@noxsoft/anima 2.0.2 → 2.0.4

package/dist/sandbox-CJTS3er6.js

@@ -0,0 +1,858 @@
+import { B as STATE_DIR, h as defaultRuntime, tt as CHANNEL_IDS } from "./entry.js";
+import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId } from "./session-key-CQT-NR6w.js";
+import { y as resolveUserPath } from "./utils-DT8uXjFS.js";
+import { b as DEFAULT_USER_FILENAME, d as DEFAULT_AGENTS_FILENAME, f as DEFAULT_AGENT_WORKSPACE_DIR, h as DEFAULT_IDENTITY_FILENAME, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, v as DEFAULT_SOUL_FILENAME, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-DZgptr9J.js";
+import { a as syncSkillsToWorkspace } from "./skills-BWFIEp4j.js";
+import { i as loadConfig } from "./config-CU-Axg8P.js";
+import { b as resolveAgentMainSessionKey, y as canonicalizeMainSessionAlias } from "./sessions-CnRjwdVr.js";
+import { spawn } from "node:child_process";
+import path from "node:path";
+import fs from "node:fs/promises";
+import crypto from "node:crypto";
+import "express";
+
+//#region src/agents/sandbox/constants.ts
+const DEFAULT_SANDBOX_WORKSPACE_ROOT = path.join(STATE_DIR, "sandboxes");
+const DEFAULT_SANDBOX_IMAGE = "anima-sandbox:bookworm-slim";
+const DEFAULT_SANDBOX_CONTAINER_PREFIX = "anima-sbx-";
+const DEFAULT_SANDBOX_WORKDIR = "/workspace";
+const DEFAULT_SANDBOX_IDLE_HOURS = 24;
+const DEFAULT_SANDBOX_MAX_AGE_DAYS = 7;
+const DEFAULT_TOOL_ALLOW = [
+	"exec",
+	"process",
+	"read",
+	"write",
+	"edit",
+	"apply_patch",
+	"image",
+	"sessions_list",
+	"sessions_history",
+	"sessions_send",
+	"sessions_spawn",
+	"subagents",
+	"session_status"
+];
+const DEFAULT_TOOL_DENY = [
+	"browser",
+	"canvas",
+	"nodes",
+	"cron",
+	"gateway",
+	...CHANNEL_IDS
+];
+const DEFAULT_SANDBOX_BROWSER_IMAGE = "anima-sandbox-browser:bookworm-slim";
+const DEFAULT_SANDBOX_COMMON_IMAGE = "anima-sandbox-common:bookworm-slim";
+const DEFAULT_SANDBOX_BROWSER_PREFIX = "anima-sbx-browser-";
+const DEFAULT_SANDBOX_BROWSER_CDP_PORT = 9222;
+const DEFAULT_SANDBOX_BROWSER_VNC_PORT = 5900;
+const DEFAULT_SANDBOX_BROWSER_NOVNC_PORT = 6080;
+const DEFAULT_SANDBOX_BROWSER_AUTOSTART_TIMEOUT_MS = 12e3;
+const SANDBOX_STATE_DIR = path.join(STATE_DIR, "sandbox");
+const SANDBOX_REGISTRY_PATH = path.join(SANDBOX_STATE_DIR, "containers.json");
+const SANDBOX_BROWSER_REGISTRY_PATH = path.join(SANDBOX_STATE_DIR, "browsers.json");
+
+//#endregion
+//#region src/agents/glob-pattern.ts
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function compileGlobPattern(params) {
+	const normalized = params.normalize(params.raw);
+	if (!normalized) return {
+		kind: "exact",
+		value: ""
+	};
+	if (normalized === "*") return { kind: "all" };
+	if (!normalized.includes("*")) return {
+		kind: "exact",
+		value: normalized
+	};
+	return {
+		kind: "regex",
+		value: new RegExp(`^${escapeRegex(normalized).replaceAll("\\*", ".*")}$`)
+	};
+}
+function compileGlobPatterns(params) {
+	if (!Array.isArray(params.raw)) return [];
+	return params.raw.map((raw) => compileGlobPattern({
+		raw,
+		normalize: params.normalize
+	})).filter((pattern) => pattern.kind !== "exact" || pattern.value);
+}
+function matchesAnyGlobPattern(value, patterns) {
+	for (const pattern of patterns) {
+		if (pattern.kind === "all") return true;
+		if (pattern.kind === "exact" && value === pattern.value) return true;
+		if (pattern.kind === "regex" && pattern.value.test(value)) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/agents/tool-policy.ts
+const TOOL_NAME_ALIASES = {
+	bash: "exec",
+	"apply-patch": "apply_patch"
+};
+const TOOL_GROUPS = {
+	"group:memory": ["memory_search", "memory_get"],
