@namzu/sdk 33.1.1 → 34.0.1

package/dist/types/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAMhD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;AAEvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAY/D;AAMD,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,OAAO,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,kBAAkB,EAK7D,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE1E,eAAO,MAAM,0BAA0B,EAAE,SAAS,uBAAuB,EAIxE,CAAA;AAED,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAA;AAEvF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAMtE;AAMD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAClC;AAMD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;QACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,KAAK,IAAI,CAAA;IACV;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAE7F;;;;;;;;OAQG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACrE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACjE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,2BAA2B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACjC,GACD;IACA;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACvB,CAAA;AAEJ;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,EAAE,CAAA;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;CACD;AAMD,MAAM,WAAW,mBAAmB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtD;AAMD,eAAO,MAAM,mBAAmB;;;;;;IAM/B;;;;;;OAMG;;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;;;;;;;;;;;;;;;;;;EAEF,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAMhD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;AAEvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAY/D;AAMD,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,OAAO,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,kBAAkB,EAK7D,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE1E,eAAO,MAAM,0BAA0B,EAAE,SAAS,uBAAuB,EAIxE,CAAA;AAED,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAA;AAEvF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAMtE;AAMD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAClC;AAMD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;QACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,KAAK,IAAI,CAAA;IACV;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAE7F;;;;;;;;OAQG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACrE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACjE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,2BAA2B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACjC,GACD;IACA;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACvB,CAAA;AAEJ;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAA;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,EAAE,CAAA;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;QAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC9B,CAAA;CACD;AAMD,MAAM,WAAW,mBAAmB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,mBAAmB,CAAA;AAEpE;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACzD,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtD;AAMD,eAAO,MAAM,mBAAmB;;;;;;IAM/B;;;;;;OAMG;;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;;;;;;;;;;;;;;;;;;EAEF,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/types/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AAUzC,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;AACF,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkC;IAClE,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,OAAO;CACP,CAAA;AAmBD,MAAM,CAAC,MAAM,0BAA0B,GAAuC;IAC7E,YAAY;IACZ,SAAS;IACT,SAAS;CACT,CAAA;AAKD,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC/D,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAM;IAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAA;AACtD,CAAC;AAiaD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1E;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CAC1E,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AAUzC,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAM;QACP,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;AACF,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkC;IAClE,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,OAAO;CACP,CAAA;AAmBD,MAAM,CAAC,MAAM,0BAA0B,GAAuC;IAC7E,YAAY;IACZ,SAAS;IACT,SAAS;CACT,CAAA;AAKD,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC/D,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAM;IAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAA;AACtD,CAAC;AA6aD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1E;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CAC1E,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "33.1.1",
+  "version": "34.0.1",
   "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "engines": {

package/src/agents/PipelineAgent.ts

@@ -84,6 +84,11 @@ export class PipelineAgent extends AbstractAgent<PipelineAgentConfig, PipelineAg
 		config: PipelineAgentConfig,
 		listener?: RunEventListener,
 	): Promise<PipelineAgentResult> {
+		if (config.sandbox) {
+			throw new Error(
+				'PipelineAgent cannot enforce a run-level sandbox around developer-authored step callbacks. Configure confinement inside each step or use a tool-running agent.',
+			)
+		}
 		const startTime = Date.now()
 		const runId = this.createRunId()
 		this.bindRun(runId, config.logger)

package/src/agents/ReactiveAgent.ts

@@ -128,6 +128,7 @@ export class ReactiveAgent extends AbstractAgent<ReactiveAgentConfig, ReactiveAg
 					model: config.model,
 					tokenBudget: config.tokenBudget,
 					timeoutMs: config.timeoutMs,
+					...(config.sandbox ? { sandbox: config.sandbox } : {}),
 					...(config.streamIdleTimeoutMs !== undefined
 						? { streamIdleTimeoutMs: config.streamIdleTimeoutMs }
 						: {}),

