@namzu/sdk 0.6.0 → 1.1.0

package/dist/types/sandbox/index.d.ts

@@ -17,6 +17,15 @@ export interface SandboxExecOptions {
     readonly env?: Record<string, string>;
     readonly cwd?: string;
 }
+/**
+ * One regular file inside the sandbox filesystem. Backends return
+ * absolute paths so the caller can pass each path straight back to
+ * {@link Sandbox.readFile} without re-anchoring.
+ */
+export interface SandboxFileEntry {
+    readonly path: string;
+    readonly size: number;
+}
 export interface Sandbox {
     readonly id: SandboxId;
     readonly status: SandboxStatus;
@@ -25,8 +34,177 @@ export interface Sandbox {
     exec(command: string, args?: string[], opts?: SandboxExecOptions): Promise<SandboxExecResult>;
     writeFile(path: string, content: string | Buffer): Promise<void>;
     readFile(path: string): Promise<Buffer>;
+    /**
+     * Recursively enumerate regular files under `rootPath`. Directories,
+     * symlinks, sockets, and other non-regular entries are skipped.
+     * Returns absolute paths so the caller can feed each into
+     * {@link readFile} directly.
+     *
+     * Used by hosts that drain agent-produced output files out of the
+     * sandbox before {@link destroy} (object-store-first persistence
+     * pattern; the sandbox's own filesystem is ephemeral).
+     *
+     * Implementations:
+     *  - Local / process-tier backends: `fs.readdir` recursively.
+     *  - Container-tier backends: `exec('find', [rootPath, '-type', 'f', …])`
+     *    against the worker, output parsed line-by-line.
+     *
+     * Implementations SHOULD return an empty array if `rootPath` does
+     * not exist (the agent may not have written anything yet). They
+     * MAY throw for other I/O failures.
+     */
+    listFiles(rootPath: string): Promise<readonly SandboxFileEntry[]>;
     destroy(): Promise<void>;
 }
+/**
+ * Source of a container mount's data on the host side. Tagged union;
+ * the discriminator lets a backend reject sources it can't honour
+ * instead of guessing. Each variant is interpreted by exactly one
+ * class of backend:
+ *
+ *  - `hostDir` — bind-mount from a path on the host filesystem.
+ *    Docker / Podman / containerd / Firecracker virtio-fs all
+ *    consume this. Local-dev tier and self-host VM tier.
+ *
+ *  - `azureFileShare` — mount an Azure Files SMB share into the
+ *    container. Used by managed Azure Container Instances (incl.
+ *    Standby Pool) which have no host filesystem to bind from; the
+ *    Vandal-side host provisions a per-task share before claim and
+ *    the ACI backend translates this variant to ACI's `volume +
+ *    azureFile` shape.
+ */
+export type ContainerSandboxMountSource = {
+    readonly type: 'hostDir';
+    readonly hostPath: string;
+} | {
+    readonly type: 'azureFileShare';
+    readonly storageAccountName: string;
+    readonly shareName: string;
+    /**
+     * Per-share access key. ACI accepts the storage account key
+     * inline on the volume definition. Hosts that want a tighter
+     * surface can issue a per-share SAS upstream; the backend
+     * accepts the key here verbatim — it never reads from env.
+     */
+    readonly storageAccountKey: string;
+} | {
+    /**
+     * No external mount — the image itself provides the directory.
+     * Used by managed-warm-pool backends (ACI Standby Pool) whose
+     * claim semantics forbid per-task volume overrides. The
+     * container's own ephemeral filesystem carries the run; the
+     * host walks output files out via the worker's HTTP API
+     * before destroy and persists them somewhere durable
+     * (e.g. blob storage).
+     */
+    readonly type: 'inImage';
+};
+/**
+ * One container mount carrying a packaged skill bundle. The default
+ * `containerPath` is `/mnt/skills/<id>`.
+ */
+export interface ContainerSandboxSkillMount {
+    readonly id: string;
+    readonly source: ContainerSandboxMountSource;
+    readonly containerPath?: string;
+}
+/**
+ * One container mount: source + optional in-container path. Building
+ * block of {@link ContainerSandboxLayout}.
+ */
+export interface ContainerSandboxLayoutMount {
+    readonly source: ContainerSandboxMountSource;
+    readonly containerPath?: string;
+}
+/**
+ * Declarative multi-mount taxonomy for a CONTAINER sandbox. Mirrors
+ * the layout Anthropic's container architecture exposes to the model
+ * (Claude container blueprint, Code Interpreter, "skills"):
+ *
+ *  - `outputs` — RW bind. User-visible output surface that the