+	"group:web": ["web_search", "web_fetch"],
+	"group:fs": [
+		"read",
+		"write",
+		"edit",
+		"apply_patch"
+	],
+	"group:runtime": ["exec", "process"],
+	"group:sessions": [
+		"sessions_list",
+		"sessions_history",
+		"sessions_send",
+		"sessions_spawn",
+		"subagents",
+		"session_status"
+	],
+	"group:ui": ["browser", "canvas"],
+	"group:automation": ["cron", "gateway"],
+	"group:messaging": ["message"],
+	"group:nodes": ["nodes"],
+	"group:anima": [
+		"browser",
+		"canvas",
+		"nodes",
+		"cron",
+		"message",
+		"gateway",
+		"agents_list",
+		"sessions_list",
+		"sessions_history",
+		"sessions_send",
+		"sessions_spawn",
+		"subagents",
+		"session_status",
+		"memory_search",
+		"memory_get",
+		"web_search",
+		"web_fetch",
+		"image"
+	]
+};
+const OWNER_ONLY_TOOL_NAMES = new Set(["whatsapp_login"]);
+const TOOL_PROFILES = {
+	minimal: { allow: ["session_status"] },
+	coding: { allow: [
+		"group:fs",
+		"group:runtime",
+		"group:sessions",
+		"group:memory",
+		"image"
+	] },
+	messaging: { allow: [
+		"group:messaging",
+		"sessions_list",
+		"sessions_history",
+		"sessions_send",
+		"session_status"
+	] },
+	full: {}
+};
+function normalizeToolName(name) {
+	const normalized = name.trim().toLowerCase();
+	return TOOL_NAME_ALIASES[normalized] ?? normalized;
+}
+function isOwnerOnlyToolName(name) {
+	return OWNER_ONLY_TOOL_NAMES.has(normalizeToolName(name));
+}
+function applyOwnerOnlyToolPolicy(tools, senderIsOwner) {
+	const withGuard = tools.map((tool) => {
+		if (!isOwnerOnlyToolName(tool.name)) return tool;
+		if (senderIsOwner || !tool.execute) return tool;
+		return {
+			...tool,
+			execute: async () => {
+				throw new Error("Tool restricted to owner senders.");
+			}
+		};
+	});
+	if (senderIsOwner) return withGuard;
+	return withGuard.filter((tool) => !isOwnerOnlyToolName(tool.name));
+}
+function normalizeToolList(list) {
+	if (!list) return [];
+	return list.map(normalizeToolName).filter(Boolean);
+}
+function expandToolGroups(list) {
+	const normalized = normalizeToolList(list);
+	const expanded = [];
+	for (const value of normalized) {
+		const group = TOOL_GROUPS[value];
+		if (group) {
+			expanded.push(...group);
+			continue;
+		}
+		expanded.push(value);
+	}
+	return Array.from(new Set(expanded));
+}
+function collectExplicitAllowlist(policies) {
+	const entries = [];
+	for (const policy of policies) {
+		if (!policy?.allow) continue;
+		for (const value of policy.allow) {
+			if (typeof value !== "string") continue;
+			const trimmed = value.trim();
+			if (trimmed) entries.push(trimmed);
+		}
+	}
+	return entries;
+}
+function buildPluginToolGroups(params) {
+	const all = [];
+	const byPlugin = /* @__PURE__ */ new Map();
+	for (const tool of params.tools) {
+		const meta = params.toolMeta(tool);
+		if (!meta) continue;
+		const name = normalizeToolName(tool.name);
+		all.push(name);
+		const pluginId = meta.pluginId.toLowerCase();
+		const list = byPlugin.get(pluginId) ?? [];
+		list.push(name);
+		byPlugin.set(pluginId, list);
+	}
+	return {
+		all,
+		byPlugin
+	};
+}
+function expandPluginGroups(list, groups) {
+	if (!list || list.length === 0) return list;
+	const expanded = [];
+	for (const entry of list) {
+		const normalized = normalizeToolName(entry);
+		if (normalized === "group:plugins") {
+			if (groups.all.length > 0) expanded.push(...groups.all);
+			else expanded.push(normalized);
+			continue;
+		}
+		const tools = groups.byPlugin.get(normalized);
+		if (tools && tools.length > 0) {
+			expanded.push(...tools);
+			continue;
+		}
+		expanded.push(normalized);
