@schlenkr/ragents 0.1.5 → 0.1.7

package/apps/server/src/plugin-support/model-choice.ts

@@ -1,6 +1,7 @@
-import { getSupportedThinkingLevels, type Api, type Model } from "@aicontainer/ai";
-import { getBuiltinModels, type BuiltinProvider } from "@aicontainer/ai/providers/all";
-import { isThinkingLevel, thinkingLevels, type ThinkingLevel } from "@aicontainer/ragents";
+import { getSupportedThinkingLevels, type Api, type Model } from "@ragents/ai";
+import { getBuiltinModels, type BuiltinProvider } from "@ragents/ai/providers/all";
+import { isThinkingLevel, thinkingLevels, type ThinkingLevel } from "@ragents/engine";
+import { ALIAS_PROVIDER, aliasCatalog, modelDefaultThinking } from "./model-aliases.js";
 import type { DeclaredEnvironment } from "./plugin-config.js";
 
 export type ModelCatalogSource = () => readonly Model<Api>[];
@@ -8,7 +9,11 @@ export type ModelCatalogSource = () => readonly Model<Api>[];
 /** Der eingebaute Katalog eines Anbieters; ein Plugin kann einen eigenen Katalog liefern, etwa den eines Relays. */
 export const builtinCatalog = (provider: string): ModelCatalogSource => () => getBuiltinModels(provider as BuiltinProvider);
 
-export const modelThinkingOptions = (provider: string, model: string, catalog: ModelCatalogSource = builtinCatalog(provider)): readonly ThinkingLevel[] => {
+/** Der Katalog, den die Modelllaufzeit für einen Anbieter kennt: die Aliasse des Profils oder den eingebauten. */
+const providerCatalog = (provider: string): ModelCatalogSource =>
+  provider === ALIAS_PROVIDER ? () => aliasCatalog() : builtinCatalog(provider);
+
+export const modelThinkingOptions = (provider: string, model: string, catalog: ModelCatalogSource = providerCatalog(provider)): readonly ThinkingLevel[] => {
   const metadata = catalog().find((entry) => entry.id === model);
   if (!metadata) throw new Error(`Das Modell ${provider}/${model} fehlt im Modellkatalog`);
   return getSupportedThinkingLevels(metadata);
@@ -20,6 +25,8 @@ export interface ModelChoice {
   readonly provider: string;
   readonly selectable: boolean;
   thinkingOptionsFor(model: string | null): readonly ThinkingLevel[];
+  /** Die Denktiefe, die ein Modell mitbringt, wenn es gewählt wird; ohne Angabe gilt die des Koordinators. */
+  defaultThinkingFor?(model: string): ThinkingLevel | undefined;
 }
 
 export const modelChoiceEnvDescriptors = [
@@ -40,7 +47,7 @@ export const modelChoiceFromEnvironment = (
     catalog?: ModelCatalogSource;
   },
 ): ModelChoice => {
-  const catalog = defaults.catalog ?? builtinCatalog(defaults.provider);
+  const catalog = defaults.catalog ?? providerCatalog(defaults.provider);
   const raw = env.optional("MODEL_SELECTABLE");
   if (raw !== undefined && raw !== "" && raw !== "0" && raw !== "1") {
     throw new Error(`MODEL_SELECTABLE muss "0" oder "1" sein, nicht "${raw}"`);
@@ -50,9 +57,11 @@ export const modelChoiceFromEnvironment = (
   const options = (): readonly string[] => {
     if (resolvedOptions) return resolvedOptions;
     const configured = env.list("AGENT_MODELS");
-    const list = configured.length > 0 ? configured : defaults.fallback();
-    const duplicate = list.find((model, index) => list.indexOf(model) !== index);
+    const duplicate = configured.find((model, index) => configured.indexOf(model) !== index);
     if (duplicate) throw new Error(`AGENT_MODELS nennt ${duplicate} mehrfach`);
+    // Ohne AGENT_MODELS gelten alle Aliasse oder die Modelle des Profils, und Agent und Koordinator dürfen dasselbe haben.
+    const fallback = defaults.provider === ALIAS_PROVIDER ? catalog().map((model) => model.id) : defaults.fallback();
+    const list = configured.length > 0 ? configured : [...new Set(fallback)];
     resolvedOptions = Object.freeze([...list]);
     return resolvedOptions;
   };
@@ -105,5 +114,6 @@ export const modelChoiceFromEnvironment = (
       const selected = model ?? defaultModel();
       return reasoningMap().get(selected) ?? modelThinkingOptions(defaults.provider, selected, catalog);
     },
+    defaultThinkingFor: (model: string) => modelDefaultThinking(defaults.provider, model),
   });
 };

