@poolzin/pool-bot 2026.3.27 → 2026.3.28

package/dist/agents/sandbox/config.js

@@ -1,133 +0,0 @@
-import { resolveAgentConfig } from "../agent-scope.js";
-import { DEFAULT_SANDBOX_BROWSER_AUTOSTART_TIMEOUT_MS, DEFAULT_SANDBOX_BROWSER_CDP_PORT, DEFAULT_SANDBOX_BROWSER_IMAGE, DEFAULT_SANDBOX_BROWSER_NETWORK, DEFAULT_SANDBOX_BROWSER_NOVNC_PORT, DEFAULT_SANDBOX_BROWSER_PREFIX, DEFAULT_SANDBOX_BROWSER_VNC_PORT, DEFAULT_SANDBOX_CONTAINER_PREFIX, DEFAULT_SANDBOX_IDLE_HOURS, DEFAULT_SANDBOX_IMAGE, DEFAULT_SANDBOX_MAX_AGE_DAYS, DEFAULT_SANDBOX_WORKDIR, DEFAULT_SANDBOX_WORKSPACE_ROOT, } from "./constants.js";
-import { resolveSandboxToolPolicyForAgent } from "./tool-policy.js";
-export function resolveSandboxBrowserDockerCreateConfig(params) {
-    const browserNetwork = params.browser.network.trim();
-    const base = {
-        ...params.docker,
-        // Browser container needs network access for Chrome, downloads, etc.
-        network: browserNetwork || DEFAULT_SANDBOX_BROWSER_NETWORK,
-        // For hashing and consistency, treat browser image as the docker image even though we
-        // pass it separately as the final `docker create` argument.
-        image: params.browser.image,
-    };
-    return params.browser.binds !== undefined ? { ...base, binds: params.browser.binds } : base;
-}
-export function resolveSandboxScope(params) {
-    if (params.scope) {
-        return params.scope;
-    }
-    if (typeof params.perSession === "boolean") {
-        return params.perSession ? "session" : "shared";
-    }
-    return "agent";
-}
-export function resolveSandboxDockerConfig(params) {
-    const agentDocker = params.scope === "shared" ? undefined : params.agentDocker;
-    const globalDocker = params.globalDocker;
-    const env = agentDocker?.env
-        ? { ...(globalDocker?.env ?? { LANG: "C.UTF-8" }), ...agentDocker.env }
-        : (globalDocker?.env ?? { LANG: "C.UTF-8" });
-    const ulimits = agentDocker?.ulimits
-        ? { ...globalDocker?.ulimits, ...agentDocker.ulimits }
-        : globalDocker?.ulimits;
-    const binds = [...(globalDocker?.binds ?? []), ...(agentDocker?.binds ?? [])];
-    return {
-        image: agentDocker?.image ?? globalDocker?.image ?? DEFAULT_SANDBOX_IMAGE,
-        containerPrefix: agentDocker?.containerPrefix ??
-            globalDocker?.containerPrefix ??
-            DEFAULT_SANDBOX_CONTAINER_PREFIX,
-        workdir: agentDocker?.workdir ?? globalDocker?.workdir ?? DEFAULT_SANDBOX_WORKDIR,
-        readOnlyRoot: agentDocker?.readOnlyRoot ?? globalDocker?.readOnlyRoot ?? true,
-        tmpfs: agentDocker?.tmpfs ?? globalDocker?.tmpfs ?? ["/tmp", "/var/tmp", "/run"],
-        network: agentDocker?.network ?? globalDocker?.network ?? "none",
-        user: agentDocker?.user ?? globalDocker?.user,
-        capDrop: agentDocker?.capDrop ?? globalDocker?.capDrop ?? ["ALL"],
-        env,
-        setupCommand: agentDocker?.setupCommand ?? globalDocker?.setupCommand,
-        pidsLimit: agentDocker?.pidsLimit ?? globalDocker?.pidsLimit,
-        memory: agentDocker?.memory ?? globalDocker?.memory,
-        memorySwap: agentDocker?.memorySwap ?? globalDocker?.memorySwap,
-        cpus: agentDocker?.cpus ?? globalDocker?.cpus,
-        ulimits,
-        seccompProfile: agentDocker?.seccompProfile ?? globalDocker?.seccompProfile,
-        apparmorProfile: agentDocker?.apparmorProfile ?? globalDocker?.apparmorProfile,
-        dns: agentDocker?.dns ?? globalDocker?.dns,
-        extraHosts: agentDocker?.extraHosts ?? globalDocker?.extraHosts,
-        binds: binds.length ? binds : undefined,
-    };
-}
-export function resolveSandboxBrowserConfig(params) {
-    const agentBrowser = params.scope === "shared" ? undefined : params.agentBrowser;
-    const globalBrowser = params.globalBrowser;
-    const binds = [...(globalBrowser?.binds ?? []), ...(agentBrowser?.binds ?? [])];
-    // Treat `binds: []` as an explicit override, so it can disable `docker.binds` for the browser container.