+	}
+	return Array.from(new Set(expanded));
+}
+function expandPolicyWithPluginGroups(policy, groups) {
+	if (!policy) return;
+	return {
+		allow: expandPluginGroups(policy.allow, groups),
+		deny: expandPluginGroups(policy.deny, groups)
+	};
+}
+function stripPluginOnlyAllowlist(policy, groups, coreTools) {
+	if (!policy?.allow || policy.allow.length === 0) return {
+		policy,
+		unknownAllowlist: [],
+		strippedAllowlist: false
+	};
+	const normalized = normalizeToolList(policy.allow);
+	if (normalized.length === 0) return {
+		policy,
+		unknownAllowlist: [],
+		strippedAllowlist: false
+	};
+	const pluginIds = new Set(groups.byPlugin.keys());
+	const pluginTools = new Set(groups.all);
+	const unknownAllowlist = [];
+	let hasCoreEntry = false;
+	for (const entry of normalized) {
+		if (entry === "*") {
+			hasCoreEntry = true;
+			continue;
+		}
+		const isPluginEntry = entry === "group:plugins" || pluginIds.has(entry) || pluginTools.has(entry);
+		const isCoreEntry = expandToolGroups([entry]).some((tool) => coreTools.has(tool));
+		if (isCoreEntry) hasCoreEntry = true;
+		if (!isCoreEntry && !isPluginEntry) unknownAllowlist.push(entry);
+	}
+	const strippedAllowlist = !hasCoreEntry;
+	if (strippedAllowlist) {}
+	return {
+		policy: strippedAllowlist ? {
+			...policy,
+			allow: void 0
+		} : policy,
+		unknownAllowlist: Array.from(new Set(unknownAllowlist)),
+		strippedAllowlist
+	};
+}
+function resolveToolProfilePolicy(profile) {
+	if (!profile) return;
+	const resolved = TOOL_PROFILES[profile];
+	if (!resolved) return;
+	if (!resolved.allow && !resolved.deny) return;
+	return {
+		allow: resolved.allow ? [...resolved.allow] : void 0,
+		deny: resolved.deny ? [...resolved.deny] : void 0
+	};
+}
+
+//#endregion
+//#region src/agents/sandbox/tool-policy.ts
+function resolveSandboxToolPolicyForAgent(cfg, agentId) {
+	const agentConfig = cfg && agentId ? resolveAgentConfig(cfg, agentId) : void 0;
+	const agentAllow = agentConfig?.tools?.sandbox?.tools?.allow;
+	const agentDeny = agentConfig?.tools?.sandbox?.tools?.deny;
+	const globalAllow = cfg?.tools?.sandbox?.tools?.allow;
+	const globalDeny = cfg?.tools?.sandbox?.tools?.deny;
+	const allowSource = Array.isArray(agentAllow) ? {
+		source: "agent",
+		key: "agents.list[].tools.sandbox.tools.allow"
+	} : Array.isArray(globalAllow) ? {
+		source: "global",
+		key: "tools.sandbox.tools.allow"
+	} : {
+		source: "default",
+		key: "tools.sandbox.tools.allow"
+	};
+	const denySource = Array.isArray(agentDeny) ? {
+		source: "agent",
+		key: "agents.list[].tools.sandbox.tools.deny"
+	} : Array.isArray(globalDeny) ? {
+		source: "global",
+		key: "tools.sandbox.tools.deny"
+	} : {
+		source: "default",
+		key: "tools.sandbox.tools.deny"
+	};
+	const deny = Array.isArray(agentDeny) ? agentDeny : Array.isArray(globalDeny) ? globalDeny : [...DEFAULT_TOOL_DENY];
+	const allow = Array.isArray(agentAllow) ? agentAllow : Array.isArray(globalAllow) ? globalAllow : [...DEFAULT_TOOL_ALLOW];
+	const expandedDeny = expandToolGroups(deny);
+	let expandedAllow = expandToolGroups(allow);
+	if (!expandedDeny.map((v) => v.toLowerCase()).includes("image") && !expandedAllow.map((v) => v.toLowerCase()).includes("image")) expandedAllow = [...expandedAllow, "image"];
+	return {
+		allow: expandedAllow,
+		deny: expandedDeny,
+		sources: {
+			allow: allowSource,
+			deny: denySource
+		}
+	};
+}
+
+//#endregion
+//#region src/agents/sandbox/config.ts
+function resolveSandboxScope(params) {
+	if (params.scope) return params.scope;
+	if (typeof params.perSession === "boolean") return params.perSession ? "session" : "shared";
