@struktoai/mirage-node 0.0.7-alpha.2 → 0.0.7-alpha.3

package/dist/runtime/sandbox/docker/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/config.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAElF,iDAAiD;AACjD,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAyB,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAEpG,iDAAiD;AACjD,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAuC,CAAA"}

package/dist/runtime/sandbox/docker/config.js

@@ -11,5 +11,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 // ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
-export const DOCKER_CONFIG_KEYS = ['env', 'container'];
+import { BASE_CONFIG_KEYS } from '@struktoai/mirage-core/runtime/sandbox/config';
+export const DOCKER_CONFIG_KEYS = [...BASE_CONFIG_KEYS, 'container'];
 //# sourceMappingURL=config.js.map

package/dist/runtime/sandbox/docker/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAevE,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,gBAAgB,EAAsB,MAAM,+CAA+C,CAAA;AAapG,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,GAAG,gBAAgB,EAAE,WAAW,CAAC,CAAA"}

package/dist/runtime/sandbox/docker/runtime.d.ts

@@ -1,11 +1,8 @@
 import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
-import type { RunResult, RuntimeOptions } from '@struktoai/mirage-core/runtime/types';
+import type { RunResult, SandboxPipe } from '@struktoai/mirage-core/runtime/types';
+import type { RuntimeOptions } from '@struktoai/mirage-core/runtime/config';
 import { type DockerConfig } from './config.ts';
-interface DockerResult {
-    stdout: Uint8Array;
-    stderr: Uint8Array;
-    code: number;
-}
+import { type CliResult } from '../cli.ts';
 /**
  * A container the user runs as a whole-line runtime.
  *
@@ -13,15 +10,15 @@ interface DockerResult {
  * execs lines. The docker CLI is the transport (Docker Desktop,
  * colima, or a podman alias all work), so there is no SDK dependency
  * and no daemon socket wiring; each line is one `docker exec -i` with
- * the merged environment, the rebased cwd, real stdin, and separated
+ * the merged environment, the session cwd, real stdin, and separated
  * stderr.
  */
 export declare class DockerRuntime extends RemoteSandbox<DockerConfig> {
     readonly name = "docker";
-    constructor(options?: RuntimeOptions<DockerConfig> | Record<string, unknown>);
-    protected docker(args: string[], stdin?: Uint8Array | null): Promise<DockerResult>;
+    constructor(options?: RuntimeOptions<DockerConfig>);
+    protected docker(args: string[], stdin?: Uint8Array | null, signal?: AbortSignal): Promise<CliResult>;
     connect(): Promise<void>;
-    execLine(line: string, stdin: Uint8Array | null, env: Record<string, string>, cwd: string): Promise<RunResult>;
+    protected execArgv(argv: readonly string[], stdin: Uint8Array | null, env: Record<string, string>, cwd: string, signal?: AbortSignal): Promise<RunResult>;
+    openPipe(command: string): Promise<SandboxPipe>;
 }
-export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime/sandbox/docker/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/runtime.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAGnE,UAAU,YAAY;IACpB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,YAAY,CAAC;IAC5D,QAAQ,CAAC,IAAI,YAAW;gBAEZ,OAAO,GAAE,cAAc,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAQhF,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,GAAE,UAAU,GAAG,IAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IA4BlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAexB,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,SAAS,CAAC;CAOtB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/runtime.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAG3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAEnE,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,WAAW,CAAA;AAE/D;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,YAAY,CAAC;IAC5D,QAAQ,CAAC,IAAI,YAAW;gBAEZ,OAAO,GAAE,cAAc,CAAC,YAAY,CAAM;IAMtD,SAAS,CAAC,MAAM,CACd,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,CAAC;IAIf,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;cAeL,QAAQ,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,CAAC;IAQZ,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAGzD"}

