@namzu/sandbox 2.0.2 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @namzu/sandbox
 
+## 2.0.3
+
+### Patch Changes
+
+- 48d9d67: Published tarballs no longer contain test files.
+
+  `files: ["dist", "src", ...]` reads as "the build output and the sources" and
+  means "everything the compiler emitted and everything in the tree", so every
+  compiled test, its declaration, and both source maps shipped to the registry —
+  and for the twelve packages that also ship `src`, the raw test sources went with
+  them.
+
+  Measured on the versions currently published:
+
+  | package      | files       | of which tests | unpacked           |
+  | ------------ | ----------- | -------------- | ------------------ |
+  | `@namzu/sdk` | 3879 → 2239 | 1640 (42%)     | 12.73 MB → 6.81 MB |
+  | `@namzu/cli` | 462 → 282   | 180 (39%)      | 1.21 MB → 0.73 MB  |
+
+  Nothing you can import changes. Every package restricts `exports` to `"."`, so
+  Node refused a deep subpath into those files already — they were weight in the
+  tarball and nothing else. Hence `patch`: there is no consumer-visible surface
+  here, only less to download.
+
+  The exclusions are at the packaging layer, not the compiler. Adding `exclude`
+  to `tsconfig.json` would have kept tests out of `dist` and also dropped them
+  from `tsc --noEmit`, silently ending type-checking of the entire test suite —
+  trading a packaging defect for a much worse one.
+
 ## 2.0.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sandbox",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + JWT-authenticated egress proxy) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
   "license": "FSL-1.1-MIT",
   "type": "module",
@@ -23,7 +23,17 @@
   },
   "files": [
     "dist",
+    "!dist/**/*.test.*",
+    "!dist/**/*.proc-test.*",
+    "!dist/**/__tests__",
+    "!dist/**/__fixtures__",
+    "!dist/**/test-setup.*",
     "src",
+    "!src/**/*.test.*",
+    "!src/**/*.proc-test.*",
+    "!src/**/__tests__",
+    "!src/**/__fixtures__",
+    "!src/**/test-setup.*",
     "LICENSE.md",
     "README.md",
     "CHANGELOG.md"
@@ -40,7 +50,7 @@
     "@types/node": "^22.19.17",
     "typescript": "^5.5.0",
     "vitest": "^3.2.6",
-    "@namzu/sdk": "^14.0.7"
+    "@namzu/sdk": "^15.0.0"
   },
   "scripts": {
     "build": "tsc --build",

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=unenforceable-controls.test.d.ts.map

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"unenforceable-controls.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts"],"names":[],"mappings":""}

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js

@@ -1,61 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { assertEnforceable } from '../index.js';
-/**
- * The claim API rejects every property override that is not a config map,
- * so a memory cap, a process cap, environment variables and an egress
- * policy have nowhere to ride through on this backend. They were accepted
- * and dropped: a host that asked for `deny-all` and 512 MB got full
- * outbound network and no cap, with no error and no warning — from the same
- * call shape that IS enforced on the sibling container backend.
- *
- * Switching backends therefore removed the blast-radius controls silently,
- * which is the worst way to lose them. namzu already holds the norm for
- * this next door: a policy accepted and quietly ignored is worse than one
- * that is refused.
- */
-const opts = (extra = {}) => ({
-    workingDirectory: '/w',
-    ...extra,
-});
-describe('controls this backend cannot apply', () => {
-    it.each([
-        ['an egress policy', { egress: { kind: 'deny-all' } }],
-        ['a memory limit', { memoryLimitMb: 512 }],
-        ['a process limit', { maxProcesses: 32 }],
-        ['environment variables', { env: { SECRET: 'x' } }],
-    ])('refuses %s', (_name, extra) => {
-        expect(() => assertEnforceable(opts(extra))).toThrow(/cannot enforce per-sandbox/);
-    });
-    it('names every field it cannot honour, not just the first', () => {
-        try {
-            assertEnforceable(opts({ egress: { kind: 'deny-all' }, memoryLimitMb: 512, maxProcesses: 8 }));
-            expect.unreachable();
-        }
-        catch (err) {
-            const message = err.message;
-            // A host fixing one and hitting the next on the following run
-            // learns the shape one failure at a time.
-            expect(message).toContain('egress');
-            expect(message).toContain('memory');
-            expect(message).toContain('process');
-        }
-    });
-    it('says where the limits do belong', () => {
-        // Refusing without saying what to do instead is a dead end; these
-        // are a property of the pooled profile.
-        expect(() => assertEnforceable(opts({ memoryLimitMb: 512 }))).toThrow(/container group profile/);
-    });
-});
-describe('what it does allow through', () => {
-    it('accepts a request that asks for nothing it cannot apply', () => {
-        expect(() => assertEnforceable(opts())).not.toThrow();
-    });
-    it('accepts a timeout, which is applied by the caller not the pool', () => {
-        expect(() => assertEnforceable(opts({ timeoutMs: 30_000 }))).not.toThrow();
-    });
-    it('treats an empty env bag as asking for nothing', () => {
-        // A host spreading an empty object should not be refused for it.
-        expect(() => assertEnforceable(opts({ env: {} }))).not.toThrow();
-    });
-});
-//# sourceMappingURL=unenforceable-controls.test.js.map

