@xenosystem/agent-interface-host 0.1.4 → 0.1.6

package/dist/isolation/CommandStream.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Streaming counterpart to `CommandExecutionPort` — ADE step 9.
+ *
+ * `execute()` buffers to completion and answers once. No parameter turns that
+ * into a terminal. This is the other shape: output as it appears, plus a
+ * writable stdin, plus an explicit EOF that is a DROP rather than a flush.
+ *
+ * ## Why it is not more fields on the buffered port
+ *
+ * A stream is not a `Promise<Result>`. Pretending otherwise would force every
+ * one-shot caller to invent a listener they do not want, and every streaming
+ * caller to wait for a result that has not happened yet. The two sit beside
+ * each other, created from the same sandbox binding, so a composition cannot
+ * confine `runCommand` and leave the PTY on the host by forgetting a second
+ * wiring.
+ *
+ * ## Three things this must not get wrong
+ *
+ * All three are defects `xeno-use` actually hit:
+ *
+ * - **A chunk is BYTES, not text.** A multi-byte UTF-8 sequence can straddle a
+ *   drain boundary. Decode with a streaming decoder at the surface that needs
+ *   a string — never per chunk at the port.
+ * - **EOF is a DROP (`closeStdin`), not a flush.** Flushing stdin does not
+ *   close it; the child never sees EOF and runs to its timeout.
+ * - **ASK THE CAPABILITY.** Streaming is a property of the runtime. The
+ *   broker protocol can stream; the Unix-domain transport is a separate
+ *   refusal. Assuming the stream exists works against one runtime and
+ *   fails against another.
+ */
+export interface CommandStreamRequest {
+    argv: readonly [string, ...string[]];
+    cwd: string;
+    /**
+     * REQUIRED. The substrate refuses an unbounded stream for the same reason
+     * the buffered port does: a wedged child becomes a wedged caller.
+     */
+    timeoutMs: number;
+    /**
+     * Ask for a PTY. Default off — streaming bytes is not a terminal.
+     * Ignored unless the runtime advertised `supports_exec_tty`.
+     */
+    tty?: boolean;
+}
+export interface CommandStreamChunk {
+    stream: 'stdout' | 'stderr';
+    bytes: Uint8Array;
+}
+export interface CommandStreamExit {
+    exitCode: number | null;
+    timedOut: boolean;
+}
+export interface CommandStreamListener {
+    onChunk(chunk: CommandStreamChunk): void;
+    onExit(exit: CommandStreamExit): void;
+}
+export interface CommandStreamSession {
+    /** Bytes for stdin, exactly as given. */
+    write(bytes: Uint8Array): Promise<void>;
+    /**
+     * EOF. Distinct from `kill`: a program waiting on stdin must be told
+     * "no more input" without the caller giving up the ability to stop it.
+     */
+    closeStdin(): Promise<void>;
+    kill(): Promise<void>;
+    /**
+     * False unless this session asked for a terminal AND the runtime
+     * advertised `supports_exec_tty`. A pipe is not a TTY.
+     */
+    readonly tty: boolean;
+    /**
+     * PTY size. A pipe must refuse — resizing one talks to nothing.
+     */
+    resize(cols: number, rows: number): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+}
+export interface CommandStreamStartResult {
+    session?: CommandStreamSession;
+    error?: string;
+}
+export interface CommandStreamPort {
+    start(request: CommandStreamRequest, listener: CommandStreamListener): Promise<CommandStreamStartResult>;
+}
+/**
+ * Decodes UTF-8 ACROSS chunk boundaries.
+ *
+ * 🔴 Per-chunk `toString()` (or a fresh `TextDecoder` each time) corrupts a
+ * multi-byte character that straddles two drains — silently, as U+FFFD in the
+ * agent's terminal, looking like the program's own output.
+ */
+export declare class Utf8StreamDecoder {
+    #private;
+    push(bytes: Uint8Array): string;
+    flush(): string;
+}
+//# sourceMappingURL=CommandStream.d.ts.map

package/dist/isolation/CommandStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandStream.d.ts","sourceRoot":"","sources":["../../src/isolation/CommandStream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACpC,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACxC,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,oBAAoB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CACH,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;;IAG5B,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAI/B,KAAK,IAAI,MAAM;CAGhB"}

