@namzu/sdk 0.1.4-rc.2 → 0.1.4

package/dist/types/sandbox/index.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+import { SANDBOX_DEFAULT_MAX_PROCESSES, SANDBOX_DEFAULT_MEMORY_LIMIT_MB, SANDBOX_DEFAULT_TIMEOUT_MS, } from '../../constants/sandbox/index.js';
+export function assertSandboxStatus(status) {
+    switch (status) {
+        case 'creating':
+        case 'ready':
+        case 'busy':
+        case 'destroyed':
+            return;
+        default: {
+            const _exhaustive = status;
+            throw new Error(`Unknown SandboxStatus: ${_exhaustive}`);
+        }
+    }
+}
+export function assertSandboxEnvironment(env) {
+    switch (env) {
+        case 'linux-namespace':
+        case 'macos-seatbelt':
+        case 'basic':
+            return;
+        default: {
+            const _exhaustive = env;
+            throw new Error(`Unknown SandboxEnvironment: ${_exhaustive}`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Runtime config schema
+// ---------------------------------------------------------------------------
+export const SandboxConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+    provider: z.enum(['local']).default('local'),
+    timeoutMs: z.number().positive().default(SANDBOX_DEFAULT_TIMEOUT_MS),
+    memoryLimitMb: z.number().positive().default(SANDBOX_DEFAULT_MEMORY_LIMIT_MB),
+    maxProcesses: z.number().positive().default(SANDBOX_DEFAULT_MAX_PROCESSES),
+    cleanupOnDestroy: z.boolean().default(true),
+});
+//# sourceMappingURL=index.js.map

package/dist/types/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AASzC,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;AACF,CAAC;AAQD,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC/D,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,OAAO;YACX,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,GAAG,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;AACF,CAAC;AA+DD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAA"}

package/dist/types/tool/index.d.ts

@@ -2,6 +2,7 @@ import type { z } from 'zod';
 import type { Logger } from '../../utils/logger.js';
 import type { RunId } from '../ids/index.js';
 import type { PermissionMode } from '../permission/index.js';
+import type { Sandbox } from '../sandbox/index.js';
 export interface ToolRegistryRef {
     searchDeferred(query: string): ToolDefinition[];
     activate(names: string[]): void;
@@ -15,10 +16,11 @@ export interface ToolContext {
     log: (level: 'info' | 'warn' | 'error', message: string) => void;
     permissionContext?: {
         mode: PermissionMode;
-        sessionId: string;
+        runId: string;
         workingDirectory: string;
     };
     toolRegistry?: ToolRegistryRef;
+    sandbox?: Sandbox;
 }
 export interface ToolResult {
     success: boolean;

package/dist/types/tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;QACjB,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,YAAY,CAAC,EAAE,eAAe,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B"}

