@truefoundry/trueforge 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/main.js

@@ -397,7 +397,14 @@ var init_config = __esm({
         raw: getEnv("TRUEFOUNDRY_MTLS_ENABLED"),
         defaultValue: false
       }),
-      TRUEFOUNDRY_MTLS_CERTS_DIR: getEnv("TRUEFOUNDRY_MTLS_CERTS_DIR", { defaultValue: "/etc/tls/truefoundry" }) ?? "/etc/tls/truefoundry"
+      TRUEFOUNDRY_MTLS_CERTS_DIR: getEnv("TRUEFOUNDRY_MTLS_CERTS_DIR", { defaultValue: "/etc/tls/truefoundry" }) ?? "/etc/tls/truefoundry",
+      TRUEFOUNDRY_SANDBOX_ENABLED: parseBoolean({
+        envKey: "TRUEFOUNDRY_SANDBOX_ENABLED",
+        raw: getEnv("TRUEFOUNDRY_SANDBOX_ENABLED"),
+        defaultValue: false
+      }),
+      TRUEFOUNDRY_SANDBOX_API_KEY: getEnv("TRUEFOUNDRY_SANDBOX_API_KEY", { required: false }),
+      TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL: getEnv("TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL", { required: false })
     };
     TrueForgeAuthMode = /* @__PURE__ */ ((TrueForgeAuthMode3) => {
       TrueForgeAuthMode3["Standalone"] = "standalone";
@@ -405,10 +412,19 @@ var init_config = __esm({
       TrueForgeAuthMode3["TrueFoundry"] = "truefoundry";
       return TrueForgeAuthMode3;
     })(TrueForgeAuthMode || {});
-    if (isTrueFoundryModeEnabled(configuration) && isOidcConfigured(configuration)) {
-      throw new Error(
-        "TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL (TrueFoundry mode) and OIDC (SSO) cannot both be enabled at once."
-      );
+    if (isTrueFoundryModeEnabled(configuration)) {
+      if (isOidcConfigured(configuration)) {
+        throw new Error(
+          "TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL (TrueFoundry mode) and OIDC (SSO) cannot both be enabled at once."
+        );
+      }
+      if (configuration.TRUEFOUNDRY_SANDBOX_ENABLED) {
+        if (configuration.TRUEFOUNDRY_SANDBOX_API_KEY === void 0 || configuration.TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL === void 0) {
+          throw new Error(
+            "TRUEFOUNDRY_SANDBOX_ENABLED is true but no sandbox provider is configured. Set TRUEFOUNDRY_SANDBOX_API_KEY + TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL, or set TRUEFOUNDRY_SANDBOX_ENABLED=false."
+          );
+        }
+      }
     }
     config_default = configuration;
   }
@@ -2622,17 +2638,6 @@ var init_skillStore = __esm({
   }
 });
 
-// src/db/createdBySubject.ts
-import { CreatedBySubjectSchema as CreatedBySubjectSchema3 } from "@truefoundry/trueforge-core/agent-session";
-function parseStoredCreatedBySubject(value) {
-  return CreatedBySubjectSchema3.parse(value);
-}
-var init_createdBySubject = __esm({
-  "src/db/createdBySubject.ts"() {
-    "use strict";
-  }
-});
-
 // src/db/indexes.ts
 var SESSION_EXTERNAL_ID_UQ, AGENT_EXTERNAL_ID_UQ;
 var init_indexes = __esm({
@@ -2795,6 +2800,7 @@ var PostgresAgentStore_exports = {};
 __export(PostgresAgentStore_exports, {
   PostgresAgentStore: () => PostgresAgentStore
 });
+import { CreatedBySubjectSchema as CreatedBySubjectSchema3 } from "@truefoundry/trueforge-core/agent-session";
 function toRecord(row) {
   return {
     id: row.id,
@@ -2802,7 +2808,7 @@ function toRecord(row) {
     name: row.name,
     manifest: parseStoredAgentSpec(row.manifest),
     external_id: row.external_id,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject),
+    created_by_subject: CreatedBySubjectSchema3.parse(row.created_by_subject),
     created_at: row.created_at.toISOString(),
     updated_at: row.updated_at.toISOString()
   };
@@ -2824,7 +2830,6 @@ var init_PostgresAgentStore = __esm({
     "use strict";
     init_id();
     init_agentStore();
-    init_createdBySubject();
     init_indexes();
     init_client();
     init_sqlExpressions();
@@ -3040,11 +3045,26 @@ var init_client2 = __esm({
       "oauth_client",
       "token",
       "auth_data",
-      "created_by_subject"
+      "created_by_subject",
+      "source"
     ]);
   }
 });
 
+// src/util/crossPlatform.ts
+import { pathToFileURL } from "url";
+function importAbsoluteModule(filePath) {
+  if (filePath.endsWith(".ts")) {
+    return import(filePath);
+  }
+  return import(pathToFileURL(filePath).href);
+}
+var init_crossPlatform = __esm({
+  "src/util/crossPlatform.ts"() {
+    "use strict";
+  }
+});
+
 // src/db/migrateSqlite.ts
 var migrateSqlite_exports = {};
 __export(migrateSqlite_exports, {
@@ -3059,6 +3079,7 @@ async function migrateSqliteToLatest(db) {
     provider: new FileMigrationProvider({
       fs: fs2,
       path: path4,
+      import: importAbsoluteModule,
       migrationFolder: path4.join(import.meta.dirname, "sqlite", "migrations")
     })
   });
@@ -3078,6 +3099,7 @@ async function migrateSqliteToLatest(db) {
 var init_migrateSqlite = __esm({
   "src/db/migrateSqlite.ts"() {
     "use strict";
+    init_crossPlatform();
   }
 });
 
@@ -3157,14 +3179,19 @@ function parseTurnCustom(value) {
 }
 async function addSessionCostAndDuration(trx, input) {
   const elapsed_ms = Date.parse(input.turn_state.completed_at) - input.turn_created_at.getTime();
-  const total_cost_in_usd = input.turn_state.metrics?.total_cost_in_usd ?? 0;
   const total_duration_ms = elapsed_ms > 0 ? Math.trunc(elapsed_ms) : 0;
+  const turnCost = input.turn_state.metrics?.total_cost_in_usd;
+  const withDuration = sql5`jsonb_set(
+    metrics,
+    '$.total_duration_ms',
+    jsonb((metrics->>'total_duration_ms') + ${total_duration_ms})
+  )`;
   await trx.updateTable("session").set({
-    metrics: sql5`jsonb_set(
-        jsonb_set(metrics, '$.total_cost_in_usd', jsonb((metrics->>'total_cost_in_usd') + ${total_cost_in_usd})),
-        '$.total_duration_ms',
-        jsonb((metrics->>'total_duration_ms') + ${total_duration_ms})
-      )`
+    metrics: turnCost === void 0 ? withDuration : sql5`jsonb_set(
+              ${withDuration},
+              '$.total_cost_in_usd',
+              jsonb(COALESCE(metrics->>'total_cost_in_usd', 0) + ${turnCost})
+            )`
   }).where("session_id", "=", input.session_id).execute();
 }
 function terminalTurnState(state, turn_id) {
@@ -3807,7 +3834,11 @@ var init_sessionAgentColumns = __esm({
 });
 