package/src/agents/SupervisorAgent.ts

@@ -319,6 +319,7 @@ export class SupervisorAgent extends AbstractAgent<SupervisorAgentConfig, Superv
 						model: config.model,
 						tokenBudget: config.tokenBudget,
 						timeoutMs: config.timeoutMs,
+						...(config.sandbox ? { sandbox: config.sandbox } : {}),
 						...(config.streamIdleTimeoutMs !== undefined
 							? { streamIdleTimeoutMs: config.streamIdleTimeoutMs }
 							: {}),

package/src/agents/runAgent.ts

@@ -66,6 +66,8 @@ export interface RunAgentOptions extends AgentIdentity {
 	tools?: ToolRegistryContract
 	/** Execute sandbox-aware tools inside this provider's boundary. */
 	sandboxProvider?: SandboxProvider
+	/** What a supplied sandbox is rooted at and its per-run limits. */
+	sandbox?: import('../types/run/config.js').AgentRunConfig['sandbox']
 	/** Sandbox teardown wait; defaults to 30 seconds and `0` is unbounded. */
 	sandboxTeardownTimeoutMs?: number
 
@@ -266,6 +268,7 @@ export async function runAgent(options: RunAgentOptions): Promise<RunAgentResult
 			workingDirectory: options.workingDirectory ?? process.cwd(),
 			runConfig: {
 				model: options.model,
+				...(options.sandbox ? { sandbox: options.sandbox } : {}),
 				maxIterations: options.maxIterations ?? DEFAULT_MAX_ITERATIONS,
 				tokenBudget: options.tokenBudget ?? DEFAULT_TOKEN_BUDGET,
 				timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,

package/src/manager/agent/lifecycle.ts

@@ -386,6 +386,12 @@ export class AgentManager {
 			// key, the same direction it already wins for `model` and `effort`.
 			const inheritedEnv = mergeEnv(childConfig.env, options.configOverrides?.env)
 			if (inheritedEnv) childConfig.env = inheritedEnv
+			// A builder may ignore a newly-added factory option. The requested root
+			// policy is an execution boundary, so stamp an explicit child override
+			// after the builder rather than silently falling back to ephemeral.
+			if (options.configOverrides?.sandbox) {
+				childConfig.sandbox = options.configOverrides.sandbox
+			}
 		} else {
 			this.log.warn('No configBuilder, using bare config', {
 				[GENAI.AGENT_ID]: options.agentId,
@@ -408,6 +414,7 @@ export class AgentManager {
 				thinking: options.configOverrides?.thinking,
 				effort: options.configOverrides?.effort,
 				env: options.configOverrides?.env,
+				sandbox: options.configOverrides?.sandbox,
 				sessionId: spawnRecord.childSessionId,
 				topicId: context.topicId,
 				projectId: context.projectId,

package/src/plugin/loader.ts

@@ -1,6 +1,6 @@
-import { lstat, readFile, readdir } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { lstat, readFile, readdir, realpath } from 'node:fs/promises'
+import { homedir, platform } from 'node:os'
+import { join, resolve } from 'node:path'
 import {
 	PLUGIN_MANIFEST_FILENAME,
 	PROJECT_PLUGIN_DIR,
@@ -261,9 +261,10 @@ export async function discoverAllPluginDirs(
 
 	const projectRoot = workingDirectory ?? process.cwd()
 	const userRoot = homedir()
+	const sharedRoot = await samePhysicalDirectory(projectRoot, userRoot)
 
 	const [project, user] = await Promise.all([
-		mayScan('project')
+		mayScan('project') && !sharedRoot
 			? discoverScopedPlugins(projectRoot, PROJECT_PLUGIN_DIR, 'project', options?.log)
 			: Promise.resolve([]),
 		mayScan('user')
@@ -275,7 +276,30 @@ export async function discoverAllPluginDirs(
 		'namzu.plugin.project_count': project.length,
 		'namzu.plugin.user_count': user.length,
 		...(scopes ? { 'namzu.plugin.allowed_scopes': scopes } : {}),
+		...(sharedRoot ? { 'namzu.plugin.shared_user_project_root': true } : {}),
 	})
 
