@openai/agents-extensions 0.8.4 → 0.9.0

package/dist/sandbox/shared/metadata.mjs

@@ -0,0 +1,81 @@
+import { isDir, isMount, normalizeRelativePath, FileMode, Permissions, SandboxUnsupportedFeatureError, } from '@openai/agents-core/sandbox';
+export const MOUNT_MANIFEST_METADATA_SUPPORT = {
+    mounts: true,
+};
+export const SANDBOX_MANIFEST_METADATA_SUPPORT = {
+    users: true,
+    groups: true,
+    entryPermissions: true,
+    entryGroups: true,
+    mounts: true,
+};
+export function sandboxEntryPermissionsMode(entry) {
+    const permissions = new Permissions(entry.permissions ?? {
+        owner: FileMode.ALL,
+        group: FileMode.READ | FileMode.EXEC,
+        other: FileMode.READ | FileMode.EXEC,
+    });
+    return (permissions.toMode() & 0o777).toString(8).padStart(4, '0');
+}
+export function assertSandboxManifestMetadataSupported(providerName, manifest, support = {}) {
+    if (!support.users && manifest.users.length > 0) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support manifest users yet.`, {
+            provider: providerName,
+            feature: 'manifest.users',
+        });
+    }
+    if (!support.groups && manifest.groups.length > 0) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support manifest groups yet.`, {
+            provider: providerName,
+            feature: 'manifest.groups',
+        });
+    }
+    if (!support.extraPathGrants && manifest.extraPathGrants.length > 0) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support extra path grants yet.`, {
+            provider: providerName,
+            feature: 'manifest.extraPathGrants',
+        });
+    }
+    for (const [logicalPath, entry] of Object.entries(manifest.entries)) {
+        assertSandboxEntryMetadataSupported(providerName, logicalPath, entry, support);
+    }
+}
+export function assertSandboxEntryMetadataSupported(providerName, logicalPath, entry, support = {}) {
+    const displayPath = logicalPath || '.';
+    if (!support.entryPermissions && entry.permissions !== undefined) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support sandbox entry permissions yet: ${displayPath}`, {
+            provider: providerName,
+            feature: 'entry.permissions',
+            path: displayPath,
+        });
+    }
+    if (!support.entryGroups && entry.group !== undefined) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support sandbox entry group ownership yet: ${displayPath}`, {
+            provider: providerName,
+            feature: 'entry.group',
+            path: displayPath,
+        });
+    }
+    if (!support.mounts && isMount(entry)) {
+        throw new SandboxUnsupportedFeatureError(`${providerName} does not support mount entries yet: ${displayPath}`, {
+            provider: providerName,
+            feature: 'entry.mount',
+            path: displayPath,
+        });
+    }
+    if (!isDir(entry) || !entry.children) {
+        return;
+    }
+    for (const [childPath, childEntry] of Object.entries(entry.children)) {
+        const childLogicalPath = joinSandboxPath(logicalPath, childPath);
+        assertSandboxEntryMetadataSupported(providerName, childLogicalPath, childEntry, support);
+    }
+}
+function joinSandboxPath(parent, child) {
+    const normalizedChild = normalizeRelativePath(child);
+    if (!parent || parent === '.') {
+        return normalizedChild;
+    }
+    return `${parent.replace(/\/+$/u, '')}/${normalizedChild}`;
+}
+//# sourceMappingURL=metadata.mjs.map