 // src/db/sqlite/session-store/queries/sessions.ts
-import { SessionMetadataSchema as SessionMetadataSchema2 } from "@truefoundry/trueforge-core/agent-session";
+import {
+  CreatedBySubjectSchema as CreatedBySubjectSchema4,
+  SessionMetadataSchema as SessionMetadataSchema2,
+  SessionSourceSchema
+} from "@truefoundry/trueforge-core/agent-session";
 import {
   decodeSessionListPageToken,
   paginateSessionListRows
@@ -3838,7 +3869,8 @@ function mapRowToSessionRecord(row) {
   return {
     tenant_id: row.tenant_id,
     session_id: row.session_id,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject),
+    created_by_subject: CreatedBySubjectSchema4.parse(row.created_by_subject),
+    source: SessionSourceSchema.nullable().parse(row.source),
     agent: sessionAgentFromColumns({
       session_id: row.session_id,
       agent_id: row.agent_id,
@@ -3861,6 +3893,7 @@ function sessionSelectColumns() {
     "tenant_id",
     "session_id",
     jsonText(sql8.ref("created_by_subject")).as("created_by_subject"),
+    jsonText(sql8.ref("source")).as("source"),
     "agent_id",
     "agent_name",
     jsonText(sql8.ref("agent_spec")).as("agent_spec"),
@@ -3883,6 +3916,7 @@ async function createSession(db, input) {
       tenant_id: input.tenant_id,
       session_id: input.session_id,
       created_by_subject: jsonbBind(input.created_by_subject),
+      source: input.source !== null ? jsonbBind(input.source) : null,
       agent_id: columns.agent_id,
       agent_name: columns.agent_name,
       agent_spec: columns.agent_spec !== null ? jsonbBind(columns.agent_spec) : null,
@@ -3891,7 +3925,6 @@ async function createSession(db, input) {
       metadata: jsonbBind(input.metadata),
       external_id: input.external_id,
       metrics: jsonbBind({
-        total_cost_in_usd: 0,
         total_duration_ms: 0,
         total_turns: 0
       }),
@@ -3973,6 +4006,23 @@ async function listSessions(db, input) {
     query = query.where("agent_id", "=", input.agent_id);
   }
   query = whereCreatedByOrAgentIds2(query, input.created_by_or_agent_ids);
+  if (input.metadata !== void 0) {
+    if (Object.keys(input.metadata).length === 0) {
+      query = query.where(sql8`NOT EXISTS (SELECT 1 FROM json_each(metadata))`);
+    } else {
+      for (const [key, value] of Object.entries(input.metadata)) {
+        query = query.where(
+          sql8`EXISTS (SELECT 1 FROM json_each(metadata) WHERE key = ${key} AND atom = ${value})`
+        );
+      }
+    }
+  }
+  if (input.source_type !== void 0) {
+    query = query.where(sql8`json_extract(source, '$.type')`, "=", input.source_type);
+  }
+  if (input.source_id !== void 0) {
+    query = query.where(sql8`json_extract(source, '$.id')`, "=", input.source_id);
+  }
   if (input.start_timestamp !== void 0) {
     query = query.where("created_at", ">=", input.start_timestamp.toISOString());
   }
@@ -4010,7 +4060,6 @@ async function listSessions(db, input) {
 var init_sessions = __esm({
   "src/db/sqlite/session-store/queries/sessions.ts"() {
     "use strict";
-    init_createdBySubject();
     init_sessionAgentColumns();
     init_client2();
     init_sqlExpressions2();
@@ -4979,6 +5028,9 @@ var SqliteAgentStore_exports = {};
 __export(SqliteAgentStore_exports, {
   SqliteAgentStore: () => SqliteAgentStore
 });
+import {
+  CreatedBySubjectSchema as CreatedBySubjectSchema5
+} from "@truefoundry/trueforge-core/agent-session";
 function recordColumns5(eb) {
   return [
     "id",
@@ -4995,7 +5047,7 @@ function toRecord3(row) {
   return {
     ...row,
     manifest: parseStoredAgentSpec(row.manifest),
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject)
+    created_by_subject: CreatedBySubjectSchema5.parse(row.created_by_subject)
   };
 }
 var SqliteAgentStore;
@@ -5004,7 +5056,6 @@ var init_SqliteAgentStore = __esm({
     "use strict";
     init_id();
     init_agentStore();
-    init_createdBySubject();
     init_client2();
     init_sqlExpressions2();
     SqliteAgentStore = class {
@@ -5115,6 +5166,9 @@ var SqliteScheduleStore_exports = {};
 __export(SqliteScheduleStore_exports, {
   SqliteScheduleStore: () => SqliteScheduleStore
 });
+import {
+  CreatedBySubjectSchema as CreatedBySubjectSchema6
+} from "@truefoundry/trueforge-core/agent-session";
 import {
   decodeOffsetPageToken as decodeOffsetPageToken5,
   paginateOffsetRows as paginateOffsetRows4
@@ -5151,13 +5205,13 @@ function toScheduleRecord(row) {
   return {
     ...row,
     manifest: parseStoredScheduleManifest(row.manifest),
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject)
+    created_by_subject: CreatedBySubjectSchema6.parse(row.created_by_subject)
   };
 }
 function toRunRecord(row) {
   return {
     ...row,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject)
+    created_by_subject: CreatedBySubjectSchema6.parse(row.created_by_subject)
   };
 }
 var SqliteScheduleStore;
@@ -5166,7 +5220,6 @@ var init_SqliteScheduleStore = __esm({
     "use strict";
     init_cron();
     init_id();
-    init_createdBySubject();
     init_scheduleStore();
     init_client2();
     init_sqlExpressions2();
@@ -5364,6 +5417,7 @@ function createMigrator(db) {
     provider: new FileMigrationProvider2({
       fs: fs3,
       path: path5,
+      import: importAbsoluteModule,
       migrationFolder: path5.join(import.meta.dirname, "postgres", "migrations")
     }),
     migrationTableSchema: TRUEFORGE_SCHEMA
@@ -5396,6 +5450,7 @@ async function migrateTo(db, targetMigrationName) {
 var init_migratePostgres = __esm({
   "src/db/migratePostgres.ts"() {
     "use strict";
+    init_crossPlatform();
     init_schema();
   }
 });
@@ -5487,18 +5542,18 @@ function incrementSessionTotalTurns() {
 }
 async function addSessionCostAndDuration2(trx, input) {
   const elapsed_ms = Date.parse(input.turn_state.completed_at) - input.turn_created_at.getTime();
-  const total_cost_in_usd = input.turn_state.metrics?.total_cost_in_usd ?? 0;
   const total_duration_ms = elapsed_ms > 0 ? Math.trunc(elapsed_ms) : 0;
+  const turnCost = input.turn_state.metrics?.total_cost_in_usd;
+  const withDuration = jsonbSet(
+    sql14`metrics`,
+    sql14`'{total_duration_ms}'`,
+    sql14`to_jsonb((metrics->>'total_duration_ms')::bigint + ${total_duration_ms}::bigint)`
+  );
   await trx.updateTable("session").set({
-    metrics: jsonbSet(
-      jsonbSet(
-        sql14`metrics`,
-        sql14`'{total_cost_in_usd}'`,
-        sql14`to_jsonb((metrics->>'total_cost_in_usd')::double precision + ${total_cost_in_usd}::double precision)`
-      ),
-      // bigint: ::int overflows at ~24.8 days of summed ms and would roll back the terminal tx.
-      sql14`'{total_duration_ms}'`,
-      sql14`to_jsonb((metrics->>'total_duration_ms')::bigint + ${total_duration_ms}::bigint)`
+    metrics: turnCost === void 0 ? withDuration : jsonbSet(
+      withDuration,
+      sql14`'{total_cost_in_usd}'`,
+      sql14`to_jsonb(COALESCE((metrics->>'total_cost_in_usd')::double precision, 0) + ${turnCost}::double precision)`
     )
   }).where("session_id", "=", input.session_id).execute();
 }
@@ -6034,7 +6089,11 @@ var init_events2 = __esm({
 });
 
 // src/db/postgres/session-store/queries/sessions.ts
-import { SessionMetadataSchema as SessionMetadataSchema3 } from "@truefoundry/trueforge-core/agent-session";
+import {
+  CreatedBySubjectSchema as CreatedBySubjectSchema7,
+  SessionMetadataSchema as SessionMetadataSchema3,
+  SessionSourceSchema as SessionSourceSchema2
+} from "@truefoundry/trueforge-core/agent-session";
 import {
   decodeSessionListPageToken as decodeSessionListPageToken2,
   paginateSessionListRows as paginateSessionListRows2
@@ -6065,7 +6124,8 @@ function mapRowToSessionRecord2(row) {
   return {
     tenant_id: row.tenant_id,
     session_id: row.session_id,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject),
+    created_by_subject: CreatedBySubjectSchema7.parse(row.created_by_subject),
+    source: SessionSourceSchema2.nullable().parse(row.source),
     agent: sessionAgentFromColumns({
       session_id: row.session_id,
       agent_id: row.agent_id,
@@ -6091,6 +6151,7 @@ async function createSession2(db, input) {
       tenant_id: input.tenant_id,
       session_id: input.session_id,
       created_by_subject: json(input.created_by_subject),
+      source: input.source !== null ? json(input.source) : null,
       agent_id: columns.agent_id,
       agent_name: columns.agent_name,
       agent_spec: columns.agent_spec !== null ? json(columns.agent_spec) : null,
@@ -6099,7 +6160,6 @@ async function createSession2(db, input) {
       metadata: json(input.metadata),
       external_id: input.external_id,
       metrics: json({
-        total_cost_in_usd: 0,
         total_duration_ms: 0,
         total_turns: 0
       }),
@@ -6182,6 +6242,19 @@ async function listSessions2(db, input) {
     query = query.where("agent_id", "=", input.agent_id);
   }
   query = whereCreatedByOrAgentIds(query, input.created_by_or_agent_ids);
+  if (input.metadata !== void 0) {
+    if (Object.keys(input.metadata).length === 0) {
+      query = query.where(sql17`metadata = '{}'::jsonb`);
+    } else {
+      query = query.where(sql17`metadata @> ${json(input.metadata)}`);
+    }
+  }
+  if (input.source_type !== void 0) {
+    query = query.where(sql17`source->>'type'`, "=", input.source_type);
+  }
+  if (input.source_id !== void 0) {
+    query = query.where(sql17`source->>'id'`, "=", input.source_id);
+  }
   if (input.start_timestamp !== void 0) {
     query = query.where("created_at", ">=", input.start_timestamp);
   }
@@ -6219,7 +6292,6 @@ async function listSessions2(db, input) {
 var init_sessions2 = __esm({
   "src/db/postgres/session-store/queries/sessions.ts"() {
     "use strict";
-    init_createdBySubject();
     init_indexes();
     init_sessionAgentColumns();
     init_client();
@@ -7168,6 +7240,7 @@ var PostgresScheduleStore_exports = {};
 __export(PostgresScheduleStore_exports, {
   PostgresScheduleStore: () => PostgresScheduleStore
 });
+import { CreatedBySubjectSchema as CreatedBySubjectSchema8 } from "@truefoundry/trueforge-core/agent-session";
 import {
   decodeOffsetPageToken as decodeOffsetPageToken9,
   paginateOffsetRows as paginateOffsetRows7
@@ -7181,7 +7254,7 @@ function toScheduleRecord2(row) {
     name: row.name,
     manifest: parseStoredScheduleManifest(row.manifest),
     status: row.status,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject),
+    created_by_subject: CreatedBySubjectSchema8.parse(row.created_by_subject),
     created_at: row.created_at.toISOString(),
     updated_at: row.updated_at.toISOString()
   };
@@ -7194,7 +7267,7 @@ function toRunRecord2(row) {
     name: row.name,
     scheduled_for: row.scheduled_for.toISOString(),
     status: row.status,
-    created_by_subject: parseStoredCreatedBySubject(row.created_by_subject),
+    created_by_subject: CreatedBySubjectSchema8.parse(row.created_by_subject),
     triggered_at: row.triggered_at === null ? null : row.triggered_at.toISOString(),
     created_at: row.created_at.toISOString(),
     updated_at: row.updated_at.toISOString()
@@ -7206,7 +7279,6 @@ var init_PostgresScheduleStore = __esm({
     "use strict";
     init_cron();
     init_id();
-    init_createdBySubject();
     init_scheduleStore();
     init_client();
     init_sqlExpressions();
@@ -7380,7 +7452,7 @@ var init_PostgresScheduleStore = __esm({
 