package/dist/utils/id.d.ts

@@ -1,4 +1,4 @@
-import type { ActivityId, AdvisoryCallId, AdvisoryId, CheckpointId, ChunkId, ConnectorId, ConnectorInstanceId, CredentialId, DocumentId, EmergencySaveId, EnvironmentId, ExecutionContextId, KnowledgeBaseId, MCPClientId, MCPServerId, MCPSessionId, MemoryId, MessageId, PlanId, PluginId, RunId, SessionId, TaskId, TenantId, ThreadId, ToolCallId } from '../types/ids/index.js';
+import type { ActivityId, AdvisoryCallId, AdvisoryId, CheckpointId, ChunkId, ConnectorId, ConnectorInstanceId, CredentialId, DocumentId, EmergencySaveId, EnvironmentId, ExecutionContextId, KnowledgeBaseId, MCPClientId, MCPServerId, MCPSessionId, MemoryId, MessageId, PlanId, PluginId, RunId, SandboxId, SessionId, TaskId, TenantId, ThreadId, ToolCallId } from '../types/ids/index.js';
 export declare function generateThreadId(): ThreadId;
 export declare function generateRunId(): RunId;
 export declare function generateMessageId(): MessageId;
@@ -25,8 +25,10 @@ export declare function generateAdvisoryCallId(): AdvisoryCallId;
 export declare function generateEmergencySaveId(): EmergencySaveId;
 export declare function generateMemoryId(): MemoryId;
 export declare function generatePluginId(): PluginId;
+export declare function generateSandboxId(): SandboxId;
 export declare function parseThreadId(raw: string): ThreadId;
 export declare function parseRunId(raw: string): RunId;
 export declare function parseConnectorInstanceId(raw: string): ConnectorInstanceId;
 export declare function parsePluginId(raw: string): PluginId;
+export declare function parseSandboxId(raw: string): SandboxId;
 //# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,UAAU,EACV,cAAc,EACd,UAAU,EACV,YAAY,EACZ,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,MAAM,EACN,QAAQ,EACR,KAAK,EACL,SAAS,EACT,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,MAAM,uBAAuB,CAAA;AAsB9B,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,aAAa,IAAI,KAAK,CAErC;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,uBAAuB,IAAI,eAAe,CAEzD;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,2BAA2B,IAAI,mBAAmB,CAEjE;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,0BAA0B,IAAI,kBAAkB,CAE/D;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,qBAAqB,IAAI,aAAa,CAErD;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,sBAAsB,IAAI,cAAc,CAEvD;AAED,wBAAgB,uBAAuB,IAAI,eAAe,CAEzD;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AASD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEnD;AACD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAE7C;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAEzE;AACD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEnD"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,UAAU,EACV,cAAc,EACd,UAAU,EACV,YAAY,EACZ,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,MAAM,EACN,QAAQ,EACR,KAAK,EACL,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,MAAM,uBAAuB,CAAA;AAsB9B,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,aAAa,IAAI,KAAK,CAErC;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,uBAAuB,IAAI,eAAe,CAEzD;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,2BAA2B,IAAI,mBAAmB,CAEjE;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,0BAA0B,IAAI,kBAAkB,CAE/D;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,qBAAqB,IAAI,aAAa,CAErD;AAED,wBAAgB,oBAAoB,IAAI,YAAY,CAEnD;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,sBAAsB,IAAI,cAAc,CAEvD;AAED,wBAAgB,uBAAuB,IAAI,eAAe,CAEzD;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AASD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEnD;AACD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAE7C;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAEzE;AACD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEnD;AACD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAErD"}

package/dist/utils/id.js

@@ -96,6 +96,9 @@ export function generateMemoryId() {
 export function generatePluginId() {
     return generateId('plg_');
 }
+export function generateSandboxId() {
+    return generateId('sbx_');
+}
 function parseId(raw, prefix, typeName) {
     if (!raw.startsWith(prefix)) {
         throw new Error(`Invalid ${typeName}: expected "${prefix}" prefix, got "${raw}"`);
@@ -114,4 +117,7 @@ export function parseConnectorInstanceId(raw) {
 export function parsePluginId(raw) {
     return parseId(raw, 'plg_', 'PluginId');
 }
+export function parseSandboxId(raw) {
+    return parseId(raw, 'sbx_', 'SandboxId');
+}
 //# sourceMappingURL=id.js.map

package/dist/utils/id.js.map

@@ -1 +1 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA8BzC,MAAM,QAAQ,GAAG,sCAAsC,CAAA;AACvD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAA;AACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,YAAY,CAAA;AAEtE,SAAS,UAAU,CAAmB,MAAS,EAAE,MAAM,GAAG,EAAE;IAC3D,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAK;YACzB,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC,CAAA;gBACvC,SAAS,EAAE,CAAA;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,MAAM,GAAG,MAAM,EAAqB,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,2BAA2B;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,0BAA0B;IACzC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,OAAO,CAAmB,GAAW,EAAE,MAAc,EAAE,QAAgB;IAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,eAAe,MAAM,kBAAkB,GAAG,GAAG,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,GAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,OAAO,OAAO,CAAW,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,GAAW;IACrC,OAAO,OAAO,CAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC5C,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,GAAW;IACnD,OAAO,OAAO,CAAsB,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAA;AACvE,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,OAAO,OAAO,CAAW,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAClD,CAAC"}
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA+BzC,MAAM,QAAQ,GAAG,sCAAsC,CAAA;AACvD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAA;AACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,YAAY,CAAA;AAEtE,SAAS,UAAU,CAAmB,MAAS,EAAE,MAAM,GAAG,EAAE;IAC3D,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAK;YACzB,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC,CAAA;gBACvC,SAAS,EAAE,CAAA;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,MAAM,GAAG,MAAM,EAAqB,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,2BAA2B;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,0BAA0B;IACzC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,OAAO,CAAmB,GAAW,EAAE,MAAc,EAAE,QAAgB;IAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,eAAe,MAAM,kBAAkB,GAAG,GAAG,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,GAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,OAAO,OAAO,CAAW,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,GAAW;IACrC,OAAO,OAAO,CAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC5C,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,GAAW;IACnD,OAAO,OAAO,CAAsB,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAA;AACvE,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,OAAO,OAAO,CAAW,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAClD,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,OAAO,CAAY,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;AACpD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@namzu/sdk",
-  "version": "0.1.4-rc.2",
-  "description": "Open-source AI agent framework — multi-model, multi-tenant, MCP + A2A native",
+  "version": "0.1.4",
+  "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/src/agents/ReactiveAgent.ts

