@namzu/sdk 2.0.0 → 3.0.0

package/dist/runtime/query/tool-pause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-pause.js","sourceRoot":"","sources":["../../../src/runtime/query/tool-pause.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAA;AAU1F,SAAS,UAAU,CAAC,OAAyB,EAAE,EAAU;IACxD,OAAO;QACN,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KAC5C,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAqB,EAAE,MAAM,EAAE,CAAC,CAAA;AAElF,MAAM,UAAU,eAAe,CAAC,IAAmB;IAClD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAEhD,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAE7C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,QAAQ,GACb,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAErF,MAAM,QAAQ,GACb,OAAO;YACP,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC;gBACvB,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,EAAE;gBAC1C,QAAQ;aACR,CAAC,CAAC,CAAA;QAEJ,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC3C,OAAO,UAAU,CAAC,0CAA0C,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACrE,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,OAAO,UAAU,CAAC,+CAA+C,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC9F,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAElC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,UAAU,CAAC,8CAA8C,CAAC,CAAA;QAClE,CAAC;QAED,OAAO;YACN,MAAM,EAAE,UAAU;YAClB,iBAAiB;YACjB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAA;IACF,CAAC,CAAA;AACF,CAAC"}

package/dist/runtime/query/tooling.d.ts

@@ -4,7 +4,8 @@ import type { RunId } from '../../types/ids/index.js';
 import type { InvocationState } from '../../types/invocation/index.js';
 import type { PermissionMode } from '../../types/permission/index.js';
 import type { RunEvent } from '../../types/run/index.js';
-import type { ToolRegistryContract } from '../../types/tool/index.js';
+import type { RequestToolPause, ToolRegistryContract } from '../../types/tool/index.js';
+import type { RepairToolCall } from '../../types/tool/repair.js';
 import type { Logger } from '../../utils/logger.js';
 import { ToolExecutor } from './executor.js';
 export type EmitEvent = (event: RunEvent) => Promise<void>;
@@ -18,6 +19,14 @@ export interface ToolingBootstrapConfig {
     allowedTools?: readonly string[];
     invocationState?: InvocationState;
     pluginManager?: PluginLifecycleManager;
+    toolTimeoutMs?: number;
+    maxToolConcurrency?: number;
+    maxToolOutputChars?: number;
+    maxToolContentBytes?: number;
+    toolOutputDir?: string;
+    repairToolCall?: RepairToolCall;
+    /** Builds the durable-pause seam for one tool call; see ToolContext.requestPause. */
+    toolPause?: (toolUseId: string) => RequestToolPause;
 }
 export declare class ToolingBootstrap {
     static init(config: ToolingBootstrapConfig, activityStore: ActivityStore, emitEvent: EmitEvent, log: Logger): ToolExecutor;

package/dist/runtime/query/tooling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tooling.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/tooling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAE1D,MAAM,WAAW,sBAAsB;IACtC,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,aAAa,CAAC,EAAE,sBAAsB,CAAA;CACtC;AAED,qBAAa,gBAAgB;IAC5B,MAAM,CAAC,IAAI,CACV,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,MAAM,GACT,YAAY;CAkBf"}
+{"version":3,"file":"tooling.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/tooling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAE1D,MAAM,WAAW,sBAAsB;IACtC,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,qFAAqF;IACrF,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAA;CACnD;AAED,qBAAa,gBAAgB;IAC5B,MAAM,CAAC,IAAI,CACV,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,MAAM,GACT,YAAY;CA+Bf"}

package/dist/runtime/query/tooling.js

@@ -11,6 +11,19 @@ export class ToolingBootstrap {
             allowedTools: config.allowedTools,
             invocationState: config.invocationState,
             pluginManager: config.pluginManager,
+            ...(config.toolTimeoutMs !== undefined ? { toolTimeoutMs: config.toolTimeoutMs } : {}),
+            ...(config.maxToolConcurrency !== undefined
+                ? { maxToolConcurrency: config.maxToolConcurrency }
+                : {}),
+            ...(config.maxToolOutputChars !== undefined
+                ? { maxToolOutputChars: config.maxToolOutputChars }
+                : {}),
+            ...(config.maxToolContentBytes !== undefined
+                ? { maxToolContentBytes: config.maxToolContentBytes }
+                : {}),
+            ...(config.toolOutputDir !== undefined ? { toolOutputDir: config.toolOutputDir } : {}),
+            ...(config.repairToolCall !== undefined ? { repairToolCall: config.repairToolCall } : {}),
+            ...(config.toolPause !== undefined ? { toolPause: config.toolPause } : {}),
         }, activityStore, emitEvent, log);
     }
 }