 // src/main.ts
 import { extractErrorLogFields as extractErrorLogFields10 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 import { mkdir as mkdir5 } from "fs/promises";
 import path6 from "path";
 
@@ -7412,6 +7484,9 @@ function getCachedLocalSandboxSupport() {
   return cachedSupport;
 }
 function isLocalSandboxFallbackEnabled() {
+  if (isTrueFoundryModeEnabled(config_default)) {
+    return false;
+  }
   return config_default.STANDALONE && cachedSupport?.supported === true;
 }
 
@@ -7425,7 +7500,7 @@ import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge
 
 // src/app.ts
 import { swaggerUI } from "@hono/swagger-ui";
-import { OpenAPIHono as OpenAPIHono16, z as z29 } from "@hono/zod-openapi";
+import { OpenAPIHono as OpenAPIHono16, z as z30 } from "@hono/zod-openapi";
 import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
 import { bodyLimit } from "hono/body-limit";
 import { HTTPException as HTTPException6 } from "hono/http-exception";
@@ -8198,6 +8273,7 @@ async function validateManifest({
   deps,
   modelProviderStore,
   mcpServerStore,
+  sandboxProviderStore,
   tenant_id
 }) {
   await validateAgentSpec({
@@ -8206,7 +8282,7 @@ async function validateManifest({
     modelProviderStore,
     mcpServerStore,
     skillStore: deps.skillStore,
-    sandboxProviderStore: deps.sandboxProviderStore
+    sandboxProviderStore
   });
   return spec;
 }
@@ -8229,6 +8305,7 @@ function createAgentsRouter(deps) {
       deps,
       modelProviderStore: deps.resolveModelProviderStore(c),
       mcpServerStore: deps.resolveMcpServerStore(c),
+      sandboxProviderStore: deps.resolveSandboxProviderStore(c),
       tenant_id: requestContext.tenant_id
     });
     try {
@@ -8289,7 +8366,7 @@ function createAgentsRouter(deps) {
     const existing = await agentIfAccessible({
       authorizer: deps.authorizer,
       context: requestContext,
-      action: "manage",
+      action: "delete",
       agent: await deps.resolveAgentStore(c).getAgent({ tenant_id: requestContext.tenant_id, id: agentId })
     });
     if (existing === void 0) {
@@ -8316,6 +8393,7 @@ function createAgentsRouter(deps) {
       deps,
       modelProviderStore: deps.resolveModelProviderStore(c),
       mcpServerStore: deps.resolveMcpServerStore(c),
+      sandboxProviderStore: deps.resolveSandboxProviderStore(c),
       tenant_id: requestContext.tenant_id
     });
     const record = await deps.resolveAgentStore(c).updateAgent({
@@ -8924,7 +9002,7 @@ function createCapabilitiesRouter(deps) {
     let status;
     try {
       const refreshed = await checkSnapshotStatus({
-        store: deps.sandboxProviderStore,
+        store: deps.resolveSandboxProviderStore(c),
         tenant_id: requestContext.tenant_id,
         logger: deps.logger
       });
@@ -10580,7 +10658,8 @@ function executeScheduledRun(client) {
   return async ({ run, schedule }) => {
     const { data: session } = await client.internal.sessions.getOrCreateByExternalId({
       externalId: run.id,
-      agent: { name: schedule.agent_name }
+      agent: { name: schedule.agent_name },
+      source: { type: "schedule", id: schedule.id, runId: run.id }
     });
     const turns = await client.sessions.listTurns(session.id, { limit: 1 });
     if (turns.data.length > 0) {
@@ -10607,7 +10686,8 @@ async function startScheduleRun(params) {
     tenant_id: schedule.tenant_id,
     external_id: run.id,
     created_by_subject: schedule.created_by_subject,
-    agent: { type: "reference", id: named.id, name: named.name }
+    agent: { type: "reference", id: named.id, name: named.name },
+    source: { type: "schedule", id: schedule.id, run_id: run.id }
   });
   const { data: turns } = await session.listTurns({ limit: 1 });
   if (turns.length > 0) {
@@ -10999,7 +11079,7 @@ import { HTTPException as HTTPException5 } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
 
 // src/routes/turnRoutes.ts
-import { createRoute as createRoute10, z as z25 } from "@hono/zod-openapi";
+import { createRoute as createRoute10, z as z26 } from "@hono/zod-openapi";
 
 // src/schemas/events.ts
 init_common();
@@ -11095,60 +11175,166 @@ var DownloadSandboxFileRequestQuerySchema = z22.object({
 }).openapi("DownloadSandboxFileRequestQuery");
 
 // src/routes/sessionRoutes.ts
-import { createRoute as createRoute9, z as z24 } from "@hono/zod-openapi";
+import { createRoute as createRoute9, z as z25 } from "@hono/zod-openapi";
 