 	return { project, user }
 }
+
+/**
+ * Whether two scope roots name the same directory, including through a
+ * symlink. When home is the working directory, `.namzu/plugins` is user state:
+ * treating the same bytes as project state would let a project-only trust
+ * policy admit user-owned executable code, while scanning both installs it
+ * twice. Missing roots fall back to normalized absolute names; discovery will
+ * independently report them empty.
+ */
+async function samePhysicalDirectory(left: string, right: string): Promise<boolean> {
+	const canonical = async (path: string): Promise<string> => {
+		let value: string
+		try {
+			value = await realpath(path)
+		} catch {
+			value = resolve(path)
+		}
+		return platform() === 'win32' ? value.toLocaleLowerCase('en-US') : value
+	}
+	const [a, b] = await Promise.all([canonical(left), canonical(right)])
+	return a === b
+}

package/src/runtime/query/index.ts

@@ -2396,6 +2396,16 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 						details: { workspace: 'working-directory' },
 					})
 				}
+				if (rootAtCwd && !params.sandboxProvider.workspaceModes?.includes('working-directory')) {
+					throw new NamzuError({
+						code: 'invalid_config',
+						message: `Sandbox provider '${params.sandboxProvider.id}' does not advertise working-directory workspace support. Refusing instead of passing a project path the provider may ignore.`,
+						details: {
+							providerId: params.sandboxProvider.id,
+							workspace: 'working-directory',
+						},
+					})
+				}
 				const acquisition = await acquireSandbox({
 					provider: params.sandboxProvider,
 					config: {

package/src/sandbox/provider/local.ts

@@ -10,7 +10,7 @@ import {
 	stat,
 } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
+import { dirname, isAbsolute, join, parse, resolve } from 'node:path'
 import { NAMZU } from '../../constants/telemetry/index.js'
 import { SCOPE_ATTRIBUTE } from '../../utils/log/types.js'
 
@@ -25,6 +25,7 @@ import {
 // registry needs the same one, and a near-copy would reproduce in the copy
 // every bug the original's comment was written to record.
 import { killTree } from '../../process/kill-tree.js'
+import { resolveWithinReal } from '../../tools/paths.js'
 import type { SandboxId } from '../../types/ids/index.js'
 import type {
 	Sandbox,
@@ -49,19 +50,6 @@ import {
 import { assertIsolation, describeIsolation } from '../isolation.js'
 import type { PtyLoader } from '../terminal.js'
 
-// ---------------------------------------------------------------------------
-// Path safety
-// ---------------------------------------------------------------------------
-
-function assertInsideSandbox(sandboxRoot: string, targetPath: string): string {
-	const resolved = resolve(sandboxRoot, targetPath)
-	const rel = relative(sandboxRoot, resolved)
-	if (rel.startsWith('..') || isAbsolute(rel)) {
-		throw new Error(`Path escapes sandbox: ${targetPath}`)
-	}
-	return resolved
-}
-
 // ---------------------------------------------------------------------------
 // Platform detection
 // ---------------------------------------------------------------------------
@@ -289,7 +277,7 @@ export function buildLimitedSpawn(request: LimitedSpawnRequest): {
 		case 'macos-seatbelt':
 			return {
 				spawnCommand: requiredWrapper(request),
-				spawnArgs: ['-p', buildSeatbeltProfile(rootDir), '--', ...inner],
+				spawnArgs: [...buildSeatbeltArgs(rootDir), '--', ...inner],
 			}
 
 		case 'basic': {
@@ -332,10 +320,7 @@ function detectEnvironment(): DetectedEnvironment {
 
 	if (platform === 'darwin') {
 		const seatbelt = resolveTrustedWrapper('sandbox-exec')
-		if (
-			seatbelt !== undefined &&
-			probeSandboxSpawn(seatbelt, ['-p', buildSeatbeltProfile(tmpdir())])
-		) {
+		if (seatbelt !== undefined && probeSandboxSpawn(seatbelt, buildSeatbeltArgs(tmpdir()))) {
 			return { environment: 'macos-seatbelt', wrapperCommand: seatbelt }
 		}
 	}
@@ -465,9 +450,7 @@ const BWRAP_SYSTEM_PATHS: readonly string[] = [
 	'/opt',
 ]
 