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"unenforceable-controls.test.js","sourceRoot":"","sources":["../../../../src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;;GAYG;AAEH,MAAM,IAAI,GAAG,CAAC,QAAwC,EAAE,EAAyB,EAAE,CAAC,CAAC;IACpF,gBAAgB,EAAE,IAAI;IACtB,GAAG,KAAK;CACR,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,IAAI,CAAC;QACP,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAW,EAAE,CAAC;QAC/D,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;KACnD,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACjE,IAAI,CAAC;YACJ,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9F,MAAM,CAAC,WAAW,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAA;YACtC,8DAA8D;YAC9D,0CAA0C;YAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,kEAAkE;QAClE,wCAAwC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,iEAAiE;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/docker/__tests__/hardening.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=hardening.test.d.ts.map

package/dist/backends/docker/__tests__/hardening.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardening.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/hardening.test.ts"],"names":[],"mappings":""}

package/dist/backends/docker/__tests__/hardening.test.js

@@ -1,32 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveNetwork } from '../index.js';
-/**
- * `EgressPolicy` was accepted by the type, threaded through the options,
- * and silently ignored by this backend. That is worse than not supporting
- * it: a host that set `deny-all` believed the container had no network,
- * and it had whatever `config.network` said.
- */
-describe('resolveNetwork', () => {
-    it('leaves the configured network alone when no policy is supplied', () => {
-        expect(resolveNetwork('bridge', undefined)).toBe('bridge');
-    });
-    it('enforces deny-all natively', () => {
-        // Docker can actually do this one, so there is no excuse for
-        // accepting the policy and ignoring it.
-        expect(resolveNetwork('bridge', { kind: 'deny-all' })).toBe('none');
-    });
-    it('allow-all keeps the configured network', () => {
-        expect(resolveNetwork('my-bridge', { kind: 'allow-all' })).toBe('my-bridge');
-    });
-    it('REFUSES a host allowlist rather than silently granting full access', () => {
-        // This backend has no proxy to filter through. Downgrading a
-        // restrictive policy to "allow everything" is the failure mode that
-        // makes a security control worse than useless.
-        expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: ['example.com'] })).toThrow(/cannot enforce an egress policy/);
-        expect(() => resolveNetwork('bridge', { kind: 'resolver', resolve: async () => [] })).toThrow(/cannot enforce an egress policy/);
-    });
-    it('names what it can do, so the failure is actionable', () => {
-        expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: [] })).toThrow(/deny-all/);
-    });
-});
-//# sourceMappingURL=hardening.test.js.map

package/dist/backends/docker/__tests__/hardening.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardening.test.js","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/hardening.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,6DAA6D;QAC7D,wCAAwC;QACxC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,6DAA6D;QAC7D,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,CAAC,GAAG,EAAE,CACX,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;QAE5C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,iCAAiC,CACjC,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts

@@ -1,40 +0,0 @@
-/**
- * Docker smoke test — leaf-mount permission semantics.
- *
- * Concern raised in review: the Dockerfile pre-creates only the parent
- * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
- * The runtime claim is that:
- *
- *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
- *      into it.
- *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
- *      the path simply does not exist — `stat` returns ENOENT, NOT
- *      a writable empty dir.
- *
- * Both of those are kernel-level mount-namespace properties, not
- * unit-testable. This file exercises them against a real docker
- * daemon. Run via:
- *
- *   pnpm --filter @namzu/sandbox test:smoke
- *   # or, from the monorepo root:
- *   pnpm sandbox:smoke
- *
- * Excluded from the default `pnpm test` run by `vitest.config.ts`.
- *
- * Pre-requisites:
- *   - `docker` CLI on PATH.
- *   - A pre-built reference image. By default this test looks for
- *     `namzu-sandbox-worker:smoke`. Override with the
- *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
- *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
- *   - A host-side scratch directory the test creates and tears down.
- *
- * On a developer machine without docker the test self-skips with a
- * clear message. On CI (`process.env.CI === 'true'`) the same
- * pre-conditions FAIL FAST instead of skipping, so a CI
- * misconfiguration cannot silently mask a regression — see the
- * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
- * always run with docker available.
- */
-export {};
-//# sourceMappingURL=leaf-permissions.smoke.test.d.ts.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"leaf-permissions.smoke.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js