package/dist/runtime/query/tooling.js.map

@@ -1 +1 @@
-{"version":3,"file":"tooling.js","sourceRoot":"","sources":["../../../src/runtime/query/tooling.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAgB5C,MAAM,OAAO,gBAAgB;IAC5B,MAAM,CAAC,IAAI,CACV,MAA8B,EAC9B,aAA4B,EAC5B,SAAoB,EACpB,GAAW;QAEX,OAAO,IAAI,YAAY,CACtB;YACC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;SACnC,EACD,aAAa,EACb,SAAS,EACT,GAAG,CACH,CAAA;IACF,CAAC;CACD"}
+{"version":3,"file":"tooling.js","sourceRoot":"","sources":["../../../src/runtime/query/tooling.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAwB5C,MAAM,OAAO,gBAAgB;IAC5B,MAAM,CAAC,IAAI,CACV,MAA8B,EAC9B,aAA4B,EAC5B,SAAoB,EACpB,GAAW;QAEX,OAAO,IAAI,YAAY,CACtB;YACC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,EACD,aAAa,EACb,SAAS,EACT,GAAG,CACH,CAAA;IACF,CAAC;CACD"}

package/dist/sandbox/__tests__/isolation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=isolation.test.d.ts.map

package/dist/sandbox/__tests__/isolation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.test.d.ts","sourceRoot":"","sources":["../../../src/sandbox/__tests__/isolation.test.ts"],"names":[],"mappings":""}