package/dist/isolation/CommandStream.js

@@ -0,0 +1,47 @@
+/**
+ * Streaming counterpart to `CommandExecutionPort` — ADE step 9.
+ *
+ * `execute()` buffers to completion and answers once. No parameter turns that
+ * into a terminal. This is the other shape: output as it appears, plus a
+ * writable stdin, plus an explicit EOF that is a DROP rather than a flush.
+ *
+ * ## Why it is not more fields on the buffered port
+ *
+ * A stream is not a `Promise<Result>`. Pretending otherwise would force every
+ * one-shot caller to invent a listener they do not want, and every streaming
+ * caller to wait for a result that has not happened yet. The two sit beside
+ * each other, created from the same sandbox binding, so a composition cannot
+ * confine `runCommand` and leave the PTY on the host by forgetting a second
+ * wiring.
+ *
+ * ## Three things this must not get wrong
+ *
+ * All three are defects `xeno-use` actually hit:
+ *
+ * - **A chunk is BYTES, not text.** A multi-byte UTF-8 sequence can straddle a
+ *   drain boundary. Decode with a streaming decoder at the surface that needs
+ *   a string — never per chunk at the port.
+ * - **EOF is a DROP (`closeStdin`), not a flush.** Flushing stdin does not
+ *   close it; the child never sees EOF and runs to its timeout.
+ * - **ASK THE CAPABILITY.** Streaming is a property of the runtime. The
+ *   broker protocol can stream; the Unix-domain transport is a separate
+ *   refusal. Assuming the stream exists works against one runtime and
+ *   fails against another.
+ */
+/**
+ * Decodes UTF-8 ACROSS chunk boundaries.
+ *
+ * 🔴 Per-chunk `toString()` (or a fresh `TextDecoder` each time) corrupts a
+ * multi-byte character that straddles two drains — silently, as U+FFFD in the
+ * agent's terminal, looking like the program's own output.
+ */
+export class Utf8StreamDecoder {
+    #decoder = new TextDecoder('utf-8', { fatal: false });
+    push(bytes) {
+        return this.#decoder.decode(bytes, { stream: true });
+    }
+    flush() {
+        return this.#decoder.decode();
+    }
+}
+//# sourceMappingURL=CommandStream.js.map

package/dist/isolation/CommandStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandStream.js","sourceRoot":"","sources":["../../src/isolation/CommandStream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAgEH;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACnB,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAE9D,IAAI,CAAC,KAAiB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;CACF"}

package/dist/isolation/RunExecutionEnvironment.d.ts

@@ -39,6 +39,7 @@
  * matters: `runObservationBinder.begin` is handed `{ runId, conversationId }`.
  */
 import type { CommandExecutionPort } from './CommandExecution.js';
+import type { CommandStreamPort } from './CommandStream.js';
 import type { RunIsolation, RunIsolationReport, RunIsolationSource } from './RunIsolationService.js';
 import { type SandboxCommandMount } from './SandboxCommandExecutor.js';
 /** What confines a run, when something does. Supplied by the composition. */
@@ -59,6 +60,13 @@ export interface RunSandboxBinding {
 export interface RunExecutionResolution {
     executor: CommandExecutionPort;
     isolation: RunIsolationReport;
+    /**
+     * Present only when this run is confined. The PTY and fire-and-forget
+     * terminal read it; without one they keep the host `node-pty` / `spawn`.
+     * Absent on an unconfined run is a fact, not a gap — there is no sandbox
+     * stream to hand them.
+     */
+    stream?: CommandStreamPort;
 }
 /**
  * A sandbox that is still being created.
@@ -88,6 +96,7 @@ export interface RunExecutionEnvironmentOptions {
      */
     localExecutor?: CommandExecutionPort;
     createSandboxExecutor?: (binding: RunSandboxBinding) => CommandExecutionPort;
+    createSandboxStream?: (binding: RunSandboxBinding) => CommandStreamPort;
 }
 export declare class RunExecutionEnvironment implements RunIsolationSource {
     #private;
@@ -125,6 +134,12 @@ export declare class RunExecutionEnvironment implements RunIsolationSource {
      * into a confident all-clear.
      */
     resolve(runId: string | undefined): RunExecutionResolution;
+    /**
+     * The single lookup, keyed the way call sites actually know a run — by
+     * conversation. `executorFor` and the agent's Bash tool both read this so
+     * argv and the executor describe the same destination.
+     */
+    resolutionForConversation(conversationId: string | undefined): RunExecutionResolution;
     /** The executor for a CONVERSATION's current run — the identity call sites have. */
     executorFor(conversationId: string | undefined): CommandExecutionPort;
     /** `RunIsolationSource`. Same lookup, so it cannot disagree with the executor. */

