@myagentroam/node 0.9.77 → 0.9.78

package/dist/connector.js

@@ -79,7 +79,8 @@ import { NodeUpgradeCoordinator, nodeUpgradeRequestPath } from './service/node-u
 import { HostedConversationStore } from './service/hosted-conversation-store.js';
 import { ConversationTemplateNodeService } from './service/conversation-template-node-service.js';
 import { HostedConversationNodeService } from './service/hosted-conversation-node-service.js';
-import { BubblewrapSandboxExecutor } from './service/bubblewrap-sandbox-executor.js';
+import { BubblewrapSandboxExecutor } from '@myagentroam/agent/sandbox/linux';
+import { hostedConversationSandboxProfile } from './service/hosted-conversation-sandbox-profile.js';
 import { MarAgentHostedConversationRuntime } from './runner/mar-agent/hosted-conversation-runtime.js';
 import { conversationHostingCapability, probeBubblewrap } from './service/conversation-hosting-capability-service.js';
 import { ConversationHostingMaintenanceService } from './service/conversation-hosting-maintenance-service.js';
@@ -103,6 +104,7 @@ const HOSTED_CONVERSATION_OPERATIONS = [
     'conversation.hosted.list',
     'conversation.hosted.create',
     'conversation.hosted.get',
+    'conversation.hosted.history',
     'conversation.hosted.watch',
     'conversation.hosted.unwatch',
     'conversation.hosted.message',
@@ -1310,7 +1312,9 @@ export class NodeConnector {
                         emitWorkbenchEvent: (event) => this.workbenchEventService.publish(event),
                         readImage: async (runId, imageIndex) => this.runAttachmentService.read(runId, imageIndex) ??
                             (await this.runAttachmentService.readNative(runId, imageIndex)),
-                        processExecutorFactory: (input) => new BubblewrapSandboxExecutor(input),
+                        processExecutorFactory: (input) => new BubblewrapSandboxExecutor({
+                            profile: hostedConversationSandboxProfile(input)
+                        }),
                         assertCanCreate: () => {
                             if (maintenanceService === undefined)
                                 throw new Error('CONVERSATION_HOSTING_UNAVAILABLE');

package/dist/runner/mar-agent/hosted-conversation-runtime.js

@@ -55,25 +55,36 @@ export class MarAgentHostedConversationRuntime {
     async history(input) {
         const catalog = await this.#openCatalog({ homeDirectory: input.homeDirectory });
         try {
-            let cursor;
+            const limit = Math.min(Math.max(input.limit ?? 10, 1), 100);
+            let cursor = input.cursor === undefined
+                ? undefined
+                : decodeHostedHistoryCursor(input.cursor, input.sessionId);
             let entries = [];
+            let turns = projectMarAgentHistory(historySession(input), entries);
             do {
                 const page = await catalog.history(input.sessionId, {
-                    limit: 1000,
+                    limit: Math.min(1000, Math.max(100, limit * 20)),
                     ...(cursor === undefined ? {} : { cursor })
                 });
                 entries = [...page.entries, ...entries];
                 cursor = page.nextCursor;
-            } while (cursor !== undefined);
-            return projectMarAgentHistory({
-                id: input.sessionId,
-                model: input.modelId ?? null,
-                effort: null,
-                access: 'full-access'
-            }, entries, {
+                turns = projectMarAgentHistory(historySession(input), entries);
+            } while (cursor !== undefined && turns.length <= limit);
+            const selected = turns.slice(-limit);
+            const earliestTurnId = selected[0]?.id;
+            const earliestSequence = earliestTurnId === undefined
+                ? undefined
+                : entries.find((entry) => historyEntryTurnId(entry) === earliestTurnId)?.sequence;
+            const projected = projectMarAgentHistory(historySession(input), entries, {
                 registerInputImages: (entry) => this.#registerInputImages(input, entry),
                 registerGeneratedImages: (sessionId, images) => this.#registerGeneratedImages(input, sessionId, images)
-            });
+            }).slice(-limit);
+            return {
+                turns: projected,
+                nextCursor: turns.length > selected.length && earliestSequence !== undefined
+                    ? encodeHostedHistoryCursor(input.sessionId, earliestSequence)
+                    : null
+            };
         }
         finally {
             await catalog.close();
@@ -342,6 +353,36 @@ export class MarAgentHostedConversationRuntime {
         }
     }
 }
+function historySession(input) {
+    return {
+        id: input.sessionId,
+        model: input.modelId ?? null,
+        effort: null,
+        access: 'full-access'
+    };
+}
+function historyEntryTurnId(entry) {
+    return entry.kind === 'user' ? entry.turnId : entry.event.turnId;
+}
+function encodeHostedHistoryCursor(sessionId, beforeSequence) {
+    return Buffer.from(JSON.stringify({ version: 1, sessionId, beforeSequence }), 'utf8').toString('base64url');
+}
+function decodeHostedHistoryCursor(cursor, sessionId) {
+    try {
+        const parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (parsed.version !== 1 ||
+            parsed.sessionId !== sessionId ||
+            !Number.isSafeInteger(parsed.beforeSequence) ||
+            parsed.beforeSequence <= 0)
+            throw new Error('HOSTED_CONVERSATION_HISTORY_CURSOR_INVALID');
+        return String(parsed.beforeSequence);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'HOSTED_CONVERSATION_HISTORY_CURSOR_INVALID')
+            throw error;
+        throw new Error('HOSTED_CONVERSATION_HISTORY_CURSOR_INVALID', { cause: error });
+    }
+}
 function projectHostedEvent(normalizer, event, userMessage, registerGeneratedImages) {
     const createdAt = Date.parse(event.timestamp);
     const base = {

package/dist/service/conversation-hosting-capability-service.js

@@ -1,16 +1,41 @@
