@voicethere/agent 0.1.1 → 0.1.3

package/README.md

@@ -23,30 +23,25 @@ npm install
 npm run build
 ```
 
-**Voice E2E:** deploy to the VoiceThere platform or run against your organization's internal agent runner. With a local runner checkout, point it at your bundle:
-
-```bash
-AGENT_BUNDLE_PATH=/path/to/dist/agent.js npm run start
-```
-
-Open the runner URL in a browser, connect, and speak.
-
 ## Verify locally (sandbox, no WebRTC)
 
-Before deploying to VoiceThere, confirm your bundle loads and responds under the **same Node sandbox** the runner uses:
+Before deploying to VoiceThere, build your bundle and run sandbox checks (same Node `--permission` flags as production):
 
 ```bash
-npm run verify:local
+npx @voicethere/agent verify
 ```
 
-| Script                    | When to use                                                                                                               |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| `npm run verify:local`    | **Default** — `npm run build`, then fork `dist/agent.js` in the sandbox and assert a `speak` reply to `user_speech_final` |
-| `npm run verify:local:only` | Re-run smoke after build; optional `AGENT_BUNDLE_PATH=./dist/agent.js` or `--bundle <path>`                               |
+This runs a short checklist: Node version, bundle build, sandbox load, IPC `session_start`, `user_speech_final` → `speak`, and no `agent_error`. Failures print which check failed and why.
+
+| Command | When to use |
+| ------- | ----------- |
+| `npx @voicethere/agent verify` | **Default** — build `agent.ts` → `dist/agent.js`, then run all checks |
+| `npx @voicethere/agent verify --no-build` | Re-run checks on an existing bundle |
+| `npx @voicethere/agent verify --no-build --bundle ./dist/agent.js` | Verify a specific bundle path |
 
-This checks bundle load, IPC, and Node permission flags. It does **not** replace a voice roundtrip — use the VoiceThere agent runner (platform or internal deployment) for mic/WebRTC E2E.
+Optional flags: `--entry` / `-e`, `--outfile` / `-o` (same as `build`).
 
-Harness: [`scripts/sandbox/`](./scripts/sandbox/) (aligned with the agent runner child launcher).
+This does **not** replace a voice roundtrip with mic/WebRTC — deploy to the VoiceThere platform for full E2E.
 
 ## API
 
@@ -101,14 +96,15 @@ Copy [`templates/agent.ts`](./templates/agent.ts) as a starting point — exhaus
 
 ## Building your agent bundle
 
-**Recommended:** single ESM bundle (esbuild or similar):
+**Recommended:** bundle with the package CLI (same esbuild settings VoiceThere uses in production):
 
 ```bash
-npm install @voicethere/agent esbuild
-npx esbuild agent.ts --bundle --platform=node --format=esm --outfile=dist/agent.js
+npm install @voicethere/agent
+npx @voicethere/agent build
+# or: npx @voicethere/agent build --entry src/agent.ts --outfile dist/agent.js
 ```
 
-Upload `dist/agent.js` (or point `AGENT_BUNDLE_PATH` at it locally). Inlining dependencies avoids runtime `node_modules` resolution inside the sandbox.
+Defaults: entry `agent.ts`, output `dist/agent.js`. Upload the bundle (or point `AGENT_BUNDLE_PATH` at it locally). Inlining dependencies avoids runtime `node_modules` resolution inside the sandbox.
 
 ## Sandbox and security model
 
@@ -213,9 +209,10 @@ Prefer **one esbuild bundle** so production behavior matches `npm run verify:loc
 
 **Pre-publish checklist**
 
-1. `npm run build` — produce `dist/agent.js`
-2. `npm run verify:local` — sandbox + IPC smoke (same flags as production child)
-3. Optional: voice E2E with the VoiceThere agent runner (platform or internal deployment)
+1. `npx @voicethere/agent verify` — build your bundle and run sandbox checks
+2. Deploy the bundle to VoiceThere (platform upload or CLI when available)
+
+For iterative work: `npx @voicethere/agent build` then `npx @voicethere/agent verify --no-build`.