@@ -36,7 +36,7 @@ export class ReactiveAgent extends AbstractAgent<ReactiveAgentConfig, ReactiveAg
 			throw new Error('ReactiveAgent.run requires a threadId in config')
 		}
 
-		const session = await drainQuery(
+		const run = await drainQuery(
 			{
 				systemPrompt: config.systemPrompt,
 				persona: config.persona,
@@ -44,7 +44,7 @@ export class ReactiveAgent extends AbstractAgent<ReactiveAgentConfig, ReactiveAg
 				basePrompt: config.basePrompt,
 				provider: config.provider,
 				tools: config.tools,
-				sessionConfig: {
+				runConfig: {
 					model: config.model,
 					tokenBudget: config.tokenBudget,
 					timeoutMs: config.timeoutMs,
@@ -72,7 +72,7 @@ export class ReactiveAgent extends AbstractAgent<ReactiveAgentConfig, ReactiveAg
 		)
 
 		let toolCallCount = 0
-		for (const msg of session.messages) {
+		for (const msg of run.messages) {
 			if (msg.role === 'assistant') {
 				const assistantMsg = msg as AssistantMessage
 				if (assistantMsg.toolCalls) {
@@ -82,16 +82,16 @@ export class ReactiveAgent extends AbstractAgent<ReactiveAgentConfig, ReactiveAg
 		}
 
 		return {
-			runId: session.id,
-			status: session.status,
-			stopReason: session.stopReason,
-			usage: session.tokenUsage,
-			cost: session.costInfo,
-			iterations: session.currentIteration,
+			runId: run.id,
+			status: run.status,
+			stopReason: run.stopReason,
+			usage: run.tokenUsage,
+			cost: run.costInfo,
+			iterations: run.currentIteration,
 			durationMs: Date.now() - startTime,
-			messages: session.messages,
-			result: session.result,
-			lastError: session.lastError,
+			messages: run.messages,
+			result: run.result,
+			lastError: run.lastError,
 			toolCallCount,
 		}
 	}

package/src/agents/SupervisorAgent.ts

@@ -98,12 +98,12 @@ export class SupervisorAgent extends AbstractAgent<SupervisorAgentConfig, Superv
 			tools.register(tool)
 		}
 
-		const session = await drainQuery(
+		const run = await drainQuery(
 			{
 				systemPrompt: config.systemPrompt,
 				provider: config.provider,
 				tools,
-				sessionConfig: {
+				runConfig: {
 					model: config.model,
 					tokenBudget: config.tokenBudget,
 					timeoutMs: config.timeoutMs,
@@ -151,16 +151,16 @@ export class SupervisorAgent extends AbstractAgent<SupervisorAgentConfig, Superv
 		const completedTasks = taskResults.filter((t) => t.result.status === 'completed').length
 
