@tangle-network/agent-app 0.44.28 → 0.44.29

package/dist/sandbox/index.d.ts

@@ -369,6 +369,29 @@ interface SandboxApiCredentials {
     baseUrl: string;
     apiKey: string;
 }
+/**
+ * Build the sandbox API's sidecar-proxy base for a box:
+ * `{baseUrl}/v1/sidecar-proxy/{sandboxId}`.
+ *
+ * This is the ONLY upstream that serves the interactive terminal. Measured on
+ * production (`sandbox.tangle.tools`, one box, `ws` client, same credential in
+ * every arm):
+ *
+ * | upstream base                          | result                          |
+ * |----------------------------------------|---------------------------------|
+ * | `/v1/sidecar-proxy/{id}`               | 101 -> `ready` 2551ms -> shell  |
+ * | `/v1/sandboxes/{id}/runtime/`          | HTTP 500                        |
+ * | `connection.runtimeUrl` (the box host) | 101 then close 1000, 0 bytes    |
+ *
+ * The box's own `connection.runtimeUrl` (`https://sandbox-*.tangle.sh`) accepts
+ * the upgrade — its Caddy front end upgrades every path, including ones that do
+ * not exist — and then hangs up without a PTY. A 101 from that host therefore
+ * proves nothing; only a `ready` control frame does. Two products shipped a
+ * terminal against it and rendered a permanent spinner.
+ *
+ * Exported so no product writes the path literal a fourth time.
+ */
+declare function sandboxSidecarProxyUrl(baseUrl: string, sandboxId: string): string;
 /** Define a connection configuration for sandbox runtime including URL and optional server-side auth token */
 interface SandboxRuntimeConnection {
     runtimeUrl: string;
@@ -464,6 +487,42 @@ interface WorkspaceSandboxTerminalUpgradeHandlerOptions {
  * ```
  */
 declare function createWorkspaceSandboxTerminalUpgradeHandler(opts: WorkspaceSandboxTerminalUpgradeHandlerOptions): (request: Request) => Promise<Response | null>;
+/** A response-like shape carrying just what the subprotocol echo decision reads. */
+interface TerminalUpgradeResponseLike {
+    status: number;
+    statusText?: string;
+    headers: Headers;
+}
+/**
+ * Decide whether a terminal upgrade's 101 needs the browser's own subprotocol
+ * echoed back onto it, and return the headers to answer with. `null` means
+ * "pass the upstream response through untouched".
+ *
+ * Why this exists: the browser's terminal credential rides in a
+ * `bearer.<base64url>` WebSocket subprotocol, because a browser cannot set
+ * `Authorization` on a WS handshake. That subprotocol is a browser-to-Worker
+ * credential, so it is stripped before the upstream hop — and the upstream then
+ * answers the 101 selecting nothing. A browser MUST fail the connection when a
+ * 101 selects no subprotocol after it offered one (RFC 6455 s4.1), so the socket
+ * dies on open and the terminal renders a spinner forever.
+ *
+ * Kept as a pure function because a 101 `Response` cannot be constructed off
+ * Workers, so this is the only part of the decision a test can drive directly.
+ */
+declare function terminalUpgradeSubprotocolEcho(upstream: TerminalUpgradeResponseLike, browserProtocol: string | null): {
+    status: number;
+    statusText: string;
+    headers: Headers;
+} | null;
+/**
+ * The exact `bearer.*` subprotocol string the browser offered, so it can be
+ * echoed verbatim on the 101. Returns null when the browser offered none.
+ *
+ * Takes the raw `Sec-WebSocket-Protocol` value rather than the `Headers`, to
+ * match its siblings `bearerSubprotocolToken` and `stripBearerSubprotocol` —
+ * one shape for the whole family, and the caller reads the header once.
+ */
+declare function selectedBearerSubprotocol(value: string | null): string | null;
 /** Build proxy headers for sandbox runtime including authorization and forwarded headers */
 declare function buildSandboxRuntimeProxyHeaders(source: Headers, sandboxApiKey: string, forwardHeaders?: string[]): Headers;
 /** Encode a runtime path by URI-encoding each valid segment and returning null for invalid segments */
@@ -475,6 +534,199 @@ declare function bearerSubprotocolToken(value: string | null): string | null;
 /** Resolve the terminal token from request headers using Authorization or Sec-WebSocket-Protocol fields */
 declare function terminalTokenFromRequest(headers: Headers): string | null;
 
+/**
+ * `createSandboxPrewarmer` — "this user just opened this project; start warming
+ * their box" as a shell primitive, so every agent-app product gets the same
+ * answer instead of forking one.