-    const bindsConfigured = globalBrowser?.binds !== undefined || agentBrowser?.binds !== undefined;
-    return {
-        enabled: agentBrowser?.enabled ?? globalBrowser?.enabled ?? false,
-        image: agentBrowser?.image ?? globalBrowser?.image ?? DEFAULT_SANDBOX_BROWSER_IMAGE,
-        containerPrefix: agentBrowser?.containerPrefix ??
-            globalBrowser?.containerPrefix ??
-            DEFAULT_SANDBOX_BROWSER_PREFIX,
-        network: agentBrowser?.network ?? globalBrowser?.network ?? DEFAULT_SANDBOX_BROWSER_NETWORK,
-        cdpPort: agentBrowser?.cdpPort ?? globalBrowser?.cdpPort ?? DEFAULT_SANDBOX_BROWSER_CDP_PORT,
-        cdpSourceRange: agentBrowser?.cdpSourceRange ?? globalBrowser?.cdpSourceRange,
-        vncPort: agentBrowser?.vncPort ?? globalBrowser?.vncPort ?? DEFAULT_SANDBOX_BROWSER_VNC_PORT,
-        noVncPort: agentBrowser?.noVncPort ?? globalBrowser?.noVncPort ?? DEFAULT_SANDBOX_BROWSER_NOVNC_PORT,
-        headless: agentBrowser?.headless ?? globalBrowser?.headless ?? false,
-        enableNoVnc: agentBrowser?.enableNoVnc ?? globalBrowser?.enableNoVnc ?? true,
-        allowHostControl: agentBrowser?.allowHostControl ?? globalBrowser?.allowHostControl ?? false,
-        autoStart: agentBrowser?.autoStart ?? globalBrowser?.autoStart ?? true,
-        autoStartTimeoutMs: agentBrowser?.autoStartTimeoutMs ??
-            globalBrowser?.autoStartTimeoutMs ??
-            DEFAULT_SANDBOX_BROWSER_AUTOSTART_TIMEOUT_MS,
-        binds: bindsConfigured ? binds : undefined,
-    };
-}
-export function resolveSandboxPruneConfig(params) {
-    const agentPrune = params.scope === "shared" ? undefined : params.agentPrune;
-    const globalPrune = params.globalPrune;
-    return {
-        idleHours: agentPrune?.idleHours ?? globalPrune?.idleHours ?? DEFAULT_SANDBOX_IDLE_HOURS,
-        maxAgeDays: agentPrune?.maxAgeDays ?? globalPrune?.maxAgeDays ?? DEFAULT_SANDBOX_MAX_AGE_DAYS,
-    };
-}
-export function resolveSandboxConfigForAgent(cfg, agentId) {
-    const agent = cfg?.agents?.defaults?.sandbox;
-    // Agent-specific sandbox config overrides global
-    let agentSandbox;
-    const agentConfig = cfg && agentId ? resolveAgentConfig(cfg, agentId) : undefined;
-    if (agentConfig?.sandbox) {
-        agentSandbox = agentConfig.sandbox;
-    }
-    const scope = resolveSandboxScope({
-        scope: agentSandbox?.scope ?? agent?.scope,
-        perSession: agentSandbox?.perSession ?? agent?.perSession,
-    });
-    const toolPolicy = resolveSandboxToolPolicyForAgent(cfg, agentId);
-    return {
-        mode: agentSandbox?.mode ?? agent?.mode ?? "off",
-        scope,
-        workspaceAccess: agentSandbox?.workspaceAccess ?? agent?.workspaceAccess ?? "none",
-        workspaceRoot: agentSandbox?.workspaceRoot ?? agent?.workspaceRoot ?? DEFAULT_SANDBOX_WORKSPACE_ROOT,
-        docker: resolveSandboxDockerConfig({
-            scope,
-            globalDocker: agent?.docker,
-            agentDocker: agentSandbox?.docker,
-        }),
-        browser: resolveSandboxBrowserConfig({
-            scope,
-            globalBrowser: agent?.browser,
-            agentBrowser: agentSandbox?.browser,
-        }),
-        tools: {
-            allow: toolPolicy.allow,
-            deny: toolPolicy.deny,
-        },
-        prune: resolveSandboxPruneConfig({
-            scope,
-            globalPrune: agent?.prune,
-            agentPrune: agentSandbox?.prune,
-        }),
-    };
-}

package/dist/agents/sandbox/constants.js

@@ -1,47 +0,0 @@
-import os from "node:os";
-import path from "node:path";
