@truefoundry/trueforge-core 0.1.3 → 0.1.4

package/dist/core/sandbox/provider/Provider.d.ts

@@ -46,6 +46,8 @@ export interface SandboxBuild {
     metadata: SandboxBuildMetadata | null;
 }
 export interface SandboxProvider {
+    /** Stable provider kind used in fancy sandbox ids and carry-forward (plain string). */
+    readonly type: string;
     /**
      * Ensures the release image is being built into the provider's backing store and
      * returns its current status. Idempotent: an already-built image reports `ready`;
@@ -62,8 +64,18 @@ export interface SandboxProvider {
     getAdditionalInstructions(): string | undefined;
     /** Directory inside the sandbox where large tool responses are dumped. */
     getToolResultDumpDir(sandboxId: string): string;
-    /** Absolute path for the git credential-store file (per logical sandbox when sharing a pod). */
+    /**
+     * Git credential-store file (absolute, or cwd-relative when exec cwd is the jail).
+     * `GIT_CONFIG` `store --file` is relative to the git process cwd — providers that
+     * return a relative path must make it absolute in their own `exec`.
+     */
     getGitCredentialsPath(sandboxId: string): string;
+    /** Directory for user-uploaded files (absolute, or cwd-relative when the provider has no global FS). */
+    getFileUploadsDir(sandboxId: string): string;
+    /** Directory where git skills are materialized. */
+    getSkillsDir(sandboxId: string): string;
+    /** Path the git skill downloader script is written to before it runs. */
+    getGitDownloaderPath(sandboxId: string): string;
     /** Downloads a file from the sandbox as a Buffer. Throws SandboxFileNotFoundError / SandboxNotAvailableError / SandboxPathIsDirectoryError / SandboxFileTooLargeError. */
     downloadFile(params: {
         sandboxId: string;

package/dist/core/sandbox/provider/Provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Provider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/Provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,eAAe,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAO1D;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAGD,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,qFAAqF;IACrF,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,0EAA0E;IAC1E,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAAC;IAChD,0EAA0E;IAC1E,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD,gGAAgG;IAChG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,0KAA0K;IAC1K,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,qCAAqC;IACrC,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9F;;;OAGG;IACH,uBAAuB,IAAI,iBAAiB,CAAC;CAC9C"}
+{"version":3,"file":"Provider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/Provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,eAAe,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAO1D;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAGD,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,qFAAqF;IACrF,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,0EAA0E;IAC1E,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAAC;IAChD,0EAA0E;IAC1E,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,wGAAwG;IACxG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7C,mDAAmD;IACnD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,yEAAyE;IACzE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD,0KAA0K;IAC1K,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,qCAAqC;IACrC,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9F;;;OAGG;IACH,uBAAuB,IAAI,iBAAiB,CAAC;CAC9C"}

package/dist/core/sandbox/provider/Provider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/provider/Provider.ts"],"sourcesContent":["import type { CodeModeTransport } from '../codeMode/CodeModeTransport';\n\n/** Command executed in sandbox — exitCode may be non-zero but the infra call succeeded. */\nexport interface ExecSuccessResult {\n  success: true;\n  response: { exitCode: number; result: string };\n}\n\n/** Sandbox infrastructure failure — command never ran (e.g. network error, auth failure). */\nexport interface ExecErrorResult {\n  success: false;\n  error: string;\n}\n\nexport type ExecResult = ExecSuccessResult | ExecErrorResult;\n\n/**\n * Wraps a value in single quotes for safe use in a shell command. Inner single quotes are\n * escaped via the standard shell idiom: ' -> '\\''. Use for any user-controlled value that is\n * interpolated into an exec command string.\n */\nexport function shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Throws if the exec result indicates failure (infra error or non-zero exit code). */\nexport function ensureExecSuccess(result: ExecResult): void {\n  if (!result.success) {\n    throw new Error(result.error);\n  }\n  if (result.response.exitCode !== 0) {\n    throw new Error(`(exit code ${String(result.response.exitCode)}): ${result.response.result}`);\n  }\n}\n\nexport interface SandboxFileInfo {\n  size: number;\n  isDir: boolean;\n}\n\n/** Parameters for a single sandbox command. */\nexport interface SandboxExecParams {\n  sandboxId: string;\n  command: string;\n  cwd?: string | undefined;\n  env?: Record<string, string> | undefined;\n  /** Overrides the provider's default exec timeout (e.g. for long skill downloads). */\n  timeoutSeconds?: number | undefined;\n}\n\n// An init command a producer (e.g. a skill mounter) hands to the Sandbox, which supplies `sandboxId`.\nexport type SandboxInit = Omit<SandboxExecParams, 'sandboxId'>;\n\nexport type SandboxBuildStatus = 'pending' | 'ready' | 'failed';\n\n/** Provider-specific opaque build metadata (string map). */\nexport type SandboxBuildMetadata = Record<string, string>;\n\nexport interface SandboxBuild {\n  status: SandboxBuildStatus;\n  /** Human-readable detail for the current status (shown to the user); null when ready. */\n  reason: string | null;\n  /** Provider-specific build details; null when the provider has none. */\n  metadata: SandboxBuildMetadata | null;\n}\n\nexport interface SandboxProvider {\n  /**\n   * Ensures the release image is being built into the provider's backing store and\n   * returns its current status. Idempotent: an already-built image reports `ready`;\n   * a fresh build starts in the background and reports `pending`.