package/dist/sandbox/__tests__/isolation.test.js

@@ -0,0 +1,139 @@
+import { afterAll, describe, expect, it, vi } from 'vitest';
+import { SANDBOX_ISOLATION_CONTROLS } from '../../types/sandbox/index.js';
+import { assertIsolation, describeIsolation, isolationOf, missingIsolation } from '../isolation.js';
+/**
+ * The provider reported `id = 'local'` / `name = 'Local Sandbox'` at every
+ * tier, and construction logged at `info` regardless. A host that turned
+ * isolation on deliberately got a tier-dependent amount of it under one
+ * undifferentiated name, with no signal saying which controls were live.
+ *
+ * These tests pin the honest table and the refusal. What must NOT hold is
+ * as important as what must: the tier that unshares a mount namespace
+ * without remounting anything does not confine the filesystem, and saying
+ * it does here would reintroduce exactly the defect being fixed.
+ */
+describe('what each tier actually enforces', () => {
+    it('reports full enforcement only where a deny-default profile is installed', () => {
+        expect(isolationOf('macos-seatbelt')).toEqual({
+            filesystem: true,
+            network: true,
+            process: true,
+        });
+    });
+    it('does not claim filesystem confinement from an unshared mount namespace', () => {
+        // A private mount table is not confinement: nothing is remounted, so
+        // the child still sees the whole host filesystem.
+        expect(isolationOf('linux-namespace').filesystem).toBe(false);
+        expect(isolationOf('linux-namespace').process).toBe(true);
+    });
+    it('claims nothing at all for the unconfined tier', () => {
+        const report = isolationOf('basic');
+        expect(Object.values(report)).toEqual([false, false, false]);
+    });
+    it('covers every environment the type admits', () => {
+        const environments = ['linux-namespace', 'macos-seatbelt', 'basic'];
+        for (const environment of environments) {
+            const report = isolationOf(environment);
+            for (const control of SANDBOX_ISOLATION_CONTROLS) {
+                expect(typeof report[control]).toBe('boolean');
+            }
+        }
+    });
+});
+describe('requiring a control', () => {
+    it('lets through what the tier can enforce', () => {
+        expect(() => assertIsolation('macos-seatbelt', ['filesystem', 'network'])).not.toThrow();
+        expect(() => assertIsolation('linux-namespace', ['network', 'process'])).not.toThrow();
+    });
+    it('refuses rather than downgrading', () => {
+        expect(() => assertIsolation('linux-namespace', ['filesystem'])).toThrow(/cannot enforce filesystem/);
+        expect(() => assertIsolation('basic', ['network'])).toThrow(/cannot enforce network/);
+    });
+    it('says what it does enforce, so the refusal is actionable', () => {
+        expect(() => assertIsolation('linux-namespace', ['filesystem'])).toThrow(/Enforced here: network, process/);
+        expect(() => assertIsolation('basic', ['process'])).toThrow(/Enforced here: nothing/);
+    });
+    it('names every missing control, not just the first', () => {
+        expect(missingIsolation('basic', ['filesystem', 'network', 'process'])).toEqual([
+            'filesystem',
+            'network',
+            'process',
+        ]);
+    });
+    it('requires nothing by default, so best-effort callers are unaffected', () => {
+        expect(() => assertIsolation('basic', [])).not.toThrow();
+    });
+});
+describe('describing a tier', () => {
+    it.each([
+        ['macos-seatbelt', 'filesystem, network, process'],
+        ['linux-namespace', 'network, process'],
+        ['basic', 'nothing'],
+    ])('%s enforces %s', (environment, expected) => {
+        expect(describeIsolation(environment)).toBe(expected);
+    });
+});
+describe('the provider', () => {
+    // `process.platform` is a per-worker global, and vitest reuses workers
+    // across files — leaving it patched would make an unrelated file's
+    // platform check answer for this one.
+    const realPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+    afterAll(() => {
+        if (realPlatform)
+            Object.defineProperty(process, 'platform', realPlatform);
+        vi.doUnmock('node:child_process');
+        vi.resetModules();
+    });
+    async function providerWith(environment) {
+        vi.resetModules();
+        vi.doMock('node:child_process', async () => {
+            const actual = await vi.importActual('node:child_process');
+            return {
+                ...actual,
+                execSync: (command) => {
+                    const wanted = environment === 'linux-namespace' ? 'unshare' : 'sandbox-exec';
+                    if (environment !== 'basic' && command.startsWith(wanted))
+                        return Buffer.alloc(0);
+                    throw new Error('not available');
+                },
+            };
+        });
+        Object.defineProperty(process, 'platform', {
+            value: environment === 'macos-seatbelt' ? 'darwin' : 'linux',
+            configurable: true,
+        });
+        return await import('../provider/local.js');
+    }
+    const logger = () => {
+        const calls = [];
+        const log = {
+            calls,
+            child: () => log,
+            debug: () => { },
+            info: (message) => calls.push({ level: 'info', message }),
+            warn: (message) => calls.push({ level: 'warn', message }),
+            error: () => { },
+        };
+        return log;
+    };
+    it('warns, not informs, when it confines nothing', async () => {
+        const { LocalSandboxProvider } = await providerWith('basic');
+        const log = logger();
+        new LocalSandboxProvider(log);
+        // `info` here reads as "sandbox created" to anyone scanning a log.
+        expect(log.calls.some((c) => c.level === 'warn' && /unconfined/.test(c.message))).toBe(true);
+        expect(log.calls.some((c) => c.level === 'info')).toBe(false);
+    });
+    it('throws at construction when a required control is unavailable', async () => {
+        const { LocalSandboxProvider } = await providerWith('basic');
+        expect(() => new LocalSandboxProvider(logger(), { requireIsolation: ['filesystem'] })).toThrow(/cannot enforce filesystem/);
+    });
+    it('constructs when the tier supplies what was asked for', async () => {
+        const { LocalSandboxProvider } = await providerWith('macos-seatbelt');
+        const provider = new LocalSandboxProvider(logger(), {
+            requireIsolation: ['filesystem', 'network'],
+        });
+        expect(provider.environment).toBe('macos-seatbelt');
+    });
+});
+//# sourceMappingURL=isolation.test.js.map

