@tangle-network/agent-app 0.44.60 → 0.45.2

package/dist/assistant/index.js

@@ -3,13 +3,13 @@ import {
   ChatMessages,
   ModelPicker,
   ProviderLogo
-} from "../chunk-WXWU2FEB.js";
+} from "../chunk-RDK3CN7Y.js";
 import "../chunk-FBVLEGEG.js";
 import "../chunk-GINKOZFD.js";
 import "../chunk-YTMKRL3L.js";
 import "../chunk-GEYACSFW.js";
 import "../chunk-6MUJROBT.js";
-import "../chunk-S4YW2Y52.js";
+import "../chunk-BATKJP3P.js";
 import "../chunk-QY4BRKRJ.js";
 import "../chunk-WBHPN5DY.js";
 import "../chunk-UXMIPX3Z.js";
@@ -18,7 +18,7 @@ import "../chunk-KWXUBMXU.js";
 import "../chunk-5EPIPT4V.js";
 import "../chunk-3ZK5IJSW.js";
 import "../chunk-YJMCRXQQ.js";
-import "../chunk-CQZSAR77.js";
+import "../chunk-73F3CKVK.js";
 
 // src/assistant/sse.ts
 var SSEChunkParser = class {

package/dist/chat-routes/index.js

@@ -100,11 +100,11 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-APFJITYT.js";
+} from "../chunk-AOQ4FCSH.js";
 import "../chunk-LWSJK546.js";
-import "../chunk-CQZSAR77.js";
-import "../chunk-ICOHEZK6.js";
-import "../chunk-3EJ6SFJI.js";
+import "../chunk-73F3CKVK.js";
+import "../chunk-ITCINLSU.js";
+import "../chunk-IVEKCOM7.js";
 import "../chunk-YEFFHORB.js";
 import "../chunk-S5SRJJQG.js";
 import "../chunk-JML7WKWU.js";

package/dist/{chunk-CQZSAR77.js → chunk-73F3CKVK.js}

@@ -1,26 +1,20 @@
 // src/harness/index.ts
 import {
   harnessSupportsModel,
+  harnessTypeSchema,
   modelProvider,
   preferredHarnessForModel,
   snapHarnessToModel as aiSnapHarnessToModel,
   snapModelToHarness as aiSnapModelToHarness
 } from "@tangle-network/agent-interface";
+var NON_BACKEND_HARNESSES = ["gemini"];
+var EXTRA_HARNESSES = ["forge", "cursor"];
+var nonBackendHarnesses = new Set(NON_BACKEND_HARNESSES);
 var KNOWN_HARNESSES = [
-  "opencode",
-  "claude-code",
-  "nanoclaw",
-  "kimi-code",
-  "codex",
-  "amp",
-  "factory-droids",
-  "pi",
-  "hermes",
-  "forge",
-  "openclaw",
-  "acp",
-  "cursor",
-  "cli-base"
+  ...harnessTypeSchema.options.filter(
+    (harness) => !nonBackendHarnesses.has(harness)
+  ),
+  ...EXTRA_HARNESSES
 ];
 var DEFAULT_HARNESS = "opencode";
 var HARNESS_SET = new Set(KNOWN_HARNESSES);
@@ -40,14 +34,30 @@ function resolveSessionHarness(input = {}) {
   const harness = coerceHarness(input.requested, coerceHarness(input.workspaceDefault, fallback));
   return { harness, locked: false, swapAttempted: false };
 }
+var canonicalHarnesses = new Set(harnessTypeSchema.options);
+function canonicalHarness(harness) {
+  return canonicalHarnesses.has(harness) ? harness : null;
+}
 function isModelCompatibleWithHarness(harness, modelId) {
-  return harnessSupportsModel(harness, modelId);
+  const canonical = canonicalHarness(harness);
+  if (!canonical) return true;
+  return harnessSupportsModel(canonical, modelId);
 }
 function snapModelToHarness(harness, modelId, canonicalIds) {
-  return aiSnapModelToHarness(harness, modelId, canonicalIds);
+  const canonical = canonicalHarness(harness);
+  if (!canonical) return modelId;
+  return aiSnapModelToHarness(canonical, modelId, canonicalIds);
 }
 function snapHarnessToModel(harness, modelId) {
-  return aiSnapHarnessToModel(harness, modelId);
+  const canonical = canonicalHarness(harness);
+  if (!canonical) return harness;
+  const snapped = aiSnapHarnessToModel(canonical, modelId);
+  if (!isHarness(snapped)) {
+    throw new Error(
+      `Harness "${harness}" snapped to "${snapped}" for model "${modelId}", which this platform has no backend for.`
+    );
+  }
+  return snapped;
 }
 function assertHarnessModelCompatible(harness, modelId) {
   if (!isModelCompatibleWithHarness(harness, modelId)) {
@@ -71,4 +81,4 @@ export {
   snapHarnessToModel,
   assertHarnessModelCompatible
 };
-//# sourceMappingURL=chunk-CQZSAR77.js.map
+//# sourceMappingURL=chunk-73F3CKVK.js.map

