@xopcai/xopc 0.0.243 → 0.0.245

package/dist/src/agent/tools/repository-search.js

@@ -0,0 +1,56 @@
+import { resolveRipgrepBinary } from "../../infra/ripgrep.js";
+import { spawn } from "node:child_process";
+//#region src/agent/tools/repository-search.ts
+/** Bounded native search; unavailable tools and invalid regexes are explicit failures. */
+async function repositorySearch(cwd, args, signal) {
+	signal?.throwIfAborted();
+	const binary = await resolveRipgrepBinary();
+	return new Promise((resolve, reject) => {
+		const child = spawn(binary, [
+			"--no-config",
+			"--hidden",
+			"--glob",
+			"!.git",
+			"--glob",
+			"!node_modules",
+			...args
+		], { cwd });
+		const chunks = [];
+		let bytes = 0, truncated = false, stderr = "";
+		const timer = setTimeout(() => child.kill("SIGKILL"), 1e4);
+		const abort = () => child.kill("SIGKILL");
+		signal?.addEventListener("abort", abort, { once: true });
+		child.stdout.on("data", (chunk) => {
+			const remaining = Math.max(0, 5e4 - bytes);
+			chunks.push(chunk.subarray(0, remaining));
+			bytes += chunk.length;
+			if (bytes > 5e4) {
+				truncated = true;
+				child.kill("SIGKILL");
+			}
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr = (stderr + String(chunk)).slice(-4e3);
+		});
+		child.on("error", reject);
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			if (signal?.aborted) {
+				reject(signal.reason ?? /* @__PURE__ */ new Error("Search aborted"));
+				return;
+			}
+			if (code !== 0 && code !== 1 && !truncated) {
+				reject(new Error(stderr || "Search did not complete; check ripgrep installation or narrow the search."));
+				return;
+			}
+			resolve({
+				output: Buffer.concat(chunks).toString("utf8"),
+				truncated
+			});
+		});
+		if (signal?.aborted) abort();
+	});
+}
+//#endregion
+export { repositorySearch };

package/dist/src/agent/tools/review-workspace.d.ts

@@ -0,0 +1,2 @@
+import type { AgentTool } from '@earendil-works/pi-agent-core';
+export declare function createReviewWorkspaceTool(workspace: string): AgentTool;

package/dist/src/agent/tools/review-workspace.js

@@ -0,0 +1,103 @@
+import { readWorkspaceRevision } from "../coding/workspace-revision.js";
+import { resolve } from "node:path";
+import { execFile } from "node:child_process";
+import { lstat, readFile, readlink, realpath } from "node:fs/promises";
+import { promisify } from "node:util";
+import { Type } from "@sinclair/typebox";
+//#region src/agent/tools/review-workspace.ts
+const exec$1 = promisify(execFile);
+function createReviewWorkspaceTool(workspace) {
+	return {
+		name: "review_workspace",
+		label: "Review workspace",
+		parameters: Type.Object({}),
+		description: "Inspect the complete Git workspace diff against HEAD, including untracked text files. Includes pre-existing changes. A truncated view is explicitly incomplete; inspect large files separately. Does not modify Git state.",
+		supportsParallel: true,
+		idempotent: true,
+		async execute(_id, _args, signal) {
+			let cwd = workspace;
+			const git = async (args) => (await exec$1("git", [
+				"-c",
+				"core.fsmonitor=false",
+				...args
+			], {
+				cwd,
+				signal,
+				timeout: 1e4,
+				maxBuffer: 8 * 1024 * 1024
+			})).stdout;
+			cwd = await realpath((await git(["rev-parse", "--show-toplevel"])).trim());
+			const startRevision = await readWorkspaceRevision(cwd);
+			const head = await git([
+				"rev-parse",
+				"--verify",
+				"HEAD"
+			]).catch(() => "");
+			const [diff, names] = await Promise.all([head ? git([
+				"diff",
+				"--no-ext-diff",
+				"--no-textconv",
+				"--binary",
+				"HEAD",
+				"--"
+			]) : Promise.all([git([
+				"diff",
+				"--no-ext-diff",
+				"--no-textconv",
+				"--binary",
+				"--cached",
+				"--"
+			]), git([
+				"diff",
+				"--no-ext-diff",
+				"--no-textconv",
+				"--binary",
+				"--"
+			])]).then((parts) => parts.join("\n")), git([
+				"ls-files",
+				"--others",
+				"--exclude-standard",
+				"-z"
+			])]);
+			let text = diff.slice(0, 2e5), complete = diff.length <= 2e5;
+			for (const path of names.split("\0").filter(Boolean)) {
+				signal?.throwIfAborted();
+				if (text.length >= 2e5) {
+					complete = false;
+					break;
+				}
+				const file = resolve(cwd, path), info = await lstat(file);
+				text += `\nUntracked file: ${path}\n`;
+				if (info.isSymbolicLink()) text += `Symlink to ${await readlink(file)}\n`;
+				else if (info.isFile() && info.size <= 5e4) {
+					const content = await readFile(file);
+					if (content.includes(0)) {
+						text += "(binary file; inspect separately)\n";
+						complete = false;
+					} else text += content.toString("utf8");
+				} else {
+					text += "(large file; inspect separately)\n";
+					complete = false;
+				}
+			}
+			complete &&= text.length <= 2e5;
+			const endRevision = await readWorkspaceRevision(cwd);
+			return {
+				content: [{
+					type: "text",
+					text: `Workspace changes against HEAD (including pre-existing changes):\n${text.slice(0, 2e5) || "(clean)"}${complete ? "" : "\n[Incomplete view]"}`
+				}],
+				details: {
+					status: "success",
+					command: "review_workspace",
+					complete,
+					exitCode: 0,
+					startRevision,
+					endRevision
+				}
+			};
+		}
+	};
+}
+//#endregion
+export { createReviewWorkspaceTool };