package/dist/isolation/RunExecutionEnvironment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RunExecutionEnvironment.d.ts","sourceRoot":"","sources":["../../src/isolation/RunExecutionEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACpG,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAA;AAEpC,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,SAAS,EAAE,kBAAkB,CAAA;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;AAWnE,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAA;IACpC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,oBAAoB,CAAA;CAC7E;AAED,qBAAa,uBAAwB,YAAW,kBAAkB;;gBAOpD,OAAO,GAAE,8BAAmC;IAaxD;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,cAAc,EAAE,MAAM,CAAA;QACtB,OAAO,CAAC,EAAE,iBAAiB,CAAA;QAC3B;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,cAAc,CAAA;KAChC,GAAG,IAAI;IAiER,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB;IA0C1D,oFAAoF;IACpF,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB;IAKrE,kFAAkF;IAClF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI3D,qFAAqF;IACrF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;CAG9C"}
+{"version":3,"file":"RunExecutionEnvironment.d.ts","sourceRoot":"","sources":["../../src/isolation/RunExecutionEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE3D,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACpG,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAA;AAGpC,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,SAAS,EAAE,kBAAkB,CAAA;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;AAWnE,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAA;IACpC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,oBAAoB,CAAA;IAC5E,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,iBAAiB,CAAA;CACxE;AAED,qBAAa,uBAAwB,YAAW,kBAAkB;;gBAQpD,OAAO,GAAE,8BAAmC;IAsBxD;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,cAAc,EAAE,MAAM,CAAA;QACtB,OAAO,CAAC,EAAE,iBAAiB,CAAA;QAC3B;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,cAAc,CAAA;KAChC,GAAG,IAAI;IAgFR,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB;IA6C1D;;;;OAIG;IACH,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB;IAKrF,oFAAoF;IACpF,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB;IAIrE,kFAAkF;IAClF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI3D,qFAAqF;IACrF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;CAG9C"}

package/dist/isolation/RunExecutionEnvironment.js

@@ -40,12 +40,14 @@
  */
 import { LocalCommandExecutor } from './LocalCommandExecutor.js';
 import { SandboxCommandExecutor, } from './SandboxCommandExecutor.js';
+import { SandboxCommandStream } from './SandboxCommandStream.js';
 export class RunExecutionEnvironment {
     #runs = new Map();
     /** conversationId → runId. Rebuilt on bind/release so it cannot outlive its run. */
     #byConversation = new Map();
     #localExecutor;
     #createSandboxExecutor;
+    #createSandboxStream;
     constructor(options = {}) {
         this.#localExecutor = options.localExecutor ?? new LocalCommandExecutor();
         this.#createSandboxExecutor =
@@ -56,6 +58,14 @@ export class RunExecutionEnvironment {
                     sandboxId: binding.sandboxId,
                     mount: binding.mount,
                 }));
+        this.#createSandboxStream =
+            options.createSandboxStream ??
+                ((binding) => new SandboxCommandStream({
+                    baseUrl: binding.baseUrl,
+                    token: binding.token,
+                    sandboxId: binding.sandboxId,
+                    mount: binding.mount,
+                }));
     }
     /**
      * Records where a run executes.
@@ -70,26 +80,30 @@ export class RunExecutionEnvironment {
         if (context.sandbox) {
             record.sandbox = {
                 executor: this.#createSandboxExecutor(context.sandbox),
+                stream: this.#createSandboxStream(context.sandbox),
                 mechanism: context.sandbox.mechanism,
             };
         }
         else if (context.pendingSandbox) {
-            const pending = { executor: undefined, failed: false };
+            const pending = { failed: false };
             const ready = context.pendingSandbox.then((binding) => {
                 if (!binding) {
                     pending.failed = true;
                     return undefined;
                 }
-                pending.executor = this.#createSandboxExecutor(binding);
+                const pair = {
+                    executor: this.#createSandboxExecutor(binding),
+                    stream: this.#createSandboxStream(binding),
+                };
                 const current = this.#runs.get(context.runId);
                 // Only if this record is still the live one: a second run on the same
                 // conversation, or a release, must not be overwritten by a container
                 // that finished spawning for a run nobody is watching any more.
                 if (current === record) {
-                    current.sandbox = { executor: pending.executor, mechanism: binding.mechanism };
+                    current.sandbox = { ...pair, mechanism: binding.mechanism };
                     delete current.pending;
                 }
-                return pending.executor;
+                return pair;
             }, () => {
                 pending.failed = true;
                 return undefined;
@@ -100,8 +114,8 @@ export class RunExecutionEnvironment {
                 // spawn do not each try to create a container.
                 executor: {
                     execute: async (request) => {
-                        const executor = await ready;
-                        if (!executor) {
+                        const pair = await ready;
+                        if (!pair) {
                             // Refused, never run locally. The whole point of waiting is that
                             // no command escapes to the host; falling back here would undo it
                             // at the one moment it matters.
@@ -114,7 +128,18 @@ export class RunExecutionEnvironment {
                                 error: 'The sandbox for this run could not be created, so the command was not run.',
                             };
                         }
-                        return await executor.execute(request);
+                        return await pair.executor.execute(request);
+                    },
+                },
+                stream: {
+                    start: async (request, listener) => {
+                        const pair = await ready;
+                        if (!pair) {
+                            return {
+                                error: 'The sandbox for this run could not be created, so the stream was not started.',
+                            };
+                        }
+                        return await pair.stream.start(request, listener);
                     },
                 },
             };
@@ -162,6 +187,7 @@ export class RunExecutionEnvironment {
         if (record.sandbox) {
             return {
                 executor: record.sandbox.executor,
+                stream: record.sandbox.stream,
                 isolation: { isolation: 'sandboxed', mechanism: record.sandbox.mechanism },
             };
         }
@@ -173,6 +199,7 @@ export class RunExecutionEnvironment {
             if (record.pending.failed) {
                 return {
                     executor: record.pending.executor,
+                    stream: record.pending.stream,
                     isolation: {
                         isolation: 'unknown',
                         reason: 'The sandbox for this run could not be created.',
@@ -184,15 +211,24 @@ export class RunExecutionEnvironment {
             // command can reach the host in the meantime.
             return {
                 executor: record.pending.executor,
+                stream: record.pending.stream,
                 isolation: { isolation: 'sandboxed', mechanism: 'container (starting)' },
             };
         }
         return { executor: this.#localExecutor, isolation: { isolation: 'none' } };
     }
+    /**
+     * The single lookup, keyed the way call sites actually know a run — by
+     * conversation. `executorFor` and the agent's Bash tool both read this so
+     * argv and the executor describe the same destination.
+     */
+    resolutionForConversation(conversationId) {
+        const runId = conversationId === undefined ? undefined : this.#byConversation.get(conversationId);
+        return this.resolve(runId);
+    }
     /** The executor for a CONVERSATION's current run — the identity call sites have. */
     executorFor(conversationId) {
-        const runId = conversationId === undefined ? undefined : this.#byConversation.get(conversationId);
-        return this.resolve(runId).executor;
+        return this.resolutionForConversation(conversationId).executor;
     }
     /** `RunIsolationSource`. Same lookup, so it cannot disagree with the executor. */
     isolationFor(runId) {

