@namzu/sandbox 13.0.0 → 14.0.0

package/dist/testing/sandbox-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-conformance.js","sourceRoot":"","sources":["../../src/testing/sandbox-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAeH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAwDzC,iGAAiG;AACjG,KAAK,UAAU,aAAa,CAC3B,MAAyB,EACzB,IAA4B;IAE5B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACJ,MAAM,IAAI,EAAE,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,cAAc,CAC5B,MAAyB,EACzB,IAA4B;IAE5B,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM,IAAI,EAAE,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,KAAK,GAAG,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AA+BD,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,8BAA8B,CAAA;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB;IAChC,MAAM,MAAM,GAAG;QACd,kCAAkC;QAClC,+CAA+C;QAC/C,oCAAoC;QACpC,4EAA4E;QAC5E,OAAO;QACP,KAAK;QACL,uCAAuC;QACvC,0BAA0B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,oCAAoC;QAClG,KAAK;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO;QACN,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,MAAM;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACnD,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5C,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAwE,EACxE,QAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC;QACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;KAC5B,CAAC,CAAA;IAEF,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,WAAW,EAAE,CAAA;gBACb,OAAO,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;QACF,CAAC,CAAC,CAAA;QACF,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACpC,iEAAiE;YACjE,kEAAkE;YAClE,kEAAkE;YAClE,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9C,WAAW,EAAE,CAAA;gBACb,MAAM,CACL,IAAI,KAAK,CACR,4DAA4D,MAAM,CAAC,QAAQ,MAC1E,MAAM,IAAI,aACX,EAAE,CACF,CACD,CAAA;YACF,CAAC;QACF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACN,IAAI;QACJ,KAAK,CAAC,IAAI;YACT,QAAQ,CAAC,IAAI,EAAE,CAAA;YACf,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACtC,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IAC1E,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAA;IACxC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAA;IACvD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,iBAAiB,CAAA;IAE9E;;;;;;;;;OASG;IACH,MAAM,WAAW,GAAG,CAAC,IAAyC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;gBAAS,CAAC;YACV,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC9C,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,CAAA;QACzB,CAAC;IACF,CAAC,CAAA;IAED,QAAQ,CAAC,GAAG,KAAK,wBAAwB,wBAAwB,EAAE,EAAE,GAAG,EAAE;QACzE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,EAAE,CACD,qEAAqE,EACrE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAuC,EAAE,CAAA;gBACrD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAChC,SAAS,EACT,CAAC,IAAI,EAAE,yDAAyD,CAAC,EACjE,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAClD,CAAA;gBAED,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBAChD,4DAA4D;gBAC5D,0DAA0D;gBAC1D,yDAAyD;gBACzD,iBAAiB;gBACjB,MAAM,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACZ,MAAM,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,qEAAqE,EACrE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,IAAI,YAAY,GAAG,KAAK,CAAA;gBACxB,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,EAAE;oBAChE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;wBACnB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAAE,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAA;oBAC7E,CAAC;iBACD,CAAC,CAAA;gBACF,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,mFAAmF,EACnF,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,gEAAgE;gBAChE,+DAA+D;gBAC/D,4DAA4D;gBAC5D,wDAAwD;gBACxD,8DAA8D;gBAC9D,wDAAwD;gBACxD,2DAA2D;gBAC3D,wDAAwD;gBACxD,8DAA8D;gBAC9D,cAAc;gBACd,MAAM,MAAM,GAAG,8BAA8B,CAAA;gBAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;gBACpC,IAAI,WAAqC,CAAA;gBACzC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC3C,WAAW,GAAG,OAAO,CAAA;gBACtB,CAAC,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC3B,SAAS,EACT;oBACC,IAAI;oBACJ,yDAAyD,MAAM,sBAAsB;iBACrF,EACD;oBACC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;wBACnB,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;4BAAE,WAAW,EAAE,EAAE,CAAA;oBAC/E,CAAC;iBACD,CACD,CAAA;gBACD,MAAM,KAAK,CAAA;gBACX,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;gBAEnE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gEAAgE;gBAChE,6BAA6B;gBAC7B,IAAI,OAA0D,CAAA;gBAC9D,IAAI,CAAC;oBACJ,OAAO,GAAG,MAAM,OAAO,CAAA;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,GAAG,SAAS,CAAA;gBACpB,CAAC;gBACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC3E,CAAC;gBAED,gEAAgE;gBAChE,8BAA8B;gBAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;gBAChB,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5D,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,EAAE,CACD,uDAAuD,EACvD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,OAAO,CAAC,SAAS,CAAC,uBAAuB,EAAE,aAAa,CAAC,CAAA;gBAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAA;gBAC5D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAClD,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,oDAAoD,EACpD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;gBACnF,MAAM,OAAO,CAAC,SAAS,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAA;gBAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAA;gBAClE,yDAAyD;gBACzD,6DAA6D;gBAC7D,wDAAwD;gBACxD,wDAAwD;gBACxD,8DAA8D;gBAC9D,qCAAqC;gBACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjE,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