-function buildSeatbeltProfile(sandboxRoot: string): string {
-	const root = canonicalizePath(sandboxRoot)
-
+function buildSeatbeltProfile(): string {
 	return [
 		'(version 1)',
 		'(deny default)',
@@ -479,8 +462,8 @@ function buildSeatbeltProfile(sandboxRoot: string): string {
 		'(allow signal (target same-sandbox))',
 
 		// --- Sandbox workspace — full read/write ---
-		`(allow file-read* (subpath "${root}"))`,
-		`(allow file-write* (subpath "${root}"))`,
+		'(allow file-read* (subpath (param "NAMZU_SANDBOX_ROOT")))',
+		'(allow file-write* (subpath (param "NAMZU_SANDBOX_ROOT")))',
 
 		// --- Root path literal — dyld needs this for path resolution ---
 		'(allow file-read* (literal "/"))',
@@ -547,6 +530,18 @@ function buildSeatbeltProfile(sandboxRoot: string): string {
 	].join('\n')
 }
 
+/**
+ * Keep caller-controlled paths out of SBPL source entirely.
+ *
+ * `sandbox-exec -Dname=value` binds an opaque argv value to `(param "name")`;
+ * quotes, newlines, and parentheses in a legal Unix directory name therefore
+ * remain path bytes instead of becoming policy syntax. This is the same
+ * parameter boundary used by Codex's seatbelt builder.
+ */
+function buildSeatbeltArgs(sandboxRoot: string): string[] {
+	return ['-p', buildSeatbeltProfile(), `-DNAMZU_SANDBOX_ROOT=${canonicalizePath(sandboxRoot)}`]
+}
+
 // ---------------------------------------------------------------------------
 // Environment building
 // ---------------------------------------------------------------------------
@@ -610,6 +605,7 @@ class LocalSandbox implements Sandbox {
 		rootDir: string,
 		environment: SandboxEnvironment,
 		private readonly wrapperCommand: string | undefined,
+		private readonly removeRootOnDestroy: boolean,
 		config: SandboxCreateConfig,
 		log: Logger,
 	) {
@@ -618,7 +614,10 @@ class LocalSandbox implements Sandbox {
 		this.environment = environment
 		this.config = config
 		this._status = 'ready'
-		this.log = log.child({ [SCOPE_ATTRIBUTE]: 'sandbox/provider/local', [NAMZU.SANDBOX_ID]: id })
+		this.log = log.child({
+			[SCOPE_ATTRIBUTE]: 'sandbox/provider/local',
+			[NAMZU.SANDBOX_ID]: id,
+		})
 
 		this.log.info('Sandbox created', {
 			'namzu.sandbox.root_dir': rootDir,
@@ -641,7 +640,7 @@ class LocalSandbox implements Sandbox {
 		const env = buildSafeEnv(this.config.env, opts?.env)
 		const timeout = opts?.timeout ?? this.config.timeoutMs ?? SANDBOX_DEFAULT_TIMEOUT_MS
 
-		const cwd = opts?.cwd ? assertInsideSandbox(this.rootDir, opts.cwd) : this.rootDir
+		const cwd = opts?.cwd ? await resolveWithinReal(this.rootDir, opts.cwd) : this.rootDir
 
 		const { spawnCommand, spawnArgs, bwrapInfoFd, bwrapBlockFd } = this.buildSpawnArgs(
 			command,
@@ -690,7 +689,7 @@ class LocalSandbox implements Sandbox {
 			throw new Error(`Sandbox ${this.id} is destroyed`)
 		}
 
-		const resolved = assertInsideSandbox(this.rootDir, path)
+		const resolved = await resolveWithinReal(this.rootDir, path)
 		await mkdir(dirname(resolved), { recursive: true })
 
 		// Convention 8: Atomic write (write-tmp-rename)
@@ -706,7 +705,7 @@ class LocalSandbox implements Sandbox {
 			throw new Error(`Sandbox ${this.id} is destroyed`)
 		}
 
-		const resolved = assertInsideSandbox(this.rootDir, path)
+		const resolved = await resolveWithinReal(this.rootDir, path)
 		return fsReadFile(resolved)
 	}
 
