@tangle-network/agent-app 0.36.0 → 0.38.0

package/dist/sandbox/index.d.ts

@@ -3,6 +3,26 @@ export { StorageConfig } from '@tangle-network/sandbox';
 import { a as AppToolName, c as ToolHeaderNames } from '../auth-BlS9GWfL.js';
 import { b as AppToolContext } from '../types-2rOJo8Hc.js';
 import { Harness } from '../harness/index.js';
+import { f as TangleExecutionEnvironment } from '../model-dF2h4xT9.js';
+
+type Outcome<T> = {
+    succeeded: true;
+    value: T;
+} | {
+    succeeded: false;
+    error: Error;
+};
+
+interface TerminalProxyIdentity {
+    userId: string;
+    workspaceId: string;
+    sandboxId: string;
+}
+declare function mintTerminalProxyToken(secret: string, identity: TerminalProxyIdentity, ttlMs?: number, now?: () => number): Promise<Outcome<{
+    token: string;
+    expiresAt: Date;
+}>>;
+declare function verifyTerminalProxyToken(secret: string, token: string, expected: TerminalProxyIdentity, now?: () => number): Promise<boolean>;
 
 interface WorkspaceSandboxInstanceLike {
     id: string;
@@ -42,15 +62,10 @@ interface WorkspaceSandboxManager<TBox extends WorkspaceSandboxInstanceLike, TEn
 declare function createWorkspaceSandboxManager<TClient, TBox extends WorkspaceSandboxInstanceLike, TEnsureOptions = void>(opts: WorkspaceSandboxManagerOptions<TClient, TBox, TEnsureOptions>): WorkspaceSandboxManager<TBox, TEnsureOptions>;
 interface SandboxTerminalTokenOptions {
     secret?: string;
-    prefix?: string;
     expiresInMs?: number;
     now?: () => number;
 }
-interface SandboxTerminalTokenSubject {
-    userId: string;
-    workspaceId: string;
-    sandboxId: string;
-}
+type SandboxTerminalTokenSubject = TerminalProxyIdentity;
 interface SandboxTerminalTokenResult {
     token: string;
     expiresAt: Date;
@@ -70,7 +85,6 @@ interface WorkspaceSandboxConnectionHandlerOptions<TBox extends WorkspaceSandbox
     ensureWorkspaceSandbox: (workspaceId: string, userId: string) => Promise<TBox>;
     tokenSecret: string | (() => string | undefined);
     tokenExpiresInMs?: number;
-    tokenPrefix?: string;
     proxyRuntimeUrl?: (args: {
         request: Request;
         workspaceId: string;
@@ -92,6 +106,7 @@ interface SandboxApiCredentials {
 }
 interface SandboxRuntimeConnection {
     runtimeUrl: string;
+    /** Server-side sidecar bearer. Must authorize terminal routes; never expose it to browser code. */
     authToken?: string;
 }
 interface WorkspaceSandboxRuntimeProxyHandlerOptions {
@@ -115,7 +130,6 @@ interface WorkspaceSandboxRuntimeProxyHandlerOptions {
         sandboxId: string;
     }) => Promise<SandboxRuntimeConnection | null | undefined>;
     tokenSecret: string | (() => string | undefined);
-    tokenPrefix?: string;
     fetch?: typeof fetch;
     forwardHeaders?: string[];
 }
@@ -165,7 +179,6 @@ interface WorkspaceSandboxTerminalUpgradeHandlerOptions {
         sandboxId: string;
     }) => Promise<SandboxRuntimeConnection | null | undefined>;
     tokenSecret: string | (() => string | undefined);
-    tokenPrefix?: string;
     fetch?: typeof fetch;
 }
 /**
@@ -186,17 +199,57 @@ declare function bearerToken(value: string | null): string | null;
 declare function bearerSubprotocolToken(value: string | null): string | null;
 declare function terminalTokenFromRequest(headers: Headers): string | null;
 