 // src/schemas/session.ts
 init_common();
-import { z as z23 } from "@hono/zod-openapi";
+import { z as z24 } from "@hono/zod-openapi";
 import {
   AgentSpecSchema as AgentSpecSchema3,
   SessionMetadataSchema,
   SessionSchema,
+  SessionSourceScheduleSchema,
+  SessionSourceTypeSchema,
   TokenPaginationSchema as TokenPaginationSchema5
 } from "@truefoundry/trueforge-core/agent-session";
-var SessionAgentNameRefSchema = z23.object({ name: NameSchema }).strict().openapi("SessionAgentNameRef");
-var SessionAgentSpecBodySchema = z23.object({ spec: AgentSpecSchema3 }).strict().openapi("SessionAgentSpecBody");
-var CreateSessionAgentSchema = z23.union([SessionAgentNameRefSchema, SessionAgentSpecBodySchema]).openapi("CreateSessionAgent");
+
+// src/schemas/deepObjectQuery.ts
+import { z as z23 } from "@hono/zod-openapi";
+function deepObjectQueryIssue({ name, message }) {
+  return new z23.ZodError([
+    {
+      code: "custom",
+      path: [name],
+      message
+    }
+  ]);
+}
+function requireSingleString({ name, key, value }) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    throw deepObjectQueryIssue({ name, message: `Query parameter "${key}" must appear at most once` });
+  }
+  throw deepObjectQueryIssue({ name, message: `Query parameter "${key}" must be a string` });
+}
+function honoQueriesToRecord(queries) {
+  const out = {};
+  for (const [key, values2] of Object.entries(queries)) {
+    out[key] = values2.length === 1 ? values2[0] : values2;
+  }
+  return out;
+}
+function foldDeepObjectQueryParam({
+  query,
+  name,
+  maxKeys
+}) {
+  const equalKey = new RegExp(`^${name}\\[([^\\]]+)\\]$`);
+  const nestedBrackets = new RegExp(`^${name}\\[[^\\]]*\\]\\[[^\\]]+\\]`);
+  const out = {};
+  const folded = {};
+  for (const [key, value] of Object.entries(query)) {
+    if (key === name) {
+      throw deepObjectQueryIssue({
+        name,
+        message: `Use ${name}[key]=value query parameters; bare ${name} is not supported`
+      });
+    }
+    if (nestedBrackets.test(key)) {
+      throw deepObjectQueryIssue({
+        name,
+        message: `Nested ${name} query parameters like ${name}[key][\u2026] are not supported; use ${name}[key]=value`
+      });
+    }
+    const equalMatch = equalKey.exec(key);
+    if (equalMatch) {
+      const mapKey = equalMatch[1];
+      if (mapKey === void 0 || mapKey.length === 0) {
+        throw deepObjectQueryIssue({ name, message: `${name} filter key must be non-empty` });
+      }
+      if (Object.hasOwn(folded, mapKey)) {
+        throw deepObjectQueryIssue({ name, message: `Duplicate ${name} filter key "${mapKey}"` });
+      }
+      folded[mapKey] = requireSingleString({ name, key, value });
+      continue;
+    }
+    if (key.startsWith(`${name}[`)) {
+      throw deepObjectQueryIssue({ name, message: `Invalid ${name} query parameter "${key}"` });
+    }
+    out[key] = value;
+  }
+  const filterKeyCount = Object.keys(folded).length;
+  if (maxKeys !== void 0 && filterKeyCount > maxKeys) {
+    throw deepObjectQueryIssue({ name, message: `at most ${String(maxKeys)} ${name} filter keys` });
+  }
+  if (filterKeyCount > 0) {
+    out[name] = folded;
+  }
+  return out;
+}
+
+// src/schemas/session.ts
+var SessionAgentNameRefSchema = z24.object({ name: NameSchema }).strict().openapi("SessionAgentNameRef");
+var SessionAgentSpecBodySchema = z24.object({ spec: AgentSpecSchema3 }).strict().openapi("SessionAgentSpecBody");
+var CreateSessionAgentSchema = z24.union([SessionAgentNameRefSchema, SessionAgentSpecBodySchema]).openapi("CreateSessionAgent");
 function isSessionAgentNameRef(agent) {
   return SessionAgentNameRefSchema.safeParse(agent).success;
 }
-var CreateSessionRequestSchema = z23.object({
+var CreateSessionRequestSchema = z24.object({
   agent: CreateSessionAgentSchema,
   metadata: SessionMetadataSchema.optional()
 }).strict().openapi("CreateSessionRequest");
-var GetOrCreateSessionByExternalIdRequestSchema = z23.object({
-  external_id: z23.string().min(1).max(128).describe("Caller-supplied id unique within the tenant."),
-  agent: CreateSessionAgentSchema
+var GetOrCreateSessionByExternalIdRequestSchema = z24.object({
+  external_id: z24.string().min(1).max(128).describe("Caller-supplied id unique within the tenant."),
+  agent: CreateSessionAgentSchema,
+  /** Internal-only provenance; not on public create/update. */
+  source: SessionSourceScheduleSchema.optional()
 }).strict().openapi("GetOrCreateSessionByExternalIdRequest");
-var UpdateSessionRequestSchema = z23.object({
+var UpdateSessionRequestSchema = z24.object({
   agent: SessionAgentSpecBodySchema.optional(),
   metadata: SessionMetadataSchema.optional()
 }).strict().openapi("UpdateSessionRequest");
-var IsoTimestampQueryParam = z23.iso.datetime({ offset: true }).openapi({ type: "string", format: "date-time" }).transform((s) => new Date(s));
-var ListSessionsRequestQuerySchema = z23.object({
-  limit: z23.coerce.number().int().min(1).max(PAGE_LIMIT).optional().default(PAGE_LIMIT).describe(`Page size. Defaults to ${String(PAGE_LIMIT)}, max ${String(PAGE_LIMIT)}.`),
-  order: z23.enum(["asc", "desc"]).optional().default("desc").describe('Sort sessions by `updated_at`. Defaults to "desc".').openapi("ListSessionsOrder"),
-  page_token: z23.string().min(1).optional().describe("Opaque keyset cursor from a previous response `next_page_token`."),
+var IsoTimestampQueryParam = z24.iso.datetime({ offset: true }).openapi({ type: "string", format: "date-time" }).transform((s) => new Date(s));
+var LIST_SESSIONS_METADATA_FILTER_MAX_KEYS = 10;
+var ListSessionsRequestQuerySchema = z24.object({
+  limit: z24.coerce.number().int().min(1).max(PAGE_LIMIT).optional().default(PAGE_LIMIT).describe(`Page size. Defaults to ${String(PAGE_LIMIT)}, max ${String(PAGE_LIMIT)}.`),
+  order: z24.enum(["asc", "desc"]).optional().default("desc").describe('Sort sessions by `updated_at`. Defaults to "desc".').openapi("ListSessionsOrder"),
+  page_token: z24.string().min(1).optional().describe("Opaque keyset cursor from a previous response `next_page_token`."),
   start_timestamp: IsoTimestampQueryParam.optional().describe(
     "Inclusive lower bound on `created_at` (ISO-8601 / RFC 3339)."
   ),
   end_timestamp: IsoTimestampQueryParam.optional().describe(
     "Inclusive upper bound on `created_at` (ISO-8601 / RFC 3339)."
   ),
-  agent_id: z23.string().min(1).optional().describe("When set, only sessions bound to this agent id are returned."),
-  created_by_me: z23.stringbool().optional().describe("When true, only sessions created by the authenticated subject.").openapi({ type: "boolean" })
+  agent_id: z24.string().min(1).optional().describe("When set, only sessions bound to this agent id are returned."),
+  created_by_me: z24.stringbool().optional().describe("When true, only sessions created by the authenticated subject.").openapi({ type: "boolean" }),
+  metadata: SessionMetadataSchema.optional().openapi({
+    param: {
+      style: "deepObject",
+      explode: true,
+      description: "Exact metadata pairs as metadata[key]=value. Sessions must contain all pairs."
+    }
+  }).transform((metadata) => metadata === void 0 || Object.keys(metadata).length === 0 ? void 0 : metadata),
+  source_type: SessionSourceTypeSchema.optional().describe(
+    "When set, returns only sessions created by this source type."
+  ),
+  source_id: z24.string().min(1).optional().describe("When set, returns only sessions from this specific source. Requires source_type.")
+}).refine((q) => q.source_id === void 0 || q.source_type !== void 0, {
+  message: "source_id requires source_type",
+  path: ["source_id"]
 }).openapi("ListSessionsRequestQuery");
-var GetSessionResponseSchema = z23.object({
+function parseListSessionsQuery(raw) {
+  return ListSessionsRequestQuerySchema.parse(
+    foldDeepObjectQueryParam({
+      query: raw,
+      name: "metadata",
+      maxKeys: LIST_SESSIONS_METADATA_FILTER_MAX_KEYS
+    })
+  );
+}
+var GetSessionResponseSchema = z24.object({
   data: SessionSchema
 }).openapi("GetSessionResponse");
-var ListSessionsResponseSchema = z23.object({
-  data: z23.array(SessionSchema),
+var ListSessionsResponseSchema = z24.object({
+  data: z24.array(SessionSchema),
   pagination: TokenPaginationSchema5
 }).openapi("ListSessionsResponse");
 
 // src/routes/sessionRoutes.ts
-var SessionIdParamsSchema = z24.object({
-  session_id: z24.string().min(1).max(64).describe("Session identifier.")
+var SessionIdParamsSchema = z25.object({
+  session_id: z25.string().min(1).max(64).describe("Session identifier.")
 });
 var createSessionRoute = createRoute9({
   method: "post",
@@ -11314,7 +11500,7 @@ var listSessionsRoute = createRoute9({
   path: "/",
   tags: ["Agent Sessions" /* AGENT_SESSIONS */],
   summary: "List sessions",
-  description: "List the caller's sessions (newest first by default).",
+  description: "List the sessions (newest first by default).",
   "x-fern-sdk-group-name": ["sessions"],
   "x-fern-sdk-method-name": "list",
   "x-fern-pagination": TOKEN_PAGINATION,
@@ -11401,7 +11587,7 @@ var listSessionEventsRoute = createRoute9({
 
 // src/routes/turnRoutes.ts
 var TurnIdParamsSchema = SessionIdParamsSchema.extend({
-  turn_id: z25.string().min(1).describe("Turn identifier.")
+  turn_id: z26.string().min(1).describe("Turn identifier.")
 });
 var listTurnsRoute = createRoute10({
   method: "get",
@@ -11475,7 +11661,7 @@ var downloadSandboxFileRoute = createRoute10({
   },
   responses: {
     200: {
-      content: { "application/octet-stream": { schema: z25.string().openapi({ format: "binary" }) } },
+      content: { "application/octet-stream": { schema: z26.string().openapi({ format: "binary" }) } },
       description: "File contents."
     },
     400: {
@@ -12310,7 +12496,7 @@ function createTurnsRouter(deps) {
       }
       const provider = await resolveSandboxProvider({
         tenant_id: requestContext.tenant_id,
-        store: deps.sandboxProviderStore,
+        store: deps.resolveSandboxProviderStore(c),
         logger: deps.logger,
         sessionId
       });
@@ -12402,12 +12588,12 @@ function createTurnsRouter(deps) {
       if (agent === void 0) {
         return c.json({ error: { message: `Agent not found: ${agentId}` } }, 422);
       }
-      const canReadAgent = await deps.authorizer.canAccessAgent({
+      const canUseAgent = await deps.authorizer.canAccessAgent({
         context: requestContext,
-        action: "read",
+        action: "use",
         agent
       });
-      if (!canReadAgent) {
+      if (!canUseAgent) {
         return c.json({ error: { message: `Agent not found: ${agentId}` } }, 404);
       }
     }
@@ -12420,7 +12606,8 @@ function createTurnsRouter(deps) {
         ...deps,
         modelProviderStore: deps.resolveModelProviderStore(c),
         mcpServerStore: deps.resolveMcpServerStore(c),
-        agentStore: deps.resolveAgentStore(c)
+        agentStore: deps.resolveAgentStore(c),
+        sandboxProviderStore: deps.resolveSandboxProviderStore(c)
       }
     };
     try {
@@ -12658,7 +12845,7 @@ function createSchedulesRouter(deps) {
     const agent = await agentIfAccessible({
       authorizer: deps.authorizer,
       context: requestContext,
-      action: "read",
+      action: "use",
       agent: await deps.resolveAgentStore(c).getAgent({
         tenant_id: requestContext.tenant_id,
         name: schedule.agent_name
@@ -12722,7 +12909,7 @@ function createSchedulesRouter(deps) {
     const agent = await agentIfAccessible({
       authorizer: deps.authorizer,
       context: requestContext,
-      action: "read",
+      action: "use",
       agent: await deps.resolveAgentStore(c).getAgent({ tenant_id: requestContext.tenant_id, name: body.agent_name })
     });
     if (agent === void 0) {
@@ -12859,13 +13046,13 @@ import { OpenAPIHono as OpenAPIHono10 } from "@hono/zod-openapi";
 import { createRoute as createRoute11 } from "@hono/zod-openapi";
 