+import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION, probeBubblewrapSandbox } from '@myagentroam/agent/sandbox/linux';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { safeErrorCode } from '../util/safe-error.js';
-import { probeBubblewrapSandbox } from './bubblewrap-sandbox-executor.js';
+import { hostedConversationSandboxProfile } from './hosted-conversation-sandbox-profile.js';
 const CONVERSATION_HOSTING_API_VERSION = 1;
-const SANDBOX_POLICY_VERSION = 1;
 /** Runs the same bounded Bubblewrap policy used by hosted local processes. */
 export async function probeBubblewrap() {
+    const root = await mkdtemp(join(tmpdir(), 'mar-node-bwrap-probe-')).catch(() => undefined);
+    if (root === undefined)
+        return { available: false, reasonCode: 'SANDBOX_UNAVAILABLE' };
+    const workspaceDirectory = join(root, 'workspace');
+    const inboxDirectory = join(root, 'inbox');
+    const outputDirectory = join(root, 'output');
+    const temporaryDirectory = join(root, 'tmp');
     try {
-        const result = await probeBubblewrapSandbox();
+        await Promise.all([workspaceDirectory, inboxDirectory, outputDirectory, temporaryDirectory].map((path) => mkdir(path, { mode: 0o700 })));
+        await Promise.all(['inbox', 'output'].map((name) => mkdir(join(workspaceDirectory, name), { recursive: true, mode: 0o700 })));
+        const result = await probeBubblewrapSandbox({
+            profile: hostedConversationSandboxProfile({
+                workspaceDirectory,
+                sourceWorkspacePath: '/home/mar-sandbox-probe/workspace',
+                inboxDirectory,
+                outputDirectory,
+                temporaryDirectory,
+                networkMode: 'NONE'
+            }),
+            cwd: workspaceDirectory
+        });
         return { available: true, version: result.version };
     }
     catch {
         return { available: false, reasonCode: 'SANDBOX_UNAVAILABLE' };
     }
+    finally {
+        await rm(root, { recursive: true, force: true }).catch(() => undefined);
+    }
 }
 export async function conversationHostingCapability(capabilities, config, storageReady, storageFailureCode, probe = probeBubblewrap, capacity = 'AVAILABLE') {
     if (capabilities.platform !== 'linux' || config?.conversationHosting?.enabled !== true) {
@@ -34,7 +59,7 @@ export async function conversationHostingCapability(capabilities, config, storag
         state: 'AVAILABLE',
         apiVersion: CONVERSATION_HOSTING_API_VERSION,
         sandboxBackend: 'BUBBLEWRAP',
-        sandboxPolicyVersion: SANDBOX_POLICY_VERSION,
+        sandboxPolicyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION,
         acceptsNewConversations: capacity !== 'FULL',
         supportsExistingConversations: true,
         capacity

package/dist/service/hosted-conversation-node-service.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { lstat, mkdir, open, readFile, rename, rm, utimes } from 'node:fs/promises';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { conversationTurnSchema, conversationTemplateDraftSchema, conversationTemplateSummarySchema, hostedConversationConfigUpdateInputSchema, hostedConversationCreateInputSchema, hostedConversationDeleteResultSchema, hostedConversationFileDeleteInputSchema, hostedConversationFileDeleteResultSchema, hostedConversationFileReadInputSchema, hostedConversationFileReadResultSchema, hostedConversationFilesSchema, hostedConversationIdInputSchema, hostedConversationImageReadInputSchema, hostedConversationListInputSchema, hostedConversationListPageSchema, hostedConversationMessageInputSchema, hostedConversationMetadataUpdateInputSchema, hostedConversationRollbackInputSchema, hostedConversationSnapshotSchema, hostedConversationSummarySchema, hostedConversationUnwatchInputSchema, hostedConversationUploadChunkInputSchema, hostedConversationUploadControlInputSchema, hostedConversationUploadCreateInputSchema, hostedConversationUploadPreflightInputSchema, hostedConversationUploadPreflightResultSchema, hostedConversationUploadSchema, hostedConversationWatchInputSchema, marAgentRuntimeModelConfigurationSchema, mcpInstallationConfigurationSchema, mcpRuntimeDescriptorSchema, resolveMarAgentDefaultReasoningEffort } from '@myagentroam/protocol';
+import { conversationTurnSchema, conversationTemplateDraftSchema, conversationTemplateSummarySchema, hostedConversationConfigUpdateInputSchema, hostedConversationCreateInputSchema, hostedConversationDeleteResultSchema, hostedConversationFileDeleteInputSchema, hostedConversationFileDeleteResultSchema, hostedConversationFileReadInputSchema, hostedConversationFileReadResultSchema, hostedConversationFilesSchema, hostedConversationHistoryInputSchema, hostedConversationHistoryPageSchema, hostedConversationIdInputSchema, hostedConversationImageReadInputSchema, hostedConversationListInputSchema, hostedConversationListPageSchema, hostedConversationMessageInputSchema, hostedConversationMetadataUpdateInputSchema, hostedConversationRollbackInputSchema, hostedConversationSnapshotSchema, hostedConversationSummarySchema, hostedConversationUnwatchInputSchema, hostedConversationUploadChunkInputSchema, hostedConversationUploadControlInputSchema, hostedConversationUploadCreateInputSchema, hostedConversationUploadPreflightInputSchema, hostedConversationUploadPreflightResultSchema, hostedConversationUploadSchema, hostedConversationWatchInputSchema, marAgentRuntimeModelConfigurationSchema, mcpInstallationConfigurationSchema, mcpRuntimeDescriptorSchema, resolveMarAgentDefaultReasoningEffort } from '@myagentroam/protocol';
 import { hostedConversationGeneratedImagesDisplayDirectory, hostedConversationImageRunId, marAgentGeneratedImagesDirectory } from '../runner/mar-agent/generated-images.js';
 import { sessionTitleFromFirstMessage } from '../util/node-operation-parsers.js';
 import { safeErrorCode } from '../util/safe-error.js';
@@ -61,6 +61,7 @@ export class HostedConversationNodeService {
             'conversation.hosted.list': (raw) => this.list(raw),
             'conversation.hosted.create': (raw) => this.create(raw),
             'conversation.hosted.get': (raw) => this.get(raw),
+            'conversation.hosted.history': (raw) => this.history(raw),
             'conversation.hosted.watch': (raw) => this.watch(raw),