package/dist/src/agent/tools/write.js

@@ -33,7 +33,7 @@ function createWriteFileTool(workspace, options) {
 						type: "text",
 						text: `🚫 ${safety.message}`
 					}],
-					details: {}
+					details: { status: "failed" }
 				};
 				const writesProfileFile = Boolean(options?.profileMarkdownRoot && isBareProfileMarkdownFileName(p.path));
 				const workspaceRoot = writesProfileFile ? options.profileMarkdownRoot : workspace;
@@ -47,7 +47,7 @@ function createWriteFileTool(workspace, options) {
 						type: "text",
 						text: `🚫 Sandbox: ${pathPolicy.reason}`
 					}],
-					details: {}
+					details: { status: "failed" }
 				};
 				const contentBytes = Buffer.byteLength(p.content, "utf-8");
 				if (contentBytes > MAX_FILE_SIZE) return {
@@ -55,7 +55,7 @@ function createWriteFileTool(workspace, options) {
 						type: "text",
 						text: `🚫 File too large: ${contentBytes} bytes`
 					}],
-					details: {}
+					details: { status: "failed" }
 				};
 				const target = writesProfileFile ? resolveProfileMarkdownPathIfBareName(p.path, options.profileMarkdownRoot) : resolvePathUnderWorkspace(p.path, workspace);
 				await mkdir(dirname(target), { recursive: true });
@@ -88,7 +88,7 @@ function createWriteFileTool(workspace, options) {
 						type: "text",
 						text: `Error: ${error instanceof Error ? error.message : String(error)}`
 					}],
-					details: {}
+					details: { status: "failed" }
 				};
 			}
 		}

package/dist/src/agent/transcript/index.js

@@ -1,7 +1,7 @@
-import { extractToolCallsFromAssistant, extractToolResultId, sanitizeToolCallId, sanitizeToolCallIdsForCloudCodeAssist } from "./tool-call-id.js";
-import { makeMissingToolResult, repairToolUseResultPairing, sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolResultDetails } from "./session-transcript-repair.js";
 import { resolveTranscriptPolicy } from "./transcript-policy.js";
 import { dropThinkingBlocks } from "./thinking.js";
+import { extractToolCallsFromAssistant, extractToolResultId, sanitizeToolCallId, sanitizeToolCallIdsForCloudCodeAssist } from "./tool-call-id.js";
+import { makeMissingToolResult, repairToolUseResultPairing, sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolResultDetails } from "./session-transcript-repair.js";
 import { applySessionTranscriptHygiene, applySessionTranscriptHygieneForPersistence, applySessionTranscriptHygieneWithPolicy, resolvePolicyForModel, tryApplySessionTranscriptHygiene, tryApplySessionTranscriptHygieneForPersistence } from "./transcript-hygiene.js";
 import { stripToolMessages } from "./strip-tool-messages.js";
 export { applySessionTranscriptHygiene, applySessionTranscriptHygieneForPersistence, applySessionTranscriptHygieneWithPolicy, dropThinkingBlocks, extractToolCallsFromAssistant, extractToolResultId, makeMissingToolResult, repairToolUseResultPairing, resolvePolicyForModel, resolveTranscriptPolicy, sanitizeToolCallId, sanitizeToolCallIdsForCloudCodeAssist, sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolMessages, stripToolResultDetails, tryApplySessionTranscriptHygiene, tryApplySessionTranscriptHygieneForPersistence };

