@myagentroam/agent 0.9.77 → 0.9.78

package/dist/model/openai-responses.js

@@ -837,6 +837,7 @@ function responsesRequestBody(configuration, request, messages, prefixIdentity =
         stream: true,
         parallel_tool_calls: !lite,
         store: false,
+        text: { verbosity: 'low' },
         include: ['reasoning.encrypted_content'],
         ...(request.promptCacheKey ? { prompt_cache_key: request.promptCacheKey } : {}),
         reasoning: {

package/dist/prompts/index.d.ts

@@ -2,7 +2,7 @@ import type { ExecutionMode } from '../sdk/types.js';
 import { type ExecutionBudgetPromptState } from './execution-budget.js';
 import { type RetainedSessionResources } from './resources.js';
 import { type CurrentAgentModel, type SubagentModelOption } from './subagent.js';
-export declare const MAR_AGENT_PROMPT_VERSION = "1.47";
+export declare const MAR_AGENT_PROMPT_VERSION = "1.48";
 export declare function buildSystemPrompt(input: {
     mode: ExecutionMode;
     platform: string;

package/dist/prompts/index.js

@@ -6,7 +6,7 @@ import { outputStylePrompt } from './output.js';
 import { retainedSessionResourcesPrompt } from './resources.js';
 import { subagentModelOptionsPrompt, subagentPrompt, currentAgentModelPrompt } from './subagent.js';
 import { interactionPrompt, longRunningPrompt, safetyPrompt, toolUsagePrompt, workflowPrompt } from './workflow.js';
-export const MAR_AGENT_PROMPT_VERSION = '1.47';
+export const MAR_AGENT_PROMPT_VERSION = '1.48';
 export function buildSystemPrompt(input) {
     const toolNames = new Set(input.tools);
     const hasLongRunningCapability = [

package/dist/prompts/modes.js

@@ -3,7 +3,7 @@ export function modePrompt(mode, input) {
         return '';
     const investigationGuidance = input.forceFinalize
         ? 'Use only evidence already gathered; do not start or continue Plan exploration.'
-        : 'Resolve discoverable facts through targeted read-only investigation. Ask about user-owned preferences and tradeoffs early when workspace evidence cannot decide them.';
+        : 'Resolve discoverable facts through targeted read-only investigation. Ask about user-owned preferences and tradeoffs early when they cannot be inferred from the request, conversation, or workspace evidence.';
     const decisionGuidance = input.questionAvailable
         ? 'Use question for unresolved choices that materially change the result; do not finalize the plan while such choices remain. Do not invent support for multiple outcomes or silently choose a default to avoid asking.'
         : input.forceFinalize
@@ -11,7 +11,7 @@ export function modePrompt(mode, input) {
             : 'Ask a concise plain-text question for unresolved user-owned choices that materially change the result instead of finalizing an ambiguous plan. Do not invent support for multiple outcomes or silently choose a default.';
     const finalGuidance = input.forceFinalize
         ? 'Return only the concise staged plan now, distinguishing verified conclusions from incomplete work and unresolved decisions. Do not ask whether to proceed or claim unresolved work is complete.'
-        : 'Once the plan is decision-complete, return only a concise, actionable plan. Include the implementation and verification details needed to execute it, without exhaustive file lists or code drafts. Do not ask whether to proceed or claim planned work is completed.';
+        : 'Once the plan is decision-complete, return only a concise, actionable plan. Break the work into meaningful, logically ordered deliverables that are easy to verify. Do not pad the plan with filler or obvious steps. Include the implementation and verification detail needed to execute it, without drafting the implementation itself. Do not ask whether to proceed or claim planned work is completed.';
     return `# Plan mode
 Use tools only for read-only investigation that reduces uncertainty and improves the plan. Do not create, modify, delete, rename, or move files, and do not run commands intended to mutate repository-tracked state or implement the requested work. This is behavioral guidance, not a security boundary; the normal tools and approval rules remain available.
 