package/dist/sandbox/__tests__/isolation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.test.js","sourceRoot":"","sources":["../../../src/sandbox/__tests__/isolation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEnG;;;;;;;;;;GAUG;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7C,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACb,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACjF,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7D,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACnD,MAAM,YAAY,GAAyB,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACzF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;YACvC,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;gBAClD,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC/C,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QACxF,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CACvE,2BAA2B,CAC3B,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CACvE,iCAAiC,CACjC,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/E,YAAY;YACZ,SAAS;YACT,SAAS;SACT,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,IAAI,CAAC;QACP,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;QAClD,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACvC,CAAC,OAAO,EAAE,SAAS,CAAC;KACX,CAAC,CAAC,gBAAgB,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE;QACvD,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC7B,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAEzE,QAAQ,CAAC,GAAG,EAAE;QACb,IAAI,YAAY;YAAE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;QAC1E,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACjC,EAAE,CAAC,YAAY,EAAE,CAAA;IAClB,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,YAAY,CAAC,WAA+B;QAC1D,EAAE,CAAC,YAAY,EAAE,CAAA;QACjB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,MAAM,GACX,MAAM,EAAE,CAAC,YAAY,CAAsC,oBAAoB,CAAC,CAAA;YACjF,OAAO;gBACN,GAAG,MAAM;gBACT,QAAQ,EAAE,CAAC,OAAe,EAAE,EAAE;oBAC7B,MAAM,MAAM,GAAG,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAA;oBAC7E,IAAI,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;oBACjF,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;gBACjC,CAAC;aACD,CAAA;QACF,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE;YAC1C,KAAK,EAAE,WAAW,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YAC5D,YAAY,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,OAAO,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,KAAK,GAA8C,EAAE,CAAA;QAC3D,MAAM,GAAG,GAAG;YACX,KAAK;YACL,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG;YAChB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;YACf,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACjE,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACjE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;SACf,CAAA;QACD,OAAO,GAAG,CAAA;IACX,CAAC,CAAA;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;QACpB,IAAI,oBAAoB,CAAC,GAAY,CAAC,CAAA;QAEtC,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5F,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAC5D,MAAM,CACL,GAAG,EAAE,CAAC,IAAI,oBAAoB,CAAC,MAAM,EAAW,EAAE,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;QACrE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,MAAM,EAAW,EAAE;YAC5D,gBAAgB,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/sandbox/__tests__/output-truncation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=output-truncation.test.d.ts.map

package/dist/sandbox/__tests__/output-truncation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-truncation.test.d.ts","sourceRoot":"","sources":["../../../src/sandbox/__tests__/output-truncation.test.ts"],"names":[],"mappings":""}

package/dist/sandbox/__tests__/output-truncation.test.js

@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest';
+import { CappedStream } from '../provider/local.js';
+/**
+ * `SandboxExecResult` carries `stdoutTruncated` / `stderrTruncated`, added
+ * when the other backend needed to report a clipped stream. The local
+ * backend clipped at the same cap and never set them, so the model read a
+ * complete-looking result whose tail was gone — against the contract's own
+ * note that the kernel does not truncate silently. The tool layer already
+ * renders the flag; nothing ever raised it.
+ */
+function push(stream, text) {
+    stream.push(Buffer.from(text, 'utf-8'));
+}
+describe('a clipped stream says it was clipped', () => {
+    it('reports nothing truncated while under the cap', () => {
+        const stream = new CappedStream(10);
+        push(stream, 'abc');
+        expect(stream.text).toBe('abc');
+        expect(stream.truncated).toBe(false);
+    });
+    it('reports nothing truncated at exactly the cap', () => {
+        const stream = new CappedStream(4);
+        push(stream, 'abcd');
+        expect(stream.text).toBe('abcd');
+        // Everything arrived and everything was kept. A boundary that
+        // reported truncation here would cry wolf on every exact fit.
+        expect(stream.truncated).toBe(false);
+    });
+    it('reports truncated on the first byte past the cap', () => {
+        const stream = new CappedStream(4);
+        push(stream, 'abcde');
+        expect(stream.text).toBe('abcd');
+        expect(stream.truncated).toBe(true);
+    });
+    it('keeps the head across chunks and clips the rest', () => {
+        const stream = new CappedStream(5);
+        push(stream, 'abc');
+        push(stream, 'def');
+        push(stream, 'ghi');
+        expect(stream.text).toBe('abcde');
+        expect(stream.truncated).toBe(true);
+    });
+    it('stays truncated once it has been, however quiet the stream goes', () => {
+        const stream = new CappedStream(2);
+        push(stream, 'abcdef');
+        push(stream, '');
+        expect(stream.truncated).toBe(true);
+    });
+    it('is empty and untruncated before anything arrives', () => {
+        const stream = new CappedStream(8);
+        expect(stream.text).toBe('');
+        expect(stream.truncated).toBe(false);
+    });
+});
+describe('the sandbox hands the flag to its caller', () => {
+    it('marks a real over-cap run as truncated', async () => {
+        const { LocalSandboxProvider } = await import('../provider/local.js');
+        const { getRootLogger } = await import('../../utils/logger.js');
+        const { SANDBOX_MAX_OUTPUT_BYTES } = await import('../../constants/sandbox/index.js');
+        const sandbox = await new LocalSandboxProvider(getRootLogger()).create();
+        try {
+            const over = SANDBOX_MAX_OUTPUT_BYTES + 1024;
+            const result = await sandbox.exec('node', ['-e', `process.stdout.write('a'.repeat(${over}))`]);
+            expect(result.stdoutTruncated).toBe(true);
+            expect(result.stdout.length).toBe(SANDBOX_MAX_OUTPUT_BYTES);
+            // The other stream is untouched, so a clip on one must not be
+            // reported on both.
+            expect(result.stderrTruncated).toBe(false);
+        }
+        finally {
+            await sandbox.destroy();
+        }
+    }, 30_000);
+    it('leaves an under-cap run unflagged', async () => {
+        const { LocalSandboxProvider } = await import('../provider/local.js');
+        const { getRootLogger } = await import('../../utils/logger.js');
+        const sandbox = await new LocalSandboxProvider(getRootLogger()).create();
+        try {
+            const result = await sandbox.exec('node', ['-e', "process.stdout.write('small')"]);
+            expect(result.stdout).toBe('small');
+            expect(result.stdoutTruncated).toBe(false);
+        }
+        finally {
+            await sandbox.destroy();
+        }
+    }, 30_000);
+});
+//# sourceMappingURL=output-truncation.test.js.map

