@tangle-network/agent-app 0.44.55 → 0.44.57

package/dist/{chunk-JTLYXUEV.js → chunk-5FAKBTCK.js}

@@ -71,6 +71,16 @@ function classifyAuthed(outcome, ctx) {
 function trimTrailingSlash(url) {
   return url.replace(/\/+$/, "");
 }
+function requiredValueProbe(config) {
+  return {
+    name: `required:${config.name}`,
+    critical: config.critical,
+    run: async () => {
+      const ok = typeof config.value === "string" && config.value.trim().length > 0;
+      return { ok, detail: ok ? void 0 : config.missingDetail ?? `${config.name} is unset` };
+    }
+  };
+}
 function routerChatProbe(config) {
   const keyLabel = config.keySecret ?? "the router API key";
   const urlLabel = config.urlSecret ?? "the router base URL";
@@ -231,10 +241,11 @@ function formatPreflightReport(report) {
 }
 
 export {
+  requiredValueProbe,
   routerChatProbe,
   sandboxAuthProbe,
   httpHeadProbe,
   runPreflight,
   formatPreflightReport
 };
-//# sourceMappingURL=chunk-JTLYXUEV.js.map
+//# sourceMappingURL=chunk-5FAKBTCK.js.map

package/dist/chunk-5FAKBTCK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/preflight/index.ts"],"sourcesContent":["/**\n * `/preflight` — deploy-time secret-liveness probes.\n *\n * WHY THIS EXISTS: on 2026-07-15 four secrets were simultaneously dead in one\n * production day — a dead `SANDBOX_API_KEY`, a stale `SANDBOX_API_URL`, and a\n * dead LiteLLM router key + URL. Each one was present in `wrangler secret list`\n * (so nothing looked wrong) yet invalid against its live endpoint, and nothing\n * anywhere checked liveness. CI cannot hold production secrets, so this binds\n * at DEPLOY time instead: a product declares a handful of probes built from its\n * real env, the deploy workflow runs `agent-app-preflight` as a step, and a\n * dead secret fails the deploy with a message that names exactly which secret\n * to rotate.\n *\n * A probe is `{ name, run, critical? }`; `run()` returns `{ ok, detail? }`.\n * The standard builders (`requiredValueProbe`, `routerChatProbe`,\n * `sandboxAuthProbe`, `httpHeadProbe`) each take explicit config — they read\n * nothing global — so the same probe runs identically in a deploy step, a test,\n * or a local check. `runPreflight` fans\n * the probes out, times each, and folds them into a pass/fail report: any\n * failed CRITICAL probe fails the whole run (probes are critical by default).\n *\n * Server-only: probes carry live API keys and hit live endpoints. This subpath\n * must never reach a browser bundle.\n */\n\n/** One probe's outcome. `detail` should name the secret to rotate on failure. */\nexport interface PreflightProbeResult {\n  ok: boolean\n  detail?: string\n}\n\n/**\n * A liveness probe. `run` performs one cheap live call and maps the result to\n * `{ ok, detail }`. `critical` defaults to `true` — a failed critical probe\n * fails the whole preflight (and the deploy).\n */\nexport interface PreflightProbe {\n  name: string\n  run: () => Promise<PreflightProbeResult>\n  critical?: boolean\n}\n\n/** Per-probe verdict enriched with the resolved criticality and measured latency. */\nexport interface PreflightProbeVerdict {\n  name: string\n  ok: boolean\n  critical: boolean\n  latencyMs: number\n  detail?: string\n}\n\n/** Aggregate of every probe verdict plus the overall pass/fail decision. */\nexport interface PreflightReport {\n  /** `false` if any critical probe failed. */\n  ok: boolean\n  probes: PreflightProbeVerdict[]\n  passed: number\n  failed: number\n  criticalFailures: number\n  durationMs: number\n}\n\n/** Deploy-time deadline for a single probe. Cold upstreams are slow; a dead\n *  endpoint should still fail fast, so 10s is the ceiling, not the target. */\nconst DEFAULT_TIMEOUT_MS = 10_000\n\nfunction nowMs(): number {\n  return typeof performance !== 'undefined' ? performance.now() : Date.now()\n}\n\nfunction isAbortLike(err: unknown): boolean {\n  return err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError')\n}\n\n/** Strip bearer tokens / key material before an upstream string is surfaced in\n *  a report (deploy logs are not always private). */\nfunction sanitizeUpstreamMessage(input: unknown): string {\n  const message = input instanceof Error ? input.message : String(input)\n  return message\n    .replace(/Bearer\\s+[^\\s]+/gi, 'Bearer [redacted]')\n    .replace(/\\b(?:sk|pk|tc)[_-][A-Za-z0-9_-]{8,}\\b/g, '[redacted-key]')\n}\n\nfunction snippet(body: string): string {\n  const trimmed = body.trim()\n  if (!trimmed) return ''\n  const clipped = trimmed.length > 180 ? `${trimmed.slice(0, 180)}…` : trimmed\n  return `: ${sanitizeUpstreamMessage(clipped)}`\n}\n\ntype ProbeOutcome =\n  | { kind: 'status'; status: number; bodyText: string }\n  | { kind: 'timeout'; timeoutMs: number }\n  | { kind: 'network'; message: string }\n\ninterface HttpProbeCall {\n  fetchImpl: typeof fetch\n  url: string\n  method: string\n  headers?: Record<string, string>\n  body?: string\n  timeoutMs: number\n}\n\n/** One live HTTP call, folded to a