\n   */\n  buildImage(): Promise<SandboxBuild>;\n  /** Current build status of the release image. Read-only: never kicks off a build. */\n  getImageBuildStatus(): Promise<SandboxBuild>;\n  createSandbox(): Promise<{ sandboxId: string }>;\n  exec(params: SandboxExecParams): Promise<ExecResult>;\n  /** Provider-specific instructions appended to the agent system prompt. */\n  getAdditionalInstructions(): string | undefined;\n  /** Directory inside the sandbox where large tool responses are dumped. */\n  getToolResultDumpDir(sandboxId: string): string;\n  /** Absolute path for the git credential-store file (per logical sandbox when sharing a pod). */\n  getGitCredentialsPath(sandboxId: string): string;\n  /** Downloads a file from the sandbox as a Buffer. Throws SandboxFileNotFoundError / SandboxNotAvailableError / SandboxPathIsDirectoryError / SandboxFileTooLargeError. */\n  downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer>;\n  /** Uploads a file to the sandbox. */\n  uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void>;\n\n  /**\n   * Construct a Code Mode transport for this provider (no connect/listen yet).\n   * Throws if the provider does not support Code Mode.\n   */\n  createCodeModeTransport(): CodeModeTransport;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBO,SAAS,YAAY,OAAuB;AACjD,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGO,SAAS,kBAAkB,QAA0B;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,SAAS,aAAa,GAAG;AAClC,UAAM,IAAI,MAAM,cAAc,OAAO,OAAO,SAAS,QAAQ,CAAC,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA,EAC9F;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/core/sandbox/provider/Provider.ts"],"sourcesContent":["import type { CodeModeTransport } from '../codeMode/CodeModeTransport';\n\n/** Command executed in sandbox — exitCode may be non-zero but the infra call succeeded. */\nexport interface ExecSuccessResult {\n  success: true;\n  response: { exitCode: number; result: string };\n}\n\n/** Sandbox infrastructure failure — command never ran (e.g. network error, auth failure). */\nexport interface ExecErrorResult {\n  success: false;\n  error: string;\n}\n\nexport type ExecResult = ExecSuccessResult | ExecErrorResult;\n\n/**\n * Wraps a value in single quotes for safe use in a shell command. Inner single quotes are\n * escaped via the standard shell idiom: ' -> '\\''. Use for any user-controlled value that is\n * interpolated into an exec command string.\n */\nexport function shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Throws if the exec result indicates failure (infra error or non-zero exit code). */\nexport function ensureExecSuccess(result: ExecResult): void {\n  if (!result.success) {\n    throw new Error(result.error);\n  }\n  if (result.response.exitCode !== 0) {\n    throw new Error(`(exit code ${String(result.response.exitCode)}): ${result.response.result}`);\n  }\n}\n\nexport interface SandboxFileInfo {\n  size: number;\n  isDir: boolean;\n}\n\n/** Parameters for a single sandbox command. */\nexport interface SandboxExecParams {\n  sandboxId: string;\n  command: string;\n  cwd?: string | undefined;\n  env?: Record<string, string> | undefined;\n  /** Overrides the provider's default exec timeout (e.g. for long skill downloads). */\n  timeoutSeconds?: number | undefined;\n}\n\n// An init command a producer (e.g. a skill mounter) hands to the Sandbox, which supplies `sandboxId`.\nexport type SandboxInit = Omit<SandboxExecParams, 'sandboxId'>;\n\nexport type SandboxBuildStatus = 'pending' | 'ready' | 'failed';\n\n/** Provider-specific opaque build metadata (string map). */\nexport type SandboxBuildMetadata = Record<string, string>;\n\nexport interface SandboxBuild {\n  status: SandboxBuildStatus;\n  /** Human-readable detail for the current status (shown to the user); null when ready. */\n  reason: string | null;\n  /** Provider-specific build details; null when the provider has none. */\n  metadata: SandboxBuildMetadata | null;\n}\n\nexport interface SandboxProvider {\n  /** Stable provider kind used in fancy sandbox ids and carry-forward (plain string). */\n  readonly type: string;\n  /**\n   * Ensures the release image is being built into the provider's backing store and\n   * returns its current status. Idempotent: an already-built image reports `ready`;\n   * a fresh build starts in the background and reports `pending`.\n   */\n  buildImage(): Promise<SandboxBuild>;\n  /** Current build status of the release image. Read-only: never kicks off a build. */\n  getImageBuildStatus(): Promise<SandboxBuild>;\n  createSandbox(): Promise<{ sandboxId: string }>;\n  exec(params: SandboxExecParams): Promise<ExecResult>;\n  /** Provider-specific instructions appended to the agent system prompt. */\n  getAdditionalInstructions(): string | undefined;\n  /** Directory inside the sandbox where large tool responses are dumped. */\n  getToolResultDumpDir(sandboxId: string): string;\n  /**\n   * Git credential-store file (absolute, or cwd-relative when exec cwd is the jail).\n   * `GIT_CONFIG` `store --file` is relative to the git process cwd — providers that\n   * return a relative path must make it absolute in their own `exec`.\n   */\n  getGitCredentialsPath(sandboxId: string): string;\n  /** Directory for user-uploaded files (absolute, or cwd-relative when the provider has no global FS). */\n  getFileUploadsDir(sandboxId: string): string;\n  /** Directory where git skills are materialized. */\n  getSkillsDir(sandboxId: string): string;\n  /** Path the git skill downloader script is written to before it runs. */\n  getGitDownloaderPath(sandboxId: string): string;\n  /** Downloads a file from the sandbox as a Buffer. Throws SandboxFileNotFoundError / SandboxNotAvailableError / SandboxPathIsDirectoryError / SandboxFileTooLargeError. */\n  downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer>;\n  /** Uploads a file to the sandbox. */\n  uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void>;\n\n  /**\n   * Construct a Code Mode transport for this provider (no connect/listen yet).\n   * Throws if the provider does not support Code Mode.\n   */\n  createCodeModeTransport(): CodeModeTransport;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBO,SAAS,YAAY,OAAuB;AACjD,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGO,SAAS,kBAAkB,QAA0B;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,SAAS,aAAa,GAAG;AAClC,UAAM,IAAI,MAAM,cAAc,OAAO,OAAO,SAAS,QAAQ,CAAC,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA,EAC9F;AACF;","names":[]}