-type Outcome<T> = {
-    succeeded: true;
-    value: T;
-} | {
-    succeeded: false;
-    error: Error;
-};
 interface SandboxClientCredentials {
     apiKey: string;
     baseUrl: string;
 }
+/**
+ * Sandbox credential policy reuses the canonical execution-environment union
+ * (development/test/staging/production) so env classification stays in one place
+ * (see resolveTangleExecutionEnvironment in runtime/model).
+ */
+type SandboxCredentialEnvironment = TangleExecutionEnvironment;
+interface ResolveSandboxClientCredentialsOptions {
+    /**
+     * Environment object to read from. Defaults to process.env when available.
+     */
+    env?: Record<string, string | undefined>;
+    /**
+     * Explicit environment classification. Defaults to APP_ENV/NODE_ENV derived
+     * behavior: local/development/test use direct env credentials; staging/prod
+     * require the provision callback unless allowDirectEnvCredentials opts in.
+     */
+    environment?: SandboxCredentialEnvironment;
+    /**
+     * Env names that may carry a sandbox-compatible bearer. The first non-empty
+     * value wins when direct env credentials are allowed.
+     */
+    directKeyNames?: readonly string[];
+    /**
+     * Env names that may carry the sandbox gateway URL. The first non-empty value
+     * wins, then defaultBaseUrl.
+     */
+    baseUrlNames?: readonly string[];
+    /**
+     * Base URL used when none of baseUrlNames are present.
+     */
+    defaultBaseUrl?: string;
+    /**
+     * Whether direct env credentials are allowed for this environment. Defaults
+     * to true in development/test and false in staging/production.
+     */
+    allowDirectEnvCredentials?: boolean | ((environment: SandboxCredentialEnvironment) => boolean);
+    /**
+     * Product-owned provision path, usually minting a per-user sandbox key from a
+     * linked platform account. Called before direct env credentials in
+     * staging/production and after direct env credentials in development/test.
+     */
+    provision?: (context: {
+        environment: SandboxCredentialEnvironment;
+        env: Record<string, string | undefined>;
+    }) => SandboxClientCredentials | null | undefined | Promise<SandboxClientCredentials | null | undefined>;
+}
+declare function resolveSandboxClientCredentials(options?: ResolveSandboxClientCredentialsOptions): Promise<SandboxClientCredentials>;
 interface SandboxResourceConfig {
     image: string;
     cpuCores: number;
@@ -256,6 +309,7 @@ interface SandboxRuntimeConfig {
     childKeyMint?: (scope: SandboxScope) => Promise<Outcome<string>>;
     bootstrap?: (box: SandboxInstance, scope: SandboxScope) => Promise<Outcome<void>>;
     livenessProbe?: LivenessProbeConfig;
+    webTerminalEnabled?: boolean;
     resumeStopped?: boolean;
     backendModelAtCreate?: boolean;
     deferProfileFiles?: boolean;
@@ -282,6 +336,27 @@ interface EnsureWorkspaceSandboxOptions {
     harness: Harness;
     forceNew?: boolean;
 }
+interface SandboxToolSpec {
+    name: string;
+    content: string;
+    executable?: boolean;
+}
+interface SandboxToolPathOptions {
+    appName: string;
+    baseDir?: string;
+    binDir?: string;
+}
+interface BuildSandboxToolFileMountsOptions extends SandboxToolPathOptions {
+    tools: readonly SandboxToolSpec[];
+}
+declare function sandboxToolRootDir(options: SandboxToolPathOptions): string;
+declare function sandboxToolBinDir(options: SandboxToolPathOptions): string;
+declare function sandboxToolPath(options: SandboxToolPathOptions & {
+    toolName: string;
+}): string;
+declare function buildSandboxToolFileMounts(options: BuildSandboxToolFileMountsOptions): AgentProfileFileMount[];
+declare function buildSandboxToolPathSetupScript(options: SandboxToolPathOptions): string;
+declare function runSandboxToolPathSetup(box: SandboxInstance, options: SandboxToolPathOptions): Promise<Outcome<void>>;
 declare function splitDeferredProfileFiles(profile: AgentProfile): {
     leanProfile: AgentProfile;
     deferredFiles: AgentProfileFileMount[];
@@ -361,16 +436,6 @@ declare function mintSandboxScopedToken(box: SandboxInstance, options: {
 declare function driveSandboxTurn(shell: SandboxRuntimeConfig, box: SandboxInstance, message: string, options: StreamSandboxPromptOptions & {
     sessionId: string;
 }): Promise<Outcome<PromptResult>>;
-interface TerminalProxyIdentity {
-    userId: string;
-    workspaceId: string;
-    sandboxId: string;
-}
-declare function mintTerminalProxyToken(secret: string, identity: TerminalProxyIdentity, ttlMs?: number): Promise<Outcome<{
-    token: string;
-    expiresAt: Date;
-}>>;
-declare function verifyTerminalProxyToken(secret: string, token: string, expected: TerminalProxyIdentity): Promise<boolean>;
 type SandboxStepTransition = {
     kind: 'step-start';
 } | {
@@ -382,4 +447,4 @@ declare function classifySeveredStream(event: unknown): SandboxStepTransition |
 declare function isTerminalPromptEvent(event: unknown): boolean;
 declare function detectInteractiveQuestion(event: unknown): string | null;
 
-export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, DEFAULT_SANDBOX_RESOURCES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type Outcome, type ProfileComposeOptions, type ProviderResolutionConfig, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxPermissionLevel, type SandboxResourceConfig, type SandboxRestoreSpec, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type ScopedTokenResult, type SecretStore, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, classifySeveredStream, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mintSandboxScopedToken, mintTerminalProxyToken, readSecret, resetClientCache, resolveModel, runSandboxPrompt, secretStoreFromClient, splitDeferredProfileFiles, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };
+export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, type BuildSandboxToolFileMountsOptions, DEFAULT_SANDBOX_RESOURCES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type Outcome, type ProfileComposeOptions, type ProviderResolutionConfig, type ResolveSandboxClientCredentialsOptions, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxCredentialEnvironment, type SandboxPermissionLevel, type SandboxResourceConfig, type SandboxRestoreSpec, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type SandboxToolPathOptions, type SandboxToolSpec, type ScopedTokenResult, type SecretStore, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, buildSandboxToolFileMounts, buildSandboxToolPathSetupScript, classifySeveredStream, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mintSandboxScopedToken, mintTerminalProxyToken, readSecret, resetClientCache, resolveModel, resolveSandboxClientCredentials, runSandboxPrompt, runSandboxToolPathSetup, sandboxToolBinDir, sandboxToolPath, sandboxToolRootDir, secretStoreFromClient, splitDeferredProfileFiles, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };

package/dist/sandbox/index.js

@@ -5,6 +5,8 @@ import {
   bearerToken,
   buildAppToolMcpServers,
   buildSandboxRuntimeProxyHeaders,
+  buildSandboxToolFileMounts,
+  buildSandboxToolPathSetupScript,
   classifySeveredStream,
   createSandboxTerminalToken,
   createWorkspaceSandboxConnectionHandler,
@@ -27,7 +29,12 @@ import {
   readSecret,
   resetClientCache,
   resolveModel,
+  resolveSandboxClientCredentials,
   runSandboxPrompt,
+  runSandboxToolPathSetup,
+  sandboxToolBinDir,
+  sandboxToolPath,
+  sandboxToolRootDir,
   secretStoreFromClient,
   splitDeferredProfileFiles,
   storeSecret,
@@ -39,10 +46,11 @@ import {
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "../chunk-GZGF3JWQ.js";
+} from "../chunk-MJ3RUHD4.js";
 import "../chunk-5VXPDXZJ.js";
-import "../chunk-MH6AVXQ7.js";
+import "../chunk-VT5DI6GL.js";
 import "../chunk-A76ZHWNF.js";
+import "../chunk-7W5XSTUF.js";
 import "../chunk-JZZ6AWF4.js";
 export {
   DEFAULT_SANDBOX_RESOURCES,
@@ -51,6 +59,8 @@ export {
   bearerToken,
   buildAppToolMcpServers,
   buildSandboxRuntimeProxyHeaders,
+  buildSandboxToolFileMounts,
+  buildSandboxToolPathSetupScript,
   classifySeveredStream,
   createSandboxTerminalToken,
   createWorkspaceSandboxConnectionHandler,
@@ -73,7 +83,12 @@ export {
   readSecret,
   resetClientCache,
   resolveModel,
+  resolveSandboxClientCredentials,
   runSandboxPrompt,
+  runSandboxToolPathSetup,
+  sandboxToolBinDir,
+  sandboxToolPath,
+  sandboxToolRootDir,
   secretStoreFromClient,
   splitDeferredProfileFiles,
   storeSecret,

package/dist/studio-react/index.js

@@ -963,7 +963,8 @@ function GenerationDetail({
 }) {
   const cfg = typeConfigFor(generation.type);
   const Icon = cfg.icon;
-  const href = vaultHref ? vaultHref(generationVaultPath(generation)) : null;
+  const vaultPath = generationVaultPath(generation);
+  const href = vaultHref && vaultPath ? vaultHref(vaultPath) : null;
   return /* @__PURE__ */ jsxs12("div", { className: "space-y-4", children: [
     /* @__PURE__ */ jsx13("div", { className: "overflow-hidden rounded-lg bg-muted/50", children: generation.type === "image" && generation.result ? /* @__PURE__ */ jsx13("img", { src: generation.result, alt: generation.prompt, className: "max-h-[420px] w-full object-contain" }) : (generation.type === "video" || generation.type === "avatar") && generation.result ? /* @__PURE__ */ jsx13("video", { src: generation.result, controls: true, className: "max-h-[420px] w-full" }) : generation.type === "speech" && generation.result ? /* @__PURE__ */ jsx13("div", { className: "p-6", children: /* @__PURE__ */ jsx13("audio", { src: generation.result, controls: true, className: "w-full" }) }) : /* @__PURE__ */ jsx13("div", { className: "flex h-32 items-center justify-center", children: /* @__PURE__ */ jsx13(Icon, { className: "h-8 w-8 text-muted-foreground/20" }) }) }),
     /* @__PURE__ */ jsxs12("div", { className: "flex flex-wrap items-center gap-2", children: [