;YAC1B,EAAE,CACD,wDAAwD,EACxD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,QAAQ,GAAG,WAAW,CAAA;gBAC5B,MAAM,QAAQ,GAAG,mCAAmC,CAAA;gBACpD,MAAM,OAAO,CAAC,SAAS,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAA;gBAC3D,MAAM,OAAO,CAAC,SAAS,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAA;gBAC3D,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,mBAAmB,CAAA;gBACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACpE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,iEAAiE,EACjE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,OAAO,4BAA4B,CAAC,CAAA;gBACrF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC7B,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;YAC7B,EAAE,CACD,gFAAgF,EAChF,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,OAAO,CAAC,YAAY;oBAAE,OAAM;gBAEjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;oBAC3C,OAAO,EAAE,SAAS;oBAClB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;oBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;iBAC5B,CAAC,CAAA;gBAEF,IAAI,MAAM,GAAG,KAAK,CAAA;gBAClB,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC9B,MAAM,GAAG,IAAI,CAAA;gBACd,CAAC,CAAC,CAAA;gBAEF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;gBACvB,8DAA8D;gBAC9D,0DAA0D;gBAC1D,wDAAwD;gBACxD,oCAAoC;gBACpC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACzB,MAAM,QAAQ,CAAC,MAAM,CAAA;YACtB,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF;;;;;;;;;WASG;QACH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAClC,kEAAkE;YAClE,oEAAoE;YACpE,gEAAgE;YAChE,8DAA8D;YAC9D,oEAAoE;YACpE,kDAAkD;YAClD,kEAAkE;YAClE,QAAQ;YACR,MAAM,iBAAiB,GAAG,eAAe;gBACxC,CAAC,CAAC,uEAAuE;gBACzE,CAAC,CAAC,2GAA2G,CAAA;YAE9G,EAAE,CACD,iBAAiB,EACjB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,OAAO,CAAC,iBAAiB;oBAAE,OAAM;gBACtC,IAAI,CAAC,eAAe;oBAAE,OAAM;gBAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;gBACzC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACnB,iDAAiD;oBACjD,uDAAuD;oBACvD,iDAAiD;oBACjD,oDAAoD;oBACpD,wDAAwD;oBACxD,MAAM,IAAI,KAAK,CACd,oFAAoF;wBACnF,wEAAwE;wBACxE,6EAA6E;wBAC7E,0EAA0E,CAC3E,CAAA;gBACF,CAAC;gBAED,2DAA2D;gBAC3D,sDAAsD;gBACtD,uDAAuD;gBACvD,wDAAwD;gBACxD,gBAAgB;gBAChB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,CAAC,eAAe,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAChE,oBAAoB,EAAE,CACtB,CAAA;gBACD,IAAI,CAAC;oBACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;oBAC3E,IAAI,QAAQ,GAAG,EAAE,CAAA;oBACjB,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;wBAC/C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;oBAChD,CAAC,CAAC,CAAA;oBACF,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;oBACrC,MAAM,UAAU,CAAC,MAAM,CAAA;oBACvB,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;oBAC5D,WAAW,EAAE,CAAA;gBACd,CAAC;wBAAS,CAAC;oBACV,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACtB,CAAC;YACF,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,6BAA6B,EAC7B,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,OAAO,CAAC,iBAAiB;oBAAE,OAAM;gBAEtC,8DAA8D;gBAC9D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,yCAAyC;gBACzC,MAAM,WAAW,GAAG;oBACnB,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,cAAc;iBACmB,CAAA;gBACxC,MAAM,aAAa,CAClB,MAAM,EACN,GAAG,EAAE,CACJ,OAAO,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CACrF,CAAA;YACF,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,EAAE,CACD,wEAAwE,EACxE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACzD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBACxC,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;gBACrD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACzC,CAAC,CAAC,CACF,CAAA;YAED,EAAE,CACD,8DAA8D,EAC9D,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;gBAEvB,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC1E,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;gBAClE,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC5D,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;gBACrE,+DAA+D;gBAC/D,8DAA8D;gBAC9D,qDAAqD;gBACrD,yDAAyD;gBACzD,6BAA6B;gBAC7B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC1B,MAAM,aAAa,CAClB,MAAM,EACN,GAAG,EAAE,CACJ,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;wBACxD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CACzC,CAAA;gBACF,CAAC;gBACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,MAAM,aAAa,CAClB,MAAM,EACN,GAAG,EAAE,CACJ,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;wBACxC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CACzC,CAAA;gBACF,CAAC;YACF,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sandbox",
-  "version": "13.0.0",
+  "version": "14.0.0",
   "description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + a loopback-bound egress proxy that allows by resolved address and brokers outbound credentials so they never enter the sandbox) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
   "license": "FSL-1.1-MIT",
   "engines": {
@@ -46,19 +46,20 @@
     "provenance": true
   },
   "peerDependencies": {
-    "@namzu/sdk": "^39.0.0"
+    "@namzu/sdk": "^40.0.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@types/node": "^22.19.17",
     "typescript": "^5.5.0",
     "vitest": "^3.2.6",
-    "@namzu/sdk": "^39.0.0"
+    "yaml": "^2.9.0",
+    "@namzu/sdk": "^40.0.0"
   },
   "scripts": {
     "build": "tsc --build",
     "dev": "tsc --build --watch",
-    "lint": "biome check src/ worker/ agent/",
+    "lint": "biome check src/ worker/ agent/ k8s/",
     "lint:fix": "biome check --write src/",
     "format": "biome format --write src/",
     "test": "vitest run --passWithNoTests",