@@ -1,157 +0,0 @@
-/**
- * Docker smoke test — leaf-mount permission semantics.
- *
- * Concern raised in review: the Dockerfile pre-creates only the parent
- * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
- * The runtime claim is that:
- *
- *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
- *      into it.
- *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
- *      the path simply does not exist — `stat` returns ENOENT, NOT
- *      a writable empty dir.
- *
- * Both of those are kernel-level mount-namespace properties, not
- * unit-testable. This file exercises them against a real docker
- * daemon. Run via:
- *
- *   pnpm --filter @namzu/sandbox test:smoke
- *   # or, from the monorepo root:
- *   pnpm sandbox:smoke
- *
- * Excluded from the default `pnpm test` run by `vitest.config.ts`.
- *
- * Pre-requisites:
- *   - `docker` CLI on PATH.
- *   - A pre-built reference image. By default this test looks for
- *     `namzu-sandbox-worker:smoke`. Override with the
- *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
- *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
- *   - A host-side scratch directory the test creates and tears down.
- *
- * On a developer machine without docker the test self-skips with a
- * clear message. On CI (`process.env.CI === 'true'`) the same
- * pre-conditions FAIL FAST instead of skipping, so a CI
- * misconfiguration cannot silently mask a regression — see the
- * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
- * always run with docker available.
- */
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { createSandboxProvider } from '../../../index.js';
-const IMAGE = process.env.NAMZU_SANDBOX_SMOKE_IMAGE ?? 'namzu-sandbox-worker:smoke';
-const IS_CI = process.env.CI === 'true';
-function dockerAvailable() {
-    const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
-        stdio: 'ignore',
-    });
-    return probe.status === 0;
-}
-function imagePresent(image) {
-    const probe = spawnSync('docker', ['image', 'inspect', image], { stdio: 'ignore' });
-    return probe.status === 0;
-}
-const skipReason = !dockerAvailable()
-    ? 'docker daemon not reachable — skipping smoke test'
-    : !imagePresent(IMAGE)
-        ? `image ${IMAGE} not present — build it with \`docker build -t ${IMAGE} -f packages/sandbox/worker/Dockerfile packages/sandbox\` and re-run`
-        : null;
-// CI fail-fast: the smoke workflow is meant to always have docker +
-// the reference image. Skipping silently in that environment would
-// let a regression land without the test even attempting to run.
-// Locally (no `CI=true`) skipping with a hint is the right behaviour
-// for a developer who hasn't built the image yet.
-if (IS_CI && skipReason) {
-    throw new Error(`smoke test pre-condition not satisfied on CI: ${skipReason}. Configure the workflow to install docker and build the reference image before running.`);
-}
-describe.skipIf(skipReason !== null)('docker smoke — leaf permissions', () => {
-    let outputsHost;
-    beforeAll(() => {
-        outputsHost = mkdtempSync(join(tmpdir(), 'namzu-sandbox-smoke-out-'));
-    });
-    afterAll(() => {
-        if (outputsHost) {
-            rmSync(outputsHost, { recursive: true, force: true });
-        }
-    });
-    it('uid 1001 can write to the outputs bind, and the host sees the file', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            const result = await sandbox.exec('sh', [
-                '-c',
-                'id -u && echo "smoke" > /mnt/user-data/outputs/hello.txt',
-            ]);
-            expect(result.exitCode).toBe(0);
-            expect(result.stdout.trim()).toBe('1001');
-            // Host-side read confirms the bind round-trips.
-            const hostContent = readFileSync(join(outputsHost, 'hello.txt'), 'utf8');
-            expect(hostContent.trim()).toBe('smoke');
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-    it('unbound leaves do not exist — uploads/transcripts/tool_results are ENOENT, not empty', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-                // Intentionally leave uploads / toolResults / transcripts
-                // unbound. The Dockerfile pre-creates only the parents
-                // (`/mnt/user-data`, `/mnt/skills`); leaves should not
-                // exist and `stat` should fail.
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            for (const leafPath of [
-                '/mnt/user-data/uploads',
-                '/mnt/user-data/tool_results',
-                '/mnt/transcripts',
-            ]) {
-                const result = await sandbox.exec('sh', ['-c', `stat ${leafPath} 2>&1; echo --rc=$?`]);
-                // `stat` returns non-zero on ENOENT; the rc line carries
-                // the failure. Either is the contract; we accept either
-                // "No such file" or "cannot stat" wording across distros.
-                expect(result.stdout).toMatch(/--rc=[1-9]/);
-                expect(result.stdout.toLowerCase()).toMatch(/no such file|cannot stat|does not exist/);
-            }
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-    it('uid 1001 cannot mkdir into the root-owned 0555 parent /mnt/user-data', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            // The model trying to "create the missing leaf dir" hits
-            // the 0555 root-owned parent and is denied — exactly what
-            // distinguishes "not bound" from "writable empty dir".
-            const result = await sandbox.exec('sh', [
-                '-c',
-                'mkdir /mnt/user-data/fake 2>&1; echo --rc=$?',
-            ]);
-            expect(result.stdout).toMatch(/--rc=[1-9]/);
-            expect(result.stdout.toLowerCase()).toMatch(/permission denied/);
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-});
-//# sourceMappingURL=leaf-permissions.smoke.test.js.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"leaf-permissions.smoke.test.js","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,4BAA4B,CAAA;AACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAA;AAEvC,SAAS,eAAe;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;QACjF,KAAK,EAAE,QAAQ;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE;IACpC,CAAC,CAAC,mDAAmD;IACrD,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,KAAK,kDAAkD,KAAK,sEAAsE;QAC7I,CAAC,CAAC,IAAI,CAAA;AAER,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,qEAAqE;AACrE,kDAAkD;AAClD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,KAAK,CACd,iDAAiD,UAAU,0FAA0F,CACrJ,CAAA;AACF,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC5E,IAAI,WAAmB,CAAA;IAEvB,SAAS,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,0DAA0D;aAC1D,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzC,gDAAgD;YAChD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;YACxE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;gBAC/D,0DAA0D;gBAC1D,uDAAuD;gBACvD,uDAAuD;gBACvD,gCAAgC;aAChC;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,KAAK,MAAM,QAAQ,IAAI;gBACtB,wBAAwB;gBACxB,6BAA6B;gBAC7B,kBAAkB;aAClB,EAAE,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,QAAQ,qBAAqB,CAAC,CAAC,CAAA;gBACtF,yDAAyD;gBACzD,wDAAwD;gBACxD,0DAA0D;gBAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;YACvF,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,yDAAyD;YACzD,0DAA0D;YAC1D,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,8CAA8C;aAC9C,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACjE,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;AACX,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts

@@ -1,16 +0,0 @@
-/**
- * `resolveTimeoutMs` is the guest agent's only guard against a
- * caller-requested `timeoutMs` that has no schema ceiling upstream (it
- * traces back to the bash tool's model-authored `timeout` argument — see
- * `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
- * be refused (the sibling `worker/server.js` answers `invalid_timeout` on
- * response), not silently shortened — a caller that asked for more and got
- * less without being told would believe its process was protected for the
- * duration it actually asked for.
- *
- * Pure-function test, no socket/process involved, so it runs on every
- * platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
- * `/bin/sh` and skip on Windows).
- */
-export {};
-//# sourceMappingURL=agent-timeout-clamp.test.d.ts.map

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-timeout-clamp.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js

@@ -1,37 +0,0 @@
-/**
- * `resolveTimeoutMs` is the guest agent's only guard against a
- * caller-requested `timeoutMs` that has no schema ceiling upstream (it
- * traces back to the bash tool's model-authored `timeout` argument — see
- * `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
- * be refused (the sibling `worker/server.js` answers `invalid_timeout` on
- * response), not silently shortened — a caller that asked for more and got
- * less without being told would believe its process was protected for the
- * duration it actually asked for.
- *
- * Pure-function test, no socket/process involved, so it runs on every
- * platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
- * `/bin/sh` and skip on Windows).
- */
-import { createRequire } from 'node:module';
-import { describe, expect, it } from 'vitest';
-const require_ = createRequire(import.meta.url);
-const agent = require_('../../../../agent/agent.cjs');
-describe('agent.cjs resolveTimeoutMs', () => {
-    it('passes through a caller value within the cap', () => {
-        expect(agent.resolveTimeoutMs(10_000)).toBe(10_000);
-    });
-    it('falls back to the default for an omitted value', () => {
-        expect(agent.resolveTimeoutMs(undefined)).toBe(5 * 60 * 1000);
-    });
-    it('refuses a request far above the cap instead of honoring or silently shortening it', () => {
-        expect(() => agent.resolveTimeoutMs(Number.MAX_SAFE_INTEGER)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(10 ** 12)).toThrow(/timeoutMs/);
-    });
-    it('refuses a non-finite or non-positive value', () => {
-        expect(() => agent.resolveTimeoutMs(0)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(-1)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(Number.NaN)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(Number.POSITIVE_INFINITY)).toThrow(/timeoutMs/);
-    });
-});
-//# sourceMappingURL=agent-timeout-clamp.test.js.map

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-timeout-clamp.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAM/C,MAAM,KAAK,GAAG,QAAQ,CAAC,6BAA6B,CAAgB,CAAA;AAEpE,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/backend.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * Firecracker `SandboxBackend` end-to-end over the loopback agent.
- *
- * Stubs the orchestrator control plane (`fetch` for `/sandboxes` create
- * + `:delete`) and points the returned vsock handle at a unix-socket
- * loopback running the REAL `agent/agent.cjs`. Proves the full
- * {@link Sandbox} handle the SDK consumes — `exec` / `writeFile` /
- * `readFile` / `listFiles` / `destroy` / `status` — speaks the NDJSON
- * wire over the vsock transport, and that the readiness fence waits on
- * the agent's healthz (not the orchestrator 2xx).
- */
-export {};
-//# sourceMappingURL=backend.test.d.ts.map

package/dist/backends/firecracker/__tests__/backend.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backend.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/backend.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}