package/dist/sandbox/shared/metadata.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.mjs","sourceRoot":"","sources":["../../../src/sandbox/shared/metadata.ts"],"names":[],"mappings":"OAAO,EACL,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,QAAQ,EACR,WAAW,EACX,8BAA8B,GAG/B,MAAM,6BAA6B;AAGpC,MAAM,CAAC,MAAM,+BAA+B,GAAmC;IAC7E,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAC5C;IACE,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE,IAAI;CACb,CAAC;AAEJ,MAAM,UAAU,2BAA2B,CAAC,KAAY;IACtD,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,KAAK,CAAC,WAAW,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,KAAK,EAAE,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI;QACpC,KAAK,EAAE,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI;KACrC,CACF,CAAC;IACF,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,YAAoB,EACpB,QAAkB,EAClB,UAA0C,EAAE;IAE5C,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,uCAAuC,EACtD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,gBAAgB;SAC1B,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,wCAAwC,EACvD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,iBAAiB;SAC3B,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,0CAA0C,EACzD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,0BAA0B;SACpC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,mCAAmC,CACjC,YAAY,EACZ,WAAW,EACX,KAAK,EACL,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,YAAoB,EACpB,WAAmB,EACnB,KAAY,EACZ,UAA0C,EAAE;IAE5C,MAAM,WAAW,GAAG,WAAW,IAAI,GAAG,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjE,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,oDAAoD,WAAW,EAAE,EAChF;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,WAAW;SAClB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,wDAAwD,WAAW,EAAE,EACpF;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,WAAW;SAClB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,GAAG,YAAY,wCAAwC,WAAW,EAAE,EACpE;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,WAAW;SAClB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,mCAAmC,CACjC,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;AAC7D,CAAC"}

package/dist/sandbox/shared/output.d.ts

@@ -0,0 +1 @@
+export { elapsedSeconds, formatExecResponse, truncateOutput, } from '@openai/agents-core/sandbox/internal';

package/dist/sandbox/shared/output.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.truncateOutput = exports.formatExecResponse = exports.elapsedSeconds = void 0;
+var internal_1 = require("@openai/agents-core/sandbox/internal");
+Object.defineProperty(exports, "elapsedSeconds", { enumerable: true, get: function () { return internal_1.elapsedSeconds; } });
+Object.defineProperty(exports, "formatExecResponse", { enumerable: true, get: function () { return internal_1.formatExecResponse; } });
+Object.defineProperty(exports, "truncateOutput", { enumerable: true, get: function () { return internal_1.truncateOutput; } });
+//# sourceMappingURL=output.js.map

package/dist/sandbox/shared/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/sandbox/shared/output.ts"],"names":[],"mappings":";;;AAAA,iEAI8C;AAH5C,0GAAA,cAAc,OAAA;AACd,8GAAA,kBAAkB,OAAA;AAClB,0GAAA,cAAc,OAAA"}

package/dist/sandbox/shared/output.mjs

@@ -0,0 +1,2 @@
+export { elapsedSeconds, formatExecResponse, truncateOutput, } from '@openai/agents-core/sandbox/internal';
+//# sourceMappingURL=output.mjs.map

package/dist/sandbox/shared/output.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.mjs","sourceRoot":"","sources":["../../../src/sandbox/shared/output.ts"],"names":[],"mappings":"OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,cAAc,GACf,MAAM,sCAAsC"}

package/dist/sandbox/shared/paths.d.ts

@@ -0,0 +1,27 @@
+import { type Manifest, type SandboxPathGrant } from '@openai/agents-core/sandbox';
+import { posixDirname, shellQuote } from '@openai/agents-core/sandbox/internal';
+import type { RemoteSandboxPathOptions } from './types';
+export { posixDirname, shellQuote };
+export type RemotePathCommandResult = {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+};
+export type ValidateRemoteSandboxPathArgs = {
+    root: string;
+    path?: string;
+    options?: ValidateRemoteSandboxPathOptions;
+    runCommand(command: string): Promise<RemotePathCommandResult>;
+};
+export type ValidateRemoteSandboxPathOptions = RemoteSandboxPathOptions & {
+    extraPathGrants?: SandboxPathGrant[];
+};
+export type ValidateRemoteSandboxPathForManifestArgs = Omit<ValidateRemoteSandboxPathArgs, 'root' | 'options'> & {
+    manifest: Manifest;
+    options?: RemoteSandboxPathOptions;
+};
+export declare function resolveSandboxAbsolutePath(root: string, path?: string, options?: ValidateRemoteSandboxPathOptions): string;
+export declare function validateRemoteSandboxPath({ root, path, options, runCommand, }: ValidateRemoteSandboxPathArgs): Promise<string>;
+export declare function validateRemoteSandboxPathForManifest({ manifest, path, options, runCommand, }: ValidateRemoteSandboxPathForManifestArgs): Promise<string>;
+export declare function resolveSandboxRelativePath(root: string, path?: string): string;
+export declare function resolveSandboxWorkdir(root: string, path?: string): string;