 
 ## Build outputs
 
@@ -227,11 +224,19 @@ Prefer **one esbuild bundle** so production behavior matches `npm run verify:loc
 ## Scripts
 
 ```bash
-npm run build           # library + example bundle
-npm run verify:local    # sandbox smoke (build + fork bundle)
+npm run build           # compile SDK + example bundle (repo dev)
+npm run build:lib       # compile SDK only (tsc → dist/)
+npm run verify:local    # repo dev: build example + sandbox verify
 npm run test:ci         # typecheck + vitest
 ```
 
+Customer project:
+
+```bash
+npx @voicethere/agent build    # bundle agent.ts → dist/agent.js
+npx @voicethere/agent verify   # build + sandbox checks
+```
+
 ## Release
 
 See [`scripts/RELEASE.md`](./scripts/RELEASE.md) — tag `release/X.Y.Z` triggers npm publish (same workflow pattern as [`node-webrtc-rust`](https://github.com/akirilyuk/node-webrtc-rust)).

package/dist/build-bundle.d.ts

@@ -0,0 +1,14 @@
+import * as esbuild from "esbuild";
+export interface BuildAgentBundleOptions {
+    /** Agent source entry (TypeScript or JavaScript). */
+    entry: string;
+    /** Output bundle path (typically `dist/agent.js`). */
+    outfile: string;
+    /** Working directory for relative paths. Defaults to `process.cwd()`. */
+    cwd?: string;
+}
+/**
+ * Bundle customer agent source into a single ESM file for the sandboxed child.
+ */
+export declare function buildAgentBundle(options: BuildAgentBundleOptions): Promise<esbuild.BuildResult>;
+//# sourceMappingURL=build-bundle.d.ts.map

package/dist/build-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-bundle.d.ts","sourceRoot":"","sources":["../src/build-bundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAoB9B"}

package/dist/build-bundle.js

@@ -0,0 +1,25 @@
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import * as esbuild from "esbuild";
+/**
+ * Bundle customer agent source into a single ESM file for the sandboxed child.
+ */
+export async function buildAgentBundle(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const entry = resolve(cwd, options.entry);
+    const outfile = resolve(cwd, options.outfile);
+    if (!existsSync(entry)) {
+        throw new Error(`Entry not found: ${entry}`);
+    }
+    mkdirSync(dirname(outfile), { recursive: true });
+    return esbuild.build({
+        entryPoints: [entry],
+        bundle: true,
+        platform: "node",
+        format: "esm",
+        outfile,
+        target: "node22",
+        logLevel: "warning",
+    });
+}
+//# sourceMappingURL=build-bundle.js.map

package/dist/build-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-bundle.js","sourceRoot":"","sources":["../src/build-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAWnC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,OAAO,OAAO,CAAC,KAAK,CAAC;QACnB,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,KAAK;QACb,OAAO;QACP,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+/**
+ * Customer-facing CLI — bundle and verify voice agents for VoiceThere.
+ *
+ *   npx @voicethere/agent build
+ *   npx @voicethere/agent verify
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG"}

package/dist/cli.js

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+/**
+ * Customer-facing CLI — bundle and verify voice agents for VoiceThere.
+ *
+ *   npx @voicethere/agent build
+ *   npx @voicethere/agent verify
+ */
+import { buildAgentBundle } from "./build-bundle.js";
+import { DEFAULT_VERIFY_BUNDLE, DEFAULT_VERIFY_ENTRY, } from "./verify/lib.js";
+import { formatVerifyFailure, runAgentVerify, } from "./verify/run-verify.js";
+const DEFAULT_ENTRY = DEFAULT_VERIFY_ENTRY;
+const DEFAULT_OUTFILE = DEFAULT_VERIFY_BUNDLE;
+function printHelp() {
+    process.stdout.write(`@voicethere/agent — bundle and verify your voice agent
+
+Usage:
+  npx @voicethere/agent
+  npx @voicethere/agent build [options]
+  npx @voicethere/agent verify [options]
+
+Commands:
+  build    Bundle agent source to a single ESM file
+  verify   Build (optional) and run sandbox checks on the bundle
+
+Build options:
+  --entry, -e <path>     Agent entry file (default: ${DEFAULT_ENTRY})
+  --outfile, -o <path>   Output bundle (default: ${DEFAULT_OUTFILE})
+
+Verify options:
+  --entry, -e <path>     Entry for build step (default: ${DEFAULT_ENTRY})
+  --outfile, -o <path>   Bundle output path (default: ${DEFAULT_OUTFILE})
+  --bundle, -b <path>    Bundle to verify (default: ${DEFAULT_OUTFILE})
+  --no-build             Skip build; verify an existing bundle only
+  --help, -h             Show this help
+
+Examples:
+  npm install @voicethere/agent