probe outcome. Never throws: a timeout, a\n *  DNS/connection failure, and any thrown error all become an outcome so the\n *  probe can classify them into an actionable detail. */\nasync function runHttp(call: HttpProbeCall): Promise<ProbeOutcome> {\n  let response: Response\n  try {\n    response = await call.fetchImpl(call.url, {\n      method: call.method,\n      headers: call.headers,\n      body: call.body,\n      signal: AbortSignal.timeout(call.timeoutMs),\n    })\n  } catch (err) {\n    if (isAbortLike(err)) return { kind: 'timeout', timeoutMs: call.timeoutMs }\n    return { kind: 'network', message: sanitizeUpstreamMessage(err) }\n  }\n  let bodyText = ''\n  try {\n    bodyText = await response.text()\n  } catch {\n    bodyText = ''\n  }\n  return { kind: 'status', status: response.status, bodyText }\n}\n\ninterface AuthedClassifyContext {\n  /** Full endpoint reached, for the message. */\n  endpoint: string\n  /** How to name the API-key secret when the endpoint reports auth failure. */\n  keyLabel: string\n  /** How to name the URL secret when the endpoint is unreachable. */\n  urlLabel: string\n}\n\n/**\n * Shared classification for an authed liveness endpoint (router, sandbox):\n * 2xx → live; 401/403 → the KEY is dead, name it; 503 → the UPSTREAM is down,\n * the key still looks valid, don't rotate; timeout / unreachable → the URL is\n * likely stale, name it; anything else → an unexpected status with a snippet.\n */\nfunction classifyAuthed(outcome: ProbeOutcome, ctx: AuthedClassifyContext): PreflightProbeResult {\n  switch (outcome.kind) {\n    case 'status': {\n      const { status, bodyText } = outcome\n      if (status >= 200 && status < 300) return { ok: true, detail: `${status} OK` }\n      if (status === 401 || status === 403) {\n        return {\n          ok: false,\n          detail: `DEAD KEY — ${ctx.endpoint} returned ${status}; rotate ${ctx.keyLabel}`,\n        }\n      }\n      if (status === 503) {\n        return {\n          ok: false,\n          detail: `UPSTREAM DOWN — ${ctx.endpoint} returned 503; ${ctx.keyLabel} still looks valid, retry or check the provider (do NOT rotate)`,\n        }\n      }\n      return { ok: false, detail: `UNEXPECTED ${status} from ${ctx.endpoint}${snippet(bodyText)}` }\n    }\n    case 'timeout':\n      return {\n        ok: false,\n        detail: `TIMEOUT after ${outcome.timeoutMs}ms reaching ${ctx.endpoint} — check ${ctx.urlLabel}`,\n      }\n    case 'network':\n      return {\n        ok: false,\n        detail: `UNREACHABLE ${ctx.endpoint} (${outcome.message}) — check ${ctx.urlLabel}`,\n      }\n  }\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, '')\n}\n\n// --- Standard probe builders --------------------------------------------------\n\n/** Configuration for a required non-empty production value. */\nexport interface RequiredValueProbeConfig {\n  /** Human-readable value name, normally the environment variable name. */\n  name: string\n  /** Value supplied by the caller. It is checked but never included in output. */\n  value: string | null | undefined\n  /** Default `true`. */\n  critical?: boolean\n  /** Failure detail. Defaults to `NAME is unset`. */\n  missingDetail?: string\n}\n\n/**\n * Require a non-empty string without ever printing its value.\n *\n * This covers local signing keys and other values that have no external\n * endpoint to probe. Credentials with a live API should use a liveness probe\n * instead, because presence alone cannot detect an expired key.\n */\nexport function requiredValueProbe(config: RequiredValueProbeConfig): PreflightProbe {\n  return {\n    name: `required:${config.name}`,\n    critical: config.critical,\n    run: async () => {\n      const ok = typeof config.value === 'string' && config.value.trim().length > 0\n      return { ok, detail: ok ? undefined : (config.missingDetail ?? `${config.name} is unset`) }\n    },\n  }\n}\n\n/** Define configuration options for probing an LLM router with authentication and model details */\nexport interface RouterChatProbeConfig {\n  /** LLM router base URL (LiteLLM / OpenAI-compatible), e.g. `https://router…`. */\n  baseUrl: string\n  apiKey: string\n  /** A cheap model id available on the router. */\n  model: string\n  /** Probe name in the report. Default `'router-chat'`. */\n  name?: string\n  /** Default `true`. */\n  critical?: boolean\n  /** Env-var name of the API key, named verbatim in a dead-key failure. */\n  keySecret?: string\n  /** Env-var name of the base URL, named verbatim in an unreachable failure. */\n  urlSecret?: string\n  /** Per-probe deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\n/**\n * Probe an OpenAI-compatible LLM router with one cheap `POST /chat/completions`\n * (`max_tokens: 1`). 200 → live; 401/403 → dead router key; 503 → upstream\n * provider down (key still valid); timeout / unreachable → check the router URL.\n */\nexport function routerChatProbe(config: RouterChatProbeConfig): PreflightProbe {\n  const keyLabel = config.keySecret ?? 