             'conversation.hosted.unwatch': (raw) => this.unwatch(raw),
             'conversation.hosted.message': (raw) => this.message(raw),
@@ -216,9 +217,24 @@ export class HostedConversationNodeService {
         const input = hostedConversationIdInputSchema.parse(payload.data);
         return this.snapshot(payload.userId, input.conversationId, runtimeModels(payload.models), payload.templateDeleted);
     }
-    async snapshot(userId, conversationId, availableModels, templateDeleted = false, includeActiveHistoryMutation = false, turnsOverride) {
+    async history(raw) {
+        const payload = hostedRequest(raw);
+        const input = hostedConversationHistoryInputSchema.parse(payload.data);
+        const conversation = this.options.store.requireConversation(payload.userId, input.conversationId);
+        const paths = this.options.store.pathsForConversation(payload.userId, conversation.id);
+        const page = await this.options.runtime.history({
+            conversationId: conversation.id,
+            sessionId: conversation.sessionId,
+            homeDirectory: paths.homeDirectory,
+            modelId: conversation.modelId,
+            limit: input.limit,
+            ...(input.cursor === undefined ? {} : { cursor: input.cursor })
+        });
+        return hostedConversationHistoryPageSchema.parse(page);
+    }
+    async snapshot(userId, conversationId, availableModels, templateDeleted = false, includeActiveHistoryMutation = false, historyOverride) {
         if (includeActiveHistoryMutation)
-            return this.readSnapshot(userId, conversationId, availableModels, templateDeleted, turnsOverride);
+            return this.readSnapshot(userId, conversationId, availableModels, templateDeleted, historyOverride);
         while (true) {
             const version = this.historyVersions.get(conversationId) ?? 0;
             const mutation = this.historyMutations.get(conversationId);
@@ -232,7 +248,7 @@ export class HostedConversationNodeService {
                 return snapshot;
         }
     }
-    async readSnapshot(userId, conversationId, availableModels, templateDeleted, turnsOverride) {
+    async readSnapshot(userId, conversationId, availableModels, templateDeleted, historyOverride) {
         let conversation = this.options.store.requireConversation(userId, conversationId);
         if (templateDeleted)
             conversation = await this.options.store.retainConversationTemplate(userId, conversationId, this.now());
@@ -243,19 +259,21 @@ export class HostedConversationNodeService {
         const version = await this.loadTemplateVersion(displayVersionId, conversation.templateId);
         const models = networkModels(allowedModels(version, availableModels), version.draft.networkMode);
         const paths = this.options.store.pathsForConversation(userId, conversation.id);
-        const turns = turnsOverride ??
+        const history = historyOverride ??
             (await this.options.runtime.history({
                 conversationId: conversation.id,
                 sessionId: conversation.sessionId,
                 homeDirectory: paths.homeDirectory,
-                modelId: conversation.modelId
+                modelId: conversation.modelId,
+                limit: 10
             }));
         return hostedConversationSnapshotSchema.parse({
             nodeAppVersion: this.options.nodeAppVersion?.() ?? 'unknown',
             conversation: this.summary(conversation),
             template: templateSummary(conversation, version.draft),
             run: this.activeRuns.get(conversation.id)?.run ?? null,
-            turns,
+            turns: history.turns,
+            historyNextCursor: history.nextCursor,
             files: this.options.store.listFiles(userId, conversation.id),
             models: models.map(modelSummary),
             error: null,
@@ -650,12 +668,7 @@ export class HostedConversationNodeService {
     }
     async rollbackConversation(payload, conversation, input) {
         const paths = this.options.store.pathsForConversation(payload.userId, conversation.id);
-        const turns = (await this.options.runtime.history({
-            conversationId: conversation.id,
-            sessionId: conversation.sessionId,
-            homeDirectory: paths.homeDirectory,
-            modelId: conversation.modelId
-        })).map((turn) => conversationTurnSchema.parse(turn));
+        const turns = await this.readAllHistory(conversation, paths);
         const targetIndex = turns.findIndex((turn) => turn.id === input.turnId);
         const target = turns[targetIndex];
         const userMessage = target?.items.find((item) => item.kind === 'user_message' && item.status === 'COMPLETED');
@@ -681,10 +694,27 @@ export class HostedConversationNodeService {
         }
         this.historyVersions.set(conversation.id, (this.historyVersions.get(conversation.id) ?? 0) + 1);
         await this.options.store.advanceLastActivity(conversation.id, Math.max(this.now(), rolledBack.lastActivityAt));
-        const snapshot = await this.snapshot(payload.userId, conversation.id, runtimeModels(payload.models), payload.templateDeleted, true, turns.slice(0, targetIndex));
+        const snapshot = await this.snapshot(payload.userId, conversation.id, runtimeModels(payload.models), payload.templateDeleted, true);
         this.publishHostedSnapshot(conversation.id, snapshot);
         return snapshot;
     }
+    async readAllHistory(conversation, paths) {
+        const turns = [];
+        let cursor;
+        do {
+            const page = await this.options.runtime.history({
+                conversationId: conversation.id,
+                sessionId: conversation.sessionId,
+                homeDirectory: paths.homeDirectory,
+                modelId: conversation.modelId,
+                limit: 100,
+                ...(cursor === undefined ? {} : { cursor })
+            });
+            turns.unshift(...page.turns.map((turn) => conversationTurnSchema.parse(turn)));
+            cursor = page.nextCursor ?? undefined;
+        } while (cursor !== undefined);
+        return turns;
+    }
