@tangle-network/agent-app 0.22.0 → 0.24.0

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/sandbox/index.ts"],"sourcesContent":["import {\n  Sandbox,\n  type AgentProfile,\n  type AgentProfileFileMount,\n  type AgentProfileMcpServer,\n  type SandboxInstance,\n  type ScopedTokenScope,\n  type StorageConfig,\n  type PromptResult,\n} from '@tangle-network/sandbox'\nimport {\n  buildAppToolMcpServer,\n  type AppToolName,\n  type AppToolContext,\n  type ToolHeaderNames,\n} from '../tools/index'\nimport { assertHarnessModelCompatible, type Harness } from '../harness/index'\n\nexport type Outcome<T> =\n  | { succeeded: true; value: T }\n  | { succeeded: false; error: Error }\n\nconst ok = <T>(value: T): Outcome<T> => ({ succeeded: true, value })\nconst fail = (error: unknown): Outcome<never> => ({\n  succeeded: false,\n  error: error instanceof Error ? error : new Error(String(error)),\n})\n\nexport interface SandboxClientCredentials {\n  apiKey: string\n  baseUrl: string\n}\n\nexport interface SandboxResourceConfig {\n  image: string\n  cpuCores: number\n  memoryMB: number\n  diskGB: number\n  maxLifetimeSeconds: number\n  idleTimeoutSeconds: number\n}\n\nexport interface ProviderResolutionConfig {\n  routerBaseUrl?: string\n  apiKey?: string\n  providerName?: string\n  modelName?: string\n  defaultModel?: string\n  openaiApiKey?: string\n}\n\nexport interface SandboxBuildContext {\n  workspaceId: string\n  connectedIntegrationIds: string[]\n  userId?: string\n}\n\n// SDK-typed snapshot storage config (re-exported for product seam closures).\nexport type { StorageConfig }\n\n// Scope handed to per-identity seams. workspaceId is always present; userId is\n// present when the lifecycle op carries one. Workspace-keyed products ignore userId.\nexport interface SandboxScope {\n  workspaceId: string\n  userId?: string\n}\n\n// Snapshot RESTORE-on-create. Returned alongside storage; undefined => fresh box.\nexport interface SandboxRestoreSpec {\n  fromSnapshot: string\n  fromSandboxId: string\n}\n\n// Reuse health gate + sidecar liveness. The exec+timeout-race is generic; the\n// sidecarProcessPattern is harness-specific (which process is the live sidecar),\n// so it is a closure. Absent => no liveness probe (reuse on metadata.harness match).\nexport interface LivenessProbeConfig {\n  sidecarProcessPattern: (harness: Harness) => string\n  execTimeoutMs?: number\n  psTimeoutMs?: number\n}\n\nexport interface ProfileComposeOptions {\n  systemPrompt?: string\n  extraFiles?: AgentProfileFileMount[]\n  extraMcp?: Record<string, AgentProfileMcpServer>\n  name?: string\n}\n\nexport interface SandboxRuntimeConfig {\n  // Widened to accept an optional scope and be async so a per-user key can be\n  // minted. The sync, no-arg form still satisfies the type (back-compat).\n  credentials: (\n    scope?: SandboxScope,\n  ) => SandboxClientCredentials | null | Promise<SandboxClientCredentials | null>\n  name: (workspaceId: string) => string\n  metadata: (harness: Harness) => Record<string, unknown>\n  connectedIntegrationIds: (workspaceId: string) => Promise<string[]>\n  env: (ctx: SandboxBuildContext) => Promise<Record<string, string>>\n  files: (ctx: SandboxBuildContext) => Promise<AgentProfileFileMount[]>\n  secrets: (workspaceId: string) => Promise<string[]>\n  profile: (options: ProfileComposeOptions) => AgentProfile\n  permissionRole?: (workspaceRole: string) => SandboxPermissionLevel\n  resources?: SandboxResourceConfig\n  provider?: ProviderResolutionConfig\n\n  // BYOS3/R2 snapshot storage. Returns undefined => key omitted entirely\n  // (fail-closed when creds absent). Product owns bucket/endpoint/credentials/prefix.\n  storage?: (ctx: SandboxBuildContext) => StorageConfig | undefined\n  // Snapshot RESTORE-on-create. undefined => fresh box.\n  restore?: (ctx: SandboxBuildContext) => SandboxRestoreSpec | undefined\n  // Per-identity box NAME. Defaults to name(scope.workspaceId) when absent.\n  boxKey?: (scope: SandboxScope) => string\n  // Per-workspace child-key mint: overrides the resolved model apiKey before create.\n  // Applied only when a model is resolved and its provider is openai-compat.\n  childKeyMint?: (scope: SandboxScope) => Promise<Outcome<string>>\n  // One-shot post-running bootstrap, on BOTH create and reuse paths (idempotency\n  // is the closure's job — it owns the marker check).\n  bootstrap?: (box: SandboxInstance, scope: SandboxScope) => Promise<Outcome<void>>\n  // Reuse health gate + sidecar liveness probe.\n  livenessProbe?: LivenessProbeConfig\n  // default true: try stopped-resume before create.\n  resumeStopped?: boolean\n  // default false: bake resolveModel() into backend.model at create.\n  backendModelAtCreate?: boolean\n}\n\nexport const DEFAULT_SANDBOX_RESOURCES: SandboxResourceConfig = {\n  image: 'universal',\n  cpuCores: 2,\n  memoryMB: 4096,\n  diskGB: 10,\n  maxLifetimeSeconds: 86400,\n  idleTimeoutSeconds: 3600,\n}\n\ninterface ClientCacheEntry {\n  client: Sandbox\n  fingerprint: string\n}\n\nlet _cached: ClientCacheEntry | null = null\n\nfunction getClientFromCreds(creds: SandboxClientCredentials): Sandbox {\n  const fingerprint = `${creds.apiKey} ${creds.baseUrl}`\n  if (_cached && _cached.fingerprint === fingerprint) return _cached.client\n\n  const client = new Sandbox({ apiKey: creds.apiKey, baseUrl: creds.baseUrl })\n  _cached = { client, fingerprint }\n  return client\n}\n\n// Sync client for non-scoped callers (secretStoreFromClient etc.). Resolves\n// credentials with no scope; throws if the seam returns a Promise — scoped\n// products must use the async ensureWorkspaceSandbox path.\nexport function getClient(shell: SandboxRuntimeConfig): Sandbox {\n  const creds = shell.credentials()\n  if (creds && typeof (creds as Promise<unknown>).then === 'function') {\n    throw new Error('getClient: scoped (async) credentials require the async sandbox path')\n  }\n  if (!creds) throw new Error('sandbox credentials are required (apiKey/baseUrl)')\n  return getClientFromCreds(creds as SandboxClientCredentials)\n}\n\nexport function resetClientCache(): void {\n  _cached = null\n}\n\nexport interface AppToolDescriptor {\n  tool: AppToolName\n  key: string\n  description: string\n}\n\nexport interface BuildAppToolMcpServersOptions {\n  tools: AppToolDescriptor[]\n  baseUrl: string\n  token: string\n  ctx: AppToolContext\n  headerNames?: ToolHeaderNames\n}\n\nexport function buildAppToolMcpServers(\n  options: BuildAppToolMcpServersOptions,\n): Record<string, AgentProfileMcpServer> {\n  const entries: Record<string, AgentProfileMcpServer> = {}\n  for (const { tool, key, description } of options.tools) {\n    entries[key] = buildAppToolMcpServer({\n      tool,\n      baseUrl: options.baseUrl,\n      token: options.token,\n      ctx: options.ctx,\n      description,\n      headerNames: options.headerNames,\n    }) as AgentProfileMcpServer\n  }\n  return entries\n}\n\nexport interface EnsureWorkspaceSandboxOptions {\n  workspaceId: string\n  userId?: string\n  harness: Harness\n  // When set, both the running-reuse and stopped-resume short-circuits are\n  // skipped and any name-matched box is deleted before create.