package/dist/prompts/output.d.ts

@@ -1,2 +1,2 @@
-export declare const outputStylePrompt = "# Output and communication style\nBe direct, natural, and concise. Default to a brief teammate update rather than a report; expand when the user requests detail or when complexity and multiple distinct findings need grouping or explanation. Lead with the result and report only details that materially support or qualify it, including actual verification, material risks, and unfinished work when relevant. Use plain sentences or a short list for simple results. Avoid unnecessary repetition, repeating progress, dumping logs, or adding empty sections. For a requested review, lead with actionable findings ordered by severity and file evidence; if none were found, say so and note validation gaps. Preserve exact paths, identifiers, error codes, citations, and useful line locations when they are evidence. Never expose hidden reasoning.";
+export declare const outputStylePrompt = "# Output and communication style\nWrite naturally as a concise teammate. Match the user's tone and assumed background, state the main point early, and develop only the explanation and detail the user needs. Use plain language, active voice, and connected prose. Use the minimum formatting needed for clarity; prefer concise paragraphs, and use lists only when the information is genuinely parallel, sequential, or easier to compare. Include technical details only when they help explain or substantiate the point. For completed work, lead with the outcome, explain material changes and limits, and summarize routine verification instead of listing every check. For a requested review, lead with actionable findings ordered by severity and file evidence; if none were found, say so and note validation gaps. Preserve exact paths, identifiers, error codes, citations, and useful line locations when they are evidence. Focus final answers on the most important information and avoid long-winded explanations unless necessary. Never expose hidden reasoning.";
 export declare const modelOutputContinuationMessage = "Continue the previous response from exactly where it stopped. Do not repeat completed content.";

package/dist/prompts/output.js

@@ -1,2 +1,2 @@
-export const outputStylePrompt = '# Output and communication style\nBe direct, natural, and concise. Default to a brief teammate update rather than a report; expand when the user requests detail or when complexity and multiple distinct findings need grouping or explanation. Lead with the result and report only details that materially support or qualify it, including actual verification, material risks, and unfinished work when relevant. Use plain sentences or a short list for simple results. Avoid unnecessary repetition, repeating progress, dumping logs, or adding empty sections. For a requested review, lead with actionable findings ordered by severity and file evidence; if none were found, say so and note validation gaps. Preserve exact paths, identifiers, error codes, citations, and useful line locations when they are evidence. Never expose hidden reasoning.';
+export const outputStylePrompt = "# Output and communication style\nWrite naturally as a concise teammate. Match the user's tone and assumed background, state the main point early, and develop only the explanation and detail the user needs. Use plain language, active voice, and connected prose. Use the minimum formatting needed for clarity; prefer concise paragraphs, and use lists only when the information is genuinely parallel, sequential, or easier to compare. Include technical details only when they help explain or substantiate the point. For completed work, lead with the outcome, explain material changes and limits, and summarize routine verification instead of listing every check. For a requested review, lead with actionable findings ordered by severity and file evidence; if none were found, say so and note validation gaps. Preserve exact paths, identifiers, error codes, citations, and useful line locations when they are evidence. Focus final answers on the most important information and avoid long-winded explanations unless necessary. Never expose hidden reasoning.";
 export const modelOutputContinuationMessage = 'Continue the previous response from exactly where it stopped. Do not repeat completed content.';

package/dist/sandbox/linux/bubblewrap-sandbox-executor.d.ts

@@ -0,0 +1,18 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { LocalProcessExecutor, LocalProcessSpawnRequest } from '../../host/local-process-executor.js';
+import { type BubblewrapSandboxExecutorOptions } from './profile.js';
+/** Compiles one process request into the fixed Linux Bubblewrap policy. */
+export declare class BubblewrapSandboxExecutor implements LocalProcessExecutor {
+    #private;
+    private readonly options;
+    constructor(options: BubblewrapSandboxExecutorOptions);
+    spawn(request: LocalProcessSpawnRequest): Promise<ChildProcessWithoutNullStreams>;
+}
+export declare function probeBubblewrapSandbox(options?: {
+    readonly bubblewrapPath?: string;
+    readonly profile?: BubblewrapSandboxExecutorOptions['profile'];
+    readonly cwd?: string;
+}): Promise<{
+    readonly version: string;
+    readonly policyVersion: number;
+}>;