package/apps/server/src/plugin-support/model-completion.ts

@@ -0,0 +1,58 @@
+import { createModels, getSupportedThinkingLevels, type Api, type Model } from "@ragents/ai";
+import { openrouterProvider } from "@ragents/ai/providers/openrouter";
+import type { ThinkingLevel } from "@ragents/engine";
+
+/** One question to a model, without history and without tools. */
+export interface TextCompletionRequest {
+  readonly systemPrompt: string;
+  readonly text: string;
+  readonly thinking: ThinkingLevel;
+  readonly temperature: number;
+  readonly maxTokens: number;
+  readonly timeoutMs: number;
+  readonly signal: AbortSignal;
+}
+
+/** Text only when the model finished and answered with nothing but text; a cut, failed or aborted answer is unfinished. */
+export type TextCompletion =
+  | { readonly kind: "text"; readonly text: string }
+  | { readonly kind: "unfinished" }
+  | { readonly kind: "not-text" };
+
+export interface CompletionModel {
+  readonly id: string;
+  readonly thinkingLevels: readonly ThinkingLevel[];
+  readonly complete: (request: TextCompletionRequest) => Promise<TextCompletion>;
+}
+
+/** An OpenRouter model of the built-in catalog that answers over the fastest provider and never retries; the key comes from OPENROUTER_API_KEY. */
+export const openRouterCompletionModel = (id: string): CompletionModel | undefined => {
+  const models = createModels();
+  models.setProvider(openrouterProvider());
+  const selected = models.getModel("openrouter", id);
+  if (!selected) return undefined;
+  const model: Model<Api> = { ...selected, compat: { ...selected.compat,
+    openRouterRouting: { ...selected.compat?.openRouterRouting, sort: "latency" },
+  } };
+  return {
+    id,
+    thinkingLevels: getSupportedThinkingLevels(selected),
+    complete: async (request) => {
+      const response = await models.completeSimple(model, {
+        systemPrompt: request.systemPrompt,
+        messages: [{ role: "user", content: request.text, timestamp: Date.now() }],
+      }, {
+        // An omitted effort is the off setting of the model; OpenRouter gets it explicitly.
+        reasoning: request.thinking === "off" ? undefined : request.thinking,
+        temperature: request.temperature,
+        maxTokens: request.maxTokens,
+        maxRetries: 0,
+        timeoutMs: request.timeoutMs,
+        signal: request.signal,
+      });
+      if (response.stopReason !== "stop") return { kind: "unfinished" };
+      if (response.content.some((part) => part.type !== "text" && part.type !== "thinking")) return { kind: "not-text" };
+      return { kind: "text", text: response.content.flatMap((part) => part.type === "text" ? [part.text] : []).join("") };
+    },
+  };
+};

package/apps/server/src/plugin-support/model-upstreams.ts

@@ -1,5 +1,5 @@
-import type { Api, Model } from "@aicontainer/ai";
-import { serviceToken, type ServiceToken } from "@aicontainer/ragents";
+import type { Api, Model } from "@ragents/ai";
+import { serviceToken, type ServiceToken } from "@ragents/engine";
 
 /** Ein Modellanbieter, den dieser Server mit eigenem Schlüssel erreicht; das Relay reicht Aufrufe dorthin durch. */
 export interface ModelUpstream {

package/apps/server/src/plugin-support/native-typescript-executor.ts

@@ -3,14 +3,15 @@ import { mkdir, realpath, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "esbuild";
-import type { NativeTypeScriptBinding, NativeTypeScriptExecutor, NativeTypeScriptRequest, NativeTypeScriptResult } from "@aicontainer/ragents";
-import type { JsonValue } from "@aicontainer/ragents";
-import { startManagedService, type ManagedService, type WorkspaceProcessContext } from "@aicontainer/workspace-executor";
+import type { NativeTypeScriptBinding, NativeTypeScriptExecutor, NativeTypeScriptRequest, NativeTypeScriptResult } from "@ragents/engine";
+import type { JsonValue } from "@ragents/engine";
+import { sandboxedLaunch, startManagedService, type ManagedService, type WorkspaceProcessContext } from "@ragents/workspace-executor";
 import { syncWorkspaceOwnership } from "./workspace-ownership.js";
 
 interface ExecutorOptions {
   directoryFor(runId: string): string;
-  processContextFor(runId: string): Promise<WorkspaceProcessContext>;
+  /** Die Node-Ausführung läuft immer auf dem Server, auch bei einem Arbeitsbereich auf einem Arbeitsplatz. */
+  serverProcessContextFor(runId: string): Promise<WorkspaceProcessContext>;
 }
 interface Backend {
   runId: string;
@@ -75,7 +76,7 @@ export class NodeTypeScriptExecutor implements NativeTypeScriptExecutor {
 