package/dist/sandbox/__tests__/output-truncation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-truncation.test.js","sourceRoot":"","sources":["../../../src/sandbox/__tests__/output-truncation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD;;;;;;;GAOG;AAEH,SAAS,IAAI,CAAC,MAAoB,EAAE,IAAY;IAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAA;QACnC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAEnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAEpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChC,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAErB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACnB,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACnB,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAEnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAEhB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;QAElC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACrE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAC/D,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QACxE,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,wBAAwB,GAAG,IAAI,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,mCAAmC,IAAI,IAAI,CAAC,CAAC,CAAA;YAE9F,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;YAC3D,8DAA8D;YAC9D,oBAAoB;YACpB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACrE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAE/D,MAAM,OAAO,GAAG,MAAM,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QACxE,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAA;YAElF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;AACX,CAAC,CAAC,CAAA"}

package/dist/sandbox/__tests__/resource-limits.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-limits.test.d.ts.map

package/dist/sandbox/__tests__/resource-limits.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-limits.test.d.ts","sourceRoot":"","sources":["../../../src/sandbox/__tests__/resource-limits.test.ts"],"names":[],"mappings":""}

package/dist/sandbox/__tests__/resource-limits.test.js

@@ -0,0 +1,86 @@
+import { describe, expect, it } from 'vitest';
+import { buildLimitedSpawn } from '../provider/local.js';
+/**
+ * `memoryLimitMb` and `maxProcesses` were applied on one tier and dropped on
+ * the other two — and the two that dropped them are the STRONGER ones. A
+ * host that asked for isolation got its blast-radius caps silently removed
+ * by choosing better isolation, which is the worst direction for a control
+ * to fail in.
+ *
+ * The sibling backend in the sandbox package already treats this as an
+ * error rather than a default: unenforceable per-sandbox controls are
+ * refused there, not ignored. Here they are enforceable on every tier —
+ * the mechanism is a shell builtin, and each tier already spawns through
+ * a wrapper it can sit inside — so they are enforced.
+ */
+const TIERS = ['basic', 'linux-namespace', 'macos-seatbelt'];
+function spawnFor(environment, limits) {
+    return buildLimitedSpawn({
+        environment,
+        command: 'node',
+        args: ['-e', "console.log('hi')"],
+        rootDir: '/tmp/sandbox-root',
+        ...limits,
+    });
+}
+describe('a resource cap survives the choice of tier', () => {
+    for (const environment of TIERS) {
+        it(`applies a memory cap under ${environment}`, () => {
+            const spawn = spawnFor(environment, { memoryLimitMb: 256 });
+            const rendered = [spawn.spawnCommand, ...spawn.spawnArgs].join(' ');
+            expect(rendered).toContain('ulimit -v 262144');
+        });
+        it(`applies a process cap under ${environment}`, () => {
+            const spawn = spawnFor(environment, { maxProcesses: 32 });
+            const rendered = [spawn.spawnCommand, ...spawn.spawnArgs].join(' ');
+            expect(rendered).toContain('ulimit -u 32');
+        });
+        it(`applies both together under ${environment}`, () => {
+            const spawn = spawnFor(environment, { memoryLimitMb: 128, maxProcesses: 8 });
+            const rendered = [spawn.spawnCommand, ...spawn.spawnArgs].join(' ');