     async finishRun(userId, conversationId, clientMessageId, run, completion) {
         const interruptionKey = runInterruptionKey(conversationId, run.id);
         const expectedInterruption = this.expectedInterruptions.has(interruptionKey);
@@ -701,7 +731,7 @@ export class HostedConversationNodeService {
                     completedAt: completion.completedAt
                 }
             });
-            void this.refreshReadyWatchSnapshots(conversationId);
+            void this.refreshReadyWatchSnapshots(conversationId, run.id);
             try {
                 const files = await this.options.store.reconcileFiles(userId, conversationId);
                 this.publishHostedEvent(conversationId, {
@@ -1178,12 +1208,16 @@ export class HostedConversationNodeService {
             this.removeWatchLease(lease.ownerKey);
         }
     }
-    async refreshReadyWatchSnapshots(conversationId) {
+    async refreshReadyWatchSnapshots(conversationId, completedRunId) {
         const leases = [...this.watchLeases.values()].filter((lease) => lease.conversationId === conversationId && lease.ready);
         await Promise.allSettled(leases.map(async (lease) => {
             const snapshot = await this.snapshot(lease.userId, conversationId, lease.models);
             if (this.watchLeases.get(lease.ownerKey) !== lease || !lease.ready)
                 return;
+            const activeRunId = this.activeRuns.get(conversationId)?.run.id;
+            if ((activeRunId !== undefined && activeRunId !== completedRunId) ||
+                (activeRunId === undefined && this.activity(conversationId).status !== 'IDLE'))
+                return;
             this.options.emitWatchEvent?.({
                 type: 'watch.hosted-conversation.snapshot',
                 workbenchConnectionId: lease.workbenchConnectionId,
@@ -1496,7 +1530,6 @@ export class HostedConversationNodeService {
     }
     processExecutor(paths, version, temporaryDirectory = paths.temporaryRootDirectory, generatedImagesDirectory, generatedImagesLogicalPath) {
         return this.options.processExecutorFactory({
-            policyVersion: HOST_POLICY_VERSION,
             workspaceDirectory: version.templateDirectory,
             ...(version.sourceWorkspacePath === undefined
                 ? {}

package/dist/service/hosted-conversation-sandbox-profile.js

@@ -0,0 +1,57 @@
+import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from '@myagentroam/agent/sandbox/linux';
+import { MarAgentError } from '@myagentroam/agent';
+import { posix } from 'node:path';
+/** Compiles Node-owned hosted-conversation directories into the generic Agent sandbox profile. */
+export function hostedConversationSandboxProfile(input) {
+    if ((input.generatedImagesDirectory === undefined) !==
+        (input.generatedImagesLogicalPath === undefined))
+        throw new MarAgentError('SANDBOX_POLICY_INVALID', 'Sandbox policy is invalid.');
+    const mounts = [
+        {
+            source: input.workspaceDirectory,
+            destination: '/workspace',
+            access: 'READ_ONLY'
+        },
+        {
+            source: input.inboxDirectory,
+            destination: '/workspace/inbox',
+            access: 'READ_WRITE'
+        },
+        {
+            source: input.outputDirectory,
+            destination: '/workspace/output',
+            access: 'READ_WRITE'
+        }
+    ];
+    if (input.generatedImagesDirectory !== undefined &&
+        input.generatedImagesLogicalPath !== undefined)
+        mounts.splice(1, 0, {
+            source: input.generatedImagesDirectory,
+            destination: input.generatedImagesLogicalPath,
+            access: 'READ_ONLY'
+        });
+    if (input.sourceWorkspacePath !== undefined)
+        mounts.splice(1, 0, {
+            source: input.workspaceDirectory,
+            destination: input.sourceWorkspacePath,
+            access: 'READ_ONLY'
+        }, {
+            source: input.inboxDirectory,
+            destination: posix.join(input.sourceWorkspacePath, 'inbox'),
+            access: 'READ_WRITE'
+        }, {
+            source: input.outputDirectory,
+            destination: posix.join(input.sourceWorkspacePath, 'output'),
+            access: 'READ_WRITE'
+        });
+    return {
+        policyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION,
+        networkMode: input.networkMode,
+        mounts,
+        temporaryDirectory: {
+            kind: 'MOUNT',
+            source: input.temporaryDirectory
+        },
+        workingDirectory: { kind: 'REQUEST' }
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/node",
-  "version": "0.9.77",
+  "version": "0.9.78",
   "description": "MyAgentRoam Node runtime CLI.",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
     "node-pty": "1.1.0",
     "ws": "^8.21.3",
     "zod": "4.4.3",
-    "@myagentroam/agent": "0.9.77",
-    "@myagentroam/protocol": "0.9.77"
+    "@myagentroam/agent": "0.9.78",
+    "@myagentroam/protocol": "0.9.78"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"

package/dist/service/bubblewrap-sandbox-executor.js

@@ -1,543 +0,0 @@
-import { execFile, spawn } from 'node:child_process';
-import { closeSync, existsSync, lstatSync, openSync, readlinkSync, rmSync } from 'node:fs';
-import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
-import { promisify } from 'node:util';
-import { MarAgentError } from '@myagentroam/agent';
-const execFileAsync = promisify(execFile);
-const DEFAULT_BUBBLEWRAP_PATH = '/usr/bin/bwrap';
-const SANDBOX_POLICY_VERSION = 1;
-const SANDBOX_PATH = '/runtime/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
-const CURSOR_SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
-const SANDBOX_CPU_SECONDS = 300;
-const SANDBOX_PROCESS_LIMIT = 64;
-const SANDBOX_OPEN_FILE_LIMIT = 256;
-const SANDBOX_FILE_SIZE_BYTES = 1024 * 1024 * 1024;
-const SAFE_ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
-const GENERATED_IMAGES_SANDBOX_ROOT = '/home/mar/.mar/agent/sessions';
-// Fontconfig and LibreOffice resolve required host configuration through absolute /etc paths
-// and /usr symlinks. Keep this allowlist read-only and never broaden it to the full /etc tree.
-const READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES = ['/etc/fonts', '/etc/libreoffice'];
-const FORBIDDEN_ENVIRONMENT_NAMES = new Set([
-    'PATH',
-    'HOME',
-    'TMPDIR',
-    'LD_PRELOAD',
-    'LD_LIBRARY_PATH',
-    'NODE_OPTIONS',
-    'PYTHONPATH',
-    'PYTHONHOME',
-    'BASH_ENV',
-    'ENV',
-    'SSH_AUTH_SOCK'
-]);
-const RESERVED_SANDBOX_ROOTS = [
-    '/workspace',
-    '/home/mar',
-    '/runtime',
-    '/usr',
-    '/bin',
-    '/sbin',
-    '/lib',
-    '/lib64',
-    ...READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES,
-    '/proc',
-    '/dev',
-    '/run'
-];
-/** Compiles one hosted-conversation process request into the fixed Linux Bubblewrap policy. */
-export class BubblewrapSandboxExecutor {
-    options;
-    #bubblewrapPath;
-    constructor(options) {
-        this.options = options;
-        this.#bubblewrapPath = options.bubblewrapPath ?? DEFAULT_BUBBLEWRAP_PATH;
-    }
-    async spawn(request) {
-        request.signal?.throwIfAborted();
-        if (process.platform !== 'linux')
-            throw unavailable();
-        if (this.options.sourceWorkspacePath !== undefined)
-            sandboxCompatibilityPath(this.options.sourceWorkspacePath);
-        if (this.options.policyVersion !== SANDBOX_POLICY_VERSION ||
-            !['NONE', 'UNRESTRICTED'].includes(this.options.networkMode))
-            throw policyInvalid();
-        if ((this.options.generatedImagesDirectory === undefined) !==
-            (this.options.generatedImagesLogicalPath === undefined))
-            throw policyInvalid();
-        if (this.options.generatedImagesLogicalPath !== undefined)
-            generatedImagesSandboxPath(this.options.generatedImagesLogicalPath);
-        await validateBackend(this.#bubblewrapPath);
-        const mounts = await this.#mounts();
-        const cwd = await sandboxPath(request.cwd, mounts);
-        const command = sandboxCommand(request, mounts);
-        const launchDirectory = await mkdtemp(join(tmpdir(), 'mar-node-bwrap-launch-'));
-        const argumentPath = join(launchDirectory, 'arguments');
-        const seccompPath = join(launchDirectory, 'seccomp.bpf');
-        try {
-            const arguments_ = this.#arguments(mounts, cwd, request);
-            await Promise.all([
-                writeFile(argumentPath, `${arguments_.join('\0')}\0`, { mode: 0o600, flag: 'wx' }),
-                writeFile(seccompPath, seccompFilter(process.arch), { mode: 0o600, flag: 'wx' })
-            ]);
-        }
-        catch (error) {
-            await rm(launchDirectory, { recursive: true, force: true }).catch(() => undefined);
-            throw error instanceof MarAgentError ? error : policyInvalid(error);
-        }
-        let argumentFd;
-        let seccompFd;
-        try {
-            argumentFd = openSync(argumentPath, 'r');
-            seccompFd = openSync(seccompPath, 'r');
-            rmSync(launchDirectory, { recursive: true, force: true });
-            request.signal?.throwIfAborted();
-            try {
-                const child = spawn(this.#bubblewrapPath, ['--args', '3', '--', ...command], {
-                    cwd: '/',
-                    shell: false,
-                    stdio: ['pipe', 'pipe', 'pipe', argumentFd, seccompFd],
-                    windowsHide: true,
-                    detached: request.detached,
-                    env: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }
-                });
-                return child;
-            }
-            catch (error) {
-                throw unavailable(error);
-            }
-        }
-        finally {
-            if (argumentFd !== undefined)
-                closeSync(argumentFd);
-            if (seccompFd !== undefined)
-                closeSync(seccompFd);
-            rmSync(launchDirectory, { recursive: true, force: true });
-        }
-    }
-    async #mounts() {
-        const definitions = [
-            [this.options.workspaceDirectory, '/workspace', false],
-            [this.options.inboxDirectory, '/workspace/inbox', true],
-            [this.options.outputDirectory, '/workspace/output', true],
-            [this.options.temporaryDirectory, '/tmp', true]
-        ];
-        if (this.options.generatedImagesDirectory !== undefined &&
-            this.options.generatedImagesLogicalPath !== undefined)
-            definitions.splice(1, 0, [
-                this.options.generatedImagesDirectory,
-                this.options.generatedImagesLogicalPath,
-                false
-            ]);
-        if (this.options.sourceWorkspacePath !== undefined)
-            definitions.splice(1, 0, [this.options.workspaceDirectory, this.options.sourceWorkspacePath, false], [this.options.inboxDirectory, posix.join(this.options.sourceWorkspacePath, 'inbox'), true], [this.options.outputDirectory, posix.join(this.options.sourceWorkspacePath, 'output'), true]);
-        const mounts = [];
-        for (const [source, destination, writable] of definitions) {
-            mounts.push({ source: await secureDirectory(source), destination, writable });
-        }
-        for (const [index, mount] of mounts.entries()) {
-            for (const other of mounts.slice(index + 1)) {