+ *    user consumes after the run. Default container path
+ *    `/mnt/user-data/outputs`. **Required** for container backends:
+ *    without it the model has no place to persist work past the
+ *    container's lifetime.
+ *
+ *  - `uploads` — RO bind. Files the user attached to the
+ *    conversation. Default container path `/mnt/user-data/uploads`.
+ *
+ *  - `toolResults` — RO bind. Cached fetches / search results
+ *    surfaced from prior tool calls. Default container path
+ *    `/mnt/user-data/tool_results`.
+ *
+ *  - `skills` — RO list, one per skill bundle. Container path
+ *    defaults to `/mnt/skills/<id>` per entry.
+ *
+ *  - `transcripts` — RO bind. Prior conversation transcripts the
+ *    model can reference. Default container path `/mnt/transcripts`.
+ *
+ * **Scratchpad is intentionally absent.** The container-internal RW
+ * area (`/home/<imageUser>` by reference Dockerfile convention) is
+ * an image-bake responsibility — there is no public knob to declare
+ * it because no backend bind-mounts it. Putting it in the layout
+ * type would advertise a switch the runtime cannot honour.
+ *
+ * `outputs.containerPath` becomes the workspace root the worker
+ * resolves against.
+ *
+ * The `Container` prefix is load-bearing: this shape is specific to
+ * the container tier. MicroVM and process tiers will carry their
+ * own layout types (e.g. `MicroVMSandboxLayout`) when their
+ * adapters land.
+ */
+export interface ContainerSandboxLayout {
+    readonly outputs: ContainerSandboxLayoutMount;
+    readonly uploads?: ContainerSandboxLayoutMount;
+    /**
+     * Working/scratch space for the agent. Sibling mount to `outputs`,
+     * not a child of it: the output collector / output watcher
+     * scans `outputs` only, so anything the agent writes under
+     * `scratch` is invisible to the user by construction. Mirrors the
+     * Anthropic Cowork pattern (`/home/claude` as scratch vs.
+     * `/mnt/user-data/outputs` as the user-visible output area).
+     * Hosts that don't need a separate scratch mount may omit this.
+     */
+    readonly scratch?: ContainerSandboxLayoutMount;
+    readonly toolResults?: ContainerSandboxLayoutMount;
+    readonly skills?: readonly ContainerSandboxSkillMount[];
+    readonly transcripts?: ContainerSandboxLayoutMount;
+}
+/**
+ * Same shape as {@link ContainerSandboxLayout}, but every container
+ * path is resolved (no defaults left implicit). Backends produce
+ * this internally and pass it to the mount-flag renderer. Exported
+ * so advanced consumers (test harnesses, prompt template generators)
+ * can inspect the post-default layout the model actually sees.
+ */
+export interface ResolvedContainerSandboxLayout {
+    readonly outputs: {
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    };
+    readonly uploads?: {
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    };
+    readonly scratch?: {
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    };
+    readonly toolResults?: {
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    };
+    readonly skills?: readonly {
+        readonly id: string;
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    }[];
+    readonly transcripts?: {
+        readonly source: ContainerSandboxMountSource;
+        readonly containerPath: string;
+    };
+}
 export interface SandboxCreateConfig {
     readonly workingDirectory?: string;
     readonly env?: Record<string, string>;
@@ -34,6 +212,21 @@ export interface SandboxCreateConfig {
     readonly memoryLimitMb?: number;
     readonly maxProcesses?: number;
 }
+/**
+ * Tier-specific layout types ({@link ContainerSandboxLayout}, future
+ * `MicroVMSandboxLayout`, etc.) are intentionally NOT fields on
+ * {@link SandboxCreateConfig}. The layout is per-task — different
+ * `hostPath`s for different runs — but it is supplied at
+ * **provider construction**, not at `provider.create()`. See
+ * `@namzu/sandbox`'s `createSandboxProvider({ backend, layout })`.
+ * Putting layout on `SandboxCreateConfig` would let the SDK runtime
+ * (`drainQuery`) call `provider.create()` without it and trigger a
+ * runtime validation failure that the type system cannot catch — a
+ * trap Codex flagged in the second review round. Hosts spawning a
+ * sandbox per task construct one provider per task too; the same
+ * closure that knows the per-task `hostPath`s is the one that calls
+ * `createSandboxProvider`.
+ */
 export interface SandboxProvider {
     readonly id: string;
     readonly name: string;