package/dist/sandbox/shared/paths.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shellQuote = exports.posixDirname = void 0;
+exports.resolveSandboxAbsolutePath = resolveSandboxAbsolutePath;
+exports.validateRemoteSandboxPath = validateRemoteSandboxPath;
+exports.validateRemoteSandboxPathForManifest = validateRemoteSandboxPathForManifest;
+exports.resolveSandboxRelativePath = resolveSandboxRelativePath;
+exports.resolveSandboxWorkdir = resolveSandboxWorkdir;
+const agents_core_1 = require("@openai/agents-core");
+const sandbox_1 = require("@openai/agents-core/sandbox");
+const internal_1 = require("@openai/agents-core/sandbox/internal");
+Object.defineProperty(exports, "posixDirname", { enumerable: true, get: function () { return internal_1.posixDirname; } });
+Object.defineProperty(exports, "shellQuote", { enumerable: true, get: function () { return internal_1.shellQuote; } });
+const RESOLVE_WORKSPACE_PATH_HELPER = String.raw `#!/bin/sh
+set -eu
+
+root="$1"
+candidate="$2"
+for_write="$3"
+shift 3
+max_symlink_depth=64
+
+case "$for_write" in
+  0|1) ;;
+  *) printf 'for_write must be 0 or 1: %s\n' "$for_write" >&2; exit 64 ;;
+esac
+
+if [ $(( $# % 2 )) -ne 0 ]; then
+  printf 'extra path grants must be root/read_only pairs\n' >&2
+  exit 64
+fi
+
+resolve_path() {
+  path="$1"
+  depth="$2"
+  seen=""
+  if [ "$#" -ge 3 ]; then
+    seen="$3"
+  fi
+  if [ "$path" = "/" ]; then
+    printf '/\n'
+    return 0
+  fi
+  if [ "$depth" -ge "$max_symlink_depth" ]; then
+    printf 'symlink resolution depth exceeded: %s\n' "$path" >&2
+    exit 112
+  fi
+  if [ -d "$path" ]; then
+    (cd "$path" && pwd -P)
+    return 0
+  fi
+  parent=$(dirname "$path")
+  base=$(basename "$path")
+  if [ -z "$parent" ] || [ "$parent" = "$path" ]; then
+    parent="/"
+  fi
+  resolved_parent=$(resolve_path "$parent" "$depth" "$seen")
+  candidate_path=$(join_child_path "$resolved_parent" "$base")
+  if [ -L "$candidate_path" ]; then
+    case ":$seen:" in
+      *":$candidate_path:"*)
+        printf 'symlink resolution depth exceeded: %s\n' "$candidate_path" >&2
+        exit 112
+        ;;
+    esac
+    target=$(readlink "$candidate_path")
+    next_depth=$((depth + 1))
+    next_seen="$seen:$candidate_path"
+    case "$target" in
+      /*) resolve_path "$target" "$next_depth" "$next_seen" ;;
+      *)
+        relative_target=$(join_child_path "$resolved_parent" "$target")
+        resolve_path "$relative_target" "$next_depth" "$next_seen"
+        ;;
+    esac
+    return 0
+  fi
+  printf '%s\n' "$candidate_path"
+}
+
+join_child_path() {
+  parent="$1"
+  child="$2"
+  if [ "$parent" = "/" ]; then
+    printf '/%s\n' "$child"
+  else
+    printf '%s/%s\n' "$parent" "$child"
+  fi
+}
+
+resolved_candidate=$(resolve_path "$candidate" 0)
+best_grant_root=""
+best_grant_original=""
+best_grant_read_only="0"
+best_grant_len=0
+
+check_workspace_root() {
+  resolved_root=$(resolve_path "$root" 0)
+  if [ "$resolved_root" = "/" ]; then
+    case "$resolved_candidate" in
+      /*)
+        printf '%s\n' "$resolved_candidate"
+        exit 0
+        ;;
+    esac
+  fi
+  case "$resolved_candidate" in
+    "$resolved_root"|"$resolved_root"/*)
+      printf '%s\n' "$resolved_candidate"
+      exit 0
+      ;;
+  esac
+}
+
+consider_extra_grant() {
+  allowed_root="$1"
+  read_only="$2"
+  case "$read_only" in
+    0|1) ;;
+    *) printf 'extra path grant read_only must be 0 or 1: %s\n' "$read_only" >&2; exit 64 ;;
+  esac
+  resolved_root=$(resolve_path "$allowed_root" 0)
+  if [ "$resolved_root" = "/" ]; then
+    printf 'extra path grant must not resolve to filesystem root: %s\n' "$allowed_root" >&2
+    exit 113
+  fi
+  case "$resolved_candidate" in
+    "$resolved_root"|"$resolved_root"/*)
+      root_len=$(printf '%s' "$resolved_root" | wc -c | tr -d ' ')
+      if [ "$root_len" -gt "$best_grant_len" ]; then
+        best_grant_root="$resolved_root"
+        best_grant_original="$allowed_root"
+        best_grant_read_only="$read_only"
+        best_grant_len="$root_len"
+      fi