+	return "agent";
+}
+function resolveSandboxDockerConfig(params) {
+	const agentDocker = params.scope === "shared" ? void 0 : params.agentDocker;
+	const globalDocker = params.globalDocker;
+	const env = agentDocker?.env ? {
+		...globalDocker?.env ?? { LANG: "C.UTF-8" },
+		...agentDocker.env
+	} : globalDocker?.env ?? { LANG: "C.UTF-8" };
+	const ulimits = agentDocker?.ulimits ? {
+		...globalDocker?.ulimits,
+		...agentDocker.ulimits
+	} : globalDocker?.ulimits;
+	const binds = [...globalDocker?.binds ?? [], ...agentDocker?.binds ?? []];
+	return {
+		image: agentDocker?.image ?? globalDocker?.image ?? DEFAULT_SANDBOX_IMAGE,
+		containerPrefix: agentDocker?.containerPrefix ?? globalDocker?.containerPrefix ?? DEFAULT_SANDBOX_CONTAINER_PREFIX,
+		workdir: agentDocker?.workdir ?? globalDocker?.workdir ?? DEFAULT_SANDBOX_WORKDIR,
+		readOnlyRoot: agentDocker?.readOnlyRoot ?? globalDocker?.readOnlyRoot ?? true,
+		tmpfs: agentDocker?.tmpfs ?? globalDocker?.tmpfs ?? [
+			"/tmp",
+			"/var/tmp",
+			"/run"
+		],
+		network: agentDocker?.network ?? globalDocker?.network ?? "none",
+		user: agentDocker?.user ?? globalDocker?.user,
+		capDrop: agentDocker?.capDrop ?? globalDocker?.capDrop ?? ["ALL"],
+		env,
+		setupCommand: agentDocker?.setupCommand ?? globalDocker?.setupCommand,
+		pidsLimit: agentDocker?.pidsLimit ?? globalDocker?.pidsLimit,
+		memory: agentDocker?.memory ?? globalDocker?.memory,
+		memorySwap: agentDocker?.memorySwap ?? globalDocker?.memorySwap,
+		cpus: agentDocker?.cpus ?? globalDocker?.cpus,
+		ulimits,
+		seccompProfile: agentDocker?.seccompProfile ?? globalDocker?.seccompProfile,
+		apparmorProfile: agentDocker?.apparmorProfile ?? globalDocker?.apparmorProfile,
+		dns: agentDocker?.dns ?? globalDocker?.dns,
+		extraHosts: agentDocker?.extraHosts ?? globalDocker?.extraHosts,
+		binds: binds.length ? binds : void 0
+	};
+}
+function resolveSandboxBrowserConfig(params) {
+	const agentBrowser = params.scope === "shared" ? void 0 : params.agentBrowser;
+	const globalBrowser = params.globalBrowser;
+	const binds = [...globalBrowser?.binds ?? [], ...agentBrowser?.binds ?? []];
+	const bindsConfigured = globalBrowser?.binds !== void 0 || agentBrowser?.binds !== void 0;
+	return {
+		enabled: agentBrowser?.enabled ?? globalBrowser?.enabled ?? false,
+		image: agentBrowser?.image ?? globalBrowser?.image ?? DEFAULT_SANDBOX_BROWSER_IMAGE,
+		containerPrefix: agentBrowser?.containerPrefix ?? globalBrowser?.containerPrefix ?? DEFAULT_SANDBOX_BROWSER_PREFIX,
+		cdpPort: agentBrowser?.cdpPort ?? globalBrowser?.cdpPort ?? DEFAULT_SANDBOX_BROWSER_CDP_PORT,
+		vncPort: agentBrowser?.vncPort ?? globalBrowser?.vncPort ?? DEFAULT_SANDBOX_BROWSER_VNC_PORT,
+		noVncPort: agentBrowser?.noVncPort ?? globalBrowser?.noVncPort ?? DEFAULT_SANDBOX_BROWSER_NOVNC_PORT,
+		headless: agentBrowser?.headless ?? globalBrowser?.headless ?? false,
+		enableNoVnc: agentBrowser?.enableNoVnc ?? globalBrowser?.enableNoVnc ?? true,
+		allowHostControl: agentBrowser?.allowHostControl ?? globalBrowser?.allowHostControl ?? false,
+		autoStart: agentBrowser?.autoStart ?? globalBrowser?.autoStart ?? true,
+		autoStartTimeoutMs: agentBrowser?.autoStartTimeoutMs ?? globalBrowser?.autoStartTimeoutMs ?? DEFAULT_SANDBOX_BROWSER_AUTOSTART_TIMEOUT_MS,
+		binds: bindsConfigured ? binds : void 0
+	};
+}
+function resolveSandboxPruneConfig(params) {
+	const agentPrune = params.scope === "shared" ? void 0 : params.agentPrune;
+	const globalPrune = params.globalPrune;
+	return {
+		idleHours: agentPrune?.idleHours ?? globalPrune?.idleHours ?? DEFAULT_SANDBOX_IDLE_HOURS,