package/dist/types/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAMhD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;AAEvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAY/D;AAMD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,OAAO,CAAA;AAE/E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAWtE;AAMD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC3B;AAMD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7F,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAMD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC9B;AAMD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtD;AAMD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAO9B,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAMhD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;AAEvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAY/D;AAMD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,OAAO,CAAA;AAE/E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAWtE;AAMD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC3B;AAMD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAMD,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7F,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,2BAA2B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACjC,GACD;IACA;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACvB,CAAA;AAEJ;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,EAAE,CAAA;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;CACD;AAMD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtD;AAMD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAO9B,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/types/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AASzC,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;AACF,CAAC;AAQD,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC/D,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,OAAO;YACX,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,GAAG,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;AACF,CAAC;AA+DD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AASzC,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;AACF,CAAC;AAQD,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC/D,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,OAAO;YACX,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,GAAG,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;AACF,CAAC;AA0RD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAA"}

package/dist/types/skills/index.d.ts

@@ -1,7 +1,9 @@
 export interface SkillMetadata {
     name: string;
     description: string;
+    license?: string;
     compatibility?: string;
+    allowedTools?: string;
     metadata?: Record<string, string>;
 }
 export interface Skill {

package/dist/types/skills/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/skills/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAA;IAEZ,WAAW,EAAE,MAAM,CAAA;IAEnB,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,KAAK;IACrB,QAAQ,EAAE,aAAa,CAAA;IAEvB,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEjE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,KAAK,CAAA;IACZ,eAAe,EAAE,oBAAoB,CAAA;IAErC,aAAa,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,SAAS,EAAE,KAAK,EAAE,CAAA;IAElB,GAAG,EAAE,KAAK,EAAE,CAAA;IAEZ,QAAQ,EAAE,KAAK,EAAE,CAAA;CACjB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/skills/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAA;IAEZ,WAAW,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,KAAK;IACrB,QAAQ,EAAE,aAAa,CAAA;IAEvB,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEjE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,KAAK,CAAA;IACZ,eAAe,EAAE,oBAAoB,CAAA;IAErC,aAAa,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,SAAS,EAAE,KAAK,EAAE,CAAA;IAElB,GAAG,EAAE,KAAK,EAAE,CAAA;IAEZ,QAAQ,EAAE,KAAK,EAAE,CAAA;CACjB"}

package/dist/types/tool/index.d.ts

@@ -9,6 +9,17 @@ export interface ToolRegistryRef {
     activate(names: string[]): void;
     getAvailability(name: string): ToolAvailability;
 }
+/**
+ * Tracks which files the agent has read in the current run.
+ * Write tool consults this to enforce the "read before overwrite" invariant
+ * (Claude Code parity): an existing file must be read first or the write fails.
+ * Keys are the resolved path used by the tool — sandbox-relative when a sandbox
+ * is active, absolute (`workingDirectory`-resolved) otherwise.
+ */
+export interface FileReadTracker {
+    recordRead(key: string): void;
+    hasRead(key: string): boolean;
+}
 export interface ToolContext {
     runId: RunId;
     workingDirectory: string;
@@ -22,7 +33,18 @@ export interface ToolContext {
     };
     invocationState?: InvocationState;
     toolRegistry?: ToolRegistryRef;
+    allowedTools?: readonly string[];
     sandbox?: Sandbox;
+    fileReadTracker?: FileReadTracker;
+    /**
+     * The `tool_use_id` of the assistant block that triggered this
+     * execution. Tools that spawn background work (e.g. coordinator
+     * `create_task`) thread this id into their tracking metadata so
+     * a later, asynchronous completion can be replied back as a
+     * canonical `tool_result` content block bound to the same id.
+     * Optional because not every executor path provides it yet.
+     */
+    toolUseId?: string;
 }
 export interface ToolResult {
     success: boolean;