-import { CHANNEL_IDS } from "../../channels/registry.js";
-import { STATE_DIR } from "../../config/config.js";
-export const DEFAULT_SANDBOX_WORKSPACE_ROOT = path.join(os.homedir(), ".poolbot", "sandboxes");
-export const DEFAULT_SANDBOX_IMAGE = "poolbot-sandbox:bookworm-slim";
-export const DEFAULT_SANDBOX_CONTAINER_PREFIX = "poolbot-sbx-";
-export const DEFAULT_SANDBOX_WORKDIR = "/workspace";
-export const DEFAULT_SANDBOX_IDLE_HOURS = 24;
-export const DEFAULT_SANDBOX_MAX_AGE_DAYS = 7;
-export const DEFAULT_TOOL_ALLOW = [
-    "exec",
-    "process",
-    "read",
-    "write",
-    "edit",
-    "apply_patch",
-    "image",
-    "sessions_list",
-    "sessions_history",
-    "sessions_send",
-    "sessions_spawn",
-    "session_status",
-];
-// Provider docking: keep sandbox policy aligned with provider tool names.
-export const DEFAULT_TOOL_DENY = [
-    "browser",
-    "canvas",
-    "nodes",
-    "cron",
-    "gateway",
-    ...CHANNEL_IDS,
-];
-export const DEFAULT_SANDBOX_BROWSER_IMAGE = "poolbot-sandbox-browser:bookworm-slim";
-export const DEFAULT_SANDBOX_COMMON_IMAGE = "poolbot-sandbox-common:bookworm-slim";
-export const DEFAULT_SANDBOX_BROWSER_PREFIX = "poolbot-sbx-browser-";
-export const DEFAULT_SANDBOX_BROWSER_CDP_PORT = 9222;
-export const DEFAULT_SANDBOX_BROWSER_VNC_PORT = 5900;
-export const DEFAULT_SANDBOX_BROWSER_NOVNC_PORT = 6080;
-export const DEFAULT_SANDBOX_BROWSER_AUTOSTART_TIMEOUT_MS = 12_000;
-export const SANDBOX_AGENT_WORKSPACE_MOUNT = "/agent";
-const resolvedSandboxStateDir = STATE_DIR ?? path.join(os.homedir(), ".poolbot");
-export const SANDBOX_STATE_DIR = path.join(resolvedSandboxStateDir, "sandbox");
-export const SANDBOX_REGISTRY_PATH = path.join(SANDBOX_STATE_DIR, "containers.json");
-export const SANDBOX_BROWSER_REGISTRY_PATH = path.join(SANDBOX_STATE_DIR, "browsers.json");
-export const SANDBOX_BROWSER_SECURITY_HASH_EPOCH = "2026-02-21-novnc-auth-default";
-export const DEFAULT_SANDBOX_BROWSER_NETWORK = "poolbot-sandbox-browser";

package/dist/agents/sandbox/context.js

@@ -1,117 +0,0 @@
-import fs from "node:fs/promises";
-import { defaultRuntime } from "../../runtime.js";
-import { resolveUserPath } from "../../utils.js";
-import { DEFAULT_BROWSER_EVALUATE_ENABLED } from "../../browser/constants.js";
-import { syncSkillsToWorkspace } from "../skills.js";
-import { DEFAULT_AGENT_WORKSPACE_DIR } from "../workspace.js";
-import { ensureSandboxBrowser } from "./browser.js";
-import { resolveSandboxConfigForAgent } from "./config.js";
-import { ensureSandboxContainer } from "./docker.js";
-import { maybePruneSandboxes } from "./prune.js";
-import { resolveSandboxRuntimeStatus } from "./runtime-status.js";
-import { resolveSandboxScopeKey, resolveSandboxWorkspaceDir } from "./shared.js";
-import { ensureSandboxWorkspace } from "./workspace.js";
-export async function resolveSandboxContext(params) {
-    const rawSessionKey = params.sessionKey?.trim();
-    if (!rawSessionKey)
-        return null;
-    const runtime = resolveSandboxRuntimeStatus({
-        cfg: params.config,
-        sessionKey: rawSessionKey,
-    });
-    if (!runtime.sandboxed)
-        return null;
-    const cfg = resolveSandboxConfigForAgent(params.config, runtime.agentId);
-    await maybePruneSandboxes(cfg);
-    const agentWorkspaceDir = resolveUserPath(params.workspaceDir?.trim() || DEFAULT_AGENT_WORKSPACE_DIR);
-    const workspaceRoot = resolveUserPath(cfg.workspaceRoot);
-    const scopeKey = resolveSandboxScopeKey(cfg.scope, rawSessionKey);
-    const sandboxWorkspaceDir = cfg.scope === "shared" ? workspaceRoot : resolveSandboxWorkspaceDir(workspaceRoot, scopeKey);