package/src/backends/firecracker/protocol.ts

@@ -19,6 +19,33 @@ import type { SandboxExecOptions, SandboxExecResult } from '@namzu/sdk'
 
 import { RemoteCommandError, RemoteProtocolError } from '../remote-execution-controller.js'
 
+// ---------------------------------------------------------------------------
+// Credential — the one optional field every request envelope may carry
+// ---------------------------------------------------------------------------
+
+/**
+ * The per-instance credential a framed request may present, mixed into
+ * the request envelope alongside its `op`.
+ *
+ * Absent on the vsock and unix transports: that control channel is
+ * host↔guest only and never traverses guest egress, so the guest agent
+ * authenticates nothing there and this field is simply never written.
+ * A guest reached over a ROUTED network has no such boundary, so it is
+ * started with a per-instance token (`NAMZU_AGENT_BIND_TOKEN`, fed the
+ * pod's own identity by its orchestrator) and refuses every op but
+ * `healthz` that does not present exactly that value — from the first
+ * frame, since the agent dispatches a connection on its first frame and
+ * there is no handshake to defer the check to.
+ *
+ * The field is OPTIONAL and additive, so a host that never sets it
+ * speaks the same wire it always did and
+ * `FIRECRACKER_AGENT_PROTOCOL_VERSION` is deliberately unchanged: this
+ * needs no coupled golden-image and host rollout.
+ */
+export interface AgentRequestCredential {
+	readonly token?: string
+}
+
 // ---------------------------------------------------------------------------
 // Exec — request + the NDJSON event shapes (verbatim from worker/server.js)
 // ---------------------------------------------------------------------------

package/src/backends/firecracker/transport.ts

@@ -73,6 +73,7 @@ import {
 	RemoteProtocolError,
 } from '../remote-execution-controller.js'
 import {
+	type AgentRequestCredential,
 	type ExecRequest,
 	ExecResultAccumulator,
 	type ReadFileRequest,
@@ -117,6 +118,18 @@ import {
  *    (`tls.TLSSocket` is a `net.Socket`). The container-app NEVER sees
  *    a host-local `udsPath`; the cert material is injected by the
  *    Vandal host layer, never returned by the orchestrator.
+ *  - `tcp`   — the guest agent listening directly on a routed pod
+ *    network (the kubernetes backend). The dialer does a plain
+ *    `net.connect({ host, port })` — no relay, no routing preamble, no
+ *    ack: there is nothing between the host and the guest's own listen
+ *    socket to route through, so the framing loop starts on the very
+ *    first byte, exactly as the `unix` arm's does. `host` may be a
+ *    Service FQDN rather than a literal IP; every call dials fresh (see
+ *    `dial()` below), so DNS is re-resolved on every request and a
+ *    resumed pod's new address is picked up for free. `token` rides in
+ *    each request envelope (see `AgentRequestCredential` in
+ *    `protocol.ts`) because a routed listener authenticates what the
+ *    vsock/unix control channel never had to.
  */
 export type SandboxAgentHandle =
 	| { readonly kind: 'unix'; readonly path: string }
@@ -133,6 +146,7 @@ export type SandboxAgentHandle =
 				readonly servername?: string
 			}
 	  }
+	| { readonly kind: 'tcp'; readonly host: string; readonly port: number; readonly token?: string }
 