'the router API key'\n  const urlLabel = config.urlSecret ?? 'the router base URL'\n  return {\n    name: config.name ?? 'router-chat',\n    critical: config.critical,\n    run: async () => {\n      const base = trimTrailingSlash(config.baseUrl)\n      const endpoint = `${base}/chat/completions`\n      const outcome = await runHttp({\n        fetchImpl: config.fetchImpl ?? fetch,\n        url: endpoint,\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${config.apiKey}`,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({\n          model: config.model,\n          messages: [{ role: 'user', content: 'ping' }],\n          max_tokens: 1,\n        }),\n        timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n      })\n      return classifyAuthed(outcome, { endpoint, keyLabel, urlLabel })\n    },\n  }\n}\n\n/** Define configuration options for probing sandbox authentication endpoints */\nexport interface SandboxAuthProbeConfig {\n  /** Sandbox API base URL. */\n  baseUrl: string\n  apiKey: string\n  /** Probe name in the report. Default `'sandbox-auth'`. */\n  name?: string\n  /** Default `true`. */\n  critical?: boolean\n  /** Env-var name of the API key, named verbatim in a dead-key failure. */\n  keySecret?: string\n  /** Env-var name of the base URL, named verbatim in an unreachable failure. */\n  urlSecret?: string\n  /** Per-probe deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\n/**\n * Probe the sandbox API with a cheap authed `GET /v1/sandboxes?limit=1`.\n * 200 → live; 401/403 → dead sandbox key; 503 → sandbox platform down (key\n * still valid); timeout / unreachable → check the sandbox URL.\n */\nexport function sandboxAuthProbe(config: SandboxAuthProbeConfig): PreflightProbe {\n  const keyLabel = config.keySecret ?? 'the sandbox API key'\n  const urlLabel = config.urlSecret ?? 'the sandbox base URL'\n  return {\n    name: config.name ?? 'sandbox-auth',\n    critical: config.critical,\n    run: async () => {\n      const base = trimTrailingSlash(config.baseUrl)\n      const endpoint = `${base}/v1/sandboxes?limit=1`\n      const outcome = await runHttp({\n        fetchImpl: config.fetchImpl ?? fetch,\n        url: endpoint,\n        method: 'GET',\n        headers: { Authorization: `Bearer ${config.apiKey}` },\n        timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n      })\n      return classifyAuthed(outcome, { endpoint, keyLabel, urlLabel })\n    },\n  }\n}\n\n/** Define configuration options for performing an HTTP HEAD probe to check URL availability */\nexport interface HttpHeadProbeConfig {\n  /** Probe name in the report. */\n  name: string\n  /** URL to `HEAD`. */\n  url: string\n  /**\n   * Accepted status(es). A single number requires an exact match; an array\n   * requires membership. Omitted → any 2xx/3xx (the host is up and the path\n   * resolves) counts as live.\n   */\n  expectStatus?: number | number[]\n  /** Default `true`. */\n  critical?: boolean\n  /** Env-var name of the URL, named verbatim in a failure. */\n  urlSecret?: string\n  /** Per-probe deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\nfunction statusMatches(status: number, expect?: number | number[]): boolean {\n  if (expect === undefined) return status >= 200 && status < 400\n  if (Array.isArray(expect)) return expect.includes(status)\n  return status === expect\n}\n\nfunction describeExpected(expect?: number | number[]): string {\n  if (expect === undefined) return '2xx/3xx'\n  if (Array.isArray(expect)) return expect.join(' or ')\n  return String(expect)\n}\n\n/**\n * Probe a plain reachability endpoint (e.g. a platform base URL) with a `HEAD`.\n * Confirms the URL is live and resolving — the class of failure behind a stale\n * platform URL that still sits in the secret store.\n */\nexport function httpHeadProbe(config: HttpHeadProbeConfig): PreflightProbe {\n  const urlLabel = config.urlSecret ?? `the URL for ${config.name}`\n  return {\n    name: config.name,\n    critical: config.critical,\n    run: async () => {\n      const outcome = await runHttp({\n        fetchImpl: config.fetchImpl ?? fetch,\n        url: config.url,\n        method: 'HEAD',\n        timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n      })\n      switch (outcome.kind) {\n        case 'status': {\n          if (statusMatches(outcome.status, config.expectStatus)) {\n            return { ok: true, detail: `${outcome.status} OK` }\n          }\n          return {\n            ok: false,\n            detail: `UNEXPECTED ${outcome.status} from ${config.url} (expected ${describeExpected(config.expectStatus)}) — check ${urlLabel}`,\n          }\n        }\n        case 'timeout':\n          return {\n            ok: false,\n            detail: `TIMEOUT after ${outcome.timeoutMs}ms reaching ${config.url} — check ${urlLabel}`,\n          }\n        case 'network':\n          return {\n            ok: false,\n            detail: `UNREACHABLE ${config.url} (${outcome.message}) — check ${urlLabel}`,\n          }\n      }\n    },\n  }\n}\n\n// --- Runner + report ----------------------------------------------------------\n\nasync function runOne(probe: PreflightProbe): Promise<PreflightProbeVerdict> {\n  const critical = probe.critical ?? true\n  const start = nowMs()\n  try {\n    const result = await probe.run()\n    return {\n      name: probe.name,\n      ok: result.ok,\n      critical,\n      latencyMs: Math.round(nowMs() - start),\n      detail: result.detail,\n    }\n  } catch (err) {\n    return {\n      name: probe.name,\n      ok: false,\n      critical,\n      latencyMs: Math.round(nowMs() - start),\n      detail: `probe threw: ${sanitizeUpstreamMessage(err)}`,\n    }\n  }\n}\n\n/**\n * Run every probe (concurrently), time each, and fold into a report. The run\n * fails (`ok: false`) iff a critical probe fails; a failed non-critical probe\n * is a warning that does not block the deploy.\n */\nexport async function runPreflight(probes: PreflightProbe[]): Promise<PreflightReport> {\n  const start = nowMs()\n  const verdicts = await Promise.all(probes.map(runOne))\n  const failed = verdicts.filter((v) => !v.ok)\n  const criticalFailures = failed.filter((v) => v.critical).length\n  return {\n    ok: criticalFailures === 0,\n    probes: verdicts,\n    passed: verdicts.length - failed.length,\n    failed: failed.length,\n    criticalFailures,\n    durationMs: Math.round(nowMs() - start),\n  }\n}\n\ninterface FormatRow {\n  status: string\n  name: string\n  latency: string\n  detail: string\n}\n\n/** Render a report as an aligned, operator-readable table + verdict line. Pure\n *  (no I/O) so it is trivially testable and reusable by the bin. */\nexport function formatPreflightReport(report: PreflightReport): string {\n  const header: FormatRow = { status: 'STATUS', name: 'PROBE', latency: 'LATENCY', detail: 'DETAIL' }\n  const rows: FormatRow[] = report.probes.map((p) => ({\n    status: p.ok ? 'PASS' : p.critical ? 'FAIL' : 'WARN',\n    name: p.name,\n    latency: `${p.latencyMs}ms`,\n    detail: p.detail ?? '',\n  }))\n  const statusW = Math.max(header.status.length, ...rows.map((r) => r.status.length))\n  const nameW = Math.max(header.name.length, ...rows.map((r) => r.name.length))\n  const latencyW = Math.max(header.latency.length, ...rows.map((r) => r.latency.length))\n  const line = (r: FormatRow): string =>\n    `${r.status.padEnd(statusW)}  ${r.name.padEnd(nameW)}  ${r.latency.padStart(latencyW)}  ${r.detail}`.trimEnd()\n\n  const out: string[] = [\n    line(header),\n    `${'-'.repeat(statusW)}  ${'-'.repeat(nameW)}  ${'-'.repeat(latencyW)}  ------`,\n    ...rows.map(line),\n    '',\n  ]\n  if (report.ok) {\n    const warn = report.failed > 0 ? ` (${report.failed} non-critical warning(s))` : ''\n    out.push(`Preflight PASSED — ${report.passed}/${report.probes.length} probe(s) live${warn}`)\n  } else {\n    const dead = report.probes\n      .filter((p) => !p.ok && p.critical)\n      .map((p) => p.name)\n      .join(', ')\n    out.push(`Preflight FAILED — ${report.criticalFailures} critical probe(s) dead: ${dead}`)\n    out.push('Rotate the secret named in each FAIL row above, then redeploy.')\n  }\n  return out.join('\\n')\n}\n"],"mappings":";AAgEA,IAAM,qBAAqB;AAE3B,SAAS,QAAgB;AACvB,SAAO,OAAO,gBAAgB,cAAc,YAAY,IAAI,IAAI,KAAK,IAAI;AAC3E;AAEA,SAAS,YAAY,KAAuB;AAC1C,SAAO,eAAe,UAAU,IAAI,SAAS,kBAAkB,IAAI,SAAS;AAC9E;AAIA,SAAS,wBAAwB,OAAwB;AACvD,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,QACJ,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,0CAA0C,gBAAgB;AACvE;AAEA,SAAS,QAAQ,MAAsB;AACrC,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,GAAG,CAAC,WAAM;AACrE,SAAO,KAAK,wBAAwB,OAAO,CAAC;AAC9C;AAmBA,eAAe,QAAQ,MAA4C;AACjE,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK,UAAU,KAAK,KAAK;AAAA,MACxC,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,MAAM,KAAK;AAAA,MACX,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,IAC5C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,YAAY,GAAG,EAAG,QAAO,EAAE,MAAM,WAAW,WAAW,KAAK,UAAU;AAC1E,WAAO,EAAE,MAAM,WAAW,SAAS,wBAAwB,GAAG,EAAE;AAAA,EAClE;AACA,MAAI,WAAW;AACf,MAAI;AACF,eAAW,MAAM,SAAS,KAAK;AAAA,EACjC,QAAQ;AACN,eAAW;AAAA,EACb;AACA,SAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,QAAQ,SAAS;AAC7D;AAiBA,SAAS,eAAe,SAAuB,KAAkD;AAC/F,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK,UAAU;AACb,YAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,UAAI,UAAU,OAAO,SAAS,IAAK,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,MAAM,MAAM;AAC7E,UAAI,WAAW,OAAO,WAAW,KAAK;AACpC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,mBAAc,IAAI,QAAQ,aAAa,MAAM,YAAY,IAAI,QAAQ;AAAA,QAC/E;AAAA,MACF;AACA,UAAI,WAAW,KAAK;AAClB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,wBAAmB,IAAI,QAAQ,kBAAkB,IAAI,QAAQ;AAAA,QACvE;AAAA,MACF;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,MAAM,SAAS,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,GAAG;AAAA,IAC9F;AAAA,IACA,KAAK;AACH,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,iBAAiB,QAAQ,SAAS,eAAe,IAAI,QAAQ,iBAAY,IAAI,QAAQ;AAAA,MAC/F;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,eAAe,IAAI,QAAQ,KAAK,QAAQ,OAAO,kBAAa,IAAI,QAAQ;AAAA,MAClF;AAAA,EACJ;AACF;AAEA,SAAS,kBAAkB,KAAqB;AAC9C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAuBO,SAAS,mBAAmB,QAAkD;AACnF,SAAO;AAAA,IACL,MAAM,YAAY,OAAO,IAAI;AAAA,IAC7B,UAAU,OAAO;AAAA,IACjB,KAAK,YAAY;AACf,YAAM,KAAK,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,SAAS;AAC5E,aAAO,EAAE,IAAI,QAAQ,KAAK,SAAa,OAAO,iBAAiB,GAAG,OAAO,IAAI,YAAa;AAAA,IAC5F;AAAA,EACF;AACF;AA4BO,SAAS,gBAAgB,QAA+C;AAC7E,QAAM,WAAW,OAAO,aAAa;AACrC,QAAM,WAAW,OAAO,aAAa;AACrC,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ;AAAA,IACrB,UAAU,OAAO;AAAA,IACjB,KAAK,YAAY;AACf,YAAM,OAAO,kBAAkB,OAAO,OAAO;AAC7C,YAAM,WAAW,GAAG,IAAI;AACxB,YAAM,UAAU,MAAM,QAAQ;AAAA,QAC5B,WAAW,OAAO,aAAa;AAAA,QAC/B,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,OAAO,MAAM;AAAA,UACtC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,UAC5C,YAAY;AAAA,QACd,CAAC;AAAA,QACD,WAAW,OAAO,aAAa;AAAA,MACjC,CAAC;AACD,aAAO,eAAe,SAAS,EAAE,UAAU,UAAU,SAAS,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AA0BO,SAAS,iBAAiB,QAAgD;AAC/E,QAAM,WAAW,OAAO,aAAa;AACrC,QAAM,WAAW,OAAO,aAAa;AACrC,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ;AAAA,IACrB,UAAU,OAAO;AAAA,IACjB,KAAK,YAAY;AACf,YAAM,OAAO,kBAAkB,OAAO,OAAO;AAC7C,YAAM,WAAW,GAAG,IAAI;AACxB,YAAM,UAAU,MAAM,QAAQ;AAAA,QAC5B,WAAW,OAAO,aAAa;AAAA,QAC/B,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,UAAU,OAAO,MAAM,GAAG;AAAA,QACpD,WAAW,OAAO,aAAa;AAAA,MACjC,CAAC;AACD,aAAO,eAAe,SAAS,EAAE,UAAU,UAAU,SAAS,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAwBA,SAAS,cAAc,QAAgB,QAAqC;AAC1E,MAAI,WAAW,OAAW,QAAO,UAAU,OAAO,SAAS;AAC3D,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,SAAS,MAAM;AACxD,SAAO,WAAW;AACpB;AAEA,SAAS,iBAAiB,QAAoC;AAC5D,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,KAAK,MAAM;AACpD,SAAO,OAAO,MAAM;AACtB;AAOO,SAAS,cAAc,QAA6C;AACzE,QAAM,WAAW,OAAO,aAAa,eAAe,OAAO,IAAI;AAC/D,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,KAAK,YAAY;AACf,YAAM,UAAU,MAAM,QAAQ;AAAA,QAC5B,WAAW,OAAO,aAAa;AAAA,QAC/B,KAAK,OAAO;AAAA,QACZ,QAAQ;AAAA,QACR,WAAW,OAAO,aAAa;AAAA,MACjC,CAAC;AACD,cAAQ,QAAQ,MAAM;AAAA,QACpB,KAAK,UAAU;AACb,cAAI,cAAc,QAAQ,QAAQ,OAAO,YAAY,GAAG;AACtD,mBAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,QAAQ,MAAM,MAAM;AAAA,UACpD;AACA,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,QAAQ,cAAc,QAAQ,MAAM,SAAS,OAAO,GAAG,cAAc,iBAAiB,OAAO,YAAY,CAAC,kBAAa,QAAQ;AAAA,UACjI;AAAA,QACF;AAAA,QACA,KAAK;AACH,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,QAAQ,iBAAiB,QAAQ,SAAS,eAAe,OAAO,GAAG,iBAAY,QAAQ;AAAA,UACzF;AAAA,QACF,KAAK;AACH,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,QAAQ,eAAe,OAAO,GAAG,KAAK,QAAQ,OAAO,kBAAa,QAAQ;AAAA,UAC5E;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAIA,eAAe,OAAO,OAAuD;AAC3E,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,QAAQ,MAAM;AACpB,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,IAAI,OAAO;AAAA,MACX;AAAA,MACA,WAAW,KAAK,MAAM,MAAM,IAAI,KAAK;AAAA,MACrC,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,IAAI;AAAA,MACJ;AAAA,MACA,WAAW,KAAK,MAAM,MAAM,IAAI,KAAK;AAAA,MACrC,QAAQ,gBAAgB,wBAAwB,GAAG,CAAC;AAAA,IACtD;AAAA,EACF;AACF;AAOA,eAAsB,aAAa,QAAoD;AACrF,QAAM,QAAQ,MAAM;AACpB,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM,CAAC;AACrD,QAAM,SAAS,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;AAC3C,QAAM,mBAAmB,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC1D,SAAO;AAAA,IACL,IAAI,qBAAqB;AAAA,IACzB,QAAQ;AAAA,IACR,QAAQ,SAAS,SAAS,OAAO;AAAA,IACjC,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,YAAY,KAAK,MAAM,MAAM,IAAI,KAAK;AAAA,EACxC;AACF;AAWO,SAAS,sBAAsB,QAAiC;AACrE,QAAM,SAAoB,EAAE,QAAQ,UAAU,MAAM,SAAS,SAAS,WAAW,QAAQ,SAAS;AAClG,QAAM,OAAoB,OAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IAClD,QAAQ,EAAE,KAAK,SAAS,EAAE,WAAW,SAAS;AAAA,IAC9C,MAAM,EAAE;AAAA,IACR,SAAS,GAAG,EAAE,SAAS;AAAA,IACvB,QAAQ,EAAE,UAAU;AAAA,EACtB,EAAE;AACF,QAAM,UAAU,KAAK,IAAI,OAAO,OAAO,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC;AAClF,QAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,MAAM,CAAC;AAC5E,QAAM,WAAW,KAAK,IAAI,OAAO,QAAQ,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,MAAM,CAAC;AACrF,QAAM,OAAO,CAAC,MACZ,GAAG,EAAE,OAAO,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,QAAQ,SAAS,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ;AAE/G,QAAM,MAAgB;AAAA,IACpB,KAAK,MAAM;AAAA,IACX,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,IACrE,GAAG,KAAK,IAAI,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,OAAO,IAAI;AACb,UAAM,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,MAAM,8BAA8B;AACjF,QAAI,KAAK,2BAAsB,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,iBAAiB,IAAI,EAAE;AAAA,EAC7F,OAAO;AACL,UAAM,OAAO,OAAO,OACjB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EACjC,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,IAAI;AACZ,QAAI,KAAK,2BAAsB,OAAO,gBAAgB,4BAA4B,IAAI,EAAE;AACxF,QAAI,KAAK,gEAAgE;AAAA,EAC3E;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;","names":[]}