package/dist/chunk-73F3CKVK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/harness/index.ts"],"sourcesContent":["/**\n * Coding-agent harness selection — taxonomy, coercion, and the session-lock invariant.\n *\n * A \"harness\" is the coding-agent CLI a sandbox drives (opencode / codex /\n * claude-code / …). The shell governs WHICH harness a chat session uses and\n * enforces that a session is LOCKED to the harness it started with — the model\n * may change mid-session, the harness may not (swapping it mid-session would\n * orphan the session's running agent state). Every product otherwise hand-rolls\n * this and hard-codes a single harness; this is the one place the rule lives.\n *\n * Substrate-free: the harness list is derived from `@tangle-network/agent-interface`'s canonical\n * harness enum and mirrors the sandbox SDK's `BackendType` (no sandbox dependency). The consumer\n * owns storage — which harness a workspace defaults to, which one a session locked — and maps the\n * resolved value onto the SDK's `backend.type`.\n *\n * Harness↔model COMPATIBILITY (which models a harness can run, snapping) is NOT defined here — it\n * comes from `@tangle-network/agent-interface`, the single source of truth shared with the\n * sandbox-ui pickers and the cli-bridge backends. This module owns the harness TAXONOMY + the\n * session lock.\n */\n\nimport {\n  harnessSupportsModel,\n  harnessTypeSchema,\n  modelProvider,\n  preferredHarnessForModel,\n  snapHarnessToModel as aiSnapHarnessToModel,\n  snapModelToHarness as aiSnapModelToHarness,\n  type HarnessType,\n} from '@tangle-network/agent-interface'\n\n/**\n * Canonical harnesses that are NOT sandbox backends. `KNOWN_HARNESSES` is dispatched as\n * `backend.type`, so a harness the platform ships no provider adapter for must stay out —\n * offering it would resolve a session onto a runner that cannot start.\n */\nconst NON_BACKEND_HARNESSES = ['gemini'] as const satisfies readonly HarnessType[]\n\n/**\n * Backends the platform runs that the canonical enum does not carry yet. The guard below turns\n * their adoption upstream into a compile error, so this list is emptied rather than duplicating a\n * canonical id.\n */\nconst EXTRA_HARNESSES = ['forge', 'cursor'] as const\n\ntype ExtrasAlreadyCanonical = Extract<HarnessType, (typeof EXTRA_HARNESSES)[number]>\nconst _extrasAreNotYetCanonical: ExtrasAlreadyCanonical extends never ? true : never = true\nvoid _extrasAreNotYetCanonical\n\nconst nonBackendHarnesses = new Set<string>(NON_BACKEND_HARNESSES)\n\n/** A coding-agent backend this shell can dispatch a session onto. */\nexport type Harness =\n  | Exclude<HarnessType, (typeof NON_BACKEND_HARNESSES)[number]>\n  | (typeof EXTRA_HARNESSES)[number]\n\n/**\n * The known coding-agent backends: the canonical harness set minus what has no provider adapter,\n * plus adapters the canonical set has yet to adopt. Derived from `harnessTypeSchema.options` so a\n * harness added upstream reaches this shell without an edit here, and kept structural so this\n * module still needs no sandbox dependency.\n */\nexport const KNOWN_HARNESSES: readonly Harness[] = [\n  ...harnessTypeSchema.options.filter(\n    (harness): harness is Exclude<HarnessType, (typeof NON_BACKEND_HARNESSES)[number]> =>\n      !nonBackendHarnesses.has(harness),\n  ),\n  ...EXTRA_HARNESSES,\n]\n\n/** Define the default harness to use for code execution and testing environments */\nexport const DEFAULT_HARNESS: Harness = 'opencode'\n\nconst HARNESS_SET: ReadonlySet<string> = new Set(KNOWN_HARNESSES)\n\n/** Determine if a value is a recognized harness string identifier */\nexport function isHarness(value: unknown): value is Harness {\n  return typeof value === 'string' && HARNESS_SET.has(value)\n}\n\n/** Coerce an arbitrary value to a known harness, falling back (default `opencode`). */\nexport function coerceHarness(value: unknown, fallback: Harness = DEFAULT_HARNESS): Harness {\n  return isHarness(value) ? value : fallback\n}\n\n/** Resolve input options to determine the appropriate session harness to use */\nexport interface ResolveSessionHarnessInput {\n  /** The harness already locked to this session (recorded at its first turn). */\n  sessionHarness?: unknown\n  /** The harness requested now — a new session's choice, or a turn's attempt to switch. */\n  requested?: unknown\n  /** The workspace's default harness, used only when starting a fresh session. */\n  workspaceDefault?: unknown\n  /** Final fallback when nothing else resolves (default `opencode`). */\n  fallback?: Harness\n}\n\n/** Represent resolved session state including harness, lock status, and swap attempt flag */\nexport interface ResolvedSessionHarness {\n  /** The harness to actually run — the locked one when the session already has it. */\n  harness: Harness\n  /** True when the session already had a locked harness (this turn did not pick it). */\n  locked: boolean\n  /** True when `requested` differs from the locked harness — a forbidden mid-session\n   *  swap the caller should reject or warn on. The lock always wins regardless. */\n  swapAttempted: boolean\n}\n\n/**\n * Resolve the harness for a turn, enforcing the session lock.\n *\n * - **Session already started** (`sessionHarness` is a known harness): that harness\n *   wins (`locked: true`); a differing `requested` sets `swapAttempted` so the caller\n *   can reject the swap. The model is a separate per-turn concern and is unaffected.\n * - **Fresh session**: pick `requested → workspaceDefault → fallback`. The caller\n *   persists the result as the session's lock for every subsequent turn.\n */\nexport function resolveSessionHarness(input: ResolveSessionHarnessInput = {}): ResolvedSessionHarness {\n  const fallback = input.fallback ?? DEFAULT_HARNESS\n  if (isHarness(input.sessionHarness)) {\n    const locked = input.sessionHarness\n    const swapAttempted = isHarness(input.requested) && input.requested !== locked\n    return { harness: locked, locked: true, swapAttempted }\n  }\n  const harness = coerceHarness(input.requested, coerceHarness(input.workspaceDefault, fallback))\n  return { harness, locked: false, swapAttempted: false }\n}\n\n/**\n * Harness ↔ model compatibility + snapping — delegated to `@tangle-network/agent-interface`.\n *\n * `Harness` and `HarnessType` OVERLAP rather than nest: this shell drops canonical harnesses the\n * platform has no backend for, and carries backends the canonical enum has yet to adopt. So a\n * harness is narrowed to a canonical id before any capability lookup, and the non-canonical\n * remainder is answered here — those runners are multi-provider CLIs with no vendor lock, so they\n * run any model and never snap. As the canonical enum adopts them, `canonicalHarness` starts\n * returning them and the lookup below takes over with no change at these call sites.\n */\n\nconst canonicalHarnesses: ReadonlySet<string> = new Set(harnessTypeSchema.options)\n\n/** The canonical id for a harness, or `null` for a backend the canonical enum does not list. */\nfunction canonicalHarness(harness: Harness): HarnessType | null {\n  return canonicalHarnesses.has(harness) ? (harness as HarnessType) : null\n}\n\nexport { modelProvider }\n\n/** Provider-less ids (sentinels like \"default\", or a session's own config) are\n *  compatible everywhere — every harness honors its own configuration. */\nexport function isModelCompatibleWithHarness(harness: Harness, modelId: string): boolean {\n  const canonical = canonicalHarness(harness)\n  if (!canonical) return true\n  return harnessSupportsModel(canonical, modelId)\n}\n\n/** Keep `modelId` when the harness can run it; else the harness's best compatible\n *  catalog id (preferred patterns in order, highest version). When nothing in the\n *  catalog fits, return the original so the caller sees the incompatibility. */\nexport function snapModelToHarness(harness: Harness, modelId: string, canonicalIds: readonly string[]): string {\n  const canonical = canonicalHarness(harness)\n  if (!canonical) return modelId\n  return aiSnapModelToHarness(canonical, modelId, canonicalIds)\n}\n\n/** Keep the harness when it can run `modelId`; else the model's native harness\n *  (anthropic → claude-code, openai → codex, moonshot → kimi-code), falling back to opencode. */\nexport function snapHarnessToModel(harness: Harness, modelId: string): Harness {\n  const canonical = canonicalHarness(harness)\n  if (!canonical) return harness\n  const snapped = aiSnapHarnessToModel(canonical, modelId)\n  if (!isHarness(snapped)) {\n    throw new Error(\n      `Harness \"${harness}\" snapped to \"${snapped}\" for model \"${modelId}\", which this platform has no backend for.