package/dist/core/sandbox/provider/Provider.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/provider/Provider.ts"],"sourcesContent":["import type { CodeModeTransport } from '../codeMode/CodeModeTransport';\n\n/** Command executed in sandbox — exitCode may be non-zero but the infra call succeeded. */\nexport interface ExecSuccessResult {\n  success: true;\n  response: { exitCode: number; result: string };\n}\n\n/** Sandbox infrastructure failure — command never ran (e.g. network error, auth failure). */\nexport interface ExecErrorResult {\n  success: false;\n  error: string;\n}\n\nexport type ExecResult = ExecSuccessResult | ExecErrorResult;\n\n/**\n * Wraps a value in single quotes for safe use in a shell command. Inner single quotes are\n * escaped via the standard shell idiom: ' -> '\\''. Use for any user-controlled value that is\n * interpolated into an exec command string.\n */\nexport function shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Throws if the exec result indicates failure (infra error or non-zero exit code). */\nexport function ensureExecSuccess(result: ExecResult): void {\n  if (!result.success) {\n    throw new Error(result.error);\n  }\n  if (result.response.exitCode !== 0) {\n    throw new Error(`(exit code ${String(result.response.exitCode)}): ${result.response.result}`);\n  }\n}\n\nexport interface SandboxFileInfo {\n  size: number;\n  isDir: boolean;\n}\n\n/** Parameters for a single sandbox command. */\nexport interface SandboxExecParams {\n  sandboxId: string;\n  command: string;\n  cwd?: string | undefined;\n  env?: Record<string, string> | undefined;\n  /** Overrides the provider's default exec timeout (e.g. for long skill downloads). */\n  timeoutSeconds?: number | undefined;\n}\n\n// An init command a producer (e.g. a skill mounter) hands to the Sandbox, which supplies `sandboxId`.\nexport type SandboxInit = Omit<SandboxExecParams, 'sandboxId'>;\n\nexport type SandboxBuildStatus = 'pending' | 'ready' | 'failed';\n\n/** Provider-specific opaque build metadata (string map). */\nexport type SandboxBuildMetadata = Record<string, string>;\n\nexport interface SandboxBuild {\n  status: SandboxBuildStatus;\n  /** Human-readable detail for the current status (shown to the user); null when ready. */\n  reason: string | null;\n  /** Provider-specific build details; null when the provider has none. */\n  metadata: SandboxBuildMetadata | null;\n}\n\nexport interface SandboxProvider {\n  /**\n   * Ensures the release image is being built into the provider's backing store and\n   * returns its current status. Idempotent: an already-built image reports `ready`;\n   * a fresh build starts in the background and reports `pending`.\n   */\n  buildImage(): Promise<SandboxBuild>;\n  /** Current build status of the release image. Read-only: never kicks off a build. */\n  getImageBuildStatus(): Promise<SandboxBuild>;\n  createSandbox(): Promise<{ sandboxId: string }>;\n  exec(params: SandboxExecParams): Promise<ExecResult>;\n  /** Provider-specific instructions appended to the agent system prompt. */\n  getAdditionalInstructions(): string | undefined;\n  /** Directory inside the sandbox where large tool responses are dumped. */\n  getToolResultDumpDir(sandboxId: string): string;\n  /** Absolute path for the git credential-store file (per logical sandbox when sharing a pod). */\n  getGitCredentialsPath(sandboxId: string): string;\n  /** Downloads a file from the sandbox as a Buffer. Throws SandboxFileNotFoundError / SandboxNotAvailableError / SandboxPathIsDirectoryError / SandboxFileTooLargeError. */\n  downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer>;\n  /** Uploads a file to the sandbox. */\n  uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void>;\n\n  /**\n   * Construct a Code Mode transport for this provider (no connect/listen yet).\n   * Throws if the provider does not support Code Mode.\n   */\n  createCodeModeTransport(): CodeModeTransport;\n}\n"],"mappings":";AAqBO,SAAS,YAAY,OAAuB;AACjD,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGO,SAAS,kBAAkB,QAA0B;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,SAAS,aAAa,GAAG;AAClC,UAAM,IAAI,MAAM,cAAc,OAAO,OAAO,SAAS,QAAQ,CAAC,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA,EAC9F;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/core/sandbox/provider/Provider.ts"],"sourcesContent":["import type { CodeModeTransport } from '../codeMode/CodeModeTransport';\n\n/** Command executed in sandbox — exitCode may be non-zero but the infra call succeeded. */\nexport interface ExecSuccessResult {\n  success: true;\n  response: { exitCode: number; result: string };\n}\n\n/** Sandbox infrastructure failure — command never ran (e.g. network error, auth failure). */\nexport interface ExecErrorResult {\n  success: false;\n  error: string;\n}\n\nexport type ExecResult = ExecSuccessResult | ExecErrorResult;\n\n/**\n * Wraps a value in single quotes for safe use in a shell command. Inner single quotes are\n * escaped via the standard shell idiom: ' -> '\\''. Use for any user-controlled value that is\n * interpolated into an exec command string.\n */\nexport function shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Throws if the exec result indicates failure (infra error or non-zero exit code). */\nexport function ensureExecSuccess(result: ExecResult): void {\n  if (!result.success) {\n    throw new Error(result.error);\n  }\n  if (result.response.exitCode !== 0) {\n    throw new Error(`(exit code ${String(result.response.exitCode)}): ${result.response.result}`);\n  }\n}\n\nexport interface SandboxFileInfo {\n  size: number;\n  isDir: boolean;\n}\n\n/** Parameters for a single sandbox command. */\nexport interface SandboxExecParams {\n  sandboxId: string;\n  command: string;\n  cwd?: string | undefined;\n  env?: Record<string, string> | undefined;\n  /** Overrides the provider's default exec timeout (e.g. for long skill downloads). */\n  timeoutSeconds?: number | undefined;\n}\n\n// An init command a producer (e.g. a skill mounter) hands to the Sandbox, which supplies `sandboxId`.\nexport type SandboxInit = Omit<SandboxExecParams, 'sandboxId'>;\n\nexport type SandboxBuildStatus = 'pending' | 'ready' | 'failed';\n\n/** Provider-specific opaque build metadata (string map). */\nexport type SandboxBuildMetadata = Record<string, string>;\n\nexport interface SandboxBuild {\n  status: SandboxBuildStatus;\n  /** Human-readable detail for the current status (shown to the user); null when ready. */\n  reason: string | null;\n  /** Provider-specific build details; null when the provider has none. */\n  metadata: SandboxBuildMetadata | null;\n}\n\nexport interface SandboxProvider {\n  /** Stable provider kind used in fancy sandbox ids and carry-forward (plain string). */\n  readonly type: string;\n  /**\n   * Ensures the release image is being built into the provider's backing store and\n   * returns its current status. Idempotent: an already-built image reports `ready`;\n   * a fresh build starts in the background and reports `pending`.\n   */\n  buildImage(): Promise<SandboxBuild>;\n  /** Current build status of the release image. Read-only: never kicks off a build. */\n  getImageBuildStatus(): Promise<SandboxBuild>;\n  createSandbox(): Promise<{ sandboxId: string }>;\n  exec(params: SandboxExecParams): Promise<ExecResult>;\n  /** Provider-specific instructions appended to the agent system prompt. */\n  getAdditionalInstructions(): string | undefined;\n  /** Directory inside the sandbox where large tool responses are dumped. */\n  getToolResultDumpDir(sandboxId: string): string;\n  /**\n   * Git credential-store file (absolute, or cwd-relative when exec cwd is the jail).\n   * `GIT_CONFIG` `store --file` is relative to the git process cwd — providers that\n   * return a relative path must make it absolute in their own `exec`.\n   */\n  getGitCredentialsPath(sandboxId: string): string;\n  /** Directory for user-uploaded files (absolute, or cwd-relative when the provider has no global FS). */\n  getFileUploadsDir(sandboxId: string): string;\n  /** Directory where git skills are materialized. */\n  getSkillsDir(sandboxId: string): string;\n  /** Path the git skill downloader script is written to before it runs. */\n  getGitDownloaderPath(sandboxId: string): string;\n  /** Downloads a file from the sandbox as a Buffer. Throws SandboxFileNotFoundError / SandboxNotAvailableError / SandboxPathIsDirectoryError / SandboxFileTooLargeError. */\n  downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer>;\n  /** Uploads a file to the sandbox. */\n  uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void>;\n\n  /**\n   * Construct a Code Mode transport for this provider (no connect/listen yet).\n   * Throws if the provider does not support Code Mode.\n   */\n  createCodeModeTransport(): CodeModeTransport;\n}\n"],"mappings":";AAqBO,SAAS,YAAY,OAAuB;AACjD,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGO,SAAS,kBAAkB,QAA0B;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,SAAS,aAAa,GAAG;AAClC,UAAM,IAAI,MAAM,cAAc,OAAO,OAAO,SAAS,QAAQ,CAAC,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA,EAC9F;AACF;","names":[]}