 /**
  * The mTLS cert material the consumer injects onto a wire `mtls` handle (the
@@ -148,12 +162,17 @@ export interface MtlsClientMaterial {
 }
 
 /**
- * The WIRE shape of an agent handle as the orchestrator returns it. Identical
- * to {@link SandboxAgentHandle} EXCEPT the `mtls` arm omits the `tls` cert
- * block: the orchestrator returns only host/port/sandboxId, and the consumer
- * (Vandal host layer) merges the cert material in (see `normalizeHandle`)
- * before constructing the transport. The `unix`/`vsock` arms are unchanged
- * (they carry no cert material).
+ * The WIRE shape of an agent handle as the FIRECRACKER orchestrator
+ * returns it. Identical to {@link SandboxAgentHandle} EXCEPT the `mtls`
+ * arm omits the `tls` cert block: the orchestrator returns only
+ * host/port/sandboxId, and the consumer (Vandal host layer) merges the
+ * cert material in (see `normalizeHandle`) before constructing the
+ * transport. The `unix`/`vsock` arms are unchanged (they carry no cert
+ * material). There is deliberately no `tcp` arm here: that kind belongs
+ * to the kubernetes backend, which builds its {@link SandboxAgentHandle}
+ * directly (host/port from the claimed Sandbox's status, token from the
+ * pod's own identity) and never goes through this orchestrator wire
+ * shape or `normalizeHandle`.
  */
 export type WireSandboxAgentHandle =
 	| { readonly kind: 'unix'; readonly path: string }
@@ -174,7 +193,7 @@ export type WireSandboxAgentHandle =
  * used the URL path (`/execute`, `/read-file`, `/write-file`,
  * `/healthz`) — over vsock the same selector rides in the framed JSON.
  */
-export type AgentRequest =
+export type AgentRequest = (
 	| { readonly op: 'execute'; readonly body: ExecRequest }
 	| { readonly op: 'reserve-execution' }
 	| {
@@ -186,6 +205,12 @@ export type AgentRequest =
 	| { readonly op: 'terminal'; readonly body: TerminalOpenRequest }
 	| { readonly op: 'tcp-connect'; readonly body: TcpConnectRequest }
 	| { readonly op: 'healthz' }
+) &
+	// Intersected, not repeated per arm: the credential is orthogonal to
+	// the op, and every arm may carry it. Optional and additive, so a host
+	// that writes no token speaks the wire it always did — see
+	// {@link AgentRequestCredential}.
+	AgentRequestCredential
 
 export interface VsockTransportOptions {
 	/** Per-attempt connect + handshake timeout. Default 5000ms. */
@@ -202,6 +227,15 @@ export interface VsockTransportOptions {
 	 * against the agent's fresh listen socket. Default 60000ms.
 	 */
 	readonly readIdleTimeoutMs?: number
+	/**
+	 * Fires once per successful dial with how long the connect took, in
+	 * milliseconds. Never fires with the handle's `token` or any request
+	 * content — a bare number. Used by callers that build their own
+	 * `RemoteExecutionAdapter` on top of this transport (the kubernetes
+	 * backend's `KubernetesAgentTransport`) to attribute wall time; the
+	 * vsock/mtls/unix arms are free to ignore it.
+	 */
+	readonly onDial?: (durationMs: number) => void
 }
 
 const DEFAULT_CONNECT_TIMEOUT_MS = 5_000
@@ -217,6 +251,39 @@ const EXECUTION_TRANSPORT_GRACE_MS = 10_000
 const POST_RESPONSE_CLOSE_TIMEOUT_MS = 1_000
 const MAX_TIMER_DELAY_MS = 2_147_483_647
 