 		return {
-			runId: session.id,
-			status: session.status === 'completed' ? 'completed' : 'failed',
-			stopReason: session.stopReason,
-			usage: session.tokenUsage,
-			cost: session.costInfo,
-			iterations: session.currentIteration,
+			runId: run.id,
+			status: run.status === 'completed' ? 'completed' : 'failed',
+			stopReason: run.stopReason,
+			usage: run.tokenUsage,
+			cost: run.costInfo,
+			iterations: run.currentIteration,
 			durationMs: Date.now() - startTime,
-			messages: session.messages,
-			result: session.result,
-			lastError: session.lastError,
+			messages: run.messages,
+			result: run.result,
+			lastError: run.lastError,
 			taskResults,
 			completedTasks,
 			totalTasks: taskResults.length,

package/src/bridge/a2a/mapper.ts

@@ -128,7 +128,7 @@ const MAPPING: {
 	run_paused: (e, ctx) =>
 		statusEvent(e.runId, 'input-required', false, ctx, {
 			role: 'agent',
-			parts: [{ kind: 'text', text: `Session paused: ${e.reason}` }],
+			parts: [{ kind: 'text', text: `Run paused: ${e.reason}` }],
 		}),
 
 	iteration_completed: null,
@@ -153,6 +153,10 @@ const MAPPING: {
 
 	plugin_hook_executing: null,
 	plugin_hook_completed: null,
+
+	sandbox_created: null,
+	sandbox_exec: null,
+	sandbox_destroyed: null,
 }
 
 export function mapRunToA2AEvent(event: RunEvent, contextId?: string): A2AStreamEvent | null {
@@ -164,4 +168,5 @@ export function mapRunToA2AEvent(event: RunEvent, contextId?: string): A2AStream
 	)
 }
 
+/** @deprecated Use mapRunToA2AEvent */
 export const mapSessionToA2AEvent = mapRunToA2AEvent

package/src/bridge/sse/mapper.ts

@@ -247,6 +247,31 @@ const MAPPING: {
 			result_action: e.result.action,
 		}),
 	},
+
+	sandbox_created: {
+		wire: 'sandbox.created',
+		transform: (e, runId) => ({
+			run_id: runId,
+			sandbox_id: e.sandboxId,
+			environment: e.environment,
+		}),
+	},
+
+	sandbox_exec: {
+		wire: 'sandbox.exec',
+		transform: (e, runId) => ({
+			run_id: runId,
+			sandbox_id: e.sandboxId,
+			command: e.command,
+			exit_code: e.exitCode,
+			duration_ms: e.durationMs,
+		}),
+	},
+
+	sandbox_destroyed: {
+		wire: 'sandbox.destroyed',
+		transform: (e, runId) => ({ run_id: runId, sandbox_id: e.sandboxId }),
+	},
 }
 
 export function mapRunToStreamEvent(event: RunEvent, runId: RunId): MappedStreamEvent | null {
@@ -269,4 +294,5 @@ export function mapRunToStreamEvent(event: RunEvent, runId: RunId): MappedStream
 	return { wire: mapping.wire, data }
 }
 
+/** @deprecated Use mapRunToStreamEvent */
 export const mapSessionToStreamEvent = mapRunToStreamEvent

package/src/config/runtime.ts

@@ -1,5 +1,8 @@
 import { z } from 'zod'
 import { HOOK_TIMEOUT_MS } from '../constants/plugin/index.js'
+import { SandboxConfigSchema } from '../types/sandbox/index.js'
+
+export { SandboxConfigSchema }
 
 export const TaskRouterConfigSchema = z
 	.object({
@@ -71,6 +74,7 @@ export const RuntimeConfigSchema = z.object({
 	agentBus: AgentBusConfigSchema.optional(),
 	promptCache: PromptCacheConfigSchema.optional(),
 	plugins: PluginRuntimeConfigSchema.optional(),
+	sandbox: SandboxConfigSchema.optional(),
 })
 
 export type RuntimeConfig = z.infer<typeof RuntimeConfigSchema>

package/src/constants/index.ts

@@ -12,3 +12,4 @@ export * from './bus/index.js'
 export * from './verification/index.js'
 export * from './emergency.js'
 export * from './plugin/index.js'
+export * from './sandbox/index.js'