package/dist/core/sandbox/provider/TFYSandboxProvider.d.ts

@@ -1,6 +1,8 @@
 import type { Logger } from 'winston';
 import type { CodeModeTransport } from '../codeMode/CodeModeTransport';
 import { type ExecResult, type SandboxBuild, type SandboxExecParams, type SandboxProvider } from './Provider';
+/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). */
+export declare function withMcpClientOnPath(path: string): string;
 export interface TFYSandboxProviderOptions {
     serverUrl: string;
     natsBridgeUrl: string;
@@ -10,12 +12,15 @@ export interface TFYSandboxProviderOptions {
     logger: Logger;
 }
 export declare class TFYSandboxProvider implements SandboxProvider {
+    readonly type = "tfy";
     private readonly serverUrl;
     private readonly natsBridgeUrl;
     private readonly tenantName;
     private readonly fileMaxBytesForDownload;
     private readonly defaultExecTimeoutSeconds;
     private readonly logger;
+    /** Discovered via `pwd` + `$PATH` — never a hardcoded host layout. */
+    private readonly sandboxLayouts;
     constructor(options: TFYSandboxProviderOptions);
     private static readonly readyBuild;
     buildImage(): Promise<SandboxBuild>;
@@ -23,7 +28,14 @@ export declare class TFYSandboxProvider implements SandboxProvider {
     createSandbox(): Promise<{
         sandboxId: string;
     }>;
+    /**
+     * No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative
+     * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so
+     * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.
+     */
     exec(params: SandboxExecParams): Promise<ExecResult>;
+    private sandboxLayout;
+    private postExec;
     private getFileInfo;
     downloadFile(params: {
         sandboxId: string;
@@ -36,7 +48,10 @@ export declare class TFYSandboxProvider implements SandboxProvider {
     }): Promise<void>;
     createCodeModeTransport(): CodeModeTransport;
     getAdditionalInstructions(): string;
-    getToolResultDumpDir(sandboxId: string): string;
-    getGitCredentialsPath(sandboxId: string): string;
+    getToolResultDumpDir(): string;
+    getGitCredentialsPath(): string;
+    getFileUploadsDir(): string;
+    getSkillsDir(): string;
+    getGitDownloaderPath(): string;
 }
 //# sourceMappingURL=TFYSandboxProvider.d.ts.map