package/dist/isolation/RunExecutionEnvironment.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunExecutionEnvironment.js","sourceRoot":"","sources":["../../src/isolation/RunExecutionEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAA;AA+DpC,MAAM,OAAO,uBAAuB;IACzB,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC7C,oFAAoF;IAC3E,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC3C,cAAc,CAAsB;IACpC,sBAAsB,CAAsD;IAErF,YAAY,UAA0C,EAAE;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,oBAAoB,EAAE,CAAA;QACzE,IAAI,CAAC,sBAAsB;YACzB,OAAO,CAAC,qBAAqB;gBAC7B,CAAC,CAAC,OAAO,EAAE,EAAE,CACX,IAAI,sBAAsB,CAAC;oBACzB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC,CAAA;IACT,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAYJ;QACC,MAAM,MAAM,GAAc,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAA;QACpE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACtD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;aACrC,CAAA;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,SAA6C,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CACvC,CAAC,OAAO,EAAE,EAAE;gBACV,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAA;oBACrB,OAAO,SAAS,CAAA;gBAClB,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;gBACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7C,sEAAsE;gBACtE,qEAAqE;gBACrE,gEAAgE;gBAChE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;oBAC9E,OAAO,OAAO,CAAC,OAAO,CAAA;gBACxB,CAAC;gBACD,OAAO,OAAO,CAAC,QAAQ,CAAA;YACzB,CAAC,EACD,GAAG,EAAE;gBACH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAA;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC,CACF,CAAA;YACD,MAAM,CAAC,OAAO,GAAG;gBACf,MAAM,EAAE,KAAK;gBACb,wEAAwE;gBACxE,+CAA+C;gBAC/C,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;wBACzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAA;wBAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,iEAAiE;4BACjE,kEAAkE;4BAClE,gCAAgC;4BAChC,OAAO;gCACL,MAAM,EAAE,EAAE;gCACV,MAAM,EAAE,EAAE;gCACV,QAAQ,EAAE,IAAI;gCACd,QAAQ,EAAE,KAAK;gCACf,SAAS,EAAE,KAAK;gCAChB,KAAK,EAAE,4EAA4E;6BACpF,CAAA;wBACH,CAAC;wBACD,OAAO,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oBACxC,CAAC;iBACF;aACF,CAAA;YACD,iEAAiE;YACjE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;gBAC9C,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM;gBACzB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxB,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAyB;QAC/B,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,SAAS,EAAE;oBACT,SAAS,EAAE,SAAS;oBACpB,MAAM,EAAE,8DAA8D;iBACvE;aACF,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACjC,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;aAC3E,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;oBACjC,SAAS,EAAE;wBACT,SAAS,EAAE,SAAS;wBACpB,MAAM,EAAE,gDAAgD;qBACzD;iBACF,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,8CAA8C;YAC9C,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACjC,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,sBAAsB,EAAE;aACzE,CAAA;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED,oFAAoF;IACpF,WAAW,CAAC,cAAkC;QAC5C,MAAM,KAAK,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACjG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAA;IACrC,CAAC;IAED,kFAAkF;IAClF,YAAY,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAA;IACtC,CAAC;IAED,qFAAqF;IACrF,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;IAChD,CAAC;CACF"}
+{"version":3,"file":"RunExecutionEnvironment.js","sourceRoot":"","sources":["../../src/isolation/RunExecutionEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAuEhE,MAAM,OAAO,uBAAuB;IACzB,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC7C,oFAAoF;IAC3E,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC3C,cAAc,CAAsB;IACpC,sBAAsB,CAAsD;IAC5E,oBAAoB,CAAmD;IAEhF,YAAY,UAA0C,EAAE;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,oBAAoB,EAAE,CAAA;QACzE,IAAI,CAAC,sBAAsB;YACzB,OAAO,CAAC,qBAAqB;gBAC7B,CAAC,CAAC,OAAO,EAAE,EAAE,CACX,IAAI,sBAAsB,CAAC;oBACzB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC,CAAA;QACP,IAAI,CAAC,oBAAoB;YACvB,OAAO,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,OAAO,EAAE,EAAE,CACX,IAAI,oBAAoB,CAAC;oBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC,CAAA;IACT,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAYJ;QACC,MAAM,MAAM,GAAc,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAA;QACpE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACtD,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;gBAClD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;aACrC,CAAA;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CACvC,CAAC,OAAO,EAAE,EAAE;gBACV,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAA;oBACrB,OAAO,SAAS,CAAA;gBAClB,CAAC;gBACD,MAAM,IAAI,GAAG;oBACX,QAAQ,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;oBAC9C,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;iBAC3C,CAAA;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7C,sEAAsE;gBACtE,qEAAqE;gBACrE,gEAAgE;gBAChE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;oBAC3D,OAAO,OAAO,CAAC,OAAO,CAAA;gBACxB,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC,EACD,GAAG,EAAE;gBACH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAA;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC,CACF,CAAA;YACD,MAAM,CAAC,OAAO,GAAG;gBACf,MAAM,EAAE,KAAK;gBACb,wEAAwE;gBACxE,+CAA+C;gBAC/C,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;wBACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAA;wBACxB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,iEAAiE;4BACjE,kEAAkE;4BAClE,gCAAgC;4BAChC,OAAO;gCACL,MAAM,EAAE,EAAE;gCACV,MAAM,EAAE,EAAE;gCACV,QAAQ,EAAE,IAAI;gCACd,QAAQ,EAAE,KAAK;gCACf,SAAS,EAAE,KAAK;gCAChB,KAAK,EAAE,4EAA4E;6BACpF,CAAA;wBACH,CAAC;wBACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oBAC7C,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;wBACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAA;wBACxB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,OAAO;gCACL,KAAK,EAAE,+EAA+E;6BACvF,CAAA;wBACH,CAAC;wBACD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;oBACnD,CAAC;iBACF;aACF,CAAA;YACD,iEAAiE;YACjE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;gBAC9C,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM;gBACzB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxB,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAyB;QAC/B,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,SAAS,EAAE;oBACT,SAAS,EAAE,SAAS;oBACpB,MAAM,EAAE,8DAA8D;iBACvE;aACF,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACjC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC7B,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;aAC3E,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;oBACjC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;oBAC7B,SAAS,EAAE;wBACT,SAAS,EAAE,SAAS;wBACpB,MAAM,EAAE,gDAAgD;qBACzD;iBACF,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,8CAA8C;YAC9C,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACjC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC7B,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,sBAAsB,EAAE;aACzE,CAAA;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;OAIG;IACH,yBAAyB,CAAC,cAAkC;QAC1D,MAAM,KAAK,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACjG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,oFAAoF;IACpF,WAAW,CAAC,cAAkC;QAC5C,OAAO,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAA;IAChE,CAAC;IAED,kFAAkF;IAClF,YAAY,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAA;IACtC,CAAC;IAED,qFAAqF;IACrF,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;IAChD,CAAC;CACF"}