`,\n    )\n  }\n  return snapped\n}\n\n/** Fail-loud server guard: throw when a harness is asked to run a model it can't.\n *  Call before dispatching a sandbox turn so a bypassed UI can't reach the sidecar\n *  with an incompatible pair. */\nexport function assertHarnessModelCompatible(harness: Harness, modelId: string): void {\n  if (!isModelCompatibleWithHarness(harness, modelId)) {\n    const provider = modelProvider(modelId)\n    const native = preferredHarnessForModel(modelId)\n    throw new Error(\n      `Harness \"${harness}\" cannot run model \"${modelId}\" (provider \"${provider}\"). ` +\n        `Use ${native ?? 'a router-backed harness (opencode)'} or an allowed model.`,\n    )\n  }\n}\n"],"mappings":";AAqBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,OAEjB;AAOP,IAAM,wBAAwB,CAAC,QAAQ;AAOvC,IAAM,kBAAkB,CAAC,SAAS,QAAQ;AAM1C,IAAM,sBAAsB,IAAI,IAAY,qBAAqB;AAa1D,IAAM,kBAAsC;AAAA,EACjD,GAAG,kBAAkB,QAAQ;AAAA,IAC3B,CAAC,YACC,CAAC,oBAAoB,IAAI,OAAO;AAAA,EACpC;AAAA,EACA,GAAG;AACL;AAGO,IAAM,kBAA2B;AAExC,IAAM,cAAmC,IAAI,IAAI,eAAe;AAGzD,SAAS,UAAU,OAAkC;AAC1D,SAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAK;AAC3D;AAGO,SAAS,cAAc,OAAgB,WAAoB,iBAA0B;AAC1F,SAAO,UAAU,KAAK,IAAI,QAAQ;AACpC;AAkCO,SAAS,sBAAsB,QAAoC,CAAC,GAA2B;AACpG,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,UAAU,MAAM,cAAc,GAAG;AACnC,UAAM,SAAS,MAAM;AACrB,UAAM,gBAAgB,UAAU,MAAM,SAAS,KAAK,MAAM,cAAc;AACxE,WAAO,EAAE,SAAS,QAAQ,QAAQ,MAAM,cAAc;AAAA,EACxD;AACA,QAAM,UAAU,cAAc,MAAM,WAAW,cAAc,MAAM,kBAAkB,QAAQ,CAAC;AAC9F,SAAO,EAAE,SAAS,QAAQ,OAAO,eAAe,MAAM;AACxD;AAaA,IAAM,qBAA0C,IAAI,IAAI,kBAAkB,OAAO;AAGjF,SAAS,iBAAiB,SAAsC;AAC9D,SAAO,mBAAmB,IAAI,OAAO,IAAK,UAA0B;AACtE;AAMO,SAAS,6BAA6B,SAAkB,SAA0B;AACvF,QAAM,YAAY,iBAAiB,OAAO;AAC1C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,qBAAqB,WAAW,OAAO;AAChD;AAKO,SAAS,mBAAmB,SAAkB,SAAiB,cAAyC;AAC7G,QAAM,YAAY,iBAAiB,OAAO;AAC1C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,qBAAqB,WAAW,SAAS,YAAY;AAC9D;AAIO,SAAS,mBAAmB,SAAkB,SAA0B;AAC7E,QAAM,YAAY,iBAAiB,OAAO;AAC1C,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,UAAU,qBAAqB,WAAW,OAAO;AACvD,MAAI,CAAC,UAAU,OAAO,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,YAAY,OAAO,iBAAiB,OAAO,gBAAgB,OAAO;AAAA,IACpE;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,6BAA6B,SAAkB,SAAuB;AACpF,MAAI,CAAC,6BAA6B,SAAS,OAAO,GAAG;AACnD,UAAM,WAAW,cAAc,OAAO;AACtC,UAAM,SAAS,yBAAyB,OAAO;AAC/C,UAAM,IAAI;AAAA,MACR,YAAY,OAAO,uBAAuB,OAAO,gBAAgB,QAAQ,WAChE,UAAU,oCAAoC;AAAA,IACzD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-APFJITYT.js → chunk-AOQ4FCSH.js}

@@ -4,16 +4,10 @@ import {
 } from "./chunk-LWSJK546.js";
 import {
   assertHarnessModelCompatible
-} from "./chunk-CQZSAR77.js";
+} from "./chunk-73F3CKVK.js";
 import {
   buildAppToolMcpServer
-} from "./chunk-3EJ6SFJI.js";
-import {
-  base64UrlDecodeText,
-  base64UrlEncodeText,
-  constantTimeEqual,
-  hmacSha256Base64Url
-} from "./chunk-S5SRJJQG.js";
+} from "./chunk-IVEKCOM7.js";
 import {
   resolveTangleExecutionEnvironment,
   trimOrNull
@@ -161,35 +155,7 @@ async function readSandboxBinaryBytes(box, absolutePath, expectedSize, options)
   return { succeeded: true, value: { bytes, size: expectedSize } };
 }
 
-// src/sandbox/terminal-proxy-token.ts
-var TERMINAL_PROXY_TOKEN_TTL_MS = 15 * 60 * 1e3;
-async function mintTerminalProxyToken(secret, identity, ttlMs = TERMINAL_PROXY_TOKEN_TTL_MS, now = Date.now) {