package/dist/types/tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAExE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,IAAI,IAAI,CAAA;IAEb,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAA;IAC7C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;IACxC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,MAAM,IAAI,cAAc,EAAE,CAAA;IAC1B,OAAO,IAAI,MAAM,EAAE,CAAA;IACnB,SAAS,IAAI,MAAM,EAAE,CAAA;IAErB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC5B,UAAU,IAAI,IAAI,CAAA;IAClB,YAAY,IAAI,OAAO,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAExD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAEhG,IAAI,IAAI,MAAM,CAAA;IAEd,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAA;IACjD,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAC7C,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAClD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAExE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,IAAI,IAAI,CAAA;IAEb,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAA;IAC7C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;IACxC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,MAAM,IAAI,cAAc,EAAE,CAAA;IAC1B,OAAO,IAAI,MAAM,EAAE,CAAA;IACnB,SAAS,IAAI,MAAM,EAAE,CAAA;IAErB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC5B,UAAU,IAAI,IAAI,CAAA;IAClB,YAAY,IAAI,OAAO,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAExD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAEhG,IAAI,IAAI,MAAM,CAAA;IAEd,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAA;IACjD,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAC7C,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAClD"}

package/dist/types/toolset/index.d.ts

@@ -0,0 +1,71 @@
+import type { LLMToolSchema, ToolDefinition, ToolPermission } from '../tool/index.js';
+export type ToolCatalogSurface = 'chat' | 'cowork' | 'managed-agent' | 'worker' | 'code';
+export type ToolSourceKind = 'host_tool' | 'provider_builtin' | 'mcp_server' | 'skill' | 'plugin' | 'connector';
+export type ToolLoadingMode = 'eager' | 'deferred' | 'disabled' | 'suspended';
+export type ToolPermissionPolicy = 'default' | 'always_allow' | 'always_ask' | 'deny';
+export interface ToolSource {
+    readonly id: string;
+    readonly kind: ToolSourceKind;
+    readonly name: string;
+    readonly description?: string;
+    readonly provider?: string;
+    readonly mcpServer?: {
+        readonly name: string;
+        readonly url?: string;
+        readonly transport?: 'streamable_http' | 'sse' | 'stdio';
+        readonly authorizationRef?: string;
+    };
+    readonly providerTool?: {
+        readonly type: string;
+        readonly name?: string;
+        readonly beta?: string;
+    };
+    readonly skill?: {
+        readonly type: 'anthropic' | 'custom';
+        readonly skillId: string;
+        readonly version?: string;
+    };
+    readonly metadata?: Record<string, unknown>;
+}
+export interface ToolsetPolicy {
+    readonly enabled?: boolean;
+    readonly loading?: ToolLoadingMode;
+    readonly preferred?: boolean;
+    readonly permissionPolicy?: ToolPermissionPolicy;
+    readonly surfaces?: readonly ToolCatalogSurface[];
+    readonly providerConfig?: Record<string, unknown>;
+}
+export interface ToolsetDefinition {
+    readonly id: string;
+    readonly sourceId: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly defaultPolicy?: ToolsetPolicy;
+    readonly toolPolicies?: Record<string, ToolsetPolicy>;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface ToolCatalogEntry {
+    readonly name: string;
+    readonly description: string;
+    readonly sourceId: string;
+    readonly toolsetId: string;
+    readonly policy: ToolsetPolicy;
+    readonly definition?: ToolDefinition;
+    readonly llmSchema?: LLMToolSchema;
+    readonly permissions?: readonly ToolPermission[];
+    readonly category?: ToolDefinition['category'];
+    readonly metadata?: Record<string, unknown>;
+}
+export interface ToolCatalogSearchResult {
+    readonly tool: ToolCatalogEntry;
+    readonly source: ToolSource;
+    readonly toolset: ToolsetDefinition;
+    readonly score: number;
+    readonly matched: readonly string[];
+}
+export interface ToolCatalogSnapshot {
+    readonly sources: readonly ToolSource[];
+    readonly toolsets: readonly ToolsetDefinition[];
+    readonly tools: readonly ToolCatalogEntry[];
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/toolset/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/toolset/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAErF,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,eAAe,GAAG,QAAQ,GAAG,MAAM,CAAA;AAExF,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,kBAAkB,GAClB,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,WAAW,CAAA;AAEd,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAA;AAE7E,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,GAAG,MAAM,CAAA;AAErF,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,GAAG,KAAK,GAAG,OAAO,CAAA;QACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAClC,CAAA;IACD,QAAQ,CAAC,YAAY,CAAC,EAAE;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAA;QACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAA;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC3C"}