package/dist/runtime/sandbox/docker/runtime.js

@@ -11,11 +11,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 // ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
-import { spawn } from 'node:child_process';
+import { EXEC_PRELUDE } from '@struktoai/mirage-core/runtime/sandbox/constants';
 import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
+import { requireId } from '@struktoai/mirage-core/runtime/sandbox/config';
 import { registerRuntime } from '@struktoai/mirage-core/runtime/table';
 import { DOCKER_CONFIG_KEYS } from "./config.js";
 import { DOCKER_CLI_HINT } from "./constants.js";
+import { openCliPipe, runCli } from "../cli.js";
 /**
  * A container the user runs as a whole-line runtime.
  *
@@ -23,46 +25,18 @@ import { DOCKER_CLI_HINT } from "./constants.js";
  * execs lines. The docker CLI is the transport (Docker Desktop,
  * colima, or a podman alias all work), so there is no SDK dependency
  * and no daemon socket wiring; each line is one `docker exec -i` with
- * the merged environment, the rebased cwd, real stdin, and separated
+ * the merged environment, the session cwd, real stdin, and separated
  * stderr.
  */
 export class DockerRuntime extends RemoteSandbox {
     name = 'docker';
     constructor(options = {}) {
         super(options, DOCKER_CONFIG_KEYS);
-        if (!this.config.container) {
-            throw new Error('docker config needs container: the id or name of a running container');
-        }
+        requireId('docker', 'container', this.config.container);
     }
     // One docker CLI invocation; the seam tests override.
-    docker(args, stdin = null) {
-        return new Promise((resolve, reject) => {
-            const child = spawn('docker', args, { stdio: ['pipe', 'pipe', 'pipe'] });
-            const out = [];
-            const err = [];
-            child.stdout.on('data', (chunk) => out.push(chunk));
-            child.stderr.on('data', (chunk) => err.push(chunk));
-            child.on('error', (error) => {
-                reject(error.code === 'ENOENT' ? new Error(DOCKER_CLI_HINT) : error);
-            });
-            child.on('close', (code) => {
-                resolve({
-                    stdout: new Uint8Array(Buffer.concat(out)),
-                    stderr: new Uint8Array(Buffer.concat(err)),
-                    code: code ?? 1,
-                });
-            });
-            // EPIPE means the container command exited without draining its
-            // stdin (`head`-like); python's communicate() suppresses the
-            // matching BrokenPipeError, so it is not an error here either.
-            child.stdin.on('error', (error) => {
-                if (error.code !== 'EPIPE')
-                    reject(error);
-            });
-            if (stdin !== null)
-                child.stdin.write(stdin);
-            child.stdin.end();
-        });
+    docker(args, stdin = null, signal) {
+        return runCli('docker', DOCKER_CLI_HINT, args, stdin, signal !== undefined ? { signal } : {});
     }
     async connect() {
         const result = await this.docker([
@@ -72,24 +46,24 @@ export class DockerRuntime extends RemoteSandbox {
             this.config.container,
         ]);
         if (result.code !== 0) {
-            throw new Error(`docker inspect failed: ${decode(result.stderr).trim()}`);
+            throw new Error(`docker inspect failed: ${DECODER.decode(result.stderr).trim()}`);
         }
-        if (decode(result.stdout).trim() !== 'true') {
+        if (DECODER.decode(result.stdout).trim() !== 'true') {
             throw new Error(`container ${this.config.container} is not running`);
         }
     }
-    async execLine(line, stdin, env, cwd) {
-        const args = ['exec', '-i', '-w', cwd];
+    async execArgv(argv, stdin, env, cwd, signal) {
+        const args = ['exec', '-i', '-w', '/'];
         for (const [key, value] of Object.entries(env))
             args.push('-e', `${key}=${value}`);
-        args.push(this.config.container, 'sh', '-c', line);
-        const result = await this.docker(args, stdin);
+        args.push(this.config.container, 'sh', '-c', EXEC_PRELUDE, 'sh', cwd, ...argv);
+        const result = await this.docker(args, stdin, signal);
         return { stdout: result.stdout, stderr: result.stderr, exitCode: result.code };
     }
+    openPipe(command) {
+        return openCliPipe('docker', ['exec', '-i', this.config.container, 'sh', '-c', command]);
+    }
 }
 const DECODER = new TextDecoder();
-function decode(bytes) {
-    return DECODER.decode(bytes);
-}
 registerRuntime('docker', DockerRuntime);
 //# sourceMappingURL=runtime.js.map

package/dist/runtime/sandbox/docker/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/runtime.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAEtE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAQhD;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAc,SAAQ,aAA2B;IACnD,IAAI,GAAG,QAAQ,CAAA;IAExB,YAAY,UAAkE,EAAE;QAC9E,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;IAED,sDAAsD;IAC5C,MAAM,CAAC,IAAc,EAAE,QAA2B,IAAI;QAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YACxE,MAAM,GAAG,GAAa,EAAE,CAAA;YACxB,MAAM,GAAG,GAAa,EAAE,CAAA;YACxB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACjD,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACtE,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC;oBACN,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1C,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1C,IAAI,EAAE,IAAI,IAAI,CAAC;iBAChB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,gEAAgE;YAChE,6DAA6D;YAC7D,+DAA+D;YAC/D,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC5C,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,SAAS;YACT,UAAU;YACV,oBAAoB;YACpB,IAAI,CAAC,MAAM,CAAC,SAAS;SACtB,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,KAAwB,EACxB,GAA2B,EAC3B,GAAW;QAEX,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAChF,CAAC;CACF;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/docker/runtime.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,kDAAkD,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAGtE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAc,SAAQ,aAA2B;IACnD,IAAI,GAAG,QAAQ,CAAA;IAExB,YAAY,UAAwC,EAAE;QACpD,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QAClC,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACzD,CAAC;IAED,sDAAsD;IAC5C,MAAM,CACd,IAAc,EACd,QAA2B,IAAI,EAC/B,MAAoB;QAEpB,OAAO,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,SAAS;YACT,UAAU;YACV,oBAAoB;YACpB,IAAI,CAAC,MAAM,CAAC,SAAS;SACtB,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAC/B,IAAuB,EACvB,KAAwB,EACxB,GAA2B,EAC3B,GAAW,EACX,MAAoB;QAEpB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAChF,CAAC;IAEQ,QAAQ,CAAC,OAAe;QAC/B,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA"}

package/dist/runtime/sandbox/microsandbox/config.d.ts

@@ -0,0 +1,8 @@
+import { type SandboxConfig } from '@struktoai/mirage-core/runtime/sandbox/config';
+/** How to reach the user's running microVM. */
+export interface MicrosandboxConfig extends SandboxConfig {
+    /** Name of a running sandbox whose guest serves the workspace paths. */
+    sandbox: string;
+}
+export declare const MICROSANDBOX_CONFIG_KEYS: readonly string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/runtime/sandbox/microsandbox/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAEpG,+CAA+C;AAC/C,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAqC,CAAA"}

package/dist/runtime/sandbox/microsandbox/config.js

@@ -0,0 +1,16 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { BASE_CONFIG_KEYS } from '@struktoai/mirage-core/runtime/sandbox/config';
+export const MICROSANDBOX_CONFIG_KEYS = [...BASE_CONFIG_KEYS, 'sandbox'];
+//# sourceMappingURL=config.js.map

package/dist/runtime/sandbox/microsandbox/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,gBAAgB,EAAsB,MAAM,+CAA+C,CAAA;AAQpG,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,GAAG,gBAAgB,EAAE,SAAS,CAAC,CAAA"}

package/dist/runtime/sandbox/microsandbox/constants.d.ts

@@ -0,0 +1,6 @@
+export declare const MICROSANDBOX_CLI_HINT: string;
+export declare const RUNNING_STATE = "Running";
+export declare const INSPECT_TIMEOUT_SECONDS = 10;
+/** Explain why the configured sandbox cannot take a command. */
+export declare function notRunningHint(sandbox: string, state: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/runtime/sandbox/microsandbox/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/constants.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,qBAAqB,QAEK,CAAA;AAEvC,eAAO,MAAM,aAAa,YAAY,CAAA;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/runtime/sandbox/microsandbox/constants.js

@@ -0,0 +1,22 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+export const MICROSANDBOX_CLI_HINT = 'the microsandbox runtime needs the msb CLI on PATH (https://microsandbox.dev); ' +
+    'start the sandbox before connecting';
+export const RUNNING_STATE = 'Running';
+export const INSPECT_TIMEOUT_SECONDS = 10;
+/** Explain why the configured sandbox cannot take a command. */
+export function notRunningHint(sandbox, state) {
+    return `sandbox ${sandbox} is not running (status: ${state}); start it with msb start`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/runtime/sandbox/microsandbox/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,MAAM,CAAC,MAAM,qBAAqB,GAChC,iFAAiF;IACjF,qCAAqC,CAAA;AAEvC,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAEzC,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC3D,OAAO,WAAW,OAAO,4BAA4B,KAAK,4BAA4B,CAAA;AACxF,CAAC"}

package/dist/runtime/sandbox/microsandbox/runtime.d.ts

@@ -0,0 +1,26 @@
+import { PROCESS_EXECUTOR, type ProcessExecutor } from '@struktoai/mirage-core/runtime/mixin';
+import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
+import type { RunResult, SandboxPipe } from '@struktoai/mirage-core/runtime/types';
+import type { RuntimeOptions } from '@struktoai/mirage-core/runtime/config';
+import { type MicrosandboxConfig } from './config.ts';
+import { type CliResult } from '../cli.ts';
+/**
+ * Run programs in an existing Microsandbox guest through the msb CLI.
+ * The user starts the sandbox and serves its workspace at the same paths
+ * inside the guest. Mirage forwards commands, stdin, environment, and cwd
+ * without managing the sandbox's lifecycle.
+ */
+export declare class MicrosandboxRuntime extends RemoteSandbox<MicrosandboxConfig> implements ProcessExecutor<undefined> {
+    readonly [PROCESS_EXECUTOR]: true;
+    readonly name = "microsandbox";
+    constructor(options?: RuntimeOptions<MicrosandboxConfig> | Record<string, unknown>);
+    /** Skip the connect-once latch: every exec probes the guest. */
+    protected ensureConnected(signal?: AbortSignal): Promise<void>;
+    protected microsandbox(args: string[], stdin?: Uint8Array | null, signal?: AbortSignal): Promise<CliResult>;
+    /** Require a running sandbox before executing any commands. */
+    connect(signal?: AbortSignal): Promise<void>;
+    private inspect;
+    protected execArgv(argv: readonly string[], stdin: Uint8Array | null, env: Record<string, string>, cwd: string, signal?: AbortSignal): Promise<RunResult>;
+    openPipe(command: string): Promise<SandboxPipe>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime/sandbox/microsandbox/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/runtime.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAI3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAO/E,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,WAAW,CAAA;AAE/D;;;;;GAKG;AACH,qBAAa,mBACX,SAAQ,aAAa,CAAC,kBAAkB,CACxC,YAAW,eAAe,CAAC,SAAS,CAAC;IAErC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAS;IAC3C,QAAQ,CAAC,IAAI,kBAAiB;gBAElB,OAAO,GAAE,cAAc,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAMtF,gEAAgE;cAC7C,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvE,SAAS,CAAC,YAAY,CACpB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,CAAC;IAIrB,+DAA+D;IACzD,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAiBpC,OAAO;cAsBI,QAAQ,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,CAAC;IAgBN,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAgB/D"}

package/dist/runtime/sandbox/microsandbox/runtime.js

@@ -0,0 +1,117 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { PROCESS_EXECUTOR } from '@struktoai/mirage-core/runtime/mixin';
+import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
+import { checkMountType, requireId } from '@struktoai/mirage-core/runtime/sandbox/config';
+import { EXEC_PRELUDE } from '@struktoai/mirage-core/runtime/sandbox/constants';
+import { registerRuntime } from '@struktoai/mirage-core/runtime/table';
+import { MICROSANDBOX_CONFIG_KEYS } from "./config.js";
+import { RUNNING_STATE, MICROSANDBOX_CLI_HINT, INSPECT_TIMEOUT_SECONDS, notRunningHint, } from "./constants.js";
+import { openCliPipe, runCli } from "../cli.js";
+/**
+ * Run programs in an existing Microsandbox guest through the msb CLI.
+ * The user starts the sandbox and serves its workspace at the same paths
+ * inside the guest. Mirage forwards commands, stdin, environment, and cwd
+ * without managing the sandbox's lifecycle.
+ */
+export class MicrosandboxRuntime extends RemoteSandbox {
+    [PROCESS_EXECUTOR] = true;
+    name = 'microsandbox';
+    constructor(options = {}) {
+        super(options, MICROSANDBOX_CONFIG_KEYS);
+        requireId('microsandbox', 'sandbox', this.config.sandbox);
+        this.serveMounts(checkMountType('microsandbox', this.config.mountType));
+    }
+    /** Skip the connect-once latch: every exec probes the guest. */
+    ensureConnected(signal) {
+        signal?.throwIfAborted();
+        return Promise.resolve();
+    }
+    // One msb CLI invocation.
+    microsandbox(args, stdin = null, signal) {
+        return runCli('msb', MICROSANDBOX_CLI_HINT, args, stdin, signal !== undefined ? { signal } : {});
+    }
+    /** Require a running sandbox before executing any commands. */
+    async connect(signal) {
+        signal?.throwIfAborted();
+        const deadline = AbortSignal.timeout(INSPECT_TIMEOUT_SECONDS * 1000);
+        const probeSignal = signal === undefined ? deadline : AbortSignal.any([signal, deadline]);
+        try {
+            await this.inspect(probeSignal);
+        }
+        catch (error) {
+            signal?.throwIfAborted();
+            if (deadline.aborted)
+                throw new Error(`msb runtime inspection timed out after ${String(INSPECT_TIMEOUT_SECONDS)} seconds`, { cause: error });
+            throw error;
+        }
+    }
+    async inspect(signal) {
+        const args = ['status', this.config.sandbox, '--format', 'json'];
+        const result = await this.microsandbox(args, null, signal);
+        if (result.code !== 0) {
+            const detail = DECODER.decode(result.stderr).trim();
+            throw new Error(`msb status failed: ${detail}`);
+        }
+        let status;
+        try {
+            status = JSON.parse(DECODER.decode(result.stdout));
+        }
+        catch (error) {
+            throw new Error(`msb status returned unreadable json: ${String(error)}`);
+        }
+        if (status === null || typeof status !== 'object' || Array.isArray(status)) {
+            throw new Error('msb status returned an invalid status object');
+        }
+        const state = status.status;
+        if (state !== RUNNING_STATE) {
+            throw new Error(notRunningHint(this.config.sandbox, String(state)));
+        }
+    }
+    async execArgv(argv, stdin, env, cwd, signal) {
+        // Released msb can still auto-start a guest stopped after this probe.
+        signal?.throwIfAborted();
+        await this.connect(signal);
+        signal?.throwIfAborted();
+        const args = ['exec', this.config.sandbox, '--quiet', '--no-tty', '-w', '/'];
+        for (const [key, value] of Object.entries(env))
+            args.push('-e', `${key}=${value}`);
+        // `--` ends the flags: the command is a trailing var arg, so a
+        // line starting with a dash would otherwise parse as one.
+        // Released agents block their event loop during chdir into passive SSHFS.
+        // Defer it until the shell starts, so the agent can serve the mount pipe.
+        args.push('--', 'sh', '-c', EXEC_PRELUDE, 'sh', cwd, ...argv);
+        const result = await this.microsandbox(args, stdin, signal);
+        return { stdout: result.stdout, stderr: result.stderr, exitCode: result.code };
+    }
+    async openPipe(command) {
+        await this.connect();
+        return openCliPipe('msb', [
+            'exec',
+            this.config.sandbox,
+            '--quiet',
+            '--no-tty',
+            '--stream',
+            '-w',
+            '/',
+            '--',
+            'sh',
+            '-c',
+            command,
+        ]);
+    }
+}
+const DECODER = new TextDecoder();
+registerRuntime('microsandbox', MicrosandboxRuntime);
+//# sourceMappingURL=runtime.js.map

package/dist/runtime/sandbox/microsandbox/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/microsandbox/runtime.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,sCAAsC,CAAA;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAC3E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,kDAAkD,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAGtE,OAAO,EAAE,wBAAwB,EAA2B,MAAM,aAAa,CAAA;AAC/E,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAE/D;;;;;GAKG;AACH,MAAM,OAAO,mBACX,SAAQ,aAAiC;IAGhC,CAAC,gBAAgB,CAAC,GAAG,IAAa,CAAA;IAClC,IAAI,GAAG,cAAc,CAAA;IAE9B,YAAY,UAAwE,EAAE;QACpF,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAA;QACxC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IACzE,CAAC;IAED,gEAAgE;IAC7C,eAAe,CAAC,MAAoB;QACrD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,0BAA0B;IAChB,YAAY,CACpB,IAAc,EACd,QAA2B,IAAI,EAC/B,MAAoB;QAEpB,OAAO,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;QACpE,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAI,QAAQ,CAAC,OAAO;gBAClB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,uBAAuB,CAAC,UAAU,EACnF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;YACH,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAmB;QACvC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,KAAK,GAAI,MAA+B,CAAC,MAAM,CAAA;QACrD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAC/B,IAAuB,EACvB,KAAwB,EACxB,GAA2B,EAC3B,GAAW,EACX,MAAoB;QAEpB,sEAAsE;QACtE,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QAClF,+DAA+D;QAC/D,0DAA0D;QAC1D,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAChF,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,OAAe;QACrC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACpB,OAAO,WAAW,CAAC,KAAK,EAAE;YACxB,MAAM;YACN,IAAI,CAAC,MAAM,CAAC,OAAO;YACnB,SAAS;YACT,UAAU;YACV,UAAU;YACV,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,eAAe,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAA"}

package/dist/runtime/sandbox/sandlock/config.d.ts

@@ -0,0 +1,8 @@
+import { type SandboxConfig } from '@struktoai/mirage-core/runtime/sandbox/config';
+export interface SandlockConfig extends SandboxConfig {
+    fsReadable?: readonly string[];
+    fsWritable?: readonly string[];
+    maxMemory?: string;
+}
+export declare const SANDLOCK_CONFIG_KEYS: readonly string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/runtime/sandbox/sandlock/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/sandlock/config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAEpG,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAKjD,CAAA"}

package/dist/runtime/sandbox/sandlock/config.js

@@ -0,0 +1,21 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { BASE_CONFIG_KEYS } from '@struktoai/mirage-core/runtime/sandbox/config';
+export const SANDLOCK_CONFIG_KEYS = [
+    ...BASE_CONFIG_KEYS,
+    'fsReadable',
+    'fsWritable',
+    'maxMemory',
+];
+//# sourceMappingURL=config.js.map

package/dist/runtime/sandbox/sandlock/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/sandlock/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,gBAAgB,EAAsB,MAAM,+CAA+C,CAAA;AAQpG,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,GAAG,gBAAgB;IACnB,YAAY;IACZ,YAAY;IACZ,WAAW;CACZ,CAAA"}

package/dist/runtime/sandbox/sandlock/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const SANDLOCK_CLI_HINT: string;
+export declare const SYSTEM_READABLE: readonly string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/runtime/sandbox/sandlock/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/sandlock/constants.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,iBAAiB,QAGiB,CAAA;AAG/C,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAQ5C,CAAA"}

package/dist/runtime/sandbox/sandlock/constants.js

@@ -0,0 +1,27 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+export const SANDLOCK_CLI_HINT = 'the sandlock runtime needs the sandlock CLI on PATH ' +
+    '(https://github.com/multikernel/sandlock); Linux only, and the full ' +
+    'ruleset wants Landlock ABI v6 (Linux 6.12+)';
+// Common loader/runtime paths. Non-system installations need explicit grants.
+export const SYSTEM_READABLE = [
+    '/usr',
+    '/lib',
+    '/lib64',
+    '/bin',
+    '/etc',
+    '/proc',
+    '/dev',
+];
+//# sourceMappingURL=constants.js.map

package/dist/runtime/sandbox/sandlock/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/sandlock/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,sDAAsD;IACtD,sEAAsE;IACtE,6CAA6C,CAAA;AAE/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAA"}

package/dist/runtime/sandbox/sandlock/runtime.d.ts

@@ -0,0 +1,24 @@
+import type { PathSpec } from '@struktoai/mirage-core/types';
+import type { Context } from '@struktoai/mirage-core/commands/config';
+import { Runtime } from '@struktoai/mirage-core/runtime/base';
+import { LINE_EXECUTOR, PROCESS_EXECUTOR, STREAMING_PROCESS, type LineExecutor, type StreamingProcess } from '@struktoai/mirage-core/runtime/mixin';
+import type { OutputFn, RunResult } from '@struktoai/mirage-core/runtime/types';
+import type { RuntimeOptions } from '@struktoai/mirage-core/runtime/config';
+import { type SandlockConfig } from './config.ts';
+/** Native commands confined by Sandlock; workspace access needs a granted native mount. */
+export declare class SandlockRuntime extends Runtime<undefined> implements LineExecutor<undefined>, StreamingProcess<undefined> {
+    readonly name = "sandlock";
+    readonly [LINE_EXECUTOR]: true;
+    readonly [PROCESS_EXECUTOR]: true;
+    readonly [STREAMING_PROCESS]: true;
+    config: SandlockConfig;
+    private readonly children;
+    constructor(options?: RuntimeOptions<SandlockConfig>);
+    policyArgv(): string[];
+    runLine(_engine: undefined, _paths: PathSpec[], _texts: string[], ctx: Context): Promise<RunResult>;
+    runProcess(_engine: undefined, _paths: PathSpec[], texts: string[], ctx: Context): Promise<RunResult>;
+    runStream(_engine: undefined, _paths: PathSpec[], texts: string[], ctx: Context, output: OutputFn): Promise<RunResult>;
+    private executeProcess;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime/sandbox/sandlock/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/sandlock/runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAA;AAC7D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,sCAAsC,CAAA;AAE7C,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAIvE,2FAA2F;AAC3F,qBAAa,eACX,SAAQ,OAAO,CAAC,SAAS,CACzB,YAAW,YAAY,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC;IAE/D,QAAQ,CAAC,IAAI,cAAa;IAC1B,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAG,IAAI,CAAS;IACxC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAS;IAC3C,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAG,IAAI,CAAS;IACpC,MAAM,EAAE,cAAc,CAAA;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;gBAEvC,OAAO,GAAE,cAAc,CAAC,cAAc,CAAM;IAMxD,UAAU,IAAI,MAAM,EAAE;IAStB,OAAO,CACL,OAAO,EAAE,SAAS,EAClB,MAAM,EAAE,QAAQ,EAAE,EAClB,MAAM,EAAE,MAAM,EAAE,EAChB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,SAAS,CAAC;IAKrB,UAAU,CACR,OAAO,EAAE,SAAS,EAClB,MAAM,EAAE,QAAQ,EAAE,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,SAAS,CAAC;IAIrB,SAAS,CACP,OAAO,EAAE,SAAS,EAClB,MAAM,EAAE,QAAQ,EAAE,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC,SAAS,CAAC;YAIP,cAAc;IA6BnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}

package/dist/runtime/sandbox/sandlock/runtime.js

@@ -0,0 +1,78 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { EXTERNAL_COMMANDS } from '@struktoai/mirage-core/runtime/constants';
+import { existsSync } from 'node:fs';
+import { Runtime } from '@struktoai/mirage-core/runtime/base';
+import { LINE_EXECUTOR, PROCESS_EXECUTOR, STREAMING_PROCESS, } from '@struktoai/mirage-core/runtime/mixin';
+import { registerRuntime } from '@struktoai/mirage-core/runtime/table';
+import { SANDLOCK_CONFIG_KEYS } from "./config.js";
+import { SANDLOCK_CLI_HINT, SYSTEM_READABLE } from "./constants.js";
+import { closeChildren, cwdRefusal, runCli } from "../cli.js";
+/** Native commands confined by Sandlock; workspace access needs a granted native mount. */
+export class SandlockRuntime extends Runtime {
+    name = 'sandlock';
+    [LINE_EXECUTOR] = true;
+    [PROCESS_EXECUTOR] = true;
+    [STREAMING_PROCESS] = true;
+    children = new Set();
+    constructor(options = {}) {
+        super(options, [EXTERNAL_COMMANDS], SANDLOCK_CONFIG_KEYS);
+        if (this.config.mountType != null)
+            throw new Error('sandlock: mountType needs a remote pipe transport');
+    }
+    policyArgv() {
+        const argv = [];
+        for (const path of [...SYSTEM_READABLE.filter(existsSync), ...(this.config.fsReadable ?? [])])
+            argv.push('-r', path);
+        for (const path of this.config.fsWritable ?? [])
+            argv.push('-w', path);
+        if (this.config.maxMemory !== undefined)
+            argv.push('-m', this.config.maxMemory);
+        return argv;
+    }
+    runLine(_engine, _paths, _texts, ctx) {
+        const line = ctx.flags.c;
+        return this.executeProcess(['/bin/sh', '-c', typeof line === 'string' ? line : ''], ctx);
+    }
+    runProcess(_engine, _paths, texts, ctx) {
+        return this.executeProcess(texts, ctx);
+    }
+    runStream(_engine, _paths, texts, ctx, output) {
+        return this.executeProcess(texts, ctx, output);
+    }
+    async executeProcess(argv, ctx, output) {
+        const refusal = await cwdRefusal(argv[0] ?? '', ctx.cwd.virtual);
+        if (refusal !== null)
+            return refusal;
+        ctx.signal?.throwIfAborted();
+        const wrapper = ['run', ...this.policyArgv(), '--clean-env'];
+        for (const [key, value] of Object.entries({ ...this.config.env, ...ctx.env }))
+            wrapper.push('--env', `${key}=${value}`);
+        wrapper.push('--', ...argv);
+        // Only host PATH locates the CLI; requested variables go to the confined child.
+        const { stdout, stderr, code } = await runCli('sandlock', SANDLOCK_CLI_HINT, wrapper, ctx.stdin, {
+            cwd: ctx.cwd.virtual,
+            env: { PATH: process.env.PATH ?? '' },
+            children: this.children,
+            ...(output !== undefined ? { output } : {}),
+            ...(ctx.signal !== undefined ? { signal: ctx.signal } : {}),
+        });
+        return { stdout, stderr: stderr.length > 0 ? stderr : null, exitCode: code };
+    }
+    close() {
+        return closeChildren(this.children);
+    }
+}
+registerRuntime('sandlock', SandlockRuntime);
+//# sourceMappingURL=runtime.js.map