   async #start(request: NativeTypeScriptRequest, instanceId: string, fingerprint: string, controller: AbortController, callerSignal?: AbortSignal): Promise<Backend> {
     const signal = callerSignal ? AbortSignal.any([controller.signal, callerSignal]) : controller.signal;
-    const processContext = await this.#options.processContextFor(request.context.runId);
+    const processContext = await this.#options.serverProcessContextFor(request.context.runId);
     signal.throwIfAborted();
     const directory = path.join(this.#options.directoryFor(request.context.runId), createHash("sha256").update(instanceId).digest("hex"), fingerprint);
     await mkdir(directory, { recursive: true });
@@ -121,9 +122,11 @@ export class NodeTypeScriptExecutor implements NativeTypeScriptExecutor {
       backend.reject(error);
       backend.service.kill("SIGKILL");
     };
+    const launch = await sandboxedLaunch(processContext, { command: process.execPath, args: [path.join(directory, "__runner.mjs")] });
+    signal.throwIfAborted();
     backend.service = startManagedService({
-      command: process.execPath,
-      args: [path.join(directory, "__runner.mjs")],
+      command: launch.command,
+      args: [...launch.args],
       cwd: request.cwd ?? processContext.cwd,
       env: { ...processContext.env, RAGENTS_RUN_ID: request.context.runId },
       uid: processContext.uid, gid: processContext.gid,

package/apps/server/src/plugin-support/plugin-config.ts

@@ -1,4 +1,4 @@
-import type { PluginConfigDescriptor } from "@aicontainer/ragents";
+import type { PluginConfigDescriptor } from "@ragents/engine";
 import { listFromEnvironmentValue } from "../config-file.js";
 
 export interface DeclaredEnvironment<Key extends string> {

package/apps/server/src/plugin-support/plugin-folder.ts

@@ -5,7 +5,7 @@ import type {
   RAgentsPlugin,
   SkillContribution,
   StartEntryContribution,
-} from "@aicontainer/ragents";
+} from "@ragents/engine";
 import { skillsFromDirectory, type FolderSkills } from "./skills.js";
 import { pluginFolder } from "./plugins-root.js";
 import { runScriptsFromDirectory, type ScriptStartEntry } from "./run-scripts.js";
@@ -13,6 +13,9 @@ import { systemPromptOptionsFromDirectory, type SystemPromptOption } from "./sys
 
 export { pluginFolder };
 
+/** A file shipped in the plugin folder; code never locates it through its own module path. */
+export const pluginAsset = (pluginId: string, name: string): string => path.join(pluginFolder(pluginId), name);
+
 const assetFolder = (folder: string, name: string): string | undefined => {
   const directory = path.join(folder, name);
   const stats = statSync(directory, { throwIfNoEntry: false });

package/apps/server/src/plugin-support/plugin-module.ts

@@ -1,4 +1,4 @@
-import type { PluginHost, RAgentsPlugin } from "@aicontainer/ragents";
+import type { PluginHost, RAgentsPlugin } from "@ragents/engine";
 
 export interface PluginModule {
   readonly requires?: readonly string[];

package/apps/server/src/plugin-support/plugins-root.ts

@@ -3,15 +3,17 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-export const PLUGIN_SERVER_FOLDER = "server";
-
 export const pluginsRoot = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)), "../../../../plugins");
 
+/** The built-in plugins as bundles, built by pnpm build:plugins; an id in PLUGINS names a folder here. */
+export const bundlesRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)), "../../../../bundles");
+
 export const isPluginPath = (entry: string): boolean => /^(\.{1,2}\/|\/|~\/)/.test(entry);
 
-/** A profile names a plugin by id (a folder under plugins/) or by a path, relative to the profile file. */
-export const pluginFolderFor = (entry: string, base: string, root = pluginsRoot): string => {
+/** A profile names a plugin by id (a folder under bundles/) or by a path, relative to the profile file. */
+export const pluginFolderFor = (entry: string, base: string, root = bundlesRoot): string => {
   if (!isPluginPath(entry)) return path.join(root, entry);
   const expanded = entry.startsWith("~/") ? path.join(homedir(), entry.slice(2)) : entry;
   return path.resolve(base, expanded);
@@ -19,12 +21,6 @@ export const pluginFolderFor = (entry: string, base: string, root = pluginsRoot)
 
 export const pluginIdOf = (folder: string): string => path.basename(folder);
 