@@ -715,7 +714,7 @@ class LocalSandbox implements Sandbox {
 			throw new Error(`Sandbox ${this.id} is destroyed`)
 		}
 
-		const resolved = assertInsideSandbox(this.rootDir, rootPath)
+		const resolved = await resolveWithinReal(this.rootDir, rootPath)
 		const root = await stat(resolved).catch(() => null)
 		if (!root || !root.isDirectory()) return []
 
@@ -746,7 +745,12 @@ class LocalSandbox implements Sandbox {
 		}
 
 		this._status = 'destroyed'
-		await rm(this.rootDir, { recursive: true, force: true })
+		// A generated temp root belongs to this allocation. A working-directory
+		// root belongs to the caller. Conflating those lifetimes turns normal run
+		// teardown into recursive deletion of the project the run just edited.
+		if (this.removeRootOnDestroy) {
+			await rm(this.rootDir, { recursive: true, force: true })
+		}
 
 		this.log.info('Sandbox destroyed', { 'namzu.sandbox.id': this.id })
 	}
@@ -974,6 +978,7 @@ export interface LocalSandboxProviderOptions {
 export class LocalSandboxProvider implements SandboxProvider {
 	readonly id = 'local'
 	readonly name = 'Local Sandbox'
+	readonly workspaceModes = ['ephemeral', 'working-directory'] as const
 	readonly environment: SandboxEnvironment
 
 	private readonly log: Logger
@@ -1016,25 +1021,59 @@ export class LocalSandboxProvider implements SandboxProvider {
 	async create(config?: SandboxCreateConfig): Promise<Sandbox> {
 		config?.signal?.throwIfAborted()
 		const id = generateSandboxId()
+		let rootDir: string
+		let removeRootOnDestroy: boolean
 
-		// mkdtemp is in node:fs/promises but requires an async import-style usage.
-		// We use the same pattern: create a unique dir under os.tmpdir().
-		const { mkdtemp } = await import('node:fs/promises')
-		const rawDir = await mkdtemp(join(tmpdir(), SANDBOX_TEMP_DIR_PREFIX))
+		if (config?.workingDirectory !== undefined) {
+			const requested = resolve(config.workingDirectory)
+			let entry: Awaited<ReturnType<typeof stat>>
+			try {
+				entry = await stat(requested)
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+					throw new Error(`Sandbox workingDirectory does not exist: ${requested}`, {
+						cause: error,
+					})
+				}
+				throw new Error(`Sandbox workingDirectory could not be inspected: ${requested}`, {
+					cause: error,
+				})
+			}
+			if (!entry.isDirectory()) {
+				throw new Error(`Sandbox workingDirectory is not a directory: ${requested}`)
+			}
+			// The caller owns this tree. The sandbox handle may be per run, but the
+			// workspace survives every handle created for the session.
+			rootDir = canonicalizePath(requested)
+			if (rootDir === parse(rootDir).root) {
+				throw new Error(
+					`Sandbox workingDirectory cannot be a filesystem root: ${rootDir}. Choose a project directory so filesystem confinement has a boundary.`,
+				)
+			}
+			removeRootOnDestroy = false
+		} else {
+			// No workspace was named: this allocation owns a fresh temporary root.
+			const { mkdtemp } = await import('node:fs/promises')
+			const rawDir = await mkdtemp(join(tmpdir(), SANDBOX_TEMP_DIR_PREFIX))
+			rootDir = canonicalizePath(rawDir)
+			removeRootOnDestroy = true
+		}
 		if (config?.signal?.aborted) {
-			await rm(rawDir, { recursive: true, force: true })
+			if (removeRootOnDestroy) await rm(rootDir, { recursive: true, force: true })
 			throw config.signal.reason
 		}
-		// Canonicalize — macOS symlinks like /var → /private/var must be resolved
-		const rootDir = canonicalizePath(rawDir)
 
