsRelease(osReleaseOutput);
+	const distroId = osRelease.ID || "ubuntu";
+	const codename = osRelease.VERSION_CODENAME || (distroId === "debian" ? "bookworm" : "jammy");
+	const versionId = osRelease.VERSION_ID || (distroId === "debian" ? "12" : "22.04");
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(codename)) throw new Error(`Invalid distro codename for blobfuse2 repo: "${codename}"`);
+	if (!/^\d+(?:\.\d+)?$/.test(versionId)) throw new Error(`Invalid distro version for blobfuse2 repo: "${versionId}"`);
+	if (distroId === "debian") {
+		const repos = [{
+			repoUrl: `https://packages.microsoft.com/debian/${versionId.split(".")[0]}/prod`,
+			suite: codename
+		}];
+		if (versionId.split(".")[0] !== "12" || codename !== "bookworm") repos.push({
+			repoUrl: "https://packages.microsoft.com/debian/12/prod",
+			suite: "bookworm"
+		});
+		return repos;
+	}
+	if (distroId === "ubuntu") {
+		const repos = [{
+			repoUrl: `https://packages.microsoft.com/ubuntu/${versionId}/prod`,
+			suite: codename
+		}];
+		if (versionId !== "24.04" || codename !== "noble") repos.push({
+			repoUrl: "https://packages.microsoft.com/ubuntu/24.04/prod",
+			suite: "noble"
+		});
+		if (versionId !== "22.04" || codename !== "jammy") repos.push({
+			repoUrl: "https://packages.microsoft.com/ubuntu/22.04/prod",
+			suite: "jammy"
+		});
+		return repos;
+	}
+	throw new Error(`Unsupported distro for blobfuse2 runtime installation: "${distroId}"`);
 }
 function resolveAuth(config) {
-  let accountName = config.accountName;
-  let accountKey = config.accountKey;
-  let sasToken = config.sasToken;
-  let endpoint = config.endpoint;
-  if (config.connectionString) {
-    const parsed = parseConnectionString(config.connectionString);
-    accountName = accountName ?? parsed.accountName;
-    accountKey = accountKey ?? parsed.accountKey;
-    sasToken = sasToken ?? parsed.sasToken;
-    endpoint = endpoint ?? parsed.endpoint;
-  }
-  let mode;
-  if (config.useDefaultCredential) {
-    mode = "msi";
-  } else if (sasToken) {
-    mode = "sas";
-  } else if (accountKey) {
-    mode = "key";
-  } else {
-    throw new Error(
-      "Azure Blob mount requires credentials: provide connectionString, accountKey + accountName, sasToken + accountName, or useDefaultCredential."
-    );
-  }
-  if (!accountName) {
-    throw new Error("Azure Blob mount requires an accountName (either explicitly or via connectionString).");
-  }
-  if (endpoint) {
-    validateEndpoint(endpoint);
-  }
-  return { mode, accountName, accountKey, sasToken, endpoint };
+	let accountName = config.accountName;
+	let accountKey = config.accountKey;
+	let sasToken = config.sasToken;
+	let endpoint = config.endpoint;
+	if (config.connectionString) {
+		const parsed = parseConnectionString(config.connectionString);
+		accountName = accountName ?? parsed.accountName;
+		accountKey = accountKey ?? parsed.accountKey;
+		sasToken = sasToken ?? parsed.sasToken;
+		endpoint = endpoint ?? parsed.endpoint;
+	}
+	let mode;
+	if (config.useDefaultCredential) mode = "msi";
+	else if (sasToken) mode = "sas";
+	else if (accountKey) mode = "key";
+	else throw new Error("Azure Blob mount requires credentials: provide connectionString, accountKey + accountName, sasToken + accountName, or useDefaultCredential.");
+	if (!accountName) throw new Error("Azure Blob mount requires an accountName (either explicitly or via connectionString).");
+	if (endpoint) validateEndpoint(endpoint);
+	return {
+		mode,
+		accountName,
+		accountKey,
+		sasToken,
+		endpoint
+	};
 }
 function buildBlobfuseConfig(container, auth, cachePath, readOnly) {
-  const lines = [
-    "allow-other: true",
-    "foreground: false",
-    `read-only: ${readOnly ? "true" : "false"}`,
-    "logging:",
-    "  type: silent",
-    "components:",
-    "  - libfuse",
-    "  - file_cache",
-    "  - attr_cache",
-    "  - azstorage",
-    "libfuse:",
-    "  attribute-expiration-sec: 240",
-    "  entry-expiration-sec: 240",
-    "  negative-entry-expiration-sec: 120",
-    "file_cache:",
-    `  path: ${yamlString(cachePath)}`,
-    "  timeout-sec: 120",
-    "attr_cache:",
-    "  timeout-sec: 7200",
-    "azstorage:",
-    `  mode: ${auth.mode}`,
-    `  account-name: ${yamlString(auth.accountName)}`,
-    `  container: ${yamlString(container)}`
-  ];
-  if (auth.mode === "key" && auth.accountKey) {
-    lines.push(`  account-key: ${yamlString(auth.accountKey)}`);
-  } else if (auth.mode === "sas" && auth.sasToken) {
-    lines.push(`  sas: ${yamlString(auth.sasToken)}`);
-  }
-  if (auth.endpoint) {
-    lines.push(`  endpoint: ${yamlString(auth.endpoint.replace(/\/$/, ""))}`);
-  }
-  return lines.join("\n") + "\n";
+	const lines = [
+		"allow-other: true",
+		"foreground: false",
+		`read-only: ${readOnly ? "true" : "false"}`,
+		"logging:",
+		"  type: silent",
+		"components:",
+		"  - libfuse",
+		"  - file_cache",
+		"  - attr_cache",
+		"  - azstorage",
+		"libfuse:",
+		"  attribute-expiration-sec: 240",
+		"  entry-expiration-sec: 240",
+		"  negative-entry-expiration-sec: 120",
+		"file_cache:",
+		`  path: ${yamlString(cachePath)}`,
+		"  timeout-sec: 120",
+		"attr_cache:",
+		"  timeout-sec: 7200",
+		"azstorage:",
+		`  mode: ${auth.mode}`,
+		`  account-name: ${yamlString(auth.accountName)}`,
+		`  container: ${yamlString(container)}`
+	];
+	if (auth.mode === "key" && auth.accountKey) lines.push(`  account-key: ${yamlString(auth.accountKey)}`);
+	else if (auth.mode === "sas" && auth.sasToken) lines.push(`  sas: ${yamlString(auth.sasToken)}`);
+	if (auth.endpoint) lines.push(`  endpoint: ${yamlString(auth.endpoint.replace(/\/$/, ""))}`);
+	return lines.join("\n") + "\n";
 }
+/**
+* Mount an Azure Blob container using blobfuse2.
+*/
 async function mountAzure(mountPath, config, ctx) {
-  const { run, writeFile, logger } = ctx;
-  validateContainerName(config.container);
-  const auth = resolveAuth(config);
-  const prefix = config.prefix ? validatePrefix(config.prefix) : void 0;
-  const quotedMountPath = shellQuote(mountPath);
-  const curlCheck = await run('which curl 2>/dev/null || echo "not found"', 3e4);
-  if (curlCheck.stdout.includes("not found")) {
-    const curlInstall = await run("sudo apt-get update -qq 2>&1 && sudo apt-get install -y curl 2>&1", 12e4);
-    if (curlInstall.exitCode !== 0) {
-      throw new Error(
-        `Failed to install curl for Azure Blob reachability check: ${curlInstall.stderr || curlInstall.stdout}`
-      );
-    }
-  }
-  const probeUrl = auth.endpoint ? auth.endpoint.replace(/\/$/, "") : `https://${auth.accountName}.blob.core.windows.net`;
-  const connectivityCheck = await run(`curl -sS --max-time 5 ${shellQuote(probeUrl)} 2>&1`, 1e4);
-  const checkOutput = connectivityCheck.stdout.trim();
-  if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) {
-    throw new Error(
-      `Cannot reach ${probeUrl} from this sandbox. Azure Blob mounting requires network access to the storage endpoint, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction.` + (checkOutput ? `
-
-Sandbox network response: ${checkOutput}` : "")
-    );
-  }
-  const checkResult = await run('which blobfuse2 2>/dev/null || echo "not found"', 3e4);
-  if (checkResult.stdout.includes("not found")) {
-    logger.warn(`${LOG_PREFIX} blobfuse2 not found, attempting runtime installation...`);
-    logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install blobfuse2 in your sandbox image`);
-    await run("sudo apt-get update -qq 2>&1", 6e4);
-    const prepResult = await run("sudo apt-get install -y curl gnupg 2>&1", 12e4);
-    if (prepResult.exitCode !== 0) {
-      throw new Error(
-        `Failed to install blobfuse2 prerequisites (curl, gnupg): ${prepResult.stderr || prepResult.stdout}`
-      );
-    }
-    const osReleaseResult = await run("cat /etc/os-release 2>/dev/null || true", 3e4);
-    const repos = resolveMicrosoftAptRepos(osReleaseResult.stdout);
-    const repoSetup = await run(
-      "sudo mkdir -p /etc/apt/keyrings && curl --retry 3 --retry-all-errors --retry-delay 2 -fsSL https://packages.microsoft.com/keys/microsoft.asc -o /tmp/ms-key.asc && sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/microsoft.gpg /tmp/ms-key.asc",
-      3e4
-    );
-    let installResult;
-    if (repoSetup.exitCode === 0) {
-      for (const { repoUrl, suite } of repos) {
-        await run(
-          `echo "deb [signed-by=/etc/apt/keyrings/microsoft.gpg] ${repoUrl} ${suite} main" | sudo tee /etc/apt/sources.list.d/microsoft-prod.list`,
-          3e4
-        );
-        await run("sudo apt-get update -qq 2>&1 || true", 6e4);
-        installResult = await run("sudo apt-get install -y blobfuse2 fuse3 2>&1", 12e4);
-        if (installResult.exitCode === 0) break;
-        logger.warn(`${LOG_PREFIX} blobfuse2 install failed for ${repoUrl} ${suite}, trying fallback if available`);
-      }
-    } else {
-      logger.warn(`${LOG_PREFIX} Failed to set up Microsoft apt repository, trying GitHub release fallback`);
-    }
-    let verifyResult = await run("which blobfuse2 && blobfuse2 --version", 3e4);
-    if (verifyResult.exitCode !== 0) {
-      installResult = await run(
-        `sudo apt-get update -qq 2>&1 || true && sudo apt-get install -y fuse3 ca-certificates curl 2>&1 && curl -L --retry 3 --retry-all-errors --retry-delay 2 -fSLo /tmp/blobfuse2.deb ${BLOBFUSE2_GITHUB_DEB} && sudo dpkg -i /tmp/blobfuse2.deb 2>&1 && sudo bash -c 'lib=$(find /usr/lib -name "libfuse3.so.3.*" | head -1); [ -z "$lib" ] || ln -sf "$lib" /usr/lib/x86_64-linux-gnu/libfuse3.so.3'`,
-        18e4
-      );
-      verifyResult = await run("which blobfuse2 && blobfuse2 --version", 3e4);
-    }
-    if (!installResult || verifyResult.exitCode !== 0) {
-      throw new Error(
-        `Failed to install blobfuse2: ${verifyResult.stderr || verifyResult.stdout || installResult?.stderr || installResult?.stdout || "unknown error"}`
-      );
-    }
-  }
-  const idResult = await run("id -u && id -g", 3e4);
-  const [uid, gid] = idResult.stdout.trim().split("\n");
-  const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
-  await run(
-    `sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q "^user_allow_other" /etc/fuse.conf 2>/dev/null || echo "user_allow_other" >> /etc/fuse.conf' 2>/dev/null || true`
-  );
-  const mountHash = createHash("md5").update(mountPath).digest("hex").slice(0, 8);
-  const configPath = `/tmp/.blobfuse2-config-${mountHash}.yaml`;
-  const cachePath = `/tmp/blobfuse2-cache-${mountHash}`;
-  const yaml = buildBlobfuseConfig(config.container, auth, cachePath, !!config.readOnly);
-  await run(`sudo rm -f ${shellQuote(configPath)}`, 3e4);
-  await writeFile(configPath, yaml);
-  await run(`chmod 600 ${shellQuote(configPath)}`, 3e4);
-  await run(`sudo rm -rf ${shellQuote(cachePath)} && mkdir -p ${shellQuote(cachePath)}`, 3e4);
-  if (validUidGid) {
-    await run(`sudo chown ${uid}:${gid} ${shellQuote(cachePath)} 2>/dev/null || true`, 3e4);
-  }
-  const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote(prefix)}` : "";
-  const mountCmd = `blobfuse2 mount ${quotedMountPath} --config-file=${shellQuote(configPath)}${prefixFlags}`;
-  logger.debug(`${LOG_PREFIX} Mounting Azure Blob:`, mountCmd);
-  const result = await run(mountCmd, 6e4);
-  logger.debug(`${LOG_PREFIX} blobfuse2 result:`, {
-    exitCode: result.exitCode,
-    stdout: result.stdout,
-    stderr: result.stderr
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(`Failed to mount Azure Blob container: ${result.stderr || result.stdout}`);
-  }
+	const { run, writeFile, logger } = ctx;
+	validateContainerName(config.container);
+	const auth = resolveAuth(config);
+	const prefix = config.prefix ? validatePrefix(config.prefix) : void 0;