+  npx @voicethere/agent build --entry src/agent.ts --outfile dist/agent.js
+  npx @voicethere/agent verify
+  npx @voicethere/agent verify --no-build --bundle dist/agent.js
+`);
+}
+function parseBuildArgs(argv) {
+    let entry = DEFAULT_ENTRY;
+    let outfile = DEFAULT_OUTFILE;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+        if (arg === "--entry" || arg === "-e") {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new Error(`${arg} requires a path`);
+            }
+            entry = value;
+            i += 1;
+            continue;
+        }
+        if (arg === "--outfile" || arg === "-o") {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new Error(`${arg} requires a path`);
+            }
+            outfile = value;
+            i += 1;
+            continue;
+        }
+        throw new Error(`Unknown option: ${arg}`);
+    }
+    return { entry, outfile };
+}
+function parseVerifyArgs(argv) {
+    let entry = DEFAULT_ENTRY;
+    let outfile = DEFAULT_OUTFILE;
+    let noBuild = false;
+    let bundleArg;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+        if (arg === "--no-build") {
+            noBuild = true;
+            continue;
+        }
+        if (arg === "--entry" || arg === "-e") {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new Error(`${arg} requires a path`);
+            }
+            entry = value;
+            i += 1;
+            continue;
+        }
+        if (arg === "--outfile" || arg === "-o") {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new Error(`${arg} requires a path`);
+            }
+            outfile = value;
+            i += 1;
+            continue;
+        }
+        if (arg === "--bundle" || arg === "-b") {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new Error(`${arg} requires a path`);
+            }
+            bundleArg = value;
+            i += 1;
+            continue;
+        }
+        throw new Error(`Unknown option: ${arg}`);
+    }
+    return {
+        entry,
+        outfile,
+        bundlePath: bundleArg ?? outfile,
+        noBuild,
+    };
+}
+async function runBuild(argv) {
+    const { entry, outfile } = parseBuildArgs(argv);
+    await buildAgentBundle({ entry, outfile });
+    process.stdout.write(`Built ${outfile} from ${entry}\n`);
+}
+async function runVerify(argv) {
+    const { entry, outfile, bundlePath, noBuild } = parseVerifyArgs(argv);
+    const result = await runAgentVerify({
+        entry,
+        outfile,
+        bundlePath,
+        noBuild,
+    });
+    if (!result.ok) {
+        process.stderr.write(`[@voicethere/agent verify] FAIL: ${formatVerifyFailure(result)}\n`);
+        process.exit(1);
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0) {
+        printHelp();
+        return;
+    }
+    if (args[0] === "help" || args[0] === "--help" || args[0] === "-h") {
+        printHelp();
+        return;
+    }
+    if (args[0] === "build") {
+        await runBuild(args.slice(1));
+        return;
+    }
+    if (args[0] === "verify") {
+        await runVerify(args.slice(1));
+        return;
+    }
+    if (args[0]?.startsWith("-")) {
+        process.stderr.write("Missing command. Use `build` or `verify` before options.\n\n");
+        printHelp();
+        process.exit(1);
+    }
+    process.stderr.write(`Unknown command: ${args[0]}\n\n`);
+    printHelp();
+    process.exit(1);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`[@voicethere/agent] ${message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;sDAY+B,aAAa;mDAChB,eAAe;;;0DAGR,aAAa;wDACf,eAAe;sDACjB,eAAe;;;;;;;;;CASpE,CAAC,CAAC;AACH,CAAC;AAYD,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,KAAK,GAAG,aAAa,CAAC;IAC1B,IAAI,OAAO,GAAG,eAAe,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,IAAI,KAAK,GAAG,aAAa,CAAC;IAC1B,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAA6B,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO;QACP,UAAU,EAAE,SAAS,IAAI,OAAO;QAChC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IACpC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAc;IACrC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,KAAK;QACL,OAAO;QACP,UAAU;QACV,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CACpE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8DAA8D,CAC/D,CAAC;QACF,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/sandbox/loader-entry.js

@@ -0,0 +1,47 @@
+/**
+ * Sandboxed child bootstrap — loads customer bundle under Node --permission.
+ *
+ * Keep in sync with the agent runner `src/child/loader-entry.js`.