+ *
+ * WHY THIS IS SHELL, NOT ENGINE. The engine rule asks whether the capability
+ * makes sense without a specific app's side channel. "Warm a box" does — but
+ * `@tangle-network/sandbox` has no notion of a WORKSPACE. It keys boxes by an
+ * opaque sandbox id; the workspace→box mapping, the harness match, and the
+ * profile materialisation all live in `ensureWorkspaceSandbox` here. A
+ * prewarmer is that mapping plus a scheduling policy, so it belongs beside it.
+ * It is deliberately NOT a new subpath: it composes `peekWorkspaceSandbox` and
+ * `ensureWorkspaceSandbox` directly and needs exactly the peers `/sandbox`
+ * already needs, so a separate entry would add a second place to look for "how
+ * do I get a box" and buy no peer isolation (the reason `/work-product-react`
+ * is split out).
+ *
+ * WHAT IT IS NOT. It does not make cold starts fast — they already are.
+ * Measured on the real platform (staging-sandbox, n=5, 2026-07-28): a box goes
+ * from nothing to terminal-ready in 2.34–3.19 s (median 2.73 s), and an
+ * already-running box answers in 1.16–2.29 s (median 1.35 s). Prewarming buys
+ * ~1.4 s. The reason it matters is not latency: it is that a product which
+ * only ever provisions lazily, on a path whose guard never passes, never
+ * provisions AT ALL — and the UI then shows a spinner over a box that does not
+ * exist and is not being created. That is the failure this primitive removes.
+ *
+ * ── COST POSTURE (read before adopting) ────────────────────────────────────
+ * A warmed box is a REAL charge. It bills from creation until the platform's
+ * idle timeout reclaims it — `SandboxRuntimeConfig`'s create-time
+ * `idleTimeoutSeconds`, not anything this module sets. A product warming on
+ * every project open pays that timeout for every user who opens and bounces.
+ * With a 3600 s idle timeout against a ~131 s mean session life, a bounce
+ * costs an hour of box time to save ~1.4 s. THAT TRADE IS USUALLY WRONG.
+ *
+ * So the levers are explicit and the defaults are the cheap ones:
+ *   - `mode: 'resume-only'` (DEFAULT) never creates a box that does not exist.
+ *     It only revives one the user already has, so the spend is bounded by
+ *     boxes the user already caused. This is the safe fleet default.
+ *   - `mode: 'create-or-resume'` is the owner-requested behaviour — warm on
+ *     open even for a first-time user. Opt in per product, and lower the
+ *     shell's `idleTimeoutSeconds` when you do.
+ *   - `shouldPrewarm(scope)` is the product's own policy hook (paid tier only,
+ *     returning user only, has-documents only …). Returning false costs nothing.
+ *   - `failureCooldownMs` stops a hard-failing workspace from retry-storming;
+ *     every retry is another create attempt, which is more spend.
+ * Warm with the SAME harness the next turn will use. `ensureWorkspaceSandbox`
+ * DELETES and recreates a name-matched box whose harness differs, so warming
+ * `opencode` and then turning `claude-code` pays for two boxes and is slower
+ * than not warming at all. The prewarm key includes the harness so the two are
+ * never deduped into one.
+ *
+ * ── SINGLE-FLIGHT (measured, not assumed) ──────────────────────────────────
+ * The sandbox platform does NOT dedupe by box name. Two concurrent
+ * `POST /v1/sandboxes` with an identical name both returned HTTP 201 and left
+ * two running boxes (verified against staging-sandbox, 2026-07-28). So two
+ * tabs, or two isolates, racing a warm genuinely leak a box — a prewarm that
+ * races is worse than no prewarm. Hence two layers:
+ *   1. an in-process map, which is free and catches same-isolate races
+ *      (double-mount, two requests on one isolate);
+ *   2. a `claim` store the product supplies, which is the only thing that can
+ *      make this correct ACROSS isolates — the usual deployment target here is
+ *      Cloudflare Workers, where "same isolate" guarantees nothing.
+ * `claim` is REQUIRED, with `'single-isolate-only'` as the explicit opt-out,
+ * so nobody gets the unsafe behaviour by forgetting a field. Say it out loud
+ * or supply a store.