+		maxAgeDays: agentPrune?.maxAgeDays ?? globalPrune?.maxAgeDays ?? DEFAULT_SANDBOX_MAX_AGE_DAYS
+	};
+}
+function resolveSandboxConfigForAgent(cfg, agentId) {
+	const agent = cfg?.agents?.defaults?.sandbox;
+	let agentSandbox;
+	const agentConfig = cfg && agentId ? resolveAgentConfig(cfg, agentId) : void 0;
+	if (agentConfig?.sandbox) agentSandbox = agentConfig.sandbox;
+	const scope = resolveSandboxScope({
+		scope: agentSandbox?.scope ?? agent?.scope,
+		perSession: agentSandbox?.perSession ?? agent?.perSession
+	});
+	const toolPolicy = resolveSandboxToolPolicyForAgent(cfg, agentId);
+	return {
+		mode: agentSandbox?.mode ?? agent?.mode ?? "off",
+		scope,
+		workspaceAccess: agentSandbox?.workspaceAccess ?? agent?.workspaceAccess ?? "none",
+		workspaceRoot: agentSandbox?.workspaceRoot ?? agent?.workspaceRoot ?? DEFAULT_SANDBOX_WORKSPACE_ROOT,
+		docker: resolveSandboxDockerConfig({
+			scope,
+			globalDocker: agent?.docker,
+			agentDocker: agentSandbox?.docker
+		}),
+		browser: resolveSandboxBrowserConfig({
+			scope,
+			globalBrowser: agent?.browser,
+			agentBrowser: agentSandbox?.browser
+		}),
+		tools: {
+			allow: toolPolicy.allow,
+			deny: toolPolicy.deny
+		},
+		prune: resolveSandboxPruneConfig({
+			scope,
+			globalPrune: agent?.prune,
+			agentPrune: agentSandbox?.prune
+		})
+	};
+}
+
+//#endregion
+//#region src/browser/bridge-auth-registry.ts
+const authByPort = /* @__PURE__ */ new Map();
+function getBridgeAuthForPort(port) {
+	if (!Number.isFinite(port) || port <= 0) return;
+	return authByPort.get(port);
+}
+function deleteBridgeAuthForPort(port) {
+	if (!Number.isFinite(port) || port <= 0) return;
+	authByPort.delete(port);
+}
+
+//#endregion
+//#region src/browser/bridge-server.ts
+async function stopBrowserBridgeServer(server) {
+	try {
+		const address = server.address();
+		if (address?.port) deleteBridgeAuthForPort(address.port);
+	} catch {}
+	await new Promise((resolve) => {
+		server.close(() => resolve());
+	});
+}
+
+//#endregion
+//#region src/agents/sandbox/browser-bridges.ts
+const BROWSER_BRIDGES = /* @__PURE__ */ new Map();
+
+//#endregion
+//#region src/agents/sandbox/registry.ts
+async function readRegistry() {
+	try {
+		const raw = await fs.readFile(SANDBOX_REGISTRY_PATH, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (parsed && Array.isArray(parsed.entries)) return parsed;
+	} catch {}
+	return { entries: [] };
+}
+async function writeRegistry(registry) {
+	await fs.mkdir(SANDBOX_STATE_DIR, { recursive: true });
+	await fs.writeFile(SANDBOX_REGISTRY_PATH, `${JSON.stringify(registry, null, 2)}\n`, "utf-8");
+}
+async function removeRegistryEntry(containerName) {
+	const registry = await readRegistry();
+	const next = registry.entries.filter((item) => item.containerName !== containerName);
+	if (next.length === registry.entries.length) return;
+	await writeRegistry({ entries: next });
+}
+async function readBrowserRegistry() {
+	try {
+		const raw = await fs.readFile(SANDBOX_BROWSER_REGISTRY_PATH, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (parsed && Array.isArray(parsed.entries)) return parsed;
+	} catch {}
+	return { entries: [] };
+}
+async function writeBrowserRegistry(registry) {
+	await fs.mkdir(SANDBOX_STATE_DIR, { recursive: true });
+	await fs.writeFile(SANDBOX_BROWSER_REGISTRY_PATH, `${JSON.stringify(registry, null, 2)}\n`, "utf-8");
+}
+async function removeBrowserRegistryEntry(containerName) {
+	const registry = await readBrowserRegistry();
+	const next = registry.entries.filter((item) => item.containerName !== containerName);
+	if (next.length === registry.entries.length) return;