+      ;;
+  esac
+}
+
+while [ "$#" -gt 0 ]; do
+  consider_extra_grant "$1" "$2"
+  shift 2
+done
+
+check_workspace_root
+if [ -n "$best_grant_root" ]; then
+  if [ "$for_write" = "1" ] && [ "$best_grant_read_only" = "1" ]; then
+    printf 'read-only extra path grant: %s\nresolved path: %s\n' "$best_grant_original" "$resolved_candidate" >&2
+    exit 114
+  fi
+  printf '%s\n' "$resolved_candidate"
+  exit 0
+fi
+
+printf 'workspace escape: %s\n' "$resolved_candidate" >&2
+exit 111`;
+function createRemotePathHelperId() {
+    const crypto = globalThis
+        .crypto;
+    if (typeof crypto?.randomUUID === 'function') {
+        return crypto.randomUUID();
+    }
+    if (typeof crypto?.getRandomValues === 'function') {
+        return Array.from(crypto.getRandomValues(new Uint32Array(4)), (value) => value.toString(36)).join('-');
+    }
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function resolveSandboxAbsolutePath(root, path, options = {}) {
+    return new sandbox_1.WorkspacePathPolicy({
+        root,
+        extraPathGrants: options.extraPathGrants,
+    }).resolve(path, { forWrite: options.forWrite }).path;
+}
+async function validateRemoteSandboxPath({ root, path, options = {}, runCommand, }) {
+    const candidate = resolveSandboxAbsolutePath(root, path, options);
+    const helperDir = `/tmp/openai-agents-resolve-path-${createRemotePathHelperId()}`;
+    const helperArgs = [
+        root,
+        candidate,
+        options.forWrite ? '1' : '0',
+        ...(options.extraPathGrants ?? []).flatMap((grant) => [
+            grant.path,
+            grant.readOnly ? '1' : '0',
+        ]),
+    ];
+    const command = [
+        `helper_dir=${(0, internal_1.shellQuote)(helperDir)}`,
+        'helper_path="$helper_dir/resolve-workspace-path.sh"',
+        'cleanup() { rm -rf "$helper_dir"; }',
+        'trap cleanup EXIT HUP INT TERM',
+        'umask 077',
+        'mkdir "$helper_dir" || exit 125',
+        'cat > "$helper_path" <<\'OPENAI_AGENTS_RESOLVE_PATH\'',
+        RESOLVE_WORKSPACE_PATH_HELPER,
+        'OPENAI_AGENTS_RESOLVE_PATH',
+        `sh "$helper_path" ${helperArgs.map(internal_1.shellQuote).join(' ')}`,
+    ].join('\n');
+    const result = await runCommand(command);
+    if (result.status !== 0) {
+        const message = (result.stderr ||
+            result.stdout ||
+            'remote validation failed')
+            .trim()
+            .split(/\r?\n/u)
+            .join('; ');
+        throw new sandbox_1.SandboxPathResolutionError(`Sandbox path "${path ?? ''}" failed remote validation: ${message}`, {
+            root,
+            path: path ?? '',
+            forWrite: options.forWrite ?? false,
+        });
+    }
+    const resolvedPath = result.stdout?.trim().split(/\r?\n/u).pop();
+    if (!resolvedPath?.startsWith('/')) {
+        throw new sandbox_1.SandboxPathResolutionError(`Sandbox path "${path ?? ''}" failed remote validation: validator did not return an absolute resolved path.`, {
+            root,
+            path: path ?? '',
+            forWrite: options.forWrite ?? false,
+        });
+    }
+    return resolvedPath;
+}
+async function validateRemoteSandboxPathForManifest({ manifest, path, options = {}, runCommand, }) {
+    return await validateRemoteSandboxPath({
+        root: manifest.root,
+        path,
+        options: {
+            ...options,
+            extraPathGrants: manifest.extraPathGrants,
+        },
+        runCommand,
+    });
+}
+function resolveSandboxRelativePath(root, path) {
+    const resolved = new sandbox_1.WorkspacePathPolicy({
+        root,
+    }).resolve(path, { forWrite: true });
+    if (typeof resolved.workspaceRelativePath !== 'string') {
+        throw new agents_core_1.UserError(`Sandbox path "${path ?? ''}" escapes the workspace root.`);
+    }
+    return (0, sandbox_1.normalizeRelativePath)(resolved.workspaceRelativePath);
+}
+function resolveSandboxWorkdir(root, path) {
+    return resolveSandboxAbsolutePath(root, path);
+}
+//# sourceMappingURL=paths.js.map