\n  forceNew?: boolean\n}\n\n// Single-quote a string for safe interpolation into a shell command.\nfunction shellSingleQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\nasync function listRunning(\n  client: Sandbox,\n  name: string,\n): Promise<Outcome<SandboxInstance | null>> {\n  try {\n    const running = await client.list({ status: 'running' })\n    return ok(running.find((s) => s.name === name) ?? null)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nasync function deleteBox(box: SandboxInstance): Promise<Outcome<void>> {\n  try {\n    await box.delete()\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\n// The SDK narrows `backend.type` to its own BackendType union and\n// `initialUsers[].role` to PermissionLevel — neither symbol is exported. The\n// create payload is assembled with the product's Harness/role strings, which\n// are a superset surface; the localized cast at the boundary is the only place\n// this widening is allowed, and the runtime contract (the sidecar boots the\n// named harness) is what enforces correctness.\ntype CreatePayload = Parameters<Sandbox['create']>[0]\n\n// Generic exec+sidecar liveness probe. Absent probe => always alive (the prior\n// reuse-on-metadata-match behavior). With a probe: the container must answer an\n// `echo alive` exec within execTimeoutMs, and the sidecar process must be found\n// by pgrep within psTimeoutMs (an inconclusive pgrep is treated as reusable).\nasync function isBoxAlive(\n  box: SandboxInstance,\n  harness: Harness,\n  probe: LivenessProbeConfig | undefined,\n): Promise<boolean> {\n  if (!probe) return true\n  const execTimeout = probe.execTimeoutMs ?? 5000\n  const psTimeout = probe.psTimeoutMs ?? 3000\n  const race = <T>(p: Promise<T>, ms: number, label: string): Promise<T> =>\n    Promise.race([\n      p,\n      new Promise<T>((_, reject) => setTimeout(() => reject(new Error(label)), ms)),\n    ])\n  try {\n    const alive = await race(box.exec('echo alive'), execTimeout, 'alive check timeout')\n    if (!alive.stdout.includes('alive')) return false\n    const pattern = probe.sidecarProcessPattern(harness)\n    try {\n      const ps = await race(\n        box.exec(`pgrep -f ${shellSingleQuote(pattern)} || echo no-sidecar`),\n        psTimeout,\n        'ps check timeout',\n      )\n      if (ps.stdout.includes('no-sidecar')) return false\n    } catch {\n      // sidecar probe inconclusive — container is alive, treat as reusable\n    }\n    return true\n  } catch {\n    return false\n  }\n}\n\n// Resume a name-matched stopped box and wait for it to reach running. Returns\n// ok(null) when no stopped box matches the name.\nasync function resumeStoppedBox(\n  client: Sandbox,\n  name: string,\n  timeoutMs: number,\n): Promise<Outcome<SandboxInstance | null>> {\n  try {\n    const stopped = await client.list({ status: 'stopped' })\n    const match = stopped.find((s) => s.name === name) ?? null\n    if (!match) return ok(null)\n    await match.resume()\n    await match.waitFor('running', { timeoutMs })\n    return ok(match)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function ensureWorkspaceSandbox(\n  shell: SandboxRuntimeConfig,\n  options: EnsureWorkspaceSandboxOptions,\n): Promise<SandboxInstance> {\n  const { workspaceId, userId, harness, forceNew } = options\n  const scope: SandboxScope = { workspaceId, ...(userId ? { userId } : {}) }\n  const creds = await shell.credentials(scope)\n  if (!creds) throw new Error('sandbox credentials are required (apiKey/baseUrl)')\n  const client = getClientFromCreds(creds)\n  const name = shell.boxKey ? shell.boxKey(scope) : shell.name(workspaceId)\n  const resources = shell.resources ?? DEFAULT_SANDBOX_RESOURCES\n  const resumeTimeout = 120_000\n\n  // Stage 1 — running-box reuse (skipped on forceNew).\n  const existing = await listRunning(client, name)\n  if (existing.succeeded && existing.value) {\n    const found = existing.value\n    if (forceNew) {\n      const dropped = await deleteBox(found)\n      if (!dropped.succeeded) {\n        throw new Error(`forceNew: sandbox ${name} could not be deleted`, { cause: dropped.error })\n      }\n    } else if (\n      found.metadata?.harness === harness &&\n      (await isBoxAlive(found, harness, shell.livenessProbe))\n    ) {\n      if (shell.bootstrap) {\n        const boot = await shell.bootstrap(found, scope)\n        if (!boot.succeeded) {\n          throw new Error(`bootstrap failed on reused box ${name}`, { cause: boot.error })\n        }\n      }\n      return found\n    } else {\n      const dropped = await deleteBox(found)\n      if (!dropped.succeeded) {\n        throw new Error(\n          `sandbox ${name} ` +\n            `(was ${String(found.metadata?.harness ?? 'unknown')}, want ${harness}, or unresponsive) ` +\n            `could not be deleted`,\n          { cause: dropped.error },\n        )\n      }\n    }\n  }\n\n  // Stage 2 — stopped-box resume (skipped on forceNew or resumeStopped===false).\n  if (!forceNew && shell.resumeStopped !== false) {\n    const resumed = await resumeStoppedBox(client, name, resumeTimeout)\n    if (\n      resumed.succeeded &&\n      resumed.value &&\n      (await isBoxAlive(resumed.value, harness, shell.livenessProbe))\n    ) {\n      const box = resumed.value\n      if (shell.bootstrap) {\n        const boot = await shell.bootstrap(box, scope)\n        if (!boot.succeeded) {\n          throw new Error(`bootstrap failed on resumed box ${name}`, { cause: boot.error })\n        }\n      }\n      return box\n    }\n  }\n\n  // Stage 3 — create fresh.\n  const connectedIntegrationIds = await shell.connectedIntegrationIds(workspaceId)\n  const buildCtx: SandboxBuildContext = {\n    workspaceId,\n    connectedIntegrationIds,\n    ...(userId ? { userId } : {}),\n  }\n  const [secrets, env, files] = await Promise.all([\n    shell.secrets(workspaceId),\n    shell.env(buildCtx),\n    shell.files(buildCtx),\n  ])\n  const profile = shell.profile({ extraFiles: files })\n\n  const role = userId && shell.permissionRole ? shell.permissionRole('developer') : undefined\n\n  // Bake the model at create when opted in. childKeyMint overrides the apiKey\n  // per-workspace; a typed mint failure falls through to the parent key (logged).