package/dist/types/toolset/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/toolset/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/toolset/index.ts"],"names":[],"mappings":""}

package/dist/types/workspace/index.d.ts

@@ -1,2 +1,3 @@
 export type { GitWorktreeBackendMeta, WorkspaceBackendKind, WorkspaceBackendMeta, WorkspaceRef, } from './ref.js';
+export type { SharedRunWorkspaceAgentRecord, SharedRunWorkspaceManifest, SharedRunWorkspacePaths, SharedRunWorkspacePlan, SharedRunWorkspaceRefs, SharedRunWorkspaceSource, } from './shared-run.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/workspace/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/workspace/index.ts"],"names":[],"mappings":"AAMA,YAAY,EACX,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACZ,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/workspace/index.ts"],"names":[],"mappings":"AAMA,YAAY,EACX,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACZ,MAAM,UAAU,CAAA;AAEjB,YAAY,EACX,6BAA6B,EAC7B,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACxB,MAAM,iBAAiB,CAAA"}

package/dist/types/workspace/shared-run.d.ts

@@ -0,0 +1,61 @@
+export interface SharedRunWorkspacePaths {
+    root: string;
+    manifest: string;
+    sharedContext: string;
+    sources: string;
+    plans: string;
+    agents: string;
+}
+export interface SharedRunWorkspaceSource {
+    id: string;
+    label: string;
+    path: string;
+    kind?: string;
+    sizeBytes?: number;
+}
+export interface SharedRunWorkspacePlan {
+    id: string;
+    briefPath: string;
+    status: 'seeded' | 'ready' | 'running' | 'completed' | 'failed';
+    updatedAt: string;
+}
+export interface SharedRunWorkspaceAgentRecord {
+    agentId: string;
+    taskId?: string;
+    workPath: string;
+    status: 'assigned' | 'running' | 'completed' | 'failed' | 'canceled';
+    updatedAt: string;
+}
+export interface SharedRunWorkspaceManifest {
+    schemaVersion: 1;
+    kind: 'shared-run-workspace';
+    createdAt: string;
+    updatedAt: string;
+    label?: string;
+    paths: SharedRunWorkspacePaths;
+    sources: SharedRunWorkspaceSource[];
+    plans: SharedRunWorkspacePlan[];
+    agents: SharedRunWorkspaceAgentRecord[];
+}
+export interface SharedRunWorkspaceRefs {
+    rootPath: string;
+    manifestPath: string;
+    /**
+     * Path to the shared coordination packet for this run. Workers read this
+     * before the larger task context or source inventory so common runtime
+     * instructions, source summaries, and workspace paths are not rediscovered
+     * independently by every specialist.
+     */
+    sharedContextPath: string;
+    sourceInventoryPath: string;
+    supervisorBriefPath: string;
+    /**
+     * Path to the canonical, full-fidelity user task description for this run.
+     * Workers read this instead of receiving the user's request text inline in
+     * every child prompt — keeps child prompts compact and lets the request
+     * grow without bloating per-worker handoffs.
+     */
+    taskContextPath: string;
+    agentsPath: string;
+}
+//# sourceMappingURL=shared-run.d.ts.map