package/dist/isolation/RunIsolationService.d.ts

@@ -14,7 +14,9 @@
  * for this repo, and its gate requires an out-of-mount write to be refused **by
  * the substrate, not by a rule inside the shell it runs in**. So nothing here
  * confines anything. It answers one question — *is this run contained?* — and
- * answers it honestly while the answer is still "no".
+ * answers it honestly. Unconfigured is `none`. A composition that bound
+ * `pendingSandbox` can report `sandboxed`. Deriving that from the observer
+ * alone is still refused.
  *
  * That ordering is not a compromise. A surface that can display containment is
  * the thing that makes adopting a sandbox observable: land the adapter and the
@@ -38,8 +40,9 @@
  * rather than a boolean. The three are genuinely different facts:
  *
  * - `none` — POSITIVE knowledge that nothing confines this run. When no source
- *   is configured at all, this is what the host knows: execution goes through
- *   `WorkspaceHostService.runCommand` to a host process as the signed-in user.
+ *   is configured, this is what the host knows: unconfined execution still
+ *   starts a host process as the signed-in user. A configured sidecar that
+ *   failed to bind still reports `none` or `unknown`, never a silent upgrade.
  *   "No sandbox is installed" is not ignorance about containment; it is
  *   containment's absence, and the user is entitled to be told so plainly.
  * - `sandboxed` — a source answered that this run is confined.
@@ -75,8 +78,10 @@ export interface RunIsolationSource {
 /**
  * Answers "is this run contained?" for every run, with or without a source.
  *
- * 🔴 Constructed with NO source in the shipped composition today, and that path
- * is the one that must be right: it reports `none`, because that is true.
+ * The shipped composition passes `runExecutionEnvironment` as the source, so
+ * a bound sandbox reports `sandboxed` from the same lookup as the executor.
+ * The no-source path must still be right: it reports `none`, because that is
+ * true when nothing is configured.
  */
 export declare class RunIsolationService {
     #private;