\n  let model = shell.backendModelAtCreate ? resolveModel(shell.provider) : undefined\n  if (model && shell.childKeyMint && model.provider === 'openai-compat') {\n    const minted = await shell.childKeyMint(scope)\n    if (minted.succeeded) model = { ...model, apiKey: minted.value }\n    else {\n      console.error(\n        `[sandbox] childKeyMint failed for ${workspaceId}; using parent key:`,\n        minted.error.message,\n      )\n    }\n  }\n\n  const storage = shell.storage?.(buildCtx)\n  const restore = shell.restore?.(buildCtx)\n\n  const payload = {\n    name,\n    image: resources.image,\n    metadata: shell.metadata(harness),\n    ...(userId ? { permissions: { initialUsers: [{ userId, role }] } } : {}),\n    env,\n    secrets,\n    backend: { type: harness, profile, ...(model ? { model } : {}) },\n    ...(storage ? { storage } : {}),\n    ...(restore ? restore : {}),\n    maxLifetimeSeconds: resources.maxLifetimeSeconds,\n    idleTimeoutSeconds: resources.idleTimeoutSeconds,\n    resources: {\n      cpuCores: resources.cpuCores,\n      memoryMB: resources.memoryMB,\n      diskGB: resources.diskGB,\n    },\n  } as CreatePayload\n\n  const box = await client.create(payload)\n\n  await box.waitFor('running', { timeoutMs: 120_000 })\n  if (!box.connection?.runtimeUrl) await box.refresh()\n\n  if (shell.bootstrap) {\n    const boot = await shell.bootstrap(box, scope)\n    if (!boot.succeeded) {\n      throw new Error(`bootstrap failed on new box ${name}`, { cause: boot.error })\n    }\n  }\n  return box\n}\n\nexport interface ResolvedModel {\n  model: string\n  provider: string\n  apiKey: string\n  baseUrl?: string\n}\n\nexport function resolveModel(\n  config: ProviderResolutionConfig | undefined,\n  override?: { model?: string; modelApiKey?: string },\n): ResolvedModel | undefined {\n  const c = config ?? {}\n  const explicitBaseUrl = c.routerBaseUrl\n  const explicitApiKey = override?.modelApiKey ?? c.apiKey\n  const provider =\n    c.providerName ?? (explicitApiKey ? 'openai-compat' : c.openaiApiKey ? 'openai' : undefined)\n  const modelName =\n    override?.model ??\n    c.modelName ??\n    (provider === 'openai' || provider === 'openai-compat' ? c.defaultModel : undefined)\n  const apiKey = explicitApiKey ?? (provider === 'openai' ? c.openaiApiKey : undefined)\n  if (!provider || !modelName || !apiKey) return undefined\n  return {\n    model: modelName,\n    provider,\n    apiKey,\n    ...(explicitBaseUrl ? { baseUrl: explicitBaseUrl } : {}),\n  }\n}\n\nexport function flattenHistory(\n  message: string,\n  history?: Array<{ role: 'user' | 'assistant'; content: string }>,\n): string {\n  if (!history?.length) return message\n  const transcript = history\n    .map((entry) => `${entry.role === 'assistant' ? 'Assistant' : 'User'}: ${entry.content}`)\n    .join('\\n\\n')\n  return `${transcript}\\n\\nUser: ${message}`\n}\n\nexport function mergeExtraMcp(\n  appToolMcp: Record<string, AgentProfileMcpServer>,\n  baseProfileMcp: Record<string, AgentProfileMcpServer>,\n  extra: Record<string, AgentProfileMcpServer> | undefined,\n): Record<string, AgentProfileMcpServer> {\n  for (const key of Object.keys(extra ?? {})) {\n    if (key in appToolMcp || key in baseProfileMcp) {\n      throw new Error(`extraMcp key '${key}' collides with an existing profile MCP server`)\n    }\n  }\n  return { ...appToolMcp, ...(extra ?? {}) }\n}\n\nexport function attachReasoningEffort(\n  profile: AgentProfile,\n  harness: Harness,\n  effort: 'auto' | 'low' | 'medium' | 'high' | undefined,\n): AgentProfile {\n  if (!effort || effort === 'auto') return profile\n  return {\n    ...profile,\n    extensions: {\n      ...(profile.extensions ?? {}),\n      [harness]: {\n        ...(profile.extensions?.[harness] ?? {}),\n        reasoningEffort: effort,\n      },\n    },\n  }\n}\n\nexport interface StreamSandboxPromptOptions {\n  sessionId?: string\n  executionId?: string\n  lastEventId?: string\n  systemPrompt?: string\n  model?: string\n  modelApiKey?: string\n  history?: Array<{ role: 'user' | 'assistant'; content: string }>\n  harness?: Harness\n  effort?: 'auto' | 'low' | 'medium' | 'high'\n  appToolMcp?: Record<string, AgentProfileMcpServer>\n  baseProfileMcp?: Record<string, AgentProfileMcpServer>\n  extraMcp?: Record<string, AgentProfileMcpServer>\n  signal?: AbortSignal\n  timeoutMs?: number\n  // When true, an interactive question event throws instead of yielding —\n  // detached (cron/mission-step) runs have no consumer to answer it.\n  disallowQuestions?: boolean\n}\n\ntype StreamPromptOptions = Parameters<SandboxInstance['streamPrompt']>[1]\n\nexport async function* streamSandboxPrompt(\n  shell: SandboxRuntimeConfig,\n  box: SandboxInstance,\n  message: string,\n  options?: StreamSandboxPromptOptions,\n): AsyncGenerator<unknown> {\n  const harness = options?.harness ?? 'opencode'\n  const model = resolveModel(shell.provider, {\n    model: options?.model,\n    modelApiKey: options?.modelApiKey,\n  })\n\n  // Server-side enforcement of the harness↔model policy: a vendor-locked harness\n  // (claude-code/codex/kimi-code) must not be sent a foreign-provider model, even\n  // if the UI snap was bypassed. Provider-less ids pass (session's own config).\n  if (model?.model) assertHarnessModelCompatible(harness, model.model)\n\n  const prompt = flattenHistory(message, options?.history)\n\n  const appToolMcp = options?.appToolMcp ?? {}\n  const extraMcp = mergeExtraMcp(appToolMcp, options?.baseProfileMcp ?? {}, options?.extraMcp)\n\n  const profile = shell.profile({ systemPrompt: options?.systemPrompt, extraMcp })\n  const profileWithEffort = attachReasoningEffort(profile, harness, options?.effort)\n\n  const stream = box.streamPrompt(prompt, {\n    sessionId: options?.sessionId,\n    executionId: options?.executionId,\n    lastEventId: options?.lastEventId,\n    ...(options?.signal ? { signal: options.signal } : {}),\n    ...(options?.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),\n    backend: {\n      type: harness,\n      profile: profileWithEffort,\n      ...(model ? { model } : {}),\n    },\n  } as StreamPromptOptions)\n\n  let severedFinishReason: string | null = null\n  for await (const event of stream) {\n    const step = classifySeveredStream(event)\n    if (step) severedFinishReason = step.kind === 'step-finish' && step.severed ? step.reason : null\n    if (severedFinishReason && isTerminalPromptEvent(event)) {\n      throw new Error(`sandbox model stream severed mid-turn (reason=\"${severedFinishReason}\")`)\n    }\n    if (options?.disallowQuestions) {\n      const q = detectInteractiveQuestion(event)\n      if (q) {\n        throw new Error(`sandbox agent asked an interactive question during an autonomous run: ${q}`)\n      }\n    }\n    yield event\n  }\n  // Reconnect-exhausted path: the stream ended on a severed step without a\n  // terminal event. A truncated turn must fail loud, not return silently.