package/src/constants/sandbox/index.ts

@@ -0,0 +1,31 @@
+/** Default timeout for sandbox command execution */
+export const SANDBOX_DEFAULT_TIMEOUT_MS = 30_000
+
+/** Default memory limit per sandbox */
+export const SANDBOX_DEFAULT_MEMORY_LIMIT_MB = 512
+
+/** Default max processes per sandbox */
+export const SANDBOX_DEFAULT_MAX_PROCESSES = 32
+
+/** Max stdout/stderr output size before truncation */
+export const SANDBOX_MAX_OUTPUT_BYTES = 10 * 1024 * 1024
+
+/** Temp directory prefix for sandbox roots */
+export const SANDBOX_TEMP_DIR_PREFIX = 'namzu-sbx-'
+
+/** Grace period before SIGKILL after SIGTERM */
+export const SANDBOX_KILL_GRACE_MS = 3_000
+
+/**
+ * Environment variable keys that are safe to pass into sandboxes.
+ * Everything else is stripped.
+ */
+export const SANDBOX_SAFE_ENV_KEYS = new Set([
+	'PATH',
+	'HOME',
+	'SHELL',
+	'LANG',
+	'TERM',
+	'LC_ALL',
+	'LC_CTYPE',
+])

package/src/constants/telemetry/index.ts

@@ -22,8 +22,8 @@ export const GENAI = {
 } as const
 
 export const NAMZU = {
-	SESSION_ID: 'namzu.session.id',
-	SESSION_STATUS: 'namzu.session.status',
+	RUN_ID: 'namzu.run.id',
+	RUN_STATUS: 'namzu.run.status',
 	ITERATION: 'namzu.iteration',
 	TOOL_SUCCESS: 'namzu.tool.success',
 	TOOL_ERROR: 'namzu.tool.error',

package/src/contracts/api.ts

@@ -179,6 +179,9 @@ export type StreamEventType =
 	| 'task.updated'
 	| 'plugin.hook_executing'
 	| 'plugin.hook_completed'
+	| 'sandbox.created'
+	| 'sandbox.exec'
+	| 'sandbox.destroyed'
 
 export interface StreamEvent {
 	event: StreamEventType

package/src/index.ts

@@ -4,9 +4,14 @@ export {
 	TaskRouterConfigSchema,
 	CompactionConfigSchema,
 	PluginRuntimeConfigSchema,
+	SandboxConfigSchema,
 	RUNTIME_DEFAULTS,
 } from './config/runtime.js'
-export type { RuntimeConfig, CompactionConfig, PluginRuntimeConfig } from './config/runtime.js'
+export type {
+	RuntimeConfig,
+	CompactionConfig,
+	PluginRuntimeConfig,
+} from './config/runtime.js'
 
 export * from './constants/index.js'
 
@@ -37,6 +42,7 @@ export * from './types/router/index.js'
 export * from './types/advisory/index.js'
 export * from './types/memory/index.js'
 export * from './types/plugin/index.js'
+export * from './types/sandbox/index.js'
 
 export {
 	AdvisorRegistry,
@@ -83,7 +89,10 @@ export { resolveTaskModel } from './router/task-router.js'
 export { query, drainQuery } from './runtime/query/index.js'
 export type { QueryParams } from './runtime/query/index.js'
 export { ContextCache } from './runtime/query/context-cache.js'
-export type { ContextCacheConfig, PromptCacheInput } from './runtime/query/context-cache.js'
+export type {
+	ContextCacheConfig,
+	PromptCacheInput,
+} from './runtime/query/context-cache.js'
 export { CheckpointManager } from './runtime/query/checkpoint.js'
 export { DecisionParser } from './runtime/decision/parser.js'
 export { FallbackResolver } from './runtime/decision/fallback.js'
@@ -128,7 +137,10 @@ export { RunDiskStore } from './store/run/disk.js'
 export { SessionStore } from './store/run/disk.js'
 
 export { ActivityStore } from './store/activity/memory.js'
-export type { ActivityEvent, ActivityEventListener } from './store/activity/memory.js'
+export type {
+	ActivityEvent,
+	ActivityEventListener,
+} from './store/activity/memory.js'
 export { InMemoryTaskStore } from './store/task/memory.js'
 export { DiskTaskStore } from './store/task/disk.js'
 export type { DiskTaskStoreConfig } from './store/task/disk.js'
@@ -160,6 +172,11 @@ export {
 	UnknownProviderError,
 } from './provider/index.js'
 