package/dist/sandbox/shared/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/sandbox/shared/paths.ts"],"names":[],"mappings":";;;AAyMA,gEASC;AAED,8DA6DC;AAED,oFAeC;AAED,gEAaC;AAED,sDAEC;AArTD,qDAAgD;AAChD,yDAMqC;AACrC,mEAAgF;AAGvE,6FAHA,uBAAY,OAGA;AAAE,2FAHA,qBAAU,OAGA;AAgCjC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA8IvC,CAAC;AAEV,SAAS,wBAAwB;IAC/B,MAAM,MAAM,GAAI,UAA6D;SAC1E,MAAM,CAAC;IACV,IAAI,OAAO,MAAM,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CACtE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CACnB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAgB,0BAA0B,CACxC,IAAY,EACZ,IAAa,EACb,UAA4C,EAAE;IAE9C,OAAO,IAAI,6BAAmB,CAAC;QAC7B,IAAI;QACJ,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,EAC9C,IAAI,EACJ,IAAI,EACJ,OAAO,GAAG,EAAE,EACZ,UAAU,GACoB;IAC9B,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,mCAAmC,wBAAwB,EAAE,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG;QACjB,IAAI;QACJ,SAAS;QACT,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC5B,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC3B,CAAC;KACH,CAAC;IACF,MAAM,OAAO,GAAG;QACd,cAAc,IAAA,qBAAU,EAAC,SAAS,CAAC,EAAE;QACrC,qDAAqD;QACrD,qCAAqC;QACrC,gCAAgC;QAChC,WAAW;QACX,iCAAiC;QACjC,uDAAuD;QACvD,6BAA6B;QAC7B,4BAA4B;QAC5B,qBAAqB,UAAU,CAAC,GAAG,CAAC,qBAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,CACd,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,MAAM;YACb,0BAA0B,CAC3B;aACE,IAAI,EAAE;aACN,KAAK,CAAC,QAAQ,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,oCAA0B,CAClC,iBAAiB,IAAI,IAAI,EAAE,+BAA+B,OAAO,EAAE,EACnE;YACE,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;SACpC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,oCAA0B,CAClC,iBAAiB,IAAI,IAAI,EAAE,iFAAiF,EAC5G;YACE,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;SACpC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAEM,KAAK,UAAU,oCAAoC,CAAC,EACzD,QAAQ,EACR,IAAI,EACJ,OAAO,GAAG,EAAE,EACZ,UAAU,GAC+B;IACzC,OAAO,MAAM,yBAAyB,CAAC;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI;QACJ,OAAO,EAAE;YACP,GAAG,OAAO;YACV,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C;QACD,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,0BAA0B,CACxC,IAAY,EACZ,IAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,6BAAmB,CAAC;QACvC,IAAI;KACL,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,QAAQ,CAAC,qBAAqB,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAS,CACjB,iBAAiB,IAAI,IAAI,EAAE,+BAA+B,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,+BAAqB,EAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAY,EAAE,IAAa;IAC/D,OAAO,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/sandbox/shared/paths.mjs