+	await writeBrowserRegistry({ entries: next });
+}
+
+//#endregion
+//#region src/agents/sandbox/shared.ts
+function slugifySessionKey(value) {
+	const trimmed = value.trim() || "session";
+	const hash = crypto.createHash("sha1").update(trimmed).digest("hex").slice(0, 8);
+	return `${trimmed.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32) || "session"}-${hash}`;
+}
+function resolveSandboxWorkspaceDir(root, sessionKey) {
+	const resolvedRoot = resolveUserPath(root);
+	const slug = slugifySessionKey(sessionKey);
+	return path.join(resolvedRoot, slug);
+}
+function resolveSandboxScopeKey(scope, sessionKey) {
+	const trimmed = sessionKey.trim() || "main";
+	if (scope === "shared") return "shared";
+	if (scope === "session") return trimmed;
+	return `agent:${resolveAgentIdFromSessionKey(trimmed)}`;
+}
+function resolveSandboxAgentId(scopeKey) {
+	const trimmed = scopeKey.trim();
+	if (!trimmed || trimmed === "shared") return;
+	const parts = trimmed.split(":").filter(Boolean);
+	if (parts[0] === "agent" && parts[1]) return normalizeAgentId(parts[1]);
+	return resolveAgentIdFromSessionKey(trimmed);
+}
+
+//#endregion
+//#region src/agents/sandbox/docker.ts
+function createAbortError() {
+	const err = /* @__PURE__ */ new Error("Aborted");
+	err.name = "AbortError";
+	return err;
+}
+function execDockerRaw(args, opts) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("docker", args, { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		const stdoutChunks = [];
+		const stderrChunks = [];
+		let aborted = false;
+		const signal = opts?.signal;
+		const handleAbort = () => {
+			if (aborted) return;
+			aborted = true;
+			child.kill("SIGTERM");
+		};
+		if (signal) if (signal.aborted) handleAbort();
+		else signal.addEventListener("abort", handleAbort);
+		child.stdout?.on("data", (chunk) => {
+			stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+		});
+		child.on("error", (error) => {
+			if (signal) signal.removeEventListener("abort", handleAbort);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			if (signal) signal.removeEventListener("abort", handleAbort);
+			const stdout = Buffer.concat(stdoutChunks);
+			const stderr = Buffer.concat(stderrChunks);
+			if (aborted || signal?.aborted) {
+				reject(createAbortError());
+				return;
+			}
+			const exitCode = code ?? 0;
+			if (exitCode !== 0 && !opts?.allowFailure) {
+				const message = stderr.length > 0 ? stderr.toString("utf8").trim() : "";
+				reject(Object.assign(new Error(message || `docker ${args.join(" ")} failed`), {
+					code: exitCode,
+					stdout,
+					stderr
+				}));
+				return;
+			}
+			resolve({
+				stdout,
+				stderr,
+				code: exitCode
+			});
+		});
+		const stdin = child.stdin;
+		if (stdin) if (opts?.input !== void 0) stdin.end(opts.input);
+		else stdin.end();
+	});
+}
+const HOT_CONTAINER_WINDOW_MS = 300 * 1e3;
+async function execDocker(args, opts) {
+	const result = await execDockerRaw(args, opts);
+	return {
+		stdout: result.stdout.toString("utf8"),
+		stderr: result.stderr.toString("utf8"),
+		code: result.code
+	};
+}
+async function dockerContainerState(name) {
+	const result = await execDocker([
+		"inspect",
+		"-f",
+		"{{.State.Running}}",
+		name
+	], { allowFailure: true });
+	if (result.code !== 0) return {
+		exists: false,
+		running: false
+	};
+	return {
+		exists: true,
+		running: result.stdout.trim() === "true"
+	};
+}
+
+//#endregion
+//#region src/agents/sandbox/browser.ts
+const HOT_BROWSER_WINDOW_MS = 300 * 1e3;
+
+//#endregion
+//#region src/agents/sandbox/runtime-status.ts