-export const WEB_ENTRY_FILES = ["web/index.ts", "web/index.tsx"] as const;
-
-export const webEntryOf = (folder: string): string | undefined =>
-  WEB_ENTRY_FILES.map((name) => path.join(folder, name))
-    .find((candidate) => statSync(candidate, { throwIfNoEntry: false })?.isFile() === true);
-
 const folders = new Map<string, string>();
 
 export const registerPluginFolder = (id: string, folder: string): void => {

package/apps/server/src/plugin-support/process-sandbox.ts

@@ -0,0 +1,312 @@
+import { spawn } from "node:child_process";
+import { existsSync, readdirSync, realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { SandboxManager, type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
+import { containsWorkspacePath, type ProcessLaunch, type ProcessSandbox } from "@ragents/workspace-executor";
+import { hostRoot } from "../host-version.js";
+
+/** Paketquellen und Git-Hosting, die Builds im Arbeitsbereich brauchen; der eigene Server kommt immer dazu. */
+export const PROCESS_SANDBOX_DEFAULT_NETWORK: readonly string[] = [
+  "registry.npmjs.org",
+  "api.nuget.org",
+  "globalcdn.nuget.org",
+  "github.com",
+  "*.github.com",
+  "*.githubusercontent.com",
+];
+
+/** Die Ordner eines Runs, aus denen seine Regeln entstehen; alles andere unter den geschützten Wurzeln bleibt ihm verborgen. */
+export interface RunSandboxFolders {
+  readonly writable: readonly string[];
+  readonly readable: readonly string[];
+  /** Der eigene Temp-Ordner des Runs; er ist beschreibbar und steht in TMPDIR. */
+  readonly temporary: string;
+}
+
+/** Was der Sandbox-Host je Run von der Prozess-Sandbox braucht. */
+export interface RunProcessSandboxes {
+  readonly forRun: (folders: RunSandboxFolders) => ProcessSandbox;
+}
+
+export interface ServerProcessSandboxOptions {
+  /** Erlaubte Ziele im Netz, Domains wie in der Profildatei; alles andere scheitert am Proxy. */
+  readonly network: readonly string[];
+  /** Die Adresse dieses Servers, etwa http://127.0.0.1:4710; ohne HTTP keine. */
+  readonly serverAddress: string | undefined;
+  readonly dataDirectory: string;
+  readonly hostRoot?: string;
+  readonly platform?: NodeJS.Platform;
+  readonly environment?: NodeJS.ProcessEnv;
+}
+
+const SELF_TEST_TIMEOUT_MS = 30_000;
+
+const shellWord = (value: string): string => `'${value.replaceAll("'", "'\\''")}'`;
+
+const shellCommand = (words: readonly string[]): string => words.map(shellWord).join(" ");
+
+/** Die Umgebung innerhalb der Sandbox: eigener Temp-Ordner, und jeder Netzaufruf geht über den Proxy, auch der zum eigenen Server. */
+const insideEnvironment = (temporary: string, searchPath: string, platform: NodeJS.Platform): readonly string[] => [
+  `PATH=${searchPath}`,
+  `TMPDIR=${temporary}`,
+  `TMP=${temporary}`,
+  `TEMP=${temporary}`,
+  "NO_PROXY=",
+  "no_proxy=",
+  "NODE_USE_ENV_PROXY=1",
+  // .NET verbindet sich sonst über IPv4-gemappte IPv6-Adressen mit dem Proxy, die die Sandbox von macOS nicht als localhost erkennt.
+  "DOTNET_SYSTEM_NET_DISABLEIPV6=1",
+  // Build-Knoten und Compiler-Server von .NET überleben den Befehl und nähmen sonst Builds anderer Runs in ihrer eigenen Sandbox an.
+  "MSBUILDDISABLENODEREUSE=1",
+  "DOTNET_CLI_USE_MSBUILD_SERVER=0",
+  "UseSharedCompilation=false",
+  // Die Werkzeug-Shims von macOS (git, clang) legen ihren Cache sonst im gesperrten Temp des Servers an.
+  ...platform === "darwin" ? [`xcrun_db=${path.join(temporary, "xcrun_db")}`] : [],
+];
+
+const serverTarget = (address: string | undefined): readonly string[] => {
+  if (address === undefined) return [];
+  const url = new URL(address);
+  return [`${url.hostname}:${url.port}`];
+};
+
+const homeRoots = (platform: NodeJS.Platform): readonly string[] =>
+  platform === "darwin" ? ["/Users"] : ["/home", "/root"];
+
+/** Der echte Pfad, auch für einen Ordner, den es noch nicht gibt: sein nächster vorhandener Vorfahr wird aufgelöst. */
+const realOrGiven = (entry: string): string => {
+  try {
+    return realpathSync(entry);
+  } catch {
+    const parent = path.dirname(entry);
+    return parent === entry ? entry : path.join(realOrGiven(parent), path.basename(entry));
+  }
+};
+
+/** Ein Eintrag ist oft ein Symlink (fnm, Homebrew, /tmp unter macOS); die Sandbox prüft das Ziel. */
+const resolvedTarget = (entry: string): readonly string[] => {
+  const target = realOrGiven(entry);
+  return target === entry ? [] : [target];
+};
+
+/** Unter Linux sind alle Unix-Sockets erlaubt; die Sockets, die aus der Sandbox hinausführen, bleiben deshalb unsichtbar. */
+const hostSockets = (platform: NodeJS.Platform): readonly string[] =>
+  platform === "linux" ? ["/var/run/docker.sock", "/run/docker.sock"].filter((socket) => existsSync(socket)) : [];
+
+/** Wo Geheimnisse und fremde Runs liegen können: Home-Ordner, Temp und der Datenordner des Servers. */
+const protectedRoots = (options: ServerProcessSandboxOptions, platform: NodeJS.Platform): readonly string[] => [
+  os.homedir(),
+  ...homeRoots(platform),
+  os.tmpdir(),
+  "/tmp",
+  options.dataDirectory,
+  ...hostSockets(platform),
+].map(realOrGiven);
+
+/** Was sich alle Runs teilen müssen: unter macOS legen .NET seine benannten Mutexe und MSBuild die Sockets seiner Build-Knoten fest unter /tmp an; unter Linux ist /tmp je Befehl ein eigener leerer Ordner. */