package/dist/preflight/cli.js

@@ -2,7 +2,7 @@
 import {
   formatPreflightReport,
   runPreflight
-} from "../chunk-JTLYXUEV.js";
+} from "../chunk-5FAKBTCK.js";
 
 // src/preflight/cli.ts
 import { pathToFileURL } from "url";

package/dist/preflight/index.d.ts

@@ -12,9 +12,10 @@
  * to rotate.
  *
  * A probe is `{ name, run, critical? }`; `run()` returns `{ ok, detail? }`.
- * The standard builders (`routerChatProbe`, `sandboxAuthProbe`, `httpHeadProbe`)
- * each take explicit config — they read nothing global — so the same probe runs
- * identically in a deploy step, a test, or a local check. `runPreflight` fans
+ * The standard builders (`requiredValueProbe`, `routerChatProbe`,
+ * `sandboxAuthProbe`, `httpHeadProbe`) each take explicit config — they read
+ * nothing global — so the same probe runs identically in a deploy step, a test,
+ * or a local check. `runPreflight` fans
  * the probes out, times each, and folds them into a pass/fail report: any
  * failed CRITICAL probe fails the whole run (probes are critical by default).
  *
@@ -54,6 +55,25 @@ interface PreflightReport {
     criticalFailures: number;
     durationMs: number;
 }
+/** Configuration for a required non-empty production value. */
+interface RequiredValueProbeConfig {
+    /** Human-readable value name, normally the environment variable name. */
+    name: string;
+    /** Value supplied by the caller. It is checked but never included in output. */
+    value: string | null | undefined;
+    /** Default `true`. */
+    critical?: boolean;
+    /** Failure detail. Defaults to `NAME is unset`. */
+    missingDetail?: string;
+}
+/**
+ * Require a non-empty string without ever printing its value.
+ *
+ * This covers local signing keys and other values that have no external
+ * endpoint to probe. Credentials with a live API should use a liveness probe
+ * instead, because presence alone cannot detect an expired key.
+ */
+declare function requiredValueProbe(config: RequiredValueProbeConfig): PreflightProbe;
 /** Define configuration options for probing an LLM router with authentication and model details */
 interface RouterChatProbeConfig {
     /** LLM router base URL (LiteLLM / OpenAI-compatible), e.g. `https://router…`. */
@@ -141,4 +161,4 @@ declare function runPreflight(probes: PreflightProbe[]): Promise<PreflightReport
  *  (no I/O) so it is trivially testable and reusable by the bin. */
 declare function formatPreflightReport(report: PreflightReport): string;
 