package/dist/isolation/RunIsolationService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RunIsolationService.d.ts","sourceRoot":"","sources":["../../src/isolation/RunIsolationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAA;AAE3D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,YAAY,CAAA;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAC5D;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;;gBAGlB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAA;KAAO;IAIzD,4DAA4D;IAC5D,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB;CAkC1C"}
+{"version":3,"file":"RunIsolationService.d.ts","sourceRoot":"","sources":["../../src/isolation/RunIsolationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAA;AAE3D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,YAAY,CAAA;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAC5D;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;;gBAGlB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAA;KAAO;IAIzD,4DAA4D;IAC5D,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB;CAkC1C"}

package/dist/isolation/RunIsolationService.js

@@ -14,7 +14,9 @@
  * for this repo, and its gate requires an out-of-mount write to be refused **by
  * the substrate, not by a rule inside the shell it runs in**. So nothing here
  * confines anything. It answers one question — *is this run contained?* — and
- * answers it honestly while the answer is still "no".
+ * answers it honestly. Unconfigured is `none`. A composition that bound
+ * `pendingSandbox` can report `sandboxed`. Deriving that from the observer
+ * alone is still refused.
  *
  * That ordering is not a compromise. A surface that can display containment is
  * the thing that makes adopting a sandbox observable: land the adapter and the
@@ -34,8 +36,10 @@
 /**
  * Answers "is this run contained?" for every run, with or without a source.
  *
- * 🔴 Constructed with NO source in the shipped composition today, and that path
- * is the one that must be right: it reports `none`, because that is true.
+ * The shipped composition passes `runExecutionEnvironment` as the source, so
+ * a bound sandbox reports `sandboxed` from the same lookup as the executor.
+ * The no-source path must still be right: it reports `none`, because that is
+ * true when nothing is configured.
  */
 export class RunIsolationService {
     #source;

package/dist/isolation/RunIsolationService.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunIsolationService.js","sourceRoot":"","sources":["../../src/isolation/RunIsolationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AA8CH;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAgC;IAEhD,YAAY,UAA2C,EAAE;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC/B,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAA;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,iDAAiD;YACjD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,MAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,wEAAwE;YACxE,qCAAqC;YACrC,OAAO;gBACL,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACjG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAA;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;YACrC,OAAO;gBACL,SAAS,EAAE,WAAW;gBACtB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aAC3E,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC7D,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAClE,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"RunIsolationService.js","sourceRoot":"","sources":["../../src/isolation/RunIsolationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA+CH;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAgC;IAEhD,YAAY,UAA2C,EAAE;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC/B,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAA;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,iDAAiD;YACjD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,MAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,wEAAwE;YACxE,qCAAqC;YACrC,OAAO;gBACL,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACjG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAA;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;YACrC,OAAO;gBACL,SAAS,EAAE,WAAW;gBACtB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aAC3E,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC7D,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAClE,CAAA;IACH,CAAC;CACF"}

package/dist/isolation/SandboxCapabilities.d.ts

@@ -0,0 +1,28 @@
+/**
+ * What a `xeno-use` runtime can actually do — asked over HTTP, never assumed.
+ *
+ * 🔒 Redeclared rather than imported: `xeno-use` is AGPL-3.0 and this package
+ * is proprietary. The shapes are written out by hand for the same reason
+ * `SandboxCommandExecutor` redeclares the buffered exec result.
+ *
+ * ⚠️ RUNTIME-level, not per-sandbox. Answerable BEFORE any sandbox exists,
+ * because a consumer needs this when it is deciding whether it can honestly
+ * offer a confined stream at all.
+ */
+export interface SandboxRuntimeCapabilities {
+    supports_exec: boolean;
+    supports_exec_stream: boolean;
+    /**
+     * A real PTY inside the sandbox. Separate from streaming bytes, and false
+     * on the CLI runtime: `docker exec -i` is not a terminal and `-t` is refused
+     * when the caller's stdin is not one. Do not treat a stream as a TTY.
+     */
+    supports_exec_tty: boolean;
+}
+export declare function readSandboxCapabilities(data: unknown): SandboxRuntimeCapabilities;
+export declare function fetchSandboxCapabilities(options: {
+    baseUrl: string;
+    token: string;
+    fetch?: typeof globalThis.fetch;
+}): Promise<SandboxRuntimeCapabilities>;
+//# sourceMappingURL=SandboxCapabilities.d.ts.map