+const sharedWritable = (platform: NodeJS.Platform): readonly string[] => platform === "darwin"
+  ? [".dotnet", `.dotnet-uid${os.userInfo().uid}`, "MSBuild*"].map((name) => path.join(realOrGiven("/tmp"), name))
+  : [];
+
+/** Wo Prozesse der Sandbox Unix-Sockets anlegen und erreichen: im Datenordner (Temp der Runs) und unter macOS in /tmp für die Build-Knoten von MSBuild. */
+const socketRoots = (dataDirectory: string, platform: NodeJS.Platform): readonly string[] =>
+  [dataDirectory, ...platform === "darwin" ? ["/tmp"] : []].map(realOrGiven);
+
+/** Die Sandbox liest einen Symlink in einem gesperrten Ordner nicht (etwa fnm unter ~/.local/state); PATH nennt deshalb die Ziele. */
+const resolvedSearchPath = (environment: NodeJS.ProcessEnv): string =>
+  [...new Set((environment.PATH ?? "").split(path.delimiter).filter((entry) => entry !== "").map(realOrGiven))].join(path.delimiter);
+
+const isInside = (root: string, candidate: string): boolean => containsWorkspacePath(root, candidate);
+
+const entriesOf = (directory: string): readonly string[] => {
+  try {
+    return readdirSync(directory).map((name) => path.join(directory, name));
+  } catch {
+    return [];
+  }
+};
+
+/** Ein freigegebener Ordner, der einen gesperrten enthält, wird in seine übrigen Einträge zerlegt; sonst hebelte er die Sperre aus oder die Sperre die Freigaben darin. */
+const besideProtected = (entry: string, hidden: readonly string[]): readonly string[] => {
+  if (hidden.some((root) => isInside(root, entry))) return [];
+  if (!hidden.some((root) => isInside(entry, root))) return [entry];
+  return entriesOf(entry).flatMap((child) => besideProtected(child, hidden));
+};
+
+/** Bubblewrap bindet lesbare Ordner nach den beschreibbaren ein; ein lesbarer Vorfahr überdeckte einen beschreibbaren Ordner darin schreibgeschützt und wird deshalb in seine übrigen Einträge zerlegt. */
+const readableBeside = (entry: string, writable: readonly string[]): readonly string[] => {
+  const inside = writable.filter((candidate) => isInside(entry, candidate));
+  if (inside.length === 0) return [entry];
+  if (inside.includes(entry)) return [];
+  return entriesOf(entry).flatMap((child) => readableBeside(child, inside));
+};
+
+/** Toolchains unter einem geschützten Ordner (etwa Node aus fnm oder dotnet-Werkzeuge im Home) bleiben lesbar, nie aber ein Vorfahr des Datenordners. */
+const toolchainDirectories = (options: ServerProcessSandboxOptions, protectedPaths: readonly string[]): readonly string[] => {
+  const environment = options.environment ?? process.env;
+  const entries = [
+    ...(environment.PATH ?? "").split(path.delimiter),
+    environment.DOTNET_ROOT,
+    environment.PNPM_HOME,
+    path.dirname(path.dirname(process.execPath)),
+  ].filter((entry): entry is string => entry !== undefined && path.isAbsolute(entry));
+  const withTargets = entries.flatMap((entry) => [entry, ...resolvedTarget(entry)]);
+  const withPrefixes = withTargets.flatMap((entry) => path.basename(entry) === "bin" ? [entry, path.dirname(entry)] : [entry]);
+  const underProtected = withPrefixes.filter((entry) => protectedPaths.some((root) => isInside(root, entry)));
+  const safe = underProtected.filter((entry) => !protectedPaths.some((root) => isInside(entry, root)));
+  return [...new Set(safe)];
+};
+
+/** Was ein Server der Sandbox für alle seine Runs freigibt: Netzziele und die Ordner, in denen Unix-Sockets liegen dürfen. */
+interface SandboxGrant {
+  readonly network: readonly string[];
+  readonly unixSockets: readonly string[];
+}
+
+/** Die Bibliothek hat genau einen Zustand je Prozess; mehrere Hosts in einem Prozess teilen ihn, ihre Netzfreigaben werden vereinigt. */
+class SharedSandboxRuntime {
+  readonly #holders = new Map<object, SandboxGrant>();
+  #started: Promise<void> | undefined;
+
+  #config(): SandboxRuntimeConfig {
+    const grants = [...this.#holders.values()];
+    return {
+      network: {
+        allowedDomains: [...new Set(grants.flatMap((grant) => grant.network))],
+        deniedDomains: [],
+        allowUnixSockets: [...new Set(grants.flatMap((grant) => grant.unixSockets))],
+        // Linux kann Unix-Sockets nur ganz oder gar nicht sperren; die Build-Werkzeuge (MSBuild-Knoten) brauchen sie.
+        ...process.platform === "linux" ? { allowAllUnixSockets: true } : {},
+      },
+      filesystem: { denyRead: [], allowWrite: [], denyWrite: [], allowGitConfig: true },
+      // Unter macOS prüfen .NET und Go Zertifikate über trustd; ohne diesen Dienst scheitert jedes TLS.
+      ...process.platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {},
+    };
+  }
+
+  async acquire(holder: object, grant: SandboxGrant): Promise<void> {
+    this.#holders.set(holder, grant);
+    if (!this.#started) {
+      this.#started = SandboxManager.initialize(this.#config());
+      await this.#started.catch((error: unknown) => {
+        this.#holders.delete(holder);
+        this.#started = undefined;
+        throw error;
+      });
+      return;
+    }
+    await this.#started;
+    SandboxManager.updateConfig(this.#config());
+  }
+
+  async release(holder: object): Promise<void> {
+    if (!this.#holders.delete(holder)) return;
+    if (this.#holders.size > 0) {
+      SandboxManager.updateConfig(this.#config());
+      return;
+    }
+    this.#started = undefined;
+    await SandboxManager.reset();