-  if (!secret) return fail(new Error("mintTerminalProxyToken: secret is required"));
-  if (!identity.userId || !identity.workspaceId || !identity.sandboxId) {
-    return fail(new Error("mintTerminalProxyToken: userId/workspaceId/sandboxId are required"));
-  }
-  const expiresAt = new Date(now() + ttlMs);
-  const payload = { ...identity, exp: Math.floor(expiresAt.getTime() / 1e3) };
-  const encoded = base64UrlEncodeText(JSON.stringify(payload));
-  const sig = await hmacSha256Base64Url(encoded, secret);
-  return ok({ token: `${encoded}.${sig}`, expiresAt });
-}
-async function verifyTerminalProxyToken(secret, token, expected, now = Date.now) {
-  if (!secret) return false;
-  const [encoded, sig, extra] = token.split(".");
-  if (!encoded || !sig || extra !== void 0) return false;
-  const expectedSig = await hmacSha256Base64Url(encoded, secret);
-  if (!constantTimeEqual(sig, expectedSig)) return false;
-  let payload;
-  try {
-    payload = JSON.parse(base64UrlDecodeText(encoded));
-  } catch {
-    return false;
-  }
-  return payload.userId === expected.userId && payload.workspaceId === expected.workspaceId && payload.sandboxId === expected.sandboxId && Number.isFinite(payload.exp) && payload.exp > Math.floor(now() / 1e3);
-}
-
-// src/sandbox/workspace-terminal.ts
+// src/sandbox/workspace-sandbox-manager.ts
 function createWorkspaceSandboxManager(opts) {
   return {
     async ensureWorkspaceSandbox(workspaceId, userId, options) {
@@ -222,293 +188,6 @@ function createWorkspaceSandboxManager(opts) {
     }
   };
 }
-var DEFAULT_TERMINAL_TOKEN_TTL_MS = 15 * 60 * 1e3;
-var BEARER_SUBPROTOCOL_PREFIX = "bearer.";
-var LEGACY_TERMINAL_TOKEN_PREFIX = "sbxt_";
-async function createSandboxTerminalToken(subject, opts) {
-  validateTerminalSubject(subject);
-  const secret = opts.secret?.trim();
-  if (!secret) throw new Error("terminal token secret is required");
-  const now = opts.now ?? Date.now;
-  const expiresInMs = opts.expiresInMs ?? DEFAULT_TERMINAL_TOKEN_TTL_MS;
-  if (!Number.isFinite(expiresInMs) || expiresInMs <= 0) throw new Error("expiresInMs must be a positive number");
-  const minted = await mintTerminalProxyToken(secret, subject, expiresInMs, now);
-  if (!minted.succeeded) throw minted.error;
-  return minted.value;
-}
-async function verifySandboxTerminalToken(token, expected, opts) {
-  validateTerminalSubject(expected);
-  const secret = opts.secret?.trim();
-  const now = opts.now ?? Date.now;
-  const normalized = token.startsWith(LEGACY_TERMINAL_TOKEN_PREFIX) ? token.slice(LEGACY_TERMINAL_TOKEN_PREFIX.length) : token;
-  return verifyTerminalProxyToken(secret ?? "", normalized, expected, now);
-}
-function createWorkspaceSandboxConnectionHandler(opts) {
-  return async function handleWorkspaceSandboxConnection({ request, params }) {
-    const user = await opts.requireUser(request);
-    const workspaceId = params.workspaceId;
-    if (!workspaceId) return Response.json({ error: "workspaceId is required" }, { status: 400 });
-    await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId });
-    let box;
-    try {
-      box = await opts.ensureWorkspaceSandbox(workspaceId, user.id);
-    } catch (err) {
-      return Response.json(
-        { error: err instanceof Error ? err.message : "Failed to provision workspace sandbox" },
-        { status: 500 }
-      );
-    }
-    const directSidecarUrl = box.connection?.sidecarUrl ?? box.connection?.runtimeUrl;
-    const directSidecarToken = box.connection?.authToken ?? box.connection?.sidecarToken;
-    const directSidecarExpiresAt = box.connection?.authTokenExpiresAt;
-    if (opts.exposeDirectSidecar && directSidecarUrl && directSidecarToken && directSidecarExpiresAt) {
-      return Response.json({
-        runtimeUrl: directSidecarUrl,
-        sidecarUrl: directSidecarUrl,
-        token: directSidecarToken,
-        expiresAt: directSidecarExpiresAt,
-        status: box.status,
-        sandboxId: box.id
-      });
-    }
-    if (!directSidecarUrl) {