+/**
+ * The guest agent's default pre-auth frame ceiling for a routed (`tcp`)
+ * connection — mirrors `agent.cjs`'s `MAX_PREAUTH_FRAME_BYTES`
+ * (`NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES`, default 8 MiB). The gate on
+ * that side cannot run until a whole frame is parsed (the credential
+ * rides inside the envelope), so it bounds what an UNAUTHENTICATED
+ * connection's first frame may announce. This transport dials fresh per
+ * call — there is no persistent, already-authenticated connection to
+ * reuse — so EVERY `tcp` request is that connection's first frame, and
+ * this ceiling is therefore the effective per-request budget, not just
+ * a one-time cost paid on first use.
+ *
+ * Checked here, client-side, BEFORE dialing: an oversized request fails
+ * fast with a clear error instead of opening a connection the guest is
+ * going to refuse anyway. Chunking a `write-file` body across multiple
+ * frames would lift this ceiling; it is a documented follow-up, not
+ * implemented by this transport.
+ */
+export const TCP_PREAUTH_FRAME_LIMIT_BYTES = 8 * 1024 * 1024
+
+/**
+ * Thrown when a `tcp`-handle request's framed envelope (op + body +
+ * token) would exceed {@link TCP_PREAUTH_FRAME_LIMIT_BYTES}. Named so a
+ * caller can distinguish "this body needs chunking" from every other
+ * transport failure.
+ */
+export class AgentPreauthFrameTooLargeError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = 'AgentPreauthFrameTooLargeError'
+	}
+}
+
 /** Exact guest wire version accepted by this Firecracker transport. */
 export const FIRECRACKER_AGENT_PROTOCOL_VERSION = REMOTE_EXECUTION_PROTOCOL_VERSION
 
@@ -286,6 +353,7 @@ export class VsockAgentTransport {
 	private readonly connectRetryBudgetMs: number
 	private readonly connectRetryIntervalMs: number
 	private readonly readIdleTimeoutMs: number
+	private readonly onDial?: (durationMs: number) => void
 	private readonly executionController: RemoteExecutionController<
 		Pick<ExecRequest, 'stdin' | 'maxOutputBytes'>
 	>
@@ -297,6 +365,7 @@ export class VsockAgentTransport {
 		this.connectRetryIntervalMs =
 			options.connectRetryIntervalMs ?? DEFAULT_CONNECT_RETRY_INTERVAL_MS
 		this.readIdleTimeoutMs = options.readIdleTimeoutMs ?? DEFAULT_READ_IDLE_TIMEOUT_MS
+		this.onDial = options.onDial
 		const adapter: RemoteExecutionAdapter<Pick<ExecRequest, 'stdin' | 'maxOutputBytes'>> = {
 			label: 'framed microVM agent',
 			reserve: async (signal) => await this.reserveExecution(signal),
@@ -330,11 +399,14 @@ export class VsockAgentTransport {
 	 */
 	private async dial(signal?: AbortSignal): Promise<net.Socket> {
 		const deadline = Date.now() + this.connectRetryBudgetMs
+		const dialStartedAt = Date.now()
 		let lastErr: unknown
 		for (;;) {
 			signal?.throwIfAborted()
 			try {
-				return await this.connectOnce(signal)
+				const socket = await this.connectOnce(signal)
+				this.onDial?.(Date.now() - dialStartedAt)
+				return socket
 			} catch (err) {
 				if (signal?.aborted) throw signal.reason
 				lastErr = err
@@ -353,6 +425,7 @@ export class VsockAgentTransport {
 	private connectOnce(signal?: AbortSignal): Promise<net.Socket> {
 		const handle = this.handle
 		if (handle.kind === 'mtls') return this.connectOnceMtls(handle, signal)
+		if (handle.kind === 'tcp') return this.connectOnceTcp(handle, signal)
 		return new Promise<net.Socket>((resolve, reject) => {
 			const path = handle.kind === 'unix' ? handle.path : handle.udsPath
 			const socket = net.connect({ path })
@@ -508,12 +581,89 @@ export class VsockAgentTransport {
 		})
 	}
 