-		this.log.info('Creating sandbox', { 'namzu.sandbox.id': id, 'namzu.sandbox.root_dir': rootDir })
+		this.log.info('Creating sandbox', {
+			'namzu.sandbox.id': id,
+			'namzu.sandbox.root_dir': rootDir,
+		})
 
 		return new LocalSandbox(
 			id,
 			rootDir,
 			this.environment,
 			this.wrapperCommand,
+			removeRootOnDestroy,
 			config ?? {},
 			this.log,
 		)

package/src/scheduler/local.ts

@@ -28,6 +28,14 @@ import { type Logger, resolveLogger } from '../utils/logger.js'
  */
 const GATEWAY_TASK_LEDGER_CAP = 1_000
 
+interface ObserverDelivery {
+	busy: boolean
+	readonly queue: Array<{
+		readonly event: Parameters<RunEventListener>[0]
+		readonly observer: 'scheduler' | 'task'
+	}>
+}
+
 export class LocalTaskScheduler implements TaskScheduler {
 	private agentManager: AgentManagerContract
 	private taskContext: AgentTaskContext
@@ -56,6 +64,15 @@ export class LocalTaskScheduler implements TaskScheduler {
 	private siblingFailurePolicy: SiblingFailurePolicy = 'continue'
 	/** See {@link onTaskProgress}. */
 	private readonly progressListeners = new Set<(taskId: TaskId) => void>()
+	/**
+	 * One non-blocking delivery chain per observer.
+	 *
+	 * Child streaming never awaits these promises, but a listener still sees
+	 * its own events in source order. Keeping the chains separate also means a
+	 * slow exporter cannot hold up a task-specific screen (or another task's
+	 * screen) that uses a different callback.
+	 */
+	private readonly observerDeliveries = new WeakMap<RunEventListener, ObserverDelivery>()
 	/** Raw, unresolved — kept as the caller handed it so each of the two log
 	 * sites below resolves it independently via `resolveLogger`, rather than
 	 * this constructor baking in ONE `.child()` binding both would then share
@@ -150,7 +167,15 @@ export class LocalTaskScheduler implements TaskScheduler {
 			// tool's own description tells the model to use — the event loop
 			// interleaves and three of the four died. Found by running one.
 			(event) => {
-				this.listener?.(event)
+				// A scheduler-wide observer and this task's observer are independent.
+				// Either may throw or reject: observation is not authority over the
+				// child, and one broken screen/export must neither stop the run nor
+				// suppress the other observer. Async listeners are deliberately not
+				// awaited, so a slow renderer cannot backpressure model streaming.
+				this.deliverEvent(this.listener, event, 'scheduler')
+				if (options.onEvent !== this.listener) {
+					this.deliverEvent(options.onEvent, event, 'task')
+				}
 				// No id yet means nothing is waiting on this task: the caller
 				// does not hold the handle, so an idle bound cannot be running
 				// against it. There is no progress to report to anyone.
@@ -190,6 +215,67 @@ export class LocalTaskScheduler implements TaskScheduler {
 		return toHandle(task)
 	}
 
+	private deliverEvent(
+		listener: RunEventListener | undefined,
+		event: Parameters<RunEventListener>[0],
+		observer: 'scheduler' | 'task',
+	): void {
+		if (!listener) return
+
+		// Each observer receives its own value graph. RunEvent is readonly at the
+		// type boundary, but a JavaScript consumer can still mutate an object it
+		// was handed; that must not forge what the next independent observer sees.
+		const snapshot = structuredClone(event)
+		let delivery = this.observerDeliveries.get(listener)
+		if (!delivery) {
+			delivery = { busy: false, queue: [] }
+			this.observerDeliveries.set(listener, delivery)
+		}
+		delivery.queue.push({ event: snapshot, observer })
+		this.drainObserver(listener, delivery)
+	}
+
+	private drainObserver(listener: RunEventListener, delivery: ObserverDelivery): void {
+		if (delivery.busy) return
+		while (delivery.queue.length > 0) {
+			const next = delivery.queue.shift()
+			if (!next) return
+			try {
+				const pending = listener(next.event)
+				if (!pending) continue
+				delivery.busy = true
+				void pending.then(
+					() => {
+						delivery.busy = false
+						this.drainObserver(listener, delivery)
+					},
+					(error) => {
+						this.reportObserverFailure(next.event.type, next.observer, error)
+						delivery.busy = false
+						this.drainObserver(listener, delivery)
+					},
+				)
+				return
+			} catch (error) {
+				this.reportObserverFailure(next.event.type, next.observer, error)
+			}
+		}
+	}
+
+	private reportObserverFailure(
+		eventType: Parameters<RunEventListener>[0]['type'],
+		observer: 'scheduler' | 'task',
+		error: unknown,
+	): void {
+		resolveLogger(this.log)
+			.child({ [SCOPE_ATTRIBUTE]: 'scheduler/local' })
+			.warn('Task event observer failed', {
+				'namzu.event.type': eventType,
+				'namzu.scheduler.observer': observer,
+				'exception.message': toErrorMessage(error),
+			})
+	}
+
 	/**
 	 * Decide what a failed child means for the ones still running.
 	 *