-    const workspaceDir = cfg.workspaceAccess === "rw" ? agentWorkspaceDir : sandboxWorkspaceDir;
-    if (workspaceDir === sandboxWorkspaceDir) {
-        await ensureSandboxWorkspace(sandboxWorkspaceDir, agentWorkspaceDir, params.config?.agents?.defaults?.skipBootstrap);
-        if (cfg.workspaceAccess !== "rw") {
-            try {
-                await syncSkillsToWorkspace({
-                    sourceWorkspaceDir: agentWorkspaceDir,
-                    targetWorkspaceDir: sandboxWorkspaceDir,
-                    config: params.config,
-                });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : JSON.stringify(error);
-                defaultRuntime.error?.(`Sandbox skill sync failed: ${message}`);
-            }
-        }
-    }
-    else {
-        await fs.mkdir(workspaceDir, { recursive: true });
-    }
-    const containerName = await ensureSandboxContainer({
-        sessionKey: rawSessionKey,
-        workspaceDir,
-        agentWorkspaceDir,
-        cfg,
-    });
-    const evaluateEnabled = params.config?.browser?.evaluateEnabled ?? DEFAULT_BROWSER_EVALUATE_ENABLED;
-    const browser = await ensureSandboxBrowser({
-        scopeKey,
-        workspaceDir,
-        agentWorkspaceDir,
-        cfg,
-        evaluateEnabled,
-    });
-    return {
-        enabled: true,
-        sessionKey: rawSessionKey,
-        workspaceDir,
-        agentWorkspaceDir,
-        workspaceAccess: cfg.workspaceAccess,
-        containerName,
-        containerWorkdir: cfg.docker.workdir,
-        docker: cfg.docker,
-        tools: cfg.tools,
-        browserAllowHostControl: cfg.browser.allowHostControl,
-        browser: browser ?? undefined,
-    };
-}
-export async function ensureSandboxWorkspaceForSession(params) {
-    const rawSessionKey = params.sessionKey?.trim();
-    if (!rawSessionKey)
-        return null;
-    const runtime = resolveSandboxRuntimeStatus({
-        cfg: params.config,
-        sessionKey: rawSessionKey,
-    });
-    if (!runtime.sandboxed)
-        return null;
-    const cfg = resolveSandboxConfigForAgent(params.config, runtime.agentId);
-    const agentWorkspaceDir = resolveUserPath(params.workspaceDir?.trim() || DEFAULT_AGENT_WORKSPACE_DIR);
-    const workspaceRoot = resolveUserPath(cfg.workspaceRoot);
-    const scopeKey = resolveSandboxScopeKey(cfg.scope, rawSessionKey);
-    const sandboxWorkspaceDir = cfg.scope === "shared" ? workspaceRoot : resolveSandboxWorkspaceDir(workspaceRoot, scopeKey);
-    const workspaceDir = cfg.workspaceAccess === "rw" ? agentWorkspaceDir : sandboxWorkspaceDir;
-    if (workspaceDir === sandboxWorkspaceDir) {
-        await ensureSandboxWorkspace(sandboxWorkspaceDir, agentWorkspaceDir, params.config?.agents?.defaults?.skipBootstrap);
-        if (cfg.workspaceAccess !== "rw") {
-            try {
-                await syncSkillsToWorkspace({
-                    sourceWorkspaceDir: agentWorkspaceDir,
-                    targetWorkspaceDir: sandboxWorkspaceDir,
-                    config: params.config,
-                });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : JSON.stringify(error);
-                defaultRuntime.error?.(`Sandbox skill sync failed: ${message}`);
-            }
-        }
-    }
-    else {
-        await fs.mkdir(workspaceDir, { recursive: true });
-    }
-    return {
-        workspaceDir,
-        containerWorkdir: cfg.docker.workdir,
-    };
-}

package/dist/agents/sandbox/docker.js

@@ -1,384 +0,0 @@
-import { spawn } from "node:child_process";
