@opengeni/runtime 0.13.11 → 0.13.13

package/dist/{index-Ciehex_q.d.ts → index-BraazrAO.d.ts}

@@ -927,6 +927,19 @@ declare class SandboxChannelAService {
     fsDelete(req: FsDeleteRequest): Promise<FsDeleteResponse>;
     fsMove(req: FsMoveRequest): Promise<FsMoveResponse>;
     fsMkdir(req: FsMkdirRequest): Promise<FsMkdirResponse>;
+    /** Measure one Git command without returning its potentially large or
+     * NUL-bearing output through the provider's text transport. */
+    private measureConfinedCommandBytes;
+    /** Read an exact prefix of a command's output in chunks that remain below
+     * every supported execCommand retained-output ceiling. The producer is
+     * intentionally rerun per chunk; turn-end capture calls this only after the
+     * durable mutation authority has quiesced the workspace. */
+    private readConfinedCommandPrefix;
+    private readConfinedCommandBytes;
+    /** Read a regular untracked file without routing its body through one large
+     * execCommand response. Native provider reads are binary-safe; providers
+     * without that surface use the same bounded chunk protocol as Git patches. */
+    private readUntrackedRegularFile;
     gitStatus(req: GitStatusRequest): Promise<GitStatusResponse>;
     gitDiff(req: GitDiffRequest): Promise<GitDiffResponse>;
     gitLog(req: GitLogRequest): Promise<GitLogResponse>;

package/dist/index.d.ts

@@ -7,8 +7,8 @@ import { HumanInputResponse, ReasoningEffort, GitCredentialProvider, GitCredenti
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import { SandboxSessionLike, Capability, SandboxSessionState, Manifest, Capabilities, LocalDirLazySkillSource, SandboxClient } from '@openai/agents/sandbox';
 import OpenAI from 'openai';
-import { R as RunCredentialSessionReady, a as RuntimeMetricsHooks } from './index-Ciehex_q.js';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from './index-Ciehex_q.js';
+import { R as RunCredentialSessionReady, a as RuntimeMetricsHooks } from './index-BraazrAO.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from './index-BraazrAO.js';
 export { SkillLibraryEntry, SkillLibraryFile, SkillLibrarySkill, getSkillLibraryEntry, isSkillLibraryEntryId, listSkillLibraryEntries, loadSkillLibrarySkill } from './skill-library.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/index.js

@@ -175,7 +175,7 @@ import {
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession,
   wrapCapabilityToolsForTurnCancellation
-} from "./chunk-RHB7ETON.js";
+} from "./chunk-3NUSY22C.js";
 import {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, R as RunCredentialSessionReady, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from '../index-Ciehex_q.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, R as RunCredentialSessionReady, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from '../index-BraazrAO.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -170,7 +170,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-RHB7ETON.js";
+} from "../chunk-3NUSY22C.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.13.11",
+  "version": "0.13.13",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -50,8 +50,8 @@
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.7",
-    "@opengeni/contracts": "^0.20.0",
+    "@opengeni/config": "^0.7.8",
+    "@opengeni/contracts": "^0.20.1",
     "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",