-      return Response.json(
-        {
-          error: "Workspace sandbox runtime not ready. The sandbox is still initializing -- retry in a few seconds.",
-          status: box.status
-        },
-        { status: 503 }
-      );
-    }
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
-    let scoped;
-    try {
-      scoped = await createSandboxTerminalToken(
-        { userId: user.id, workspaceId, sandboxId: box.id },
-        { secret, expiresInMs: opts.tokenExpiresInMs }
-      );
-    } catch (err) {
-      return Response.json(
-        { error: err instanceof Error ? err.message : "Failed to mint sandbox token" },
-        { status: 503 }
-      );
-    }
-    const runtimeUrl = opts.proxyRuntimeUrl ? opts.proxyRuntimeUrl({ request, workspaceId, sandboxId: box.id, box }) : `/api/workspaces/${encodeURIComponent(workspaceId)}/sandbox/runtime/${encodeURIComponent(box.id)}`;
-    return Response.json({
-      runtimeUrl,
-      sidecarUrl: runtimeUrl,
-      token: scoped.token,
-      expiresAt: scoped.expiresAt.toISOString(),
-      status: box.status,
-      sandboxId: box.id
-    });
-  };
-}
-function sandboxSidecarProxyUrl(baseUrl, sandboxId) {
-  if (!baseUrl) throw new Error("baseUrl is required");
-  if (!sandboxId) throw new Error("sandboxId is required");
-  return new URL(`/v1/sidecar-proxy/${encodeURIComponent(sandboxId)}`, baseUrl).toString().replace(/\/+$/, "");
-}
-function createWorkspaceSandboxRuntimeProxyHandler(opts) {
-  return async function handleWorkspaceSandboxRuntimeProxy({ request, params }) {
-    const user = await opts.requireUser(request);
-    const workspaceId = params.workspaceId;
-    const sandboxId = params.sandboxId;
-    const runtimePath = params["*"];
-    if (!workspaceId || !sandboxId || !runtimePath) {
-      return Response.json({ error: "workspaceId, sandboxId, and runtime path are required" }, { status: 400 });
-    }
-    const encodedRuntimePath = encodeSandboxRuntimePath(runtimePath);
-    if (!encodedRuntimePath) return Response.json({ error: "Invalid sandbox runtime path" }, { status: 400 });
-    await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId, sandboxId });
-    const token = terminalTokenFromRequest(request.headers);
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
-    if (!token || !await verifySandboxTerminalToken(token, { userId: user.id, workspaceId, sandboxId }, { secret })) {
-      return Response.json({ error: "Invalid terminal token" }, { status: 403 });
-    }
-    const requestUrl = new URL(request.url);
-    const runtimeConnection = await opts.getSandboxRuntimeConnection?.({ request, userId: user.id, workspaceId, sandboxId });
-    const directRuntimeConnection = runtimeConnection?.runtimeUrl && runtimeConnection.authToken ? runtimeConnection : null;
-    const credentials = directRuntimeConnection ? null : await opts.getSandboxApiCredentials({ request, userId: user.id, workspaceId, sandboxId });
-    const upstreamUrl = directRuntimeConnection ? new URL(encodedRuntimePath, `${directRuntimeConnection.runtimeUrl.replace(/\/+$/, "")}/`) : new URL(encodedRuntimePath, `${sandboxSidecarProxyUrl(credentials.baseUrl, sandboxId)}/`);
-    upstreamUrl.search = requestUrl.search;
-    const headers = buildSandboxRuntimeProxyHeaders(
-      request.headers,
-      directRuntimeConnection?.authToken ?? credentials.apiKey,
-      opts.forwardHeaders
-    );
-    const init = {
-      method: request.method,
-      headers,
-      redirect: "manual"
-    };
-    if (request.method !== "GET" && request.method !== "HEAD" && request.body) {
-      init.body = request.body;
-      init.duplex = "half";
-    }
-    const fetchImpl = opts.fetch ?? fetch;
-    const response = await fetchImpl(upstreamUrl, init);
-    const responseHeaders = new Headers(response.headers);
-    responseHeaders.delete("set-cookie");
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: responseHeaders
-    });
-  };
-}