\n  if (severedFinishReason) {\n    throw new Error(`sandbox model stream severed mid-turn (reason=\"${severedFinishReason}\")`)\n  }\n}\n\nexport async function runSandboxPrompt(\n  shell: SandboxRuntimeConfig,\n  box: SandboxInstance,\n  message: string,\n  options?: StreamSandboxPromptOptions,\n): Promise<string> {\n  let fullText = ''\n  let firstTextSeen = false\n\n  for await (const rawEvent of streamSandboxPrompt(shell, box, message, options)) {\n    const event = rawEvent as { type?: string; data?: Record<string, unknown> }\n    if (!event.type) continue\n\n    if (event.type === 'message.part.updated') {\n      const part = event.data?.part as Record<string, unknown> | undefined\n      const delta = typeof event.data?.delta === 'string' ? event.data.delta : null\n      if (String(part?.type ?? '') === 'text') {\n        if (!firstTextSeen) {\n          firstTextSeen = true\n          continue\n        }\n        if (delta) fullText += delta\n        else if (typeof part?.text === 'string') fullText = part.text\n      }\n    } else if (event.type === 'result') {\n      const finalText = typeof event.data?.finalText === 'string' ? event.data.finalText : null\n      if (finalText) fullText = finalText\n    }\n  }\n\n  return fullText\n}\n\n// Mirrors the SDK's PermissionLevel union (not re-exported by\n// @tangle-network/sandbox). The product's role-mapping seam must produce one of\n// these; binding the seam's return type to the union makes a wrong mapping a\n// compile error rather than a runtime 400 from the orchestrator.\nexport type SandboxPermissionLevel = 'owner' | 'admin' | 'developer' | 'viewer'\n\nexport interface MemberSyncSeam {\n  roleToSandboxRole: (workspaceRole: string) => SandboxPermissionLevel\n}\n\nexport async function syncSandboxMemberAdd(\n  box: SandboxInstance,\n  seam: MemberSyncSeam,\n  userId: string,\n  role: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.add({ userId, role: seam.roleToSandboxRole(role) })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function syncSandboxMemberRemove(\n  box: SandboxInstance,\n  userId: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.remove(userId, { preserveHomeDir: true })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function syncSandboxMemberRole(\n  box: SandboxInstance,\n  seam: MemberSyncSeam,\n  userId: string,\n  role: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.update(userId, { role: seam.roleToSandboxRole(role) })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport interface SecretStore {\n  create: (name: string, value: string) => Promise<void>\n  update: (name: string, value: string) => Promise<void>\n  get: (name: string) => Promise<string>\n  delete: (name: string) => Promise<void>\n}\n\nexport function secretStoreFromClient(shell: SandboxRuntimeConfig): SecretStore {\n  const client = getClient(shell)\n  return {\n    create: async (name, value) => {\n      await client.secrets.create(name, value)\n    },\n    update: async (name, value) => {\n      await client.secrets.update(name, value)\n    },\n    get: (name) => client.secrets.get(name),\n    delete: async (name) => {\n      await client.secrets.delete(name)\n    },\n  }\n}\n\nexport async function storeSecret(\n  store: SecretStore,\n  name: string,\n  value: string,\n): Promise<Outcome<void>> {\n  try {\n    await store.create(name, value)\n    return ok(undefined)\n  } catch {\n    try {\n      await store.update(name, value)\n      return ok(undefined)\n    } catch (err) {\n      return fail(new Error(`Failed to store sandbox secret ${name}`, { cause: err }))\n    }\n  }\n}\n\nexport async function readSecret(store: SecretStore, name: string): Promise<Outcome<string>> {\n  try {\n    return ok(await store.get(name))\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function deleteSecret(store: SecretStore, name: string): Promise<Outcome<void>> {\n  try {\n    await store.delete(name)\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport interface ScopedTokenResult {\n  token: string\n  expiresAt: Date\n  scope: ScopedTokenScope\n}\n\n/**\n * Mint a scoped token for an already-provisioned box (e.g. to hand a terminal\n * proxy a narrowed credential). Uses the SDK's native `box.mintScopedToken`,\n * which normalizes `expiresAt` to a Date — no hand-rolled wire call.\n */\nexport async function mintSandboxScopedToken(\n  box: SandboxInstance,\n  options: { scope: ScopedTokenScope; sessionId?: string; ttlMinutes?: number },\n): Promise<Outcome<ScopedTokenResult>> {\n  try {\n    const token = await box.mintScopedToken({\n      scope: options.scope,\n      ...(options.sessionId ? { sessionId: options.sessionId } : {}),\n      ...(options.ttlMinutes ? { ttlMinutes: options.ttlMinutes } : {}),\n    })\n    return ok({ token: token.token, expiresAt: token.expiresAt, scope: token.scope })\n  } catch (err) {\n    return fail(err)\n  }\n}\n\n// Detached single-turn advance. The SDK SandboxInstance has no `driveTurn`; the\n// non-streaming sibling of streamPrompt is box.prompt(message, opts) -> PromptResult.\n// Returns a typed Outcome so a failed turn is inspected, not swallowed.\nexport async function driveSandboxTurn(\n  shell: SandboxRuntimeConfig,\n  box: SandboxInstance,\n  message: string,\n  options: StreamSandboxPromptOptions & { sessionId: string },\n): Promise<Outcome<PromptResult>> {\n  const harness = options.harness ?? 'opencode'\n  const model = resolveModel(shell.provider, {\n    model: options.model,\n    modelApiKey: options.modelApiKey,\n  })\n  if (model?.model) assertHarnessModelCompatible(harness, model.model)\n  const prompt = flattenHistory(message, options.history)\n  const appToolMcp = options.appToolMcp ?? {}\n  const extraMcp = mergeExtraMcp(appToolMcp, options.baseProfileMcp ?? {}, options.extraMcp)\n  const profile = attachReasoningEffort(\n    shell.profile({ systemPrompt: options.systemPrompt, extraMcp }),\n    harness,\n    options.effort,\n  )\n  try {\n    const result = await box.prompt(prompt, {\n      sessionId: options.sessionId,\n      ...(options.executionId ? { executionId: options.executionId } : {}),\n      ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),\n      ...(options.signal ? { signal: options.signal } : {}),\n      backend: { type: harness, profile, ...