package/dist/core/sandbox/provider/TFYSandboxProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TFYSandboxProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAYpB,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,OAAO,EAAE,yBAAyB,EAO7C;IAGD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAIhC;IAEF,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAElC;IAED,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAI9C;IAEK,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA+CzD;YAEa,WAAW;IAiBnB,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB/E;IAEK,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASlG;IAGD,uBAAuB,IAAI,iBAAiB,CAM3C;IAED,yBAAyB,IAAI,MAAM,CAOlC;IAED,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9C;IAED,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/C;CACF"}
+{"version":3,"file":"TFYSandboxProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAUvE,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAQpB,4GAA4G;AAC5G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxD;AAWD,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8D;IAE7F,YAAY,OAAO,EAAE,yBAAyB,EAO7C;IAGD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAIhC;IAEF,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAElC;IAED,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAI9C;IAED;;;;OAIG;IACG,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CASzD;YAEa,aAAa;YAoBb,QAAQ;YAiDR,WAAW;IAiBnB,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB/E;IAEK,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASlG;IAGD,uBAAuB,IAAI,iBAAiB,CAO3C;IAED,yBAAyB,IAAI,MAAM,CAOlC;IAKD,oBAAoB,IAAI,MAAM,CAE7B;IAED,qBAAqB,IAAI,MAAM,CAE9B;IAED,iBAAiB,IAAI,MAAM,CAE1B;IAED,YAAY,IAAI,MAAM,CAErB;IAED,oBAAoB,IAAI,MAAM,CAE7B;CACF"}

package/dist/core/sandbox/provider/TFYSandboxProvider.js

@@ -30,30 +30,46 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/core/sandbox/provider/TFYSandboxProvider.ts
 var TFYSandboxProvider_exports = {};
 __export(TFYSandboxProvider_exports, {
-  TFYSandboxProvider: () => TFYSandboxProvider
+  TFYSandboxProvider: () => TFYSandboxProvider,
+  withMcpClientOnPath: () => withMcpClientOnPath
 });
 module.exports = __toCommonJS(TFYSandboxProvider_exports);
 var import_api = require("@opentelemetry/api");
 var import_core = require("@opentelemetry/core");
-var import_crypto = require("crypto");
 var import_dedent = __toESM(require("dedent"), 1);
+var import_node_crypto = require("crypto");
+var import_posix = require("path/posix");
 var import_errorLogFields = require("../../util/errorLogFields.js");
 var import_CodeModeNatsTransport = require("../codeMode/nats/CodeModeNatsTransport.js");
 var import_constants = require("../constants.js");
 var import_SandboxErrors = require("../SandboxErrors.js");
+var import_execEnv = require("./execEnv.js");
 var import_Provider = require("./Provider.js");
 var DEFAULT_TIMEOUT_SECONDS = 60;
 var CLIENT_TIMEOUT_BUFFER_SECONDS = 5;
-function shellEscape(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
+var TFY_MCP_CLIENT_BIN = "mcp-client/bin";
+function withMcpClientOnPath(path) {
+  const rest = path.split(":").filter((part) => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);
+  return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(":")}`;
+}
+function parsePwdAndPath(text) {
+  const lines = text.replace(/\r\n/g, "\n").split("\n");
+  const root = lines[0];
+  if (!root?.startsWith("/")) {
+    return void 0;
+  }
+  return { root, inheritedPath: lines[1] ?? "" };
 }
 var TFYSandboxProvider = class _TFYSandboxProvider {
+  type = "tfy";
   serverUrl;
   natsBridgeUrl;
   tenantName;
   fileMaxBytesForDownload;
   defaultExecTimeoutSeconds;
   logger;
+  /** Discovered via `pwd` + `$PATH` — never a hardcoded host layout. */
+  sandboxLayouts = /* @__PURE__ */ new Map();
   constructor(options) {
     this.serverUrl = options.serverUrl.replace(/\/+$/, "");
     this.natsBridgeUrl = options.natsBridgeUrl;
@@ -75,11 +91,45 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     return Promise.resolve(_TFYSandboxProvider.readyBuild);
   }
   createSandbox() {
-    const sandboxId = `${this.tenantName}.${(0, import_crypto.randomUUID)()}`;
+    const sandboxId = `${this.tenantName}.${(0, import_node_crypto.randomUUID)()}`;
     this.logger.debug(`Sandbox created: id=${sandboxId}`);
     return Promise.resolve({ sandboxId });
   }
+  /**
+   * No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative
+   * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so
+   * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.
+   */
   async exec(params) {
+    (0, import_SandboxErrors.validateSandboxOwnedByTenant)({ sandboxId: params.sandboxId, tenantName: this.tenantName });
+    const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);
+    const incoming = params.env ?? {};
+    const env = (0, import_execEnv.absolutizeRelativeExecEnv)({
+      root,
+      env: { ...incoming, PATH: withMcpClientOnPath(incoming["PATH"] ?? inheritedPath) }
+    });
+    return this.postExec({ ...params, env });
+  }
+  async sandboxLayout(sandboxId) {
+    const cached = this.sandboxLayouts.get(sandboxId);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const result = await this.postExec({
+      sandboxId,
+      command: `printf '%s\\n%s\\n' "$(pwd)" "$PATH"`
+    });
+    if (!result.success) {
+      throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);
+    }
+    const parsed = parsePwdAndPath(result.response.result);
+    if (parsed === void 0) {
+      throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);
+    }
+    this.sandboxLayouts.set(sandboxId, parsed);
+    return parsed;
+  }
+  async postExec(params) {
     return import_api.context.with((0, import_core.suppressTracing)(import_api.context.active()), async () => {
       const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;
       const body = {
@@ -124,7 +174,7 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
   async getFileInfo(params) {
     const result = await this.exec({
       sandboxId: params.sandboxId,
-      command: `stat -L --printf='{"size":%s,"type":"%F"}' ${shellEscape(params.path)}`
+      command: `stat -L --printf='{"size":%s,"type":"%F"}' ${(0, import_Provider.shellEscape)(params.path)}`
     });
     if (!result.success) {
       throw new Error(`Failed to stat file: ${result.error}`);
@@ -145,7 +195,7 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     }
     const result = await this.exec({
       sandboxId: params.sandboxId,
-      command: `base64 -w0 ${shellEscape(params.path)}`
+      command: `base64 -w0 ${(0, import_Provider.shellEscape)(params.path)}`
     });
     if (!result.success) {
       throw new Error(`Failed to download file: ${result.error}`);
@@ -157,10 +207,10 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
   }
   async uploadFile(params) {
     const encoded = params.content.toString("base64");
-    const escapedPath = shellEscape(params.remotePath);
+    const escapedPath = (0, import_Provider.shellEscape)(params.remotePath);
     const result = await this.exec({
       sandboxId: params.sandboxId,
-      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`
+      command: `echo ${(0, import_Provider.shellEscape)(encoded)} | base64 -d > ${escapedPath}`
     });
     (0, import_Provider.ensureExecSuccess)(result);
   }
@@ -169,26 +219,40 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     return new import_CodeModeNatsTransport.CodeModeNatsTransport({
       resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),
       sandboxClientNatsUrl: `ws://localhost:${String(import_constants.DEFAULT_SANDBOX_NATS_WS_PORT)}`,
-      logger: this.logger
+      logger: this.logger,
+      mcpClientInstall: { remotePath: (0, import_posix.join)("mcp-client", "mcp_client.py") }
     });
   }
   getAdditionalInstructions() {
     return import_dedent.default`
     SANDBOX RULES:
-    - The Agent's first sandbox command should be \`pwd\` to discover the working directory.
-    - ALL file creation and writes MUST stay within that working directory.
+    - uploads, skills, and tool-results live in the sandbox working directory (not /tmp or /opt).
+    - ALL file creation and writes MUST stay within the sandbox working directory.
     - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.
   `;
   }
-  getToolResultDumpDir(sandboxId) {
-    return `/tmp/${sandboxId}/tool-results`;
+  // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.
+  //   uploads, skills, tool-results, git_downloader.py, .git-credentials
+  //   mcp-client/mcp_client.py  (no /usr/local/bin symlink)
+  getToolResultDumpDir() {
+    return "tool-results";
+  }
+  getGitCredentialsPath() {
+    return ".git-credentials";
+  }
+  getFileUploadsDir() {
+    return "uploads";
+  }
+  getSkillsDir() {
+    return "skills";
   }
-  getGitCredentialsPath(sandboxId) {
-    return `/tmp/${sandboxId}/.git-credentials`;
+  getGitDownloaderPath() {
+    return "git_downloader.py";
   }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  TFYSandboxProvider
+  TFYSandboxProvider,
+  withMcpClientOnPath
 });
 //# sourceMappingURL=TFYSandboxProvider.js.map