-var SANDBOX_TERMINAL_WS_PATHNAME = /^\/api\/workspaces\/([^/]+)\/sandbox\/runtime\/([^/]+)\/(terminals\/[^/]+\/ws)$/;
-function matchSandboxTerminalWsPath(pathname) {
-  const m = SANDBOX_TERMINAL_WS_PATHNAME.exec(pathname);
-  if (!m) return null;
-  const [, workspaceId, sandboxId, subPath] = m;
-  if (!workspaceId || !sandboxId || !subPath) return null;
-  const decodedWorkspaceId = safeDecodeURIComponent(workspaceId);
-  const decodedSandboxId = safeDecodeURIComponent(sandboxId);
-  if (!decodedWorkspaceId || !decodedSandboxId) return null;
-  return { workspaceId: decodedWorkspaceId, sandboxId: decodedSandboxId, subPath };
-}
-function isSandboxTerminalWsUpgrade(request) {
-  if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return false;
-  try {
-    return matchSandboxTerminalWsPath(new URL(request.url).pathname) !== null;
-  } catch {
-    return false;
-  }
-}
-function createWorkspaceSandboxTerminalUpgradeHandler(opts) {
-  return async function handleWorkspaceSandboxTerminalUpgrade(request) {
-    if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return null;
-    let url;
-    try {
-      url = new URL(request.url);
-    } catch {
-      return null;
-    }
-    const match = matchSandboxTerminalWsPath(url.pathname);
-    if (!match) return null;
-    const { workspaceId, sandboxId, subPath } = match;
-    let user;
-    try {
-      user = await opts.requireUser(request);
-    } catch {
-      return new Response("Unauthorized", { status: 401 });
-    }
-    try {
-      await opts.requireWorkspaceAccess({ request, userId: user.id, workspaceId, sandboxId });
-    } catch {
-      return new Response("Forbidden", { status: 403 });
-    }
-    const token = terminalTokenFromRequest(request.headers);
-    const secret = typeof opts.tokenSecret === "function" ? opts.tokenSecret() : opts.tokenSecret;
-    if (!token || !await verifySandboxTerminalToken(token, { userId: user.id, workspaceId, sandboxId }, { secret })) {
-      return new Response("Invalid terminal token", { status: 403 });
-    }
-    const runtimeConnection = await opts.getSandboxRuntimeConnection?.({ request, userId: user.id, workspaceId, sandboxId });
-    const directRuntimeConnection = runtimeConnection?.runtimeUrl && runtimeConnection.authToken ? runtimeConnection : null;
-    const credentials = directRuntimeConnection ? null : await opts.getSandboxApiCredentials({ request, userId: user.id, workspaceId, sandboxId });
-    const upstreamUrl = directRuntimeConnection ? new URL(subPath, `${directRuntimeConnection.runtimeUrl.replace(/\/+$/, "")}/`) : new URL(subPath, `${sandboxSidecarProxyUrl(credentials.baseUrl, sandboxId)}/`);
-    upstreamUrl.search = url.search;
-    const upstreamHeaders = new Headers(request.headers);
-    const upstreamBearer = directRuntimeConnection?.authToken ?? credentials.apiKey;
-    upstreamHeaders.set("Authorization", `Bearer ${upstreamBearer}`);
-    upstreamHeaders.delete("host");
-    const browserProtocol = selectedBearerSubprotocol(request.headers.get("Sec-WebSocket-Protocol"));
-    stripBearerSubprotocol(upstreamHeaders);
-    const fetchImpl = opts.fetch ?? fetch;
-    const upstream = await fetchImpl(upstreamUrl.toString(), { method: request.method, headers: upstreamHeaders });
-    const echo = terminalUpgradeSubprotocolEcho(upstream, browserProtocol);
-    if (!echo) return upstream;
-    return new Response(null, {
-      status: echo.status,
-      statusText: echo.statusText,
-      headers: echo.headers,
-      webSocket: upstream.webSocket ?? null
-    });
-  };
-}
-function terminalUpgradeSubprotocolEcho(upstream, browserProtocol) {
-  if (upstream.status !== 101 || !browserProtocol) return null;
-  if (upstream.headers.has("Sec-WebSocket-Protocol")) return null;
-  const headers = new Headers(upstream.headers);
-  headers.set("Sec-WebSocket-Protocol", browserProtocol);
-  return { status: upstream.status, statusText: upstream.statusText ?? "", headers };
-}
-function selectedBearerSubprotocol(value) {
-  if (!value) return null;
-  for (const part of value.split(",")) {
-    const protocol = part.trim();
-    if (protocol.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX)) return protocol;
-  }
-  return null;
-}
-var DEFAULT_RUNTIME_PROXY_HEADERS = ["accept", "content-type", "last-event-id", "x-session-id"];
-function buildSandboxRuntimeProxyHeaders(source, sandboxApiKey, forwardHeaders = DEFAULT_RUNTIME_PROXY_HEADERS) {
-  const headers = new Headers();
-  headers.set("Authorization", `Bearer ${sandboxApiKey}`);
-  for (const name of forwardHeaders) {
-    const value = source.get(name);
-    if (value) headers.set(name, value);
-  }
-  return headers;
-}
-function encodeSandboxRuntimePath(runtimePath) {
-  const segments = runtimePath.split("/");
-  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return null;
-  return segments.map((segment) => encodeURIComponent(segment)).join("/");
-}
-function bearerToken(value) {
-  if (!value) return null;
-  const trimmed = value.trim();
-  if (!trimmed) return null;
-  if (trimmed.toLowerCase() === "bearer") return null;
-  if (trimmed.toLowerCase().startsWith("bearer ")) {
-    const token = trimmed.slice("bearer ".length).trim();
-    return token || null;
-  }
-  return trimmed;
-}
-function bearerSubprotocolToken(value) {
-  if (!value) return null;
-  for (const part of value.split(",")) {
-    const protocol = part.trim();
-    if (!protocol.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX)) continue;
-    const encoded = protocol.slice(BEARER_SUBPROTOCOL_PREFIX.length);
-    if (!encoded) return null;
-    try {
-      const token = base64UrlDecodeText(encoded).trim();
-      return token || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
-function terminalTokenFromRequest(headers) {
-  return bearerToken(headers.get("Authorization")) ?? bearerSubprotocolToken(headers.get("Sec-WebSocket-Protocol"));
-}
-function safeDecodeURIComponent(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-}
-function stripBearerSubprotocol(headers) {
-  const value = headers.get("Sec-WebSocket-Protocol");
-  if (!value) return;
-  const protocols = value.split(",").map((part) => part.trim()).filter((part) => part && !part.toLowerCase().startsWith(BEARER_SUBPROTOCOL_PREFIX));
-  if (protocols.length) {
-    headers.set("Sec-WebSocket-Protocol", protocols.join(", "));
-  } else {
-    headers.delete("Sec-WebSocket-Protocol");
-  }
-}
-function validateTerminalSubject(subject) {
-  if (!subject.userId) throw new Error("userId is required");
-  if (!subject.workspaceId) throw new Error("workspaceId is required");
-  if (!subject.sandboxId) throw new Error("sandboxId is required");
-}
 
 // src/sandbox/terminal-connection.ts
 var DEFAULT_TTL_MINUTES = 15;
@@ -840,7 +519,7 @@ function buildAppToolMcpServers(options) {
     entries[key] = buildAppToolMcpServer({
       tool,
       baseUrl: options.baseUrl,
-      token: options.token,
+      tokenEnvKey: options.tokenEnvKey,
       ctx: options.ctx,
       description,
       headerNames: options.headerNames
@@ -2046,24 +1725,7 @@ export {
   shellQuote,
   statSandboxFileSize,
   readSandboxBinaryBytes,
-  mintTerminalProxyToken,
-  verifyTerminalProxyToken,
   createWorkspaceSandboxManager,
-  createSandboxTerminalToken,
-  verifySandboxTerminalToken,
-  createWorkspaceSandboxConnectionHandler,
-  sandboxSidecarProxyUrl,
-  createWorkspaceSandboxRuntimeProxyHandler,
-  matchSandboxTerminalWsPath,
-  isSandboxTerminalWsUpgrade,
-  createWorkspaceSandboxTerminalUpgradeHandler,
-  terminalUpgradeSubprotocolEcho,
-  selectedBearerSubprotocol,
-  buildSandboxRuntimeProxyHeaders,
-  encodeSandboxRuntimePath,
-  bearerToken,
-  bearerSubprotocolToken,
-  terminalTokenFromRequest,
   createSandboxTerminalConnectionRoute,
   createSandboxPrewarmer,
   DEFAULT_PREWARM_CLAIM_TABLE,
@@ -2114,4 +1776,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-APFJITYT.js.map
+//# sourceMappingURL=chunk-AOQ4FCSH.js.map