package/dist/isolation/SandboxCapabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxCapabilities.d.ts","sourceRoot":"","sources":["../../src/isolation/SandboxCapabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,OAAO,CAAA;IACtB,oBAAoB,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,0BAA0B,CAOjF;AAED,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAYtC"}

package/dist/isolation/SandboxCapabilities.js

@@ -0,0 +1,33 @@
+/**
+ * What a `xeno-use` runtime can actually do — asked over HTTP, never assumed.
+ *
+ * 🔒 Redeclared rather than imported: `xeno-use` is AGPL-3.0 and this package
+ * is proprietary. The shapes are written out by hand for the same reason
+ * `SandboxCommandExecutor` redeclares the buffered exec result.
+ *
+ * ⚠️ RUNTIME-level, not per-sandbox. Answerable BEFORE any sandbox exists,
+ * because a consumer needs this when it is deciding whether it can honestly
+ * offer a confined stream at all.
+ */
+export function readSandboxCapabilities(data) {
+    const record = data && typeof data === 'object' ? data : {};
+    return {
+        supports_exec: record.supports_exec === true,
+        supports_exec_stream: record.supports_exec_stream === true,
+        supports_exec_tty: record.supports_exec_tty === true,
+    };
+}
+export async function fetchSandboxCapabilities(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const baseUrl = options.baseUrl.replace(/\/+$/, '');
+    const response = await fetchImpl(`${baseUrl}/v1/use/sandbox/capabilities`, {
+        method: 'GET',
+        headers: { authorization: `Bearer ${options.token}` },
+    });
+    if (!response.ok) {
+        throw new Error(`The sandbox capabilities request failed (HTTP ${response.status}).`);
+    }
+    const body = (await response.json());
+    return readSandboxCapabilities(body.data);
+}
+//# sourceMappingURL=SandboxCapabilities.js.map

package/dist/isolation/SandboxCapabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxCapabilities.js","sourceRoot":"","sources":["../../src/isolation/SandboxCapabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,KAAK,IAAI;QAC5C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,KAAK,IAAI;QAC1D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,IAAI;KACrD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAI9C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,8BAA8B,EAAE;QACzE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAA;IAC1D,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC"}

package/dist/isolation/SandboxCommandExecutor.d.ts

@@ -5,13 +5,10 @@
  * and what decides — in ONE lookup — both that this executor serves a run and
  * that the run reports `sandboxed`. Nothing constructs this directly.
  *
- * ⚠️ What remains before a run is actually confined is the BINDING: no
- * composition yet spawns a sandbox the agent RUNS in. `XenoUseRunObserver`
- * spawns an OBSERVATION sandbox, and binding execution to that one is exactly
- * the convenient wrong turn `isolationIsNotObservation.test.ts` exists to pin —
- * a sandbox that is watched is not a sandbox that confines. Everything
- * downstream of the binding is now live, so that step is a spawn plus a
- * `bind({ sandbox })`, not a rewrite.
+ * Binding is a composition concern. `composeHost` already hands the same
+ * sandbox to observation and to `RunExecutionEnvironment.bind({ sandbox })`.
+ * `isolationIsNotObservation.test.ts` still pins the other direction: a
+ * watched sandbox is not a confined one unless execution is bound to it.
  *
  * This is the other half of the port `LocalCommandExecutor` exists beside, and
  * the reason the port was built at all: adopting a sandbox becomes a composition

package/dist/isolation/SandboxCommandExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SandboxCommandExecutor.d.ts","sourceRoot":"","sources":["../../src/isolation/SandboxCommandExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,uBAAuB,CAAA;AAE9B,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAChC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAapB;AAED,qBAAa,sBAAuB,YAAW,oBAAoB;;gBAOrD,OAAO,EAAE,6BAA6B;IAQ5C,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2FjF"}
+{"version":3,"file":"SandboxCommandExecutor.d.ts","sourceRoot":"","sources":["../../src/isolation/SandboxCommandExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,uBAAuB,CAAA;AAG9B,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAChC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAapB;AAED,qBAAa,sBAAuB,YAAW,oBAAoB;;gBAOrD,OAAO,EAAE,6BAA6B;IAQ5C,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA4FjF"}