package/dist/core/sandbox/provider/TFYSandboxProvider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'crypto';\nimport dedent from 'dedent';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport { SandboxFileNotFoundError, SandboxFileTooLargeError, SandboxPathIsDirectoryError } from '../SandboxErrors';\nimport {\n  ensureExecSuccess,\n  type ExecResult,\n  type SandboxBuild,\n  type SandboxExecParams,\n  type SandboxFileInfo,\n  type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\n// Wraps a value in single quotes for safe use in shell commands.\n// Inner single quotes are escaped via the standard shell idiom: ' → '\\''\nfunction shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nexport interface TFYSandboxProviderOptions {\n  serverUrl: string;\n  natsBridgeUrl: string;\n  tenantName: string;\n  fileMaxBytesForDownload: number;\n  defaultExecTimeoutMs?: number | undefined;\n  logger: Logger;\n}\n\ninterface StatResult {\n  size: number;\n  type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n  private readonly serverUrl: string;\n  private readonly natsBridgeUrl: string;\n  private readonly tenantName: string;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly defaultExecTimeoutSeconds: number;\n  private readonly logger: Logger;\n\n  constructor(options: TFYSandboxProviderOptions) {\n    this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n    this.natsBridgeUrl = options.natsBridgeUrl;\n    this.tenantName = options.tenantName;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS * 1000) / 1000);\n    this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n  }\n\n  // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n  private static readonly readyBuild: SandboxBuild = {\n    status: 'ready',\n    reason: null,\n    metadata: null,\n  };\n\n  buildImage(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  getImageBuildStatus(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  createSandbox(): Promise<{ sandboxId: string }> {\n    const sandboxId = `${this.tenantName}.${randomUUID()}`;\n    this.logger.debug(`Sandbox created: id=${sandboxId}`);\n    return Promise.resolve({ sandboxId });\n  }\n\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n      // request timeout and the client abort timer; fall back to the provider default otherwise.\n      const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n      const body = {\n        sandbox_id: params.sandboxId,\n        command: params.command,\n        cwd: params.cwd,\n        env: params.env,\n        timeout: timeoutSeconds,\n      };\n\n      const controller = new AbortController();\n      const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) * 1000;\n      const timer = setTimeout(() => {\n        controller.abort();\n      }, clientTimeoutMs);\n\n      try {\n        const response = await fetch(`${this.serverUrl}/exec`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(body),\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          const text = await response.text();\n          this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n          return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n        }\n\n        const result = (await response.json()) as ExecResult;\n        return result;\n      } catch (e: unknown) {\n        if (e instanceof Error && e.name === 'AbortError') {\n          this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n          return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n        }\n        this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      } finally {\n        clearTimeout(timer);\n      }\n    });\n  }\n\n  private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to stat file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    const parsed = JSON.parse(result.response.result) as StatResult;\n    return { size: parsed.size, isDir: parsed.type === 'directory' };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    const info = await this.getFileInfo(params);\n    if (info.isDir) {\n      throw new SandboxPathIsDirectoryError(params.path);\n    }\n    if (info.size > this.fileMaxBytesForDownload) {\n      throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n    }\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `base64 -w0 ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to download file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    return Buffer.from(result.response.result.trim(), 'base64');\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    const encoded = params.content.toString('base64');\n    const escapedPath = shellEscape(params.remotePath);\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`,\n    });\n    ensureExecSuccess(result);\n  }\n\n  // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n      sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n      logger: this.logger,\n    });\n  }\n\n  getAdditionalInstructions(): string {\n    return dedent`\n    SANDBOX RULES:\n    - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n    - ALL file creation and writes MUST stay within that working directory.\n    - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n  `;\n  }\n\n  getToolResultDumpDir(sandboxId: string): string {\n    return `/tmp/${sandboxId}/tool-results`;\n  }\n\n  getGitCredentialsPath(sandboxId: string): string {\n    return `/tmp/${sandboxId}/.git-credentials`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAwB;AACxB,kBAAgC;AAChC,oBAA2B;AAC3B,oBAAmB;AAEnB,4BAAsC;AAEtC,mCAAsC;AACtC,uBAA6C;AAC7C,2BAAgG;AAChG,sBAOO;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAItC,SAAS,YAAY,OAAuB;AAC1C,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,QAAI,0BAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,QAAgD;AACzD,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,SAAK,6CAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,2BAAuB,6CAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,8CAA8C,YAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,cAAc,YAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,cAAc,YAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,QAAQ,YAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,2CAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,6CAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO,cAAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT;AAAA,EAEA,qBAAqB,WAA2B;AAC9C,WAAO,QAAQ,SAAS;AAAA,EAC1B;AAAA,EAEA,sBAAsB,WAA2B;AAC/C,WAAO,QAAQ,SAAS;AAAA,EAC1B;AACF;","names":["dedent"]}
+{"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n  SandboxFileNotFoundError,\n  SandboxFileTooLargeError,\n  SandboxPathIsDirectoryError,\n  validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n  ensureExecSuccess,\n  shellEscape,\n  type ExecResult,\n  type SandboxBuild,\n  type SandboxExecParams,\n  type SandboxFileInfo,\n  type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). */\nexport function withMcpClientOnPath(path: string): string {\n  const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n  return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } | undefined {\n  const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n  const root = lines[0];\n  if (!root?.startsWith('/')) {\n    return undefined;\n  }\n  return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n  serverUrl: string;\n  natsBridgeUrl: string;\n  tenantName: string;\n  fileMaxBytesForDownload: number;\n  defaultExecTimeoutMs?: number | undefined;\n  logger: Logger;\n}\n\ninterface StatResult {\n  size: number;\n  type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n  readonly type = 'tfy';\n  private readonly serverUrl: string;\n  private readonly natsBridgeUrl: string;\n  private readonly tenantName: string;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly defaultExecTimeoutSeconds: number;\n  private readonly logger: Logger;\n  /** Discovered via `pwd` + `$PATH` — never a hardcoded host layout. */\n  private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n  constructor(options: TFYSandboxProviderOptions) {\n    this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n    this.natsBridgeUrl = options.natsBridgeUrl;\n    this.tenantName = options.tenantName;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS * 1000) / 1000);\n    this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n  }\n\n  // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n  private static readonly readyBuild: SandboxBuild = {\n    status: 'ready',\n    reason: null,\n    metadata: null,\n  };\n\n  buildImage(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  getImageBuildStatus(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  createSandbox(): Promise<{ sandboxId: string }> {\n    const sandboxId = `${this.tenantName}.${randomUUID()}`;\n    this.logger.debug(`Sandbox created: id=${sandboxId}`);\n    return Promise.resolve({ sandboxId });\n  }\n\n  /**\n   * No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n   * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n   * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n   */\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n    const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n    const incoming = params.env ?? {};\n    const env = absolutizeRelativeExecEnv({\n      root,\n      env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n    });\n    return this.postExec({ ...params, env });\n  }\n\n  private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n    const cached = this.sandboxLayouts.get(sandboxId);\n    if (cached !== undefined) {\n      return cached;\n    }\n    const result = await this.postExec({\n      sandboxId,\n      command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n    });\n    if (!result.success) {\n      throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n    }\n    const parsed = parsePwdAndPath(result.response.result);\n    if (parsed === undefined) {\n      throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n    }\n    this.sandboxLayouts.set(sandboxId, parsed);\n    return parsed;\n  }\n\n  private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n      // request timeout and the client abort timer; fall back to the provider default otherwise.\n      const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n      const body = {\n        sandbox_id: params.sandboxId,\n        command: params.command,\n        cwd: params.cwd,\n        env: params.env,\n        timeout: timeoutSeconds,\n      };\n\n      const controller = new AbortController();\n      const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) * 1000;\n      const timer = setTimeout(() => {\n        controller.abort();\n      }, clientTimeoutMs);\n\n      try {\n        const response = await fetch(`${this.serverUrl}/exec`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(body),\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          const text = await response.text();\n          this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n          return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n        }\n\n        const result = (await response.json()) as ExecResult;\n        return result;\n      } catch (e: unknown) {\n        if (e instanceof Error && e.name === 'AbortError') {\n          this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n          return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n        }\n        this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      } finally {\n        clearTimeout(timer);\n      }\n    });\n  }\n\n  private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to stat file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    const parsed = JSON.parse(result.response.result) as StatResult;\n    return { size: parsed.size, isDir: parsed.type === 'directory' };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    const info = await this.getFileInfo(params);\n    if (info.isDir) {\n      throw new SandboxPathIsDirectoryError(params.path);\n    }\n    if (info.size > this.fileMaxBytesForDownload) {\n      throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n    }\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `base64 -w0 ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to download file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    return Buffer.from(result.response.result.trim(), 'base64');\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    const encoded = params.content.toString('base64');\n    const escapedPath = shellEscape(params.remotePath);\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`,\n    });\n    ensureExecSuccess(result);\n  }\n\n  // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n      sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n      logger: this.logger,\n      mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n    });\n  }\n\n  getAdditionalInstructions(): string {\n    return dedent`\n    SANDBOX RULES:\n    - uploads, skills, and tool-results live in the sandbox working directory (not /tmp or /opt).\n    - ALL file creation and writes MUST stay within the sandbox working directory.\n    - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n  `;\n  }\n\n  // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n  //   uploads, skills, tool-results, git_downloader.py, .git-credentials\n  //   mcp-client/mcp_client.py  (no /usr/local/bin symlink)\n  getToolResultDumpDir(): string {\n    return 'tool-results';\n  }\n\n  getGitCredentialsPath(): string {\n    return '.git-credentials';\n  }\n\n  getFileUploadsDir(): string {\n    return 'uploads';\n  }\n\n  getSkillsDir(): string {\n    return 'skills';\n  }\n\n  getGitDownloaderPath(): string {\n    return 'git_downloader.py';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAwB;AACxB,kBAAgC;AAChC,oBAAmB;AACnB,yBAA2B;AAC3B,mBAAqB;AAErB,4BAAsC;AAEtC,mCAAsC;AACtC,uBAA6C;AAC7C,2BAKO;AACP,qBAA0C;AAC1C,sBAQO;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAEtC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,QAAI,+BAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,2DAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,UAAM,0CAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,SAAK,6CAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,2BAAuB,6CAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kDAA8C,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kBAAc,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,kBAAc,6BAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,YAAQ,6BAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,2CAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,6CAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,gBAAY,mBAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO,cAAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AACF;","names":["dedent"]}