+ *
+ * ── FAILURE IS LOUD, NEVER FATAL ───────────────────────────────────────────
+ * A failed warm degrades to exactly today's lazy path: the next real request
+ * calls `ensureWorkspaceSandbox` itself. It never throws into the caller's
+ * render path — `completion` RESOLVES with `{ ok: false }` rather than
+ * rejecting, because an unhandled rejection handed to `waitUntil` can fail the
+ * request it rode in on. But it is never silent: every failure fires
+ * `onEvent({ type: 'failed' })` and is readable afterwards through
+ * `readiness()` as `{ status: 'failed' }`. The bug class this whole module
+ * exists to kill is a soft failure that surfaces as an unusable panel ten
+ * minutes later, so a warm that dies must leave a trace a product can render.
+ */
+
+/** The workspace a warm targets. Mirrors `EnsureWorkspaceSandboxOptions`'
+ *  identity fields — the prewarmer forwards them verbatim so a warmed box is
+ *  byte-identical to the one the lazy path would have built. */
+interface SandboxPrewarmScope {
+    workspaceId: string;
+    userId?: string;
+    /** Must match the harness the next turn will use — see the cost note above. */
+    harness: Harness;
+    billingOwnerId?: string;
+}
+/**
+ * Cross-isolate claim. `acquire` must be atomic (a D1 conditional insert, a DO,
+ * a KV `put` with `onlyIf`) — a read-then-write is exactly the race this exists
+ * to close. `ttlSeconds` bounds a claim leaked by an isolate that died
+ * mid-warm; without expiry a single crash wedges a workspace forever.
+ */
+interface PrewarmClaimStore {
+    /** True when THIS caller now owns the right to warm `key`. */
+    acquire(key: string, ttlSeconds: number): Promise<boolean>;
+    /** Best-effort release. A throw here is swallowed — the TTL is the backstop. */
+    release(key: string): Promise<void>;
+    /** Optional: lets `readiness()` report `warming` for a warm running in
+     *  ANOTHER isolate. Without it, `warming` is only visible in the isolate
+     *  that started it, and every other one reports `absent`. */
+    isHeld?(key: string): Promise<boolean>;
+}
+/** What `prewarm()` decided. Every value except `started` means no box was
+ *  created and nothing was spent on this call. */
+type PrewarmOutcome = 'started' | 'already-running' | 'already-warming' | 'warming-elsewhere' | 'declined-by-policy' | 'cooling-down' | 'absent-and-resume-only';
+/** Terminal result of a warm this caller owns. Never a rejection. */
+interface PrewarmResult {
+    ok: boolean;
+    boxId?: string;
+    error?: string;
+    /** Wall time of the warm itself, for the product's own timing trace. */
+    ms: number;
+}
+interface PrewarmDecision {
+    outcome: PrewarmOutcome;
+    /** Present ONLY when `outcome === 'started'`. Hand it to `ctx.waitUntil` so a
+     *  client disconnect cannot kill the warm. Never rejects. */
+    completion?: Promise<PrewarmResult>;
+}
+/** Readiness for the UI. `ready`/`warming` reuse the vocabulary
+ *  `createSandboxFileIndexRoute` (`/chat-routes`) and `useFileMentions`
+ *  (`/web-react`) already speak, so a product renders ONE warming state rather
+ *  than inventing a second spinner for boxes. */
+type SandboxReadiness = {
+    status: 'ready';
+    boxId: string;
+} | {
+    status: 'warming';
+} | {
+    status: 'absent';
+} | {
+    status: 'failed';
+    error: string;
+    retryAfterMs: number;
+};
+type PrewarmEvent = {
+    type: 'started';
+    key: string;
+    workspaceId: string;
+} | {
+    type: 'succeeded';
+    key: string;
+    workspaceId: string;
+    boxId: string;
+    ms: number;
+} | {
+    type: 'failed';
+    key: string;
+    workspaceId: string;
+    error: string;
+    ms: number;
+} | {
+    type: 'skipped';
+    key: string;
+    workspaceId: string;
+    outcome: PrewarmOutcome;
+};
+interface SandboxPrewarmerOptions {
+    /** Cross-isolate single-flight, or the explicit acknowledgement that you are
+     *  accepting per-isolate dedupe only. No default — see the header. */
+    claim: PrewarmClaimStore | 'single-isolate-only';
+    /** `'resume-only'` (default) never creates a box that does not exist.