+	const quotedMountPath = shellQuote(mountPath);
+	if ((await run("which curl 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) {
+		const curlInstall = await run("sudo apt-get update -qq 2>&1 && sudo apt-get install -y curl 2>&1", 12e4);
+		if (curlInstall.exitCode !== 0) throw new Error(`Failed to install curl for Azure Blob reachability check: ${curlInstall.stderr || curlInstall.stdout}`);
+	}
+	const probeUrl = auth.endpoint ? auth.endpoint.replace(/\/$/, "") : `https://${auth.accountName}.blob.core.windows.net`;
+	const connectivityCheck = await run(`curl -sS --max-time 5 ${shellQuote(probeUrl)} 2>&1`, 1e4);
+	const checkOutput = connectivityCheck.stdout.trim();
+	if (connectivityCheck.exitCode !== 0 || checkOutput.toLowerCase().includes("restricted") || checkOutput.toLowerCase().includes("blocked")) throw new Error(`Cannot reach ${probeUrl} from this sandbox. Azure Blob mounting requires network access to the storage endpoint, which may be blocked on Daytona's restricted tiers. Upgrade to a tier with unrestricted internet access, or contact Daytona support to remove the network restriction.` + (checkOutput ? `\n\nSandbox network response: ${checkOutput}` : ""));
+	if ((await run("which blobfuse2 2>/dev/null || echo \"not found\"", 3e4)).stdout.includes("not found")) {
+		logger.warn(`${LOG_PREFIX} blobfuse2 not found, attempting runtime installation...`);
+		logger.info(`${LOG_PREFIX} Tip: For faster startup, pre-install blobfuse2 in your sandbox image`);
+		await run("sudo apt-get update -qq 2>&1", 6e4);
+		const prepResult = await run("sudo apt-get install -y curl gnupg 2>&1", 12e4);
+		if (prepResult.exitCode !== 0) throw new Error(`Failed to install blobfuse2 prerequisites (curl, gnupg): ${prepResult.stderr || prepResult.stdout}`);
+		const repos = resolveMicrosoftAptRepos((await run("cat /etc/os-release 2>/dev/null || true", 3e4)).stdout);
+		const repoSetup = await run("sudo mkdir -p /etc/apt/keyrings && curl --retry 3 --retry-all-errors --retry-delay 2 -fsSL https://packages.microsoft.com/keys/microsoft.asc -o /tmp/ms-key.asc && sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/microsoft.gpg /tmp/ms-key.asc", 3e4);
+		let installResult;
+		if (repoSetup.exitCode === 0) for (const { repoUrl, suite } of repos) {
+			await run(`echo "deb [signed-by=/etc/apt/keyrings/microsoft.gpg] ${repoUrl} ${suite} main" | sudo tee /etc/apt/sources.list.d/microsoft-prod.list`, 3e4);
+			await run("sudo apt-get update -qq 2>&1 || true", 6e4);
+			installResult = await run("sudo apt-get install -y blobfuse2 fuse3 2>&1", 12e4);
+			if (installResult.exitCode === 0) break;
+			logger.warn(`${LOG_PREFIX} blobfuse2 install failed for ${repoUrl} ${suite}, trying fallback if available`);
+		}
+		else logger.warn(`${LOG_PREFIX} Failed to set up Microsoft apt repository, trying GitHub release fallback`);
+		let verifyResult = await run("which blobfuse2 && blobfuse2 --version", 3e4);
+		if (verifyResult.exitCode !== 0) {
+			installResult = await run(`sudo apt-get update -qq 2>&1 || true && sudo apt-get install -y fuse3 ca-certificates curl 2>&1 && curl -L --retry 3 --retry-all-errors --retry-delay 2 -fSLo /tmp/blobfuse2.deb ${BLOBFUSE2_GITHUB_DEB} && sudo dpkg -i /tmp/blobfuse2.deb 2>&1 && sudo bash -c 'lib=\$(find /usr/lib -name "libfuse3.so.3.*" | head -1); [ -z "\$lib" ] || ln -sf "\$lib" /usr/lib/x86_64-linux-gnu/libfuse3.so.3'`, 18e4);
+			verifyResult = await run("which blobfuse2 && blobfuse2 --version", 3e4);
+		}
+		if (!installResult || verifyResult.exitCode !== 0) throw new Error(`Failed to install blobfuse2: ${verifyResult.stderr || verifyResult.stdout || installResult?.stderr || installResult?.stdout || "unknown error"}`);
+	}
+	const [uid, gid] = (await run("id -u && id -g", 3e4)).stdout.trim().split("\n");
+	const validUidGid = uid && gid && /^\d+$/.test(uid) && /^\d+$/.test(gid);
+	await run("sudo chmod a+rw /dev/fuse 2>/dev/null || true; sudo bash -c 'grep -q \"^user_allow_other\" /etc/fuse.conf 2>/dev/null || echo \"user_allow_other\" >> /etc/fuse.conf' 2>/dev/null || true");
+	const mountHash = createHash("md5").update(mountPath).digest("hex").slice(0, 8);
+	const configPath = `/tmp/.blobfuse2-config-${mountHash}.yaml`;
+	const cachePath = `/tmp/blobfuse2-cache-${mountHash}`;
+	const yaml = buildBlobfuseConfig(config.container, auth, cachePath, !!config.readOnly);
+	await run(`sudo rm -f ${shellQuote(configPath)}`, 3e4);
+	await writeFile(configPath, yaml);
+	await run(`chmod 600 ${shellQuote(configPath)}`, 3e4);
+	await run(`sudo rm -rf ${shellQuote(cachePath)} && mkdir -p ${shellQuote(cachePath)}`, 3e4);
+	if (validUidGid) await run(`sudo chown ${uid}:${gid} ${shellQuote(cachePath)} 2>/dev/null || true`, 3e4);
+	const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote(prefix)}` : "";
+	const mountCmd = `blobfuse2 mount ${quotedMountPath} --config-file=${shellQuote(configPath)}${prefixFlags}`;
+	logger.debug(`${LOG_PREFIX} Mounting Azure Blob:`, mountCmd);
+	const result = await run(mountCmd, 6e4);
+	logger.debug(`${LOG_PREFIX} blobfuse2 result:`, {
+		exitCode: result.exitCode,
+		stdout: result.stdout,
+		stderr: result.stderr
+	});
+	if (result.exitCode !== 0) throw new Error(`Failed to mount Azure Blob container: ${result.stderr || result.stdout}`);
 }
+//#endregion
+//#region src/sandbox/process-manager.ts
+/**
+* Wraps a Daytona session + command pair to conform to Mastra's ProcessHandle.
+* Not exported — internal to this module.
+*/
 var DaytonaProcessHandle = class extends ProcessHandle {
-  pid;
-  _cmdId;
-  _sandbox;
-  _startTime;
-  _timeout;
-  _exitCode;
-  _waitPromise = null;
-  _streamingPromise = null;
-  _killed = false;
-  constructor(sessionId, cmdId, sandbox, startTime, options) {
-    super(options);
-    this.pid = sessionId;
-    this._cmdId = cmdId;
-    this._sandbox = sandbox;
-    this._startTime = startTime;
-    this._timeout = options?.timeout;
-  }
-  get exitCode() {
-    return this._exitCode;
-  }
-  /** @internal Set by the process manager after streaming starts. */
-  set streamingPromise(p) {
-    this._streamingPromise = p;
-    p.then(() => this._resolveExitCode()).catch(() => this._resolveExitCode());
-  }
-  /** Fetch the exit code from Daytona and set _exitCode. No-op if already set. */
-  async _resolveExitCode() {
-    if (this._exitCode !== void 0) return;
-    try {
-      const cmd = await this._sandbox.process.getSessionCommand(this.pid, this._cmdId);
-      this._exitCode = cmd.exitCode ?? 0;
-    } catch {
-      if (this._exitCode === void 0) {
-        this._exitCode = 1;
-      }
-    }
-  }
-  async wait() {
-    if (!this._waitPromise) {
-      this._waitPromise = this._doWait();
-    }
-    return this._waitPromise;
-  }
-  async _doWait() {
-    const streamDone = this._streamingPromise ?? Promise.resolve();
-    if (this._timeout) {
-      let timeoutId;
-      const timeoutPromise = new Promise((_, reject) => {
-        timeoutId = setTimeout(() => reject(new Error(`Command timed out after ${this._timeout}ms`)), this._timeout);
-      });
-      try {
-        await Promise.race([streamDone, timeoutPromise]);
-      } catch (error) {
-        if (error instanceof Error && error.message.includes("timed out")) {
-          await this.kill();
-          this._exitCode = 124;
-          return {
-            success: false,
-            exitCode: 124,
-            stdout: this.stdout,
-            stderr: this.stderr || error.message,
-            executionTimeMs: Date.now() - this._startTime,
-            killed: true,
-            timedOut: true
-          };
-        }
-        throw error;
-      } finally {
-        clearTimeout(timeoutId);
-      }
-    } else {
-      await streamDone.catch(() => {
-      });
-    }
-    if (this._killed) {
-      return {
-        success: false,
-        exitCode: this._exitCode ?? 137,
-        stdout: this.stdout,
-        stderr: this.stderr,
-        executionTimeMs: Date.now() - this._startTime,
-        killed: true,
-        timedOut: false
-      };
-    }
-    await this._resolveExitCode();
-    return {
-      success: this._exitCode === 0,
-      exitCode: this._exitCode ?? 1,
-      stdout: this.stdout,
-      stderr: this.stderr,
-      executionTimeMs: Date.now() - this._startTime
-    };
-  }
-  async kill() {
-    if (this._exitCode !== void 0) return false;
-    this._killed = true;
-    this._exitCode = 137;
-    try {
-      await this._sandbox.process.deleteSession(this.pid);
-    } catch {
-    }
-    return true;
-  }
-  async sendStdin(data) {
-    if (this._exitCode !== void 0) {
-      throw new Error(`Process ${this.pid} has already exited with code ${this._exitCode}`);
-    }
-    await this._sandbox.process.sendSessionCommandInput(this.pid, this._cmdId, data);
-  }
+	pid;
+	_cmdId;
+	_sandbox;
+	_startTime;
+	_timeout;
+	_exitCode;
+	_waitPromise = null;
+	_streamingPromise = null;
+	_killed = false;
+	constructor(sessionId, cmdId, sandbox, startTime, options) {
+		super(options);
+		this.pid = sessionId;
+		this._cmdId = cmdId;
+		this._sandbox = sandbox;
+		this._startTime = startTime;
+		this._timeout = options?.timeout;
+	}
+	get exitCode() {
+		return this._exitCode;
+	}
+	/** @internal Set by the process manager after streaming starts. */
+	set streamingPromise(p) {
+		this._streamingPromise = p;
+		p.then(() => this._resolveExitCode()).catch(() => this._resolveExitCode());
+	}
+	/** Fetch the exit code from Daytona and set _exitCode. No-op if already set. */
+	async _resolveExitCode() {
+		if (this._exitCode !== void 0) return;
+		try {
+			const cmd = await this._sandbox.process.getSessionCommand(this.pid, this._cmdId);
+			this._exitCode = cmd.exitCode ?? 0;
+		} catch {
+			if (this._exitCode === void 0) this._exitCode = 1;
+		}
+	}
+	async wait() {
+		if (!this._waitPromise) this._waitPromise = this._doWait();
+		return this._waitPromise;
+	}
+	async _doWait() {
+		const streamDone = this._streamingPromise ?? Promise.resolve();
+		if (this._timeout) {
+			let timeoutId;
+			const timeoutPromise = new Promise((_, reject) => {
+				timeoutId = setTimeout(() => reject(/* @__PURE__ */ new Error(`Command timed out after ${this._timeout}ms`)), this._timeout);
+			});
+			try {
+				await Promise.race([streamDone, timeoutPromise]);
+			} catch (error) {
+				if (error instanceof Error && error.message.includes("timed out")) {
+					await this.kill();
+					this._exitCode = 124;
+					return {
+						success: false,
+						exitCode: 124,
+						stdout: this.stdout,
+						stderr: this.stderr || error.message,
+						executionTimeMs: Date.now() - this._startTime,
+						killed: true,
+						timedOut: true
+					};
+				}
+				throw error;
+			} finally {
+				clearTimeout(timeoutId);
+			}
+		} else await streamDone.catch(() => {});
+		if (this._killed) return {
+			success: false,
+			exitCode: this._exitCode ?? 137,
+			stdout: this.stdout,
+			stderr: this.stderr,
+			executionTimeMs: Date.now() - this._startTime,
+			killed: true,
+			timedOut: false
+		};
+		await this._resolveExitCode();
+		return {
+			success: this._exitCode === 0,
+			exitCode: this._exitCode ?? 1,
+			stdout: this.stdout,
+			stderr: this.stderr,
+			executionTimeMs: Date.now() - this._startTime
+		};
+	}
+	async kill() {
+		if (this._exitCode !== void 0) return false;
+		this._killed = true;
+		this._exitCode = 137;
+		try {
+			await this._sandbox.process.deleteSession(this.pid);
+		} catch {}
+		return true;
+	}
+	async sendStdin(data) {
+		if (this._exitCode !== void 0) throw new Error(`Process ${this.pid} has already exited with code ${this._exitCode}`);
+		await this._sandbox.process.sendSessionCommandInput(this.pid, this._cmdId, data);
+	}
 };
+/**
+* Daytona implementation of SandboxProcessManager.