-                if (mount.source === other.source) {
-                    if (mount.writable !== other.writable)
-                        throw policyInvalid();
-                    continue;
-                }
-                if (within(mount.source, other.source) || within(other.source, mount.source))
-                    throw policyInvalid();
-            }
-        }
-        const ordered = [...mounts].sort(compareMountDestinations);
-        await prepareNestedMountDestinations(ordered);
-        return ordered;
-    }
-    #arguments(mounts, cwd, request) {
-        const args = [
-            '--unshare-user',
-            '--unshare-pid',
-            ...(this.options.networkMode === 'UNRESTRICTED' ? [] : ['--unshare-net']),
-            '--unshare-uts',
-            '--unshare-ipc',
-            '--unshare-cgroup-try',
-            '--disable-userns',
-            '--die-with-parent',
-            '--new-session',
-            '--cap-drop',
-            'ALL',
-            '--hostname',
-            'mar-hosted',
-            '--clearenv',
-            '--setenv',
-            'PATH',
-            SANDBOX_PATH,
-            '--setenv',
-            'HOME',
-            '/home/mar',
-            '--setenv',
-            'LANG',
-            'C.UTF-8',
-            '--setenv',
-            'LC_ALL',
-            'C.UTF-8',
-            '--setenv',
-            'TMPDIR',
-            '/tmp',
-            '--tmpfs',
-            '/',
-            ...runtimeMountArguments(),
-            ...sandboxDirectoryArguments(mounts),
-            '--proc',
-            '/proc',
-            '--dev',
-            '/dev',
-            '--tmpfs',
-            '/run'
-        ];
-        for (const mount of mounts)
-            args.push(mount.writable ? '--bind' : '--ro-bind', mount.source, mount.destination);
-        if (request.owner !== undefined) {
-            if (!CURSOR_SAFE_ID.test(request.owner.sessionId) ||
-                !CURSOR_SAFE_ID.test(request.owner.executionId))
-                throw policyInvalid();
-            args.push('--setenv', 'MAR_AGENT_SESSION_ID', request.owner.sessionId, '--setenv', 'MAR_AGENT_EXECUTION_ID', request.owner.executionId);
-        }
-        for (const [name, value] of explicitEnvironment(request))
-            args.push('--setenv', name, value);
-        args.push('--seccomp', '4', '--chdir', cwd);
-        return args;
-    }
-}
-export async function probeBubblewrapSandbox(bubblewrapPath = DEFAULT_BUBBLEWRAP_PATH) {
-    if (process.platform !== 'linux')
-        throw unavailable();
-    const versionOutput = await execFileAsync(bubblewrapPath, ['--version'], {
-        timeout: 5_000,
-        windowsHide: true
-    }).catch((error) => {
-        throw unavailable(error);
-    });
-    const version = /^bubblewrap\s+([0-9]+(?:\.[0-9]+){1,3})\s*$/u.exec(versionOutput.stdout)?.[1];
-    if (version === undefined)
-        throw unavailable();
-    const root = await mkdtemp(join(tmpdir(), 'mar-node-bwrap-probe-'));
-    const directories = Object.fromEntries(['workspace', 'inbox', 'output', 'tmp'].map((name) => [name, join(root, name)]));
-    try {
-        await Promise.all(Object.values(directories).map((path) => mkdir(path, { mode: 0o700 })));
-        await Promise.all(['inbox', 'output'].map((name) => mkdir(join(directories.workspace, name), { recursive: true, mode: 0o700 })));
-        const executor = new BubblewrapSandboxExecutor({
-            bubblewrapPath,
-            policyVersion: SANDBOX_POLICY_VERSION,
-            workspaceDirectory: directories.workspace,
-            sourceWorkspacePath: '/home/mar-sandbox-probe/workspace',
-            inboxDirectory: directories.inbox,
-            outputDirectory: directories.output,
-            temporaryDirectory: directories.tmp,
-            networkMode: 'NONE'
-        });
-        const child = await executor.spawn({
-            command: '/bin/true',
-            cwd: directories.workspace,
-            shell: false,
-            environment: {},
-            detached: true,
-            owner: { sessionId: 'sandbox-probe', executionId: 'sandbox-probe' }
-        });
-        const result = await waitForProbe(child);
-        if (result.code !== 0)
-            throw unavailable(new Error(result.stderr));
-        return { version };
-    }
-    finally {
-        await rm(root, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-async function waitForProbe(child) {
-    const chunks = [];
-    let bytes = 0;
-    child.stderr.on('data', (chunk) => {
-        if (bytes >= 8_192)
-            return;
-        const remaining = 8_192 - bytes;
-        chunks.push(chunk.subarray(0, remaining));
-        bytes += Math.min(chunk.length, remaining);
-    });
-    child.stdin.end();
-    return await new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            child.kill('SIGKILL');
-            reject(unavailable(new Error('Sandbox probe timed out.')));
-        }, 5_000);
-        timer.unref();
-        child.once('error', (error) => {
-            clearTimeout(timer);
-            reject(unavailable(error));
-        });
-        child.once('close', (code) => {
-            clearTimeout(timer);
-            resolve({ code, stderr: Buffer.concat(chunks).toString('utf8') });
-        });
-    });
-}
-async function validateBackend(path) {
-    try {
-        const metadata = await lstat(path);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || (metadata.mode & 0o111) === 0)
-            throw unavailable();
-    }
-    catch (error) {
-        if (error instanceof MarAgentError)
-            throw error;
-        throw unavailable(error);
-    }
-}
-async function secureDirectory(path) {
-    if (!isAbsolute(path))
-        throw policyInvalid();
-    try {
-        const metadata = await lstat(path);
-        if (!metadata.isDirectory() || metadata.isSymbolicLink())
-            throw policyInvalid();
-        const canonical = await realpath(path);
-        if (canonical !== resolve(path))
-            throw policyInvalid();
-        return canonical;
-    }
-    catch (error) {
-        if (error instanceof MarAgentError)
-            throw error;
-        throw policyInvalid(error);
-    }
-}
-async function sandboxPath(path, mounts) {
-    const canonical = await secureDirectory(path);
-    const mount = [...mounts]
-        .sort((left, right) => right.source.length - left.source.length)
-        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
-    if (mount === undefined)
-        throw policyInvalid();
-    const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
-    return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
-}
-function sandboxCommand(request, mounts) {
-    const command = request.shell === undefined || request.shell === false
-        ? [sandboxExecutable(request.command, mounts), ...(request.args ?? [])]
-        : [
-            sandboxExecutable(typeof request.shell === 'string' ? request.shell : '/bin/sh', mounts),
-            '-c',
-            request.command,
-            ...(request.args ?? [])
-        ];
-    return [
-        '/usr/bin/prlimit',
-        `--cpu=${SANDBOX_CPU_SECONDS}:${SANDBOX_CPU_SECONDS}`,
-        `--nproc=${SANDBOX_PROCESS_LIMIT}:${SANDBOX_PROCESS_LIMIT}`,
-        `--nofile=${SANDBOX_OPEN_FILE_LIMIT}:${SANDBOX_OPEN_FILE_LIMIT}`,
-        `--fsize=${SANDBOX_FILE_SIZE_BYTES}:${SANDBOX_FILE_SIZE_BYTES}`,
-        '--',
-        ...command
-    ];
-}
-function sandboxExecutable(command, mounts) {
-    if (!isAbsolute(command))
-        return command;
-    const canonical = resolve(command);
-    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
-    if (nodeRuntimeDirectory !== '/usr' &&
-        (canonical === nodeRuntimeDirectory || within(nodeRuntimeDirectory, canonical))) {
-        const suffix = relative(nodeRuntimeDirectory, canonical).split(sep).filter(Boolean);
-        return suffix.length === 0 ? '/runtime/node' : posix.join('/runtime/node', ...suffix);
-    }
-    const mount = [...mounts]
-        .sort((left, right) => right.source.length - left.source.length)
-        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
-    if (mount !== undefined) {
-        const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
-        return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
-    }
-    if (['/usr', '/bin', '/sbin', '/lib', '/lib64'].some((root) => canonical === root || within(root, canonical)))
-        return canonical;
-    throw policyInvalid();
-}
-function explicitEnvironment(request) {
-    const entries = [];
-    const seen = new Set();
-    for (const name of request.environmentKeys ?? []) {
-        if (seen.has(name))
-            continue;
-        seen.add(name);
-        if (!SAFE_ENVIRONMENT_NAME.test(name) || FORBIDDEN_ENVIRONMENT_NAMES.has(name))
-            throw policyInvalid();
-        const value = request.environment[name];
-        if (typeof value !== 'string' || value.includes('\0') || Buffer.byteLength(value) > 32_768)
-            throw policyInvalid();
-        entries.push([name, value]);
-    }
-    return entries;
-}
-function sandboxCompatibilityPath(path) {
-    if (!isAbsolute(path) ||
-        path.includes('\0') ||
-        path === '/' ||
-        path === '/tmp' ||
-        resolve(path) !== path ||
-        RESERVED_SANDBOX_ROOTS.some((root) => path === root || within(root, path) || within(path, root)))
-        throw policyInvalid();
-    return path;
-}
-function generatedImagesSandboxPath(path) {
-    const segments = relative(GENERATED_IMAGES_SANDBOX_ROOT, path).split(sep).filter(Boolean);
-    if (!isAbsolute(path) ||
-        path.includes('\0') ||
-        resolve(path) !== path ||
-        !within(GENERATED_IMAGES_SANDBOX_ROOT, path) ||
-        segments.length !== 2 ||
-        !safePathSegment(segments[0]) ||
-        segments[1] !== 'generated_images')
-        throw policyInvalid();
-    return path;
-}
-function safePathSegment(value) {
-    return (value.length > 0 &&
-        value.length <= 255 &&
-        value !== '.' &&
-        value !== '..' &&
-        !value.includes('/') &&
-        !value.includes('\\'));
-}
-function compareMountDestinations(left, right) {
-    const depth = left.destination.split('/').filter(Boolean).length -
-        right.destination.split('/').filter(Boolean).length;
-    return depth === 0 ? left.destination.localeCompare(right.destination, 'en-US') : depth;