-export { type HttpHeadProbeConfig, type PreflightProbe, type PreflightProbeResult, type PreflightProbeVerdict, type PreflightReport, type RouterChatProbeConfig, type SandboxAuthProbeConfig, formatPreflightReport, httpHeadProbe, routerChatProbe, runPreflight, sandboxAuthProbe };
+export { type HttpHeadProbeConfig, type PreflightProbe, type PreflightProbeResult, type PreflightProbeVerdict, type PreflightReport, type RequiredValueProbeConfig, type RouterChatProbeConfig, type SandboxAuthProbeConfig, formatPreflightReport, httpHeadProbe, requiredValueProbe, routerChatProbe, runPreflight, sandboxAuthProbe };

package/dist/preflight/index.js

@@ -1,13 +1,15 @@
 import {
   formatPreflightReport,
   httpHeadProbe,
+  requiredValueProbe,
   routerChatProbe,
   runPreflight,
   sandboxAuthProbe
-} from "../chunk-JTLYXUEV.js";
+} from "../chunk-5FAKBTCK.js";
 export {
   formatPreflightReport,
   httpHeadProbe,
+  requiredValueProbe,
   routerChatProbe,
   runPreflight,
   sandboxAuthProbe

package/dist/sandbox/index.d.ts

@@ -901,9 +901,16 @@ interface StoppedSandboxResumeRecovery {
     replacementBoxKey: string;
     restore?: SandboxRestoreSpec | null;
 }
+/**
+ * Default ERE passed to `pgrep -f` when a liveness probe does not override the
+ * harness-process matcher. It covers the platform process names used by the
+ * fleet's shared OpenCode, Claude Code, and Codex terminal path; products with
+ * another harness can override it.
+ */
+declare const DEFAULT_SIDECAR_PROCESS_PATTERN = "opencode|claude|codex";
 /** Define configuration for liveness probes including sidecar process pattern and optional timeouts */
 interface LivenessProbeConfig {
-    sidecarProcessPattern: (harness: Harness) => string;
+    sidecarProcessPattern?: (harness: Harness) => string;
     execTimeoutMs?: number;
     psTimeoutMs?: number;
 }
@@ -1332,4 +1339,4 @@ declare function isTerminalPromptEvent(event: unknown): boolean;
 /** Resolve the interactive question text from a structured event or return null if none found */
 declare function detectInteractiveQuestion(event: unknown): string | null;
 