package/src/sandbox/channel-a.ts

@@ -12,9 +12,10 @@
 // Built on `session.exec(args): Promise<SandboxExecResult>`, which
 // returns RAW {stdout,stderr,exitCode} on the agents-core local/docker sessions
 // (and Modal/the extensions providers expose the equivalent). `execCommand`
-// returns a BANNER-DECORATED string (formatExecResponse) — NEVER used for
-// parsing; only as a last-resort fallback when `exec` is absent, with the banner
-// stripped. `readFile` returns string|Uint8Array (binary-safe). Writes go
+// returns a BANNER-DECORATED string (formatExecResponse). Structured reads use
+// it only with bounded, explicit framing and strip the banner before parsing;
+// raw `exec` remains preferred. `readFile` returns string|Uint8Array
+// (binary-safe). Writes go
 // through `exec` (a base64 heredoc — raw + binary capable, unlike createEditor's
 // apply-patch-only path which cannot do binary, C4), falling back to
 // `createEditor` for text when `exec` is absent.
@@ -212,6 +213,12 @@ const FS_LIST_TRUNCATED_MARKER = "__OPENGENI_FS_LIST_TRUNCATED__";
 // stream. Leave ample framing/translation headroom and emit an explicit marker
 // instead of allowing the SDK to drop the tree's leading parent records.
 const FS_LIST_MAX_OUTPUT_BYTES = 768 * 1024;
+// Modal and the local SDK retain at most 1 MiB of command output and discard
+// the prefix when that limit is crossed. Git's NUL-delimited metadata and
+// unified patches therefore travel as bounded base64 chunks. 512 KiB of raw
+// data expands to ~683 KiB, leaving room for confinement/provider framing.
+const GIT_COMMAND_CHUNK_BYTES = 512 * 1024;
+const GIT_METADATA_MAX_BYTES = 2 * 1024 * 1024;
 const US = String.fromCharCode(0x1f); // \x1f unit sep — git-log field separator
 const RS = String.fromCharCode(0x1e); // \x1e record sep — git-log record separator
 const SELFHOSTED_VIRTUAL_ROOT = "/workspace";
@@ -256,8 +263,9 @@ export class SandboxChannelAService {
   // ════════════════════════════ exec primitive ══════════════════════════════
   // RAW exec — returns {stdout, stderr, exitCode}. Uses session.exec when present
   // (the local/docker sessions return raw output); falls back to execCommand +
-  // a banner strip (last resort; banner-truncation can mangle, so exec is always
-  // preferred). Throws ChannelAUnsupportedError when neither exists.
+  // a banner strip. Callers that parse output must independently bound/frame it
+  // because provider retained-output truncation drops command prefixes. Throws
+  // ChannelAUnsupportedError when neither exists.
   private async run(args: ChannelAExecArgs): Promise<{
     stdout: string;
     stderr: string;
@@ -797,6 +805,141 @@ export class SandboxChannelAService {
 
