@rlemaigre/sbx 0.1.0 → 0.1.3

package/README.md

@@ -5,7 +5,7 @@ Sandboxed AI Agents — TypeScript API and CLI for [Gondolin](https://github.com
 ## Install
 
 ```bash
-npm install -g sbx
+npm install -g @rlemaigre/sbx
 ```
 
 ## Usage
@@ -26,7 +26,7 @@ sbx run pi -- echo hello
 ### API
 
 ```typescript
-import { Sandbox, SandboxConfig } from "sbx";
+import { Sandbox, SandboxConfig } from "@rlemaigre/sbx";
 
 const config = SandboxConfig.load("~/.config/sbx/pi.yaml");
 const sandbox = await Sandbox.create(config, "~/.cache/sbx/pi");

package/dist/api.d.ts

@@ -1,5 +1,5 @@
 import { VM } from "@earendil-works/gondolin";
-import { SandboxConfig } from "./config";
+import { SandboxConfig, type IMount } from "./config";
 export { loadConfig, SandboxConfig } from "./config";
 export type { INetworkPolicy, IMount, ISecretConfig, } from "./config";
 /**
@@ -36,9 +36,7 @@ export interface IExecResult {
 }
 /**
  * Sandbox handle — wraps the underlying Gondolin VM.
- * The guest disk is disposable: modifications via `exec()` are never persisted.
- * The checkpoint (post-setup snapshot) is managed automatically by `Sandbox.create()`.
- * To persist data, write through `mounts` backed by `RealFSProvider`.
+ * Setup commands run on every start. Persist data through `mounts` backed by `RealFSProvider`.
  */
 export declare class Sandbox {
     /**
@@ -50,13 +48,12 @@ export declare class Sandbox {
     /**
      * Create a sandboxed agent VM.
      *
-     * On first run: fresh boot → run `setup` → save disk snapshot + manifest into `cacheDir`.
-     * On subsequent runs: if `setup` matches the saved manifest, restore the snapshot;
-     * otherwise re-run setup from scratch and save a new snapshot.
+     * Every run: fresh boot → run `setup` commands.
      * Mounts, network, and secrets are always rebuilt from the caller-supplied config.
-     * User modifications via `exec()` are never persisted.
+     * User modifications via `exec()` are never persisted — `shutdown()` is destructive.
+     * @param extraMounts - Additional mounts merged with config mounts (same shadow rules apply).
      */
-    static create(config: SandboxConfig, cacheDir?: string): Promise<Sandbox>;
+    static create(config: SandboxConfig, extraMounts?: IMount[]): Promise<Sandbox>;
     /**
      * Run each setup command from the config inside an existing sandbox.
      */
@@ -83,9 +80,5 @@ export declare class Sandbox {
      * Tear down the VM. Does not save state — shutdown is destructive.
      */
     shutdown(): Promise<void>;
-    /**
-     * Checkpoint the current VM state to a path on disk.
-     */
-    save(path: string): Promise<void>;
 }
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAkC,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAc,aAAa,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAErD,YAAY,EACV,cAAc,EACd,MAAM,EACN,aAAa,GACd,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CACJ,KAAK,EAAE,MAAM,CAAC,UAAU,EACxB,MAAM,EAAE,MAAM,CAAC,WAAW,EAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,OAAO;IAClB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAK;gBAEZ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa;IAKzC;;;;;;;;OAQG;WACU,MAAM,CACjB,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAwBnB;;OAEG;mBACkB,QAAQ;IAS7B;;;OAGG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWlE;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAO/B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAgB/B;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMjD;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIxC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,EAAoB,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAc,aAAa,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA0BrD,YAAY,EACV,cAAc,EACd,MAAM,EACN,aAAa,GACd,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CACJ,KAAK,EAAE,MAAM,CAAC,UAAU,EACxB,MAAM,EAAE,MAAM,CAAC,WAAW,EAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,OAAO;IAClB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAK;gBAEZ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa;IAKzC;;;;;;;OAOG;WACU,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpF;;OAEG;mBACkB,QAAQ;IAkB7B;;;OAGG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWlE;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAO/B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAgB/B;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMjD;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAIhC"}

package/dist/api.js

@@ -1,17 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Sandbox = exports.SandboxConfig = exports.loadConfig = void 0;
+const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
 const gondolin_1 = require("@earendil-works/gondolin");
 var config_1 = require("./config");
 Object.defineProperty(exports, "loadConfig", { enumerable: true, get: function () { return config_1.loadConfig; } });
 Object.defineProperty(exports, "SandboxConfig", { enumerable: true, get: function () { return config_1.SandboxConfig; } });
+const IMAGE_URL = "https://github.com/rlemaigre/agent-sandboxes/releases/download/v0.1.3-image/sbx-assets.tar.gz";
+const IMAGE_CACHE_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), ".cache", "sbx", "image");
+/**
+ * Ensure the custom sbx image is downloaded and extracted.
+ * Returns the path to the image assets directory.
+ */
+async function ensureImage() {
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(IMAGE_CACHE_DIR, "manifest.json"))) {
+        return IMAGE_CACHE_DIR;
+    }
+    (0, node_fs_1.mkdirSync)(IMAGE_CACHE_DIR, { recursive: true });
+    const tarball = (0, node_path_1.join)(IMAGE_CACHE_DIR, "..", "sbx-assets.tar.gz");
+    console.error("[sbx] downloading image...");
+    const resp = await fetch(IMAGE_URL);
+    if (!resp.ok)
+        throw new Error(`Image download failed: ${resp.status}`);
+    const buffer = await resp.arrayBuffer();
+    require("node:fs").writeFileSync(tarball, Buffer.from(buffer));
+    console.error("[sbx] extracting image...");
+    (0, node_child_process_1.execFileSync)("tar", ["xzf", tarball, "-C", IMAGE_CACHE_DIR]);
+    require("node:fs").unlinkSync(tarball);
+    return IMAGE_CACHE_DIR;
+}
 /**
  * Sandbox handle — wraps the underlying Gondolin VM.
- * The guest disk is disposable: modifications via `exec()` are never persisted.
- * The checkpoint (post-setup snapshot) is managed automatically by `Sandbox.create()`.
- * To persist data, write through `mounts` backed by `RealFSProvider`.
+ * Setup commands run on every start. Persist data through `mounts` backed by `RealFSProvider`.
  */
 class Sandbox {
     /**
@@ -26,37 +49,37 @@ class Sandbox {
     /**
      * Create a sandboxed agent VM.
      *
-     * On first run: fresh boot → run `setup` → save disk snapshot + manifest into `cacheDir`.
-     * On subsequent runs: if `setup` matches the saved manifest, restore the snapshot;
-     * otherwise re-run setup from scratch and save a new snapshot.
+     * Every run: fresh boot → run `setup` commands.
      * Mounts, network, and secrets are always rebuilt from the caller-supplied config.
-     * User modifications via `exec()` are never persisted.
+     * User modifications via `exec()` are never persisted — `shutdown()` is destructive.
+     * @param extraMounts - Additional mounts merged with config mounts (same shadow rules apply).
      */
-    static async create(config, cacheDir) {
-        const vmOptions = buildVmOptions(config);
-        const cache = cacheDir ? new CacheDir(cacheDir) : null;
-        // Restore from cache if manifest matches
-        if (cache?.matches(config)) {
-            return cache.restore(config);
-        }
-        // Fresh boot — run setup
-        const setupVm = await gondolin_1.VM.create(vmOptions);
-        const sandbox = new Sandbox(setupVm, config);
-        await Sandbox.runSetup(sandbox, config);
-        // If caching, checkpoint and resume from snapshot
-        if (cache) {
-            await cache.save(setupVm, config);
-            await setupVm.close();
-            return cache.restore(config);
-        }
+    static async create(config, extraMounts) {
+        const imageDir = config.image ?? await ensureImage();
+        const vmOptions = buildVmOptions(config, imageDir, extraMounts);
+        const debug = config.debug;
+        debug && console.error("[sbx] fresh boot, running setup");
+        const vm = await gondolin_1.VM.create(vmOptions);
+        const sandbox = new Sandbox(vm, config);
+        await Sandbox.runSetup(sandbox, config, debug);
         return sandbox;
     }
     /**
      * Run each setup command from the config inside an existing sandbox.
      */
-    static async runSetup(sandbox, config) {
+    static async runSetup(sandbox, config, debug) {
         for (const cmd of config.setup ?? []) {
-            await (await sandbox.exec(cmd)).exit;
+            const result = await (await sandbox.exec(cmd)).exit;
+            if (debug) {
+                console.error(`[sbx] setup: ${cmd}`);
+                if (result.stdout)
+                    console.error(result.stdout);
+                if (result.stderr)
+                    console.error(result.stderr);
+                if (result.exitCode !== 0) {
+                    console.error(`[sbx] setup exited with code ${result.exitCode}`);
+                }
+            }
         }
     }
     /**
@@ -111,106 +134,23 @@ class Sandbox {
     async shutdown() {
         return this.vm.close();
     }
-    /**
-     * Checkpoint the current VM state to a path on disk.
-     */
-    async save(path) {
-        const cache = new CacheDir(path);
-        await cache.save(this.vm, this.config);
-    }
 }
 exports.Sandbox = Sandbox;
-/**
- * Cache directory handle — manages checkpoint save/restore and manifest validation.
- */
-class CacheDir {
-    path;
-    constructor(path) {
-        this.path = path;
-    }
-    /**
-     * Load the cached manifest (verbatim setup commands).
-     * Returns undefined if manifest.txt is missing.
-     */
-    loadManifest() {
-        const path = (0, node_path_1.join)(this.path, "manifest.txt");
-        if (!(0, node_fs_1.existsSync)(path))
-            return undefined;
-        try {
-            return (0, node_fs_1.readFileSync)(path, "utf-8").split("\n").filter(Boolean);
-        }
-        catch {
-            return undefined;
-        }
-    }
-    /**
-     * Load a cached disk checkpoint.
-     * Returns undefined if the file is missing or corrupt.
-     */
-    async loadCheckpoint() {
-        const path = (0, node_path_1.join)(this.path, "disk.qcow2");
-        if (!(0, node_fs_1.existsSync)(path))
-            return undefined;
-        try {
-            return await gondolin_1.VmCheckpoint.load(path);
-        }
-        catch {
-            return undefined;
-        }
-    }
-    /**
-     * Returns true if the cached manifest matches the config setup commands.
-     */
-    matches(config) {
-        const manifest = this.loadManifest();
-        if (!manifest)
-            return false;
-        const setup = config.setup ?? [];
-        if (manifest.length !== setup.length)
-            return false;
-        return manifest.every((cmd, i) => cmd === setup[i]);
-    }
-    /**
-     * Restore a sandbox from the cached checkpoint.
-     * Throws if the manifest does not match the config.
-     */
-    async restore(config) {
-        if (!this.matches(config)) {
-            throw new Error("checkpoint manifest mismatch");
-        }
-        const checkpoint = await this.loadCheckpoint();
-        if (!checkpoint)
-            throw new Error("checkpoint not found");
-        const vmOptions = buildVmOptions(config);
-        const vm = await checkpoint.resume(vmOptions);
-        return new Sandbox(vm, config);
-    }
-    /**
-     * Save the current VM disk and manifest into the cache directory.
-     */
-    async save(vm, config) {
-        (0, node_fs_1.mkdirSync)(this.path, { recursive: true });
-        try {
-            await vm.checkpoint((0, node_path_1.join)(this.path, "disk.qcow2"));
-            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(this.path, "manifest.txt"), (config.setup ?? []).join("\n"));
-        }
-        catch {
-            // checkpoint failed — VM still runs
-        }
-    }
-}
 /**
  * Build VM options from a sandbox config.
- * Derives network hooks, VFS mounts, merged env, and DNS mode.
+ * Derives network hooks, VFS mounts, merged env, DNS mode, and custom image path.
  */
-function buildVmOptions(config) {
+function buildVmOptions(config, imageDir, extraMounts) {
     const { httpHooks, env } = config.buildHttpHooks();
-    const mounts = config.buildVFSProviders();
-    return {
+    const vfsMounts = config.buildVFSProviders(extraMounts);
+    const mergedEnv = { ...env, ...config.env };
+    const options = {
+        sandbox: { imagePath: imageDir },
         httpHooks,
-        env: { ...env, ...config.env },
+        env: mergedEnv,
         dns: { mode: "synthetic" },
-        vfs: { mounts },
+        vfs: Object.keys(vfsMounts).length ? { mounts: vfsMounts } : undefined,
     };
+    return options;
 }
 //# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":";;;AAAA,qCAA6E;AAC7E,yCAAiC;AACjC,uDAA8E;AAG9E,mCAAqD;AAA5C,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AA+ClC;;;;;GAKG;AACH,MAAa,OAAO;IAClB;;OAEG;IACM,MAAM,CAAgB;IACd,EAAE,CAAK;IAExB,YAAY,EAAM,EAAE,MAAqB;QACvC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAqB,EACrB,QAAiB;QAEjB,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvD,yCAAyC;QACzC,IAAI,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,aAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,kDAAkD;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAC3B,OAAgB,EAChB,MAAqB;QAErB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAsB;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAChC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB,CAAC,OAAsB;QACpD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;QAChC,OAAO,SAAS;YACd,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;YAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxG,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB,CAC7B,IAA4B,EAC5B,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,IAAI,EAAE;gBACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC;gBACrB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACF;AAhID,0BAgIC;AAED;;GAEG;AACH,MAAM,QAAQ;IACK,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,YAAY;QAClB,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,IAAA,sBAAY,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAqB;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,MAAqB;QACtC,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,CAAC,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACnD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAqB;IAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAC1C,OAAO;QACL,SAAS;QACT,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;QAC9B,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC1B,GAAG,EAAE,EAAE,MAAM,EAAE;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":";;;AAAA,2DAAkD;AAClD,qCAAgD;AAChD,yCAA0C;AAC1C,qCAAkC;AAClC,uDAAgE;AAGhE,mCAAqD;AAA5C,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAElC,MAAM,SAAS,GAAG,+FAA+F,CAAC;AAClH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAElE;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,eAAe,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAA,mBAAS,EAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,eAAe,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3C,IAAA,iCAAY,EAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC;AACzB,CAAC;AA+CD;;;GAGG;AACH,MAAa,OAAO;IAClB;;OAEG;IACM,MAAM,CAAgB;IACd,EAAE,CAAK;IAExB,YAAY,EAAM,EAAE,MAAqB;QACvC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,WAAsB;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,WAAW,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAE3B,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,aAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAC3B,OAAgB,EAChB,MAAqB,EACrB,KAAe;QAEf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;gBACrC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAsB;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAChC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB,CAAC,OAAsB;QACpD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;QAChC,OAAO,SAAS;YACd,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;YAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxG,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB,CAC7B,IAA4B,EAC5B,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,IAAI,EAAE;gBACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC;gBACrB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CAEF;AAlHD,0BAkHC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,QAAgB,EAChB,WAAsB;IAEtB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAoC;QAC/C,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;QAChC,SAAS;QACT,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli.d.ts

@@ -1,2 +1,3 @@
+#!/usr/bin/env node
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 "use strict";
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -5,6 +6,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
 const node_fs_1 = require("node:fs");
+const node_process_1 = require("node:process");
 const node_path_1 = require("node:path");
 const tiny_invariant_1 = __importDefault(require("tiny-invariant"));
 const config_1 = require("./config");
@@ -16,7 +18,6 @@ const CONFIG_DIR = (0, node_path_1.resolve)((0, node_path_1.join)(home, ".config
 const SHIM_DIR = process.platform === "win32"
     ? (0, node_path_1.resolve)((0, node_path_1.join)(home, "AppData", "Roaming", "bin"))
     : (0, node_path_1.resolve)((0, node_path_1.join)(home, ".local", "bin"));
-const CACHE_DIR = (0, node_path_1.resolve)((0, node_path_1.join)(home, ".cache", "sbx"));
 /**
  * Commander program instance with registered sub-commands.
  */
@@ -24,7 +25,7 @@ const program = new commander_1.Command();
 program
     .name("sbx")
     .description("Sandboxed AI Agents — CLI for Gondolin micro-VMs")
-    .version("0.1.0");
+    .version(JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8")).version);
 program
     .command("init")
     .description("Generate a config file at ~/.config/sbx/<name>.yaml")
@@ -109,10 +110,11 @@ async function handleRun(args, opts) {
     (0, tiny_invariant_1.default)(shimName, "Missing --shim-name");
     const config = config_1.SandboxConfig.load((0, node_path_1.join)(CONFIG_DIR, `${shimName}.yaml`));
     (0, tiny_invariant_1.default)(config.cmd, `Config for ${shimName} must specify cmd`);
-    const sandbox = await api_1.Sandbox.create(config, (0, node_path_1.join)(CACHE_DIR, shimName));
+    const autoMount = { hostPath: (0, node_process_1.cwd)(), guestPath: "/workspace" };
+    const sandbox = await api_1.Sandbox.create(config, [autoMount]);
     const cmd = buildCommand(config.cmd, args);
     try {
-        const exitCode = await sandbox.execAndAttach(cmd);
+        const exitCode = await sandbox.execAndAttach(`cd /workspace && ${cmd}`);
         process.exit(exitCode);
     }
     finally {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;AAAA,yCAAoC;AACpC,qCAAkH;AAClH,yCAAmD;AACnD,oEAAuC;AACvC,qCAAyC;AACzC,+BAAgC;AAEhC,+EAA+E;AAE/E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;AAC9B,IAAA,wBAAS,EAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;AAErD,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACzD,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,OAAO;IAC1B,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3C,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,kDAAkD,CAAC;KAC/D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qDAAqD,CAAC;KAClE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KACzC,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wCAAwC,CAAC;KACrD,QAAQ,CAAC,YAAY,EAAE,wBAAwB,CAAC;KAChD,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,qBAAqB,CAAC;KAClC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;KAC9C,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC/D,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;KAC3D,kBAAkB,CAAC,IAAI,CAAC;KACxB,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,gFAAgF;AAEhF;;GAEG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAChD,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,WAAW,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAe;IACnC,IAAA,mBAAS,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAA,uBAAa,EAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAA,mBAAS,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAe;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAA2B;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAA,wBAAS,EAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,sBAAa,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC;IACxE,IAAA,wBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,cAAc,QAAQ,mBAAmB,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,MAAM,aAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAA,gBAAI,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAc;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAA,gBAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACzF,OAAO,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,qCAAkH;AAClH,+CAAmC;AACnC,yCAAmD;AACnD,oEAAuC;AACvC,qCAAsD;AACtD,+BAAgC;AAEhC,+EAA+E;AAE/E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;AAC9B,IAAA,wBAAS,EAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;AAErD,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACzD,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,OAAO;IAC1B,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAG3C;;GAEG;AACH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,kDAAkD,CAAC;KAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAE7F,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qDAAqD,CAAC;KAClE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KACzC,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wCAAwC,CAAC;KACrD,QAAQ,CAAC,YAAY,EAAE,wBAAwB,CAAC;KAChD,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,qBAAqB,CAAC;KAClC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;KAC9C,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC/D,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;KAC3D,kBAAkB,CAAC,IAAI,CAAC;KACxB,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,gFAAgF;AAEhF;;GAEG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAChD,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,WAAW,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAe;IACnC,IAAA,mBAAS,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAA,uBAAa,EAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAA,mBAAS,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAe;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAA2B;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAA,wBAAS,EAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,sBAAa,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC;IACxE,IAAA,wBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,cAAc,QAAQ,mBAAmB,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAW,EAAE,QAAQ,EAAE,IAAA,kBAAG,GAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,aAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAc;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAA,gBAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACzF,OAAO,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC"}

package/dist/config.d.ts

@@ -34,11 +34,13 @@ export interface ISecretConfig {
 export declare class SandboxConfig {
     readonly cmd?: string;
     readonly setup?: string[];
+    readonly image?: string;
     readonly network?: INetworkPolicy;
     readonly mounts?: IMount[];
     readonly shadow?: string[];
     readonly env?: Record<string, string>;
     readonly secrets?: Record<string, ISecretConfig>;
+    readonly debug?: boolean;
     /**
      * Create a SandboxConfig from a plain object.
      */
@@ -51,8 +53,9 @@ export declare class SandboxConfig {
     /**
      * Build VFS providers from config mounts and shadow rules.
      * Mount chain: RealFS → Readonly (if readOnly) → Shadow (if shadow paths).
+     * @param extraMounts - Additional mounts (e.g. auto-mounted PWD) applied with the same shadow rules.
      */
-    buildVFSProviders(): Record<string, VirtualProvider>;
+    buildVFSProviders(extraMounts?: IMount[]): Record<string, VirtualProvider>;
     /**
      * Build HTTP hooks and secret env vars from config.
      * Secrets are read from the host environment at runtime.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO3E;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAID;;;GAGG;AACH,qBAAa,aAAa;IACxB,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAgB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,SAAgB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzC,SAAgB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,SAAgB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,SAAgB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAExD;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAIzD;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IASxC,OAAO;IAUP;;;OAGG;IACH,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAWpD;;;OAGG;IACH,cAAc,IAAI;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAoBvE;;;OAGG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAI1F;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAM7G;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAO7B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;CAqB/B;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAEtD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO3E;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAID;;;GAGG;AACH,qBAAa,aAAa;IACxB,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAgB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAgB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzC,SAAgB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,SAAgB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,SAAgB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAIzD;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IASxC,OAAO;IAYP;;;;OAIG;IACH,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAY1E;;;OAGG;IACH,cAAc,IAAI;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAoBvE;;;OAGG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAI1F;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAM7G;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAO7B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;CAqB/B;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAEtD"}

package/dist/config.js

@@ -27,11 +27,13 @@ const gondolin_2 = require("@earendil-works/gondolin");
 class SandboxConfig {
     cmd;
     setup;
+    image;
     network;
     mounts;
     shadow;
     env;
     secrets;
+    debug;
     /**
      * Create a SandboxConfig from a plain object.
      */
@@ -52,20 +54,24 @@ class SandboxConfig {
     constructor(data) {
         this.cmd = data.cmd;
         this.setup = data.setup;
+        this.image = data.image;
         this.network = data.network;
         this.mounts = data.mounts;
         this.shadow = data.shadow;
         this.env = data.env;
         this.secrets = data.secrets;
+        this.debug = data.debug;
     }
     /**
      * Build VFS providers from config mounts and shadow rules.
      * Mount chain: RealFS → Readonly (if readOnly) → Shadow (if shadow paths).
+     * @param extraMounts - Additional mounts (e.g. auto-mounted PWD) applied with the same shadow rules.
      */
-    buildVFSProviders() {
+    buildVFSProviders(extraMounts) {
         const mounts = {};
         const globalShadow = this.shadow ?? [];
-        for (const mount of this.mounts ?? []) {
+        const allMounts = [...(extraMounts ?? []), ...(this.mounts ?? [])];
+        for (const mount of allMounts) {
             mounts[mount.guestPath] = SandboxConfig.buildMountChain(mount, globalShadow);
         }
         return mounts;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAmMH,kCAKC;AAMD,gCAEC;AA9MD,qCAAuC;AACvC,yCAAoC;AACpC,qCAA+B;AAC/B,yCAAsC;AACtC,oEAAuC;AACvC,uDAA2D;AAE3D,uDAIkC;AA2BlC,gFAAgF;AAEhF;;;GAGG;AACH,MAAa,aAAa;IACR,GAAG,CAAU;IACb,KAAK,CAAY;IACjB,OAAO,CAAkB;IACzB,MAAM,CAAY;IAClB,MAAM,CAAY;IAClB,GAAG,CAA0B;IAC7B,OAAO,CAAiC;IAExD;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAA6B;QACvC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAA,cAAI,EAAC,IAAA,sBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;QAC7D,IAAA,wBAAS,EAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,+BAA+B,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,GAA8B,CAAC,CAAC;QACjE,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAoB,IAA6B;QAC/C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAyB,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAA6B,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAqC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAA8B,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAA8B,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAyC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAoD,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACH,iBAAiB;QACf,MAAM,MAAM,GAAoC,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAEvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,OAAO,GAAuD,EAAE,CAAC;QAEvE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;aAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAA,0BAAe,EAAC;YACrB,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;YAC9C,oBAAoB,EAAE,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE;YAC9D,mBAAmB,EAAE,IAAI;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAA+B;QACtD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA+B;QACnD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAE9E;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,SAAmB,EAAE;QACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAA,wBAAS,EAAC,KAAK,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;YACtD,IAAA,wBAAS,EAAC,KAAK,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,aAAa,CAAC,WAAqB,EAAE,IAAY;QAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,IAAA,qBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,eAAe,CAC5B,KAAa,EACb,YAAsB;QAEtB,IAAI,QAAQ,GAAoB,IAAI,yBAAc,CAChD,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,QAAQ,GAAG,IAAI,2BAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,yBAAc,CAAC,QAAQ,EAAE;gBACtC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AA9ID,sCA8IC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAA,wBAAS,EAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IACrD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAyMH,kCAKC;AAMD,gCAEC;AApND,qCAAuC;AACvC,yCAAoC;AACpC,qCAA+B;AAC/B,yCAAsC;AACtC,oEAAuC;AACvC,uDAA2D;AAE3D,uDAIkC;AA2BlC,gFAAgF;AAEhF;;;GAGG;AACH,MAAa,aAAa;IACR,GAAG,CAAU;IACb,KAAK,CAAY;IACjB,KAAK,CAAU;IACf,OAAO,CAAkB;IACzB,MAAM,CAAY;IAClB,MAAM,CAAY;IAClB,GAAG,CAA0B;IAC7B,OAAO,CAAiC;IACxC,KAAK,CAAW;IAEhC;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAA6B;QACvC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAA,cAAI,EAAC,IAAA,sBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;QAC7D,IAAA,wBAAS,EAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,+BAA+B,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,GAA8B,CAAC,CAAC;QACjE,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAoB,IAA6B;QAC/C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAyB,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAA6B,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAA2B,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAqC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAA8B,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAA8B,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAyC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAoD,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAA4B,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,WAAsB;QACtC,MAAM,MAAM,GAAoC,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAEnE,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,OAAO,GAAuD,EAAE,CAAC;QAEvE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;aAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAA,0BAAe,EAAC;YACrB,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;YAC9C,oBAAoB,EAAE,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE;YAC9D,mBAAmB,EAAE,IAAI;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAA+B;QACtD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA+B;QACnD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAE9E;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,SAAmB,EAAE;QACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAA,wBAAS,EAAC,KAAK,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;YACtD,IAAA,wBAAS,EAAC,KAAK,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,aAAa,CAAC,WAAqB,EAAE,IAAY;QAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,IAAA,qBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,eAAe,CAC5B,KAAa,EACb,YAAsB;QAEtB,IAAI,QAAQ,GAAoB,IAAI,yBAAc,CAChD,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,QAAQ,GAAG,IAAI,2BAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,yBAAc,CAAC,QAAQ,EAAE;gBACtC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AApJD,sCAoJC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAA,wBAAS,EAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IACrD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/templates/config.template.yaml

@@ -4,9 +4,15 @@
 # Command to run inside the VM (required)
 cmd: pi
 
+# Path to a custom Gondolin guest image directory (with manifest.json).
+# Defaults to sbx-alpine (pi pre-installed, 2 GB rootfs).
+# Build your own: gondolin build --config my-image.json --output ./my-image
+# image: ./my-image
+
 # Shell commands to run on first boot
-setup:
-  - apk add --no-cache nodejs npm git ripgrep
+# (pi, git, ripgrep are pre-installed in the sbx-alpine image)
+# setup:
+#   - apk add --no-cache neovim
 
 # Outbound network policy
 network:
@@ -14,17 +20,16 @@ network:
   allowedHosts:
     - api.anthropic.com
     - "*.github.com"
+    - registry.npmjs.org
   # Scoped exceptions for internal hosts (internal ranges are always blocked)
   allowedInternalHosts: []
 
-# Host filesystem mounts
+# Host filesystem mounts (additive to PWD auto-mounted as /workspace when using shim)
 mounts:
-  - hostPath: "/home/user/project"
-    guestPath: "/workspace"
-    readOnly: false
-    # Per-mount shadow rules (added to global shadow)
-    shadow:
-      - ".git"
+  # Share pi config so sandboxed and native pi use the same settings
+  - hostPath: "~/.config/pi"
+    guestPath: "/root/.config/pi"
+    readOnly: true
 
 # Global files/directories to shadow (hide from guest, relative to each mount)
 shadow:
@@ -33,8 +38,8 @@ shadow:
   - ".aws/"
 
 # Environment variables to set in the guest
-env:
-  NODE_ENV: production
+# env:
+#   NODE_ENV: production
 
 # Secrets to inject via host-side HTTP interception
 # Key name maps to host env var of the same name (read at runtime)
@@ -42,6 +47,6 @@ secrets:
   ANTHROPIC_API_KEY:
     hosts:
       - api.anthropic.com
-  GITHUB_TOKEN:
-    hosts:
-      - "*.github.com"
+
+# Print setup command output and lifecycle messages to stderr.
+# debug: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rlemaigre/sbx",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Sandboxed AI Agents — TypeScript API and CLI for Gondolin micro-VMs",
   "main": "dist/api.js",
   "types": "dist/api.d.ts",
@@ -25,7 +25,8 @@
   "scripts": {
     "build": "tsc && mkdir -p dist/templates && cp src/templates/* dist/templates/",
     "prepublishOnly": "tsc && mkdir -p dist/templates && cp src/templates/* dist/templates/",
-    "test": "tsx --test --test-concurrency=1 test/*.test.ts"
+    "test": "tsx --test --test-concurrency=1 test/*.test.ts",
+    "build-image": "npx @earendil-works/gondolin build --config sbx-image.json --output ../scratch/sbx-assets && (cd ../scratch/sbx-assets && tar czf ../sbx-assets.tar.gz .) && mv ../scratch/sbx-assets.tar.gz ../"
   },
   "dependencies": {
     "@earendil-works/gondolin": "^0.12.0",

package/dist/commands/deploy.d.ts

@@ -1,6 +0,0 @@
-/**
- * Deploy command — install shim scripts.
- */
-import { Command } from "commander";
-export declare const deployCommand: Command;
-//# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,eAAO,MAAM,aAAa,SA0CtB,CAAC"}

package/dist/commands/deploy.js

@@ -1,49 +0,0 @@
-"use strict";
-/**
- * Deploy command — install shim scripts.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.deployCommand = void 0;
-const commander_1 = require("commander");
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const paths_1 = require("../lib/paths");
-function getLinuxShim(name) {
-    return `#!/usr/bin/env bash\nexec sbx run "$@" --shim-name ${name}\n`;
-}
-function getWindowsShim(name) {
-    return `@echo off\nwsl sbx run %* --shim-name ${name}\n`;
-}
-exports.deployCommand = new commander_1.Command("deploy")
-    .description("Install shim scripts for named configs")
-    .argument("[names...]", "config names to deploy (default: all)")
-    .action((names) => {
-    const configNames = names?.length
-        ? names
-        : (0, node_fs_1.readdirSync)(paths_1.CONFIG_DIR)
-            .filter((f) => f.endsWith(".yaml"))
-            .map((f) => f.replace(/\.yaml$/, ""));
-    (0, node_fs_1.mkdirSync)(paths_1.SHIM_DIR, { recursive: true });
-    for (const name of configNames) {
-        const configPath = (0, node_path_1.join)(paths_1.CONFIG_DIR, `${name}.yaml`);
-        if (!(0, node_fs_1.existsSync)(configPath)) {
-            console.error(`Config not found for: ${name}`);
-            continue;
-        }
-        const shimPath = process.platform === "win32"
-            ? (0, node_path_1.join)(paths_1.SHIM_DIR, `${name}.cmd`)
-            : (0, node_path_1.join)(paths_1.SHIM_DIR, name);
-        const content = process.platform === "win32"
-            ? getWindowsShim(name)
-            : getLinuxShim(name);
-        (0, node_fs_1.writeFileSync)(shimPath, content);
-        if (process.platform !== "win32") {
-            (0, node_fs_1.chmodSync)(shimPath, 0o755);
-        }
-        console.log(`Deployed ${shimPath}`);
-    }
-    if (process.platform === "win32") {
-        console.log(`\nIf ${paths_1.SHIM_DIR} is not on your PATH, run:\n  setx PATH "%PATH%;${paths_1.SHIM_DIR}"`);
-    }
-});
-//# sourceMappingURL=deploy.js.map

package/dist/commands/deploy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,yCAAoC;AACpC,qCAAuF;AACvF,yCAAiC;AACjC,wCAAoD;AAEpD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,sDAAsD,IAAI,IAAI,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,yCAAyC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAEY,QAAA,aAAa,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,wCAAwC,CAAC;KACrD,QAAQ,CAAC,YAAY,EAAE,uCAAuC,CAAC;KAC/D,MAAM,CAAC,CAAC,KAAgB,EAAE,EAAE;IAC3B,MAAM,WAAW,GACf,KAAK,EAAE,MAAM;QACX,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAA,qBAAW,EAAC,kBAAU,CAAC;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAEhD,IAAA,mBAAS,EAAC,gBAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,kBAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,IAAA,gBAAI,EAAC,gBAAQ,EAAE,GAAG,IAAI,MAAM,CAAC;YAC/B,CAAC,CAAC,IAAA,gBAAI,EAAC,gBAAQ,EAAE,IAAI,CAAC,CAAC;QAE3B,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAA,uBAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAA,mBAAS,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CACT,QAAQ,gBAAQ,mDAAmD,gBAAQ,GAAG,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/init.d.ts

@@ -1,6 +0,0 @@
-/**
- * Init command — copy template config to user config directory.
- */
-import { Command } from "commander";
-export declare const initCommand: Command;
-//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,WAAW,SASpB,CAAC"}

package/dist/commands/init.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Init command — copy template config to user config directory.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.initCommand = void 0;
-const commander_1 = require("commander");
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const paths_1 = require("../lib/paths");
-exports.initCommand = new commander_1.Command("init")
-    .description("Generate a config file at ~/.config/sbx/<name>.yaml")
-    .argument("<name>", "shim name (e.g. pi)")
-    .action((name) => {
-    const target = (0, node_path_1.join)(paths_1.CONFIG_DIR, `${name}.yaml`);
-    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(target), { recursive: true });
-    (0, node_fs_1.copyFileSync)((0, node_path_1.resolve)(__dirname, "../template.yaml"), target);
-    console.log(`Created ${target}`);
-    console.log(`Edit it, then run: sbx deploy ${name}`);
-});
-//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,yCAAoC;AACpC,qCAAkD;AAClD,yCAAmD;AACnD,wCAA0C;AAE7B,QAAA,WAAW,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,qDAAqD,CAAC;KAClE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KACzC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,kBAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAChD,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}

package/dist/commands/run.d.ts

@@ -1,9 +0,0 @@
-/**
- * Run command — execute agent inside sandboxed VM.
- *
- * Invoked by shim scripts. Delegates to the API:
- *   loadConfig → createSandbox → exec + TTY forwarding → shutdown
- */
-import { Command } from "commander";
-export declare const runCommand: Command;
-//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,UAAU,SAiCnB,CAAC"}

package/dist/commands/run.js

@@ -1,49 +0,0 @@
-"use strict";
-/**
- * Run command — execute agent inside sandboxed VM.
- *
- * Invoked by shim scripts. Delegates to the API:
- *   loadConfig → createSandbox → exec + TTY forwarding → shutdown
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runCommand = void 0;
-const commander_1 = require("commander");
-const node_path_1 = require("node:path");
-const paths_1 = require("../lib/paths");
-const tiny_invariant_1 = __importDefault(require("tiny-invariant"));
-const config_1 = require("../lib/config");
-const api_1 = require("../api");
-exports.runCommand = new commander_1.Command("run")
-    .description("Execute agent inside sandboxed VM (internal — invoked by shims)")
-    .argument("[args...]", "arguments to pass to the agent command")
-    .option("--shim-name <name>", "shim name (resolves config)")
-    .allowUnknownOption(true)
-    .action(async (args, opts) => {
-    const shimName = opts.shimName;
-    (0, tiny_invariant_1.default)(shimName, "Missing --shim-name");
-    const config = (0, config_1.loadConfig)((0, node_path_1.join)(paths_1.CONFIG_DIR, `${shimName}.yaml`));
-    (0, tiny_invariant_1.default)(config.cmd, `Config for ${shimName} must specify cmd`);
-    const sandbox = await (0, api_1.createSandbox)({
-        config,
-        cacheDir: (0, node_path_1.join)(paths_1.CACHE_DIR, shimName),
-    });
-    const cmd = args.length > 0 ? `${config.cmd} ${args.join(" ")}` : config.cmd;
-    try {
-        const proc = await sandbox.exec(cmd, {
-            pty: true,
-            stdin: true,
-            stdout: "pipe",
-            stderr: "pipe",
-        });
-        proc.attach(process.stdin, process.stdout, process.stderr);
-        const result = await proc.exit;
-        process.exit(result.exitCode);
-    }
-    finally {
-        await sandbox.shutdown();
-    }
-});
-//# sourceMappingURL=run.js.map

package/dist/commands/run.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,yCAAoC;AACpC,yCAAiC;AACjC,wCAAqD;AACrD,oEAAuC;AAEvC,0CAA2C;AAC3C,gCAAuC;AAE1B,QAAA,UAAU,GAAG,IAAI,mBAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC/D,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;KAC3D,kBAAkB,CAAC,IAAI,CAAC;KACxB,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAkB,CAAC;IACzC,IAAA,wBAAS,EAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,IAAA,gBAAI,EAAC,kBAAU,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC;IAChE,IAAA,wBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,cAAc,QAAQ,mBAAmB,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAa,EAAC;QAClC,MAAM;QACN,QAAQ,EAAE,IAAA,gBAAI,EAAC,iBAAS,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAE7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACnC,GAAG,EAAE,IAAI;YACT,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/undeploy.d.ts

@@ -1,6 +0,0 @@
-/**
- * Undeploy command — remove shim scripts.
- */
-import { Command } from "commander";
-export declare const undeployCommand: Command;
-//# sourceMappingURL=undeploy.d.ts.map

package/dist/commands/undeploy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"undeploy.d.ts","sourceRoot":"","sources":["../../src/commands/undeploy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,eAAe,SAiBxB,CAAC"}

package/dist/commands/undeploy.js

@@ -1,28 +0,0 @@
-"use strict";
-/**
- * Undeploy command — remove shim scripts.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.undeployCommand = void 0;
-const commander_1 = require("commander");
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const paths_1 = require("../lib/paths");
-exports.undeployCommand = new commander_1.Command("undeploy")
-    .description("Remove shim scripts")
-    .argument("<names...>", "shim names to remove")
-    .action((names) => {
-    for (const name of names) {
-        const shimPath = process.platform === "win32"
-            ? (0, node_path_1.join)(paths_1.SHIM_DIR, `${name}.cmd`)
-            : (0, node_path_1.join)(paths_1.SHIM_DIR, name);
-        if ((0, node_fs_1.existsSync)(shimPath)) {
-            (0, node_fs_1.unlinkSync)(shimPath);
-            console.log(`Removed ${shimPath}`);
-        }
-        else {
-            console.error(`Shim not found: ${shimPath}`);
-        }
-    }
-});
-//# sourceMappingURL=undeploy.js.map

package/dist/commands/undeploy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"undeploy.js","sourceRoot":"","sources":["../../src/commands/undeploy.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,yCAAoC;AACpC,qCAAiD;AACjD,yCAAiC;AACjC,wCAAwC;AAE3B,QAAA,eAAe,GAAG,IAAI,mBAAO,CAAC,UAAU,CAAC;KACnD,WAAW,CAAC,qBAAqB,CAAC;KAClC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;KAC9C,MAAM,CAAC,CAAC,KAAe,EAAE,EAAE;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,IAAA,gBAAI,EAAC,gBAAQ,EAAE,GAAG,IAAI,MAAM,CAAC;YAC/B,CAAC,CAAC,IAAA,gBAAI,EAAC,gBAAQ,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/lib/config.d.ts

@@ -1,51 +0,0 @@
-/**
- * Configuration interfaces and YAML loading/saving.
- *
- * Mirrors the YAML config keys (SPECS §3.1).
- */
-/**
- * Outbound network policy.
- */
-export interface INetworkPolicy {
-    allowedHosts?: string[];
-    allowedInternalHosts?: string[];
-    blockInternalRanges?: boolean;
-    dnsMode?: "synthetic" | "trusted" | "open";
-}
-/**
- * Host filesystem mount.
- */
-export interface IMount {
-    hostPath: string;
-    guestPath: string;
-    readOnly?: boolean;
-    shadow?: string[];
-}
-/**
- * Secret injection configuration.
- */
-export interface ISecretConfig {
-    hosts: string[];
-}
-/**
- * Sandbox configuration — mirrors the YAML config keys (SPECS §3.1).
- */
-export interface ISandboxConfig {
-    cmd?: string;
-    packages?: string[];
-    network?: INetworkPolicy;
-    mounts?: IMount[];
-    shadow?: string[];
-    env?: Record<string, string>;
-    secrets?: Record<string, ISecretConfig>;
-}
-/**
- * Load a sandbox configuration from a YAML file.
- * Same syntax as the Coding Assistants config files.
- */
-export declare function loadConfig(path: string): ISandboxConfig;
-/**
- * Save a sandbox configuration to a YAML file.
- */
-export declare function saveConfig(path: string, config: ISandboxConfig): void;
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACzC;AAYD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAOvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAGrE"}

package/dist/lib/config.js

@@ -1,47 +0,0 @@
-"use strict";
-/**
- * Configuration interfaces and YAML loading/saving.
- *
- * Mirrors the YAML config keys (SPECS §3.1).
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadConfig = loadConfig;
-exports.saveConfig = saveConfig;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const ajv_1 = __importDefault(require("ajv"));
-const js_yaml_1 = require("js-yaml");
-const tiny_invariant_1 = __importDefault(require("tiny-invariant"));
-const config_json_1 = __importDefault(require("../../schema/config.json"));
-const ajv = new ajv_1.default({ strict: false });
-const validate = ajv.compile(config_json_1.default);
-function expandTilde(path) {
-    if (!path.startsWith("~"))
-        return path;
-    const home = process.env.HOME;
-    (0, tiny_invariant_1.default)(home, "HOME environment variable not set");
-    return (0, node_path_1.resolve)(home, path.slice(1));
-}
-/**
- * Load a sandbox configuration from a YAML file.
- * Same syntax as the Coding Assistants config files.
- */
-function loadConfig(path) {
-    const resolved = expandTilde(path);
-    const raw = (0, js_yaml_1.load)((0, node_fs_1.readFileSync)(resolved, "utf-8"));
-    if (!validate(raw)) {
-        throw new Error(`Config validation failed: ${JSON.stringify(validate.errors)}`);
-    }
-    return raw;
-}
-/**
- * Save a sandbox configuration to a YAML file.
- */
-function saveConfig(path, config) {
-    const resolved = expandTilde(path);
-    (0, node_fs_1.writeFileSync)(resolved, (0, js_yaml_1.dump)(config, { lineWidth: -1 }));
-}
-//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;AAgEH,gCAOC;AAKD,gCAGC;AA7ED,qCAAsD;AACtD,yCAA0C;AAC1C,8CAAsB;AACtB,qCAAqC;AACrC,oEAAuC;AAEvC,2EAA8C;AA0C9C,MAAM,GAAG,GAAG,IAAI,aAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAM,CAAC,CAAC;AAErC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAA,wBAAS,EAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IACrD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAA,cAAI,EAAC,IAAA,sBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAqB,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,MAAsB;IAC7D,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,IAAA,uBAAa,EAAC,QAAQ,EAAE,IAAA,cAAI,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/network.d.ts

@@ -1,18 +0,0 @@
-/**
- * HTTP hooks building from config network policy and secrets.
- *
- * Maps YAML network + secrets to Gondolin's createHttpHooks.
- */
-import type { HttpHooks } from "@earendil-works/gondolin";
-import { ISandboxConfig } from "./config";
-/**
- * Build HTTP hooks and secret env vars from config.
- *
- * Secrets are read from the host environment at runtime.
- * Returns { httpHooks, env } — the env maps secret names to placeholder values.
- */
-export declare function buildHttpHooks(config: ISandboxConfig): {
-    httpHooks: HttpHooks;
-    env: Record<string, string>;
-};
-//# sourceMappingURL=network.d.ts.map

package/dist/lib/network.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/lib/network.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG;IACtD,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B,CAmBA"}

package/dist/lib/network.js

@@ -1,31 +0,0 @@
-"use strict";
-/**
- * HTTP hooks building from config network policy and secrets.
- *
- * Maps YAML network + secrets to Gondolin's createHttpHooks.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildHttpHooks = buildHttpHooks;
-const gondolin_1 = require("@earendil-works/gondolin");
-/**
- * Build HTTP hooks and secret env vars from config.
- *
- * Secrets are read from the host environment at runtime.
- * Returns { httpHooks, env } — the env maps secret names to placeholder values.
- */
-function buildHttpHooks(config) {
-    const secrets = {};
-    for (const [name, secret] of Object.entries(config.secrets ?? {})) {
-        secrets[name] = {
-            hosts: secret.hosts,
-            value: process.env[name] ?? "",
-        };
-    }
-    return (0, gondolin_1.createHttpHooks)({
-        allowedHosts: config.network?.allowedHosts ?? [],
-        allowedInternalHosts: config.network?.allowedInternalHosts ?? [],
-        blockInternalRanges: config.network?.blockInternalRanges ?? true,
-        secrets,
-    });
-}
-//# sourceMappingURL=network.js.map

package/dist/lib/network.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/lib/network.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAaH,wCAsBC;AAjCD,uDAA2D;AAK3D;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAsB;IAInD,MAAM,OAAO,GAGT,EAAE,CAAC;IAEP,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,GAAG;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO,IAAA,0BAAe,EAAC;QACrB,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;QAChD,oBAAoB,EAAE,MAAM,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE;QAChE,mBAAmB,EAAE,MAAM,CAAC,OAAO,EAAE,mBAAmB,IAAI,IAAI;QAChE,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/paths.d.ts

@@ -1,12 +0,0 @@
-/**
- * Platform-aware path constants.
- *
- * Resolves config, shim, and cache directories per SPECS §3.2.
- */
-/** Config directory: ~/.config/sbx/ */
-export declare const CONFIG_DIR: string;
-/** Shim directory: ~/.local/bin/ (Linux) or mapped WSL path (Windows) */
-export declare const SHIM_DIR: string;
-/** Cache directory: ~/.cache/sbx/ */
-export declare const CACHE_DIR: string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/lib/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/lib/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,uCAAuC;AACvC,eAAO,MAAM,UAAU,QAAwC,CAAC;AAEhE,yEAAyE;AACzE,eAAO,MAAM,QAAQ,QAGqB,CAAC;AAE3C,qCAAqC;AACrC,eAAO,MAAM,SAAS,QAAuC,CAAC"}

package/dist/lib/paths.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Platform-aware path constants.
- *
- * Resolves config, shim, and cache directories per SPECS §3.2.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CACHE_DIR = exports.SHIM_DIR = exports.CONFIG_DIR = void 0;
-const node_path_1 = require("node:path");
-const home = process.env.HOME;
-if (!home)
-    throw new Error("HOME environment variable not set");
-/** Config directory: ~/.config/sbx/ */
-exports.CONFIG_DIR = (0, node_path_1.resolve)((0, node_path_1.join)(home, ".config", "sbx"));
-/** Shim directory: ~/.local/bin/ (Linux) or mapped WSL path (Windows) */
-exports.SHIM_DIR = process.platform === "win32"
-    ? (0, node_path_1.resolve)((0, node_path_1.join)(home, "AppData", "Roaming", "bin"))
-    : (0, node_path_1.resolve)((0, node_path_1.join)(home, ".local", "bin"));
-/** Cache directory: ~/.cache/sbx/ */
-exports.CACHE_DIR = (0, node_path_1.resolve)((0, node_path_1.join)(home, ".cache", "sbx"));
-//# sourceMappingURL=paths.js.map

package/dist/lib/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/lib/paths.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,yCAA0C;AAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;AAC9B,IAAI,CAAC,IAAI;IAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAEhE,uCAAuC;AAC1B,QAAA,UAAU,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhE,yEAAyE;AAC5D,QAAA,QAAQ,GACnB,OAAO,CAAC,QAAQ,KAAK,OAAO;IAC1B,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3C,qCAAqC;AACxB,QAAA,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC"}

package/dist/lib/vfs.d.ts

@@ -1,15 +0,0 @@
-/**
- * VFS provider building from config mounts and shadow rules.
- *
- * Builds the RealFS → Readonly → Shadow mount chain per SPECS §2.1.
- */
-import type { VirtualProvider } from "@earendil-works/gondolin";
-import { ISandboxConfig } from "./config";
-/**
- * Build VFS providers from config mounts and shadow rules.
- *
- * Mount chain: RealFS → Readonly (if readOnly) → Shadow (if shadow paths).
- * Global shadow is merged with per-mount shadow.
- */
-export declare function buildVFSProviders(config: ISandboxConfig): Record<string, VirtualProvider>;
-//# sourceMappingURL=vfs.d.ts.map

package/dist/lib/vfs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vfs.d.ts","sourceRoot":"","sources":["../../src/lib/vfs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS1C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,cAAc,GACrB,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CA2BjC"}

package/dist/lib/vfs.js

@@ -1,44 +0,0 @@
-"use strict";
-/**
- * VFS provider building from config mounts and shadow rules.
- *
- * Builds the RealFS → Readonly → Shadow mount chain per SPECS §2.1.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildVFSProviders = buildVFSProviders;
-const node_path_1 = require("node:path");
-const minimatch_1 = require("minimatch");
-const gondolin_1 = require("@earendil-works/gondolin");
-function expandTilde(path) {
-    if (!path.startsWith("~"))
-        return path;
-    const home = process.env.HOME;
-    if (!home)
-        throw new Error("HOME environment variable not set");
-    return (0, node_path_1.resolve)(home, path.slice(1));
-}
-/**
- * Build VFS providers from config mounts and shadow rules.
- *
- * Mount chain: RealFS → Readonly (if readOnly) → Shadow (if shadow paths).
- * Global shadow is merged with per-mount shadow.
- */
-function buildVFSProviders(config) {
-    const mounts = {};
-    const globalShadow = config.shadow ?? [];
-    for (const mount of config.mounts ?? []) {
-        let provider = new gondolin_1.RealFSProvider(expandTilde(mount.hostPath));
-        if (mount.readOnly) {
-            provider = new gondolin_1.ReadonlyProvider(provider);
-        }
-        const shadowPaths = [...globalShadow, ...(mount.shadow ?? [])];
-        if (shadowPaths.length > 0) {
-            provider = new gondolin_1.ShadowProvider(provider, {
-                shouldShadow: (info) => shadowPaths.some((p) => (0, minimatch_1.minimatch)(info.path, `/${p}`, { dot: true })),
-            });
-        }
-        mounts[mount.guestPath] = provider;
-    }
-    return mounts;
-}
-//# sourceMappingURL=vfs.js.map

package/dist/lib/vfs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"vfs.js","sourceRoot":"","sources":["../../src/lib/vfs.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA2BH,8CA6BC;AAtDD,yCAAoC;AACpC,yCAAsC;AAEtC,uDAIkC;AAKlC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChE,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,MAAsB;IAEtB,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,QAAQ,GAAoB,IAAI,yBAAc,CAChD,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,QAAQ,GAAG,IAAI,2BAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,yBAAc,CAAC,QAAQ,EAAE;gBACtC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CACrB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,IAAA,qBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAC7C;aACJ,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}