+            expect(rendered).toContain('ulimit -v 131072');
+            expect(rendered).toContain('ulimit -u 8');
+        });
+    }
+});
+describe('the tier keeps doing its own job', () => {
+    it('still unshares the namespaces when a cap is set', () => {
+        const spawn = spawnFor('linux-namespace', { maxProcesses: 4 });
+        expect(spawn.spawnCommand).toBe('unshare');
+        expect(spawn.spawnArgs.join(' ')).toContain('--pid');
+    });
+    it('still installs the confinement profile when a cap is set', () => {
+        const spawn = spawnFor('macos-seatbelt', { maxProcesses: 4 });
+        expect(spawn.spawnCommand).toBe('sandbox-exec');
+        expect(spawn.spawnArgs).toContain('-p');
+    });
+});
+describe('nothing is wrapped when nothing was capped', () => {
+    it('spawns the command directly under the unconfined tier', () => {
+        const spawn = spawnFor('basic', {});
+        expect(spawn.spawnCommand).toBe('node');
+        expect(spawn.spawnArgs).toEqual(['-e', "console.log('hi')"]);
+    });
+    it('leaves the wrapper alone under the stronger tiers', () => {
+        const spawn = spawnFor('linux-namespace', {});
+        expect(spawn.spawnArgs).toContain('node');
+        expect(spawn.spawnArgs.join(' ')).not.toContain('ulimit');
+    });
+});
+describe('an argument cannot break out of the shell that applies the cap', () => {
+    it('quotes a single quote in an argument', () => {
+        const spawn = buildLimitedSpawn({
+            environment: 'basic',
+            command: 'echo',
+            args: ["it's; rm -rf /"],
+            rootDir: '/tmp/sandbox-root',
+            maxProcesses: 4,
+        });
+        const rendered = spawn.spawnArgs.join(' ');
+        // The payload survives as ONE argument rather than becoming a second
+        // command: the `;` stays inside the quoting.
+        expect(rendered).not.toContain("; rm -rf / '");
+        expect(rendered).toContain("'\\''");
+    });
+});
+//# sourceMappingURL=resource-limits.test.js.map

package/dist/sandbox/__tests__/resource-limits.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-limits.test.js","sourceRoot":"","sources":["../../../src/sandbox/__tests__/resource-limits.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,KAAK,GAAyB,CAAC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAA;AAElF,SAAS,QAAQ,CAAC,WAA+B,EAAE,MAA8B;IAChF,OAAO,iBAAiB,CAAC;QACxB,WAAW;QACX,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC;QACjC,OAAO,EAAE,mBAAmB;QAC5B,GAAG,MAAM;KACT,CAAC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC3D,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QACjC,EAAE,CAAC,8BAA8B,WAAW,EAAE,EAAE,GAAG,EAAE;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+BAA+B,WAAW,EAAE,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+BAA+B,WAAW,EAAE,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAA;YAC5E,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;IACH,CAAC;AACF,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAA;QAE9D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAA;QAE7D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAEnC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAE7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC/E,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC/B,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,mBAAmB;YAC5B,YAAY,EAAE,CAAC;SACf,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE1C,qEAAqE;QACrE,6CAA6C;QAC7C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/sandbox/factory.js

@@ -3,7 +3,7 @@ export class SandboxProviderFactory {
     static create(config, log) {
         switch (config.provider) {
             case 'local':
-                return new LocalSandboxProvider(log);
+                return new LocalSandboxProvider(log, { requireIsolation: config.requireIsolation });
             default: {
                 const _exhaustive = config.provider;
                 throw new Error(`Unknown sandbox provider: ${_exhaustive}`);