-import { createSubsystemLogger } from "../../logging/subsystem.js";
-import { sanitizeEnvVars } from "./sanitize-env-vars.js";
-function createAbortError() {
-    const err = new Error("Aborted");
-    err.name = "AbortError";
-    return err;
-}
-export function execDockerRaw(args, opts) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("docker", args, {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        const stdoutChunks = [];
-        const stderrChunks = [];
-        let aborted = false;
-        const signal = opts?.signal;
-        const handleAbort = () => {
-            if (aborted) {
-                return;
-            }
-            aborted = true;
-            child.kill("SIGTERM");
-        };
-        if (signal) {
-            if (signal.aborted) {
-                handleAbort();
-            }
-            else {
-                signal.addEventListener("abort", handleAbort);
-            }
-        }
-        child.stdout?.on("data", (chunk) => {
-            stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-        });
-        child.stderr?.on("data", (chunk) => {
-            stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-        });
-        child.on("error", (error) => {
-            if (signal) {
-                signal.removeEventListener("abort", handleAbort);
-            }
-            reject(error);
-        });
-        child.on("close", (code) => {
-            if (signal) {
-                signal.removeEventListener("abort", handleAbort);
-            }
-            const stdout = Buffer.concat(stdoutChunks);
-            const stderr = Buffer.concat(stderrChunks);
-            if (aborted || signal?.aborted) {
-                reject(createAbortError());
-                return;
-            }
-            const exitCode = code ?? 0;
-            if (exitCode !== 0 && !opts?.allowFailure) {
-                const message = stderr.length > 0 ? stderr.toString("utf8").trim() : "";
-                const error = Object.assign(new Error(message || `docker ${args.join(" ")} failed`), {
-                    code: exitCode,
-                    stdout,
-                    stderr,
-                });
-                reject(error);
-                return;
-            }
-            resolve({ stdout, stderr, code: exitCode });
-        });
-        const stdin = child.stdin;
-        if (stdin) {
-            if (opts?.input !== undefined) {
-                stdin.end(opts.input);
-            }
-            else {
-                stdin.end();
-            }
-        }
-    });
-}
-import { formatCliCommand } from "../../cli/command-format.js";
-import { defaultRuntime } from "../../runtime.js";
-import { computeSandboxConfigHash } from "./config-hash.js";
-import { DEFAULT_SANDBOX_IMAGE, SANDBOX_AGENT_WORKSPACE_MOUNT } from "./constants.js";
-import { readRegistry, updateRegistry } from "./registry.js";
-import { resolveSandboxAgentId, resolveSandboxScopeKey, slugifySessionKey } from "./shared.js";
-import { validateSandboxSecurity } from "./validate-sandbox-security.js";
-const log = createSubsystemLogger("docker");
-const HOT_CONTAINER_WINDOW_MS = 5 * 60 * 1000;
-export async function execDocker(args, opts) {
-    const result = await execDockerRaw(args, opts);
-    return {
-        stdout: result.stdout.toString("utf8"),
-        stderr: result.stderr.toString("utf8"),
-        code: result.code,
-    };
-}
-export async function readDockerContainerLabel(containerName, label) {