+  }
+}
+
+const sharedRuntime = new SharedSandboxRuntime();
+
+const unsupported = (platform: NodeJS.Platform): Error => new Error(platform === "win32"
+  ? "Die Prozess-Sandbox gibt es auf einem Windows-Server nicht: dort lassen sich die Ordnerregeln je Run nicht setzen. "
+    + "Wer den Server trotzdem unter Windows betreibt, schaltet sie in der Profildatei ausdrücklich ab: "
+    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace."
+  : `Die Prozess-Sandbox kennt die Plattform ${platform} nicht; unterstützt sind macOS und Linux. `
+    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+
+const missingDependencies = (errors: readonly string[]): Error => new Error(
+  `Die Prozess-Sandbox kann nicht starten: ${errors.join("; ")}. `
+  + "Unter Linux braucht sie bubblewrap, socat und ripgrep (Debian/Ubuntu: apt-get install bubblewrap socat ripgrep). "
+  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+
+const failedSelfTest = (detail: string): Error => new Error(
+  `Die Prozess-Sandbox lässt sich auf diesem Rechner nicht starten: ${detail.trim() || "ohne Ausgabe"}. `
+  + "Unter Linux braucht bubblewrap Benutzer-Namensräume; in einem Container muss das Profil des Containers sie erlauben. "
+  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+
+const runSelfTest = (launch: ProcessLaunch, environment: NodeJS.ProcessEnv): Promise<void> => new Promise((resolve, reject) => {
+  const child = spawn(launch.command, [...launch.args], { stdio: ["ignore", "ignore", "pipe"], env: environment });
+  let stderr = "";
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    reject(failedSelfTest(`keine Antwort nach ${SELF_TEST_TIMEOUT_MS / 1000} Sekunden`));
+  }, SELF_TEST_TIMEOUT_MS);
+  child.stderr.on("data", (chunk: Buffer) => { stderr = (stderr + chunk.toString("utf8")).slice(-2_000); });
+  child.once("error", (error) => {
+    clearTimeout(timer);
+    reject(failedSelfTest(error.message));
+  });
+  child.once("close", (code) => {
+    clearTimeout(timer);
+    if (code === 0) resolve();
+    else reject(failedSelfTest(`Code ${code ?? "Signal"}: ${stderr}`));
+  });
+});
+
+/** Die Prozess-Sandbox des Servers: jeder Prozess eines Runs, den der Executor des Servers startet, läuft mit den Ordnern und Netzzielen seines Runs. */
+export class ServerProcessSandbox implements RunProcessSandboxes {
+  readonly #options: ServerProcessSandboxOptions;
+  readonly #platform: NodeJS.Platform;
+  readonly #protected: readonly string[];
+  readonly #readable: readonly string[];
+  readonly #searchPath: string;
+
+  constructor(options: ServerProcessSandboxOptions) {
+    this.#options = options;
+    this.#platform = options.platform ?? process.platform;
+    if (this.#platform !== "darwin" && this.#platform !== "linux") throw unsupported(this.#platform);
+    this.#protected = protectedRoots(options, this.#platform);
+    this.#readable = [options.hostRoot ?? hostRoot(), ...toolchainDirectories(options, this.#protected)];
+    this.#searchPath = resolvedSearchPath(options.environment ?? process.env);
+  }
+
+  /** Prüft die Voraussetzungen, startet den Netz-Proxy und startet einmal einen Prozess in der Sandbox; jedes Scheitern ist ein Startfehler. */
+  async start(): Promise<void> {
+    const { errors } = SandboxManager.checkDependencies();
+    if (errors.length > 0) throw missingDependencies(errors);
+    await sharedRuntime.acquire(this, {
+      network: [...this.#options.network, ...serverTarget(this.#options.serverAddress)],
+      unixSockets: socketRoots(this.#options.dataDirectory, this.#platform),
+    });
+    try {
+      const probe = this.forRun({ writable: [], readable: [], temporary: path.join(this.#options.dataDirectory, "sandbox-self-test") });
+      await runSelfTest(await probe.wrap({ command: "true", args: [] }), this.#options.environment ?? process.env);
+    } catch (error) {
+      await sharedRuntime.release(this);
+      throw error;
+    }
+  }
+
+  stop(): Promise<void> {
+    return sharedRuntime.release(this);
+  }
+
+  forRun(folders: RunSandboxFolders): ProcessSandbox {
+    const bridges = [SandboxManager.getLinuxHttpSocketPath(), SandboxManager.getLinuxSocksSocketPath()]
+      .filter((socket): socket is string => socket !== undefined);
+    const environment = insideEnvironment(folders.temporary, this.#searchPath, this.#platform);
+    const allowed = (entries: readonly string[]): readonly string[] => entries.map(realOrGiven)
+      .flatMap((entry) => besideProtected(entry, this.#protected.filter((root) => !isInside(root, entry))));
+    return {
+      wrap: async (launch) => {
+        const writable = allowed([...folders.writable, folders.temporary, ...sharedWritable(this.#platform)]);
+        const readable = allowed([...this.#readable, ...folders.readable]).flatMap((entry) => readableBeside(entry, writable));
+        const filesystem = {
+          denyRead: [...this.#protected],
+          allowRead: [...bridges, ...readable, ...writable],
+          allowWrite: [...writable],
+          denyWrite: [],
+        };
+        const inner = shellCommand(["env", ...environment, launch.command, ...launch.args]);
+        const wrapped = await SandboxManager.wrapWithSandbox(inner, undefined, { filesystem });
+        return { command: "/bin/sh", args: ["-c", wrapped] };
+      },
+    };
+  }
+}