 // src/schemas/sessionMetrics.ts
-import { z as z26 } from "@hono/zod-openapi";
+import { z as z27 } from "@hono/zod-openapi";
 var MAX_SESSION_METRICS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
-var SessionMetricsPointSchema = z26.object({
-  timestamp: z26.string(),
-  value: z26.number().nonnegative()
+var SessionMetricsPointSchema = z27.object({
+  timestamp: z27.string(),
+  value: z27.number().nonnegative()
 }).strict().openapi("SessionMetricsPoint");
-var SessionMetricsMeterNameSchema = z26.enum([
+var SessionMetricsMeterNameSchema = z27.enum([
   "total_sessions",
   "total_cost_in_usd",
   "total_turns",
@@ -12882,47 +13069,47 @@ var SessionMetricsMeterNameSchema = z26.enum([
 var METRICS_USD_FERN_ENUM = {
   $: { name: "USD" }
 };
-var MetricsUnitSchema = z26.enum(["count", "$", "ms"]).openapi("MetricsUnit", {
+var MetricsUnitSchema = z27.enum(["count", "$", "ms"]).openapi("MetricsUnit", {
   "x-fern-enum": METRICS_USD_FERN_ENUM
 });
-var SessionMetricsMeterSchema = z26.object({
+var SessionMetricsMeterSchema = z27.object({
   name: SessionMetricsMeterNameSchema,
-  aggregate_value: z26.number().nonnegative(),
-  description: z26.string(),
+  aggregate_value: z27.number().nonnegative(),
+  description: z27.string(),
   unit: MetricsUnitSchema
 }).strict().openapi("SessionMetricsMeter");
-var SessionMetricsMeterResponseSchema = z26.object({
-  meters: z26.array(SessionMetricsMeterSchema)
+var SessionMetricsMeterResponseSchema = z27.object({
+  meters: z27.array(SessionMetricsMeterSchema)
 }).strict().openapi("SessionMetricsMeterResponse");
-var SessionMetricsChartNameSchema = z26.enum(["sessions_over_time", "sessions_cost_over_time", "turns_over_time"]).describe("Session metrics chart to return.").openapi("SessionMetricsChartName");
-var SessionMetricsChartSchema = z26.object({
+var SessionMetricsChartNameSchema = z27.enum(["sessions_over_time", "sessions_cost_over_time", "turns_over_time"]).describe("Session metrics chart to return.").openapi("SessionMetricsChartName");
+var SessionMetricsChartSchema = z27.object({
   name: SessionMetricsChartNameSchema,
-  display_name: z26.string(),
-  description: z26.string(),
-  chart_type: z26.literal("line")
+  display_name: z27.string(),
+  description: z27.string(),
+  chart_type: z27.literal("line")
 }).strict().openapi("SessionMetricsChart");
-var SessionMetricsChartResponseSchema = z26.object({
-  charts: z26.array(SessionMetricsChartSchema)
+var SessionMetricsChartResponseSchema = z27.object({
+  charts: z27.array(SessionMetricsChartSchema)
 }).strict().openapi("SessionMetricsChartResponse");
-var SessionMetricsGraphLineSchema = z26.object({
-  name: z26.string(),
-  values: z26.array(SessionMetricsPointSchema)
+var SessionMetricsGraphLineSchema = z27.object({
+  name: z27.string(),
+  values: z27.array(SessionMetricsPointSchema)
 }).strict().openapi("SessionMetricsGraphLine");
-var SessionMetricsGraphSchema = z26.object({
+var SessionMetricsGraphSchema = z27.object({
   name: SessionMetricsChartNameSchema,
-  display_name: z26.string(),
-  description: z26.string(),
+  display_name: z27.string(),
+  description: z27.string(),
   unit: MetricsUnitSchema,
-  chart_type: z26.literal("line"),
-  graph_lines: z26.array(SessionMetricsGraphLineSchema)
+  chart_type: z27.literal("line"),
+  graph_lines: z27.array(SessionMetricsGraphLineSchema)
 }).strict().openapi("SessionMetricsGraph");
-var SessionMetricsChartDataResponseSchema = z26.object({
-  step: z26.string(),
-  graphs: z26.array(SessionMetricsGraphSchema)
+var SessionMetricsChartDataResponseSchema = z27.object({
+  step: z27.string(),
+  graphs: z27.array(SessionMetricsGraphSchema)
 }).strict().openapi("SessionMetricsChartDataResponse");
-var IsoTimestampQueryParam2 = z26.iso.datetime({ offset: true }).openapi({ type: "string", format: "date-time" }).transform((s) => new Date(s));
-var GetSessionMetricsRequestQueryObjectSchema = z26.object({
-  agent_id: z26.string().min(1).max(64).describe("Named agent identifier."),
+var IsoTimestampQueryParam2 = z27.iso.datetime({ offset: true }).openapi({ type: "string", format: "date-time" }).transform((s) => new Date(s));
+var GetSessionMetricsRequestQueryObjectSchema = z27.object({
+  agent_id: z27.string().min(1).max(64).describe("Named agent identifier."),
   start_timestamp: IsoTimestampQueryParam2.describe("Inclusive lower bound on session `created_at`."),
   end_timestamp: IsoTimestampQueryParam2.describe("Inclusive upper bound on session `created_at`.")
 });
@@ -12947,17 +13134,17 @@ function refineSessionMetricsTimeWindow(query, ctx) {
 var GetSessionMetricsRequestQuerySchema = GetSessionMetricsRequestQueryObjectSchema.superRefine(
   refineSessionMetricsTimeWindow
 ).openapi("GetSessionMetricsRequestQuery");
-var GetSessionMetricsChartDataRequestQuerySchema = z26.object({
+var GetSessionMetricsChartDataRequestQuerySchema = z27.object({
   ...GetSessionMetricsRequestQueryObjectSchema.shape,
   chart_name: SessionMetricsChartNameSchema
 }).superRefine(refineSessionMetricsTimeWindow).openapi("GetSessionMetricsChartDataRequestQuery");
-var GetSessionMetricsMeterResponseSchema = z26.object({
+var GetSessionMetricsMeterResponseSchema = z27.object({
   data: SessionMetricsMeterResponseSchema
 }).openapi("GetSessionMetricsMeterResponse");
-var GetSessionMetricsChartResponseSchema = z26.object({
+var GetSessionMetricsChartResponseSchema = z27.object({
   data: SessionMetricsChartResponseSchema
 }).openapi("GetSessionMetricsChartResponse");
-var GetSessionMetricsChartDataResponseSchema = z26.object({
+var GetSessionMetricsChartDataResponseSchema = z27.object({
   data: SessionMetricsChartDataResponseSchema
 }).openapi("GetSessionMetricsChartDataResponse");
 