-export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, type BuildSandboxToolFileMountsOptions, type D1PrewarmClaimStoreOptions, DEFAULT_PREWARM_CLAIM_TABLE, DEFAULT_SANDBOX_RESOURCES, type DriveSandboxTurnOptions, ENV_TOTAL_MAX_BYTES, ENV_VALUE_MAX_BYTES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type ModelSelection, type ModelSelectionError, type ModelSelectionFailure, type ModelSelectionSource, type Outcome, PREWARM_CLAIM_TABLE_DDL, PROVISION_PAYLOAD_MAX_BYTES, type PeekWorkspaceSandboxOutcome, type PrewarmClaimD1Like, type PrewarmClaimStore, type PrewarmDecision, type PrewarmEvent, type PrewarmOutcome, type PrewarmResult, type ProfileComposeOptions, type PromptInputPart, type ProviderResolutionConfig, type ProvisionPayloadSections, type ProvisionProfileSection, type ResolveSandboxClientCredentialsOptions, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxCredentialEnvironment, SandboxEgressPolicyMismatchError, type SandboxEgressPolicySource, type SandboxExecChannel, type SandboxExecOptions, type SandboxExistingBoxStage, type SandboxFileBytesOutcome, type SandboxFileSizeOutcome, SandboxModelResolutionError, type SandboxPermissionLevel, type SandboxPrewarmScope, type SandboxPrewarmer, type SandboxPrewarmerOptions, type SandboxReadiness, SandboxRecoveryFailedError, type SandboxRecoveryPhase, type SandboxResourceConfig, type SandboxRestoreSpec, SandboxRuntimeAuthRefreshError, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type SandboxToolPathOptions, type SandboxToolSpec, type ScopedTokenResult, type SecretStore, type StoppedSandboxResumeFailure, type StoppedSandboxResumeRecovery, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type TerminalUpgradeResponseLike, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, type WriteProfileFilesOptions, assertEnvWithinLimits, assertProvisionPayloadWithinCap, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, buildSandboxToolFileMounts, buildSandboxToolPathSetupScript, classifySeveredStream, collectSandboxPromptText, createD1PrewarmClaimStore, createSandboxPrewarmer, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deferredCorpusHash, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mergeHistoryIntoParts, mintSandboxScopedToken, mintTerminalProxyToken, peekWorkspaceSandbox, readSandboxBinaryBytes, readSecret, requireTransportableModel, resetClientCache, resolveModel, resolveModelSelection, resolveSandboxClientCredentials, runSandboxPrompt, runSandboxToolPathSetup, sandboxSidecarProxyUrl, sandboxToolBinDir, sandboxToolPath, sandboxToolRootDir, secretStoreFromClient, selectedBearerSubprotocol, shellQuote, splitDeferredProfileFiles, statSandboxFileSize, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, terminalUpgradeSubprotocolEcho, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };
+export { type AppToolDescriptor, type AuthenticatedSandboxUser, type BuildAppToolMcpServersOptions, type BuildSandboxToolFileMountsOptions, type D1PrewarmClaimStoreOptions, DEFAULT_PREWARM_CLAIM_TABLE, DEFAULT_SANDBOX_RESOURCES, DEFAULT_SIDECAR_PROCESS_PATTERN, type DriveSandboxTurnOptions, ENV_TOTAL_MAX_BYTES, ENV_VALUE_MAX_BYTES, type EnsureWorkspaceSandboxOptions, type LivenessProbeConfig, type MemberSyncSeam, type ModelSelection, type ModelSelectionError, type ModelSelectionFailure, type ModelSelectionSource, type Outcome, PREWARM_CLAIM_TABLE_DDL, PROVISION_PAYLOAD_MAX_BYTES, type PeekWorkspaceSandboxOutcome, type PrewarmClaimD1Like, type PrewarmClaimStore, type PrewarmDecision, type PrewarmEvent, type PrewarmOutcome, type PrewarmResult, type ProfileComposeOptions, type PromptInputPart, type ProviderResolutionConfig, type ProvisionPayloadSections, type ProvisionProfileSection, type ResolveSandboxClientCredentialsOptions, type ResolvedModel, type SandboxApiCredentials, type SandboxBuildContext, type SandboxClientCredentials, type SandboxCredentialEnvironment, SandboxEgressPolicyMismatchError, type SandboxEgressPolicySource, type SandboxExecChannel, type SandboxExecOptions, type SandboxExistingBoxStage, type SandboxFileBytesOutcome, type SandboxFileSizeOutcome, SandboxModelResolutionError, type SandboxPermissionLevel, type SandboxPrewarmScope, type SandboxPrewarmer, type SandboxPrewarmerOptions, type SandboxReadiness, SandboxRecoveryFailedError, type SandboxRecoveryPhase, type SandboxResourceConfig, type SandboxRestoreSpec, SandboxRuntimeAuthRefreshError, type SandboxRuntimeConfig, type SandboxRuntimeConnection, type SandboxScope, type SandboxStepTransition, type SandboxTerminalTokenOptions, type SandboxTerminalTokenResult, type SandboxTerminalTokenSubject, type SandboxTerminalWsMatch, type SandboxToolPathOptions, type SandboxToolSpec, type ScopedTokenResult, type SecretStore, type StoppedSandboxResumeFailure, type StoppedSandboxResumeRecovery, type StreamSandboxPromptOptions, type TerminalProxyIdentity, type TerminalUpgradeResponseLike, type WorkspaceSandboxConnectionArgs, type WorkspaceSandboxConnectionHandlerOptions, type WorkspaceSandboxEnsureContext, type WorkspaceSandboxInstanceLike, type WorkspaceSandboxManager, type WorkspaceSandboxManagerOptions, type WorkspaceSandboxRuntimeProxyArgs, type WorkspaceSandboxRuntimeProxyHandlerOptions, type WorkspaceSandboxTerminalUpgradeHandlerOptions, type WriteProfileFilesOptions, assertEnvWithinLimits, assertProvisionPayloadWithinCap, attachReasoningEffort, bearerSubprotocolToken, bearerToken, buildAppToolMcpServers, buildSandboxRuntimeProxyHeaders, buildSandboxToolFileMounts, buildSandboxToolPathSetupScript, classifySeveredStream, collectSandboxPromptText, createD1PrewarmClaimStore, createSandboxPrewarmer, createSandboxTerminalToken, createWorkspaceSandboxConnectionHandler, createWorkspaceSandboxManager, createWorkspaceSandboxRuntimeProxyHandler, createWorkspaceSandboxTerminalUpgradeHandler, deferredCorpusHash, deleteSecret, detectInteractiveQuestion, driveSandboxTurn, encodeSandboxRuntimePath, ensureWorkspaceSandbox, flattenHistory, getClient, isSandboxTerminalWsUpgrade, isTerminalPromptEvent, matchSandboxTerminalWsPath, mergeExtraMcp, mergeHistoryIntoParts, mintSandboxScopedToken, mintTerminalProxyToken, peekWorkspaceSandbox, readSandboxBinaryBytes, readSecret, requireTransportableModel, resetClientCache, resolveModel, resolveModelSelection, resolveSandboxClientCredentials, runSandboxPrompt, runSandboxToolPathSetup, sandboxSidecarProxyUrl, sandboxToolBinDir, sandboxToolPath, sandboxToolRootDir, secretStoreFromClient, selectedBearerSubprotocol, shellQuote, splitDeferredProfileFiles, statSandboxFileSize, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole, terminalTokenFromRequest, terminalUpgradeSubprotocolEcho, verifySandboxTerminalToken, verifyTerminalProxyToken, writeProfileFilesToBox };

package/dist/sandbox/index.js

@@ -1,6 +1,7 @@
 import {
   DEFAULT_PREWARM_CLAIM_TABLE,
   DEFAULT_SANDBOX_RESOURCES,
+  DEFAULT_SIDECAR_PROCESS_PATTERN,
   ENV_TOTAL_MAX_BYTES,
   ENV_VALUE_MAX_BYTES,
   PREWARM_CLAIM_TABLE_DDL,
@@ -71,7 +72,7 @@ import {
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "../chunk-6W5Y4J2X.js";
+} from "../chunk-2UDJH6QR.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-CQZSAR77.js";
 import "../chunk-ICOHEZK6.js";
@@ -82,6 +83,7 @@ import "../chunk-JML7WKWU.js";
 export {
   DEFAULT_PREWARM_CLAIM_TABLE,
   DEFAULT_SANDBOX_RESOURCES,
+  DEFAULT_SIDECAR_PROCESS_PATTERN,
   ENV_TOTAL_MAX_BYTES,
   ENV_VALUE_MAX_BYTES,
   PREWARM_CLAIM_TABLE_DDL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.44.55",
+  "version": "0.44.57",
   "packageManager": "pnpm@11.17.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [