@tangle-network/agent-app 0.44.59 → 0.45.1

package/dist/assistant/index.js

@@ -9,7 +9,7 @@ import "../chunk-GINKOZFD.js";
 import "../chunk-YTMKRL3L.js";
 import "../chunk-GEYACSFW.js";
 import "../chunk-6MUJROBT.js";
-import "../chunk-HCOROIRT.js";
+import "../chunk-BATKJP3P.js";
 import "../chunk-QY4BRKRJ.js";
 import "../chunk-WBHPN5DY.js";
 import "../chunk-UXMIPX3Z.js";

package/dist/chat-routes/index.js

@@ -100,7 +100,7 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-2UDJH6QR.js";
+} from "../chunk-EC7CUA4L.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-CQZSAR77.js";
 import "../chunk-ICOHEZK6.js";

package/dist/{chunk-HCOROIRT.js → chunk-BATKJP3P.js}

@@ -21,9 +21,11 @@ function useSandboxTerminalConnection(opts) {
   const pollTimeoutMs = opts.provisionPollTimeoutMs ?? DEFAULT_PROVISION_POLL_TIMEOUT_MS;
   const refreshSkewMs = opts.tokenRefreshSkewMs ?? DEFAULT_TOKEN_REFRESH_SKEW_MS;
   const connectionUrl = useCallback(() => {
-    if (typeof opts.connectionUrl === "function") return opts.connectionUrl(opts.workspaceId);
-    return opts.connectionUrl ?? `/api/workspaces/${encodeURIComponent(opts.workspaceId)}/sandbox/connection`;
-  }, [opts.connectionUrl, opts.workspaceId]);
+    const base = typeof opts.connectionUrl === "function" ? opts.connectionUrl(opts.workspaceId) : opts.connectionUrl ?? `/api/workspaces/${encodeURIComponent(opts.workspaceId)}/sandbox/connection`;
+    if (!opts.connectionId) return base;
+    const separator = base.includes("?") ? "&" : "?";
+    return `${base}${separator}connectionId=${encodeURIComponent(opts.connectionId)}`;
+  }, [opts.connectionUrl, opts.workspaceId, opts.connectionId]);
   const connect = useCallback(async () => {
     const generation = generationRef.current + 1;
     generationRef.current = generation;
@@ -49,7 +51,8 @@ function useSandboxTerminalConnection(opts) {
             status: data.status ?? "running",
             error: null,
             loading: false,
-            ...data.sandboxId ? { sandboxId: data.sandboxId } : {}
+            ...data.sandboxId ? { sandboxId: data.sandboxId } : {},
+            ...data.connectionId ? { connectionId: data.connectionId } : {}
           });
           return;
         }
@@ -163,4 +166,4 @@ export {
   useSandboxTerminalConnection,
   tabTerminalConnectionId
 };
-//# sourceMappingURL=chunk-HCOROIRT.js.map
+//# sourceMappingURL=chunk-BATKJP3P.js.map

package/dist/chunk-BATKJP3P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/web-react/sandbox-terminal.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from 'react'\n\n/** Define the connection details and status for a sandbox terminal session */\nexport interface SandboxTerminalConnection {\n  runtimeUrl: string | null\n  sidecarUrl: string | null\n  token: string | null\n  expiresAt: string | null\n  status: string\n  error: string | null\n  loading: boolean\n  sandboxId?: string\n  connectionId?: string\n}\n\n/**\n * Define the response structure for a sandbox terminal connection including URLs, token, status, and errors\n *\n * The browser-direct scoped-token route (`createSandboxTerminalConnectionRoute`,\n * `src/sandbox/terminal-connection.ts`) returns `sidecarUrl`. The hook also\n * exposes that URL through the historical `runtimeUrl` state field so existing\n * terminal panels do not need transport-specific branching.\n *\n * `connectionId` is the id the route's minted token's `sid` is bound to\n * (echoed back from the `connectionId` the hook sent) — pass it straight\n * through as `TerminalView`'s `connectionId` prop, since any other value\n * fails the WS upgrade on the current platform.\n */\nexport interface SandboxTerminalConnectionResponse {\n  runtimeUrl?: string\n  sidecarUrl?: string\n  token?: string\n  expiresAt?: string\n  status?: string\n  error?: string\n  sandboxId?: string\n  connectionId?: string\n}\n\n/**\n * Define options for configuring a sandbox terminal connection including workspace ID and connection parameters\n *\n * `connectionId`, when set, is passed to\n * `createSandboxTerminalConnectionRoute` as the `connectionId` query\n * parameter — pass `tabTerminalConnectionId()` here so the route mints a\n * token whose `sid` is bound to the same id `TerminalView` will dial. Give\n * `TerminalView` the response's echoed `connectionId` (not this input\n * value) alongside `sidecarUrl` as `apiUrl` and `token`, since a product's\n * `resolveConnectionId` seam may rewrite it server-side.\n */\nexport interface UseSandboxTerminalConnectionOptions {\n  workspaceId: string\n  connectionUrl?: string | ((workspaceId: string) => string)\n  connectionId?: string\n  fetcher?: typeof fetch\n  provisionPollIntervalMs?: number\n  provisionPollTimeoutMs?: number\n  tokenRefreshSkewMs?: number\n}\n\n/** Resolve sandbox terminal connection status and provide a method to initiate the connection */\nexport interface UseSandboxTerminalConnectionResult extends SandboxTerminalConnection {\n  connect: () => Promise<void>\n}\n\nconst DEFAULT_PROVISION_POLL_INTERVAL_MS = 2_000\nconst DEFAULT_PROVISION_POLL_TIMEOUT_MS = 90_000\nconst DEFAULT_TOKEN_REFRESH_SKEW_MS = 120_000\n\nconst EMPTY_CONNECTION: SandboxTerminalConnection = {\n  runtimeUrl: null,\n  sidecarUrl: null,\n  token: null,\n  expiresAt: null,\n  status: 'idle',\n  error: null,\n  loading: false,\n}\n\n/**\n * Manage and maintain a sandbox terminal connection with automatic polling and token refresh handling\n *\n * `connectionUrl` is backed by the browser-direct scoped-token route\n * (`createSandboxTerminalConnectionRoute`,\n * `src/sandbox/terminal-connection.ts`). The route returns `sidecarUrl`; the\n * hook normalizes it into both URL fields for compatibility with existing\n * terminal panels.\n *\n * Pass `tabTerminalConnectionId()` as `opts.connectionId` — the hook forwards\n * it as the `connectionId` query parameter the browser-direct route requires\n * to mint a token whose `sid` is bound to that exact id (the orchestrator's\n * terminal WS gate fails closed on any other value). Give `TerminalView` the\n * RESULT's echoed `connectionId` (not the input value — a product's\n * `resolveConnectionId` seam may rewrite it), the resolved `sidecarUrl`/\n * `runtimeUrl` as `apiUrl`, and `token` as its token prop.\n */\nexport function useSandboxTerminalConnection(opts: UseSandboxTerminalConnectionOptions): UseSandboxTerminalConnectionResult {\n  const [conn, setConn] = useState<SandboxTerminalConnection>(EMPTY_CONNECTION)\n  const mountedRef = useRef(false)\n  const generationRef = useRef(0)\n  const fetcher = opts.fetcher ?? fetch\n  const pollIntervalMs = opts.provisionPollIntervalMs ?? DEFAULT_PROVISION_POLL_INTERVAL_MS\n  const pollTimeoutMs = opts.provisionPollTimeoutMs ?? DEFAULT_PROVISION_POLL_TIMEOUT_MS\n  const refreshSkewMs = opts.tokenRefreshSkewMs ?? DEFAULT_TOKEN_REFRESH_SKEW_MS\n\n  const connectionUrl = useCallback(() => {\n    const base = typeof opts.connectionUrl === 'function'\n      ? opts.connectionUrl(opts.workspaceId)\n      : opts.connectionUrl ?? `/api/workspaces/${encodeURIComponent(opts.workspaceId)}/sandbox/connection`\n    if (!opts.connectionId) return base\n    // `base` may be relative (SSR-safe), so a plain `URL` parse isn't always\n    // possible — string-append with proper encoding covers both shapes.\n    const separator = base.includes('?') ? '&' : '?'\n    return `${base}${separator}connectionId=${encodeURIComponent(opts.connectionId)}`\n  }, [opts.connectionUrl, opts.workspaceId, opts.connectionId])\n\n  const connect = useCallback(async () => {\n    const generation = generationRef.current + 1\n    generationRef.current = generation\n    const isCurrent = () => mountedRef.current && generationRef.current === generation\n    const setCurrentConn: typeof setConn = (value) => {\n      if (!isCurrent()) return\n      setConn(value)\n    }\n\n    setCurrentConn((current) => ({ ...current, loading: true, error: null }))\n    const deadline = Date.now() + pollTimeoutMs\n    while (isCurrent()) {\n      try {\n        const res = await fetcher(connectionUrl())\n        const data = (await res.json()) as SandboxTerminalConnectionResponse\n        if (!isCurrent()) return\n        const runtimeUrl = data.runtimeUrl ?? data.sidecarUrl\n        if (res.ok && runtimeUrl && data.token && data.expiresAt) {\n          setCurrentConn({\n            runtimeUrl,\n            sidecarUrl: data.sidecarUrl ?? runtimeUrl,\n            token: data.token,\n            expiresAt: data.expiresAt,\n            status: data.status ?? 'running',\n            error: null,\n            loading: false,\n            ...(data.sandboxId ? { sandboxId: data.sandboxId } : {}),\n            ...(data.connectionId ? { connectionId: data.connectionId } : {}),\n          })\n          return\n        }\n        if (res.ok) {\n          setCurrentConn({\n            runtimeUrl: null,\n            sidecarUrl: null,\n            token: null,\n            expiresAt: null,\n            loading: false,\n            error: 'Sandbox connection response is missing required fields',\n            status: data.status ?? 'error',\n            ...(data.sandboxId ? { sandboxId: data.sandboxId } : {}),\n          })\n          return\n        }\n        if (res.status === 503 && Date.now() < deadline) {\n          setCurrentConn((current) => ({\n            ...current,\n            loading: true,\n            status: data.status ?? 'provisioning',\n            error: null,\n          }))\n          await sleep(pollIntervalMs)\n          continue\n        }\n        setCurrentConn((current) => ({\n          ...current,\n          runtimeUrl: null,\n          sidecarUrl: null,\n          token: null,\n          expiresAt: null,\n          loading: false,\n          error: data.error ?? 'Sandbox not available',\n          status: data.status ?? 'error',\n        }))\n        return\n      } catch (err) {\n        if (!isCurrent()) return\n        if (Date.now() < deadline) {\n          await sleep(pollIntervalMs)\n          continue\n        }\n        setCurrentConn((current) => ({\n          ...current,\n          runtimeUrl: null,\n          sidecarUrl: null,\n          token: null,\n          expiresAt: null,\n          loading: false,\n          error: err instanceof Error ? err.message : 'Connection failed',\n        }))\n        return\n      }\n    }\n  }, [connectionUrl, fetcher, pollIntervalMs, pollTimeoutMs])\n\n  useEffect(() => {\n    mountedRef.current = true\n    return () => {\n      mountedRef.current = false\n      generationRef.current += 1\n    }\n  }, [])\n\n  useEffect(() => {\n    void connect()\n  }, [connect])\n\n  useEffect(() => {\n    if (!conn.runtimeUrl || !conn.token || !conn.expiresAt) return\n    const refreshAt = Date.parse(conn.expiresAt) - Date.now() - refreshSkewMs\n    if (!Number.isFinite(refreshAt)) {\n      setConn((current) => ({\n        ...current,\n        runtimeUrl: null,\n        sidecarUrl: null,\n        token: null,\n        expiresAt: null,\n        status: 'error',\n        error: 'Sandbox token expiry is invalid',\n      }))\n      return\n    }\n    const timer = window.setTimeout(() => {\n      void connect()\n    }, Math.max(1_000, refreshAt))\n    return () => window.clearTimeout(timer)\n  }, [conn.runtimeUrl, conn.token, conn.expiresAt, connect, refreshSkewMs])\n\n  return { ...conn, connect }\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => window.setTimeout(resolve, ms))\n}\n\nconst DEFAULT_TERMINAL_CID_KEY = 'agent-app:terminal-connection-id'\n\nfunction newConnectionId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') return crypto.randomUUID()\n  return `cid-${Date.now().toString(36)}-${Math.floor(Math.random() * 1e9).toString(36)}`\n}\n\n/**\n * Stable-per-tab, unique-per-client terminal connection id.\n *\n * Persists in `sessionStorage` so a reload in the same tab reuses the id (the\n * sidecar restores the same PTY session via `TerminalView.connectionId`), while\n * separate tabs/windows each get a distinct id. Pass the result as\n * `TerminalView`'s `connectionId`. Without it (e.g. gtm-agent today) every tab\n * shares one connection id and their reconnects evict each other.\n *\n * Falls back to an ephemeral id when `sessionStorage` is unavailable (SSR,\n * privacy mode) — still unique per call, just not reload-stable.\n */\nexport function tabTerminalConnectionId(storageKey: string = DEFAULT_TERMINAL_CID_KEY): string {\n  try {\n    const store = globalThis.sessionStorage\n    const existing = store?.getItem(storageKey)\n    if (existing) return existing\n    const id = newConnectionId()\n    store?.setItem(storageKey, id)\n    return id\n  } catch {\n    return newConnectionId()\n  }\n}\n"],"mappings":";AAAA,SAAS,aAAa,WAAW,QAAQ,gBAAgB;AAiEzD,IAAM,qCAAqC;AAC3C,IAAM,oCAAoC;AAC1C,IAAM,gCAAgC;AAEtC,IAAM,mBAA8C;AAAA,EAClD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AACX;AAmBO,SAAS,6BAA6B,MAA+E;AAC1H,QAAM,CAAC,MAAM,OAAO,IAAI,SAAoC,gBAAgB;AAC5E,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,gBAAgB,OAAO,CAAC;AAC9B,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,iBAAiB,KAAK,2BAA2B;AACvD,QAAM,gBAAgB,KAAK,0BAA0B;AACrD,QAAM,gBAAgB,KAAK,sBAAsB;AAEjD,QAAM,gBAAgB,YAAY,MAAM;AACtC,UAAM,OAAO,OAAO,KAAK,kBAAkB,aACvC,KAAK,cAAc,KAAK,WAAW,IACnC,KAAK,iBAAiB,mBAAmB,mBAAmB,KAAK,WAAW,CAAC;AACjF,QAAI,CAAC,KAAK,aAAc,QAAO;AAG/B,UAAM,YAAY,KAAK,SAAS,GAAG,IAAI,MAAM;AAC7C,WAAO,GAAG,IAAI,GAAG,SAAS,gBAAgB,mBAAmB,KAAK,YAAY,CAAC;AAAA,EACjF,GAAG,CAAC,KAAK,eAAe,KAAK,aAAa,KAAK,YAAY,CAAC;AAE5D,QAAM,UAAU,YAAY,YAAY;AACtC,UAAM,aAAa,cAAc,UAAU;AAC3C,kBAAc,UAAU;AACxB,UAAM,YAAY,MAAM,WAAW,WAAW,cAAc,YAAY;AACxE,UAAM,iBAAiC,CAAC,UAAU;AAChD,UAAI,CAAC,UAAU,EAAG;AAClB,cAAQ,KAAK;AAAA,IACf;AAEA,mBAAe,CAAC,aAAa,EAAE,GAAG,SAAS,SAAS,MAAM,OAAO,KAAK,EAAE;AACxE,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,WAAO,UAAU,GAAG;AAClB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,cAAc,CAAC;AACzC,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,YAAI,CAAC,UAAU,EAAG;AAClB,cAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,YAAI,IAAI,MAAM,cAAc,KAAK,SAAS,KAAK,WAAW;AACxD,yBAAe;AAAA,YACb;AAAA,YACA,YAAY,KAAK,cAAc;AAAA,YAC/B,OAAO,KAAK;AAAA,YACZ,WAAW,KAAK;AAAA,YAChB,QAAQ,KAAK,UAAU;AAAA,YACvB,OAAO;AAAA,YACP,SAAS;AAAA,YACT,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,YACtD,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,UACjE,CAAC;AACD;AAAA,QACF;AACA,YAAI,IAAI,IAAI;AACV,yBAAe;AAAA,YACb,YAAY;AAAA,YACZ,YAAY;AAAA,YACZ,OAAO;AAAA,YACP,WAAW;AAAA,YACX,SAAS;AAAA,YACT,OAAO;AAAA,YACP,QAAQ,KAAK,UAAU;AAAA,YACvB,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,UACxD,CAAC;AACD;AAAA,QACF;AACA,YAAI,IAAI,WAAW,OAAO,KAAK,IAAI,IAAI,UAAU;AAC/C,yBAAe,CAAC,aAAa;AAAA,YAC3B,GAAG;AAAA,YACH,SAAS;AAAA,YACT,QAAQ,KAAK,UAAU;AAAA,YACvB,OAAO;AAAA,UACT,EAAE;AACF,gBAAM,MAAM,cAAc;AAC1B;AAAA,QACF;AACA,uBAAe,CAAC,aAAa;AAAA,UAC3B,GAAG;AAAA,UACH,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,OAAO;AAAA,UACP,WAAW;AAAA,UACX,SAAS;AAAA,UACT,OAAO,KAAK,SAAS;AAAA,UACrB,QAAQ,KAAK,UAAU;AAAA,QACzB,EAAE;AACF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,CAAC,UAAU,EAAG;AAClB,YAAI,KAAK,IAAI,IAAI,UAAU;AACzB,gBAAM,MAAM,cAAc;AAC1B;AAAA,QACF;AACA,uBAAe,CAAC,aAAa;AAAA,UAC3B,GAAG;AAAA,UACH,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,OAAO;AAAA,UACP,WAAW;AAAA,UACX,SAAS;AAAA,UACT,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC9C,EAAE;AACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,GAAG,CAAC,eAAe,SAAS,gBAAgB,aAAa,CAAC;AAE1D,YAAU,MAAM;AACd,eAAW,UAAU;AACrB,WAAO,MAAM;AACX,iBAAW,UAAU;AACrB,oBAAc,WAAW;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,SAAK,QAAQ;AAAA,EACf,GAAG,CAAC,OAAO,CAAC;AAEZ,YAAU,MAAM;AACd,QAAI,CAAC,KAAK,cAAc,CAAC,KAAK,SAAS,CAAC,KAAK,UAAW;AACxD,UAAM,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI;AAC5D,QAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,cAAQ,CAAC,aAAa;AAAA,QACpB,GAAG;AAAA,QACH,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,EAAE;AACF;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,WAAW,MAAM;AACpC,WAAK,QAAQ;AAAA,IACf,GAAG,KAAK,IAAI,KAAO,SAAS,CAAC;AAC7B,WAAO,MAAM,OAAO,aAAa,KAAK;AAAA,EACxC,GAAG,CAAC,KAAK,YAAY,KAAK,OAAO,KAAK,WAAW,SAAS,aAAa,CAAC;AAExE,SAAO,EAAE,GAAG,MAAM,QAAQ;AAC5B;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,OAAO,WAAW,SAAS,EAAE,CAAC;AAChE;AAEA,IAAM,2BAA2B;AAEjC,SAAS,kBAA0B;AACjC,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAAY,QAAO,OAAO,WAAW;AACvG,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;AACvF;AAcO,SAAS,wBAAwB,aAAqB,0BAAkC;AAC7F,MAAI;AACF,UAAM,QAAQ,WAAW;AACzB,UAAM,WAAW,OAAO,QAAQ,UAAU;AAC1C,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,gBAAgB;AAC3B,WAAO,QAAQ,YAAY,EAAE;AAC7B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,gBAAgB;AAAA,EACzB;AACF;","names":[]}

package/dist/{chunk-2UDJH6QR.js → chunk-EC7CUA4L.js}

@@ -8,12 +8,6 @@ import {
 import {
   buildAppToolMcpServer
 } from "./chunk-3EJ6SFJI.js";
-import {
-  base64UrlDecodeText,
-  base64UrlEncodeText,
-  constantTimeEqual,
-  hmacSha256Base64Url
-} from "./chunk-S5SRJJQG.js";
 import {
   resolveTangleExecutionEnvironment,
   trimOrNull
@@ -161,35 +155,7 @@ async function readSandboxBinaryBytes(box, absolutePath, expectedSize, options)
   return { succeeded: true, value: { bytes, size: expectedSize } };
 }
 
-// src/sandbox/terminal-proxy-token.ts
-var TERMINAL_PROXY_TOKEN_TTL_MS = 15 * 60 * 1e3;
-async function mintTerminalProxyToken(secret, identity, ttlMs = TERMINAL_PROXY_TOKEN_TTL_MS, now = Date.now) {
-  if (!secret) return fail(new Error("mintTerminalProxyToken: secret is required"));
-  if (!identity.userId || !identity.workspaceId || !identity.sandboxId) {
-    return fail(new Error("mintTerminalProxyToken: userId/workspaceId/sandboxId are required"));
-  }
-  const expiresAt = new Date(now() + ttlMs);
-  const payload = { ...identity, exp: Math.floor(expiresAt.getTime() / 1e3) };
-  const encoded = base64UrlEncodeText(JSON.stringify(payload));
-  const sig = await hmacSha256Base64Url(encoded, secret);
-  return ok({ token: `${encoded}.${sig}`, expiresAt });
-}
-async function verifyTerminalProxyToken(secret, token, expected, now = Date.now) {
-  if (!secret) return false;
-  const [encoded, sig, extra] = token.split(".");
-  if (!encoded || !sig || extra !== void 0) return false;
-  const expectedSig = await hmacSha256Base64Url(encoded, secret);
-  if (!constantTimeEqual(sig, expectedSig)) return false;
-  let payload;
-  try {
-    payload = JSON.parse(base64UrlDecodeText(encoded));
-  } catch {
-    return false;
-  }
-  return payload.userId === expected.userId && payload.workspaceId === expected.workspaceId && payload.sandboxId === expected.sandboxId && Number.isFinite(payload.exp) && payload.exp > Math.floor(now() / 1e3);
-}
-
-// src/sandbox/workspace-terminal.ts
+// src/sandbox/workspace-sandbox-manager.ts
 function createWorkspaceSandboxManager(opts) {
   return {
     async ensureWorkspaceSandbox(workspaceId, userId, options) {
@@ -222,293 +188,70 @@ function createWorkspaceSandboxManager(opts) {
     }
   };
 }
-var DEFAULT_TERMINAL_TOKEN_TTL_MS = 15 * 60 * 1e3;
-var BEARER_SUBPROTOCOL_PREFIX = "bearer.";
-var LEGACY_TERMINAL_TOKEN_PREFIX = "sbxt_";
-async function createSandboxTerminalToken(subject, opts) {
-  validateTerminalSubject(subject);
-  const secret = opts.secret?.trim();
-  if (!secret) throw new Error("terminal token secret is required");
-  const now = opts.now ?? Date.now;
-  const expiresInMs = opts.expiresInMs ?? DEFAULT_TERMINAL_TOKEN_TTL_MS;
-  if (!Number.isFinite(expiresInMs) || expiresInMs <= 0) throw new Error("expiresInMs must be a positive number");
-  const minted = await mintTerminalProxyToken(secret, subject, expiresInMs, now);
-  if (!minted.succeeded) throw minted.error;
-  return minted.value;
-}
-async function verifySandboxTerminalToken(token, expected, opts) {
-  validateTerminalSubject(expected);
-  const secret = opts.secret?.trim();
-  const now = opts.now ?? Date.now;
-  const normalized = token.startsWith(LEGACY_TERMINAL_TOKEN_PREFIX) ? token.slice(LEGACY_TERMINAL_TOKEN_PREFIX.length) : token;
-  return verifyTerminalProxyToken(secret ?? "", normalized, expected, now);
-}
-function createWorkspaceSandboxConnectionHandler(opts) {
-  return async function handleWorkspaceSandboxConnection({ request, params }) {
+
+// src/sandbox/terminal-connection.ts
+var DEFAULT_TTL_MINUTES = 15;
+var TERMINAL_SCOPE = "session-runtime";
+function defaultResolveConnectionId(ctx) {
+  return ctx.requested;
+}
+function createSandboxTerminalConnectionRoute(opts) {
+  const resolveConnectionId = opts.resolveConnectionId ?? defaultResolveConnectionId;
+  return async function handleSandboxTerminalConnection(request) {
     const user = await opts.requireUser(request);
-    const workspaceId = params.workspaceId;
-    if (!workspaceId) return Response.json({ error: "workspaceId is required" }, { status: 400 });
-    await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId });
+    if (user instanceof Response) return user;
     let box;
     try {
-      box = await opts.ensureWorkspaceSandbox(workspaceId, user.id);
+      box = await opts.ensureSandbox(user, request);
     } catch (err) {
       return Response.json(
-        { error: err instanceof Error ? err.message : "Failed to provision workspace sandbox" },
+        { error: err instanceof Error ? err.message : "Failed to provision sandbox" },
         { status: 500 }
       );
     }
-    const directSidecarUrl = box.connection?.sidecarUrl ?? box.connection?.runtimeUrl;
-    const directSidecarToken = box.connection?.authToken ?? box.connection?.sidecarToken;
-    const directSidecarExpiresAt = box.connection?.authTokenExpiresAt;
-    if (opts.exposeDirectSidecar && directSidecarUrl && directSidecarToken && directSidecarExpiresAt) {
-      return Response.json({
-        runtimeUrl: directSidecarUrl,
-        sidecarUrl: directSidecarUrl,
-        token: directSidecarToken,
-        expiresAt: directSidecarExpiresAt,
-        status: box.status,
-        sandboxId: box.id
-      });
-    }
-    if (!directSidecarUrl) {
+    const runtimeUrl = box.connection?.runtimeUrl;
+    if (!runtimeUrl) {
       return Response.json(
         {
-          error: "Workspace sandbox runtime not ready. The sandbox is still initializing -- retry in a few seconds.",
+          error: "Sandbox runtime not ready. The sandbox is still initializing -- retry in a few seconds.",
           status: box.status
         },
         { status: 503 }
       );
     }
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
+    const requested = new URL(request.url).searchParams.get("connectionId");
+    const connectionId = await resolveConnectionId({ request, user, box, requested });
+    if (!connectionId) {
+      return Response.json(
+        {
+          error: "connectionId is required \u2014 pass the same id TerminalView dials (tabTerminalConnectionId()) as the 'connectionId' query parameter"
+        },
+        { status: 400 }
+      );
+    }
     let scoped;
     try {
-      scoped = await createSandboxTerminalToken(
-        { userId: user.id, workspaceId, sandboxId: box.id },
-        { secret, expiresInMs: opts.tokenExpiresInMs }
-      );
+      scoped = await box.mintScopedToken({
+        scope: TERMINAL_SCOPE,
+        ttlMinutes: opts.ttlMinutes ?? DEFAULT_TTL_MINUTES,
+        sessionId: connectionId
+      });
     } catch (err) {
       return Response.json(
         { error: err instanceof Error ? err.message : "Failed to mint sandbox token" },
         { status: 503 }
       );
     }
-    const runtimeUrl = opts.proxyRuntimeUrl ? opts.proxyRuntimeUrl({ request, workspaceId, sandboxId: box.id, box }) : `/api/workspaces/${encodeURIComponent(workspaceId)}/sandbox/runtime/${encodeURIComponent(box.id)}`;
     return Response.json({
-      runtimeUrl,
-      sidecarUrl: runtimeUrl,
+      sidecarUrl: scoped.sidecarProxyUrl,
       token: scoped.token,
       expiresAt: scoped.expiresAt.toISOString(),
       status: box.status,
-      sandboxId: box.id
+      sandboxId: box.id,
+      connectionId
     });
   };
 }
-function sandboxSidecarProxyUrl(baseUrl, sandboxId) {
-  if (!baseUrl) throw new Error("baseUrl is required");
-  if (!sandboxId) throw new Error("sandboxId is required");
-  return new URL(`/v1/sidecar-proxy/${encodeURIComponent(sandboxId)}`, baseUrl).toString().replace(/\/+$/, "");
-}
-function createWorkspaceSandboxRuntimeProxyHandler(opts) {
-  return async function handleWorkspaceSandboxRuntimeProxy({ request, params }) {
-    const user = await opts.requireUser(request);
-    const workspaceId = params.workspaceId;
-    const sandboxId = params.sandboxId;
-    const runtimePath = params["*"];
-    if (!workspaceId || !sandboxId || !runtimePath) {
-      return Response.json({ error: "workspaceId, sandboxId, and runtime path are required" }, { status: 400 });
-    }
-    const encodedRuntimePath = encodeSandboxRuntimePath(runtimePath);
-    if (!encodedRuntimePath) return Response.json({ error: "Invalid sandbox runtime path" }, { status: 400 });
-    await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId, sandboxId });
-    const token = terminalTokenFromRequest(request.headers);
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
-    if (!token || !await verifySandboxTerminalToken(token, { userId: user.id, workspaceId, sandboxId }, { secret })) {
-      return Response.json({ error: "Invalid terminal token" }, { status: 403 });
-    }
-    const requestUrl = new URL(request.url);
-    const runtimeConnection = await opts.getSandboxRuntimeConnection?.({ request, userId: user.id, workspaceId, sandboxId });
-    const directRuntimeConnection = runtimeConnection?.runtimeUrl && runtimeConnection.authToken ? runtimeConnection : null;
-    const credentials = directRuntimeConnection ? null : await opts.getSandboxApiCredentials({ request, userId: user.id, workspaceId, sandboxId });
-    const upstreamUrl = directRuntimeConnection ? new URL(encodedRuntimePath, `${directRuntimeConnection.runtimeUrl.replace(/\/+$/, "")}/`) : new URL(encodedRuntimePath, `${sandboxSidecarProxyUrl(credentials.baseUrl, sandboxId)}/`);
-    upstreamUrl.search = requestUrl.search;
-    const headers = buildSandboxRuntimeProxyHeaders(
-      request.headers,
-      directRuntimeConnection?.authToken ?? credentials.apiKey,
-      opts.forwardHeaders
-    );
-    const init = {
-      method: request.method,
-      headers,
-      redirect: "manual"
-    };
-    if (request.method !== "GET" && request.method !== "HEAD" && request.body) {
-      init.body = request.body;
-      init.duplex = "half";
-    }
-    const fetchImpl = opts.fetch ?? fetch;
-    const response = await fetchImpl(upstreamUrl, init);
-    const responseHeaders = new Headers(response.headers);
-    responseHeaders.delete("set-cookie");
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: responseHeaders
-    });
-  };
-}
-var SANDBOX_TERMINAL_WS_PATHNAME = /^\/api\/workspaces\/([^/]+)\/sandbox\/runtime\/([^/]+)\/(terminals\/[^/]+\/ws)$/;
-function matchSandboxTerminalWsPath(pathname) {
-  const m = SANDBOX_TERMINAL_WS_PATHNAME.exec(pathname);
-  if (!m) return null;
-  const [, workspaceId, sandboxId, subPath] = m;
-  if (!workspaceId || !sandboxId || !subPath) return null;
-  const decodedWorkspaceId = safeDecodeURIComponent(workspaceId);
-  const decodedSandboxId = safeDecodeURIComponent(sandboxId);
-  if (!decodedWorkspaceId || !decodedSandboxId) return null;
-  return { workspaceId: decodedWorkspaceId, sandboxId: decodedSandboxId, subPath };
-}
-function isSandboxTerminalWsUpgrade(request) {
-  if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return false;
-  try {
-    return matchSandboxTerminalWsPath(new URL(request.url).pathname) !== null;
-  } catch {
-    return false;
-  }
-}
-function createWorkspaceSandboxTerminalUpgradeHandler(opts) {
-  return async function handleWorkspaceSandboxTerminalUpgrade(request) {
-    if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return null;
-    let url;
-    try {
-      url = new URL(request.url);
-    } catch {
-      return null;
-    }
-    const match = matchSandboxTerminalWsPath(url.pathname);
-    if (!match) return null;
-    const { workspaceId, sandboxId, subPath } = match;
-    let user;
-    try {
-      user = await opts.requireUser(request);
-    } catch {
-      return new Response("Unauthorized", { status: 401 });
-    }
-    try {
-      await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId, sandboxId });
-    } catch {
-      return new Response("Forbidden", { status: 403 });
-    }
-    const token = terminalTokenFromRequest(request.headers);
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
-    if (!token || !await verifySandboxTerminalToken(token, { userId: user.id, workspaceId, sandboxId }, { secret })) {
-      return new Response("Invalid terminal token", { status: 403 });
-    }
-    const runtimeConnection = await opts.getSandboxRuntimeConnection?.({ request, userId: user.id, workspaceId, sandboxId });
-    const directRuntimeConnection = runtimeConnection?.runtimeUrl && runtimeConnection.authToken ? runtimeConnection : null;
-    const credentials = directRuntimeConnection ? null : await opts.getSandboxApiCredentials({ request, userId: user.id, workspaceId, sandboxId });
-    const upstreamUrl = directRuntimeConnection ? new URL(subPath, `${directRuntimeConnection.runtimeUrl.replace(/\/+$/, "")}/`) : new URL(subPath, `${sandboxSidecarProxyUrl(credentials.baseUrl, sandboxId)}/`);
-    upstreamUrl.search = url.search;
-    const upstreamHeaders = new Headers(request.headers);
-    const upstreamBearer = directRuntimeConnection?.authToken ?? credentials.apiKey;
-    upstreamHeaders.set("Authorization", `Bearer ${upstreamBearer}`);
-    upstreamHeaders.delete("host");
-    const browserProtocol = selectedBearerSubprotocol(request.headers.get("Sec-WebSocket-Protocol"));
-    stripBearerSubprotocol(upstreamHeaders);
-    const fetchImpl = opts.fetch ?? fetch;
-    const upstream = await fetchImpl(upstreamUrl.toString(), { method: request.method, headers: upstreamHeaders });
-    const echo = terminalUpgradeSubprotocolEcho(upstream, browserProtocol);
-    if (!echo) return upstream;