package/dist/sandbox/linux/bubblewrap-sandbox-executor.js

@@ -0,0 +1,605 @@
+import { execFile, spawn } from 'node:child_process';
+import { closeSync, existsSync, lstatSync, openSync, readlinkSync, rmSync } from 'node:fs';
+import { lstat, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+import { MarAgentError } from '../../error.js';
+import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';
+const execFileAsync = promisify(execFile);
+const DEFAULT_BUBBLEWRAP_PATH = '/usr/bin/bwrap';
+const SANDBOX_PATH = '/runtime/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const CURSOR_SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const SANDBOX_CPU_SECONDS = 300;
+const SANDBOX_PROCESS_LIMIT = 64;
+const SANDBOX_OPEN_FILE_LIMIT = 256;
+const SANDBOX_FILE_SIZE_BYTES = 1024 * 1024 * 1024;
+const SAFE_ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+const GENERATED_IMAGES_SANDBOX_ROOT = '/home/mar/.mar/agent/sessions';
+// Fontconfig and LibreOffice resolve required host configuration through absolute /etc paths
+// and /usr symlinks. Keep this allowlist read-only and never broaden it to the full /etc tree.
+const READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES = ['/etc/fonts', '/etc/libreoffice'];
+const FORBIDDEN_ENVIRONMENT_NAMES = new Set([
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'NODE_OPTIONS',
+    'PYTHONPATH',
+    'PYTHONHOME',
+    'BASH_ENV',
+    'ENV',
+    'SSH_AUTH_SOCK'
+]);
+const RESERVED_SANDBOX_ROOTS = [
+    '/home/mar',
+    '/runtime',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib64',
+    '/etc',
+    '/proc',
+    '/dev',
+    '/run',
+    '/tmp'
+];
+/** Compiles one process request into the fixed Linux Bubblewrap policy. */
+export class BubblewrapSandboxExecutor {
+    options;
+    #bubblewrapPath;
+    constructor(options) {
+        this.options = options;
+        this.#bubblewrapPath = options.bubblewrapPath ?? DEFAULT_BUBBLEWRAP_PATH;
+    }
+    async spawn(request) {
+        request.signal?.throwIfAborted();
+        if (process.platform !== 'linux')
+            throw unavailable();
+        validateProfile(this.options.profile);
+        await validateBackend(this.#bubblewrapPath);
+        const mounts = await this.#mounts();
+        const cwd = await workingDirectory(request, mounts, this.options.profile.workingDirectory);
+        const command = sandboxCommand(request, mounts);
+        const launchDirectory = await mkdtemp(join(tmpdir(), 'mar-agent-bwrap-launch-'));
+        const argumentPath = join(launchDirectory, 'arguments');
+        const seccompPath = join(launchDirectory, 'seccomp.bpf');
+        try {
+            const arguments_ = this.#arguments(mounts, cwd, request);
+            await Promise.all([
+                writeFile(argumentPath, `${arguments_.join('\0')}\0`, { mode: 0o600, flag: 'wx' }),
+                writeFile(seccompPath, seccompFilter(process.arch), { mode: 0o600, flag: 'wx' })
+            ]);
+        }
+        catch (error) {
+            await rm(launchDirectory, { recursive: true, force: true }).catch(() => undefined);
+            throw error instanceof MarAgentError ? error : policyInvalid(error);
+        }
+        let argumentFd;
+        let seccompFd;
+        try {
+            argumentFd = openSync(argumentPath, 'r');
+            seccompFd = openSync(seccompPath, 'r');
+            rmSync(launchDirectory, { recursive: true, force: true });
+            request.signal?.throwIfAborted();
+            try {
+                const child = spawn(this.#bubblewrapPath, ['--args', '3', '--', ...command], {
+                    cwd: '/',
+                    shell: false,
+                    stdio: ['pipe', 'pipe', 'pipe', argumentFd, seccompFd],
+                    windowsHide: true,
+                    detached: request.detached,
+                    env: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }
+                });
+                await waitForSpawn(child);
+                return child;
+            }
+            catch (error) {
+                throw unavailable(error);
+            }
+        }
+        finally {
+            if (argumentFd !== undefined)
+                closeSync(argumentFd);
+            if (seccompFd !== undefined)
+                closeSync(seccompFd);
+            rmSync(launchDirectory, { recursive: true, force: true });
+        }
+    }
+    async #mounts() {
+        const mounts = [];
+        for (const definition of this.options.profile.mounts ?? []) {
+            mounts.push({
+                source: await secureDirectory(definition.source),
+                destination: sandboxDestination(definition.destination, definition.access),
+                access: definition.access
+            });
+        }
+        if (this.options.profile.temporaryDirectory?.kind === 'MOUNT')
+            mounts.push({
+                source: await secureDirectory(this.options.profile.temporaryDirectory.source),
+                destination: '/tmp',
+                access: 'READ_WRITE'
+            });
+        for (const [index, mount] of mounts.entries()) {
+            for (const other of mounts.slice(index + 1)) {
+                if (mount.destination === other.destination)
+                    throw policyInvalid();
+                const parent = withinSandboxPath(mount.destination, other.destination)
+                    ? mount
+                    : withinSandboxPath(other.destination, mount.destination)
+                        ? other
+                        : undefined;
+                if (parent !== undefined) {
+                    const child = parent === mount ? other : mount;
+                    if (parent.access !== 'READ_ONLY' || child.access !== 'READ_WRITE')
+                        throw policyInvalid();
+                }
+                if (mount.source === other.source) {
+                    if (mount.access !== other.access)
+                        throw policyInvalid();
+                    continue;
+                }
+                if (within(mount.source, other.source) || within(other.source, mount.source))
+                    throw policyInvalid();
+            }
+        }
+        const ordered = [...mounts].sort(compareMountDestinations);
+        await prepareNestedMountDestinations(ordered);
+        return ordered;
+    }
+    #arguments(mounts, cwd, request) {
+        const networkMode = this.options.profile.networkMode ?? 'NONE';
+        const temporaryDirectory = this.options.profile.temporaryDirectory ?? { kind: 'EPHEMERAL' };
+        const args = [
+            '--unshare-user',
+            '--unshare-pid',
+            ...(networkMode === 'UNRESTRICTED' ? [] : ['--unshare-net']),
+            '--unshare-uts',
+            '--unshare-ipc',
+            '--unshare-cgroup-try',
+            '--disable-userns',
+            '--die-with-parent',
+            '--new-session',
+            '--cap-drop',
+            'ALL',
+            '--hostname',
+            'mar-hosted',
+            '--clearenv',
+            '--setenv',
+            'PATH',
+            SANDBOX_PATH,
+            '--setenv',
+            'HOME',
+            '/home/mar',
+            '--setenv',
+            'LANG',
+            'C.UTF-8',
+            '--setenv',
+            'LC_ALL',
+            'C.UTF-8',
+            '--setenv',
+            'TMPDIR',
+            '/tmp',
+            '--tmpfs',
+            '/',
+            ...runtimeMountArguments(),
+            ...sandboxDirectoryArguments(mounts),
+            ...(temporaryDirectory.kind === 'EPHEMERAL' ? ['--tmpfs', '/tmp'] : []),
+            '--proc',
+            '/proc',
+            '--dev',
+            '/dev',
+            '--tmpfs',
+            '/run'
+        ];
+        for (const mount of mounts)
+            args.push(mount.access === 'READ_WRITE' ? '--bind' : '--ro-bind', mount.source, mount.destination);
+        if (request.owner !== undefined) {
+            if (!CURSOR_SAFE_ID.test(request.owner.sessionId) ||
+                !CURSOR_SAFE_ID.test(request.owner.executionId))
+                throw policyInvalid();
+            args.push('--setenv', 'MAR_AGENT_SESSION_ID', request.owner.sessionId, '--setenv', 'MAR_AGENT_EXECUTION_ID', request.owner.executionId);
+        }
+        for (const [name, value] of explicitEnvironment(request))
+            args.push('--setenv', name, value);
+        args.push('--seccomp', '4', '--chdir', cwd);
+        return args;
+    }
+}
+export async function probeBubblewrapSandbox(options = {}) {
+    if (process.platform !== 'linux')
+        throw unavailable();
+    const bubblewrapPath = options.bubblewrapPath ?? DEFAULT_BUBBLEWRAP_PATH;
+    const versionOutput = await execFileAsync(bubblewrapPath, ['--version'], {
+        timeout: 5_000,
+        windowsHide: true
+    }).catch((error) => {
+        throw unavailable(error);
+    });
+    const version = /^bubblewrap\s+([0-9]+(?:\.[0-9]+){1,3})\s*$/u.exec(versionOutput.stdout)?.[1];
+    if (version === undefined)
+        throw unavailable();
+    const executor = new BubblewrapSandboxExecutor({
+        bubblewrapPath,
+        profile: options.profile ?? {
+            policyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION
+        }
+    });
+    const child = await executor.spawn({
+        command: '/bin/true',
+        cwd: options.cwd ?? '/',
+        shell: false,
+        environment: {},
+        detached: true,
+        owner: { sessionId: 'sandbox-probe', executionId: 'sandbox-probe' }
+    });
+    const result = await waitForProbe(child);
+    if (result.code !== 0)
+        throw unavailable(new Error(result.stderr));
+    return { version, policyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION };
+}
+async function waitForProbe(child) {
+    const chunks = [];
+    let bytes = 0;
+    child.stderr.on('data', (chunk) => {
+        if (bytes >= 8_192)
+            return;
+        const remaining = 8_192 - bytes;
+        chunks.push(chunk.subarray(0, remaining));
+        bytes += Math.min(chunk.length, remaining);
+    });
+    child.stdin.end();
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(unavailable(new Error('Sandbox probe timed out.')));
+        }, 5_000);
+        timer.unref();
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(unavailable(error));
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            resolve({ code, stderr: Buffer.concat(chunks).toString('utf8') });
+        });
+    });
+}
+async function waitForSpawn(child) {
+    await new Promise((resolve, reject) => {
+        const spawned = () => {
+            child.off('error', failed);
+            resolve();
+        };
+        const failed = (error) => {
+            child.off('spawn', spawned);
+            reject(unavailable(error));
+        };
+        child.once('spawn', spawned);
+        child.once('error', failed);
+    });
+}
+async function validateBackend(path) {
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink() || (metadata.mode & 0o111) === 0)
+            throw unavailable();
+    }
+    catch (error) {
+        if (error instanceof MarAgentError)
+            throw error;
+        throw unavailable(error);
+    }
+}
+async function secureDirectory(path) {
+    if (!isAbsolute(path))
+        throw policyInvalid();
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            throw policyInvalid();
+        const canonical = await realpath(path);
+        if (canonical !== resolve(path))
+            throw policyInvalid();
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof MarAgentError)
+            throw error;
+        throw policyInvalid(error);
+    }
+}
+function validateProfile(profile) {
+    if (profile === null ||
+        typeof profile !== 'object' ||
+        profile.policyVersion !== LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION ||
+        (profile.networkMode !== undefined &&
+            profile.networkMode !== 'NONE' &&
+            profile.networkMode !== 'UNRESTRICTED') ||
+        (profile.mounts !== undefined && !Array.isArray(profile.mounts)))
+        throw policyInvalid();
+    for (const mount of profile.mounts ?? []) {
+        if (mount === null ||
+            typeof mount !== 'object' ||
+            typeof mount.source !== 'string' ||
+            typeof mount.destination !== 'string' ||
+            (mount.access !== 'READ_ONLY' && mount.access !== 'READ_WRITE'))
+            throw policyInvalid();
+    }
+    const temporaryDirectory = profile.temporaryDirectory;
+    if (temporaryDirectory !== undefined &&
+        (temporaryDirectory === null ||
+            typeof temporaryDirectory !== 'object' ||
+            (temporaryDirectory.kind !== 'EPHEMERAL' &&
+                (temporaryDirectory.kind !== 'MOUNT' || typeof temporaryDirectory.source !== 'string'))))
+        throw policyInvalid();
+    const workingDirectory = profile.workingDirectory;
+    if (workingDirectory !== undefined &&
+        (workingDirectory === null ||
+            typeof workingDirectory !== 'object' ||
+            (workingDirectory.kind !== 'REQUEST' &&
+                (workingDirectory.kind !== 'SANDBOX' || typeof workingDirectory.path !== 'string'))))
+        throw policyInvalid();
+}
+async function workingDirectory(request, mounts, configuration) {
+    const selected = configuration ?? { kind: 'SANDBOX', path: '/tmp' };
+    if (selected.kind === 'REQUEST')
+        return await sandboxPath(request.cwd, mounts);
+    const path = normalizedSandboxPath(selected.path);
+    if (path === '/tmp' || path === '/home/mar')
+        return path;
+    const mount = [...mounts]
+        .sort((left, right) => right.destination.length - left.destination.length)
+        .find((candidate) => path === candidate.destination || withinSandboxPath(candidate.destination, path));
+    if (mount === undefined)
+        throw policyInvalid();
+    const suffix = posix.relative(mount.destination, path).split('/').filter(Boolean);
+    await secureDirectory(join(mount.source, ...suffix));
+    return path;
+}
+async function sandboxPath(path, mounts) {
+    const canonical = await secureDirectory(path);
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount === undefined)
+        throw policyInvalid();
+    const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+    return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+}
+function sandboxDestination(path, access) {
+    const normalized = normalizedSandboxPath(path);
+    if (generatedImagesSandboxPath(normalized)) {
+        if (access !== 'READ_ONLY')
+            throw policyInvalid();
+        return normalized;
+    }
+    if (normalized === '/' ||
+        RESERVED_SANDBOX_ROOTS.some((root) => normalized === root ||
+            withinSandboxPath(root, normalized) ||
+            withinSandboxPath(normalized, root)))
+        throw policyInvalid();
+    return normalized;
+}
+function normalizedSandboxPath(path) {
+    if (!path.startsWith('/') ||
+        path.includes('\0') ||
+        path.includes('\\') ||
+        posix.normalize(path) !== path ||
+        posix.resolve(path) !== path)
+        throw policyInvalid();
+    return path;
+}
+function sandboxCommand(request, mounts) {
+    const command = request.shell === undefined || request.shell === false
+        ? [sandboxExecutable(request.command, mounts), ...(request.args ?? [])]
+        : [
+            sandboxExecutable(typeof request.shell === 'string' ? request.shell : '/bin/sh', mounts),
+            '-c',
+            request.command,
+            ...(request.args ?? [])
+        ];
+    return [
+        '/usr/bin/prlimit',
+        `--cpu=${SANDBOX_CPU_SECONDS}:${SANDBOX_CPU_SECONDS}`,
+        `--nproc=${SANDBOX_PROCESS_LIMIT}:${SANDBOX_PROCESS_LIMIT}`,
+        `--nofile=${SANDBOX_OPEN_FILE_LIMIT}:${SANDBOX_OPEN_FILE_LIMIT}`,
+        `--fsize=${SANDBOX_FILE_SIZE_BYTES}:${SANDBOX_FILE_SIZE_BYTES}`,
+        '--',
+        ...command
+    ];
+}
+function sandboxExecutable(command, mounts) {
+    if (!isAbsolute(command))
+        return command;
+    const canonical = resolve(command);
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr' &&
+        (canonical === nodeRuntimeDirectory || within(nodeRuntimeDirectory, canonical))) {
+        const suffix = relative(nodeRuntimeDirectory, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? '/runtime/node' : posix.join('/runtime/node', ...suffix);
+    }
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount !== undefined) {
+        const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+    }
+    if (['/usr', '/bin', '/sbin', '/lib', '/lib64'].some((root) => canonical === root || within(root, canonical)))
+        return canonical;
+    throw policyInvalid();
+}
+function explicitEnvironment(request) {
+    const entries = [];
+    const seen = new Set();
+    for (const name of request.environmentKeys ?? []) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        if (!SAFE_ENVIRONMENT_NAME.test(name))
+            throw policyInvalid();
+        if (FORBIDDEN_ENVIRONMENT_NAMES.has(name))
+            continue;
+        const value = request.environment[name];
+        if (typeof value !== 'string' || value.includes('\0') || Buffer.byteLength(value) > 32_768)
+            throw policyInvalid();
+        entries.push([name, value]);
+    }
+    return entries;
+}
+function generatedImagesSandboxPath(path) {
+    const segments = posix.relative(GENERATED_IMAGES_SANDBOX_ROOT, path).split('/').filter(Boolean);
+    return (withinSandboxPath(GENERATED_IMAGES_SANDBOX_ROOT, path) &&
+        segments.length === 2 &&
+        safePathSegment(segments[0]) &&
+        segments[1] === 'generated_images');
+}
+function safePathSegment(value) {
+    return (value.length > 0 &&
+        value.length <= 255 &&
+        value !== '.' &&
+        value !== '..' &&
+        !value.includes('/') &&
+        !value.includes('\\'));
+}
+function compareMountDestinations(left, right) {
+    const depth = left.destination.split('/').filter(Boolean).length -
+        right.destination.split('/').filter(Boolean).length;
+    return depth === 0 ? left.destination.localeCompare(right.destination, 'en-US') : depth;
+}
+async function prepareNestedMountDestinations(mounts) {
+    for (const [index, mount] of mounts.entries()) {
+        const parent = mounts
+            .slice(0, index)
+            .filter((candidate) => withinSandboxPath(candidate.destination, mount.destination))
+            .sort((left, right) => right.destination.length - left.destination.length)[0];
+        if (parent === undefined)
+            continue;
+        const suffix = relative(parent.destination, mount.destination).split(sep).filter(Boolean);
+        const target = join(parent.source, ...suffix);
+        try {
+            const metadata = await lstat(target);
+            if (!metadata.isDirectory() ||
+                metadata.isSymbolicLink() ||
+                (await realpath(target)) !== resolve(target))
+                throw policyInvalid();
+        }
+        catch (error) {
+            if (error instanceof MarAgentError)
+                throw error;
+            throw policyInvalid(error);
+        }
+    }
+}
+function sandboxDirectoryArguments(mounts) {
+    const directories = new Set(['/home', '/home/mar']);
+    for (const mount of mounts) {
+        const segments = mount.destination.split('/').filter(Boolean);
+        let current = '';
+        for (const segment of segments) {
+            current = `${current}/${segment}`;
+            directories.add(current);
+        }
+    }
+    return [...directories]
+        .sort((left, right) => {
+        const depth = left.split('/').filter(Boolean).length - right.split('/').filter(Boolean).length;
+        return depth === 0 ? left.localeCompare(right, 'en-US') : depth;
+    })
+        .flatMap((directory) => ['--dir', directory]);
+}
+function runtimeMountArguments() {
+    const args = [];
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr')
+        args.push('--dir', '/runtime', '--dir', '/runtime/node', '--ro-bind', nodeRuntimeDirectory, '/runtime/node');
+    for (const path of ['/usr', '/bin', '/sbin', '/lib', '/lib64']) {
+        if (!existsSync(path))
+            continue;
+        const metadata = lstatSync(path);
+        if (metadata.isSymbolicLink())
+            args.push('--symlink', readlinkSync(path), path);
+        else if (metadata.isDirectory())
+            args.push('--ro-bind', path, path);
+    }
+    for (const path of READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES) {
+        if (!existsSync(path) || !lstatSync(path).isDirectory())
+            continue;
+        args.push('--ro-bind', path, path);
+    }
+    for (const path of [
+        '/etc/host.conf',
+        '/etc/hosts',
+        '/etc/ld.so.cache',
+        '/etc/resolv.conf',
+        '/etc/passwd',
+        '/etc/group',
+        '/etc/nsswitch.conf',
+        '/etc/localtime',
+        '/etc/ssl/certs'
+    ]) {
+        if (existsSync(path))
+            args.push('--ro-bind', path, path);
+    }
+    return args;
+}
+function seccompFilter(architecture) {
+    const policy = syscallPolicy(architecture);
+    const filters = [
+        [0x20, 0, 0, 4],
+        [0x15, 1, 0, policy.auditArchitecture],
+        [0x06, 0, 0, 0x80000000],
+        [0x20, 0, 0, 0]
+    ];
+    if (architecture === 'x64')
+        filters.push([0x54, 0, 0, 0x40000000], [0x15, 1, 0, 0], [0x06, 0, 0, 0x80000000], [0x20, 0, 0, 0]);
+    for (const syscall of policy.blockedSyscalls)
+        filters.push([0x15, 0, 1, syscall], [0x06, 0, 0, 0x00050001]);
+    filters.push([0x06, 0, 0, 0x7fff0000]);
+    const buffer = Buffer.alloc(filters.length * 8);
+    for (const [index, [code, jumpTrue, jumpFalse, value]] of filters.entries()) {
+        const offset = index * 8;
+        buffer.writeUInt16LE(code, offset);
+        buffer.writeUInt8(jumpTrue, offset + 2);
+        buffer.writeUInt8(jumpFalse, offset + 3);
+        buffer.writeUInt32LE(value >>> 0, offset + 4);
+    }
+    return buffer;
+}
+function syscallPolicy(architecture) {
+    if (architecture === 'x64')
+        return {
+            auditArchitecture: 0xc000003e,
+            blockedSyscalls: [
+                101, 155, 165, 166, 175, 176, 246, 248, 249, 250, 272, 298, 304, 308, 313, 321, 323, 428,
+                429, 430, 431, 432, 442
+            ]
+        };
+    if (architecture === 'arm64')
+        return {
+            auditArchitecture: 0xc00000b7,
+            blockedSyscalls: [
+                39, 40, 41, 97, 104, 105, 106, 117, 217, 218, 219, 241, 265, 268, 273, 280, 282, 428, 429,
+                430, 431, 432, 442
+            ]
+        };
+    throw policyInvalid();
+}
+function within(parent, candidate) {
+    const relation = relative(parent, candidate);
+    return relation.length > 0 && relation !== '..' && !relation.startsWith(`..${sep}`);
+}
+function withinSandboxPath(parent, candidate) {
+    const relation = posix.relative(parent, candidate);
+    return relation.length > 0 && relation !== '..' && !relation.startsWith('../');
+}
+function unavailable(_cause) {
+    return new MarAgentError('SANDBOX_UNAVAILABLE', 'Bubblewrap sandbox is unavailable.');
+}
+function policyInvalid(_cause) {
+    return new MarAgentError('SANDBOX_POLICY_INVALID', 'Sandbox policy is invalid.');
+}

package/dist/sandbox/linux/index.d.ts

@@ -0,0 +1,2 @@
+export { BubblewrapSandboxExecutor, probeBubblewrapSandbox } from './bubblewrap-sandbox-executor.js';
+export { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION, type BubblewrapSandboxExecutorOptions, type BubblewrapSandboxProfile, type LinuxSandboxMount, type LinuxSandboxNetworkMode, type LinuxSandboxTemporaryDirectory, type LinuxSandboxWorkingDirectory } from './profile.js';

package/dist/sandbox/linux/index.js

@@ -0,0 +1,2 @@
+export { BubblewrapSandboxExecutor, probeBubblewrapSandbox } from './bubblewrap-sandbox-executor.js';
+export { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';

package/dist/sandbox/linux/profile.d.ts

@@ -0,0 +1,30 @@
+export declare const LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION = 1;
+export type LinuxSandboxNetworkMode = 'NONE' | 'UNRESTRICTED';
+export interface LinuxSandboxMount {
+    readonly source: string;
+    readonly destination: string;
+    readonly access: 'READ_ONLY' | 'READ_WRITE';
+}
+export type LinuxSandboxTemporaryDirectory = {
+    readonly kind: 'EPHEMERAL';
+} | {
+    readonly kind: 'MOUNT';
+    readonly source: string;
+};
+export type LinuxSandboxWorkingDirectory = {
+    readonly kind: 'REQUEST';
+} | {
+    readonly kind: 'SANDBOX';
+    readonly path: string;
+};
+export interface BubblewrapSandboxProfile {
+    readonly policyVersion: number;
+    readonly networkMode?: LinuxSandboxNetworkMode;
+    readonly mounts?: readonly LinuxSandboxMount[];
+    readonly temporaryDirectory?: LinuxSandboxTemporaryDirectory;
+    readonly workingDirectory?: LinuxSandboxWorkingDirectory;
+}
+export interface BubblewrapSandboxExecutorOptions {
+    readonly profile: BubblewrapSandboxProfile;
+    readonly bubblewrapPath?: string;
+}

package/dist/sandbox/linux/profile.js

@@ -0,0 +1 @@
+export const LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION = 1;

package/dist/tools/question.js

@@ -4,7 +4,7 @@ import { TOOL_EXECUTION_LIMITS } from './execution-limits.js';
 export const questionToolDefinition = {
     name: 'question',
     parallelSafety: 'serial',
-    description: 'Pause for one to three tightly related user-owned decisions that materially change the result and cannot be resolved through relevant safe discovery. Prefer asking over guessing in Plan mode; do not avoid clarification by inventing configuration, branches, abstractions, or support for multiple outcomes. Provide 2-3 mutually exclusive options with consequences, put the recommended option first and identify it in its label or description, and use another question round if key ambiguity remains. This is not a permission/approval tool and should not interrupt routine in-scope work.',
+    description: 'Pause for one to three tightly related user-owned decisions that materially change the result and cannot be inferred from the request, conversation, or relevant safe discovery. Prefer asking over guessing in Plan mode; do not avoid clarification by inventing configuration, branches, abstractions, or support for multiple outcomes. Provide 2-3 mutually exclusive options with consequences, put the recommended option first and identify it in its label or description, and use another question round if key ambiguity remains. This is not a permission/approval tool and should not interrupt routine in-scope work.',
     inputSchema: {
         type: 'object',
         properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/agent",
-  "version": "0.9.77",
+  "version": "0.9.78",
   "description": "Embeddable MAR coding agent SDK and CLI.",
   "license": "Apache-2.0",
   "type": "module",
@@ -14,6 +14,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./sandbox/linux": {
+      "types": "./dist/sandbox/linux/index.d.ts",
+      "default": "./dist/sandbox/linux/index.js"
     }
   },
   "bin": {