@@ -0,0 +1,236 @@
+import { UserError } from '@openai/agents-core';
+import { normalizeRelativePath, SandboxPathResolutionError, WorkspacePathPolicy, } from '@openai/agents-core/sandbox';
+import { posixDirname, shellQuote } from '@openai/agents-core/sandbox/internal';
+export { posixDirname, shellQuote };
+const RESOLVE_WORKSPACE_PATH_HELPER = String.raw `#!/bin/sh
+set -eu
+
+root="$1"
+candidate="$2"
+for_write="$3"
+shift 3
+max_symlink_depth=64
+
+case "$for_write" in
+  0|1) ;;
+  *) printf 'for_write must be 0 or 1: %s\n' "$for_write" >&2; exit 64 ;;
+esac
+
+if [ $(( $# % 2 )) -ne 0 ]; then
+  printf 'extra path grants must be root/read_only pairs\n' >&2
+  exit 64
+fi
+
+resolve_path() {
+  path="$1"
+  depth="$2"
+  seen=""
+  if [ "$#" -ge 3 ]; then
+    seen="$3"
+  fi
+  if [ "$path" = "/" ]; then
+    printf '/\n'
+    return 0
+  fi
+  if [ "$depth" -ge "$max_symlink_depth" ]; then
+    printf 'symlink resolution depth exceeded: %s\n' "$path" >&2
+    exit 112
+  fi
+  if [ -d "$path" ]; then
+    (cd "$path" && pwd -P)
+    return 0
+  fi
+  parent=$(dirname "$path")
+  base=$(basename "$path")
+  if [ -z "$parent" ] || [ "$parent" = "$path" ]; then
+    parent="/"
+  fi
+  resolved_parent=$(resolve_path "$parent" "$depth" "$seen")
+  candidate_path=$(join_child_path "$resolved_parent" "$base")
+  if [ -L "$candidate_path" ]; then
+    case ":$seen:" in
+      *":$candidate_path:"*)
+        printf 'symlink resolution depth exceeded: %s\n' "$candidate_path" >&2
+        exit 112
+        ;;
+    esac
+    target=$(readlink "$candidate_path")
+    next_depth=$((depth + 1))
+    next_seen="$seen:$candidate_path"
+    case "$target" in
+      /*) resolve_path "$target" "$next_depth" "$next_seen" ;;
+      *)
+        relative_target=$(join_child_path "$resolved_parent" "$target")
+        resolve_path "$relative_target" "$next_depth" "$next_seen"
+        ;;
+    esac
+    return 0
+  fi
+  printf '%s\n' "$candidate_path"
+}
+
+join_child_path() {
+  parent="$1"
+  child="$2"
+  if [ "$parent" = "/" ]; then
+    printf '/%s\n' "$child"
+  else
+    printf '%s/%s\n' "$parent" "$child"
+  fi
+}
+
+resolved_candidate=$(resolve_path "$candidate" 0)
+best_grant_root=""
+best_grant_original=""
+best_grant_read_only="0"
+best_grant_len=0
+
+check_workspace_root() {
+  resolved_root=$(resolve_path "$root" 0)
+  if [ "$resolved_root" = "/" ]; then
+    case "$resolved_candidate" in
+      /*)
+        printf '%s\n' "$resolved_candidate"
+        exit 0
+        ;;
+    esac
+  fi
+  case "$resolved_candidate" in
+    "$resolved_root"|"$resolved_root"/*)
+      printf '%s\n' "$resolved_candidate"
+      exit 0
+      ;;
+  esac
+}
+
+consider_extra_grant() {
+  allowed_root="$1"
+  read_only="$2"
+  case "$read_only" in
+    0|1) ;;
+    *) printf 'extra path grant read_only must be 0 or 1: %s\n' "$read_only" >&2; exit 64 ;;
+  esac
+  resolved_root=$(resolve_path "$allowed_root" 0)
+  if [ "$resolved_root" = "/" ]; then
+    printf 'extra path grant must not resolve to filesystem root: %s\n' "$allowed_root" >&2
+    exit 113
+  fi
+  case "$resolved_candidate" in
+    "$resolved_root"|"$resolved_root"/*)
+      root_len=$(printf '%s' "$resolved_root" | wc -c | tr -d ' ')
+      if [ "$root_len" -gt "$best_grant_len" ]; then
+        best_grant_root="$resolved_root"
+        best_grant_original="$allowed_root"
+        best_grant_read_only="$read_only"
+        best_grant_len="$root_len"
+      fi
+      ;;
+  esac
+}
+
+while [ "$#" -gt 0 ]; do
+  consider_extra_grant "$1" "$2"
+  shift 2
+done
+
+check_workspace_root
+if [ -n "$best_grant_root" ]; then
+  if [ "$for_write" = "1" ] && [ "$best_grant_read_only" = "1" ]; then