+* Uses the Daytona SDK's session API with one session per spawned process.
+*/
 var DaytonaProcessManager = class extends SandboxProcessManager {
-  _spawnCounter = 0;
-  _defaultTimeout;
-  constructor(opts = {}) {
-    super({ env: opts.env });
-    this._defaultTimeout = opts.defaultTimeout;
-  }
-  async spawn(command, options = {}) {
-    const effectiveOptions = {
-      ...options,
-      timeout: options.timeout ?? this._defaultTimeout,
-      cwd: options.cwd ?? this.sandbox.mounts?.entries?.keys().next().value
-    };
-    const mergedEnv = { ...this.env, ...effectiveOptions.env };
-    const envs = Object.fromEntries(
-      Object.entries(mergedEnv).filter((entry) => entry[1] !== void 0)
-    );
-    const sessionCommand = buildSpawnCommand(command, effectiveOptions.cwd, envs);
-    return this.sandbox.retryOnDead(async () => {
-      const sandbox = this.sandbox.daytona;
-      const sessionId = `mastra-proc-${Date.now().toString(36)}-${++this._spawnCounter}`;
-      await sandbox.process.createSession(sessionId);
-      const { cmdId } = await sandbox.process.executeSessionCommand(sessionId, {
-        command: sessionCommand,
-        runAsync: true
-      });
-      const handle = new DaytonaProcessHandle(sessionId, cmdId, sandbox, Date.now(), effectiveOptions);
-      const streamingPromise = sandbox.process.getSessionCommandLogs(
-        sessionId,
-        cmdId,
-        (chunk) => handle.emitStdout(chunk),
-        (chunk) => handle.emitStderr(chunk)
-      ).catch(() => {
-      });
-      handle.streamingPromise = streamingPromise;
-      this._tracked.set(handle.pid, handle);
-      return handle;
-    });
-  }
-  async list() {
-    const result = [];
-    for (const [pid, handle] of this._tracked) {
-      result.push({
-        pid,
-        command: handle.command,
-        running: handle.exitCode === void 0,
-        exitCode: handle.exitCode
-      });
-    }
-    return result;
-  }
+	_spawnCounter = 0;
+	_defaultTimeout;
+	constructor(opts = {}) {
+		super({ env: opts.env });
+		this._defaultTimeout = opts.defaultTimeout;
+	}
+	async spawn(command, options = {}) {
+		const effectiveOptions = {
+			...options,
+			timeout: options.timeout ?? this._defaultTimeout,
+			cwd: options.cwd ?? this.sandbox.mounts?.entries?.keys().next().value
+		};
+		const mergedEnv = {
+			...this.env,
+			...effectiveOptions.env
+		};
+		const envs = Object.fromEntries(Object.entries(mergedEnv).filter((entry) => entry[1] !== void 0));
+		const sessionCommand = buildSpawnCommand(command, effectiveOptions.cwd, envs);
+		return this.sandbox.retryOnDead(async () => {
+			const sandbox = this.sandbox.daytona;
+			const sessionId = `mastra-proc-${Date.now().toString(36)}-${++this._spawnCounter}`;
+			await sandbox.process.createSession(sessionId);
+			const { cmdId } = await sandbox.process.executeSessionCommand(sessionId, {
+				command: sessionCommand,
+				runAsync: true
+			});
+			const handle = new DaytonaProcessHandle(sessionId, cmdId, sandbox, Date.now(), effectiveOptions);
+			handle.streamingPromise = sandbox.process.getSessionCommandLogs(sessionId, cmdId, (chunk) => handle.emitStdout(chunk), (chunk) => handle.emitStderr(chunk)).catch(() => {});
+			this._tracked.set(handle.pid, handle);
+			return handle;
+		});
+	}
+	async list() {
+		const result = [];
+		for (const [pid, handle] of this._tracked) result.push({
+			pid,
+			command: handle.command,
+			running: handle.exitCode === void 0,
+			exitCode: handle.exitCode
+		});
+		return result;
+	}
 };
-var SHELL_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SHELL_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Build a shell command string that bakes in cwd and env vars.
+* Wraps the user command in a subshell `(command)` so that:
+* - `exit N` exits the subshell, not the session shell
+* - Heredocs work correctly within the subshell
+*
+* @example
+* buildSpawnCommand('npm test', '/app', { NODE_ENV: 'test' })
+* // → "export NODE_ENV='test' && cd '/app' && (npm test)"
+*/
 function buildSpawnCommand(command, cwd, envs) {
-  const parts = [];
-  for (const [k, v] of Object.entries(envs)) {
-    if (!SHELL_IDENTIFIER_PATTERN.test(k)) {
-      throw new Error(`Invalid environment variable name: ${JSON.stringify(k)}`);
-    }
-    parts.push(`export ${k}=${shellQuote(v)}`);
-  }
-  if (cwd) {
-    parts.push(`cd ${shellQuote(cwd)}`);
-  }
-  parts.push(`(${command})`);
-  return parts.join(" && ");
+	const parts = [];
+	for (const [k, v] of Object.entries(envs)) {
+		if (!SHELL_IDENTIFIER_PATTERN.test(k)) throw new Error(`Invalid environment variable name: ${JSON.stringify(k)}`);
+		parts.push(`export ${k}=${shellQuote(v)}`);
+	}
+	if (cwd) parts.push(`cd ${shellQuote(cwd)}`);
+	parts.push(`(${command})`);
+	return parts.join(" && ");
 }
-
-// src/sandbox/index.ts
-var SAFE_MOUNT_PATH = /^\/[a-zA-Z0-9_.\-/]+$/;
-var MOUNT_COMMAND_TIMEOUT_MS = 3e4;
+//#endregion
+//#region src/sandbox/index.ts
+/**
+* Daytona Sandbox Provider
+*
+* A Daytona sandbox implementation for Mastra workspaces.
+* Supports command execution, environment variables, resource configuration,
+* snapshots, Daytona volumes, and FUSE-based cloud filesystem mounting (S3, GCS).
+*
+* @see https://www.daytona.io/docs
+*/
+/** Allowlist pattern for mount paths — absolute path with safe characters only. */
+const SAFE_MOUNT_PATH = /^\/[a-zA-Z0-9_.\-/]+$/;
+/** Default timeout for mount lifecycle shell commands (mkdir, unmount, proc reads, etc.) */
+const MOUNT_COMMAND_TIMEOUT_MS = 3e4;
+/** Convert an unknown error to a readable string. */
 function errorToString(error) {
-  if (error instanceof Error) return error.message;
-  if (typeof error === "string") return error;
-  if (error && typeof error === "object" && "message" in error) {
-    const maybeError = error;
-    if (typeof maybeError.message === "string") {
-      return maybeError.message;
-    }
-  }
-  try {
-    return JSON.stringify(error);
-  } catch {
-    return String(error);
-  }
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	if (error && typeof error === "object" && "message" in error) {
+		const maybeError = error;
+		if (typeof maybeError.message === "string") return maybeError.message;
+	}
+	try {
+		return JSON.stringify(error);
+	} catch {
+		return String(error);
+	}
 }
 function validateMountPath(mountPath) {
-  if (!SAFE_MOUNT_PATH.test(mountPath)) {
-    throw new Error(
-      `Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.`
-    );
-  }
-  const segments = mountPath.split("/");
-  if (mountPath.includes("//") || segments.some((segment) => segment === "." || segment === "..")) {
-    throw new Error(`Invalid mount path: ${mountPath}. Path traversal segments are not allowed.`);
-  }
+	if (!SAFE_MOUNT_PATH.test(mountPath)) throw new Error(`Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.`);
+	const segments = mountPath.split("/");
+	if (mountPath.includes("//") || segments.some((segment) => segment === "." || segment === "..")) throw new Error(`Invalid mount path: ${mountPath}. Path traversal segments are not allowed.`);
 }
-var SAFE_MARKER_NAME = /^mount-[a-z0-9]+$/;
-var SANDBOX_DEAD_PATTERNS = [
-  /sandbox is not running/i,
-  /sandbox already destroyed/i,
-  /sandbox.*not found/i,
-  /failed to resolve container IP/i,
-  /is the sandbox started/i
+/** Allowlist for marker filenames from ls output — e.g. "mount-abc123" */
+const SAFE_MARKER_NAME = /^mount-[a-z0-9]+$/;
+/** Patterns indicating the sandbox is dead/gone (@daytonaio/sdk@0.143.0). */
+const SANDBOX_DEAD_PATTERNS = [
+	/sandbox is not running/i,
+	/sandbox already destroyed/i,
+	/sandbox.*not found/i,
+	/failed to resolve container IP/i,
+	/is the sandbox started/i
 ];
-var DaytonaSandbox = class _DaytonaSandbox extends MastraSandbox {
-  id;
-  name = "DaytonaSandbox";
-  provider = "daytona";
-  // Non-optional (initialized by base class when mount() exists)
-  /**
-   * Networking capability: public HTTPS URLs for sandbox ports.
-   * Daytona exposes ports through preview links (`getPreviewLink(port)`) —
-   * if the port is closed it is opened automatically. Private sandboxes
-   * require the preview token; pass `public: true` for tokenless URLs
-   * (required for sandbox deploys).
-   *
-   * When not attached in this process, the sandbox is looked up by identity
-   * (`daytona.get()` does not start it), so other processes can resolve
-   * deployments without waking a stopped sandbox.
-   */
-  networking = {
-    getPortUrl: async (port) => {
-      try {
-        const sandbox = this._sandbox ?? await this.lookupDetachedSandbox();
-        if (!sandbox) return null;
-        const preview = await sandbox.getPreviewLink(port);
-        return preview?.url ?? null;
-      } catch {
-        return null;
-      }
-    }
-  };
-  status = "pending";
-  _daytona = null;
-  _sandbox = null;
-  _createdAt = null;
-  _workingDir = null;
-  _isRetrying = false;
-  timeout;
-  language;
-  resources;
-  env;
-  labels;
-  snapshotId;
-  image;
-  ephemeral;
-  autoStopInterval;
-  autoArchiveInterval;
-  autoDeleteInterval;
-  volumeConfigs;
-  sandboxName;
-  _daytonaSandboxId;
-  sandboxUser;
-  sandboxPublic;
-  networkBlockAll;
-  networkAllowList;
-  connectionOpts;
-  _constructorOptions;
-  constructor(options = {}) {
-    super({
-      ...options,
-      name: "DaytonaSandbox",
-      processes: new DaytonaProcessManager({
-        env: options.env,
-        defaultTimeout: options.timeout ?? 3e5
-      })
-    });
-    this.id = options.id ?? this.generateId();
-    this.timeout = options.timeout ?? 3e5;
-    this.language = options.language ?? "typescript";
-    this.resources = options.resources;
-    this.env = options.env ?? {};
-    this.labels = options.labels ?? {};
-    this.snapshotId = options.snapshot;
-    this.image = options.image;
-    this.ephemeral = options.ephemeral ?? false;
-    this.autoStopInterval = options.autoStopInterval ?? 15;
-    this.autoArchiveInterval = options.autoArchiveInterval;
-    this.autoDeleteInterval = options.autoDeleteInterval;
-    this.volumeConfigs = options.volumes ?? [];
-    this.sandboxName = options.name ?? this.id;
-    this.sandboxUser = options.user;
-    this.sandboxPublic = options.public;
-    this.networkBlockAll = options.networkBlockAll;
-    this.networkAllowList = options.networkAllowList;
-    this.connectionOpts = {
-      ...options.apiKey !== void 0 && { apiKey: options.apiKey },
-      ...options.apiUrl !== void 0 && { apiUrl: options.apiUrl },
-      ...options.target !== void 0 && { target: options.target }
-    };
-    this._constructorOptions = { ...options };
-  }
-  generateId() {
-    return `daytona-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-  }
-  /**
-   * Construct a sibling `DaytonaSandbox` that inherits this sandbox's
-   * configuration (credentials, snapshot/image, resources, network policy)
-   * with per-instance overrides.