package/dist/core/sandbox/provider/TFYSandboxProvider.mjs

@@ -1,27 +1,48 @@
 // src/core/sandbox/provider/TFYSandboxProvider.ts
 import { context } from "@opentelemetry/api";
 import { suppressTracing } from "@opentelemetry/core";
-import { randomUUID } from "crypto";
 import dedent from "dedent";
+import { randomUUID } from "crypto";
+import { join } from "path/posix";
 import { extractErrorLogFields } from "../../util/errorLogFields.mjs";
 import { CodeModeNatsTransport } from "../codeMode/nats/CodeModeNatsTransport.mjs";
 import { DEFAULT_SANDBOX_NATS_WS_PORT } from "../constants.mjs";
-import { SandboxFileNotFoundError, SandboxFileTooLargeError, SandboxPathIsDirectoryError } from "../SandboxErrors.mjs";
 import {
-  ensureExecSuccess
+  SandboxFileNotFoundError,
+  SandboxFileTooLargeError,
+  SandboxPathIsDirectoryError,
+  validateSandboxOwnedByTenant
+} from "../SandboxErrors.mjs";
+import { absolutizeRelativeExecEnv } from "./execEnv.mjs";
+import {
+  ensureExecSuccess,
+  shellEscape
 } from "./Provider.mjs";
 var DEFAULT_TIMEOUT_SECONDS = 60;
 var CLIENT_TIMEOUT_BUFFER_SECONDS = 5;
-function shellEscape(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
+var TFY_MCP_CLIENT_BIN = "mcp-client/bin";
+function withMcpClientOnPath(path) {
+  const rest = path.split(":").filter((part) => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);
+  return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(":")}`;
+}
+function parsePwdAndPath(text) {
+  const lines = text.replace(/\r\n/g, "\n").split("\n");
+  const root = lines[0];
+  if (!root?.startsWith("/")) {
+    return void 0;
+  }
+  return { root, inheritedPath: lines[1] ?? "" };
 }
 var TFYSandboxProvider = class _TFYSandboxProvider {
+  type = "tfy";
   serverUrl;
   natsBridgeUrl;
   tenantName;
   fileMaxBytesForDownload;
   defaultExecTimeoutSeconds;
   logger;
+  /** Discovered via `pwd` + `$PATH` — never a hardcoded host layout. */
+  sandboxLayouts = /* @__PURE__ */ new Map();
   constructor(options) {
     this.serverUrl = options.serverUrl.replace(/\/+$/, "");
     this.natsBridgeUrl = options.natsBridgeUrl;
@@ -47,7 +68,41 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     this.logger.debug(`Sandbox created: id=${sandboxId}`);
     return Promise.resolve({ sandboxId });
   }
+  /**
+   * No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative
+   * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so
+   * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.
+   */
   async exec(params) {
+    validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });
+    const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);
+    const incoming = params.env ?? {};
+    const env = absolutizeRelativeExecEnv({
+      root,
+      env: { ...incoming, PATH: withMcpClientOnPath(incoming["PATH"] ?? inheritedPath) }
+    });
+    return this.postExec({ ...params, env });
+  }
+  async sandboxLayout(sandboxId) {
+    const cached = this.sandboxLayouts.get(sandboxId);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const result = await this.postExec({
+      sandboxId,
+      command: `printf '%s\\n%s\\n' "$(pwd)" "$PATH"`
+    });
+    if (!result.success) {
+      throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);
+    }
+    const parsed = parsePwdAndPath(result.response.result);
+    if (parsed === void 0) {
+      throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);
+    }
+    this.sandboxLayouts.set(sandboxId, parsed);
+    return parsed;
+  }
+  async postExec(params) {
     return context.with(suppressTracing(context.active()), async () => {
       const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;
       const body = {
@@ -137,25 +192,39 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     return new CodeModeNatsTransport({
       resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),
       sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,
-      logger: this.logger
+      logger: this.logger,
+      mcpClientInstall: { remotePath: join("mcp-client", "mcp_client.py") }
     });
   }
   getAdditionalInstructions() {
     return dedent`
     SANDBOX RULES:
-    - The Agent's first sandbox command should be \`pwd\` to discover the working directory.
-    - ALL file creation and writes MUST stay within that working directory.
+    - uploads, skills, and tool-results live in the sandbox working directory (not /tmp or /opt).
+    - ALL file creation and writes MUST stay within the sandbox working directory.
     - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.
   `;
   }
-  getToolResultDumpDir(sandboxId) {
-    return `/tmp/${sandboxId}/tool-results`;
+  // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.
+  //   uploads, skills, tool-results, git_downloader.py, .git-credentials
+  //   mcp-client/mcp_client.py  (no /usr/local/bin symlink)
+  getToolResultDumpDir() {
+    return "tool-results";
+  }
+  getGitCredentialsPath() {
+    return ".git-credentials";
+  }
+  getFileUploadsDir() {
+    return "uploads";
+  }
+  getSkillsDir() {
+    return "skills";
   }
-  getGitCredentialsPath(sandboxId) {
-    return `/tmp/${sandboxId}/.git-credentials`;
+  getGitDownloaderPath() {
+    return "git_downloader.py";
   }
 };
 export {
-  TFYSandboxProvider
+  TFYSandboxProvider,
+  withMcpClientOnPath
 };
 //# sourceMappingURL=TFYSandboxProvider.mjs.map