package/dist/sandbox/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/sandbox/factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,OAAO,sBAAsB;IAClC,MAAM,CAAC,MAAM,CAAC,MAAqB,EAAE,GAAW;QAC/C,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,OAAO;gBACX,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACrC,OAAO,CAAC,CAAC,CAAC;gBACT,MAAM,WAAW,GAAU,MAAM,CAAC,QAAQ,CAAA;gBAC1C,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/sandbox/factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,OAAO,sBAAsB;IAClC,MAAM,CAAC,MAAM,CAAC,MAAqB,EAAE,GAAW;QAC/C,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,OAAO;gBACX,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAA;YACpF,OAAO,CAAC,CAAC,CAAC;gBACT,MAAM,WAAW,GAAU,MAAM,CAAC,QAAQ,CAAA;gBAC1C,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;CACD"}

package/dist/sandbox/index.d.ts

@@ -1,3 +1,5 @@
 export { LocalSandboxProvider } from './provider/local.js';
+export type { LocalSandboxProviderOptions } from './provider/local.js';
 export { SandboxProviderFactory } from './factory.js';
+export { assertIsolation, describeIsolation, isolationOf, missingIsolation } from './isolation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,YAAY,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/sandbox/index.js

@@ -1,3 +1,4 @@
 export { LocalSandboxProvider } from './provider/local.js';
 export { SandboxProviderFactory } from './factory.js';
+export { assertIsolation, describeIsolation, isolationOf, missingIsolation } from './isolation.js';
 //# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/sandbox/isolation.d.ts

@@ -0,0 +1,15 @@
+import type { SandboxEnvironment, SandboxIsolationControl, SandboxIsolationReport } from '../types/sandbox/index.js';
+export declare function isolationOf(environment: SandboxEnvironment): SandboxIsolationReport;
+/** The requested controls this environment cannot supply, in a stable order. */
+export declare function missingIsolation(environment: SandboxEnvironment, required: readonly SandboxIsolationControl[]): SandboxIsolationControl[];
+/**
+ * Refuse when the host cannot supply a control the caller asked for.
+ *
+ * Refusing is the whole point. A security control that is accepted and
+ * then silently not applied is worse than one that was never offered: the
+ * caller stops looking, and the run proceeds believing it is confined.
+ */
+export declare function assertIsolation(environment: SandboxEnvironment, required: readonly SandboxIsolationControl[]): void;
+/** Human-readable summary for logs and error messages. */
+export declare function describeIsolation(environment: SandboxEnvironment): string;
+//# sourceMappingURL=isolation.d.ts.map

package/dist/sandbox/isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../../src/sandbox/isolation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,MAAM,2BAA2B,CAAA;AAwBlC,wBAAgB,WAAW,CAAC,WAAW,EAAE,kBAAkB,GAAG,sBAAsB,CAMnF;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC/B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC1C,uBAAuB,EAAE,CAK3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC9B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC1C,IAAI,CAON;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,CAIzE"}

package/dist/sandbox/isolation.js

@@ -0,0 +1,53 @@
+import { SANDBOX_ISOLATION_CONTROLS } from '../types/sandbox/index.js';
+/**
+ * What each tier actually enforces on the spawned process.
+ *
+ * This table is deliberately pessimistic: a control is `true` only where
+ * the spawn arguments enforce it, never where the tier's name suggests it.
+ * The gap being closed here is that a caller who turned isolation on got a
+ * tier-dependent amount of it under one undifferentiated provider name,
+ * with no way to tell which controls were live.
+ *
+ * `linux-namespace` reports `filesystem: false` on purpose. The tier
+ * unshares the mount namespace but never remounts anything, so the child
+ * still sees the whole host filesystem — a private mount table is not
+ * confinement. Claiming otherwise here would reintroduce the exact defect
+ * this table exists to end.
+ */
+const ISOLATION_BY_ENVIRONMENT = {
+    'macos-seatbelt': { filesystem: true, network: true, process: true },
+    'linux-namespace': { filesystem: false, network: true, process: true },
+    basic: { filesystem: false, network: false, process: false },
+};
+export function isolationOf(environment) {
+    const report = ISOLATION_BY_ENVIRONMENT[environment];
+    if (report === undefined) {
+        throw new Error(`Unknown sandbox environment: ${environment}`);
+    }
+    return report;
+}
+/** The requested controls this environment cannot supply, in a stable order. */
+export function missingIsolation(environment, required) {
+    const report = isolationOf(environment);
+    return SANDBOX_ISOLATION_CONTROLS.filter((control) => required.includes(control) && !report[control]);
+}
+/**
+ * Refuse when the host cannot supply a control the caller asked for.
+ *
+ * Refusing is the whole point. A security control that is accepted and
+ * then silently not applied is worse than one that was never offered: the
+ * caller stops looking, and the run proceeds believing it is confined.
+ */
+export function assertIsolation(environment, required) {
+    const missing = missingIsolation(environment, required);
+    if (missing.length === 0)
+        return;
+    throw new Error(`Sandbox environment "${environment}" cannot enforce ${missing.join(', ')} isolation, which this run requires. Enforced here: ${describeIsolation(environment)}. Run on a host that supports it, or drop the requirement explicitly — it will not be silently downgraded.`);
+}
+/** Human-readable summary for logs and error messages. */
+export function describeIsolation(environment) {
+    const report = isolationOf(environment);
+    const enforced = SANDBOX_ISOLATION_CONTROLS.filter((control) => report[control]);
+    return enforced.length === 0 ? 'nothing' : enforced.join(', ');
+}
+//# sourceMappingURL=isolation.js.map