-   *
-   * Performs no I/O — the sandbox clone provisions (or reconnects to an
-   * existing Daytona sandbox with the same logical `id`) on its own `start()`.
-   * Use it when one configured sandbox acts as the template for a fleet of
-   * independent sandboxes (e.g. one per project).
-   *
-   * `options.idleTimeoutMinutes` maps to Daytona's `autoStopInterval`
-   * (minutes); `options.sandboxId` is ignored because Daytona reconnects by
-   * logical `id`.
-   */
-  clone(options = {}) {
-    const { id: _id, name: _name, ...base } = this._constructorOptions;
-    return new _DaytonaSandbox({
-      ...base,
-      ...options.id !== void 0 && { id: options.id },
-      ...options.env !== void 0 && { env: options.env },
-      ...options.idleTimeoutMinutes !== void 0 && { autoStopInterval: options.idleTimeoutMinutes }
-    });
-  }
-  /**
-   * Get the underlying Daytona Sandbox instance for direct access to Daytona APIs.
-   *
-   * Use this when you need to access Daytona features not exposed through the
-   * WorkspaceSandbox interface (e.g., filesystem API, git operations, LSP).
-   *
-   * @throws {SandboxNotReadyError} If the sandbox has not been started
-   *
-   * @example Direct file operations
-   * ```typescript
-   * await sandbox.start();
-   * const daytonaSandbox = sandbox.daytona;
-   * await daytonaSandbox.fs.uploadFile(Buffer.from('Hello'), '/tmp/test.txt');
-   * ```
-   */
-  get daytona() {
-    if (!this._sandbox) {
-      throw new SandboxNotReadyError(this.id);
-    }
-    return this._sandbox;
-  }
-  /** @deprecated Use `daytona` instead. */
-  get instance() {
-    return this.daytona;
-  }
-  // ---------------------------------------------------------------------------
-  // Lifecycle
-  // ---------------------------------------------------------------------------
-  /**
-   * Start the Daytona sandbox.
-   * Reconnects to an existing sandbox with the same logical ID if one exists,
-   * otherwise creates a new sandbox instance.
-   */
-  async start() {
-    if (this._sandbox) {
-      return;
-    }
-    if (!this._daytona) {
-      this._daytona = new Daytona(this.connectionOpts);
-    }
-    const existing = await this.findExistingSandbox();
-    if (existing) {
-      this._sandbox = existing;
-      this._daytonaSandboxId = existing.id;
-      this._createdAt = existing.createdAt ? new Date(existing.createdAt) : /* @__PURE__ */ new Date();
-      this.logger.debug(`${LOG_PREFIX} Reconnected to existing sandbox ${existing.id} for: ${this.id}`);
-      const expectedPaths = Array.from(this.mounts.entries.keys());
-      this.logger.debug(`${LOG_PREFIX} Running mount reconciliation...`);
-      await this.reconcileMounts(expectedPaths);
-      this.logger.debug(`${LOG_PREFIX} Mount reconciliation complete`);
-      await this.detectWorkingDir();
-      return;
-    }
-    this.logger.debug(`${LOG_PREFIX} Creating sandbox for: ${this.id}`);
-    const baseParams = compact({
-      language: this.language,
-      labels: { ...this.labels, "mastra-sandbox-id": this.id },
-      ephemeral: this.ephemeral,
-      autoStopInterval: this.autoStopInterval,
-      autoArchiveInterval: this.autoArchiveInterval,
-      autoDeleteInterval: this.autoDeleteInterval,
-      volumes: this.volumeConfigs.length > 0 ? this.volumeConfigs : void 0,
-      name: this.sandboxName,
-      user: this.sandboxUser,
-      public: this.sandboxPublic,
-      networkBlockAll: this.networkBlockAll,
-      networkAllowList: this.networkAllowList
-    });
-    if (this.resources && !this.image) {
-      this.logger.warn(
-        `${LOG_PREFIX} 'resources' option requires 'image' to take effect \u2014 falling back to snapshot-based creation without custom resources`
-      );
-    }
-    const createParams = this.image && !this.snapshotId ? compact({
-      ...baseParams,
-      image: this.image,
-      resources: this.resources
-    }) : compact({ ...baseParams, snapshot: this.snapshotId });
-    this._sandbox = await this._daytona.create(createParams);
-    this._daytonaSandboxId = this._sandbox.id;
-    this.logger.debug(`${LOG_PREFIX} Created sandbox ${this._sandbox.id} for logical ID: ${this.id}`);
-    this._createdAt = /* @__PURE__ */ new Date();
-    await this.detectWorkingDir();
-  }
-  /**
-   * Stop the Daytona sandbox.
-   * Unmounts all filesystems, then stops the sandbox.
-   */
-  async stop() {
-    if (!this._sandbox) {
-      try {
-        const existing = await this.lookupDetachedSandbox();
-        if (existing && existing.state === SandboxState.STARTED) {
-          await this._daytona.stop(existing);
-        }
-      } catch {
-      }
-      return;
-    }
-    for (const mountPath of [...this.mounts.entries.keys()]) {
-      try {
-        await this.unmount(mountPath);
-      } catch {
-      }
-    }
-    if (this._daytona) {
-      try {
-        await this._daytona.stop(this._sandbox);
-      } catch {
-      }
-    }
-    this._sandbox = null;
-  }
-  /**
-   * Destroy the Daytona sandbox and clean up all resources.
-   * Deletes the sandbox and clears all state.
-   */
-  async destroy() {
-    if (this._sandbox && this._daytona) {
-      try {
-        await this._daytona.delete(this._sandbox);
-      } catch {
-      }
-    } else if (!this._sandbox) {
-      try {
-        const orphan = await this.lookupDetachedSandbox();
-        if (orphan) {
-          await this._daytona.delete(orphan);
-        }
-      } catch {
-      }
-    }
-    this._sandbox = null;
-    this._daytonaSandboxId = void 0;
-    this._daytona = null;
-    this.mounts?.clear();
-  }
-  /**
-   * Check if the sandbox is ready for operations.
-   */
-  async isReady() {
-    return this.status === "running" && this._sandbox !== null;
-  }
-  /**
-   * Get information about the current state of the sandbox.
-   */
-  async getInfo() {
-    return {
-      id: this.id,
-      name: this.name,
-      provider: this.provider,
-      status: this.status,
-      createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
-      mounts: this.mounts ? Array.from(this.mounts.entries).map(([path, entry]) => ({
-        path,
-        filesystem: entry.filesystem?.provider ?? entry.config?.type ?? "unknown"
-      })) : [],
-      ...this._sandbox && {
-        resources: {
-          cpuCores: this._sandbox.cpu,
-          memoryMB: this._sandbox.memory * 1024,
-          diskMB: this._sandbox.disk * 1024
-        }
-      },
-      metadata: {
-        language: this.language,
-        ephemeral: this.ephemeral,
-        ...this.snapshotId && { snapshot: this.snapshotId },
-        ...this.image && { image: this.image },
-        ...this._sandbox && { target: this._sandbox.target }
-      }
-    };
-  }
-  /**
-   * Get instructions describing this Daytona sandbox.
-   * Used by agents to understand the execution environment.
-   */
-  getInstructions() {
-    const parts = [];
-    const mountCount = this.mounts.entries.size;
-    const mountInfo = mountCount > 0 ? ` ${mountCount} filesystem(s) mounted via FUSE.` : "";
-    parts.push(`Cloud sandbox with isolated execution (${this.language} runtime).${mountInfo}`);
-    if (this._workingDir) {
-      parts.push(`Default working directory: ${this._workingDir}.`);
-    }
-    parts.push(`Command timeout: ${Math.ceil(this.timeout / 1e3)}s.`);
-    parts.push(`Running as user: ${this.sandboxUser ?? "daytona"}.`);
-    if (this.volumeConfigs.length > 0) {
-      parts.push(`${this.volumeConfigs.length} volume(s) attached.`);
-    }
-    if (this.networkBlockAll) {
-      parts.push(`Network access is blocked.`);
-    }
-    return parts.join(" ");
-  }
-  // ---------------------------------------------------------------------------
-  // Command Execution
-  // ---------------------------------------------------------------------------
-  /**
-   * Execute a command in the sandbox and return the result.
-   */
-  async executeCommand(command, args = [], options = {}) {
-    await this.ensureRunning();
-    const fullCommand = args.length > 0 ? `${command} ${args.map(shellQuote).join(" ")}` : command;
-    const handle = await this.processes.spawn(fullCommand, options);
-    const result = await handle.wait();
-    return { ...result, command, args };
-  }
-  /**
-   * Bulk-write files into the sandbox filesystem via the SDK's native upload.
-   */
-  async writeFiles(files) {
-    await this.ensureRunning();
-    await this.daytona.fs.uploadFiles(
-      files.map((file) => ({
-        source: Buffer.isBuffer(file.content) ? file.content : Buffer.from(file.content),
-        destination: file.path
-      }))
-    );
-  }
-  // ---------------------------------------------------------------------------
-  // Mount Support
-  // ---------------------------------------------------------------------------
-  /**
-   * Mount a filesystem at a path in the sandbox.
-   * Uses FUSE tools (s3fs, gcsfuse) to mount cloud storage.
-   */
-  async mount(filesystem, mountPath) {
-    validateMountPath(mountPath);
-    if (!this._sandbox) {
-      throw new SandboxNotReadyError(this.id);
-    }
-    const sandbox = this._sandbox;
-    this.logger.debug(`${LOG_PREFIX} Mounting "${mountPath}"...`);
-    const config = filesystem.getMountConfig?.();
-    if (!config) {
-      const error = `Filesystem "${filesystem.id}" does not provide a mount config`;
-      this.logger.error(`${LOG_PREFIX} ${error}`);
-      this.mounts.set(mountPath, { filesystem, state: "error", error });
-      return { success: false, mountPath, error };
-    }
-    const existingMount = await this.checkExistingMount(mountPath, config);
-    if (existingMount === "matching") {
-      this.logger.debug(
-        `${LOG_PREFIX} Detected existing mount for ${filesystem.provider} ("${filesystem.id}") at "${mountPath}" with correct config, skipping`
-      );
-      this.mounts.set(mountPath, { state: "mounted", config });
-      return { success: true, mountPath };
-    } else if (existingMount === "mismatched") {
-      this.logger.debug(`${LOG_PREFIX} Config mismatch at "${mountPath}", unmounting to re-mount with new config...`);
-      await this.unmount(mountPath);
-    } else if (existingMount === "unmanaged") {
-      const error = `Mount path "${mountPath}" is already mounted by an unmanaged source`;
-      this.logger.error(`${LOG_PREFIX} ${error}`);
-      this.mounts.set(mountPath, { filesystem, state: "error", config, error });
-      return { success: false, mountPath, error };
-    }
-    this.mounts.set(mountPath, { filesystem, state: "mounting", config });
-    this.logger.debug(`${LOG_PREFIX} Config type: ${config.type}`);
-    try {
-      const quotedPath = shellQuote(mountPath);
-      const checkResult = await runCommand(
-        sandbox,
-        `[ -d ${quotedPath} ] && ! mountpoint -q ${quotedPath} 2>/dev/null && [ "$(ls -A ${quotedPath} 2>/dev/null)" ] && echo "non-empty" || echo "ok"`,
-        { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-      );
-      if (checkResult.output.trim() === "non-empty") {
-        const error = `Cannot mount at ${mountPath}: directory exists and is not empty. Mounting would hide existing files. Use a different path or empty the directory first.`;
-        this.logger.error(`${LOG_PREFIX} ${error}`);
-        this.mounts.set(mountPath, { filesystem, state: "error", config, error });
-        return { success: false, mountPath, error };
-      }
-    } catch {
-    }
-    this.logger.debug(`${LOG_PREFIX} Creating mount directory for "${mountPath}"...`);
-    try {
-      const quotedPath = shellQuote(mountPath);
-      const mkdirResult = await runCommand(
-        sandbox,
-        `mountpoint -q ${quotedPath} 2>/dev/null && sudo mount -t tmpfs tmpfs ${quotedPath} 2>/dev/null; sudo mkdir -p ${quotedPath} 2>/dev/null; sudo chown $(id -u):$(id -g) ${quotedPath}`,
-        { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-      );
-      if (mkdirResult.exitCode !== 0) {
-        const error = mkdirResult.output || "Failed to create mount directory";
-        this.logger.debug(`${LOG_PREFIX} mkdir error for "${mountPath}":`, error);
-        this.mounts.set(mountPath, { filesystem, state: "error", config, error });
-        return { success: false, mountPath, error };
-      }
-    } catch (err) {
-      const error = `Failed to create mount directory: ${err}`;
-      this.mounts.set(mountPath, { filesystem, state: "error", config, error });
-      return { success: false, mountPath, error };
-    }
-    const mountCtx = {
-      run: async (cmd, timeoutMs) => {
-        const result = await runCommand(sandbox, cmd, timeoutMs !== void 0 ? { timeout: timeoutMs } : void 0);
-        return {
-          exitCode: result.exitCode,
-          stdout: result.output,
-          stderr: result.exitCode !== 0 ? result.output : ""
-        };
-      },
-      writeFile: async (path, content) => {
-        await sandbox.fs.uploadFile(Buffer.from(content), path);
-      },
-      logger: this.logger
-    };
-    try {
-      switch (config.type) {
-        case "s3":
-          this.logger.debug(`${LOG_PREFIX} Mounting S3 at "${mountPath}"...`);
-          await mountS3(mountPath, config, mountCtx);
-          this.logger.debug(`${LOG_PREFIX} Mounted S3 bucket at ${mountPath}`);
-          break;
-        case "gcs":
-          this.logger.debug(`${LOG_PREFIX} Mounting GCS at "${mountPath}"...`);
-          await mountGCS(mountPath, config, mountCtx);
-          this.logger.debug(`${LOG_PREFIX} Mounted GCS bucket at ${mountPath}`);
-          break;
-        case "azure-blob":
-          this.logger.debug(`${LOG_PREFIX} Mounting Azure Blob at "${mountPath}"...`);
-          await mountAzure(mountPath, config, mountCtx);
-          this.logger.debug(`${LOG_PREFIX} Mounted Azure Blob container at ${mountPath}`);
-          break;
-        default: {
-          const error = `Unsupported mount type: ${config.type}`;
-          this.mounts.set(mountPath, { filesystem, state: "unsupported", config, error });
-          return { success: false, mountPath, error };
-        }
-      }
-    } catch (error) {
-      this.logger.error(
-        `${LOG_PREFIX} Error mounting "${filesystem.provider}" (${filesystem.id}) at "${mountPath}":`,
-        error
-      );
-      this.mounts.set(mountPath, { filesystem, state: "error", config, error: errorToString(error) });
-      await runCommand(sandbox, `sudo rmdir ${shellQuote(mountPath)} 2>/dev/null || true`, {
-        timeout: MOUNT_COMMAND_TIMEOUT_MS
-      });
-      this.logger.debug(`${LOG_PREFIX} Cleaned up directory after failed mount: ${mountPath}`);
-      return { success: false, mountPath, error: errorToString(error) };
-    }
-    this.mounts.set(mountPath, { state: "mounted", config });
-    await this.writeMarkerFile(mountPath);
-    this.logger.debug(`${LOG_PREFIX} Mounted "${mountPath}"`);
-    return { success: true, mountPath };
-  }
-  /**
-   * Unmount a filesystem from a path in the sandbox.
-   */
-  async unmount(mountPath) {
-    validateMountPath(mountPath);
-    if (!this._sandbox) {
-      throw new SandboxNotReadyError(this.id);
-    }
-    const sandbox = this._sandbox;
-    this.logger.debug(`${LOG_PREFIX} Unmounting "${mountPath}"...`);
-    const quotedPath = shellQuote(mountPath);
-    await runCommand(
-      sandbox,
-      `sudo fusermount -u ${quotedPath} 2>/dev/null; sudo umount -l ${quotedPath} 2>/dev/null; mountpoint -q ${quotedPath} 2>/dev/null && { _p="/tmp/.mastra-defunct-$$"; sudo mkdir -p "$_p" && sudo mount --move ${quotedPath} "$_p" 2>/dev/null; sudo umount -l "$_p" 2>/dev/null; sudo rmdir "$_p" 2>/dev/null; }`,
-      { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-    );
-    this.mounts.delete(mountPath);
-    const markerPath = `/tmp/.mastra-mounts/${this.mounts.markerFilename(mountPath)}`;
-    const rmdirResult = await runCommand(
-      sandbox,
-      `rm -f ${shellQuote(markerPath)} 2>/dev/null; sudo rmdir ${quotedPath} 2>&1`,
-      {
-        timeout: MOUNT_COMMAND_TIMEOUT_MS
-      }
-    );
-    if (rmdirResult.exitCode === 0) {
-      this.logger.debug(`${LOG_PREFIX} Unmounted and removed ${mountPath}`);
-    } else {
-      this.logger.debug(
-        `${LOG_PREFIX} Unmounted ${mountPath} (directory not removed: ${rmdirResult.output.trim() || "not empty"})`
-      );
-    }
-  }
-  /**
-   * Unmount all stale mounts that are not in the expected mounts list.
-   * Also cleans up orphaned directories and marker files from failed mount attempts.
-   * Call this after reconnecting to an existing sandbox to clean up old mounts.
-   */
-  async reconcileMounts(expectedMountPaths) {
-    if (!this._sandbox) return;
-    const sandbox = this._sandbox;
-    this.logger.debug(`${LOG_PREFIX} Reconciling mounts. Expected paths:`, expectedMountPaths);
-    let currentMounts = [];
-    try {
-      const mountsResult = await runCommand(
-        sandbox,
-        `grep -E 'fuse\\.(s3fs|gcsfuse|blobfuse2)' /proc/mounts | awk '{print $2}'`,
-        { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-      );
-      currentMounts = mountsResult.output.trim().split("\n").filter((p) => p.length > 0);
-    } catch (err) {
-      this.logger.debug(`${LOG_PREFIX} Could not read /proc/mounts: ${err}`);
-      return;
-    }
-    this.logger.debug(`${LOG_PREFIX} Current FUSE mounts in sandbox:`, currentMounts);
-    let markerFiles = [];
-    try {
-      const markersResult = await runCommand(sandbox, 'ls /tmp/.mastra-mounts/ 2>/dev/null || echo ""', {
-        timeout: MOUNT_COMMAND_TIMEOUT_MS
-      });
-      markerFiles = markersResult.output.trim().split("\n").filter((f) => f.length > 0 && SAFE_MARKER_NAME.test(f));
-    } catch (err) {
-      this.logger.debug(`${LOG_PREFIX} Could not read marker files: ${err}`);
-    }
-    const managedMountPaths = /* @__PURE__ */ new Map();
-    for (const markerFile of markerFiles) {
-      const markerResult = await runCommand(sandbox, `cat "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null || echo ""`, {
-        timeout: MOUNT_COMMAND_TIMEOUT_MS
-      });
-      const parsed = this.mounts.parseMarkerContent(markerResult.output.trim());
-      if (parsed && SAFE_MOUNT_PATH.test(parsed.path)) {
-        managedMountPaths.set(parsed.path, markerFile);
-      }
-    }
-    const staleMounts = currentMounts.filter((path) => !expectedMountPaths.includes(path));
-    for (const stalePath of staleMounts) {
-      if (managedMountPaths.has(stalePath)) {
-        this.logger.debug(`${LOG_PREFIX} Found stale managed FUSE mount at "${stalePath}", unmounting...`);
-        try {
-          await this.unmount(stalePath);
-        } catch (err) {
-          this.logger.debug(`${LOG_PREFIX} Failed to unmount stale mount at "${stalePath}": ${err}`);
-        }
-      } else {
-        this.logger.debug(`${LOG_PREFIX} Found external FUSE mount at "${stalePath}", leaving untouched`);
-      }
-    }
-    try {
-      const expectedMarkerFiles = new Set(expectedMountPaths.map((p) => this.mounts.markerFilename(p)));
-      const markerToPath = /* @__PURE__ */ new Map();
-      for (const [path, file] of managedMountPaths) {
-        markerToPath.set(file, path);
-      }
-      for (const markerFile of markerFiles) {
-        if (!expectedMarkerFiles.has(markerFile)) {
-          const mountPath = markerToPath.get(markerFile);
-          if (mountPath) {
-            if (!currentMounts.includes(mountPath)) {
-              this.logger.debug(`${LOG_PREFIX} Cleaning up orphaned marker and directory for ${mountPath}`);
-              await runCommand(
-                sandbox,
-                `rm -f "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null; sudo rmdir ${shellQuote(mountPath)} 2>/dev/null`,
-                { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-              );
-            }
-          } else {
-            this.logger.debug(`${LOG_PREFIX} Removing malformed marker file: ${markerFile}`);
-            await runCommand(sandbox, `rm -f "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null || true`, {
-              timeout: MOUNT_COMMAND_TIMEOUT_MS
-            });
-          }
-        }
-      }
-    } catch {
-      this.logger.debug(`${LOG_PREFIX} Error during orphan cleanup (non-fatal)`);
-    }
-  }
-  /**
-   * Write marker file for detecting config changes on reconnect.
-   * Stores both the mount path and config hash in the file.
-   */
-  async writeMarkerFile(mountPath) {
-    if (!this._sandbox) return;
-    const markerContent = this.mounts.getMarkerContent(mountPath);
-    if (!markerContent) return;
-    const filename = this.mounts.markerFilename(mountPath);
-    const markerPath = `/tmp/.mastra-mounts/${filename}`;
-    try {
-      await runCommand(this._sandbox, "mkdir -p /tmp/.mastra-mounts", { timeout: MOUNT_COMMAND_TIMEOUT_MS });
-      await this._sandbox.fs.uploadFile(Buffer.from(markerContent, "utf-8"), markerPath);
-    } catch {
-      this.logger.debug(`${LOG_PREFIX} Warning: Could not write marker file at ${markerPath}`);
-    }
-  }
-  /**
-   * Check if a path is already mounted and whether the config matches.
-   *
-   * @param mountPath - The mount path to check
-   * @param newConfig - The new config to compare against the stored config
-   * @returns 'not_mounted' | 'matching' | 'mismatched' | 'unmanaged'
-   */
-  async checkExistingMount(mountPath, newConfig) {
-    if (!this._sandbox) throw new SandboxNotReadyError(this.id);
-    const sandbox = this._sandbox;
-    try {
-      const mountCheck = await runCommand(
-        sandbox,
-        `mountpoint -q ${shellQuote(mountPath)} && echo "mounted" || echo "not mounted"`,
-        { timeout: MOUNT_COMMAND_TIMEOUT_MS }
-      );
-      if (mountCheck.output.trim() !== "mounted") {
-        return "not_mounted";
-      }
-    } catch {
-      return "not_mounted";
-    }
-    const filename = this.mounts.markerFilename(mountPath);
-    const markerPath = `/tmp/.mastra-mounts/${filename}`;
-    let parsed;
-    try {
-      const markerResult = await runCommand(sandbox, `cat ${shellQuote(markerPath)} 2>/dev/null || echo ""`, {
-        timeout: MOUNT_COMMAND_TIMEOUT_MS
-      });
-      parsed = this.mounts.parseMarkerContent(markerResult.output.trim());
-    } catch {
-      return "unmanaged";
-    }
-    if (!parsed) return "unmanaged";
-    const newConfigHash = this.mounts.computeConfigHash(newConfig);
-    this.logger.debug(
-      `${LOG_PREFIX} Marker check - stored hash: "${parsed.configHash}", new config hash: "${newConfigHash}"`
-    );
-    if (parsed.path === mountPath && parsed.configHash === newConfigHash) {
-      return "matching";
-    }
-    return "mismatched";
-  }
-  // ---------------------------------------------------------------------------
-  // Internal Helpers
-  // ---------------------------------------------------------------------------
-  /**
-   * Try to find and reconnect to an existing Daytona sandbox by ID.
-   * Returns the sandbox if found and usable, or null if a fresh one should
-   * be created.
-   */
-  async detectWorkingDir() {
-    if (!this._sandbox) return;
-    try {
-      const result = await runCommand(this._sandbox, "pwd", { timeout: MOUNT_COMMAND_TIMEOUT_MS });
-      const dir = result.output?.trim();
-      if (dir) {
-        this._workingDir = dir;
-        this.logger.debug(`${LOG_PREFIX} Detected working directory: ${dir}`);
-      }
-    } catch {
-      this.logger.debug(`${LOG_PREFIX} Could not detect working directory, will omit from instructions`);
-    }
-  }
-  /**
-   * Look up the existing Daytona sandbox by identity WITHOUT starting it.
-   * Used for detached (cross-process) networking/stop/destroy so those
-   * operations never wake a stopped sandbox. Returns null when not found.
-   */
-  async lookupDetachedSandbox() {
-    const lookupKey = this._daytonaSandboxId ?? this.sandboxName;
-    if (!lookupKey) {
-      return null;
-    }
-    if (!this._daytona) {
-      this._daytona = new Daytona(this.connectionOpts);
-    }
-    try {
-      return await this._daytona.get(lookupKey);
-    } catch (error) {
-      if (error instanceof DaytonaNotFoundError) {
-        return null;
-      }
-      throw error;
-    }
-  }
-  async findExistingSandbox() {
-    const DEAD_STATES = [
-      SandboxState.DESTROYED,
-      SandboxState.DESTROYING,
-      SandboxState.ERROR,
-      SandboxState.BUILD_FAILED
-    ];
-    const lookupKey = this._daytonaSandboxId ?? this.sandboxName;
-    if (!lookupKey) {
-      return null;
-    }
-    let sandbox;
-    try {
-      sandbox = await this._daytona.get(lookupKey);
-    } catch (error) {
-      if (error instanceof DaytonaNotFoundError) {
-        this._daytonaSandboxId = void 0;
-        return null;
-      }
-      throw error;
-    }
-    const state = sandbox.state;
-    if (state && DEAD_STATES.includes(state)) {
-      this.logger.debug(`${LOG_PREFIX} Existing sandbox ${sandbox.id} is dead (${state}), deleting and creating fresh`);
-      try {
-        await this._daytona.delete(sandbox);
-      } catch {
-      }
-      return null;
-    }
-    if (state !== SandboxState.STARTED) {
-      this.logger.debug(`${LOG_PREFIX} Restarting sandbox ${sandbox.id} (state: ${state})`);
-      await this.waitForStableStateAndStart(sandbox);
-    }
-    return sandbox;
-  }
-  /**
-   * Transitional states where the Daytona API will reject start() with
-   * "State change in progress". We poll until the sandbox reaches a stable
-   * state before attempting start().
-   */
-  static TRANSITIONAL_STATES = [
-    SandboxState.STARTING,
-    SandboxState.STOPPING,
-    SandboxState.CREATING,
-    SandboxState.RESTORING,
-    SandboxState.ARCHIVING,
-    SandboxState.RESIZING,
-    SandboxState.PULLING_SNAPSHOT,
-    SandboxState.BUILDING_SNAPSHOT
-  ];
-  /**
-   * Wait for the sandbox to leave a transitional state, then start it if needed.
-   * Polls every 2s for up to 120s. If the sandbox reaches STARTED on its own
-   * (e.g. it was STARTING), we skip the start() call. If start() still fails
-   * with "State change in progress", we retry with backoff.
-   */
-  async waitForStableStateAndStart(sandbox) {
-    const MAX_WAIT_MS = 12e4;
-    const POLL_INTERVAL_MS = 2e3;
-    const deadline = Date.now() + MAX_WAIT_MS;
-    let current = sandbox;
-    while (current.state && _DaytonaSandbox.TRANSITIONAL_STATES.includes(current.state) && Date.now() < deadline) {
-      this.logger.debug(`${LOG_PREFIX} Sandbox ${current.id} is in transitional state (${current.state}), waiting...`);
-      await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-      current = await this._daytona.get(current.id);
-    }
-    if (current.state === SandboxState.STARTED) {
-      Object.assign(sandbox, current);
-      return;
-    }
-    while (Date.now() < deadline) {
-      try {
-        await this._daytona.start(current);
-        return;
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (msg.includes("State change in progress") && Date.now() < deadline) {
-          this.logger.debug(`${LOG_PREFIX} start() returned "State change in progress", retrying...`);
-          await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-          current = await this._daytona.get(current.id);
-          if (current.state === SandboxState.STARTED) {
-            Object.assign(sandbox, current);
-            return;
-          }
-          continue;
-        }
-        throw error;
-      }
-    }
-    await this._daytona.start(current);
-  }
-  /**
-   * Check if an error indicates the sandbox is dead/gone.
-   * Uses DaytonaNotFoundError from the SDK when available,
-   * with string fallback for edge cases.
-   *
-   * String patterns observed in @daytonaio/sdk@0.143.0 error messages.
-   * Update if SDK error messages change in future versions.
-   */
-  isSandboxDeadError(error) {
-    if (!error) return false;
-    if (error instanceof DaytonaNotFoundError) return true;
-    const errorStr = String(error);
-    return SANDBOX_DEAD_PATTERNS.some((pattern) => pattern.test(errorStr));
-  }
-  /**
-   * Handle sandbox timeout by clearing the instance and resetting state.
-   */
-  handleSandboxTimeout() {
-    this._sandbox = null;
-    if (this.mounts) {
-      for (const [path, entry] of this.mounts.entries) {
-        if (entry.state === "mounted" || entry.state === "mounting") {
-          this.mounts.set(path, { state: "pending" });
-        }
-      }
-    }
-    this.status = "stopped";
-  }
-  // ---------------------------------------------------------------------------
-  // Retry on Dead
-  // ---------------------------------------------------------------------------
-  /**
-   * Execute a function, retrying once if the sandbox is found to be dead.
-   * Used by DaytonaProcessManager to handle stale sandboxes transparently.
-   */
-  async retryOnDead(fn) {
-    try {
-      return await fn();
-    } catch (error) {
-      if (this.isSandboxDeadError(error) && !this._isRetrying) {
-        this.handleSandboxTimeout();
-        this._isRetrying = true;
-        try {
-          await this.ensureRunning();
-          return await fn();
-        } finally {
-          this._isRetrying = false;
-        }
-      }
-      throw error;
-    }
-  }
+/**
+* Daytona sandbox provider for Mastra workspaces.
+*
+* Features:
+* - Isolated cloud sandbox via Daytona SDK
+* - Multi-runtime support (TypeScript, JavaScript, Python)
+* - Resource configuration (CPU, memory, disk)
+* - Volume attachment at creation time
+* - FUSE-based cloud filesystem mounting (S3, GCS)
+* - Automatic sandbox timeout handling with retry
+*
+* @example Basic usage
+* ```typescript
+* import { Workspace } from '@mastra/core/workspace';
+* import { DaytonaSandbox } from '@mastra/daytona';
+*
+* const sandbox = new DaytonaSandbox({
+*   timeout: 60000,
+*   language: 'typescript',
+* });
+*
+* const workspace = new Workspace({ sandbox });
+* const result = await workspace.executeCode('console.log("Hello!")');
+* ```
+*
+* @example With resources and volumes
+* ```typescript
+* const sandbox = new DaytonaSandbox({
+*   resources: { cpu: 2, memory: 4, disk: 6 },
+*   volumes: [{ volumeId: 'vol-123', mountPath: '/data' }],
+*   env: { NODE_ENV: 'production' },
+* });
+* ```
+*/
+var DaytonaSandbox = class DaytonaSandbox extends MastraSandbox {
+	id;
+	name = "DaytonaSandbox";
+	provider = "daytona";
+	/**
+	* Networking capability: public HTTPS URLs for sandbox ports.
+	* Daytona exposes ports through preview links (`getPreviewLink(port)`) —
+	* if the port is closed it is opened automatically. Private sandboxes
+	* require the preview token; pass `public: true` for tokenless URLs
+	* (required for sandbox deploys).
+	*
+	* When not attached in this process, the sandbox is looked up by identity
+	* (`daytona.get()` does not start it), so other processes can resolve
+	* deployments without waking a stopped sandbox.
+	*/
+	networking = { getPortUrl: async (port) => {
+		try {
+			const sandbox = this._sandbox ?? await this.lookupDetachedSandbox();
+			if (!sandbox) return null;
+			return (await sandbox.getPreviewLink(port))?.url ?? null;
+		} catch {
+			return null;
+		}
+	} };
+	status = "pending";
+	_daytona = null;
+	_sandbox = null;
+	_createdAt = null;
+	_workingDir = null;
+	_isRetrying = false;
+	timeout;
+	language;
+	resources;
+	env;
+	labels;
+	snapshotId;
+	image;
+	ephemeral;
+	autoStopInterval;
+	autoArchiveInterval;
+	autoDeleteInterval;
+	volumeConfigs;
+	sandboxName;
+	_daytonaSandboxId;
+	sandboxUser;
+	sandboxPublic;
+	networkBlockAll;
+	networkAllowList;
+	domainAllowList;
+	connectionOpts;
+	_constructorOptions;
+	constructor(options = {}) {
+		super({
+			...options,
+			name: "DaytonaSandbox",
+			processes: new DaytonaProcessManager({
+				env: options.env,
+				defaultTimeout: options.timeout ?? 3e5
+			})
+		});
+		this.id = options.id ?? this.generateId();
+		this.timeout = options.timeout ?? 3e5;
+		this.language = options.language ?? "typescript";
+		this.resources = options.resources;
+		this.env = options.env ?? {};
+		this.labels = options.labels ?? {};
+		this.snapshotId = options.snapshot;
+		this.image = options.image;
+		this.ephemeral = options.ephemeral ?? false;
+		this.autoStopInterval = options.autoStopInterval ?? 15;
+		this.autoArchiveInterval = options.autoArchiveInterval;
+		this.autoDeleteInterval = options.autoDeleteInterval;
+		this.volumeConfigs = options.volumes ?? [];
+		this.sandboxName = options.name ?? this.id;
+		this.sandboxUser = options.user;
+		this.sandboxPublic = options.public;
+		this.networkBlockAll = options.networkBlockAll;
+		this.networkAllowList = options.networkAllowList;
+		this.domainAllowList = options.domainAllowList;
+		this.connectionOpts = {
+			...options.apiKey !== void 0 && { apiKey: options.apiKey },
+			...options.apiUrl !== void 0 && { apiUrl: options.apiUrl },
+			...options.target !== void 0 && { target: options.target }
+		};
+		this._constructorOptions = { ...options };
+	}
+	generateId() {
+		return `daytona-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+	}
+	/**
+	* Construct a sibling `DaytonaSandbox` that inherits this sandbox's
+	* configuration (credentials, snapshot/image, resources, network policy)
+	* with per-instance overrides.
+	*
+	* Performs no I/O — the sandbox clone provisions (or reconnects to an
+	* existing Daytona sandbox with the same logical `id`) on its own `start()`.
+	* Use it when one configured sandbox acts as the template for a fleet of
+	* independent sandboxes (e.g. one per project).
+	*
+	* `options.idleTimeoutMinutes` maps to Daytona's `autoStopInterval`
+	* (minutes); `options.sandboxId` is ignored because Daytona reconnects by
+	* logical `id`.
+	*/
+	clone(options = {}) {
+		const { id: _id, name: _name, ...base } = this._constructorOptions;
+		return new DaytonaSandbox({
+			...base,
+			...options.id !== void 0 && { id: options.id },
+			...options.env !== void 0 && { env: options.env },
+			...options.idleTimeoutMinutes !== void 0 && { autoStopInterval: options.idleTimeoutMinutes }
+		});
+	}
+	/**
+	* Get the underlying Daytona Sandbox instance for direct access to Daytona APIs.
+	*
+	* Use this when you need to access Daytona features not exposed through the
+	* WorkspaceSandbox interface (e.g., filesystem API, git operations, LSP).
+	*
+	* @throws {SandboxNotReadyError} If the sandbox has not been started
+	*
+	* @example Direct file operations
+	* ```typescript
+	* await sandbox.start();
+	* const daytonaSandbox = sandbox.daytona;
+	* await daytonaSandbox.fs.uploadFile(Buffer.from('Hello'), '/tmp/test.txt');
+	* ```
+	*/
+	get daytona() {
+		if (!this._sandbox) throw new SandboxNotReadyError(this.id);
+		return this._sandbox;
+	}
+	/** @deprecated Use `daytona` instead. */
+	get instance() {
+		return this.daytona;
+	}
+	/**
+	* Start the Daytona sandbox.
+	* Reconnects to an existing sandbox with the same logical ID if one exists,
+	* otherwise creates a new sandbox instance.
+	*/
+	async start() {
+		if (this._sandbox) return;
+		if (!this._daytona) this._daytona = new Daytona(this.connectionOpts);
+		const existing = await this.findExistingSandbox();
+		if (existing) {
+			this._sandbox = existing;
+			this._daytonaSandboxId = existing.id;
+			this._createdAt = existing.createdAt ? new Date(existing.createdAt) : /* @__PURE__ */ new Date();
+			this.logger.debug(`${LOG_PREFIX} Reconnected to existing sandbox ${existing.id} for: ${this.id}`);
+			const expectedPaths = Array.from(this.mounts.entries.keys());
+			this.logger.debug(`${LOG_PREFIX} Running mount reconciliation...`);
+			await this.reconcileMounts(expectedPaths);
+			this.logger.debug(`${LOG_PREFIX} Mount reconciliation complete`);
+			await this.detectWorkingDir();
+			return;
+		}
+		this.logger.debug(`${LOG_PREFIX} Creating sandbox for: ${this.id}`);
+		const baseParams = compact({
+			language: this.language,
+			labels: {
+				...this.labels,
+				"mastra-sandbox-id": this.id
+			},
+			ephemeral: this.ephemeral,
+			autoStopInterval: this.autoStopInterval,
+			autoArchiveInterval: this.autoArchiveInterval,
+			autoDeleteInterval: this.autoDeleteInterval,
+			volumes: this.volumeConfigs.length > 0 ? this.volumeConfigs : void 0,
+			name: this.sandboxName,
+			user: this.sandboxUser,
+			public: this.sandboxPublic,
+			networkBlockAll: this.networkBlockAll,
+			networkAllowList: this.networkAllowList,
+			domainAllowList: this.domainAllowList
+		});
+		if (this.resources && !this.image) this.logger.warn(`${LOG_PREFIX} 'resources' option requires 'image' to take effect — falling back to snapshot-based creation without custom resources`);
+		const createParams = this.image && !this.snapshotId ? compact({
+			...baseParams,
+			image: this.image,
+			resources: this.resources
+		}) : compact({
+			...baseParams,
+			snapshot: this.snapshotId
+		});
+		this._sandbox = await this._daytona.create(createParams);
+		this._daytonaSandboxId = this._sandbox.id;
+		this.logger.debug(`${LOG_PREFIX} Created sandbox ${this._sandbox.id} for logical ID: ${this.id}`);
+		this._createdAt = /* @__PURE__ */ new Date();
+		await this.detectWorkingDir();
+	}
+	/**
+	* Stop the Daytona sandbox.
+	* Unmounts all filesystems, then stops the sandbox.
+	*/
+	async stop() {
+		if (!this._sandbox) {
+			try {
+				const existing = await this.lookupDetachedSandbox();
+				if (existing && existing.state === SandboxState.STARTED) await this._daytona.stop(existing);
+			} catch {}
+			return;
+		}
+		for (const mountPath of [...this.mounts.entries.keys()]) try {
+			await this.unmount(mountPath);
+		} catch {}
+		if (this._daytona) try {
+			await this._daytona.stop(this._sandbox);
+		} catch {}
+		this._sandbox = null;
+	}
+	/**
+	* Destroy the Daytona sandbox and clean up all resources.
+	* Deletes the sandbox and clears all state.
+	*/
+	async destroy() {
+		if (this._sandbox && this._daytona) try {
+			await this._daytona.delete(this._sandbox);
+		} catch {}
+		else if (!this._sandbox) try {
+			const orphan = await this.lookupDetachedSandbox();
+			if (orphan) await this._daytona.delete(orphan);
+		} catch {}
+		this._sandbox = null;
+		this._daytonaSandboxId = void 0;
+		this._daytona = null;
+		this.mounts?.clear();
+	}
+	/**
+	* Check if the sandbox is ready for operations.
+	*/
+	async isReady() {
+		return this.status === "running" && this._sandbox !== null;
+	}
+	/**
+	* Get information about the current state of the sandbox.
+	*/
+	async getInfo() {
+		return {
+			id: this.id,
+			name: this.name,
+			provider: this.provider,
+			status: this.status,
+			createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
+			mounts: this.mounts ? Array.from(this.mounts.entries).map(([path, entry]) => ({
+				path,
+				filesystem: entry.filesystem?.provider ?? entry.config?.type ?? "unknown"
+			})) : [],
+			...this._sandbox && { resources: {
+				cpuCores: this._sandbox.cpu,
+				memoryMB: this._sandbox.memory * 1024,
+				diskMB: this._sandbox.disk * 1024
+			} },
+			metadata: {
+				language: this.language,
+				ephemeral: this.ephemeral,
+				...this.snapshotId && { snapshot: this.snapshotId },
+				...this.image && { image: this.image },
+				...this._sandbox && { target: this._sandbox.target }
+			}
+		};
+	}
+	/**
+	* Get instructions describing this Daytona sandbox.
+	* Used by agents to understand the execution environment.
+	*/
+	getInstructions() {
+		const parts = [];
+		const mountCount = this.mounts.entries.size;
+		const mountInfo = mountCount > 0 ? ` ${mountCount} filesystem(s) mounted via FUSE.` : "";
+		parts.push(`Cloud sandbox with isolated execution (${this.language} runtime).${mountInfo}`);
+		if (this._workingDir) parts.push(`Default working directory: ${this._workingDir}.`);
+		parts.push(`Command timeout: ${Math.ceil(this.timeout / 1e3)}s.`);
+		parts.push(`Running as user: ${this.sandboxUser ?? "daytona"}.`);
+		if (this.volumeConfigs.length > 0) parts.push(`${this.volumeConfigs.length} volume(s) attached.`);
+		if (this.networkBlockAll) parts.push(`Network access is blocked.`);
+		return parts.join(" ");
+	}
+	/**
+	* Execute a command in the sandbox and return the result.
+	*/
+	async executeCommand(command, args = [], options = {}) {
+		await this.ensureRunning();
+		const fullCommand = args.length > 0 ? `${command} ${args.map(shellQuote).join(" ")}` : command;
+		return {
+			...await (await this.processes.spawn(fullCommand, options)).wait(),
+			command,
+			args
+		};
+	}
+	/**
+	* Bulk-write files into the sandbox filesystem via the SDK's native upload.
+	*/
+	async writeFiles(files) {
+		await this.ensureRunning();
+		await this.daytona.fs.uploadFiles(files.map((file) => ({
+			source: Buffer.isBuffer(file.content) ? file.content : Buffer.from(file.content),
+			destination: file.path
+		})));
+	}
+	/**
+	* Mount a filesystem at a path in the sandbox.
+	* Uses FUSE tools (s3fs, gcsfuse) to mount cloud storage.
+	*/
+	async mount(filesystem, mountPath) {
+		validateMountPath(mountPath);
+		if (!this._sandbox) throw new SandboxNotReadyError(this.id);
+		const sandbox = this._sandbox;
+		this.logger.debug(`${LOG_PREFIX} Mounting "${mountPath}"...`);
+		const config = filesystem.getMountConfig?.();
+		if (!config) {
+			const error = `Filesystem "${filesystem.id}" does not provide a mount config`;
+			this.logger.error(`${LOG_PREFIX} ${error}`);
+			this.mounts.set(mountPath, {
+				filesystem,
+				state: "error",
+				error
+			});
+			return {
+				success: false,
+				mountPath,
+				error
+			};
+		}
+		const existingMount = await this.checkExistingMount(mountPath, config);
+		if (existingMount === "matching") {
+			this.logger.debug(`${LOG_PREFIX} Detected existing mount for ${filesystem.provider} ("${filesystem.id}") at "${mountPath}" with correct config, skipping`);
+			this.mounts.set(mountPath, {
+				state: "mounted",
+				config
+			});
+			return {
+				success: true,
+				mountPath
+			};
+		} else if (existingMount === "mismatched") {
+			this.logger.debug(`${LOG_PREFIX} Config mismatch at "${mountPath}", unmounting to re-mount with new config...`);
+			await this.unmount(mountPath);
+		} else if (existingMount === "unmanaged") {
+			const error = `Mount path "${mountPath}" is already mounted by an unmanaged source`;
+			this.logger.error(`${LOG_PREFIX} ${error}`);
+			this.mounts.set(mountPath, {
+				filesystem,
+				state: "error",
+				config,
+				error
+			});
+			return {
+				success: false,
+				mountPath,
+				error
+			};
+		}
+		this.mounts.set(mountPath, {
+			filesystem,
+			state: "mounting",
+			config
+		});
+		this.logger.debug(`${LOG_PREFIX} Config type: ${config.type}`);
+		try {
+			const quotedPath = shellQuote(mountPath);
+			if ((await runCommand(sandbox, `[ -d ${quotedPath} ] && ! mountpoint -q ${quotedPath} 2>/dev/null && [ "$(ls -A ${quotedPath} 2>/dev/null)" ] && echo "non-empty" || echo "ok"`, { timeout: MOUNT_COMMAND_TIMEOUT_MS })).output.trim() === "non-empty") {
+				const error = `Cannot mount at ${mountPath}: directory exists and is not empty. Mounting would hide existing files. Use a different path or empty the directory first.`;
+				this.logger.error(`${LOG_PREFIX} ${error}`);
+				this.mounts.set(mountPath, {
+					filesystem,
+					state: "error",
+					config,
+					error
+				});
+				return {
+					success: false,
+					mountPath,
+					error
+				};
+			}
+		} catch {}
+		this.logger.debug(`${LOG_PREFIX} Creating mount directory for "${mountPath}"...`);
+		try {
+			const quotedPath = shellQuote(mountPath);
+			const mkdirResult = await runCommand(sandbox, `mountpoint -q ${quotedPath} 2>/dev/null && sudo mount -t tmpfs tmpfs ${quotedPath} 2>/dev/null; sudo mkdir -p ${quotedPath} 2>/dev/null; sudo chown $(id -u):$(id -g) ${quotedPath}`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+			if (mkdirResult.exitCode !== 0) {
+				const error = mkdirResult.output || "Failed to create mount directory";
+				this.logger.debug(`${LOG_PREFIX} mkdir error for "${mountPath}":`, error);
+				this.mounts.set(mountPath, {
+					filesystem,
+					state: "error",
+					config,
+					error
+				});
+				return {
+					success: false,
+					mountPath,
+					error
+				};
+			}
+		} catch (err) {
+			const error = `Failed to create mount directory: ${err}`;
+			this.mounts.set(mountPath, {
+				filesystem,
+				state: "error",
+				config,
+				error
+			});
+			return {
+				success: false,
+				mountPath,
+				error
+			};
+		}
+		const mountCtx = {
+			run: async (cmd, timeoutMs) => {
+				const result = await runCommand(sandbox, cmd, timeoutMs !== void 0 ? { timeout: timeoutMs } : void 0);
+				return {
+					exitCode: result.exitCode,
+					stdout: result.output,
+					stderr: result.exitCode !== 0 ? result.output : ""
+				};
+			},
+			writeFile: async (path, content) => {
+				await sandbox.fs.uploadFile(Buffer.from(content), path);
+			},
+			logger: this.logger
+		};
+		try {
+			switch (config.type) {
+				case "s3":
+					this.logger.debug(`${LOG_PREFIX} Mounting S3 at "${mountPath}"...`);
+					await mountS3(mountPath, config, mountCtx);
+					this.logger.debug(`${LOG_PREFIX} Mounted S3 bucket at ${mountPath}`);
+					break;
+				case "gcs":
+					this.logger.debug(`${LOG_PREFIX} Mounting GCS at "${mountPath}"...`);
+					await mountGCS(mountPath, config, mountCtx);
+					this.logger.debug(`${LOG_PREFIX} Mounted GCS bucket at ${mountPath}`);
+					break;
+				case "azure-blob":
+					this.logger.debug(`${LOG_PREFIX} Mounting Azure Blob at "${mountPath}"...`);
+					await mountAzure(mountPath, config, mountCtx);
+					this.logger.debug(`${LOG_PREFIX} Mounted Azure Blob container at ${mountPath}`);
+					break;
+				default: {
+					const error = `Unsupported mount type: ${config.type}`;
+					this.mounts.set(mountPath, {
+						filesystem,
+						state: "unsupported",
+						config,
+						error
+					});
+					return {
+						success: false,
+						mountPath,
+						error
+					};
+				}
+			}
+		} catch (error) {
+			this.logger.error(`${LOG_PREFIX} Error mounting "${filesystem.provider}" (${filesystem.id}) at "${mountPath}":`, error);
+			this.mounts.set(mountPath, {
+				filesystem,
+				state: "error",
+				config,
+				error: errorToString(error)
+			});
+			await runCommand(sandbox, `sudo rmdir ${shellQuote(mountPath)} 2>/dev/null || true`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+			this.logger.debug(`${LOG_PREFIX} Cleaned up directory after failed mount: ${mountPath}`);
+			return {
+				success: false,
+				mountPath,
+				error: errorToString(error)
+			};
+		}
+		this.mounts.set(mountPath, {
+			state: "mounted",
+			config
+		});
+		await this.writeMarkerFile(mountPath);
+		this.logger.debug(`${LOG_PREFIX} Mounted "${mountPath}"`);
+		return {
+			success: true,
+			mountPath
+		};
+	}
+	/**
+	* Unmount a filesystem from a path in the sandbox.
+	*/
+	async unmount(mountPath) {
+		validateMountPath(mountPath);
+		if (!this._sandbox) throw new SandboxNotReadyError(this.id);
+		const sandbox = this._sandbox;
+		this.logger.debug(`${LOG_PREFIX} Unmounting "${mountPath}"...`);
+		const quotedPath = shellQuote(mountPath);
+		await runCommand(sandbox, `sudo fusermount -u ${quotedPath} 2>/dev/null; sudo umount -l ${quotedPath} 2>/dev/null; mountpoint -q ${quotedPath} 2>/dev/null && { _p="/tmp/.mastra-defunct-$$"; sudo mkdir -p "$_p" && sudo mount --move ${quotedPath} "$_p" 2>/dev/null; sudo umount -l "$_p" 2>/dev/null; sudo rmdir "$_p" 2>/dev/null; }`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+		this.mounts.delete(mountPath);
+		const rmdirResult = await runCommand(sandbox, `rm -f ${shellQuote(`/tmp/.mastra-mounts/${this.mounts.markerFilename(mountPath)}`)} 2>/dev/null; sudo rmdir ${quotedPath} 2>&1`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+		if (rmdirResult.exitCode === 0) this.logger.debug(`${LOG_PREFIX} Unmounted and removed ${mountPath}`);
+		else this.logger.debug(`${LOG_PREFIX} Unmounted ${mountPath} (directory not removed: ${rmdirResult.output.trim() || "not empty"})`);
+	}
+	/**
+	* Unmount all stale mounts that are not in the expected mounts list.
+	* Also cleans up orphaned directories and marker files from failed mount attempts.
+	* Call this after reconnecting to an existing sandbox to clean up old mounts.
+	*/
+	async reconcileMounts(expectedMountPaths) {
+		if (!this._sandbox) return;
+		const sandbox = this._sandbox;
+		this.logger.debug(`${LOG_PREFIX} Reconciling mounts. Expected paths:`, expectedMountPaths);
+		let currentMounts = [];
+		try {
+			currentMounts = (await runCommand(sandbox, `grep -E 'fuse\\.(s3fs|gcsfuse|blobfuse2)' /proc/mounts | awk '{print $2}'`, { timeout: MOUNT_COMMAND_TIMEOUT_MS })).output.trim().split("\n").filter((p) => p.length > 0);
+		} catch (err) {
+			this.logger.debug(`${LOG_PREFIX} Could not read /proc/mounts: ${err}`);
+			return;
+		}
+		this.logger.debug(`${LOG_PREFIX} Current FUSE mounts in sandbox:`, currentMounts);
+		let markerFiles = [];
+		try {
+			markerFiles = (await runCommand(sandbox, "ls /tmp/.mastra-mounts/ 2>/dev/null || echo \"\"", { timeout: MOUNT_COMMAND_TIMEOUT_MS })).output.trim().split("\n").filter((f) => f.length > 0 && SAFE_MARKER_NAME.test(f));
+		} catch (err) {
+			this.logger.debug(`${LOG_PREFIX} Could not read marker files: ${err}`);
+		}
+		const managedMountPaths = /* @__PURE__ */ new Map();
+		for (const markerFile of markerFiles) {
+			const markerResult = await runCommand(sandbox, `cat "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null || echo ""`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+			const parsed = this.mounts.parseMarkerContent(markerResult.output.trim());
+			if (parsed && SAFE_MOUNT_PATH.test(parsed.path)) managedMountPaths.set(parsed.path, markerFile);
+		}
+		const staleMounts = currentMounts.filter((path) => !expectedMountPaths.includes(path));
+		for (const stalePath of staleMounts) if (managedMountPaths.has(stalePath)) {
+			this.logger.debug(`${LOG_PREFIX} Found stale managed FUSE mount at "${stalePath}", unmounting...`);
+			try {
+				await this.unmount(stalePath);
+			} catch (err) {
+				this.logger.debug(`${LOG_PREFIX} Failed to unmount stale mount at "${stalePath}": ${err}`);
+			}
+		} else this.logger.debug(`${LOG_PREFIX} Found external FUSE mount at "${stalePath}", leaving untouched`);
+		try {
+			const expectedMarkerFiles = new Set(expectedMountPaths.map((p) => this.mounts.markerFilename(p)));
+			const markerToPath = /* @__PURE__ */ new Map();
+			for (const [path, file] of managedMountPaths) markerToPath.set(file, path);
+			for (const markerFile of markerFiles) if (!expectedMarkerFiles.has(markerFile)) {
+				const mountPath = markerToPath.get(markerFile);
+				if (mountPath) {
+					if (!currentMounts.includes(mountPath)) {
+						this.logger.debug(`${LOG_PREFIX} Cleaning up orphaned marker and directory for ${mountPath}`);
+						await runCommand(sandbox, `rm -f "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null; sudo rmdir ${shellQuote(mountPath)} 2>/dev/null`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+					}
+				} else {
+					this.logger.debug(`${LOG_PREFIX} Removing malformed marker file: ${markerFile}`);
+					await runCommand(sandbox, `rm -f "/tmp/.mastra-mounts/${markerFile}" 2>/dev/null || true`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+				}
+			}
+		} catch {
+			this.logger.debug(`${LOG_PREFIX} Error during orphan cleanup (non-fatal)`);
+		}
+	}
+	/**
+	* Write marker file for detecting config changes on reconnect.
+	* Stores both the mount path and config hash in the file.
+	*/
+	async writeMarkerFile(mountPath) {
+		if (!this._sandbox) return;
+		const markerContent = this.mounts.getMarkerContent(mountPath);
+		if (!markerContent) return;
+		const markerPath = `/tmp/.mastra-mounts/${this.mounts.markerFilename(mountPath)}`;
+		try {
+			await runCommand(this._sandbox, "mkdir -p /tmp/.mastra-mounts", { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+			await this._sandbox.fs.uploadFile(Buffer.from(markerContent, "utf-8"), markerPath);
+		} catch {
+			this.logger.debug(`${LOG_PREFIX} Warning: Could not write marker file at ${markerPath}`);
+		}
+	}
+	/**
+	* Check if a path is already mounted and whether the config matches.
+	*
+	* @param mountPath - The mount path to check
+	* @param newConfig - The new config to compare against the stored config
+	* @returns 'not_mounted' | 'matching' | 'mismatched' | 'unmanaged'
+	*/
+	async checkExistingMount(mountPath, newConfig) {
+		if (!this._sandbox) throw new SandboxNotReadyError(this.id);
+		const sandbox = this._sandbox;
+		try {
+			if ((await runCommand(sandbox, `mountpoint -q ${shellQuote(mountPath)} && echo "mounted" || echo "not mounted"`, { timeout: MOUNT_COMMAND_TIMEOUT_MS })).output.trim() !== "mounted") return "not_mounted";
+		} catch {
+			return "not_mounted";
+		}
+		const markerPath = `/tmp/.mastra-mounts/${this.mounts.markerFilename(mountPath)}`;
+		let parsed;
+		try {
+			const markerResult = await runCommand(sandbox, `cat ${shellQuote(markerPath)} 2>/dev/null || echo ""`, { timeout: MOUNT_COMMAND_TIMEOUT_MS });
+			parsed = this.mounts.parseMarkerContent(markerResult.output.trim());
+		} catch {
+			return "unmanaged";
+		}
+		if (!parsed) return "unmanaged";
+		const newConfigHash = this.mounts.computeConfigHash(newConfig);
+		this.logger.debug(`${LOG_PREFIX} Marker check - stored hash: "${parsed.configHash}", new config hash: "${newConfigHash}"`);
+		if (parsed.path === mountPath && parsed.configHash === newConfigHash) return "matching";
+		return "mismatched";
+	}
+	/**
+	* Try to find and reconnect to an existing Daytona sandbox by ID.
+	* Returns the sandbox if found and usable, or null if a fresh one should
+	* be created.
+	*/
+	async detectWorkingDir() {
+		if (!this._sandbox) return;
+		try {
+			const dir = (await runCommand(this._sandbox, "pwd", { timeout: MOUNT_COMMAND_TIMEOUT_MS })).output?.trim();
+			if (dir) {
+				this._workingDir = dir;
+				this.logger.debug(`${LOG_PREFIX} Detected working directory: ${dir}`);
+			}
+		} catch {
+			this.logger.debug(`${LOG_PREFIX} Could not detect working directory, will omit from instructions`);
+		}
+	}
+	/**
+	* Look up the existing Daytona sandbox by identity WITHOUT starting it.
+	* Used for detached (cross-process) networking/stop/destroy so those
+	* operations never wake a stopped sandbox. Returns null when not found.
+	*/
+	async lookupDetachedSandbox() {
+		const lookupKey = this._daytonaSandboxId ?? this.sandboxName;
+		if (!lookupKey) return null;
+		if (!this._daytona) this._daytona = new Daytona(this.connectionOpts);
+		try {
+			return await this._daytona.get(lookupKey);
+		} catch (error) {
+			if (error instanceof DaytonaNotFoundError) return null;
+			throw error;
+		}
+	}
+	async findExistingSandbox() {
+		const DEAD_STATES = [
+			SandboxState.DESTROYED,
+			SandboxState.DESTROYING,
+			SandboxState.ERROR,
+			SandboxState.BUILD_FAILED
+		];
+		const lookupKey = this._daytonaSandboxId ?? this.sandboxName;
+		if (!lookupKey) return null;
+		let sandbox;
+		try {
+			sandbox = await this._daytona.get(lookupKey);
+		} catch (error) {
+			if (error instanceof DaytonaNotFoundError) {
+				this._daytonaSandboxId = void 0;
+				return null;
+			}
+			throw error;
+		}
+		const state = sandbox.state;
+		if (state && DEAD_STATES.includes(state)) {
+			this.logger.debug(`${LOG_PREFIX} Existing sandbox ${sandbox.id} is dead (${state}), deleting and creating fresh`);
+			try {
+				await this._daytona.delete(sandbox);
+			} catch {}
+			return null;
+		}
+		if (state !== SandboxState.STARTED) {
+			this.logger.debug(`${LOG_PREFIX} Restarting sandbox ${sandbox.id} (state: ${state})`);
+			await this.waitForStableStateAndStart(sandbox);
+		}
+		return sandbox;
+	}
+	/**
+	* Transitional states where the Daytona API will reject start() with
+	* "State change in progress". We poll until the sandbox reaches a stable
+	* state before attempting start().
+	*/
+	static TRANSITIONAL_STATES = [
+		SandboxState.STARTING,
+		SandboxState.STOPPING,
+		SandboxState.CREATING,
+		SandboxState.RESTORING,
+		SandboxState.ARCHIVING,
+		SandboxState.RESIZING,
+		SandboxState.PULLING_SNAPSHOT,
+		SandboxState.BUILDING_SNAPSHOT
+	];
+	/**
+	* Wait for the sandbox to leave a transitional state, then start it if needed.
+	* Polls every 2s for up to 120s. If the sandbox reaches STARTED on its own
+	* (e.g. it was STARTING), we skip the start() call. If start() still fails
+	* with "State change in progress", we retry with backoff.
+	*/
+	async waitForStableStateAndStart(sandbox) {
+		const MAX_WAIT_MS = 12e4;
+		const POLL_INTERVAL_MS = 2e3;
+		const deadline = Date.now() + MAX_WAIT_MS;
+		let current = sandbox;
+		while (current.state && DaytonaSandbox.TRANSITIONAL_STATES.includes(current.state) && Date.now() < deadline) {
+			this.logger.debug(`${LOG_PREFIX} Sandbox ${current.id} is in transitional state (${current.state}), waiting...`);
+			await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+			current = await this._daytona.get(current.id);
+		}
+		if (current.state === SandboxState.STARTED) {
+			Object.assign(sandbox, current);
+			return;
+		}
+		while (Date.now() < deadline) try {
+			await this._daytona.start(current);
+			return;
+		} catch (error) {
+			if ((error instanceof Error ? error.message : String(error)).includes("State change in progress") && Date.now() < deadline) {
+				this.logger.debug(`${LOG_PREFIX} start() returned "State change in progress", retrying...`);
+				await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+				current = await this._daytona.get(current.id);
+				if (current.state === SandboxState.STARTED) {
+					Object.assign(sandbox, current);
+					return;
+				}
+				continue;
+			}
+			throw error;
+		}
+		await this._daytona.start(current);
+	}
+	/**
+	* Check if an error indicates the sandbox is dead/gone.
+	* Uses DaytonaNotFoundError from the SDK when available,
+	* with string fallback for edge cases.
+	*
+	* String patterns observed in @daytonaio/sdk@0.143.0 error messages.
+	* Update if SDK error messages change in future versions.
+	*/
+	isSandboxDeadError(error) {
+		if (!error) return false;
+		if (error instanceof DaytonaNotFoundError) return true;
+		const errorStr = String(error);
+		return SANDBOX_DEAD_PATTERNS.some((pattern) => pattern.test(errorStr));
+	}
+	/**
+	* Handle sandbox timeout by clearing the instance and resetting state.
+	*/
+	handleSandboxTimeout() {
+		this._sandbox = null;
+		if (this.mounts) {
+			for (const [path, entry] of this.mounts.entries) if (entry.state === "mounted" || entry.state === "mounting") this.mounts.set(path, { state: "pending" });
+		}
+		this.status = "stopped";
+	}
+	/**
+	* Execute a function, retrying once if the sandbox is found to be dead.
+	* Used by DaytonaProcessManager to handle stale sandboxes transparently.
+	*/
+	async retryOnDead(fn) {
+		try {
+			return await fn();
+		} catch (error) {
+			if (this.isSandboxDeadError(error) && !this._isRetrying) {
+				this.handleSandboxTimeout();
+				this._isRetrying = true;
+				try {
+					await this.ensureRunning();
+					return await fn();
+				} finally {
+					this._isRetrying = false;
+				}
+			}
+			throw error;
+		}
+	}
 };
-
+//#endregion
 export { DaytonaProcessManager, DaytonaSandbox };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map