package/apps/server/src/plugin-support/product-model-settings-contract.ts

@@ -1,7 +1,16 @@
 import { Type } from "typebox";
-import { defineOperation } from "@aicontainer/ragents/src/rpc/contract";
-import { openJson } from "@aicontainer/ragents/src/http/contracts";
-import type { ProductModelDraft, ProductModelSettings } from "../../../../plugins/ragents.product/model-settings-contract.js";
+import { defineOperation } from "@ragents/engine/src/rpc/contract";
+import { openJson } from "@ragents/engine/src/http/contracts";
+import type { ThinkingLevel } from "@ragents/engine/src/domain/driver";
+
+export interface ProductModelDraft {
+  profiles: { name: string; model: string; thinking: ThinkingLevel }[];
+}
+
+export interface ProductModelSettings {
+  profiles: (ProductModelDraft["profiles"][number] & { description: string; provider: string })[];
+  models: { id: string; provider: string; label: string; thinking: readonly ThinkingLevel[] }[];
+}
 
 const settings = openJson<ProductModelSettings>("ProductModelSettings");
 
@@ -9,14 +18,14 @@ const settings = openJson<ProductModelSettings>("ProductModelSettings");
 export const productModelSettingsContracts = (pluginId: string) => ({
   read: defineOperation({
     id: `${pluginId}.modelSettings.read`,
-    description: "Die Modellvorgaben der Agentprofile mit dem verfügbaren Modellkatalog. Recht: settings.read.",
+    description: "Die Modellvorgaben der Rollen mit dem verfügbaren Modellkatalog. Recht: settings.read.",
     rights: ["settings.read"],
     input: Type.Object({}, { additionalProperties: false }),
     result: settings,
   }),
   save: defineOperation({
     id: `${pluginId}.modelSettings.save`,
-    description: "Die Modellvorgaben der Agentprofile speichern. Rechte: settings.read und settings.write.",
+    description: "Die Modellvorgaben der Rollen speichern. Rechte: settings.read und settings.write.",
     rights: ["settings.read", "settings.write"],
     input: Type.Object({ value: openJson<ProductModelDraft>("ProductModelDraft") }, { additionalProperties: false }),
     result: settings,