+    printf 'read-only extra path grant: %s\nresolved path: %s\n' "$best_grant_original" "$resolved_candidate" >&2
+    exit 114
+  fi
+  printf '%s\n' "$resolved_candidate"
+  exit 0
+fi
+
+printf 'workspace escape: %s\n' "$resolved_candidate" >&2
+exit 111`;
+function createRemotePathHelperId() {
+    const crypto = globalThis
+        .crypto;
+    if (typeof crypto?.randomUUID === 'function') {
+        return crypto.randomUUID();
+    }
+    if (typeof crypto?.getRandomValues === 'function') {
+        return Array.from(crypto.getRandomValues(new Uint32Array(4)), (value) => value.toString(36)).join('-');
+    }
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+export function resolveSandboxAbsolutePath(root, path, options = {}) {
+    return new WorkspacePathPolicy({
+        root,
+        extraPathGrants: options.extraPathGrants,
+    }).resolve(path, { forWrite: options.forWrite }).path;
+}
+export async function validateRemoteSandboxPath({ root, path, options = {}, runCommand, }) {
+    const candidate = resolveSandboxAbsolutePath(root, path, options);
+    const helperDir = `/tmp/openai-agents-resolve-path-${createRemotePathHelperId()}`;
+    const helperArgs = [
+        root,
+        candidate,
+        options.forWrite ? '1' : '0',
+        ...(options.extraPathGrants ?? []).flatMap((grant) => [
+            grant.path,
+            grant.readOnly ? '1' : '0',
+        ]),
+    ];
+    const command = [
+        `helper_dir=${shellQuote(helperDir)}`,
+        'helper_path="$helper_dir/resolve-workspace-path.sh"',
+        'cleanup() { rm -rf "$helper_dir"; }',
+        'trap cleanup EXIT HUP INT TERM',
+        'umask 077',
+        'mkdir "$helper_dir" || exit 125',
+        'cat > "$helper_path" <<\'OPENAI_AGENTS_RESOLVE_PATH\'',
+        RESOLVE_WORKSPACE_PATH_HELPER,
+        'OPENAI_AGENTS_RESOLVE_PATH',
+        `sh "$helper_path" ${helperArgs.map(shellQuote).join(' ')}`,
+    ].join('\n');
+    const result = await runCommand(command);
+    if (result.status !== 0) {
+        const message = (result.stderr ||
+            result.stdout ||
+            'remote validation failed')
+            .trim()
+            .split(/\r?\n/u)
+            .join('; ');
+        throw new SandboxPathResolutionError(`Sandbox path "${path ?? ''}" failed remote validation: ${message}`, {
+            root,
+            path: path ?? '',
+            forWrite: options.forWrite ?? false,
+        });
+    }
+    const resolvedPath = result.stdout?.trim().split(/\r?\n/u).pop();
+    if (!resolvedPath?.startsWith('/')) {
+        throw new SandboxPathResolutionError(`Sandbox path "${path ?? ''}" failed remote validation: validator did not return an absolute resolved path.`, {
+            root,
+            path: path ?? '',
+            forWrite: options.forWrite ?? false,
+        });
+    }
+    return resolvedPath;
+}
+export async function validateRemoteSandboxPathForManifest({ manifest, path, options = {}, runCommand, }) {
+    return await validateRemoteSandboxPath({
+        root: manifest.root,
+        path,
+        options: {
+            ...options,
+            extraPathGrants: manifest.extraPathGrants,
+        },
+        runCommand,
+    });
+}
+export function resolveSandboxRelativePath(root, path) {
+    const resolved = new WorkspacePathPolicy({
+        root,
+    }).resolve(path, { forWrite: true });
+    if (typeof resolved.workspaceRelativePath !== 'string') {
+        throw new UserError(`Sandbox path "${path ?? ''}" escapes the workspace root.`);
+    }
+    return normalizeRelativePath(resolved.workspaceRelativePath);
+}
+export function resolveSandboxWorkdir(root, path) {
+    return resolveSandboxAbsolutePath(root, path);
+}
+//# sourceMappingURL=paths.mjs.map