+function shouldSandboxSession(cfg, sessionKey, mainSessionKey) {
+	if (cfg.mode === "off") return false;
+	if (cfg.mode === "all") return true;
+	return sessionKey.trim() !== mainSessionKey.trim();
+}
+function resolveMainSessionKeyForSandbox(params) {
+	if (params.cfg?.session?.scope === "global") return "global";
+	return resolveAgentMainSessionKey({
+		cfg: params.cfg,
+		agentId: params.agentId
+	});
+}
+function resolveComparableSessionKeyForSandbox(params) {
+	return canonicalizeMainSessionAlias({
+		cfg: params.cfg,
+		agentId: params.agentId,
+		sessionKey: params.sessionKey
+	});
+}
+function resolveSandboxRuntimeStatus(params) {
+	const sessionKey = params.sessionKey?.trim() ?? "";
+	const agentId = resolveSessionAgentId({
+		sessionKey,
+		config: params.cfg
+	});
+	const cfg = params.cfg;
+	const sandboxCfg = resolveSandboxConfigForAgent(cfg, agentId);
+	const mainSessionKey = resolveMainSessionKeyForSandbox({
+		cfg,
+		agentId
+	});
+	const sandboxed = sessionKey ? shouldSandboxSession(sandboxCfg, resolveComparableSessionKeyForSandbox({
+		cfg,
+		agentId,
+		sessionKey
+	}), mainSessionKey) : false;
+	return {
+		agentId,
+		sessionKey,
+		mainSessionKey,
+		mode: sandboxCfg.mode,
+		sandboxed,
+		toolPolicy: resolveSandboxToolPolicyForAgent(cfg, agentId)
+	};
+}
+
+//#endregion
+//#region src/agents/sandbox/workspace.ts
+async function ensureSandboxWorkspace(workspaceDir, seedFrom, skipBootstrap) {
+	await fs.mkdir(workspaceDir, { recursive: true });
+	if (seedFrom) {
+		const seed = resolveUserPath(seedFrom);
+		const files = [
+			DEFAULT_AGENTS_FILENAME,
+			DEFAULT_SOUL_FILENAME,
+			DEFAULT_TOOLS_FILENAME,
+			DEFAULT_IDENTITY_FILENAME,
+			DEFAULT_USER_FILENAME,
+			DEFAULT_BOOTSTRAP_FILENAME,
+			DEFAULT_HEARTBEAT_FILENAME
+		];
+		for (const name of files) {
+			const src = path.join(seed, name);
+			const dest = path.join(workspaceDir, name);
+			try {
+				await fs.access(dest);
+			} catch {
+				try {
+					const content = await fs.readFile(src, "utf-8");
+					await fs.writeFile(dest, content, {
+						encoding: "utf-8",
+						flag: "wx"
+					});
+				} catch {}
+			}
+		}
+	}
+	await ensureAgentWorkspace({
+		dir: workspaceDir,
+		ensureBootstrapFiles: !skipBootstrap
+	});
+}
+
+//#endregion
+//#region src/agents/sandbox/context.ts
+async function ensureSandboxWorkspaceLayout(params) {
+	const { cfg, rawSessionKey } = params;
+	const agentWorkspaceDir = resolveUserPath(params.workspaceDir?.trim() || DEFAULT_AGENT_WORKSPACE_DIR);
+	const workspaceRoot = resolveUserPath(cfg.workspaceRoot);
+	const scopeKey = resolveSandboxScopeKey(cfg.scope, rawSessionKey);
+	const sandboxWorkspaceDir = cfg.scope === "shared" ? workspaceRoot : resolveSandboxWorkspaceDir(workspaceRoot, scopeKey);
+	const workspaceDir = cfg.workspaceAccess === "rw" ? agentWorkspaceDir : sandboxWorkspaceDir;
+	if (workspaceDir === sandboxWorkspaceDir) {
+		await ensureSandboxWorkspace(sandboxWorkspaceDir, agentWorkspaceDir, params.config?.agents?.defaults?.skipBootstrap);
+		if (cfg.workspaceAccess !== "rw") try {
+			await syncSkillsToWorkspace({
+				sourceWorkspaceDir: agentWorkspaceDir,
+				targetWorkspaceDir: sandboxWorkspaceDir,
+				config: params.config
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : JSON.stringify(error);
+			defaultRuntime.error?.(`Sandbox skill sync failed: ${message}`);
+		}
+	} else await fs.mkdir(workspaceDir, { recursive: true });
+	return {
+		agentWorkspaceDir,
+		scopeKey,
+		sandboxWorkspaceDir,
+		workspaceDir
+	};
+}
+async function ensureSandboxWorkspaceForSession(params) {
+	const rawSessionKey = params.sessionKey?.trim();