-    return new Response(null, {
-      status: echo.status,
-      statusText: echo.statusText,
-      headers: echo.headers,
-      webSocket: upstream.webSocket ?? null
-    });
-  };
-}
-function terminalUpgradeSubprotocolEcho(upstream, browserProtocol) {
-  if (upstream.status !== 101 || !browserProtocol) return null;
-  if (upstream.headers.has("Sec-WebSocket-Protocol")) return null;
-  const headers = new Headers(upstream.headers);
-  headers.set("Sec-WebSocket-Protocol", browserProtocol);
-  return { status: upstream.status, statusText: upstream.statusText ?? "", headers };
-}
-function selectedBearerSubprotocol(value) {
-  if (!value) return null;
-  for (const part of value.split(",")) {
-    const protocol = part.trim();
-    if (protocol.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX)) return protocol;
-  }
-  return null;
-}
-var DEFAULT_RUNTIME_PROXY_HEADERS = ["accept", "content-type", "last-event-id", "x-session-id"];
-function buildSandboxRuntimeProxyHeaders(source, sandboxApiKey, forwardHeaders = DEFAULT_RUNTIME_PROXY_HEADERS) {
-  const headers = new Headers();
-  headers.set("Authorization", `Bearer ${sandboxApiKey}`);
-  for (const name of forwardHeaders) {
-    const value = source.get(name);
-    if (value) headers.set(name, value);
-  }
-  return headers;
-}
-function encodeSandboxRuntimePath(runtimePath) {
-  const segments = runtimePath.split("/");
-  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return null;
-  return segments.map((segment) => encodeURIComponent(segment)).join("/");
-}
-function bearerToken(value) {
-  if (!value) return null;
-  const trimmed = value.trim();
-  if (!trimmed) return null;
-  if (trimmed.toLowerCase() === "bearer") return null;
-  if (trimmed.toLowerCase().startsWith("bearer ")) {
-    const token = trimmed.slice("bearer ".length).trim();
-    return token || null;
-  }
-  return trimmed;
-}
-function bearerSubprotocolToken(value) {
-  if (!value) return null;
-  for (const part of value.split(",")) {
-    const protocol = part.trim();
-    if (!protocol.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX)) continue;
-    const encoded = protocol.slice(BEARER_SUBPROTOCOL_PREFIX.length);
-    if (!encoded) return null;
-    try {
-      const token = base64UrlDecodeText(encoded).trim();
-      return token || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
-function terminalTokenFromRequest(headers) {
-  return bearerToken(headers.get("Authorization")) ?? bearerSubprotocolToken(headers.get("Sec-WebSocket-Protocol"));
-}
-function safeDecodeURIComponent(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-}
-function stripBearerSubprotocol(headers) {
-  const value = headers.get("Sec-WebSocket-Protocol");
-  if (!value) return;
-  const protocols = value.split(",").map((part) => part.trim()).filter((part) => part && !part.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX));
-  if (protocols.length) {
-    headers.set("Sec-WebSocket-Protocol", protocols.join(", "));
-  } else {
-    headers.delete("Sec-WebSocket-Protocol");
-  }
-}
-function validateTerminalSubject(subject) {
-  if (!subject.userId) throw new Error("userId is required");
-  if (!subject.workspaceId) throw new Error("workspaceId is required");
-  if (!subject.sandboxId) throw new Error("sandboxId is required");
-}
 
 // src/sandbox/prewarm.ts
 function prewarmKey(scope) {
@@ -1982,24 +1725,8 @@ export {
   shellQuote,
   statSandboxFileSize,
   readSandboxBinaryBytes,
-  mintTerminalProxyToken,
-  verifyTerminalProxyToken,
   createWorkspaceSandboxManager,
-  createSandboxTerminalToken,
-  verifySandboxTerminalToken,
-  createWorkspaceSandboxConnectionHandler,
-  sandboxSidecarProxyUrl,
-  createWorkspaceSandboxRuntimeProxyHandler,
-  matchSandboxTerminalWsPath,
-  isSandboxTerminalWsUpgrade,
-  createWorkspaceSandboxTerminalUpgradeHandler,
-  terminalUpgradeSubprotocolEcho,
-  selectedBearerSubprotocol,
-  buildSandboxRuntimeProxyHeaders,
-  encodeSandboxRuntimePath,
-  bearerToken,
-  bearerSubprotocolToken,
-  terminalTokenFromRequest,
+  createSandboxTerminalConnectionRoute,
   createSandboxPrewarmer,
   DEFAULT_PREWARM_CLAIM_TABLE,
   PREWARM_CLAIM_TABLE_DDL,
@@ -2049,4 +1776,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-2UDJH6QR.js.map
+//# sourceMappingURL=chunk-EC7CUA4L.js.map