package/apps/server/src/plugin-support/product-model-settings.ts

@@ -1,10 +1,10 @@
 import { readFileSync, renameSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { DomainError, implement, isThinkingLevel, type AgentProfile, type MethodContribution, type ThinkingLevel } from "@aicontainer/ragents";
-import type { ProductModelDraft, ProductModelSettings } from "../../../../plugins/ragents.product/model-settings-contract.js";
+import { DomainError, implement, isThinkingLevel, type AgentProfile, type MethodContribution, type ThinkingLevel } from "@ragents/engine";
+import { modelLabel } from "./model-aliases.js";
 import type { ModelChoice } from "./model-choice.js";
-import { productModelSettingsContracts } from "./product-model-settings-contract.js";
+import { productModelSettingsContracts, type ProductModelDraft, type ProductModelSettings } from "./product-model-settings-contract.js";
 
 type AgentModelProfile = Extract<AgentProfile, { driver: "agent" }>;
 
@@ -42,6 +42,7 @@ export class ProductModelSettingsStore {
       get selectable() { return choice.selectable; },
       get defaultModel() { return store.#selection("coordinator").model; },
       thinkingOptionsFor: (model) => choice.thinkingOptionsFor(model ?? store.#selection("coordinator").model),
+      ...(choice.defaultThinkingFor ? { defaultThinkingFor: choice.defaultThinkingFor } : {}),
     };
   }
 
@@ -61,7 +62,7 @@ export class ProductModelSettingsStore {
       profiles: this.profiles().filter((profile): profile is AgentModelProfile => profile.driver === "agent")
         .map(({ name, description, provider, model, thinking }) => ({ name, description, provider, model, thinking: thinking! })),
       models: this.#choice.options.map((id) => ({
-        id, provider: this.#choice.provider, label: `${this.#choice.provider}/${id}`,
+        id, provider: this.#choice.provider, label: modelLabel(this.#choice.provider, id),
         thinking: [...this.#choice.thinkingOptionsFor(id)],
       })),
     };
@@ -86,22 +87,22 @@ export class ProductModelSettingsStore {
 
   #selection(name: string): ProductModelDraft["profiles"][number] {
     const selected = this.#current.profiles.find((profile) => profile.name === name);
-    if (!selected) throw invalid(`Das Agentprofil ${name} hat keine Modellvorgabe.`);
+    if (!selected) throw invalid(`Die Rolle ${name} hat keine Modellvorgabe.`);
     return selected;
   }
 
   #validate(value: unknown): ProductModelDraft {
     const { profiles } = objectOf(value, ["profiles"]);
     const expected = this.#agentProfiles();
-    if (!Array.isArray(profiles) || profiles.length !== expected.length) throw invalid(`Vollständig erforderlich sind die Agentprofile: ${expected.map((profile) => profile.name).join(", ")}.`);
+    if (!Array.isArray(profiles) || profiles.length !== expected.length) throw invalid(`Vollständig erforderlich sind die Rollen: ${expected.map((profile) => profile.name).join(", ")}.`);
     const seen = new Set<string>();
     const validated = profiles.map((item: unknown) => {
       const entry = objectOf(item, ["name", "model", "thinking"]);
       const profile = expected.find((candidate) => candidate.name === entry.name);
-      if (!profile) throw invalid(`Unbekanntes Agentprofil ${String(entry.name)}.`);
-      if (seen.has(profile.name)) throw invalid(`Das Agentprofil ${profile.name} steht doppelt.`);
+      if (!profile) throw invalid(`Unbekannte Rolle ${String(entry.name)}.`);
+      if (seen.has(profile.name)) throw invalid(`Die Rolle ${profile.name} steht doppelt.`);
       seen.add(profile.name);
-      if (profile.provider !== this.#choice.provider) throw invalid(`Das Agentprofil ${profile.name} verwendet einen anderen Provider.`);
+      if (profile.provider !== this.#choice.provider) throw invalid(`Die Rolle ${profile.name} verwendet einen anderen Provider.`);
       if (typeof entry.model !== "string" || !this.#choice.options.includes(entry.model)) throw invalid(`Das Modell ${String(entry.model)} steht nicht zur Wahl.`);
       const allowed = this.#choice.thinkingOptionsFor(entry.model);
       if (!isThinkingLevel(entry.thinking) || !allowed.includes(entry.thinking)) throw invalid(`Die Denktiefe ${String(entry.thinking)} ist für ${entry.model} nicht verfügbar (gültig: ${allowed.join(", ")}).`);