package/dist/core/sandbox/provider/TFYSandboxProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'crypto';\nimport dedent from 'dedent';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport { SandboxFileNotFoundError, SandboxFileTooLargeError, SandboxPathIsDirectoryError } from '../SandboxErrors';\nimport {\n  ensureExecSuccess,\n  type ExecResult,\n  type SandboxBuild,\n  type SandboxExecParams,\n  type SandboxFileInfo,\n  type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\n// Wraps a value in single quotes for safe use in shell commands.\n// Inner single quotes are escaped via the standard shell idiom: ' → '\\''\nfunction shellEscape(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nexport interface TFYSandboxProviderOptions {\n  serverUrl: string;\n  natsBridgeUrl: string;\n  tenantName: string;\n  fileMaxBytesForDownload: number;\n  defaultExecTimeoutMs?: number | undefined;\n  logger: Logger;\n}\n\ninterface StatResult {\n  size: number;\n  type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n  private readonly serverUrl: string;\n  private readonly natsBridgeUrl: string;\n  private readonly tenantName: string;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly defaultExecTimeoutSeconds: number;\n  private readonly logger: Logger;\n\n  constructor(options: TFYSandboxProviderOptions) {\n    this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n    this.natsBridgeUrl = options.natsBridgeUrl;\n    this.tenantName = options.tenantName;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS * 1000) / 1000);\n    this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n  }\n\n  // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n  private static readonly readyBuild: SandboxBuild = {\n    status: 'ready',\n    reason: null,\n    metadata: null,\n  };\n\n  buildImage(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  getImageBuildStatus(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  createSandbox(): Promise<{ sandboxId: string }> {\n    const sandboxId = `${this.tenantName}.${randomUUID()}`;\n    this.logger.debug(`Sandbox created: id=${sandboxId}`);\n    return Promise.resolve({ sandboxId });\n  }\n\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n      // request timeout and the client abort timer; fall back to the provider default otherwise.\n      const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n      const body = {\n        sandbox_id: params.sandboxId,\n        command: params.command,\n        cwd: params.cwd,\n        env: params.env,\n        timeout: timeoutSeconds,\n      };\n\n      const controller = new AbortController();\n      const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) * 1000;\n      const timer = setTimeout(() => {\n        controller.abort();\n      }, clientTimeoutMs);\n\n      try {\n        const response = await fetch(`${this.serverUrl}/exec`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(body),\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          const text = await response.text();\n          this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n          return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n        }\n\n        const result = (await response.json()) as ExecResult;\n        return result;\n      } catch (e: unknown) {\n        if (e instanceof Error && e.name === 'AbortError') {\n          this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n          return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n        }\n        this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      } finally {\n        clearTimeout(timer);\n      }\n    });\n  }\n\n  private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to stat file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    const parsed = JSON.parse(result.response.result) as StatResult;\n    return { size: parsed.size, isDir: parsed.type === 'directory' };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    const info = await this.getFileInfo(params);\n    if (info.isDir) {\n      throw new SandboxPathIsDirectoryError(params.path);\n    }\n    if (info.size > this.fileMaxBytesForDownload) {\n      throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n    }\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `base64 -w0 ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to download file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    return Buffer.from(result.response.result.trim(), 'base64');\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    const encoded = params.content.toString('base64');\n    const escapedPath = shellEscape(params.remotePath);\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`,\n    });\n    ensureExecSuccess(result);\n  }\n\n  // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n      sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n      logger: this.logger,\n    });\n  }\n\n  getAdditionalInstructions(): string {\n    return dedent`\n    SANDBOX RULES:\n    - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n    - ALL file creation and writes MUST stay within that working directory.\n    - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n  `;\n  }\n\n  getToolResultDumpDir(sandboxId: string): string {\n    return `/tmp/${sandboxId}/tool-results`;\n  }\n\n  getGitCredentialsPath(sandboxId: string): string {\n    return `/tmp/${sandboxId}/.git-credentials`;\n  }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,SAAS,6BAA6B;AAEtC,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C,SAAS,0BAA0B,0BAA0B,mCAAmC;AAChG;AAAA,EACE;AAAA,OAMK;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAItC,SAAS,YAAY,OAAuB;AAC1C,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,IAAI,WAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,QAAgD;AACzD,WAAO,QAAQ,KAAK,gBAAgB,QAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,KAAK,sBAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,uBAAuB,sBAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,8CAA8C,YAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,4BAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,yBAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,cAAc,YAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,cAAc,YAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,QAAQ,YAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,sBAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,sBAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,4BAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT;AAAA,EAEA,qBAAqB,WAA2B;AAC9C,WAAO,QAAQ,SAAS;AAAA,EAC1B;AAAA,EAEA,sBAAsB,WAA2B;AAC/C,WAAO,QAAQ,SAAS;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n  SandboxFileNotFoundError,\n  SandboxFileTooLargeError,\n  SandboxPathIsDirectoryError,\n  validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n  ensureExecSuccess,\n  shellEscape,\n  type ExecResult,\n  type SandboxBuild,\n  type SandboxExecParams,\n  type SandboxFileInfo,\n  type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). */\nexport function withMcpClientOnPath(path: string): string {\n  const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n  return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } | undefined {\n  const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n  const root = lines[0];\n  if (!root?.startsWith('/')) {\n    return undefined;\n  }\n  return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n  serverUrl: string;\n  natsBridgeUrl: string;\n  tenantName: string;\n  fileMaxBytesForDownload: number;\n  defaultExecTimeoutMs?: number | undefined;\n  logger: Logger;\n}\n\ninterface StatResult {\n  size: number;\n  type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n  readonly type = 'tfy';\n  private readonly serverUrl: string;\n  private readonly natsBridgeUrl: string;\n  private readonly tenantName: string;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly defaultExecTimeoutSeconds: number;\n  private readonly logger: Logger;\n  /** Discovered via `pwd` + `$PATH` — never a hardcoded host layout. */\n  private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n  constructor(options: TFYSandboxProviderOptions) {\n    this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n    this.natsBridgeUrl = options.natsBridgeUrl;\n    this.tenantName = options.tenantName;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS * 1000) / 1000);\n    this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n  }\n\n  // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n  private static readonly readyBuild: SandboxBuild = {\n    status: 'ready',\n    reason: null,\n    metadata: null,\n  };\n\n  buildImage(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  getImageBuildStatus(): Promise<SandboxBuild> {\n    return Promise.resolve(TFYSandboxProvider.readyBuild);\n  }\n\n  createSandbox(): Promise<{ sandboxId: string }> {\n    const sandboxId = `${this.tenantName}.${randomUUID()}`;\n    this.logger.debug(`Sandbox created: id=${sandboxId}`);\n    return Promise.resolve({ sandboxId });\n  }\n\n  /**\n   * No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n   * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n   * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n   */\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n    const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n    const incoming = params.env ?? {};\n    const env = absolutizeRelativeExecEnv({\n      root,\n      env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n    });\n    return this.postExec({ ...params, env });\n  }\n\n  private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n    const cached = this.sandboxLayouts.get(sandboxId);\n    if (cached !== undefined) {\n      return cached;\n    }\n    const result = await this.postExec({\n      sandboxId,\n      command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n    });\n    if (!result.success) {\n      throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n    }\n    const parsed = parsePwdAndPath(result.response.result);\n    if (parsed === undefined) {\n      throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n    }\n    this.sandboxLayouts.set(sandboxId, parsed);\n    return parsed;\n  }\n\n  private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n      // request timeout and the client abort timer; fall back to the provider default otherwise.\n      const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n      const body = {\n        sandbox_id: params.sandboxId,\n        command: params.command,\n        cwd: params.cwd,\n        env: params.env,\n        timeout: timeoutSeconds,\n      };\n\n      const controller = new AbortController();\n      const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) * 1000;\n      const timer = setTimeout(() => {\n        controller.abort();\n      }, clientTimeoutMs);\n\n      try {\n        const response = await fetch(`${this.serverUrl}/exec`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(body),\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          const text = await response.text();\n          this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n          return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n        }\n\n        const result = (await response.json()) as ExecResult;\n        return result;\n      } catch (e: unknown) {\n        if (e instanceof Error && e.name === 'AbortError') {\n          this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n          return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n        }\n        this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      } finally {\n        clearTimeout(timer);\n      }\n    });\n  }\n\n  private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to stat file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    const parsed = JSON.parse(result.response.result) as StatResult;\n    return { size: parsed.size, isDir: parsed.type === 'directory' };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    const info = await this.getFileInfo(params);\n    if (info.isDir) {\n      throw new SandboxPathIsDirectoryError(params.path);\n    }\n    if (info.size > this.fileMaxBytesForDownload) {\n      throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n    }\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `base64 -w0 ${shellEscape(params.path)}`,\n    });\n\n    if (!result.success) {\n      throw new Error(`Failed to download file: ${result.error}`);\n    }\n    if (result.response.exitCode !== 0) {\n      throw new SandboxFileNotFoundError(params.path);\n    }\n\n    return Buffer.from(result.response.result.trim(), 'base64');\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    const encoded = params.content.toString('base64');\n    const escapedPath = shellEscape(params.remotePath);\n\n    const result = await this.exec({\n      sandboxId: params.sandboxId,\n      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`,\n    });\n    ensureExecSuccess(result);\n  }\n\n  // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n      sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n      logger: this.logger,\n      mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n    });\n  }\n\n  getAdditionalInstructions(): string {\n    return dedent`\n    SANDBOX RULES:\n    - uploads, skills, and tool-results live in the sandbox working directory (not /tmp or /opt).\n    - ALL file creation and writes MUST stay within the sandbox working directory.\n    - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n  `;\n  }\n\n  // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n  //   uploads, skills, tool-results, git_downloader.py, .git-credentials\n  //   mcp-client/mcp_client.py  (no /usr/local/bin symlink)\n  getToolResultDumpDir(): string {\n    return 'tool-results';\n  }\n\n  getGitCredentialsPath(): string {\n    return '.git-credentials';\n  }\n\n  getFileUploadsDir(): string {\n    return 'uploads';\n  }\n\n  getSkillsDir(): string {\n    return 'skills';\n  }\n\n  getGitDownloaderPath(): string {\n    return 'git_downloader.py';\n  }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,OAAO,YAAY;AACnB,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AAErB,SAAS,6BAA6B;AAEtC,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OAMK;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAEtC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,IAAI,WAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,iCAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,MAAM,0BAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,QAAQ,KAAK,gBAAgB,QAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,KAAK,sBAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,uBAAuB,sBAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,8CAA8C,YAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,4BAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,yBAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,cAAc,YAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,cAAc,YAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,QAAQ,YAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,sBAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,sBAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,4BAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,YAAY,KAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/core/sandbox/provider/execEnv.d.ts

@@ -0,0 +1,6 @@
+/** Make cwd-relative PATH / PYTHONPATH / GIT_CONFIG store --file / TFY_SKILLS_DIR usable from any cwd. */
+export declare function absolutizeRelativeExecEnv(params: {
+    root: string;
+    env: Record<string, string>;
+}): Record<string, string>;
+//# sourceMappingURL=execEnv.d.ts.map