(model ? { model } : {}) },\n    } as Parameters<SandboxInstance['prompt']>[1])\n    if (!result.success) return fail(new Error(result.error ?? 'sandbox turn failed'))\n    return ok(result)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\n// Terminal-proxy HMAC token. Identity tuple is generic; the secret comes from a\n// closure (fail-loud if absent).\nexport interface TerminalProxyIdentity {\n  userId: string\n  workspaceId: string\n  sandboxId: string\n}\n\nconst TERMINAL_PROXY_TOKEN_TTL_MS = 15 * 60 * 1000\n\nasync function signTerminalProxyToken(secret: string, encodedPayload: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(encodedPayload))\n  return base64UrlEncodeBytes(new Uint8Array(sig))\n}\n\nexport async function mintTerminalProxyToken(\n  secret: string,\n  identity: TerminalProxyIdentity,\n  ttlMs = TERMINAL_PROXY_TOKEN_TTL_MS,\n): Promise<Outcome<{ token: string; expiresAt: Date }>> {\n  if (!secret) return fail(new Error('mintTerminalProxyToken: secret is required'))\n  if (!identity.userId || !identity.workspaceId || !identity.sandboxId) {\n    return fail(new Error('mintTerminalProxyToken: userId/workspaceId/sandboxId are required'))\n  }\n  const expiresAt = new Date(Date.now() + ttlMs)\n  const payload = { ...identity, exp: Math.floor(expiresAt.getTime() / 1000) }\n  const encoded = base64UrlEncodeUtf8(JSON.stringify(payload))\n  const sig = await signTerminalProxyToken(secret, encoded)\n  return ok({ token: `${encoded}.${sig}`, expiresAt })\n}\n\nexport async function verifyTerminalProxyToken(\n  secret: string,\n  token: string,\n  expected: TerminalProxyIdentity,\n): Promise<boolean> {\n  if (!secret) return false\n  const [encoded, sig, extra] = token.split('.')\n  if (!encoded || !sig || extra !== undefined) return false\n  const expectedSig = await signTerminalProxyToken(secret, encoded)\n  if (!constantTimeEqual(sig, expectedSig)) return false\n  let payload: TerminalProxyIdentity & { exp: number }\n  try {\n    payload = JSON.parse(base64UrlDecodeUtf8(encoded))\n  } catch {\n    return false\n  }\n  return (\n    payload.userId === expected.userId &&\n    payload.workspaceId === expected.workspaceId &&\n    payload.sandboxId === expected.sandboxId &&\n    Number.isFinite(payload.exp) &&\n    payload.exp > Math.floor(Date.now() / 1000)\n  )\n}\n\nfunction base64UrlEncodeBytes(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction base64UrlEncodeUtf8(v: string): string {\n  return base64UrlEncodeBytes(new TextEncoder().encode(v))\n}\n\nfunction base64UrlDecodeUtf8(v: string): string {\n  const padded = v.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(v.length / 4) * 4, '=')\n  const bin = atob(padded)\n  const bytes = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i += 1) bytes[i] = bin.charCodeAt(i)\n  return new TextDecoder().decode(bytes)\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let r = 0\n  for (let i = 0; i < a.length; i += 1) r |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return r === 0\n}\n\n// Severed-stream classifier. Generic to any router-backed harness: a final step\n// that finished with error/other/unknown is a truncated turn, not a completed one.\nconst SEVERED_FINISH_REASONS = new Set(['error', 'other', 'unknown'])\n\nexport type SandboxStepTransition =\n  | { kind: 'step-start' }\n  | { kind: 'step-finish'; reason: string; severed: boolean }\n\nfunction asPlainRecord(v: unknown): Record<string, unknown> | null {\n  return v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : null\n}\n\nexport function classifySeveredStream(event: unknown): SandboxStepTransition | null {\n  const root = asPlainRecord(event)\n  if (!root || root.type !== 'message.part.updated') return null\n  const body = asPlainRecord(root.properties) ?? asPlainRecord(root.data) ?? root\n  const part = asPlainRecord(body.part)\n  if (!part) return null\n  if (part.type === 'step-start') return { kind: 'step-start' }\n  if (part.type !== 'step-finish') return null\n  const reason = typeof part.reason === 'string' && part.reason ? part.reason : 'unknown'\n  return { kind: 'step-finish', reason, severed: SEVERED_FINISH_REASONS.has(reason) }\n}\n\nexport function isTerminalPromptEvent(event: unknown): boolean {\n  const t = asPlainRecord(event)?.type\n  return t === 'result' || t === 'done'\n}\n\n// Interactive-question detector. Returns the question text or null. Used by\n// streamSandboxPrompt when disallowQuestions is set.\nexport function detectInteractiveQuestion(event: unknown): string | null {\n  const root = asPlainRecord(event)\n  if (!root) return null\n  const type = typeof root.type === 'string' ? root.type : undefined\n  const data = asPlainRecord(root.data)\n  const props = asPlainRecord(root.properties)\n  const body = props ?? data ?? root\n  if (type === 'question.asked' || type === 'question') return firstQuestionText(body)\n  const part = asPlainRecord(data?.part) ?? asPlainRecord(body.part)\n  const tool =\n    (typeof part?.tool === 'string' && part.tool) ||\n    (typeof part?.name === 'string' && part.name) ||\n    (typeof body.tool === 'string' && body.tool) ||\n    undefined\n  const isQ =\n    type === 'message.part.updated' &&\n    (tool === 'question' || asPlainRecord(part)?.type === 'question')\n  if (!isQ) return null\n  const state = asPlainRecord(asPlainRecord(part)?.state)\n  return firstQuestionText(asPlainRecord(state?.input) ?? state ?? part ?? body)\n}\n\nfunction firstQuestionText(value: Record<string, unknown> | null): string {\n  const arr = Array.isArray(value?.questions)\n    ? value!.questions\n    : Array.isArray(asPlainRecord(value?.input)?.questions)\n      ? (asPlainRecord(value!.input)!.questions as unknown[])\n      : []\n  const first = asPlainRecord(arr[0])\n  const q =\n    (typeof first?.question === 'string' && first.question) ||\n    (typeof first?.prompt === 'string' && first.prompt) ||\n    undefined\n  return q ?? 