package/src/types/agent/base.ts

@@ -31,6 +31,15 @@ export interface BaseAgentConfig {
 	costLimitUsd?: number
 	permissionMode?: PermissionMode
 
+	/**
+	 * Run-level sandbox limits and workspace ownership.
+	 *
+	 * A provider alone only says HOW commands are confined. This field says
+	 * WHAT it is rooted at; `working-directory` makes sandbox-aware tools act
+	 * on the run's declared workspace instead of a disposable empty tree.
+	 */
+	sandbox?: import('../run/config.js').AgentRunConfig['sandbox']
+
 	/**
 	 * The tools this run may use, narrowing whatever its registry holds.
 	 *

package/src/types/agent/factory.ts

@@ -53,6 +53,7 @@ export interface AgentFactoryOptions {
 	maxResponseTokens?: number
 	env?: Record<string, string>
 	permissionMode?: 'plan' | 'auto'
+	sandbox?: BaseAgentConfig['sandbox']
 
 	systemPrompt?: string
 

package/src/types/agent/scheduler.ts

@@ -1,6 +1,7 @@
 import type { TaskId } from '../ids/index.js'
 import type { AgentPersona } from '../persona/index.js'
 import type { CancelCause } from '../run/cancel-cause.js'
+import type { RunEventListener } from '../run/events.js'
 import type { AgentRuntimeContext, BaseAgentConfig, BaseAgentResult } from './base.js'
 import type { AgentTaskState } from './task.js'
 
@@ -27,6 +28,18 @@ export interface TaskHandle {
 export type SiblingFailurePolicy = 'continue' | 'cancel-siblings'
 
 export interface CreateTaskOptions {
+	/**
+	 * Observe events from this one delegated run when the scheduler can expose
+	 * them.
+	 *
+	 * The built-in local scheduler supports this without replacing its
+	 * scheduler-wide listener. Delivery is observational and must not
+	 * backpressure or decide the child run; a remote/custom scheduler may omit
+	 * it when that transport has no event stream. Callers must therefore settle
+	 * their task view from the returned {@link TaskHandle} as well.
+	 */
+	readonly onEvent?: RunEventListener
+
 	/**
 	 * Span the spawned run should hang off — normally the executing tool's
 	 * own span, so the delegation shows up inside the turn that asked for

package/src/types/sandbox/index.ts

@@ -473,6 +473,9 @@ export interface SandboxCreateConfig {
 	readonly maxProcesses?: number
 }
 
+/** Workspace-root contracts a provider can enforce honestly. */
+export type SandboxWorkspaceMode = 'ephemeral' | 'working-directory'
+
 /**
  * Tier-specific layout types ({@link ContainerSandboxLayout}, future
  * `MicroVMSandboxLayout`, etc.) are intentionally NOT fields on
@@ -497,6 +500,15 @@ export interface SandboxProvider {
 	readonly id: string
 	readonly name: string
 	readonly environment: SandboxEnvironment
+	/**
+	 * Root modes this provider actually implements.
+	 *
+	 * Optional for legacy providers using the ephemeral default. The kernel
+	 * refuses an explicit `working-directory` request unless that mode is
+	 * advertised; accepting `workingDirectory` and ignoring it would report a
+	 * boundary around a project the provider never mounted.
+	 */
+	readonly workspaceModes?: readonly SandboxWorkspaceMode[]
 	create(config?: SandboxCreateConfig): Promise<Sandbox>
 }