package/dist/types/workspace/shared-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-run.d.ts","sourceRoot":"","sources":["../../../src/types/workspace/shared-run.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;IAC/D,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAA;IACpE,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,0BAA0B;IAC1C,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,sBAAsB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,uBAAuB,CAAA;IAC9B,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,KAAK,EAAE,sBAAsB,EAAE,CAAA;IAC/B,MAAM,EAAE,6BAA6B,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CAClB"}

package/dist/types/workspace/shared-run.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shared-run.js.map

package/dist/types/workspace/shared-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-run.js","sourceRoot":"","sources":["../../../src/types/workspace/shared-run.ts"],"names":[],"mappings":""}

package/dist/verification/index.d.ts

@@ -1,3 +1,4 @@
 export { VerificationGate, type ToolCallContext } from './gate.js';
+export { defaultSandboxedGateConfig, defaultSandboxedShellGateConfig } from './presets.js';
 export { evaluateRule } from './rules.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/verification/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}

package/dist/verification/index.js

@@ -1,3 +1,4 @@
 export { VerificationGate } from './gate.js';
+export { defaultSandboxedGateConfig, defaultSandboxedShellGateConfig } from './presets.js';
 export { evaluateRule } from './rules.js';
 //# sourceMappingURL=index.js.map

package/dist/verification/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAwB,MAAM,WAAW,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAwB,MAAM,WAAW,CAAA;AAClE,OAAO,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}

package/dist/verification/presets.d.ts

@@ -0,0 +1,53 @@
+import type { VerificationGateConfig } from '../types/verification/index.js';
+/**
+ * Sensible defaults for an agent that runs inside a host-provided
+ * sandbox (isolated working directory, isolated container, or both).
+ *
+ * The model: the sandbox is the safety boundary. Anything that
+ * stays inside the sandbox auto-approves. Things that try to escape
+ * (network reach, shell tricks the dangerous-pattern list catches)
+ * fall through to a human review prompt. This mirrors Codex CLI's
+ * `workspace-write` + `on-request` default and Claude Code's
+ * sandboxed permission mode.
+ *
+ * What this enables:
+ * - `allowReadOnlyTools` — anything `tool.isReadOnly(input)` reports
+ *   as read-only auto-approves (file reads, lookups, web search).
+ * - `denyDangerousPatterns` — the canonical brick-the-host shell
+ *   tricks (`rm -rf /`, sudo, `curl … | sh`, etc.) hard-deny.
+ * - `allow_by_category: ['filesystem', 'analysis', 'custom']` —
+ *   in-sandbox file mutation (write_file / edit) auto-approves
+ *   because the FS boundary is enforced by the sandbox layer, not
+ *   by per-call review.
+ *
+ * What still prompts for review:
+ * - `category: 'shell'` and `category: 'network'` tools — bash and
+ *   network calls do NOT auto-approve. The host is expected to
+ *   either layer additional rules for its own threat model or rely
+ *   on the review prompt. This is the conservative choice; hosts
+ *   that trust their sandbox enough to auto-approve shell can opt
+ *   in via {@link defaultSandboxedShellGateConfig}.
+ *
+ * Hosts override individual fields by spreading: `{ ...defaultSandboxedGateConfig(), logDecisions: false }`.
+ */
+export declare function defaultSandboxedGateConfig(): VerificationGateConfig;
+/**
+ * Like {@link defaultSandboxedGateConfig} but additionally trusts
+ * `category: 'shell'` tools (bash, etc.) to auto-approve inside the
+ * sandbox, on the assumption that the host has real OS-level
+ * isolation around the agent's working directory and outbound
+ * network. The dangerous-patterns deny rule still hard-denies the
+ * canonical brick patterns.
+ *
+ * Use this when:
+ * - The agent runs inside a per-task container or VM.
+ * - Outbound network is gated by an egress allowlist proxy.
+ * - The cost of a per-call review prompt outweighs the cost of an
+ *   in-sandbox shell mistake.
+ *
+ * Don't use this when the agent runs in a shared process with
+ * other tenants, or when the working directory is the user's
+ * actual home/repo without an extra isolation layer.
+ */
+export declare function defaultSandboxedShellGateConfig(): VerificationGateConfig;
+//# sourceMappingURL=presets.d.ts.map