-    const result = await execDocker(["inspect", "-f", `{{ index .Config.Labels "${label}" }}`, containerName], { allowFailure: true });
-    if (result.code !== 0) {
-        return null;
-    }
-    const raw = result.stdout.trim();
-    if (!raw || raw === "<no value>") {
-        return null;
-    }
-    return raw;
-}
-export async function readDockerContainerEnvVar(containerName, envVar) {
-    const result = await execDocker(["inspect", "-f", "{{range .Config.Env}}{{println .}}{{end}}", containerName], { allowFailure: true });
-    if (result.code !== 0) {
-        return null;
-    }
-    for (const line of result.stdout.split(/\r?\n/)) {
-        if (line.startsWith(`${envVar}=`)) {
-            return line.slice(envVar.length + 1);
-        }
-    }
-    return null;
-}
-export async function readDockerPort(containerName, port) {
-    const result = await execDocker(["port", containerName, `${port}/tcp`], {
-        allowFailure: true,
-    });
-    if (result.code !== 0) {
-        return null;
-    }
-    const line = result.stdout.trim().split(/\r?\n/)[0] ?? "";
-    const match = line.match(/:(\d+)\s*$/);
-    if (!match) {
-        return null;
-    }
-    const mapped = Number.parseInt(match[1] ?? "", 10);
-    return Number.isFinite(mapped) ? mapped : null;
-}
-async function dockerImageExists(image) {
-    const result = await execDocker(["image", "inspect", image], {
-        allowFailure: true,
-    });
-    if (result.code === 0) {
-        return true;
-    }
-    const stderr = result.stderr.trim();
-    if (stderr.includes("No such image")) {
-        return false;
-    }
-    throw new Error(`Failed to inspect sandbox image: ${stderr}`);
-}
-export async function ensureDockerImage(image) {
-    const exists = await dockerImageExists(image);
-    if (exists) {
-        return;
-    }
-    if (image === DEFAULT_SANDBOX_IMAGE) {
-        await execDocker(["pull", "debian:bookworm-slim"]);
-        await execDocker(["tag", "debian:bookworm-slim", DEFAULT_SANDBOX_IMAGE]);
-        return;
-    }
-    throw new Error(`Sandbox image not found: ${image}. Build or pull it first.`);
-}
-export async function dockerContainerState(name) {
-    const result = await execDocker(["inspect", "-f", "{{.State.Running}}", name], {
-        allowFailure: true,
-    });
-    if (result.code !== 0) {
-        return { exists: false, running: false };
-    }
-    return { exists: true, running: result.stdout.trim() === "true" };
-}
-function normalizeDockerLimit(value) {
-    if (value === undefined || value === null) {
-        return undefined;
-    }
-    if (typeof value === "number") {
-        return Number.isFinite(value) ? String(value) : undefined;
-    }
-    const trimmed = value.trim();
-    return trimmed ? trimmed : undefined;
-}
-function formatUlimitValue(name, value) {
-    if (!name.trim()) {
-        return null;
-    }
-    if (typeof value === "number" || typeof value === "string") {
-        const raw = String(value).trim();
-        return raw ? `${name}=${raw}` : null;
-    }
-    const soft = typeof value.soft === "number" ? Math.max(0, value.soft) : undefined;
-    const hard = typeof value.hard === "number" ? Math.max(0, value.hard) : undefined;
-    if (soft === undefined && hard === undefined) {
-        return null;
-    }
-    if (soft === undefined) {
-        return `${name}=${hard}`;
-    }
-    if (hard === undefined) {
-        return `${name}=${soft}`;
-    }
-    return `${name}=${soft}:${hard}`;
-}
-export function buildSandboxCreateArgs(params) {
-    // Runtime security validation: blocks dangerous bind mounts, network modes, and profiles.