   // ════════════════════════════ Git (A2, read-only) ═════════════════════════
 
+  /** Measure one Git command without returning its potentially large or
+   * NUL-bearing output through the provider's text transport. */
+  private async measureConfinedCommandBytes(repo: string, command: string): Promise<number> {
+    const measured = await this.runInConfinedDirectory(repo, {
+      cmd: [
+        "set -o pipefail",
+        `{ ${command}; } 2>/dev/null | { bytes=$(wc -c | tr -d ' \\n'); printf '%s' "$bytes"; }`,
+        "producer_status=${PIPESTATUS[0]}",
+        "printf '\\t%s\\n' \"$producer_status\"",
+      ].join("; "),
+      maxOutputTokens: 1_024,
+    });
+    const match = measured.stdout.match(/^(\d+)\t(\d+)\n?$/);
+    if (
+      !match ||
+      (measured.exitCode !== null && measured.exitCode !== 0) ||
+      Number(match[2]) !== 0
+    ) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git data is temporarily unavailable. Retry the operation.",
+      );
+    }
+    const size = Number(match[1]);
+    if (!Number.isSafeInteger(size) || size < 0) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git data is temporarily unavailable. Retry the operation.",
+      );
+    }
+    return size;
+  }
+
+  /** Read an exact prefix of a command's output in chunks that remain below
+   * every supported execCommand retained-output ceiling. The producer is
+   * intentionally rerun per chunk; turn-end capture calls this only after the
+   * durable mutation authority has quiesced the workspace. */
+  private async readConfinedCommandPrefix(
+    repo: string,
+    command: string,
+    byteLength: number,
+  ): Promise<Buffer> {
+    if (byteLength === 0) return Buffer.alloc(0);
+    const chunks: Buffer[] = [];
+    for (let offset = 0; offset < byteLength; offset += GIT_COMMAND_CHUNK_BYTES) {
+      const expected = Math.min(GIT_COMMAND_CHUNK_BYTES, byteLength - offset);
+      const chunk = await this.runInConfinedDirectory(repo, {
+        cmd: [
+          `{ ${command}; } 2>/dev/null`,
+          `tail -c +${offset + 1}`,
+          `head -c ${expected}`,
+          "base64",
+          `tr -d '\\n'`,
+        ].join(" | "),
+        maxOutputTokens: Math.ceil((GIT_COMMAND_CHUNK_BYTES * 4) / 3) + 1_024,
+      });
+      if (chunk.exitCode !== null && chunk.exitCode !== 0) {
+        throw new ChannelAUnavailableError(
+          "Workspace Git data is temporarily unavailable. Retry the operation.",
+        );
+      }
+      const encoded = chunk.stdout.replace(/\s/g, "");
+      const bytes = Buffer.from(encoded, "base64");
+      if (bytes.byteLength !== expected || bytes.toString("base64") !== encoded) {
+        throw new ChannelAUnavailableError(
+          "Workspace Git data is temporarily unavailable. Retry the operation.",
+        );
+      }
+      chunks.push(bytes);
+    }
+    return Buffer.concat(chunks, byteLength);
+  }
+
+  private async readConfinedCommandBytes(
+    repo: string,
+    command: string,
+    maxBytes: number,
+  ): Promise<{ bytes: Buffer; sizeBytes: number; truncated: boolean }> {
+    const sizeBytes = await this.measureConfinedCommandBytes(repo, command);
+    if (sizeBytes > maxBytes) {
+      return { bytes: Buffer.alloc(0), sizeBytes, truncated: true };
+    }
+    return {
+      bytes: await this.readConfinedCommandPrefix(repo, command, sizeBytes),
+      sizeBytes,
+      truncated: false,
+    };
+  }
+
+  /** Read a regular untracked file without routing its body through one large
+   * execCommand response. Native provider reads are binary-safe; providers
+   * without that surface use the same bounded chunk protocol as Git patches. */
+  private async readUntrackedRegularFile(
+    repo: string,
+    target: string,
+    byteLength: number,
+  ): Promise<Buffer> {
+    if (byteLength === 0) return Buffer.alloc(0);
+    const path = repo ? `${repo}/${target}` : target;
+    assertSafeRelPath(path);
+    if (this.session.readFile) {
+      try {
+        const raw = await this.session.readFile({
+          path: this.joinRoot(path),
+          maxBytes: byteLength,
+          ...(this.runAs ? { runAs: this.runAs } : {}),
+        });
+        const bytes = typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw);
+        if (bytes.byteLength !== byteLength) {
+          throw new ChannelAUnavailableError(
+            "Workspace Git data changed during capture. Retry the operation.",
+          );
+        }
+        return bytes;
+      } catch (error) {
+        if (error instanceof ChannelAUnavailableError) throw error;
+        if (isWorkspaceEscapeError(error)) {
+          throw new ChannelAValidationError(`path resolves outside workspace: ${path}`);
+        }
+        if (isDefinitePathNotFoundError(error)) {
+          throw new ChannelANotFoundError(`file not found: ${path}`);
+        }
+        if (!this.session.exec && !this.session.execCommand) {
+          throw new ChannelAUnavailableError(
+            "Workspace Git data is temporarily unavailable. Retry the operation.",
+          );
+        }
+      }
+    }
+    const fileArg = target.startsWith("./") ? target : `./${target}`;
+    return await this.readConfinedCommandPrefix(
+      repo,
+      `file=${shellQuote(fileArg)}; test ! -L "$file" && test -f "$file" || exit 66; cat -- "$file"`,
+      byteLength,
+    );
+  }
+
   async gitStatus(req: GitStatusRequest): Promise<GitStatusResponse> {
     const repo = assertSafeRelPathOrRoot(req.path);
     const inside = await this.runInConfinedDirectory(repo, {
@@ -814,10 +957,17 @@ export class SandboxChannelAService {
         revision: this.revision,
       };
     }
-    const { stdout } = await this.runInConfinedDirectory(repo, {
-      cmd: "git status --porcelain=v2 --branch -z",
-    });
-    return { ...parsePorcelainV2(stdout), revision: this.revision };
+    const status = await this.readConfinedCommandBytes(
+      repo,
+      "git status --porcelain=v2 --branch -z",
+      GIT_METADATA_MAX_BYTES,
+    );
+    if (status.truncated) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path.",
+      );
+    }
+    return { ...parsePorcelainV2(status.bytes.toString("utf8")), revision: this.revision };
   }
 