package/dist/verification/presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../src/verification/presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAQnE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,IAAI,sBAAsB,CAUxE"}

package/dist/verification/presets.js

@@ -0,0 +1,70 @@
+/**
+ * Sensible defaults for an agent that runs inside a host-provided
+ * sandbox (isolated working directory, isolated container, or both).
+ *
+ * The model: the sandbox is the safety boundary. Anything that
+ * stays inside the sandbox auto-approves. Things that try to escape
+ * (network reach, shell tricks the dangerous-pattern list catches)
+ * fall through to a human review prompt. This mirrors Codex CLI's
+ * `workspace-write` + `on-request` default and Claude Code's
+ * sandboxed permission mode.
+ *
+ * What this enables:
+ * - `allowReadOnlyTools` — anything `tool.isReadOnly(input)` reports
+ *   as read-only auto-approves (file reads, lookups, web search).
+ * - `denyDangerousPatterns` — the canonical brick-the-host shell
+ *   tricks (`rm -rf /`, sudo, `curl … | sh`, etc.) hard-deny.
+ * - `allow_by_category: ['filesystem', 'analysis', 'custom']` —
+ *   in-sandbox file mutation (write_file / edit) auto-approves
+ *   because the FS boundary is enforced by the sandbox layer, not
+ *   by per-call review.
+ *
+ * What still prompts for review:
+ * - `category: 'shell'` and `category: 'network'` tools — bash and
+ *   network calls do NOT auto-approve. The host is expected to
+ *   either layer additional rules for its own threat model or rely
+ *   on the review prompt. This is the conservative choice; hosts
+ *   that trust their sandbox enough to auto-approve shell can opt
+ *   in via {@link defaultSandboxedShellGateConfig}.
+ *
+ * Hosts override individual fields by spreading: `{ ...defaultSandboxedGateConfig(), logDecisions: false }`.
+ */
+export function defaultSandboxedGateConfig() {
+    return {
+        enabled: true,
+        allowReadOnlyTools: true,
+        denyDangerousPatterns: true,
+        logDecisions: false,
+        rules: [{ type: 'allow_by_category', categories: ['filesystem', 'analysis', 'custom'] }],
+    };
+}
+/**
+ * Like {@link defaultSandboxedGateConfig} but additionally trusts
+ * `category: 'shell'` tools (bash, etc.) to auto-approve inside the
+ * sandbox, on the assumption that the host has real OS-level
+ * isolation around the agent's working directory and outbound
+ * network. The dangerous-patterns deny rule still hard-denies the
+ * canonical brick patterns.
+ *
+ * Use this when:
+ * - The agent runs inside a per-task container or VM.
+ * - Outbound network is gated by an egress allowlist proxy.
+ * - The cost of a per-call review prompt outweighs the cost of an
+ *   in-sandbox shell mistake.
+ *
+ * Don't use this when the agent runs in a shared process with
+ * other tenants, or when the working directory is the user's
+ * actual home/repo without an extra isolation layer.
+ */
+export function defaultSandboxedShellGateConfig() {
+    return {
+        enabled: true,
+        allowReadOnlyTools: true,
+        denyDangerousPatterns: true,
+        logDecisions: false,
+        rules: [
+            { type: 'allow_by_category', categories: ['filesystem', 'shell', 'analysis', 'custom'] },
+        ],
+    };
+}
+//# sourceMappingURL=presets.js.map

package/dist/verification/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/verification/presets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO;QACN,OAAO,EAAE,IAAI;QACb,kBAAkB,EAAE,IAAI;QACxB,qBAAqB,EAAE,IAAI;QAC3B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KACxF,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,+BAA+B;IAC9C,OAAO;QACN,OAAO,EAAE,IAAI;QACb,kBAAkB,EAAE,IAAI;QACxB,qBAAqB,EAAE,IAAI;QAC3B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE;YACN,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE;SACxF;KACD,CAAA;AACF,CAAC"}