package/dist/isolation/SandboxCommandExecutor.js

@@ -5,13 +5,10 @@
  * and what decides — in ONE lookup — both that this executor serves a run and
  * that the run reports `sandboxed`. Nothing constructs this directly.
  *
- * ⚠️ What remains before a run is actually confined is the BINDING: no
- * composition yet spawns a sandbox the agent RUNS in. `XenoUseRunObserver`
- * spawns an OBSERVATION sandbox, and binding execution to that one is exactly
- * the convenient wrong turn `isolationIsNotObservation.test.ts` exists to pin —
- * a sandbox that is watched is not a sandbox that confines. Everything
- * downstream of the binding is now live, so that step is a spawn plus a
- * `bind({ sandbox })`, not a rewrite.
+ * Binding is a composition concern. `composeHost` already hands the same
+ * sandbox to observation and to `RunExecutionEnvironment.bind({ sandbox })`.
+ * `isolationIsNotObservation.test.ts` still pins the other direction: a
+ * watched sandbox is not a confined one unless execution is bound to it.
  *
  * This is the other half of the port `LocalCommandExecutor` exists beside, and
  * the reason the port was built at all: adopting a sandbox becomes a composition
@@ -50,6 +47,7 @@
  * resolver taking a run id would put routing in the hot path and make "which
  * sandbox did this actually run in?" a question with a computed answer.
  */
+import { mintUseIdempotencyKey } from './useIdempotency.js';
 const DEFAULT_MAX_OUTPUT_BYTES = 200_000;
 /**
  * Maps a host path into container terms.
@@ -110,6 +108,7 @@ export class SandboxCommandExecutor {
                 headers: {
                     authorization: `Bearer ${this.#token}`,
                     'content-type': 'application/json',
+                    'idempotency-key': mintUseIdempotencyKey('exec'),
                 },
                 body: JSON.stringify({
                     // A LIST, unchanged. The port and the substrate agree on this, so

package/dist/isolation/SandboxCommandExecutor.js.map

@@ -1 +1 @@
-{"version":3,"file":"SandboxCommandExecutor.js","sourceRoot":"","sources":["../../src/isolation/SandboxCommandExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAwCH,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAClC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAErD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IACd,UAAU,CAAQ;IAClB,MAAM,CAAqB;IAC3B,MAAM,CAAyB;IAExC,YAAY,OAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAgC;QAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,0EAA0E;YAC1E,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,OAAO,CAAC,GAAG,oCAAoC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,CACrG,CAAA;QACH,CAAC;QAED,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAC1B,GAAG,IAAI,CAAC,QAAQ,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAC7E;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;oBACvB,GAAG;oBACH,UAAU,EAAE,OAAO,CAAC,SAAS;iBAC9B,CAAC;aACH,CACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mEAAmE;YACnE,6CAA6C;YAC7C,OAAO,IAAI,CAAC,OAAO,CACjB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CACjB,gDAAgD,QAAQ,CAAC,MAAM,IAAI,CACpE,CAAA;QACH,CAAC;QAED,IAAI,IAAqB,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAA;YAClE,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACjE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAA;QACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAEjF,OAAO;YACL,MAAM;YACN,MAAM;YACN,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,OAAO,CAAC,SAAS,KAAK,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM;SACd,CAAA;IACH,CAAC;CACF;AAED;mDACmD;AACnD,SAAS,IAAI,CACX,SAAiB,EACjB,SAAiB,EACjB,KAAa;IAEb,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9B,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC"}
+{"version":3,"file":"SandboxCommandExecutor.js","sourceRoot":"","sources":["../../src/isolation/SandboxCommandExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAkC3D,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAClC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAErD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IACd,UAAU,CAAQ;IAClB,MAAM,CAAqB;IAC3B,MAAM,CAAyB;IAExC,YAAY,OAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAgC;QAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,0EAA0E;YAC1E,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,OAAO,CAAC,GAAG,oCAAoC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,CACrG,CAAA;QACH,CAAC;QAED,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAC1B,GAAG,IAAI,CAAC,QAAQ,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAC7E;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,iBAAiB,EAAE,qBAAqB,CAAC,MAAM,CAAC;iBACjD;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;oBACvB,GAAG;oBACH,UAAU,EAAE,OAAO,CAAC,SAAS;iBAC9B,CAAC;aACH,CACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mEAAmE;YACnE,6CAA6C;YAC7C,OAAO,IAAI,CAAC,OAAO,CACjB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CACjB,gDAAgD,QAAQ,CAAC,MAAM,IAAI,CACpE,CAAA;QACH,CAAC;QAED,IAAI,IAAqB,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAA;YAClE,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACjE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAA;QACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAEjF,OAAO;YACL,MAAM;YACN,MAAM;YACN,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,OAAO,CAAC,SAAS,KAAK,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM;SACd,CAAA;IACH,CAAC;CACF;AAED;mDACmD;AACnD,SAAS,IAAI,CACX,SAAiB,EACjB,SAAiB,EACjB,KAAa;IAEb,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9B,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC"}