-    validateSandboxSecurity(params.cfg);
-    const createdAtMs = params.createdAtMs ?? Date.now();
-    const args = ["create", "--name", params.name];
-    args.push("--label", "poolbot.sandbox=1");
-    args.push("--label", `poolbot.sessionKey=${params.scopeKey}`);
-    args.push("--label", `poolbot.createdAtMs=${createdAtMs}`);
-    if (params.configHash) {
-        args.push("--label", `poolbot.configHash=${params.configHash}`);
-    }
-    for (const [key, value] of Object.entries(params.labels ?? {})) {
-        if (key && value) {
-            args.push("--label", `${key}=${value}`);
-        }
-    }
-    if (params.cfg.readOnlyRoot) {
-        args.push("--read-only");
-    }
-    for (const entry of params.cfg.tmpfs) {
-        args.push("--tmpfs", entry);
-    }
-    if (params.cfg.network) {
-        args.push("--network", params.cfg.network);
-    }
-    if (params.cfg.user) {
-        args.push("--user", params.cfg.user);
-    }
-    const envSanitization = sanitizeEnvVars(params.cfg.env ?? {});
-    if (envSanitization.blocked.length > 0) {
-        log.warn(`Blocked sensitive environment variables: ${envSanitization.blocked.join(", ")}`);
-    }
-    if (envSanitization.warnings.length > 0) {
-        log.warn(`Suspicious environment variables: ${envSanitization.warnings.join(", ")}`);
-    }
-    for (const [key, value] of Object.entries(envSanitization.allowed)) {
-        args.push("--env", `${key}=${value}`);
-    }
-    for (const cap of params.cfg.capDrop) {
-        args.push("--cap-drop", cap);
-    }
-    args.push("--security-opt", "no-new-privileges");
-    if (params.cfg.seccompProfile) {
-        args.push("--security-opt", `seccomp=${params.cfg.seccompProfile}`);
-    }
-    if (params.cfg.apparmorProfile) {
-        args.push("--security-opt", `apparmor=${params.cfg.apparmorProfile}`);
-    }
-    for (const entry of params.cfg.dns ?? []) {
-        if (entry.trim()) {
-            args.push("--dns", entry);
-        }
-    }
-    for (const entry of params.cfg.extraHosts ?? []) {
-        if (entry.trim()) {
-            args.push("--add-host", entry);
-        }
-    }
-    if (typeof params.cfg.pidsLimit === "number" && params.cfg.pidsLimit > 0) {
-        args.push("--pids-limit", String(params.cfg.pidsLimit));
-    }
-    const memory = normalizeDockerLimit(params.cfg.memory);
-    if (memory) {
-        args.push("--memory", memory);
-    }
-    const memorySwap = normalizeDockerLimit(params.cfg.memorySwap);
-    if (memorySwap) {
-        args.push("--memory-swap", memorySwap);
-    }
-    if (typeof params.cfg.cpus === "number" && params.cfg.cpus > 0) {
-        args.push("--cpus", String(params.cfg.cpus));
-    }
-    for (const [name, value] of Object.entries(params.cfg.ulimits ?? {})) {
-        const formatted = formatUlimitValue(name, value);
-        if (formatted) {
-            args.push("--ulimit", formatted);
-        }
-    }
-    if (params.cfg.binds?.length) {
-        for (const bind of params.cfg.binds) {
-            args.push("-v", bind);
-        }
-    }
-    return args;
-}
-async function createSandboxContainer(params) {
-    const { name, cfg, workspaceDir, scopeKey } = params;
-    await ensureDockerImage(cfg.image);
-    const args = buildSandboxCreateArgs({
-        name,
-        cfg,
-        scopeKey,
-        configHash: params.configHash,
-    });
-    args.push("--workdir", cfg.workdir);
-    const mainMountSuffix = params.workspaceAccess === "ro" && workspaceDir === params.agentWorkspaceDir ? ":ro" : "";
-    args.push("-v", `${workspaceDir}:${cfg.workdir}${mainMountSuffix}`);
-    if (params.workspaceAccess !== "none" && workspaceDir !== params.agentWorkspaceDir) {