+     *  `'create-or-resume'` warms from nothing — the expensive one. */
+    mode?: 'resume-only' | 'create-or-resume';
+    /** Product policy gate. Not called when a box is already running. */
+    shouldPrewarm?(scope: SandboxPrewarmScope): boolean | Promise<boolean>;
+    /** Observability seam. A failed warm MUST be visible somewhere. */
+    onEvent?(event: PrewarmEvent): void;
+    /** Claim lifetime. Default 180 s — comfortably over a cold create. */
+    claimTtlSeconds?: number;
+    /** Suppress re-warming a workspace that just failed. Default 60_000 ms. */
+    failureCooldownMs?: number;
+    /** Clock seam for tests. */
+    now?(): number;
+}
+interface SandboxPrewarmer {
+    /**
+     * Non-blocking warm. The returned promise settles as soon as the DECISION is
+     * known (at most one `list()` against the platform, plus a claim `acquire`);
+     * the provisioning itself rides on `completion`. On a render path either
+     * ignore the returned promise or run the whole call inside `waitUntil` — do
+     * not await `completion` before responding.
+     */
+    prewarm(scope: SandboxPrewarmScope): Promise<PrewarmDecision>;
+    /** Zero-provisioning status read for a UI. Never creates or resumes. */
+    readiness(scope: SandboxPrewarmScope): Promise<SandboxReadiness>;
+    /** Clear a recorded failure so the next `prewarm` retries immediately. */
+    clearFailure(scope: SandboxPrewarmScope): void;
+}
+declare function createSandboxPrewarmer(shell: SandboxRuntimeConfig, options: SandboxPrewarmerOptions): SandboxPrewarmer;
+
 /** Define client credentials for accessing the sandbox environment with API key and base URL */
 interface SandboxClientCredentials {
     apiKey: string;
@@ -976,4 +1228,4 @@ declare function isTerminalPromptEvent(event: unknown): boolean;
 /** Resolve the interactive question text from a structured event or return null if none found */
 declare function detectInteractiveQuestion(event: unknown): string | null;
 
-export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, type BuildSandboxToolFileMountsOptions, DEFAULT_SANDBOX_RESOURCES, type DriveSandboxTurnOptions, ENV_TOTAL_MAX_BYTES, ENV_VALUE_MAX_BYTES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type ModelSelection, type ModelSelectionError, type ModelSelectionFailure, type ModelSelectionSource, type Outcome, PROVISION_PAYLOAD_MAX_BYTES, type PeekWorkspaceSandboxOutcome, type ProfileComposeOptions, type PromptInputPart, type ProviderResolutionConfig, type ProvisionPayloadSections, type ProvisionProfileSection, type ResolveSandboxClientCredentialsOptions, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxCredentialEnvironment, type SandboxExecChannel, type SandboxExecOptions, type SandboxFileBytesOutcome, type SandboxFileSizeOutcome, SandboxModelResolutionError, type SandboxPermissionLevel, SandboxRecoveryFailedError, type SandboxRecoveryPhase, type SandboxResourceConfig, type SandboxRestoreSpec, SandboxRuntimeAuthRefreshError, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type SandboxToolPathOptions, type SandboxToolSpec, type ScopedTokenResult, type SecretStore, type StoppedSandboxResumeFailure, type StoppedSandboxResumeRecovery, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, type WriteProfileFilesOptions, assertEnvWithinLimits, assertProvisionPayloadWithinCap, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, buildSandboxToolFileMounts, buildSandboxToolPathSetupScript, classifySeveredStream, collectSandboxPromptText, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deferredCorpusHash, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mergeHistoryIntoParts, mintSandboxScopedToken, mintTerminalProxyToken, peekWorkspaceSandbox, readSandboxBinaryBytes, readSecret, requireTransportableModel, resetClientCache, resolveModel, resolveModelSelection, resolveSandboxClientCredentials, runSandboxPrompt, runSandboxToolPathSetup, sandboxToolBinDir, sandboxToolPath, sandboxToolRootDir, secretStoreFromClient, shellQuote, splitDeferredProfileFiles, statSandboxFileSize, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };
+export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, type BuildSandboxToolFileMountsOptions, DEFAULT_SANDBOX_RESOURCES, type DriveSandboxTurnOptions, ENV_TOTAL_MAX_BYTES, ENV_VALUE_MAX_BYTES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type ModelSelection, type ModelSelectionError, type ModelSelectionFailure, type ModelSelectionSource, type Outcome, PROVISION_PAYLOAD_MAX_BYTES, type PeekWorkspaceSandboxOutcome, type PrewarmClaimStore, type PrewarmDecision, type PrewarmEvent, type PrewarmOutcome, type PrewarmResult, type ProfileComposeOptions, type PromptInputPart, type ProviderResolutionConfig, type ProvisionPayloadSections, type ProvisionProfileSection, type ResolveSandboxClientCredentialsOptions, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxCredentialEnvironment, type SandboxExecChannel, type SandboxExecOptions, type SandboxFileBytesOutcome, type SandboxFileSizeOutcome, SandboxModelResolutionError, type SandboxPermissionLevel, type SandboxPrewarmScope, type SandboxPrewarmer, type SandboxPrewarmerOptions, type SandboxReadiness, SandboxRecoveryFailedError, type SandboxRecoveryPhase, type SandboxResourceConfig, type SandboxRestoreSpec, SandboxRuntimeAuthRefreshError, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type SandboxToolPathOptions, type SandboxToolSpec, type ScopedTokenResult, type SecretStore, type StoppedSandboxResumeFailure, type StoppedSandboxResumeRecovery, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type TerminalUpgradeResponseLike, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, type WriteProfileFilesOptions, assertEnvWithinLimits, assertProvisionPayloadWithinCap, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, buildSandboxToolFileMounts, buildSandboxToolPathSetupScript, classifySeveredStream, collectSandboxPromptText, createSandboxPrewarmer, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deferredCorpusHash, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mergeHistoryIntoParts, mintSandboxScopedToken, mintTerminalProxyToken, peekWorkspaceSandbox, readSandboxBinaryBytes, readSecret, requireTransportableModel, resetClientCache, resolveModel, resolveModelSelection, resolveSandboxClientCredentials, runSandboxPrompt, runSandboxToolPathSetup, sandboxSidecarProxyUrl, sandboxToolBinDir, sandboxToolPath, sandboxToolRootDir, secretStoreFromClient, selectedBearerSubprotocol, shellQuote, splitDeferredProfileFiles, statSandboxFileSize, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, terminalUpgradeSubprotocolEcho, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };

package/dist/sandbox/index.js

@@ -17,6 +17,7 @@ import {
   buildSandboxToolPathSetupScript,
   classifySeveredStream,
   collectSandboxPromptText,
+  createSandboxPrewarmer,
   createSandboxTerminalToken,
   createWorkspaceSandboxConnectionHandler,
   createWorkspaceSandboxManager,
@@ -47,10 +48,12 @@ import {
   resolveSandboxClientCredentials,
   runSandboxPrompt,
   runSandboxToolPathSetup,
+  sandboxSidecarProxyUrl,
   sandboxToolBinDir,
   sandboxToolPath,
   sandboxToolRootDir,
   secretStoreFromClient,
+  selectedBearerSubprotocol,
   shellQuote,
   splitDeferredProfileFiles,
   statSandboxFileSize,
@@ -60,10 +63,11 @@ import {
   syncSandboxMemberRemove,
   syncSandboxMemberRole,
   terminalTokenFromRequest,
+  terminalUpgradeSubprotocolEcho,
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "../chunk-7775L5NN.js";
+} from "../chunk-BAC2B2KI.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-CQZSAR77.js";
 import "../chunk-ICOHEZK6.js";
@@ -90,6 +94,7 @@ export {
   buildSandboxToolPathSetupScript,
   classifySeveredStream,
   collectSandboxPromptText,
+  createSandboxPrewarmer,
   createSandboxTerminalToken,
   createWorkspaceSandboxConnectionHandler,
   createWorkspaceSandboxManager,
@@ -120,10 +125,12 @@ export {
   resolveSandboxClientCredentials,
   runSandboxPrompt,
   runSandboxToolPathSetup,
+  sandboxSidecarProxyUrl,
   sandboxToolBinDir,
   sandboxToolPath,
   sandboxToolRootDir,
   secretStoreFromClient,
+  selectedBearerSubprotocol,
   shellQuote,
   splitDeferredProfileFiles,
   statSandboxFileSize,
@@ -133,6 +140,7 @@ export {
   syncSandboxMemberRemove,
   syncSandboxMemberRole,
   terminalTokenFromRequest,
+  terminalUpgradeSubprotocolEcho,
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.44.28",
+  "version": "0.44.29",
   "packageManager": "pnpm@10.33.4",
   "description": "Application-shell framework for Tangle agent products: a bounded tool loop, the structured agent→app tool side channel, integration-hub client, per-workspace billing, and crypto — composed over the Tangle agent substrate through typed seams.",
   "keywords": [