+ */
+
+const bundlePath = process.env.__CHILD_BUNDLE_PATH__;
+if (!bundlePath) {
+  process.stderr.write("[child] missing __CHILD_BUNDLE_PATH__\n");
+  process.exit(1);
+}
+
+function formatArgs(args) {
+  return args.map((value) => String(value)).join(" ");
+}
+
+console.log = (...args) => {
+  process.send?.({ type: "log", level: "info", message: formatArgs(args) });
+};
+
+console.info = console.log;
+
+console.error = (...args) => {
+  process.send?.({ type: "log", level: "error", message: formatArgs(args) });
+};
+
+console.warn = (...args) => {
+  process.send?.({
+    type: "log",
+    level: "info",
+    message: `[warn] ${formatArgs(args)}`,
+  });
+};
+
+const { pathToFileURL } = await import("node:url");
+
+try {
+  await import(pathToFileURL(bundlePath).href);
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  process.send?.({
+    type: "agent_error",
+    sessionId: "",
+    message: `Bundle load failed: ${message}`,
+  });
+  process.exit(1);
+}

package/dist/sandbox/sandbox.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Node --permission flags for the customer child process.
+ *
+ * Keep in sync with the agent runner `src/child/sandbox.ts`.
+ */
+/**
+ * Node --permission flags for the customer child: no subprocesses, no fs writes.
+ * `fs` read is limited to the loader + bundle directories (no `--allow-child-process`).
+ */
+export declare function buildChildExecArgv(options: {
+    loaderDir: string;
+    bundlePath: string;
+}): string[];
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,EAAE,CAUX"}

package/dist/sandbox/sandbox.js

@@ -0,0 +1,21 @@
+/**
+ * Node --permission flags for the customer child process.
+ *
+ * Keep in sync with the agent runner `src/child/sandbox.ts`.
+ */
+import { dirname, resolve } from "node:path";
+/**
+ * Node --permission flags for the customer child: no subprocesses, no fs writes.
+ * `fs` read is limited to the loader + bundle directories (no `--allow-child-process`).
+ */
+export function buildChildExecArgv(options) {
+    const readDirs = new Set([
+        resolve(options.loaderDir),
+        resolve(dirname(options.bundlePath)),
+    ]);
+    return [
+        "--permission",
+        ...[...readDirs].map((dir) => `--allow-fs-read=${dir}`),
+    ];
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAGlC;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;QAC/B,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,cAAc;QACd,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,GAAG,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/sandbox/start-child.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Fork a customer agent bundle the same way the agent runner does (IPC + sandbox).
+ *
+ * Keep behavior aligned with runner `src/child/starter.ts`.
+ */
+import { type ChildToParentMessage, type ParentToChildMessage } from "../protocol.js";
+export interface StartSandboxedChildOptions {
+    sessionId: string;
+    bundlePath: string;
+    projectId?: string;
+    buildId?: string;
+    onStderr?: (message: string) => void;
+}
+export interface SandboxedChild {
+    pid: number;
+    bundlePath: string;
+    send(message: ParentToChildMessage): boolean;
+    kill(signal?: NodeJS.Signals): void;
+    onMessage(handler: (message: ChildToParentMessage) => void): () => void;
+    onExit(handler: (code: number | null, signal: NodeJS.Signals | null) => void): () => void;
+}
+export declare function resolveBundlePath(bundlePath: string): string;
+export declare function startSandboxedChild(options: StartSandboxedChildOptions): SandboxedChild;
+//# sourceMappingURL=start-child.d.ts.map

package/dist/sandbox/start-child.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-child.d.ts","sourceRoot":"","sources":["../../src/sandbox/start-child.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AAMxB,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACxE,MAAM,CACJ,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GACpE,MAAM,IAAI,CAAC;CACf;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,cAAc,CAiEhB"}

package/dist/sandbox/start-child.js

@@ -0,0 +1,84 @@
+/**
+ * Fork a customer agent bundle the same way the agent runner does (IPC + sandbox).
+ *
+ * Keep behavior aligned with runner `src/child/starter.ts`.
+ */
+import { fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ALLOWED_CHILD_ENV_KEYS, } from "../protocol.js";
+import { buildChildExecArgv } from "./sandbox.js";
+const SANDBOX_DIR = dirname(fileURLToPath(import.meta.url));
+const LOADER_ENTRY = join(SANDBOX_DIR, "loader-entry.js");
+export function resolveBundlePath(bundlePath) {
+    const resolved = resolve(bundlePath.trim());
+    if (!existsSync(resolved)) {
+        throw new Error(`Bundle not found: ${resolved}`);
+    }
+    return resolved;
+}
+export function startSandboxedChild(options) {
+    const bundlePath = resolveBundlePath(options.bundlePath);
+    const env = {
+        NODE_ENV: "production",
+        __CHILD_BUNDLE_PATH__: bundlePath,
+    };
+    for (const key of ALLOWED_CHILD_ENV_KEYS) {
+        if (key === "SESSION_ID")
+            env[key] = options.sessionId;
+        if (key === "PROJECT_ID" && options.projectId)
+            env[key] = options.projectId;
+        if (key === "BUILD_ID" && options.buildId)
+            env[key] = options.buildId;
+    }
+    const child = fork(LOADER_ENTRY, [], {
+        env,
+        stdio: ["ignore", "pipe", "pipe", "ipc"],
+        execArgv: buildChildExecArgv({
+            loaderDir: SANDBOX_DIR,
+            bundlePath,
+        }),
+    });
+    child.stderr?.on("data", (chunk) => {
+        const message = String(chunk).trim();
+        if (message)
+            options.onStderr?.(message);
+    });
+    const messageHandlers = new Set();
+    const exitHandlers = new Set();
+    child.on("message", (message) => {
+        if (!message || typeof message !== "object")
+            return;
+        const payload = message;
+        for (const handler of messageHandlers) {
+            handler(payload);
+        }
+    });
+    child.on("exit", (code, signal) => {
+        for (const handler of exitHandlers) {
+            handler(code, signal);
+        }
+    });
+    return {
+        pid: child.pid ?? -1,
+        bundlePath,
+        send(message) {
+            if (!child.connected)
+                return false;
+            return child.send(message);
+        },
+        kill(signal = "SIGTERM") {
+            child.kill(signal);
+        },
+        onMessage(handler) {
+            messageHandlers.add(handler);
+            return () => messageHandlers.delete(handler);
+        },
+        onExit(handler) {
+            exitHandlers.add(handler);
+            return () => exitHandlers.delete(handler);
+        },
+    };
+}
+//# sourceMappingURL=start-child.js.map

package/dist/sandbox/start-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-child.js","sourceRoot":"","sources":["../../src/sandbox/start-child.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,sBAAsB,GAGvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAqB1D,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,GAAG,GAAsB;QAC7B,QAAQ,EAAE,YAAY;QACtB,qBAAqB,EAAE,UAAU;KAClC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,IAAI,GAAG,KAAK,YAAY;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QACvD,IAAI,GAAG,KAAK,YAAY,IAAI,OAAO,CAAC,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5E,IAAI,GAAG,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAiB,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE;QACjD,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;QACxC,QAAQ,EAAE,kBAAkB,CAAC;YAC3B,SAAS,EAAE,WAAW;YACtB,UAAU;SACX,CAAC;KACH,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,GAAG,EAEzB,CAAC;IAEJ,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACpD,MAAM,OAAO,GAAG,OAA+B,CAAC;QAChD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,UAAU;QACV,IAAI,CAAC,OAA6B;YAChC,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,SAAyB,SAAS;YACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,SAAS,CAAC,OAAO;YACf,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,OAAO;YACZ,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/lib.d.ts

@@ -0,0 +1,9 @@
+import type { ChildToParentMessage } from "../protocol.js";
+export declare const VERIFY_SESSION_ID = "local-verify";
+export declare const DEFAULT_VERIFY_BUNDLE = "dist/agent.js";
+export declare const DEFAULT_VERIFY_ENTRY = "agent.ts";
+export declare function parseBundleArg(argv: string[], env?: NodeJS.ProcessEnv, cwd?: string): string;
+export declare function waitForSpeak(messages: ChildToParentMessage[], sessionId: string, timeoutMs: number): Promise<Extract<ChildToParentMessage, {
+    type: "speak";
+}>>;
+//# sourceMappingURL=lib.d.ts.map

package/dist/verify/lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../../src/verify/lib.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAChD,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AACrD,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAsB,GAC1B,MAAM,CAWR;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,oBAAoB,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAuB3D"}

package/dist/verify/lib.js

@@ -0,0 +1,34 @@
+import { resolve } from "node:path";
+export const VERIFY_SESSION_ID = "local-verify";
+export const DEFAULT_VERIFY_BUNDLE = "dist/agent.js";
+export const DEFAULT_VERIFY_ENTRY = "agent.ts";
+export function parseBundleArg(argv, env = process.env, cwd = process.cwd()) {
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if ((arg === "--bundle" || arg === "-b") && argv[i + 1]) {
+            return resolve(cwd, argv[i + 1]);
+        }
+    }
+    if (env.AGENT_BUNDLE_PATH?.trim()) {
+        return resolve(cwd, env.AGENT_BUNDLE_PATH.trim());
+    }
+    return resolve(cwd, DEFAULT_VERIFY_BUNDLE);
+}
+export function waitForSpeak(messages, sessionId, timeoutMs) {
+    return new Promise((resolvePromise, reject) => {
+        const started = Date.now();
+        const timer = setInterval(() => {
+            const speak = messages.find((m) => m.type === "speak" && m.sessionId === sessionId);
+            if (speak) {
+                clearInterval(timer);
+                resolvePromise(speak);
+                return;
+            }
+            if (Date.now() - started >= timeoutMs) {
+                clearInterval(timer);
+                reject(new Error(`Timed out after ${timeoutMs}ms waiting for child speak IPC`));
+            }
+        }, 50);
+    });
+}
+//# sourceMappingURL=lib.js.map

package/dist/verify/lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../../src/verify/lib.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C,MAAM,UAAU,cAAc,CAC5B,IAAc,EACd,MAAyB,OAAO,CAAC,GAAG,EACpC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,QAAgC,EAChC,SAAiB,EACjB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAC,EAAyD,EAAE,CAC3D,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAClD,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrB,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;gBACtC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrB,MAAM,CACJ,IAAI,KAAK,CACP,mBAAmB,SAAS,gCAAgC,CAC7D,CACF,CAAC;YACJ,CAAC;QACH,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/verify/run-verify.d.ts

@@ -0,0 +1,23 @@
+export interface VerifyAgentOptions {
+    cwd?: string;
+    entry?: string;
+    outfile?: string;
+    bundlePath?: string;
+    /** When true, skip the build step and verify an existing bundle only. */
+    noBuild?: boolean;
+    /** When true, suppress per-check log lines (for tests). */
+    quiet?: boolean;
+}
+export interface VerifyCheckResult {
+    name: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface VerifyAgentResult {
+    ok: boolean;
+    checks: VerifyCheckResult[];
+    bundlePath: string;
+}
+export declare function runAgentVerify(options?: VerifyAgentOptions): Promise<VerifyAgentResult>;
+export declare function formatVerifyFailure(result: VerifyAgentResult): string;
+//# sourceMappingURL=run-verify.d.ts.map

package/dist/verify/run-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-verify.d.ts","sourceRoot":"","sources":["../../src/verify/run-verify.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAqBD,wBAAsB,cAAc,CAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAuL5B;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAQrE"}

package/dist/verify/run-verify.js

@@ -0,0 +1,176 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { buildAgentBundle } from "../build-bundle.js";
+import { startSandboxedChild } from "../sandbox/start-child.js";
+import { VERIFY_SESSION_ID, parseBundleArg, waitForSpeak, } from "./lib.js";
+const READY_MS = 300;
+const SPEAK_TIMEOUT_MS = 5000;
+const MIN_NODE_MAJOR = 22;
+function delay(ms) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));
+}
+function logLine(quiet, message) {
+    if (!quiet) {
+        process.stdout.write(`${message}\n`);
+    }
+}
+function failCheck(checks, name, detail) {
+    checks.push({ name, ok: false, detail });
+    return { ok: false, checks, bundlePath: "" };
+}
+export async function runAgentVerify(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const checks = [];
+    const quiet = options.quiet;
+    const entry = options.entry ?? "agent.ts";
+    const outfile = options.outfile ?? "dist/agent.js";
+    const bundlePath = options.bundlePath ??