+export {
+	LocalSandboxProvider,
+	SandboxProviderFactory,
+} from './sandbox/index.js'
+
 export { defineTool } from './tools/defineTool.js'
 export type { DefineToolOptions } from './tools/defineTool.js'
 export { ToolRegistry } from './registry/tool/execute.js'
@@ -257,7 +274,10 @@ export {
 } from './bridge/a2a/index.js'
 export type { CreateRunFromA2A } from './bridge/a2a/index.js'
 
-export { mapRunToStreamEvent, mapSessionToStreamEvent } from './bridge/sse/index.js'
+export {
+	mapRunToStreamEvent,
+	mapSessionToStreamEvent,
+} from './bridge/sse/index.js'
 export type { MappedStreamEvent } from './bridge/sse/index.js'
 
 export { InMemoryCredentialVault } from './vault/index.js'

package/src/manager/run/emergency.ts

@@ -18,7 +18,7 @@ import type { RunPersistence } from './persistence.js'
 
 export class EmergencySaveManager {
 	private static _instance: EmergencySaveManager | undefined
-	private sessionRef: WeakRef<RunPersistence> | undefined
+	private runRef: WeakRef<RunPersistence> | undefined
 	private outputDir: string | undefined
 	private signalHandlers: Map<string, () => void> = new Map()
 	private log: Logger
@@ -37,9 +37,9 @@ export class EmergencySaveManager {
 		return EmergencySaveManager._instance
 	}
 
-	attach(sessionMgr: RunPersistence, outputDir: string, log: Logger): void {
+	attach(runMgr: RunPersistence, outputDir: string, log: Logger): void {
 		this.detach()
-		this.sessionRef = new WeakRef(sessionMgr)
+		this.runRef = new WeakRef(runMgr)
 		this.outputDir = outputDir
 		this.log = log.child({ component: 'EmergencySaveManager' })
 
@@ -67,17 +67,17 @@ export class EmergencySaveManager {
 			process.removeListener(signal, handler)
 		}
 		this.signalHandlers.clear()
-		this.sessionRef = undefined
+		this.runRef = undefined
 		this.outputDir = undefined
 	}
 
 	emergencySave(signal: string): void {
-		const sessionMgr = this.sessionRef?.deref()
-		if (!sessionMgr || !this.outputDir) {
+		const runMgr = this.runRef?.deref()
+		if (!runMgr || !this.outputDir) {
 			return
 		}
 
-		const snapshot = sessionMgr.toEmergencySnapshot(signal)
+		const snapshot = runMgr.toEmergencySnapshot(signal)
 
 		const emergencyDir = join(this.outputDir, '..', EMERGENCY_DIR_NAME)
 		mkdirSync(emergencyDir, { recursive: true })

package/src/manager/run/persistence.ts

@@ -35,7 +35,7 @@ export class RunPersistence {
 			metadata: {
 				agentId: config.agentId,
 				agentName: config.agentName,
-				config: config.sessionConfig,
+				config: config.runConfig,
 				provider: config.providerId,
 			},
 			messages: [],

package/src/run/reporter.ts

@@ -171,6 +171,31 @@ export function createRunReporter(parentLogger?: Logger): RunReporter {
 				})
 				break
 
+			case 'sandbox_created':
+				log.info('Sandbox created', {
+					runId: event.runId,
+					sandboxId: event.sandboxId,
+					environment: event.environment,
+				})
+				break
+
+			case 'sandbox_exec':
+				log.debug('Sandbox exec', {
+					runId: event.runId,
+					sandboxId: event.sandboxId,
+					command: event.command,
+					exitCode: event.exitCode,
+					durationMs: event.durationMs,
+				})
+				break
+
+			case 'sandbox_destroyed':
+				log.info('Sandbox destroyed', {
+					runId: event.runId,
+					sandboxId: event.sandboxId,
+				})
+				break
+
 			default: {
 				const _exhaustive: never = event
 				throw new Error(`Unhandled run event type: ${(_exhaustive as RunEvent).type}`)