-        const agentMountSuffix = params.workspaceAccess === "ro" ? ":ro" : "";
-        args.push("-v", `${params.agentWorkspaceDir}:${SANDBOX_AGENT_WORKSPACE_MOUNT}${agentMountSuffix}`);
-    }
-    args.push(cfg.image, "sleep", "infinity");
-    await execDocker(args);
-    await execDocker(["start", name]);
-    if (cfg.setupCommand?.trim()) {
-        await execDocker(["exec", "-i", name, "sh", "-lc", cfg.setupCommand]);
-    }
-}
-async function readContainerConfigHash(containerName) {
-    return await readDockerContainerLabel(containerName, "poolbot.configHash");
-}
-function formatSandboxRecreateHint(params) {
-    if (params.scope === "session") {
-        return formatCliCommand(`poolbot sandbox recreate --session ${params.sessionKey}`);
-    }
-    if (params.scope === "agent") {
-        const agentId = resolveSandboxAgentId(params.sessionKey) ?? "main";
-        return formatCliCommand(`poolbot sandbox recreate --agent ${agentId}`);
-    }
-    return formatCliCommand("poolbot sandbox recreate --all");
-}
-export async function ensureSandboxContainer(params) {
-    const scopeKey = resolveSandboxScopeKey(params.cfg.scope, params.sessionKey);
-    const slug = params.cfg.scope === "shared" ? "shared" : slugifySessionKey(scopeKey);
-    const name = `${params.cfg.docker.containerPrefix}${slug}`;
-    const containerName = name.slice(0, 63);
-    const expectedHash = computeSandboxConfigHash({
-        docker: params.cfg.docker,
-        workspaceAccess: params.cfg.workspaceAccess,
-        workspaceDir: params.workspaceDir,
-        agentWorkspaceDir: params.agentWorkspaceDir,
-    });
-    const now = Date.now();
-    const state = await dockerContainerState(containerName);
-    let hasContainer = state.exists;
-    let running = state.running;
-    let currentHash = null;
-    let hashMismatch = false;
-    let registryEntry;
-    if (hasContainer) {
-        const registry = await readRegistry();
-        registryEntry = registry.entries.find((entry) => entry.containerName === containerName);
-        currentHash = await readContainerConfigHash(containerName);
-        if (!currentHash) {
-            currentHash = registryEntry?.configHash ?? null;
-        }
-        hashMismatch = !currentHash || currentHash !== expectedHash;
-        if (hashMismatch) {
-            const lastUsedAtMs = registryEntry?.lastUsedAtMs;
-            const isHot = running &&
-                (typeof lastUsedAtMs !== "number" || now - lastUsedAtMs < HOT_CONTAINER_WINDOW_MS);
-            if (isHot) {
-                const hint = formatSandboxRecreateHint({ scope: params.cfg.scope, sessionKey: scopeKey });
-                defaultRuntime.log(`Sandbox config changed for ${containerName} (recently used). Recreate to apply: ${hint}`);
-            }
-            else {
-                await execDocker(["rm", "-f", containerName], { allowFailure: true });
-                hasContainer = false;
-                running = false;
-            }
-        }
-    }
-    if (!hasContainer) {
-        await createSandboxContainer({
-            name: containerName,
-            cfg: params.cfg.docker,
-            workspaceDir: params.workspaceDir,
-            workspaceAccess: params.cfg.workspaceAccess,
-            agentWorkspaceDir: params.agentWorkspaceDir,
-            scopeKey,
-            configHash: expectedHash,
-        });
-    }
-    else if (!running) {
-        await execDocker(["start", containerName]);
-    }
-    await updateRegistry({
-        containerName,
-        sessionKey: scopeKey,
-        createdAtMs: now,
-        lastUsedAtMs: now,
-        image: params.cfg.docker.image,
-        configHash: hashMismatch && running ? (currentHash ?? undefined) : expectedHash,
-    });
-    return containerName;
-}