+        parseBundleArg([], process.env, cwd);
+    logLine(quiet, "[@voicethere/agent verify]");
+    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    if (!Number.isFinite(nodeMajor) || nodeMajor < MIN_NODE_MAJOR) {
+        return failCheck(checks, "Node.js version", `Node ${MIN_NODE_MAJOR}+ required (--permission sandbox); found ${process.version}`);
+    }
+    checks.push({
+        name: "Node.js version",
+        ok: true,
+        detail: process.version,
+    });
+    logLine(quiet, `✓ Node.js ${process.version}`);
+    if (!options.noBuild) {
+        try {
+            await buildAgentBundle({ cwd, entry, outfile });
+            checks.push({
+                name: "Build bundle",
+                ok: true,
+                detail: `${outfile} from ${entry}`,
+            });
+            logLine(quiet, `✓ Built ${outfile} from ${entry}`);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            return failCheck(checks, "Build bundle", detail);
+        }
+    }
+    else {
+        checks.push({
+            name: "Build bundle",
+            ok: true,
+            detail: "skipped (--no-build)",
+        });
+        logLine(quiet, "○ Build bundle (skipped)");
+    }
+    const resolvedBundle = resolve(cwd, bundlePath);
+    if (!existsSync(resolvedBundle)) {
+        return failCheck(checks, "Bundle present", `Bundle not found: ${resolvedBundle}`);
+    }
+    checks.push({
+        name: "Bundle present",
+        ok: true,
+        detail: resolvedBundle,
+    });
+    logLine(quiet, `✓ Bundle present (${resolvedBundle})`);
+    const childMessages = [];
+    let childError;
+    let earlyExitCode;
+    let child;
+    try {
+        child = startSandboxedChild({
+            sessionId: VERIFY_SESSION_ID,
+            bundlePath: resolvedBundle,
+            onStderr: (message) => {
+                if (!quiet) {
+                    process.stderr.write(`[child stderr] ${message}\n`);
+                }
+            },
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return failCheck(checks, "Sandbox spawn", detail);
+    }
+    checks.push({
+        name: "Sandbox spawn",
+        ok: true,
+        detail: `pid ${child.pid}`,
+    });
+    logLine(quiet, `✓ Sandbox spawn (pid ${child.pid})`);
+    child.onMessage((message) => {
+        childMessages.push(message);
+        if (message.type === "log" && !quiet) {
+            process.stdout.write(`[child ${message.level}] ${message.message}\n`);
+        }
+        if (message.type === "agent_error") {
+            childError = message.message;
+        }
+        if (message.type === "speak" && !quiet) {
+            process.stdout.write(`[child speak] ${message.text}\n`);
+        }
+    });
+    const exitPromise = new Promise((resolveExit) => {
+        child.onExit((code) => {
+            earlyExitCode = code;
+            resolveExit(code);
+        });
+    });
+    child.send({
+        type: "session_start",
+        sessionId: VERIFY_SESSION_ID,
+        env: {
+            SESSION_ID: VERIFY_SESSION_ID,
+            PROJECT_ID: "local",
+            BUILD_ID: "verify",
+        },
+    });
+    await delay(READY_MS);
+    if (earlyExitCode !== undefined) {
+        return failCheck(checks, "Bundle load", `Child exited early with code ${earlyExitCode ?? "null"}`);
+    }
+    checks.push({ name: "Bundle load", ok: true });
+    logLine(quiet, "✓ Bundle load");
+    child.send({
+        type: "speech_event",
+        sessionId: VERIFY_SESSION_ID,
+        event: { type: "user_speech_final", text: "hello from verify" },
+    });
+    try {
+        const speak = await waitForSpeak(childMessages, VERIFY_SESSION_ID, SPEAK_TIMEOUT_MS);
+        if (!speak.text.trim()) {
+            return failCheck(checks, "Speech response", "Child returned empty speak text for user_speech_final");
+        }
+        checks.push({
+            name: "Speech response",
+            ok: true,
+            detail: speak.text.trim(),
+        });
+        logLine(quiet, `✓ Speech response (${speak.text.trim()})`);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        child.kill("SIGTERM");
+        await exitPromise;
+        return failCheck(checks, "Speech response", detail);
+    }
+    if (childError) {
+        child.kill("SIGTERM");
+        await exitPromise;
+        return failCheck(checks, "No agent errors", childError);
+    }
+    checks.push({ name: "No agent errors", ok: true });
+    logLine(quiet, "✓ No agent errors");
+    child.send({ type: "session_end", sessionId: VERIFY_SESSION_ID });
+    child.kill("SIGTERM");
+    await exitPromise;
+    logLine(quiet, "[@voicethere/agent verify] All checks passed.");
+    return { ok: true, checks, bundlePath: resolvedBundle };
+}
+export function formatVerifyFailure(result) {
+    const failed = result.checks.filter((check) => !check.ok);
+    if (failed.length === 0) {
+        return "Verify failed";
+    }
+    return failed
+        .map((check) => `${check.name}: ${check.detail ?? "failed"}`)
+        .join("; ");
+}
+//# sourceMappingURL=run-verify.js.map