package/src/runtime/query/checkpoint.ts

@@ -19,7 +19,7 @@ export class CheckpointManager {
 	}
 
 	async create(
-		sessionMgr: RunPersistence,
+		runMgr: RunPersistence,
 		iteration: number,
 		extra?: {
 			toolResults?: Array<{ toolCallId: string; toolName: string; input: unknown; output: string }>
@@ -29,14 +29,14 @@ export class CheckpointManager {
 	): Promise<IterationCheckpoint> {
 		const checkpoint: IterationCheckpoint = {
 			id: generateCheckpointId(),
-			runId: sessionMgr.id,
+			runId: runMgr.id,
 			iteration,
-			messages: [...sessionMgr.messages],
-			tokenUsage: { ...sessionMgr.tokenUsage },
-			costInfo: { ...sessionMgr.costInfo },
+			messages: [...runMgr.messages],
+			tokenUsage: { ...runMgr.tokenUsage },
+			costInfo: { ...runMgr.costInfo },
 			guardState: {
-				iterationCount: sessionMgr.currentIteration,
-				elapsedMs: Date.now() - (sessionMgr.getSession().startedAt ?? Date.now()),
+				iterationCount: runMgr.currentIteration,
+				elapsedMs: Date.now() - (runMgr.getSession().startedAt ?? Date.now()),
 			},
 			createdAt: Date.now(),
 			toolResultHashes: extra?.toolResults ? buildToolResultHashes(extra.toolResults) : undefined,
@@ -71,16 +71,16 @@ export class CheckpointManager {
 		}
 	}
 
-	static buildSummary(sessionMgr: RunPersistence, iteration: number): CheckpointSummary {
-		const lastAssistant = [...sessionMgr.messages]
+	static buildSummary(runMgr: RunPersistence, iteration: number): CheckpointSummary {
+		const lastAssistant = [...runMgr.messages]
 			.reverse()
 			.find((m): m is AssistantMessage => m.role === 'assistant' && m.content !== null)
 
 		return {
 			iteration,
-			messageCount: sessionMgr.messages.length,
-			tokenUsage: { ...sessionMgr.tokenUsage },
-			costInfo: { ...sessionMgr.costInfo },
+			messageCount: runMgr.messages.length,
+			tokenUsage: { ...runMgr.tokenUsage },
+			costInfo: { ...runMgr.costInfo },
 			lastAssistantMessage: lastAssistant?.content ?? undefined,
 		}
 	}

package/src/runtime/query/context.ts

@@ -16,7 +16,7 @@ import { getRootLogger } from '../../utils/logger.js'
 export interface RunContextConfig {
 	agentId: string
 	agentName: string
-	sessionConfig: AgentRunConfig
+	runConfig: AgentRunConfig
 	provider: LLMProvider
 	workingDirectory?: string
 	pricing?: ModelPricing
@@ -36,7 +36,7 @@ export interface RunContextConfig {
 export interface RunContext {
 	runId: RunId
 	threadId: ThreadId
-	sessionMgr: RunPersistence
+	runMgr: RunPersistence
 	activityStore: ActivityStore
 	planManager: PlanManager
 	abortController: AbortController
@@ -55,7 +55,7 @@ export class RunContextFactory {
 		}
 
 		const cwd = config.workingDirectory ?? process.cwd()
-		const permissionMode = config.sessionConfig.permissionMode ?? 'auto'
+		const permissionMode = config.runConfig.permissionMode ?? 'auto'
 		const runId = config.runId ?? generateRunId()
 
 		if (!config.threadId) {
@@ -71,11 +71,11 @@ export class RunContextFactory {
 			threadId,
 		})
 
-		const sessionMgr = new RunPersistence({
+		const runMgr = new RunPersistence({
 			runId,
 			agentId: config.agentId,
 			agentName: config.agentName,
-			sessionConfig: config.sessionConfig,
+			runConfig: config.runConfig,
 			providerId: config.provider.id,
 			outputDir,
 			pricing: config.pricing,
@@ -91,7 +91,7 @@ export class RunContextFactory {
 		return {
 			runId,
 			threadId,
-			sessionMgr,
+			runMgr,
 			activityStore,
 			planManager,
 			abortController,