   async gitDiff(req: GitDiffRequest): Promise<GitDiffResponse> {
@@ -826,16 +976,34 @@ export class SandboxChannelAService {
     // Selector precedence: refs > staged > worktree.
     let range = "";
     if (req.fromRef && req.toRef) range = `${shellQuote(req.fromRef)} ${shellQuote(req.toRef)}`;
-    else if (req.fromRef) range = `${shellQuote(req.fromRef)}`;
-    else if (req.staged) range = "--cached";
+    else if (req.fromRef) {
+      if (req.fromRef === "HEAD") {
+        const head = await this.runInConfinedDirectory(repo, {
+          cmd: "if git rev-parse --verify --quiet HEAD >/dev/null; then printf 'present'; else printf 'unborn'; fi",
+        });
+        // An unborn repository has no HEAD tree. `--cached` compares its index
+        // to Git's empty tree and preserves staged additions; every other
+        // invalid ref remains a real read failure in the bounded command path.
+        range = head.stdout.trim() === "present" ? shellQuote(req.fromRef) : "--cached";
+      } else {
+        range = shellQuote(req.fromRef);
+      }
+    } else if (req.staged) range = "--cached";
     const pathspec = req.pathspec.length ? ` -- ${req.pathspec.map(shellQuote).join(" ")}` : "";
 
     // Pass 1: numstat (stats + binary detection). -z gives NUL-separated fields;
     // a rename emits old\0new for that record's path fields.
-    const numstat = await this.runInConfinedDirectory(repo, {
-      cmd: `git -c core.quotePath=false diff --no-color -z --numstat ${range}${pathspec}`.trim(),
-    });
-    const stats = parseNumstatZ(numstat.stdout);
+    const numstat = await this.readConfinedCommandBytes(
+      repo,
+      `git -c core.quotePath=false diff --no-color -z --numstat ${range}${pathspec}`.trim(),
+      GIT_METADATA_MAX_BYTES,
+    );
+    if (numstat.truncated) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path.",
+      );
+    }
+    const stats = parseNumstatZ(numstat.bytes.toString("utf8"));
 
     const files: GitFileDiff[] = [];
     for (const stat of stats) {
@@ -856,13 +1024,14 @@ export class SandboxChannelAService {
         continue;
       }
       // Pass 2: the per-file unified patch -> hunks.
-      const patch = await this.runInConfinedDirectory(repo, {
-        cmd: `git -c core.quotePath=false diff --no-color -U${ctx} ${range} -- ${shellQuote(target)}`.trim(),
-      });
-      const oversized = Buffer.byteLength(patch.stdout, "utf8") > req.maxBytesPerFile;
-      const parsed = oversized
+      const patch = await this.readConfinedCommandBytes(
+        repo,
+        `git -c core.quotePath=false diff --no-color -U${ctx} ${range} -- ${shellQuote(target)}`.trim(),
+        req.maxBytesPerFile,
+      );
+      const parsed = patch.truncated
         ? { hunks: [] as GitDiffHunk[], status: "modified" as GitFileStatusCode }
-        : parseUnifiedPatch(patch.stdout);
+        : parseUnifiedPatch(patch.bytes.toString("utf8"));
       files.push({
         path: target,
         oldPath: stat.oldPath,
@@ -872,7 +1041,7 @@ export class SandboxChannelAService {
         additions: stat.additions,
         deletions: stat.deletions,
         hunks: parsed.hunks,
-        truncated: oversized,
+        truncated: patch.truncated,
       });
     }
 