package/dist/sandbox/shared/paths.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.mjs","sourceRoot":"","sources":["../../../src/sandbox/shared/paths.ts"],"names":[],"mappings":"OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB;OACxC,EAEL,qBAAqB,EAErB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,6BAA6B;OAC7B,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sCAAsC;AAG/E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAgCpC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA8IvC,CAAC;AAEV,SAAS,wBAAwB;IAC/B,MAAM,MAAM,GAAI,UAA6D;SAC1E,MAAM,CAAC;IACV,IAAI,OAAO,MAAM,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CACtE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CACnB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,IAAa,EACb,UAA4C,EAAE;IAE9C,OAAO,IAAI,mBAAmB,CAAC;QAC7B,IAAI;QACJ,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,IAAI,EACJ,IAAI,EACJ,OAAO,GAAG,EAAE,EACZ,UAAU,GACoB;IAC9B,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,mCAAmC,wBAAwB,EAAE,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG;QACjB,IAAI;QACJ,SAAS;QACT,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC5B,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC3B,CAAC;KACH,CAAC;IACF,MAAM,OAAO,GAAG;QACd,cAAc,UAAU,CAAC,SAAS,CAAC,EAAE;QACrC,qDAAqD;QACrD,qCAAqC;QACrC,gCAAgC;QAChC,WAAW;QACX,iCAAiC;QACjC,uDAAuD;QACvD,6BAA6B;QAC7B,4BAA4B;QAC5B,qBAAqB,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,CACd,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,MAAM;YACb,0BAA0B,CAC3B;aACE,IAAI,EAAE;aACN,KAAK,CAAC,QAAQ,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,IAAI,IAAI,EAAE,+BAA+B,OAAO,EAAE,EACnE;YACE,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;SACpC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,IAAI,IAAI,EAAE,iFAAiF,EAC5G;YACE,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;SACpC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,EACzD,QAAQ,EACR,IAAI,EACJ,OAAO,GAAG,EAAE,EACZ,UAAU,GAC+B;IACzC,OAAO,MAAM,yBAAyB,CAAC;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI;QACJ,OAAO,EAAE;YACP,GAAG,OAAO;YACV,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C;QACD,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,IAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;QACvC,IAAI;KACL,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,QAAQ,CAAC,qBAAqB,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CACjB,iBAAiB,IAAI,IAAI,EAAE,+BAA+B,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAa;IAC/D,OAAO,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/sandbox/shared/ports.d.ts

@@ -0,0 +1,14 @@
+import { type ExposedPortEndpoint, type SandboxSessionState } from '@openai/agents-core/sandbox';
+export declare function assertConfiguredExposedPort(args: {
+    providerName: string;
+    port: number;
+    configuredPorts?: number[];
+    allowOnDemand?: boolean;
+}): number;
+export declare function getCachedExposedPortEndpoint(state: SandboxSessionState, port: number): ExposedPortEndpoint | undefined;
+export declare function recordResolvedExposedPortEndpoint(state: SandboxSessionState, requestedPort: number, endpoint: ExposedPortEndpoint): ExposedPortEndpoint;
+export declare function parseExposedPortEndpoint(value: string, args: {
+    providerName: string;
+    source: string;
+    query?: string;
+}): ExposedPortEndpoint;