package/dist/verify/run-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-verify.js","sourceRoot":"","sources":["../../src/verify/run-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,CAAC;AAyB1B,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,KAA0B,EAAE,OAAe;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,MAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;QAClB,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEvC,OAAO,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;QAC9D,OAAO,SAAS,CACd,MAAM,EACN,iBAAiB,EACjB,QAAQ,cAAc,4CAA4C,OAAO,CAAC,OAAO,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,iBAAiB;QACvB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,OAAO,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,aAAa,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,EAAE;aACnC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,EAAE,WAAW,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CACd,MAAM,EACN,gBAAgB,EAChB,qBAAqB,cAAc,EAAE,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,qBAAqB,cAAc,GAAG,CAAC,CAAC;IAEvD,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,IAAI,UAA8B,CAAC;IACnC,IAAI,aAAwC,CAAC;IAE7C,IAAI,KAA6C,CAAC;IAClD,IAAI,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC;YAC1B,SAAS,EAAE,iBAAiB;YAC5B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;gBACpB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,IAAI,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,eAAe;QACrB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,wBAAwB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,OAAO,CAAgB,CAAC,WAAW,EAAE,EAAE;QAC7D,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACpB,aAAa,GAAG,IAAI,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,iBAAiB;QAC5B,GAAG,EAAE;YACH,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,QAAQ;SACnB;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CACd,MAAM,EACN,aAAa,EACb,gCAAgC,aAAa,IAAI,MAAM,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAEhC,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,iBAAiB;QAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE;KAChE,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,aAAa,EACb,iBAAiB,EACjB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,OAAO,SAAS,CACd,MAAM,EACN,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,WAAW,CAAC;QAClB,OAAO,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,WAAW,CAAC;QAClB,OAAO,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAEpC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,WAAW,CAAC;IAElB,OAAO,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;IAEhE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voicethere/agent",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "VoiceThere customer agent SDK — IPC types and runtime helpers for sandboxed child bundles",
   "type": "module",
   "exports": {
@@ -9,18 +9,21 @@
       "import": "./dist/index.js"
     }
   },
+  "bin": "./dist/cli.js",
   "files": [
     "dist",
     "templates",
     "README.md"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json && esbuild examples/agent.ts --bundle --platform=node --format=esm --outfile=dist/agent.js",
+    "build:lib": "tsc -p tsconfig.json && mkdir -p dist/sandbox && cp src/sandbox/loader-entry.js dist/sandbox/",
+    "build:example": "node dist/cli.js build --entry examples/agent.ts --outfile dist/agent.js",
+    "build": "npm run build:lib && npm run build:example",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.test.json",
     "test": "vitest run",
     "test:ci": "npm run typecheck && npm run build && npm run test",
-    "verify:local": "npm run build && tsx scripts/verify-local.ts",
-    "verify:local:only": "tsx scripts/verify-local.ts",
+    "verify:local": "npm run build && node dist/cli.js verify --no-build --bundle dist/agent.js",
+    "verify:local:only": "node dist/cli.js verify --no-build --bundle dist/agent.js",
     "prepublishOnly": "npm run build"
   },
   "repository": {
@@ -45,14 +48,14 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@node-webrtc-rust/sdk": "0.5.2"
+    "@node-webrtc-rust/sdk": "0.5.2",
+    "esbuild": "^0.25.12"
   },
   "peerDependencies": {
     "@node-webrtc-rust/sdk": ">=0.5.2"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
-    "esbuild": "^0.25.12",
     "tsx": "^4.19.2",
     "typescript": "^5.7.0",
     "vitest": "^2.1.8"

package/templates/README.md

@@ -17,10 +17,15 @@ Full starter bundle covering every speech event from `@node-webrtc-rust/sdk/voic
 **Build:**
 
 ```bash
-npm install @voicethere/agent esbuild
-npx esbuild agent.ts --bundle --platform=node --format=esm --outfile=dist/agent.js
+npm install @voicethere/agent
+npx @voicethere/agent build
+# optional: --entry agent.ts --outfile dist/agent.js
 ```
 
-**Verify sandbox (no WebRTC):** from the agent repo, `npm run verify:local` after building your bundle.
+**Verify sandbox (no WebRTC):**
+
+```bash
+npx @voicethere/agent verify
+```
 
 **Voice E2E:** host with the VoiceThere agent runner (platform or internal deployment) — set `AGENT_BUNDLE_PATH` to your built `dist/agent.js`.

package/templates/agent.ts

@@ -6,7 +6,10 @@
  *
  * Build:
  *   npm install @voicethere/agent
- *   npx esbuild agent.ts --bundle --platform=node --format=esm --outfile=dist/agent.js
+ *   npx @voicethere/agent build
+ *
+ * Verify (sandbox checks, no WebRTC):
+ *   npx @voicethere/agent verify
  *
  * Voice E2E (VoiceThere agent runner — platform or internal deployment):
  *   AGENT_BUNDLE_PATH=./dist/agent.js npm run start