@@ -13083,14 +13270,14 @@ import {
   redisRequest,
   RequestTimeoutError
 } from "@truefoundry/trueforge-core/request-reply";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 init_config();
 init_id();
 var SESSIONS_CANCEL_PATH = "sessions/cancel";
-var CancelPeerBodySchema = z27.object({
-  session_id: z27.string(),
-  turn_id: z27.string(),
-  reason: z27.enum(CancellationReason2)
+var CancelPeerBodySchema = z28.object({
+  session_id: z28.string(),
+  turn_id: z28.string(),
+  reason: z28.enum(CancellationReason2)
 });
 function toWireSession(record) {
   return {
@@ -13101,7 +13288,8 @@ function toWireSession(record) {
     created_at: record.created_at.toISOString(),
     updated_at: record.updated_at.toISOString(),
     metrics: record.metrics,
-    metadata: record.metadata
+    metadata: record.metadata,
+    source: record.source
   };
 }
 function cancelTurnOnThisExecutor(activeTurns, input) {
@@ -13218,7 +13406,7 @@ function createGetOrCreateSessionByExternalIdHandler(deps) {
       const named = await agentIfAccessible({
         authorizer: deps.authorizer,
         context: requestContext,
-        action: "read",
+        action: "use",
         agent: await deps.resolveAgentStore(c).getAgent({
           tenant_id: requestContext.tenant_id,
           name: body.agent.name
@@ -13235,7 +13423,7 @@ function createGetOrCreateSessionByExternalIdHandler(deps) {
         modelProviderStore: deps.resolveModelProviderStore(c),
         mcpServerStore: deps.resolveMcpServerStore(c),
         skillStore: deps.skillStore,
-        sandboxProviderStore: deps.sandboxProviderStore
+        sandboxProviderStore: deps.resolveSandboxProviderStore(c)
       });
       agent = { type: "inline", spec: body.agent.spec };
     }
@@ -13243,7 +13431,8 @@ function createGetOrCreateSessionByExternalIdHandler(deps) {
       tenant_id: requestContext.tenant_id,
       external_id: body.external_id,
       created_by_subject: createdBySubjectFromRequestContext(requestContext),
-      agent
+      agent,
+      source: body.source ?? null
     });
     if (!created && !await canReadAgentBoundResource({
       store: deps.resolveAgentStore(c),
@@ -13271,7 +13460,7 @@ function createSessionsRouter(deps) {
       const agent = await agentIfAccessible({
         authorizer: deps.authorizer,
         context: requestContext,
-        action: "read",
+        action: "use",
         agent: await deps.resolveAgentStore(c).getAgent({
           tenant_id: requestContext.tenant_id,
           name: body.agent.name
@@ -13296,7 +13485,7 @@ function createSessionsRouter(deps) {
       modelProviderStore: deps.resolveModelProviderStore(c),
       mcpServerStore: deps.resolveMcpServerStore(c),
       skillStore: deps.skillStore,
-      sandboxProviderStore: deps.sandboxProviderStore
+      sandboxProviderStore: deps.resolveSandboxProviderStore(c)
     });
     const session = await deps.sessions.create({
       tenant_id: requestContext.tenant_id,
@@ -13375,7 +13564,7 @@ function createSessionsRouter(deps) {
         modelProviderStore: deps.resolveModelProviderStore(c),
         mcpServerStore: deps.resolveMcpServerStore(c),
         skillStore: deps.skillStore,
-        sandboxProviderStore: deps.sandboxProviderStore
+        sandboxProviderStore: deps.resolveSandboxProviderStore(c)
       });
     }
     try {
@@ -13405,7 +13594,7 @@ function createSessionsRouter(deps) {
     return c.json({ data: toWireSession(record) }, 200);
   };
   const listSessionsHandler = async (c) => {
-    const query = c.req.valid("query");
+    const query = parseListSessionsQuery(honoQueriesToRecord(c.req.queries()));
     const requestContext = deps.resolveRequestContext(c);
     try {
       const managedAgentIds = query.created_by_me ? [] : await resolveManagedAgentIds({
@@ -13420,11 +13609,14 @@ function createSessionsRouter(deps) {
           agent_ids: managedAgentIds
         },
         tenant_id: requestContext.tenant_id,
+        metadata: query.metadata,
         limit: query.limit,
         order: query.order,
         page_token: query.page_token,
         start_timestamp: query.start_timestamp,
-        end_timestamp: query.end_timestamp
+        end_timestamp: query.end_timestamp,
+        source_type: query.source_type,
+        source_id: query.source_id
       });
       return c.json({ data: data.map(toWireSession), pagination }, 200);
     } catch (error) {
@@ -13754,12 +13946,13 @@ function redactSandboxProvider(manifest) {
 function createSandboxProvidersRouter(deps) {
   const getHandler = async (c) => {
     const requestContext = deps.resolveRequestContext(c);
-    const record = await deps.sandboxProviderStore.getSandboxProvider(requestContext.tenant_id);
+    const store = deps.resolveSandboxProviderStore(c);
+    const record = await store.getSandboxProvider(requestContext.tenant_id);
     if (record === void 0) {
       return c.json({ error: { message: "No sandbox provider configured" } }, 404);
     }
     const status = await checkSnapshotStatus({
-      store: deps.sandboxProviderStore,
+      store,
       tenant_id: requestContext.tenant_id,
       logger: deps.logger
     });
@@ -13777,6 +13970,7 @@ function createSandboxProvidersRouter(deps) {
   const putHandler = async (c) => {
     const body = c.req.valid("json");
     const requestContext = deps.resolveRequestContext(c);
+    const store = deps.resolveSandboxProviderStore(c);
     const incoming = body.manifest;
     const resolveManifest = (existing) => ({
       ...incoming,
@@ -13789,10 +13983,7 @@ function createSandboxProvidersRouter(deps) {
     });
     try {
       const { manifest, status } = await deps.withTransaction(async (transaction) => {
-        const locked = await deps.sandboxProviderStore.getSandboxProviderForUpdate(
-          requestContext.tenant_id,
-          transaction
-        );
+        const locked = await store.getSandboxProviderForUpdate(requestContext.tenant_id, transaction);
         const resolved = resolveManifest(locked);
         const provider = toDaytonaSandboxProvider({
           manifest: resolved,
@@ -13803,7 +13994,7 @@ function createSandboxProvidersRouter(deps) {
         const built = toSandboxStatus(
           await withTimeout2(provider.buildImage(), BUILD_REQUEST_TIMEOUT_MS, "sandbox buildImage")
         );
-        await deps.sandboxProviderStore.upsertSandboxProvider(
+        await store.upsertSandboxProvider(
           { tenant_id: requestContext.tenant_id, manifest: resolved, ...built },
           transaction
         );
@@ -14052,7 +14243,7 @@ function createSettingsRouter(deps) {
   router.route(
     "/sandbox-providers",
     createSandboxProvidersRouter({
-      sandboxProviderStore: deps.sandboxProviderStore,
+      resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
       withTransaction: deps.withTransaction,
       logger: deps.logger,
       resolveRequestContext: deps.resolveRequestContext
@@ -14189,9 +14380,9 @@ var PACKAGE_VERSION = readPackageVersion();
 init_schedule();
 
 // src/zodErrorResponse.ts
-import { z as z28 } from "@hono/zod-openapi";
+import { z as z29 } from "@hono/zod-openapi";
 function zodErrorResponse(c, error) {
-  return c.json({ error: { message: z28.prettifyError(error) } }, 400);
+  return c.json({ error: { message: z29.prettifyError(error) } }, 400);
 }
 var zodValidationHook = (result, c) => {
   if (!result.success) {
@@ -14237,7 +14428,7 @@ function createRequestBodyLimitMiddleware(maxSize) {
 }
 function createAppErrorHandler(params) {
   return (error, c) => {
-    if (error instanceof z29.ZodError) {
+    if (error instanceof z30.ZodError) {
       return zodErrorResponse(c, error);
     }
     if (error instanceof InvalidCronError) {
@@ -14311,7 +14502,7 @@ function createServerApp(deps) {
     "/api/v1/capabilities",
     withAuth(
       createCapabilitiesRouter({
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         withTransaction: deps.withTransaction,
         logger: deps.logger,
         resolveRequestContext
@@ -14382,7 +14573,7 @@ function createServerApp(deps) {
         resolveModelProviderStore: deps.resolveModelProviderStore,
         resolveMcpServerStore: deps.resolveMcpServerStore,
         skillStore: deps.skillStore,
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         withTransaction: deps.withTransaction,
         resolveRequestContext,
         authorizer: deps.authorizer
@@ -14404,7 +14595,7 @@ function createServerApp(deps) {
           mcpServerStore: deps.resolveMcpServerStore(c),
           skillStore: deps.skillStore,
           agentStore: deps.resolveAgentStore(c),
-          sandboxProviderStore: deps.sandboxProviderStore,
+          sandboxProviderStore: deps.resolveSandboxProviderStore(c),
           logger: deps.logger
         }),
         withTransaction: deps.withTransaction,
@@ -14422,7 +14613,7 @@ function createServerApp(deps) {
         resolveMcpServerStore: deps.resolveMcpServerStore,
         tokenStore: deps.tokenStore,
         skillStore: deps.skillStore,
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         withTransaction: deps.withTransaction,
         logger: deps.logger,
         resolveRequestContext
@@ -14439,7 +14630,7 @@ function createServerApp(deps) {
         resolveMcpServerStore: deps.resolveMcpServerStore,
         skillStore: deps.skillStore,
         resolveAgentStore: deps.resolveAgentStore,
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         resolveRequestContext,
         authorizer: deps.authorizer
       }),
@@ -14469,7 +14660,7 @@ function createServerApp(deps) {
         resolveMcpServerStore: deps.resolveMcpServerStore,
         skillStore: deps.skillStore,
         resolveAgentStore: deps.resolveAgentStore,
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         redis: deps.redis,
         requestReplyRouter: deps.requestReplyRouter,
         resolveRequestContext,
@@ -14491,7 +14682,7 @@ function createServerApp(deps) {
         skillStore: deps.skillStore,
         resolveAgentStore: deps.resolveAgentStore,
         eventSubscriptions: deps.eventSubscriptions,
-        sandboxProviderStore: deps.sandboxProviderStore,
+        resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
         logger: deps.logger,
         resolveRequestContext,
         authorizer: deps.authorizer
@@ -14512,7 +14703,7 @@ var TrueForgeAuthorizer = class {
     return Promise.resolve({ kind: "all" });
   }
   canAccessAgent(input) {
-    if (input.action === "read") {
+    if (input.action === "read" || input.action === "use") {
       return Promise.resolve(true);
     }
     return Promise.resolve(input.agent.created_by_subject.subject_id === input.context.subject.id);
@@ -15417,9 +15608,9 @@ function printStandaloneStartupBanner(options) {
 
 // src/truefoundry/perServerMcpHeaders.ts
 import { HTTPException as HTTPException9 } from "hono/http-exception";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var X_TFG_MCP_HEADERS = "x-tfg-mcp-headers";
-var PerServerMcpHeadersSchema = z30.record(z30.string().min(1), z30.record(z30.string().min(1), z30.string()));
+var PerServerMcpHeadersSchema = z31.record(z31.string().min(1), z31.record(z31.string().min(1), z31.string()));
 function parsePerServerMcpHeaders(raw) {
   let decoded;
   try {
@@ -15445,7 +15636,7 @@ import { sql as sql3 } from "kysely";
 import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 import { fetch as undiciFetch2 } from "undici";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // src/truefoundry/internalTls.ts
 function normalizeInternalTlsUrl(input) {
@@ -15459,48 +15650,48 @@ function createInternalTlsDispatcher(options) {
 }
 