@@ -882,32 +1051,41 @@ export class SandboxChannelAService {
       // Ask Git for the exact NUL-delimited set, then synthesize an added-file
       // hunk from a bounded read. The explicit request flag keeps commit/staged
       // consumers on native Git semantics.
-      const untracked = await this.runInConfinedDirectory(repo, {
-        cmd: `git -c core.quotePath=false ls-files --others --exclude-standard -z${pathspec}`,
-      });
-      for (const target of untracked.stdout.split(NUL).filter(Boolean)) {
+      const untracked = await this.readConfinedCommandBytes(
+        repo,
+        `git -c core.quotePath=false ls-files --others --exclude-standard -z${pathspec}`,
+        GIT_METADATA_MAX_BYTES,
+      );
+      if (untracked.truncated) {
+        throw new ChannelAUnavailableError(
+          "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path.",
+        );
+      }
+      for (const target of untracked.bytes.toString("utf8").split(NUL).filter(Boolean)) {
         const fileArg = target.startsWith("./") ? target : `./${target}`;
         const read = await this.runInConfinedDirectory(repo, {
           cmd: [
             `file=${shellQuote(fileArg)}`,
-            'if [ -L "$file" ]; then printf "L\\n"; readlink -z -- "$file" | base64 | tr -d "\\n"; exit; fi',
+            'if [ -L "$file" ]; then printf "L\\t"; readlink -z -- "$file" | base64 | tr -d "\\n"; exit; fi',
             'size=$(wc -c < "$file") || exit 66',
             'line_count=$(wc -l < "$file") || exit 66',
             'if [ "$size" -gt 0 ]; then last_byte=$(tail -c 1 "$file" | od -An -tu1 | tr -d " \\n"); if [ "$last_byte" != "10" ]; then line_count=$((line_count + 1)); fi; fi',
-            'printf "F\\t%s\\t%s\\n" "$size" "$line_count"',
-            `head -c ${req.maxBytesPerFile + 1} "$file" | base64 | tr -d "\\n"`,
+            'printf "F\\t%s\\t%s" "$size" "$line_count"',
           ].join("; "),
         });
-        if (read.exitCode !== null && read.exitCode !== 0) continue;
+        if (read.exitCode !== null && read.exitCode !== 0) {
+          throw new ChannelAUnavailableError(
+            "Workspace Git data is temporarily unavailable. Retry the operation.",
+          );
+        }
 
-        const lineBreak = read.stdout.indexOf("\n");
-        if (lineBreak < 0) continue;
-        const header = read.stdout.slice(0, lineBreak);
-        const encoded = read.stdout.slice(lineBreak + 1).replace(/\s/g, "");
-        let sampled = Buffer.from(encoded, "base64");
+        const [kind, first, second] = read.stdout.split("\t");
+        let sampled: Buffer = Buffer.alloc(0);
         let sizeBytes: number;
         let lineCount: number;
-        if (header === "L") {
+        if (kind === "L") {
+          const encoded = (first ?? "").replace(/\s/g, "");
+          sampled = Buffer.from(encoded, "base64");
           // GNU readlink -z preserves every byte (including trailing newlines)
           // and adds one NUL framing byte. The diff shows the link destination
           // itself, matching Git's symlink-blob semantics, never target content.
@@ -916,10 +1094,9 @@ export class SandboxChannelAService {
           sizeBytes = sampled.length;
           lineCount = addedLines(sampled).length;
         } else {
-          const [kind, sizeRaw, lineCountRaw] = header.split("\t");
           if (kind !== "F") continue;
-          const parsedSize = safeInt(sizeRaw);
-          const parsedLineCount = safeInt(lineCountRaw);
+          const parsedSize = safeInt(first);
+          const parsedLineCount = safeInt(second);
           if (
             parsedSize === null ||
             parsedSize < 0 ||
@@ -930,6 +1107,12 @@ export class SandboxChannelAService {
           }
           sizeBytes = parsedSize;
           lineCount = parsedLineCount;
+          const truncated = sizeBytes > req.maxBytesPerFile;
+          const sampleSize = Math.min(sizeBytes, 8_192);
+          sampled = await this.readUntrackedRegularFile(repo, target, sampleSize);
+          if (!sniffBinary(sampled) && !truncated && sampleSize < sizeBytes) {
+            sampled = await this.readUntrackedRegularFile(repo, target, sizeBytes);
+          }
         }
         const truncated = sizeBytes > req.maxBytesPerFile || sampled.length > req.maxBytesPerFile;
         const bytes = truncated ? sampled.subarray(0, req.maxBytesPerFile) : sampled;

package/src/sandbox/index.ts

@@ -536,14 +536,14 @@ function withDockerNetwork(client: SandboxClient, network: string | undefined):
 }
 
 async function connectDockerNetwork(network: string, containerId: string): Promise<void> {
-  const result = Bun.spawnSync(["docker", "network", "connect", network, containerId], {
-    stdout: "pipe",
-    stderr: "pipe",
+  const { spawnSync } = await import("node:child_process");
+  const result = spawnSync("docker", ["network", "connect", network, containerId], {
+    encoding: "utf8",
   });
-  if (result.exitCode === 0) {
+  if (result.status === 0) {
     return;
   }
-  const stderr = new TextDecoder().decode(result.stderr);
+  const stderr = result.stderr ?? result.error?.message ?? "";
   if (stderr.includes("already exists")) {
     return;
   }