+	/**
+	 * Dial a `tcp` handle: a plain `net.connect({ host, port })`. NO
+	 * routing preamble and NO ack — there is no relay to route through
+	 * and no handshake line the guest expects, so the socket is handed
+	 * to the framing loop the instant it connects, exactly like the
+	 * `unix` arm above (whose body this deliberately does not touch).
+	 */
+	private connectOnceTcp(
+		handle: Extract<SandboxAgentHandle, { kind: 'tcp' }>,
+		signal?: AbortSignal,
+	): Promise<net.Socket> {
+		return new Promise<net.Socket>((resolve, reject) => {
+			const socket = net.connect({ host: handle.host, port: handle.port })
+			let settled = false
+			const fail = (err: Error) => {
+				if (settled) return
+				settled = true
+				clearTimeout(timer)
+				signal?.removeEventListener('abort', abort)
+				socket.destroy()
+				reject(err)
+			}
+			const abort = () => fail(signalError(signal))
+			const timer = setTimeout(
+				() => fail(new Error(`connect/handshake timed out after ${this.connectTimeoutMs}ms`)),
+				this.connectTimeoutMs,
+			)
+			timer.unref()
+
+			socket.once('error', fail)
+			if (signal?.aborted) {
+				abort()
+				return
+			}
+			signal?.addEventListener('abort', abort, { once: true })
+
+			socket.once('connect', () => {
+				if (settled) return
+				settled = true
+				clearTimeout(timer)
+				signal?.removeEventListener('abort', abort)
+				socket.removeListener('error', fail)
+				resolve(socket)
+			})
+		})
+	}
+
+	/**
+	 * Fold the handle's credential into a request envelope. Only the
+	 * `tcp` arm carries a token — the vsock/unix/mtls control channels
+	 * are host↔guest only and the agent authenticates nothing there, so
+	 * a request built for those arms passes through unchanged.
+	 */
+	private withCredential(req: AgentRequest): AgentRequest {
+		if (this.handle.kind === 'tcp' && this.handle.token !== undefined) {
+			return { ...req, token: this.handle.token }
+		}
+		return req
+	}
+
+	/**
+	 * Refuse an oversized `tcp` envelope BEFORE dialing. See
+	 * {@link TCP_PREAUTH_FRAME_LIMIT_BYTES}. A no-op for every other
+	 * handle kind, which the guest never gates on frame size pre-auth.
+	 */
+	private assertPreauthBudget(payload: string): void {
+		if (this.handle.kind !== 'tcp') return
+		const size = Buffer.byteLength(payload, 'utf8')
+		if (size <= TCP_PREAUTH_FRAME_LIMIT_BYTES) return
+		throw new AgentPreauthFrameTooLargeError(
+			`kubernetes tcp transport: request envelope is ${size} bytes, which exceeds the ${TCP_PREAUTH_FRAME_LIMIT_BYTES}-byte limit the guest agent enforces on an unauthenticated connection's first frame (NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES, default 8 MiB). Every tcp request dials a fresh connection, so this request WOULD be that connection's first frame. Chunking a large body across multiple frames is not implemented; reduce the payload or raise the deployment's NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES.`,
+		)
+	}
+
 	/**
 	 * Send one framed request and read one framed JSON reply (file-IO +
 	 * healthz). Applies the read-idle timeout so a post-resume hung read
 	 * is torn down rather than wedging the caller.
 	 */
 	async request<T>(req: AgentRequest, signal?: AbortSignal): Promise<T> {
+		const envelope = this.withCredential(req)
+		const payload = JSON.stringify(envelope)
+		this.assertPreauthBudget(payload)
 		const socket = await this.dial(signal)
 		return await new Promise<T>((resolve, reject) => {
 			const reader = new FrameReader()
@@ -581,7 +731,7 @@ export class VsockAgentTransport {
 			}
 			signal?.addEventListener('abort', abort, { once: true })
 			idle.bump()
-			socket.write(frame(JSON.stringify(req)))
+			socket.write(frame(payload))
 		})
 	}
 
@@ -595,6 +745,9 @@ export class VsockAgentTransport {
 		opts?: SandboxExecOptions,
 		signal?: AbortSignal,
 	): Promise<SandboxExecResult> {
+		const envelope = this.withCredential({ op: 'execute', body } satisfies AgentRequest)
+		const payload = JSON.stringify(envelope)
+		this.assertPreauthBudget(payload)
 		const socket = await this.dial(signal)
 		const start = Date.now()
 		return await new Promise<SandboxExecResult>((resolve, reject) => {
@@ -687,7 +840,7 @@ export class VsockAgentTransport {
 				return
 			}
 			signal?.addEventListener('abort', abort, { once: true })
-			socket.write(frame(JSON.stringify({ op: 'execute', body } satisfies AgentRequest)))
+			socket.write(frame(payload))
 		})
 	}
 