 // src/truefoundry/mapSfyMcpServers.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var MCP_PROXY_BASE_URL_TEMPLATE = "{{mcpProxyBaseURL}}";
-var IsoInstantSchema = z31.union([z31.string().min(1), z31.date()]).transform((value, ctx) => {
+var IsoInstantSchema = z32.union([z32.string().min(1), z32.date()]).transform((value, ctx) => {
   if (value instanceof Date) {
     if (!Number.isFinite(value.getTime())) {
       ctx.addIssue({ code: "custom", message: "Invalid Date" });
-      return z31.NEVER;
+      return z32.NEVER;
     }
     return value.toISOString();
   }
   const ms = Date.parse(value);
   if (!Number.isFinite(ms)) {
     ctx.addIssue({ code: "custom", message: "Invalid ISO timestamp" });
-    return z31.NEVER;
+    return z32.NEVER;
   }
   return new Date(ms).toISOString();
 });
-var SfyMcpServerRowSchema = z31.object({
-  id: z31.string().min(1),
-  name: z31.string().min(1),
-  proxyUrl: z31.string().min(1),
+var SfyMcpServerRowSchema = z32.object({
+  id: z32.string().min(1),
+  name: z32.string().min(1),
+  proxyUrl: z32.string().min(1),
   createdAt: IsoInstantSchema,
   updatedAt: IsoInstantSchema,
-  manifest: z31.object({
-    description: z31.string().min(1).optional(),
-    auth_data: z31.object({
-      type: z31.string().min(1).optional()
+  manifest: z32.object({
+    description: z32.string().min(1).optional(),
+    auth_data: z32.object({
+      type: z32.string().min(1).optional()
     }).optional()
   }).optional()
 });
-var SfyMcpAuthStatusAuthenticatedSchema = z31.object({ status: z31.literal("authenticated") });
-var SfyMcpAuthStatusNotRequiredSchema = z31.object({ status: z31.literal("authentication_not_required") });
-var SfyMcpAuthStatusRequiredSchema = z31.object({ status: z31.literal("authentication_required") });
+var SfyMcpAuthStatusAuthenticatedSchema = z32.object({ status: z32.literal("authenticated") });
+var SfyMcpAuthStatusNotRequiredSchema = z32.object({ status: z32.literal("authentication_not_required") });
+var SfyMcpAuthStatusRequiredSchema = z32.object({ status: z32.literal("authentication_required") });
 var SfyMcpAuthorizeRequiredSchema = SfyMcpAuthStatusRequiredSchema.extend({
-  authorization_endpoint: z31.url()
+  authorization_endpoint: z32.url()
 });
-var SfyMcpAuthStatusSchema = z31.discriminatedUnion("status", [
+var SfyMcpAuthStatusSchema = z32.discriminatedUnion("status", [
   SfyMcpAuthStatusAuthenticatedSchema,
   SfyMcpAuthStatusRequiredSchema,
   SfyMcpAuthStatusNotRequiredSchema
 ]);
-var SfyMcpAuthorizeResultSchema = z31.discriminatedUnion("status", [
+var SfyMcpAuthorizeResultSchema = z32.discriminatedUnion("status", [
   SfyMcpAuthStatusAuthenticatedSchema,
   SfyMcpAuthorizeRequiredSchema,
   SfyMcpAuthStatusNotRequiredSchema
@@ -15566,37 +15757,37 @@ var TFG_AGENTS_PATH = "internal/tfg/agents";
 var SESSION_PATH = "v1/session";
 var AGENT_PERMISSIONS_PATH = "v1/authorize/permissions";
 var INTEGRATIONS_PAGE_SIZE = 1e3;
-var SessionSubjectSchema = z32.object({
-  subjectId: z32.string().min(1),
-  subjectType: z32.string().min(1),
-  subjectDisplayName: z32.string().nullable().optional(),
-  subjectSlug: z32.string().nullable().optional()
+var SessionSubjectSchema = z33.object({
+  subjectId: z33.string().min(1),
+  subjectType: z33.string().min(1),
+  subjectDisplayName: z33.string().nullable().optional(),
+  subjectSlug: z33.string().nullable().optional()
 });
-var GetSessionUserSchema = z32.object({
-  tenantName: z32.string().min(1),
-  roles: z32.array(z32.string()),
+var GetSessionUserSchema = z33.object({
+  tenantName: z33.string().min(1),
+  roles: z33.array(z33.string()),
   subject: SessionSubjectSchema
 });
-var GetSessionWireSchema = z32.object({
+var GetSessionWireSchema = z33.object({
   user: GetSessionUserSchema.nullable()
 });
-var ListResponseSchema = z32.union([
-  z32.array(z32.unknown()),
-  z32.object({
-    data: z32.array(z32.unknown()).catch([]),
-    pagination: z32.object({ total: z32.number().optional() }).optional()
+var ListResponseSchema = z33.union([
+  z33.array(z33.unknown()),
+  z33.object({
+    data: z33.array(z33.unknown()).catch([]),
+    pagination: z33.object({ total: z33.number().optional() }).optional()
   })
 ]);
-var ServiceFoundryErrorSchema = z32.object({
-  message: z32.union([z32.string(), z32.array(z32.string())]).optional()
+var ServiceFoundryErrorSchema = z33.object({
+  message: z33.union([z33.string(), z33.array(z33.string())]).optional()
 });
-var PutRemoteAgentResponseSchema = z32.object({
-  agentId: z32.string().min(1)
+var PutRemoteAgentResponseSchema = z33.object({
+  agentId: z33.string().min(1)
 });
-var AgentPermissionSchema = z32.enum(["READ_AGENT", "MANAGE_AGENT"]);
-var AgentPermissionsSchema = z32.record(
-  z32.string(),
-  z32.array(z32.string()).transform(
+var AgentPermissionSchema = z33.enum(["READ_AGENT", "USE_AGENT", "MANAGE_AGENT", "DELETE_AGENT"]);
+var AgentPermissionsSchema = z33.record(
+  z33.string(),
+  z33.array(z33.string()).transform(
     (permissions) => permissions.flatMap((permission) => {
       const parsed = AgentPermissionSchema.safeParse(permission);
       return parsed.success ? [parsed.data] : [];
@@ -15965,7 +16156,7 @@ function toPutRemoteAgentPayload({
 }) {
   return {
     name,
-    description: manifest.instructions ?? name,
+    description: name,
     model: manifest.model.name,
     mcp_servers: (manifest.mcp_servers ?? []).map((server) => server.name)
   };
@@ -16092,8 +16283,14 @@ var TrueFoundryAgentStore = class {
 
 // src/truefoundry/TrueFoundryAuthorizer.ts
 import { HTTPException as HTTPException11 } from "hono/http-exception";
+var permissionByAction = {
+  read: "READ_AGENT",
+  use: "USE_AGENT",
+  manage: "MANAGE_AGENT",
+  delete: "DELETE_AGENT"
+};
 function allowsAction(permissions, action) {
-  return action === "manage" ? permissions.includes("MANAGE_AGENT") : permissions.includes("READ_AGENT") || permissions.includes("MANAGE_AGENT");
+  return permissions.includes(permissionByAction[action]);
 }
 function requireUserCredential(context) {
   if (context.user_credential === null) {
@@ -16140,24 +16337,24 @@ init_mcpServerStore();
 // src/truefoundry/mapEnabledModels.ts
 import { SUPPORTED_REASONING_EFFORTS as SUPPORTED_REASONING_EFFORTS3 } from "@truefoundry/trueforge-core/core";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
-import { z as z33 } from "zod";
-var ModelParamSchema = z33.object({
-  key: z33.string(),
-  supportedValues: z33.array(z33.string()).optional()
+import { z as z34 } from "zod";
+var ModelParamSchema = z34.object({
+  key: z34.string(),
+  supportedValues: z34.array(z34.string()).optional()
 });
-var MetadataSchema = z33.object({
-  limits: z33.object({
-    context_window: z33.number().optional(),
-    max_input_tokens: z33.number().optional(),
-    max_output_tokens: z33.number().optional(),
-    max_tokens: z33.number().optional()
+var MetadataSchema = z34.object({
+  limits: z34.object({
+    context_window: z34.number().optional(),
+    max_input_tokens: z34.number().optional(),
+    max_output_tokens: z34.number().optional(),
+    max_tokens: z34.number().optional()
   }).optional(),
-  params: z33.array(ModelParamSchema).optional()
+  params: z34.array(ModelParamSchema).optional()
 });
-var IntegrationSchema = z33.object({
-  name: z33.string().min(1),
-  manifest: z33.object({ model_types: z33.array(z33.string()).optional() }),
-  providerAccount: z33.object({ name: z33.string().min(1) }),
+var IntegrationSchema = z34.object({
+  name: z34.string().min(1),
+  manifest: z34.object({ model_types: z34.array(z34.string()).optional() }),
+  providerAccount: z34.object({ name: z34.string().min(1) }),
   metadata: MetadataSchema.optional()
 });
 function toReasoningEfforts(params) {
@@ -16204,11 +16401,11 @@ function mapEnabledModels(input) {
   }
   return models;
 }
-var InstallationSchema = z33.object({
-  isDefault: z33.boolean().optional(),
-  manifest: z33.object({ url: z33.string().min(1) })
+var InstallationSchema = z34.object({
+  isDefault: z34.boolean().optional(),
+  manifest: z34.object({ url: z34.string().min(1) })
 });
-var InstallationsEnvelopeSchema = z33.union([z33.array(z33.unknown()), z33.object({ data: z33.array(z33.unknown()) })]);
+var InstallationsEnvelopeSchema = z34.union([z34.array(z34.unknown()), z34.object({ data: z34.array(z34.unknown()) })]);
 function resolveDefaultGatewayUrl(payload) {
   const envelope = InstallationsEnvelopeSchema.parse(payload);
   const rows = Array.isArray(envelope) ? envelope : envelope.data;
@@ -16290,13 +16487,15 @@ var TrueFoundryMcpServerStore = class {
     if (input.names?.length === 0) {
       return paginateOffsetRows([], input.limit, offset);
     }
-    const rows = await this.#client.listMcpServers({
-      accessToken: this.#accessToken,
-      limit: input.limit + 1,
-      offset,
-      ...input.names !== void 0 ? { names: input.names } : {}
-    });
-    const gatewayUrl = await this.#resolveGatewayUrl();
+    const [rows, gatewayUrl] = await Promise.all([
+      this.#client.listMcpServers({
+        accessToken: this.#accessToken,
+        limit: input.limit + 1,
+        offset,
+        ...input.names !== void 0 ? { names: input.names } : {}
+      }),
+      this.#resolveGatewayUrl()
+    ]);
     const records = mapSfyMcpServers({ rows }).map(
       (server) => toRecord2({ tenant_id: input.tenant_id, server, gatewayUrl })
     );
@@ -16304,12 +16503,14 @@ var TrueFoundryMcpServerStore = class {
   }
   async getServer(input, transaction) {
     void transaction;
-    const row = await this.#client.getMcpServerByName({ accessToken: this.#accessToken, name: input.name });
+    const [row, gatewayUrl] = await Promise.all([
+      this.#client.getMcpServerByName({ accessToken: this.#accessToken, name: input.name }),
+      this.#resolveGatewayUrl()
+    ]);
     if (row === void 0) {
       return void 0;
     }
     const server = parseSfyMcpServerSummary(row);
-    const gatewayUrl = await this.#resolveGatewayUrl();
     return toRecord2({ tenant_id: input.tenant_id, server, gatewayUrl });
   }
   getServerForUpdate(input, transaction) {
@@ -16500,6 +16701,135 @@ function toManifest(input) {
   };
 }
 