'interactive question'\n}"],"mappings":";;;;;;;;;;AAAA;AAAA,EACE;AAAA,OAQK;AAaP,IAAM,KAAK,CAAI,WAA0B,EAAE,WAAW,MAAM,MAAM;AAClE,IAAM,OAAO,CAAC,WAAoC;AAAA,EAChD,WAAW;AAAA,EACX,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAqGO,IAAM,4BAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAOA,IAAI,UAAmC;AAEvC,SAAS,mBAAmB,OAA0C;AACpE,QAAM,cAAc,GAAG,MAAM,MAAM,IAAI,MAAM,OAAO;AACpD,MAAI,WAAW,QAAQ,gBAAgB,YAAa,QAAO,QAAQ;AAEnE,QAAM,SAAS,IAAI,QAAQ,EAAE,QAAQ,MAAM,QAAQ,SAAS,MAAM,QAAQ,CAAC;AAC3E,YAAU,EAAE,QAAQ,YAAY;AAChC,SAAO;AACT;AAKO,SAAS,UAAU,OAAsC;AAC9D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,SAAS,OAAQ,MAA2B,SAAS,YAAY;AACnE,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mDAAmD;AAC/E,SAAO,mBAAmB,KAAiC;AAC7D;AAEO,SAAS,mBAAyB;AACvC,YAAU;AACZ;AAgBO,SAAS,uBACd,SACuC;AACvC,QAAM,UAAiD,CAAC;AACxD,aAAW,EAAE,MAAM,KAAK,YAAY,KAAK,QAAQ,OAAO;AACtD,YAAQ,GAAG,IAAI,sBAAsB;AAAA,MACnC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,KAAK,QAAQ;AAAA,MACb;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAYA,SAAS,iBAAiB,OAAuB;AAC/C,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAEA,eAAe,YACb,QACA,MAC0C;AAC1C,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,UAAU,CAAC;AACvD,WAAO,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,IAAI;AAAA,EACxD,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAe,UAAU,KAA8C;AACrE,MAAI;AACF,UAAM,IAAI,OAAO;AACjB,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAcA,eAAe,WACb,KACA,SACA,OACkB;AAClB,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,cAAc,MAAM,iBAAiB;AAC3C,QAAM,YAAY,MAAM,eAAe;AACvC,QAAM,OAAO,CAAI,GAAe,IAAY,UAC1C,QAAQ,KAAK;AAAA,IACX;AAAA,IACA,IAAI,QAAW,CAAC,GAAG,WAAW,WAAW,MAAM,OAAO,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;AAAA,EAC9E,CAAC;AACH,MAAI;AACF,UAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,YAAY,GAAG,aAAa,qBAAqB;AACnF,QAAI,CAAC,MAAM,OAAO,SAAS,OAAO,EAAG,QAAO;AAC5C,UAAM,UAAU,MAAM,sBAAsB,OAAO;AACnD,QAAI;AACF,YAAM,KAAK,MAAM;AAAA,QACf,IAAI,KAAK,YAAY,iBAAiB,OAAO,CAAC,qBAAqB;AAAA,QACnE;AAAA,QACA;AAAA,MACF;AACA,UAAI,GAAG,OAAO,SAAS,YAAY,EAAG,QAAO;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAe,iBACb,QACA,MACA,WAC0C;AAC1C,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,UAAU,CAAC;AACvD,UAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK;AACtD,QAAI,CAAC,MAAO,QAAO,GAAG,IAAI;AAC1B,UAAM,MAAM,OAAO;AACnB,UAAM,MAAM,QAAQ,WAAW,EAAE,UAAU,CAAC;AAC5C,WAAO,GAAG,KAAK;AAAA,EACjB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,uBACpB,OACA,SAC0B;AAC1B,QAAM,EAAE,aAAa,QAAQ,SAAS,SAAS,IAAI;AACnD,QAAM,QAAsB,EAAE,aAAa,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG;AACzE,QAAM,QAAQ,MAAM,MAAM,YAAY,KAAK;AAC3C,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mDAAmD;AAC/E,QAAM,SAAS,mBAAmB,KAAK;AACvC,QAAM,OAAO,MAAM,SAAS,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK,WAAW;AACxE,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,gBAAgB;AAGtB,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AAC/C,MAAI,SAAS,aAAa,SAAS,OAAO;AACxC,UAAM,QAAQ,SAAS;AACvB,QAAI,UAAU;AACZ,YAAM,UAAU,MAAM,UAAU,KAAK;AACrC,UAAI,CAAC,QAAQ,WAAW;AACtB,cAAM,IAAI,MAAM,qBAAqB,IAAI,yBAAyB,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,MAC5F;AAAA,IACF,WACE,MAAM,UAAU,YAAY,WAC3B,MAAM,WAAW,OAAO,SAAS,MAAM,aAAa,GACrD;AACA,UAAI,MAAM,WAAW;AACnB,cAAM,OAAO,MAAM,MAAM,UAAU,OAAO,KAAK;AAC/C,YAAI,CAAC,KAAK,WAAW;AACnB,gBAAM,IAAI,MAAM,kCAAkC,IAAI,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AACA,aAAO;AAAA,IACT,OAAO;AACL,YAAM,UAAU,MAAM,UAAU,KAAK;AACrC,UAAI,CAAC,QAAQ,WAAW;AACtB,cAAM,IAAI;AAAA,UACR,WAAW,IAAI,SACL,OAAO,MAAM,UAAU,WAAW,SAAS,CAAC,UAAU,OAAO;AAAA,UAEvE,EAAE,OAAO,QAAQ,MAAM;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,YAAY,MAAM,kBAAkB,OAAO;AAC9C,UAAM,UAAU,MAAM,iBAAiB,QAAQ,MAAM,aAAa;AAClE,QACE,QAAQ,aACR,QAAQ,SACP,MAAM,WAAW,QAAQ,OAAO,SAAS,MAAM,aAAa,GAC7D;AACA,YAAMA,OAAM,QAAQ;AACpB,UAAI,MAAM,WAAW;AACnB,cAAM,OAAO,MAAM,MAAM,UAAUA,MAAK,KAAK;AAC7C,YAAI,CAAC,KAAK,WAAW;AACnB,gBAAM,IAAI,MAAM,mCAAmC,IAAI,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,QAClF;AAAA,MACF;AACA,aAAOA;AAAA,IACT;AAAA,EACF;AAGA,QAAM,0BAA0B,MAAM,MAAM,wBAAwB,WAAW;AAC/E,QAAM,WAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACA,QAAM,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC9C,MAAM,QAAQ,WAAW;AAAA,IACzB,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,UAAU,MAAM,QAAQ,EAAE,YAAY,MAAM,CAAC;AAEnD,QAAM,OAAO,UAAU,MAAM,iBAAiB,MAAM,eAAe,WAAW,IAAI;AAIlF,MAAI,QAAQ,MAAM,uBAAuB,aAAa,MAAM,QAAQ,IAAI;AACxE,MAAI,SAAS,MAAM,gBAAgB,MAAM,aAAa,iBAAiB;AACrE,UAAM,SAAS,MAAM,MAAM,aAAa,KAAK;AAC7C,QAAI,OAAO,UAAW,SAAQ,EAAE,GAAG,OAAO,QAAQ,OAAO,MAAM;AAAA,SAC1D;AACH,cAAQ;AAAA,QACN,qCAAqC,WAAW;AAAA,QAChD,OAAO,MAAM;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,UAAU,QAAQ;AACxC,QAAM,UAAU,MAAM,UAAU,QAAQ;AAExC,QAAM,UAAU;AAAA,IACd;AAAA,IACA,OAAO,UAAU;AAAA,IACjB,UAAU,MAAM,SAAS,OAAO;AAAA,IAChC,GAAI,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,QAAQ,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA,SAAS,EAAE,MAAM,SAAS,SAAS,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG;AAAA,IAC/D,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,UAAU,UAAU,CAAC;AAAA,IACzB,oBAAoB,UAAU;AAAA,IAC9B,oBAAoB,UAAU;AAAA,IAC9B,WAAW;AAAA,MACT,UAAU,UAAU;AAAA,MACpB,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,OAAO,OAAO,OAAO;AAEvC,QAAM,IAAI,QAAQ,WAAW,EAAE,WAAW,KAAQ,CAAC;AACnD,MAAI,CAAC,IAAI,YAAY,WAAY,OAAM,IAAI,QAAQ;AAEnD,MAAI,MAAM,WAAW;AACnB,UAAM,OAAO,MAAM,MAAM,UAAU,KAAK,KAAK;AAC7C,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI,MAAM,+BAA+B,IAAI,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,aACd,QACA,UAC2B;AAC3B,QAAM,IAAI,UAAU,CAAC;AACrB,QAAM,kBAAkB,EAAE;AAC1B,QAAM,iBAAiB,UAAU,eAAe,EAAE;AAClD,QAAM,WACJ,EAAE,iBAAiB,iBAAiB,kBAAkB,EAAE,eAAe,WAAW;AACpF,QAAM,YACJ,UAAU,SACV,EAAE,cACD,aAAa,YAAY,aAAa,kBAAkB,EAAE,eAAe;AAC5E,QAAM,SAAS,mBAAmB,aAAa,WAAW,EAAE,eAAe;AAC3E,MAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAQ,QAAO;AAC/C,SAAO;AAAA,IACL,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,GAAI,kBAAkB,EAAE,SAAS,gBAAgB,IAAI,CAAC;AAAA,EACxD;AACF;AAEO,SAAS,eACd,SACA,SACQ;AACR,MAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,QAAM,aAAa,QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,SAAS,cAAc,cAAc,MAAM,KAAK,MAAM,OAAO,EAAE,EACvF,KAAK,MAAM;AACd,SAAO,GAAG,UAAU;AAAA;AAAA,QAAa,OAAO;AAC1C;AAEO,SAAS,cACd,YACA,gBACA,OACuC;AACvC,aAAW,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,GAAG;AAC1C,QAAI,OAAO,cAAc,OAAO,gBAAgB;AAC9C,YAAM,IAAI,MAAM,iBAAiB,GAAG,gDAAgD;AAAA,IACtF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,GAAI,SAAS,CAAC,EAAG;AAC3C;AAEO,SAAS,sBACd,SACA,SACA,QACc;AACd,MAAI,CAAC,UAAU,WAAW,OAAQ,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAI,QAAQ,cAAc,CAAC;AAAA,MAC3B,CAAC,OAAO,GAAG;AAAA,QACT,GAAI,QAAQ,aAAa,OAAO,KAAK,CAAC;AAAA,QACtC,iBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAwBA,gBAAuB,oBACrB,OACA,KACA,SACA,SACyB;AACzB,QAAM,UAAU,SAAS,WAAW;AACpC,QAAM,QAAQ,aAAa,MAAM,UAAU;AAAA,IACzC,OAAO,SAAS;AAAA,IAChB,aAAa,SAAS;AAAA,EACxB,CAAC;AAKD,MAAI,OAAO,MAAO,8BAA6B,SAAS,MAAM,KAAK;AAEnE,QAAM,SAAS,eAAe,SAAS,SAAS,OAAO;AAEvD,QAAM,aAAa,SAAS,cAAc,CAAC;AAC3C,QAAM,WAAW,cAAc,YAAY,SAAS,kBAAkB,CAAC,GAAG,SAAS,QAAQ;AAE3F,QAAM,UAAU,MAAM,QAAQ,EAAE,cAAc,SAAS,cAAc,SAAS,CAAC;AAC/E,QAAM,oBAAoB,sBAAsB,SAAS,SAAS,SAAS,MAAM;AAEjF,QAAM,SAAS,IAAI,aAAa,QAAQ;AAAA,IACtC,WAAW,SAAS;AAAA,IACpB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS;AAAA,IACtB,GAAI,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACpD,GAAI,SAAS,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC3E,SAAS;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,MACT,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IAC3B;AAAA,EACF,CAAwB;AAExB,MAAI,sBAAqC;AACzC,mBAAiB,SAAS,QAAQ;AAChC,UAAM,OAAO,sBAAsB,KAAK;AACxC,QAAI,KAAM,uBAAsB,KAAK,SAAS,iBAAiB,KAAK,UAAU,KAAK,SAAS;AAC5F,QAAI,uBAAuB,sBAAsB,KAAK,GAAG;AACvD,YAAM,IAAI,MAAM,kDAAkD,mBAAmB,IAAI;AAAA,IAC3F;AACA,QAAI,SAAS,mBAAmB;AAC9B,YAAM,IAAI,0BAA0B,KAAK;AACzC,UAAI,GAAG;AACL,cAAM,IAAI,MAAM,yEAAyE,CAAC,EAAE;AAAA,MAC9F;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAGA,MAAI,qBAAqB;AACvB,UAAM,IAAI,MAAM,kDAAkD,mBAAmB,IAAI;AAAA,EAC3F;AACF;AAEA,eAAsB,iBACpB,OACA,KACA,SACA,SACiB;AACjB,MAAI,WAAW;AACf,MAAI,gBAAgB;AAEpB,mBAAiB,YAAY,oBAAoB,OAAO,KAAK,SAAS,OAAO,GAAG;AAC9E,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,KAAM;AAEjB,QAAI,MAAM,SAAS,wBAAwB;AACzC,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,QAAQ,OAAO,MAAM,MAAM,UAAU,WAAW,MAAM,KAAK,QAAQ;AACzE,UAAI,OAAO,MAAM,QAAQ,EAAE,MAAM,QAAQ;AACvC,YAAI,CAAC,eAAe;AAClB,0BAAgB;AAChB;AAAA,QACF;AACA,YAAI,MAAO,aAAY;AAAA,iBACd,OAAO,MAAM,SAAS,SAAU,YAAW,KAAK;AAAA,MAC3D;AAAA,IACF,WAAW,MAAM,SAAS,UAAU;AAClC,YAAM,YAAY,OAAO,MAAM,MAAM,cAAc,WAAW,MAAM,KAAK,YAAY;AACrF,UAAI,UAAW,YAAW;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,qBACpB,KACA,MACA,QACA,MACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,IAAI,EAAE,QAAQ,MAAM,KAAK,kBAAkB,IAAI,EAAE,CAAC;AACxE,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,wBACpB,KACA,QACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,OAAO,QAAQ,EAAE,iBAAiB,KAAK,CAAC;AAC9D,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,sBACpB,KACA,MACA,QACA,MACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,OAAO,QAAQ,EAAE,MAAM,KAAK,kBAAkB,IAAI,EAAE,CAAC;AAC3E,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AASO,SAAS,sBAAsB,OAA0C;AAC9E,QAAM,SAAS,UAAU,KAAK;AAC9B,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,UAAU;AAC7B,YAAM,OAAO,QAAQ,OAAO,MAAM,KAAK;AAAA,IACzC;AAAA,IACA,QAAQ,OAAO,MAAM,UAAU;AAC7B,YAAM,OAAO,QAAQ,OAAO,MAAM,KAAK;AAAA,IACzC;AAAA,IACA,KAAK,CAAC,SAAS,OAAO,QAAQ,IAAI,IAAI;AAAA,IACtC,QAAQ,OAAO,SAAS;AACtB,YAAM,OAAO,QAAQ,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,OACA,MACA,OACwB;AACxB,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,WAAO,GAAG,MAAS;AAAA,EACrB,QAAQ;AACN,QAAI;AACF,YAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,aAAO,GAAG,MAAS;AAAA,IACrB,SAAS,KAAK;AACZ,aAAO,KAAK,IAAI,MAAM,kCAAkC,IAAI,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,OAAoB,MAAwC;AAC3F,MAAI;AACF,WAAO,GAAG,MAAM,MAAM,IAAI,IAAI,CAAC;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,aAAa,OAAoB,MAAsC;AAC3F,MAAI;AACF,UAAM,MAAM,OAAO,IAAI;AACvB,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAaA,eAAsB,uBACpB,KACA,SACqC;AACrC,MAAI;AACF,UAAM,QAAQ,MAAM,IAAI,gBAAgB;AAAA,MACtC,OAAO,QAAQ;AAAA,MACf,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,IACjE,CAAC;AACD,WAAO,GAAG,EAAE,OAAO,MAAM,OAAO,WAAW,MAAM,WAAW,OAAO,MAAM,MAAM,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAKA,eAAsB,iBACpB,OACA,KACA,SACA,SACgC;AAChC,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,QAAQ,aAAa,MAAM,UAAU;AAAA,IACzC,OAAO,QAAQ;AAAA,IACf,aAAa,QAAQ;AAAA,EACvB,CAAC;AACD,MAAI,OAAO,MAAO,8BAA6B,SAAS,MAAM,KAAK;AACnE,QAAM,SAAS,eAAe,SAAS,QAAQ,OAAO;AACtD,QAAM,aAAa,QAAQ,cAAc,CAAC;AAC1C,QAAM,WAAW,cAAc,YAAY,QAAQ,kBAAkB,CAAC,GAAG,QAAQ,QAAQ;AACzF,QAAM,UAAU;AAAA,IACd,MAAM,QAAQ,EAAE,cAAc,QAAQ,cAAc,SAAS,CAAC;AAAA,IAC9D;AAAA,IACA,QAAQ;AAAA,EACV;AACA,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,OAAO,QAAQ;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,MAClE,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC1E,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnD,SAAS,EAAE,MAAM,SAAS,SAAS,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG;AAAA,IACjE,CAA6C;AAC7C,QAAI,CAAC,OAAO,QAAS,QAAO,KAAK,IAAI,MAAM,OAAO,SAAS,qBAAqB,CAAC;AACjF,WAAO,GAAG,MAAM;AAAA,EAClB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAUA,IAAM,8BAA8B,KAAK,KAAK;AAE9C,eAAe,uBAAuB,QAAgB,gBAAyC;AAC7F,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,cAAc,CAAC;AAC1F,SAAO,qBAAqB,IAAI,WAAW,GAAG,CAAC;AACjD;AAEA,eAAsB,uBACpB,QACA,UACA,QAAQ,6BAC8C;AACtD,MAAI,CAAC,OAAQ,QAAO,KAAK,IAAI,MAAM,4CAA4C,CAAC;AAChF,MAAI,CAAC,SAAS,UAAU,CAAC,SAAS,eAAe,CAAC,SAAS,WAAW;AACpE,WAAO,KAAK,IAAI,MAAM,mEAAmE,CAAC;AAAA,EAC5F;AACA,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK;AAC7C,QAAM,UAAU,EAAE,GAAG,UAAU,KAAK,KAAK,MAAM,UAAU,QAAQ,IAAI,GAAI,EAAE;AAC3E,QAAM,UAAU,oBAAoB,KAAK,UAAU,OAAO,CAAC;AAC3D,QAAM,MAAM,MAAM,uBAAuB,QAAQ,OAAO;AACxD,SAAO,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,GAAG,IAAI,UAAU,CAAC;AACrD;AAEA,eAAsB,yBACpB,QACA,OACA,UACkB;AAClB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,MAAM,GAAG;AAC7C,MAAI,CAAC,WAAW,CAAC,OAAO,UAAU,OAAW,QAAO;AACpD,QAAM,cAAc,MAAM,uBAAuB,QAAQ,OAAO;AAChE,MAAI,CAAC,kBAAkB,KAAK,WAAW,EAAG,QAAO;AACjD,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,oBAAoB,OAAO,CAAC;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SACE,QAAQ,WAAW,SAAS,UAC5B,QAAQ,gBAAgB,SAAS,eACjC,QAAQ,cAAc,SAAS,aAC/B,OAAO,SAAS,QAAQ,GAAG,KAC3B,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE9C;AAEA,SAAS,qBAAqB,OAA2B;AACvD,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AACnD,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,SAAO,qBAAqB,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC;AACzD;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,QAAM,SAAS,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,IAAI,GAAG,GAAG;AAC9F,QAAM,MAAM,KAAK,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,IAAI,MAAM;AACvC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,EAAG,OAAM,CAAC,IAAI,IAAI,WAAW,CAAC;AACnE,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,EAAG,MAAK,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,MAAM;AACf;AAIA,IAAM,yBAAyB,oBAAI,IAAI,CAAC,SAAS,SAAS,SAAS,CAAC;AAMpE,SAAS,cAAc,GAA4C;AACjE,SAAO,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC;AAC5F;AAEO,SAAS,sBAAsB,OAA8C;AAClF,QAAM,OAAO,cAAc,KAAK;AAChC,MAAI,CAAC,QAAQ,KAAK,SAAS,uBAAwB,QAAO;AAC1D,QAAM,OAAO,cAAc,KAAK,UAAU,KAAK,cAAc,KAAK,IAAI,KAAK;AAC3E,QAAM,OAAO,cAAc,KAAK,IAAI;AACpC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,aAAc,QAAO,EAAE,MAAM,aAAa;AAC5D,MAAI,KAAK,SAAS,cAAe,QAAO;AACxC,QAAM,SAAS,OAAO,KAAK,WAAW,YAAY,KAAK,SAAS,KAAK,SAAS;AAC9E,SAAO,EAAE,MAAM,eAAe,QAAQ,SAAS,uBAAuB,IAAI,MAAM,EAAE;AACpF;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,QAAM,IAAI,cAAc,KAAK,GAAG;AAChC,SAAO,MAAM,YAAY,MAAM;AACjC;AAIO,SAAS,0BAA0B,OAA+B;AACvE,QAAM,OAAO,cAAc,KAAK;AAChC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAM,OAAO,cAAc,KAAK,IAAI;AACpC,QAAM,QAAQ,cAAc,KAAK,UAAU;AAC3C,QAAM,OAAO,SAAS,QAAQ;AAC9B,MAAI,SAAS,oBAAoB,SAAS,WAAY,QAAO,kBAAkB,IAAI;AACnF,QAAM,OAAO,cAAc,MAAM,IAAI,KAAK,cAAc,KAAK,IAAI;AACjE,QAAM,OACH,OAAO,MAAM,SAAS,YAAY,KAAK,QACvC,OAAO,MAAM,SAAS,YAAY,KAAK,QACvC,OAAO,KAAK,SAAS,YAAY,KAAK,QACvC;AACF,QAAM,MACJ,SAAS,2BACR,SAAS,cAAc,cAAc,IAAI,GAAG,SAAS;AACxD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,QAAQ,cAAc,cAAc,IAAI,GAAG,KAAK;AACtD,SAAO,kBAAkB,cAAc,OAAO,KAAK,KAAK,SAAS,QAAQ,IAAI;AAC/E;AAEA,SAAS,kBAAkB,OAA+C;AACxE,QAAM,MAAM,MAAM,QAAQ,OAAO,SAAS,IACtC,MAAO,YACP,MAAM,QAAQ,cAAc,OAAO,KAAK,GAAG,SAAS,IACjD,cAAc,MAAO,KAAK,EAAG,YAC9B,CAAC;AACP,QAAM,QAAQ,cAAc,IAAI,CAAC,CAAC;AAClC,QAAM,IACH,OAAO,OAAO,aAAa,YAAY,MAAM,YAC7C,OAAO,OAAO,WAAW,YAAY,MAAM,UAC5C;AACF,SAAO,KAAK;AACd;","names":["box"]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/web-react/index.d.ts

@@ -2,6 +2,7 @@ import * as react from 'react';
 import { ReactNode } from 'react';
 import { S as StepAgentActivity } from '../agent-activity-C8ZG0F0M.js';
 import { FlowTrace } from '../trace/index.js';
+import { Harness } from '../harness/index.js';
 import { C as CatalogModel } from '../model-catalog-BEAEVDaa.js';
 
 /**
@@ -197,6 +198,38 @@ interface AgentActivityPanelProps {
  */
 declare function AgentActivityPanel({ fetchActivity, renderMissionRef, title, emptyLabel }: AgentActivityPanelProps): react.JSX.Element;
 
+interface SandboxTerminalConnection {
+    runtimeUrl: string | null;
+    sidecarUrl: string | null;
+    token: string | null;
+    expiresAt: string | null;
+    status: string;
+    error: string | null;
+    loading: boolean;
+    sandboxId?: string;
+}
+interface SandboxTerminalConnectionResponse {
+    runtimeUrl?: string;
+    sidecarUrl?: string;
+    token?: string;
+    expiresAt?: string;
+    status?: string;
+    error?: string;
+    sandboxId?: string;
+}
+interface UseSandboxTerminalConnectionOptions {
+    workspaceId: string;
+    connectionUrl?: string | ((workspaceId: string) => string);
+    fetcher?: typeof fetch;
+    provisionPollIntervalMs?: number;
+    provisionPollTimeoutMs?: number;
+    tokenRefreshSkewMs?: number;
+}
+interface UseSandboxTerminalConnectionResult extends SandboxTerminalConnection {
+    connect: () => Promise<void>;
+}
+declare function useSandboxTerminalConnection(opts: UseSandboxTerminalConnectionOptions): UseSandboxTerminalConnectionResult;
+
 /**
  * `SeatPaywall` — the shared "unlock this product" screen every agent app
  * shows when a user has no active seat and has spent past the free tier. One
@@ -233,6 +266,34 @@ interface SeatPaywallProps {
  */
 declare function SeatPaywall({ product, onCheckout, priceUsd, includedUsageUsd, tagline, ctaLabel, }: SeatPaywallProps): ReactNode;
 
+interface AgentSessionControlsProps {
+    /** Catalog models — canonical provider-prefixed ids. */
+    models: CatalogModel[];
+    modelsLoading?: boolean;
+    /** Selected canonical model id. */
+    model: string;
+    onModelChange(modelId: string): void;
+    /** Current harness; harness↔model coherence is enforced on every change. */
+    harness: Harness;
+    onHarnessChange(harness: Harness): void;
+    /** Harnesses to offer; defaults to the labeled set. */
+    availableHarnesses?: ReadonlyArray<Harness>;
+    /** Reasoning-effort value + setter. Shown only when the selected model
+     *  `supportsReasoning`, matching `EffortPicker`'s guidance. */
+    effort: string;
+    onEffortChange(effort: string): void;
+    /**
+     * `inline` (default): model, harness, effort side by side — the prior
+     * behavior. `compact`: model inline, harness + effort behind a gear popover.
+     */
+    layout?: 'inline' | 'compact';
+    /** Hide the harness control entirely (single-harness products). */
+    showHarness?: boolean;
+    renderProviderBadge?: (provider: string) => ReactNode;
+    className?: string;
+}
+declare function AgentSessionControls(props: AgentSessionControlsProps): react.JSX.Element;
+
 interface ChatMessageMetrics {
     modelUsed?: string;
     promptTokens?: number;
@@ -353,4 +414,4 @@ type ToolDetailRenderers = Record<string, (call: ChatToolCallInfo, message: Chat
  */
 declare function ChatMessages({ messages, models, renderMarkdown, renderExtras, userLabel, agentLabel, loading, approval, onToolCallClick, toolRenderers, }: ChatMessagesProps): react.JSX.Element;
 
-export { type ActivityTone, type AgentActivityPage, AgentActivityPanel, type AgentActivityPanelProps, type AgentActivityRecord, type ChatMessageMetrics, ChatMessages, type ChatMessagesProps, type ChatStreamCallbacks, type ChatStreamToolCall, type ChatStreamToolResult, type ChatToolCallInfo, type ChatUiMessage, type ConsumeChatStreamResult, EffortPicker, type EffortPickerProps, FlowWaterfall, type FlowWaterfallProps, MissionActivityLane, type MissionActivityLaneProps, ModelPicker, type ModelPickerProps, type ProposalApprovalHandlers, ProviderLogo, type ProviderLogoProps, RunDrillIn, type RunDrillInProps, SeatPaywall, type SeatPaywallProps, type SmoothRevealOptions, type StreamChatOptions, type ToolDetailRenderers, type ToolRunRecord, type ToolRunStep, type WaterfallRow, activityTone, consumeChatStream, dispatchChatStreamLine, formatActivityCost, formatActivityDuration, formatModelCost, formatTokensPerSecond, mergeActivityPages, nextRevealCount, pendingApprovalOf, streamChatTurn, useSmoothText, waterfallLayout };
+export { type ActivityTone, type AgentActivityPage, AgentActivityPanel, type AgentActivityPanelProps, type AgentActivityRecord, AgentSessionControls, type AgentSessionControlsProps, type ChatMessageMetrics, ChatMessages, type ChatMessagesProps, type ChatStreamCallbacks, type ChatStreamToolCall, type ChatStreamToolResult, type ChatToolCallInfo, type ChatUiMessage, type ConsumeChatStreamResult, EffortPicker, type EffortPickerProps, FlowWaterfall, type FlowWaterfallProps, MissionActivityLane, type MissionActivityLaneProps, ModelPicker, type ModelPickerProps, type ProposalApprovalHandlers, ProviderLogo, type ProviderLogoProps, RunDrillIn, type RunDrillInProps, type SandboxTerminalConnection, type SandboxTerminalConnectionResponse, SeatPaywall, type SeatPaywallProps, type SmoothRevealOptions, type StreamChatOptions, type ToolDetailRenderers, type ToolRunRecord, type ToolRunStep, type UseSandboxTerminalConnectionOptions, type UseSandboxTerminalConnectionResult, type WaterfallRow, activityTone, consumeChatStream, dispatchChatStreamLine, formatActivityCost, formatActivityDuration, formatModelCost, formatTokensPerSecond, mergeActivityPages, nextRevealCount, pendingApprovalOf, streamChatTurn, useSandboxTerminalConnection, useSmoothText, waterfallLayout };