package/dist/sandbox/isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.js","sourceRoot":"","sources":["../../src/sandbox/isolation.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,wBAAwB,GAAiE;IAC9F,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IACpE,iBAAiB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IACtE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;CAC5D,CAAA;AAED,MAAM,UAAU,WAAW,CAAC,WAA+B;IAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAA;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC/B,WAA+B,EAC/B,QAA4C;IAE5C,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACvC,OAAO,0BAA0B,CAAC,MAAM,CACvC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAC3D,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC9B,WAA+B,EAC/B,QAA4C;IAE5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEhC,MAAM,IAAI,KAAK,CACd,wBAAwB,WAAW,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,iBAAiB,CAAC,WAAW,CAAC,4GAA4G,CAC1Q,CAAA;AACF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,WAA+B;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC"}

package/dist/sandbox/provider/local.d.ts

@@ -1,11 +1,60 @@
-import type { Sandbox, SandboxCreateConfig, SandboxEnvironment, SandboxProvider } from '../../types/sandbox/index.js';
+import type { Sandbox, SandboxCreateConfig, SandboxEnvironment, SandboxIsolationControl, SandboxProvider } from '../../types/sandbox/index.js';
 import type { Logger } from '../../utils/logger.js';
+/**
+ * One output stream, accumulated under a byte cap that it reports hitting.
+ *
+ * The clipping was inline and the flag was not set, so a run whose output
+ * ran past the cap returned a result that looked whole. The tool layer
+ * already renders `stdoutTruncated` when a backend sets it — this one
+ * simply never did, which is the silent truncation the contract's own doc
+ * says the kernel does not do.
+ */
+export declare class CappedStream {
+    private readonly capBytes;
+    private chunks;
+    private bytes;
+    constructor(capBytes: number);
+    push(chunk: Buffer): void;
+    get text(): string;
+    /** True once more arrived than was kept. */
+    get truncated(): boolean;
+}
+export interface LimitedSpawnRequest {
+    readonly environment: SandboxEnvironment;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly rootDir: string;
+    readonly memoryLimitMb?: number;
+    readonly maxProcesses?: number;
+}
+/**
+ * How one command is spawned under a tier, with the resource caps applied.
+ *
+ * The caps used to live inside the unconfined tier's branch only, so a host
+ * that asked for stronger isolation had its memory and process limits
+ * silently dropped — a control failing in the one direction nobody checks.
+ * They are the same shell builtin on every tier; the only difference is
+ * that the stronger tiers apply them one level in, inside the wrapper they
+ * already spawn through.
+ */
+export declare function buildLimitedSpawn(request: LimitedSpawnRequest): {
+    spawnCommand: string;
+    spawnArgs: string[];
+};
+export interface LocalSandboxProviderOptions {
+    /**
+     * Controls this run relies on. Construction throws when the detected
+     * environment cannot enforce one of them, rather than downgrading to
+     * whatever the host happens to offer.
+     */
+    readonly requireIsolation?: readonly SandboxIsolationControl[];
+}
 export declare class LocalSandboxProvider implements SandboxProvider {
     readonly id = "local";
     readonly name = "Local Sandbox";
     readonly environment: SandboxEnvironment;
     private readonly log;
-    constructor(log: Logger);
+    constructor(log: Logger, options?: LocalSandboxProviderOptions);
     create(config?: SandboxCreateConfig): Promise<Sandbox>;
 }
 //# sourceMappingURL=local.d.ts.map