+	if (!rawSessionKey) return null;
+	const runtime = resolveSandboxRuntimeStatus({
+		cfg: params.config,
+		sessionKey: rawSessionKey
+	});
+	if (!runtime.sandboxed) return null;
+	const cfg = resolveSandboxConfigForAgent(params.config, runtime.agentId);
+	const { workspaceDir } = await ensureSandboxWorkspaceLayout({
+		cfg,
+		rawSessionKey,
+		config: params.config,
+		workspaceDir: params.workspaceDir
+	});
+	return {
+		workspaceDir,
+		containerWorkdir: cfg.docker.workdir
+	};
+}
+
+//#endregion
+//#region src/agents/sandbox/manage.ts
+async function listSandboxContainers() {
+	const config = loadConfig();
+	const registry = await readRegistry();
+	const results = [];
+	for (const entry of registry.entries) {
+		const state = await dockerContainerState(entry.containerName);
+		let actualImage = entry.image;
+		if (state.exists) try {
+			const result = await execDocker([
+				"inspect",
+				"-f",
+				"{{.Config.Image}}",
+				entry.containerName
+			], { allowFailure: true });
+			if (result.code === 0) actualImage = result.stdout.trim();
+		} catch {}
+		const configuredImage = resolveSandboxConfigForAgent(config, resolveSandboxAgentId(entry.sessionKey)).docker.image;
+		results.push({
+			...entry,
+			image: actualImage,
+			running: state.running,
+			imageMatch: actualImage === configuredImage
+		});
+	}
+	return results;
+}
+async function listSandboxBrowsers() {
+	const config = loadConfig();
+	const registry = await readBrowserRegistry();
+	const results = [];
+	for (const entry of registry.entries) {
+		const state = await dockerContainerState(entry.containerName);
+		let actualImage = entry.image;
+		if (state.exists) try {
+			const result = await execDocker([
+				"inspect",
+				"-f",
+				"{{.Config.Image}}",
+				entry.containerName
+			], { allowFailure: true });
+			if (result.code === 0) actualImage = result.stdout.trim();
+		} catch {}
+		const configuredImage = resolveSandboxConfigForAgent(config, resolveSandboxAgentId(entry.sessionKey)).browser.image;
+		results.push({
+			...entry,
+			image: actualImage,
+			running: state.running,
+			imageMatch: actualImage === configuredImage
+		});
+	}
+	return results;
+}
+async function removeSandboxContainer(containerName) {
+	try {
+		await execDocker([
+			"rm",
+			"-f",
+			containerName
+		], { allowFailure: true });
+	} catch {}
+	await removeRegistryEntry(containerName);
+}
+async function removeSandboxBrowserContainer(containerName) {
+	try {
+		await execDocker([
+			"rm",
+			"-f",
+			containerName
+		], { allowFailure: true });
+	} catch {}
+	await removeBrowserRegistryEntry(containerName);
+	for (const [sessionKey, bridge] of BROWSER_BRIDGES.entries()) if (bridge.containerName === containerName) {
+		await stopBrowserBridgeServer(bridge.bridge.server).catch(() => void 0);
+		BROWSER_BRIDGES.delete(sessionKey);
+	}
+}
+
+//#endregion
+export { DEFAULT_SANDBOX_IMAGE as C, DEFAULT_SANDBOX_COMMON_IMAGE as S, resolveToolProfilePolicy as _, ensureSandboxWorkspaceForSession as a, matchesAnyGlobPattern as b, resolveSandboxConfigForAgent as c, applyOwnerOnlyToolPolicy as d, buildPluginToolGroups as f, normalizeToolName as g, expandToolGroups as h, removeSandboxContainer as i, resolveSandboxScope as l, expandPolicyWithPluginGroups as m, listSandboxContainers as n, resolveSandboxRuntimeStatus as o, collectExplicitAllowlist as p, removeSandboxBrowserContainer as r, getBridgeAuthForPort as s, listSandboxBrowsers as t, resolveSandboxToolPolicyForAgent as u, stripPluginOnlyAllowlist as v, DEFAULT_SANDBOX_BROWSER_IMAGE as x, compileGlobPatterns as y };