+// src/truefoundry/TrueFoundrySandboxProviderStore.ts
+import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { LRUCache } from "lru-cache";
+import { z as z35 } from "zod";
+
+// src/truefoundry/resolveTrueFoundrySandboxProviderConfig.ts
+init_config();
+import { HTTPException as HTTPException15 } from "hono/http-exception";
+function resolveTrueFoundrySandboxProviderConfig(config = config_default) {
+  if (config.STANDALONE) {
+    throw new HTTPException15(500, {
+      message: "TrueFoundry sandbox provider config is not available in standalone mode"
+    });
+  }
+  if (config.TRUEFOUNDRY_SANDBOX_ENABLED && config.TRUEFOUNDRY_SANDBOX_API_KEY !== void 0 && config.TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL !== void 0) {
+    return {
+      type: "daytona",
+      apiKey: config.TRUEFOUNDRY_SANDBOX_API_KEY,
+      settingsServerUrl: config.TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL
+    };
+  }
+  return void 0;
+}
+
+// src/truefoundry/TrueFoundrySandboxProviderStore.ts
+var SETTINGS_CACHE_TTL_MS = 5 * 60 * 1e3;
+var SETTINGS_FETCH_TIMEOUT_MS = 1e4;
+var SANDBOX_DEFAULT_SETTINGS = {
+  timeoutMs: 6e4,
+  autoStopIntervalInMinutes: 5,
+  autoArchiveIntervalInMinutes: 60,
+  autoDeleteIntervalInMinutes: 43200
+};
+var DaytonaSandboxSettingsSchema = z35.object({
+  snapshotName: z35.string().min(1, "snapshotName is required"),
+  autoStopIntervalInMinutes: z35.number().default(SANDBOX_DEFAULT_SETTINGS.autoStopIntervalInMinutes),
+  autoArchiveIntervalInMinutes: z35.number().default(SANDBOX_DEFAULT_SETTINGS.autoArchiveIntervalInMinutes),
+  autoDeleteIntervalInMinutes: z35.number().default(SANDBOX_DEFAULT_SETTINGS.autoDeleteIntervalInMinutes),
+  timeoutMs: z35.number().default(SANDBOX_DEFAULT_SETTINGS.timeoutMs)
+});
+var DAYTONA_SETTINGS_CACHE_KEY = "daytona-settings";
+var daytonaSettingsCache = new LRUCache({
+  max: 1,
+  ttl: SETTINGS_CACHE_TTL_MS
+});
+async function resolveDaytonaSandboxSettings({
+  accessToken,
+  settingsServerUrl
+}) {
+  const cached = daytonaSettingsCache.get(DAYTONA_SETTINGS_CACHE_KEY);
+  if (cached !== void 0) {
+    return cached;
+  }
+  let response;
+  try {
+    response = await fetch(settingsServerUrl, {
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(SETTINGS_FETCH_TIMEOUT_MS)
+    });
+  } catch (error) {
+    const timedOut = error instanceof Error && error.name === "TimeoutError";
+    throw new Error(
+      timedOut ? `Sandbox settings endpoint timed out after ${String(SETTINGS_FETCH_TIMEOUT_MS / 1e3)}s` : "Sandbox settings endpoint request failed",
+      { cause: error }
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Sandbox settings endpoint returned ${String(response.status)}: ${body}`);
+  }
+  const settings = DaytonaSandboxSettingsSchema.parse(await response.json());
+  daytonaSettingsCache.set(DAYTONA_SETTINGS_CACHE_KEY, settings);
+  return settings;
+}
+function managed3() {
+  throw new HTTPException16(TRUEFOUNDRY_MANAGED_STATUS, { message: TRUEFOUNDRY_MANAGED_MESSAGE });
+}
+var TrueFoundrySandboxProviderStore = class {
+  #accessToken;
+  constructor(input) {
+    this.#accessToken = input.accessToken;
+  }
+  async getSandboxProvider(tenantId, transaction) {
+    void transaction;
+    const providerConfig = resolveTrueFoundrySandboxProviderConfig();
+    if (!providerConfig) {
+      return void 0;
+    }
+    const settings = await resolveDaytonaSandboxSettings({
+      accessToken: this.#accessToken,
+      settingsServerUrl: providerConfig.settingsServerUrl
+    });
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      tenant_id: tenantId,
+      manifest: {
+        type: "daytona",
+        auth: { api_key: providerConfig.apiKey },
+        exec_timeout_ms: settings.timeoutMs,
+        auto_stop_interval_in_minutes: settings.autoStopIntervalInMinutes,
+        auto_archive_interval_in_minutes: settings.autoArchiveIntervalInMinutes,
+        auto_delete_interval_in_minutes: settings.autoDeleteIntervalInMinutes
+      },
+      status: "ready",
+      status_reason: null,
+      // Snapshot name only — no image_uri; TFY mode never registers a snapshot.
+      build_metadata: { build_ref: settings.snapshotName },
+      created_at: now2,
+      // Fresh on every get so checkSnapshotStatus short-circuits without Daytona.
+      updated_at: now2
+    };
+  }
+  getSandboxProviderForUpdate(tenantId, transaction) {
+    void tenantId;
+    void transaction;
+    return managed3();
+  }
+  upsertSandboxProvider(input, transaction) {
+    void input;
+    void transaction;
+    return managed3();
+  }
+  updateSandboxStatus(input, transaction) {
+    void input;
+    void transaction;
+    return managed3();
+  }
+};
+
 // src/main.ts
 var configuration2;
 var isOidcConfigured2;
@@ -16524,8 +16854,8 @@ try {
 function requireRequestCredentialToken(c) {
   const credential = resolveRequestContext(c).user_credential;
   if (credential === null) {
-    throw new HTTPException15(401, {
-      message: "Authentication token required to list or call TrueFoundry models, MCP servers, and agents"
+    throw new HTTPException17(401, {
+      message: "Authentication token required to list or call TrueFoundry models, MCP servers, agents, and sandbox"
     });
   }
   return credential;
@@ -16589,6 +16919,15 @@ function buildResolveAgentStore(options) {
     return persistenceStore;
   };
 }
+function buildResolveSandboxProviderStore(options) {
+  const { persistenceStore } = options;
+  if (!isTrueFoundryModeEnabled2(configuration2)) {
+    return () => persistenceStore;
+  }
+  return (c) => new TrueFoundrySandboxProviderStore({
+    accessToken: requireRequestCredentialToken(c)
+  });
+}
 async function createStandalonePersistence(options) {
   const { sqlitePath, logger } = options;
   await mkdir5(path6.dirname(sqlitePath), { recursive: true });
@@ -16630,16 +16969,17 @@ async function createStandalonePersistence(options) {
     tokenStore,
     clientName: configuration2.MCP_DCR_OAUTH_CLIENT_NAME
   });
+  const sandboxProviderStore = new SqliteSandboxProviderStore2(db);
   return {
     sessionStore: new SqliteSessionStore2(db),
     sessionMetricsStore: new SqliteSessionMetricsStore2(db),
     resolveModelProviderStore: () => modelProviderStore,
     resolveMcpServerStore: () => mcpServerStore,
     resolveAgentStore: () => agentStore,
+    resolveSandboxProviderStore: () => sandboxProviderStore,
     withTransaction: (callback) => db.transaction().execute(callback),
     tokenStore,
     skillStore: new SqliteSkillStore2(db),
-    sandboxProviderStore: new SqliteSandboxProviderStore2(db),
     scheduleStore: new SqliteScheduleStore2(db),
     destroyDb: () => db.destroy(),
     redis: void 0,
@@ -16714,10 +17054,12 @@ async function createDistributedPersistence(options) {
       db,
       client: serviceFoundryClient
     }),
+    resolveSandboxProviderStore: buildResolveSandboxProviderStore({
+      persistenceStore: new PostgresSandboxProviderStore2(db)
+    }),
     withTransaction: (callback) => db.transaction().execute(callback),
     tokenStore,
     skillStore: new PostgresSkillStore2(db),
-    sandboxProviderStore: new PostgresSandboxProviderStore2(db),
     scheduleStore: new PostgresScheduleStore2(db),
     destroyDb: () => db.destroy(),
     redis: await connectRedis2({ url: redisUrl, logger }),
@@ -16731,10 +17073,10 @@ async function createServerRuntime(persistence, logger) {
     resolveModelProviderStore,
     resolveMcpServerStore,
     resolveAgentStore,
+    resolveSandboxProviderStore,
     withTransaction,
     tokenStore,
     skillStore,
-    sandboxProviderStore,
     scheduleStore,
     destroyDb,
     redis,
@@ -16783,10 +17125,10 @@ async function createServerRuntime(persistence, logger) {
     resolveModelProviderStore,
     resolveMcpServerStore,
     resolveAgentStore,
+    resolveSandboxProviderStore,
     withTransaction,
     tokenStore,
     skillStore,
-    sandboxProviderStore,
     scheduleStore,
     sessionStore,
     sessionMetricsStore,