-}
-async function prepareNestedMountDestinations(mounts) {
-    for (const [index, mount] of mounts.entries()) {
-        const parent = mounts
-            .slice(0, index)
-            .filter((candidate) => within(candidate.destination, mount.destination))
-            .sort((left, right) => right.destination.length - left.destination.length)[0];
-        if (parent === undefined)
-            continue;
-        const suffix = relative(parent.destination, mount.destination).split(sep).filter(Boolean);
-        const target = join(parent.source, ...suffix);
-        if (parent.writable) {
-            await mkdir(target, { recursive: true, mode: 0o700 });
-            continue;
-        }
-        try {
-            const metadata = await lstat(target);
-            if (!metadata.isDirectory() ||
-                metadata.isSymbolicLink() ||
-                (await realpath(target)) !== resolve(target))
-                throw policyInvalid();
-        }
-        catch (error) {
-            if (error instanceof MarAgentError)
-                throw error;
-            throw policyInvalid(error);
-        }
-    }
-}
-function sandboxDirectoryArguments(mounts) {
-    const directories = new Set(['/home', '/home/mar']);
-    for (const mount of mounts) {
-        const segments = mount.destination.split('/').filter(Boolean);
-        let current = '';
-        for (const segment of segments) {
-            current = `${current}/${segment}`;
-            directories.add(current);
-        }
-    }
-    return [...directories]
-        .sort((left, right) => {
-        const depth = left.split('/').filter(Boolean).length - right.split('/').filter(Boolean).length;
-        return depth === 0 ? left.localeCompare(right, 'en-US') : depth;
-    })
-        .flatMap((directory) => ['--dir', directory]);
-}
-function runtimeMountArguments() {
-    const args = [];
-    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
-    if (nodeRuntimeDirectory !== '/usr')
-        args.push('--dir', '/runtime', '--dir', '/runtime/node', '--ro-bind', nodeRuntimeDirectory, '/runtime/node');
-    for (const path of ['/usr', '/bin', '/sbin', '/lib', '/lib64']) {
-        if (!existsSync(path))
-            continue;
-        const metadata = lstatSync(path);
-        if (metadata.isSymbolicLink())
-            args.push('--symlink', readlinkSync(path), path);
-        else if (metadata.isDirectory())
-            args.push('--ro-bind', path, path);
-    }
-    for (const path of READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES) {
-        if (!existsSync(path) || !lstatSync(path).isDirectory())
-            continue;
-        args.push('--ro-bind', path, path);
-    }
-    for (const path of [
-        '/etc/host.conf',
-        '/etc/hosts',
-        '/etc/ld.so.cache',
-        '/etc/resolv.conf',
-        '/etc/passwd',
-        '/etc/group',
-        '/etc/nsswitch.conf',
-        '/etc/localtime',
-        '/etc/ssl/certs'
-    ]) {
-        if (existsSync(path))
-            args.push('--ro-bind', path, path);
-    }
-    return args;
-}
-function seccompFilter(architecture) {
-    const policy = syscallPolicy(architecture);
-    const filters = [
-        [0x20, 0, 0, 4],
-        [0x15, 1, 0, policy.auditArchitecture],
-        [0x06, 0, 0, 0x80000000],
-        [0x20, 0, 0, 0]
-    ];
-    if (architecture === 'x64')
-        filters.push([0x54, 0, 0, 0x40000000], [0x15, 1, 0, 0], [0x06, 0, 0, 0x80000000], [0x20, 0, 0, 0]);
-    for (const syscall of policy.blockedSyscalls)
-        filters.push([0x15, 0, 1, syscall], [0x06, 0, 0, 0x00050001]);
-    filters.push([0x06, 0, 0, 0x7fff0000]);
-    const buffer = Buffer.alloc(filters.length * 8);
-    for (const [index, [code, jumpTrue, jumpFalse, value]] of filters.entries()) {
-        const offset = index * 8;
-        buffer.writeUInt16LE(code, offset);
-        buffer.writeUInt8(jumpTrue, offset + 2);
-        buffer.writeUInt8(jumpFalse, offset + 3);
-        buffer.writeUInt32LE(value >>> 0, offset + 4);
-    }
-    return buffer;
-}
-function syscallPolicy(architecture) {
-    if (architecture === 'x64')
-        return {
-            auditArchitecture: 0xc000003e,
-            blockedSyscalls: [
-                101, 155, 165, 166, 175, 176, 246, 248, 249, 250, 272, 298, 304, 308, 313, 321, 323, 428,
-                429, 430, 431, 432, 442
-            ]
-        };
-    if (architecture === 'arm64')
-        return {
-            auditArchitecture: 0xc00000b7,
-            blockedSyscalls: [
-                39, 40, 41, 97, 104, 105, 106, 117, 217, 218, 219, 241, 265, 268, 273, 280, 282, 428, 429,
-                430, 431, 432, 442
-            ]
-        };
-    throw policyInvalid();
-}
-function within(parent, candidate) {
-    const relation = relative(parent, candidate);
-    return relation.length > 0 && relation !== '..' && !relation.startsWith(`..${sep}`);
-}
-function unavailable(cause) {
-    return new MarAgentError('SANDBOX_UNAVAILABLE', 'Bubblewrap sandbox is unavailable.', { cause });
-}
-function policyInvalid(cause) {
-    return new MarAgentError('SANDBOX_POLICY_INVALID', 'Sandbox policy is invalid.', { cause });
-}