@@ -732,6 +885,27 @@ export class VsockAgentTransport {
 		return await this.executionController.exec(command, argv, opts)
 	}
 
+	/**
+	 * The raw `/execute` primitive with NO admission/reservation
+	 * semantics: dial, send one framed request, accumulate the streamed
+	 * NDJSON reply. Public (unlike the identical-in-spirit
+	 * {@link reserveExecution}/{@link cancelExecution}, reached through
+	 * the already-public {@link request}) so a caller running its OWN
+	 * {@link RemoteExecutionController} — the kubernetes backend's
+	 * adapter — can reuse this exact dial + framing rather than
+	 * reimplementing it, while still supplying that controller its own
+	 * `reserve`/`cancel`/`execute` triple as {@link RemoteExecutionAdapter}
+	 * requires. Callers that just want a reserve-before-admission `exec`
+	 * should use {@link execute} or {@link exec} instead.
+	 */
+	async executeStreamed(
+		body: ExecRequest,
+		opts?: SandboxExecOptions,
+		signal?: AbortSignal,
+	): Promise<SandboxExecResult> {
+		return await this.executeRaw(body, opts, signal)
+	}
+
 	private async reserveExecution(signal: AbortSignal): Promise<unknown> {
 		const response = await this.request<Record<string, unknown>>(
 			{ op: 'reserve-execution' },
@@ -848,7 +1022,6 @@ export class VsockAgentTransport {
 	 * the session and its authenticated WebSocket attachment.
 	 */
 	async openTerminal(options: OpenTerminalOptions): Promise<TerminalSession> {
-		const socket = await this.dial()
 		const request: TerminalOpenRequest = {
 			...(options.command !== undefined ? { command: options.command } : {}),
 			...(options.args !== undefined ? { args: options.args } : {}),
@@ -857,6 +1030,11 @@ export class VsockAgentTransport {
 			cols: options.size.cols,
 			rows: options.size.rows,
 		}
+		const openPayload = JSON.stringify(
+			this.withCredential({ op: 'terminal', body: request } satisfies AgentRequest),
+		)
+		this.assertPreauthBudget(openPayload)
+		const socket = await this.dial()
 
 		return await new Promise<TerminalSession>((resolve, reject) => {
 			const KILL_GRACE_MS = 5_000
@@ -986,14 +1164,7 @@ export class VsockAgentTransport {
 				finish(new Error('vsock transport: terminal socket closed before exit')),
 			)
 			idle.bump()
-			socket.write(
-				frame(
-					JSON.stringify({
-						op: 'terminal',
-						body: request,
-					} satisfies AgentRequest),
-				),
-			)
+			socket.write(frame(openPayload))
 		})
 	}
 
@@ -1006,8 +1177,12 @@ export class VsockAgentTransport {
 		if (host !== '127.0.0.1' && host !== '::1') {
 			throw new Error('firecracker TCP connections are restricted to guest loopback')
 		}
-		const socket = await this.dial()
 		const request: TcpConnectRequest = { host, port: options.port }
+		const openPayload = JSON.stringify(
+			this.withCredential({ op: 'tcp-connect', body: request } satisfies AgentRequest),
+		)
+		this.assertPreauthBudget(openPayload)
+		const socket = await this.dial()
 
 		return await new Promise<SandboxTcpConnection>((resolve, reject) => {
 			const reader = new FrameReader()
@@ -1127,14 +1302,7 @@ export class VsockAgentTransport {
 				finish(ready ? null : new Error('vsock TCP socket closed before readiness')),
 			)
 			idle.bump()
-			socket.write(
-				frame(
-					JSON.stringify({
-						op: 'tcp-connect',
-						body: request,
-					} satisfies AgentRequest),
-				),
-			)
+			socket.write(frame(openPayload))
 		})
 	}
 }
@@ -1214,6 +1382,9 @@ function describeHandle(handle: SandboxAgentHandle): string {
 			return `vsock:${handle.udsPath}#${handle.port}`
 		case 'mtls':
 			return `mtls:${handle.host}:${handle.port}/${handle.sandboxId}`
+		case 'tcp':
+			// Never the token: this string lands in thrown error messages.
+			return `tcp:${handle.host}:${handle.port}`
 	}
 }