package/dist/src/agent/transcript/transcript-hygiene.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { sanitizeToolCallIdsForCloudCodeAssist } from "./tool-call-id.js";
-import { sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolResultDetails } from "./session-transcript-repair.js";
 import { resolveTranscriptPolicy } from "./transcript-policy.js";
 import { dropThinkingBlocks } from "./thinking.js";
+import { sanitizeToolCallIdsForCloudCodeAssist } from "./tool-call-id.js";
+import { sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolResultDetails } from "./session-transcript-repair.js";
 //#region src/agent/transcript/transcript-hygiene.ts
 init_logger();
 const log = createLogger("transcript-hygiene");

package/dist/src/agent/workflow/subagent-runner.d.ts

@@ -10,8 +10,6 @@
  *   without ever calling `structured_output`, we treat it as failure (`null`).
  * - Failures and aborts resolve to `null`. The workflow runtime continues — this
  *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.
- * - We do NOT mutate `createDelegateChildHandle` — we just leverage its
- *   `buildChildTools` injection point.
  */
 import type { AgentTool } from '@earendil-works/pi-agent-core';
 import type { Api, Model } from '@earendil-works/pi-ai';

package/dist/src/agent/workflow/subagent-runner.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { createSqliteTranscriptRuntime } from "../embedded/transcript-runtime.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
 import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS } from "../tools/delegate-tool.js";
-import { emitSessionTranscriptUpdate } from "../../session/transcript-events.js";
 import { STRUCTURED_OUTPUT_TOOL_NAME, createStructuredOutputTool } from "./structured-output-tool.js";
 //#region src/agent/workflow/subagent-runner.ts
 init_logger();
@@ -27,24 +27,6 @@ var DelegateSubagentRunner = class {
 		}
 		const fullPrompt = buildPrompt(prompt, opts, wantStructured);
 		const streamMode = resolveSubagentStreamMode(this.deps.getConfig);
-		let transcriptPersistQueue = Promise.resolve();
-		const persistTranscriptSnapshot = opts.sessionKey && this.deps.sessionStore ? (messages) => {
-			const store = this.deps.sessionStore;
-			const key = opts.sessionKey;
-			if (!store || !key) return;
-			const snapshot = cloneAgentMessages(messages);
-			transcriptPersistQueue = transcriptPersistQueue.then(async () => {
-				await store.saveMessages(key, snapshot);
-				emitSessionTranscriptUpdate({ sessionKey: key });
-			}).catch((err) => {
-				const msg = err instanceof Error ? err.message : String(err);
-				log.warn({
-					err,
-					sessionKey: key,
-					errorMessage: msg
-				}, `Failed to persist workflow subagent transcript snapshot: ${msg}`);
-			});
-		} : void 0;
 		const childOptions = {
 			workspace: this.deps.workspace,
 			goal: fullPrompt,
@@ -72,20 +54,22 @@ var DelegateSubagentRunner = class {
 				onProgress: (event) => {
 					opts.onProgress?.(mapChildProgressEvent(event));
 				}
-			} : void 0,
-			onTranscriptSnapshot: persistTranscriptSnapshot
+			} : void 0
 		};
-		if (opts.sessionKey && opts.sessionMetadata && this.deps.sessionStore) await this.preparePersistentSubagentSession(opts.sessionKey, opts.sessionMetadata);
+		if (opts.sessionKey && opts.sessionMetadata && this.deps.sessionStore) {
+			await this.preparePersistentSubagentSession(opts.sessionKey, opts.sessionMetadata);
+			childOptions.sessionKey = opts.sessionKey;
+			childOptions.transcriptRuntime = await createSqliteTranscriptRuntime({
+				sessionKey: opts.sessionKey,
+				sessionStore: this.deps.sessionStore
+			});
+		}
 		const handle = createDelegateChildHandle(childOptions);
 		const onAbort = () => handle.abort();
 		opts.signal?.addEventListener("abort", onAbort, { once: true });
 		try {
-			const { summary, messages } = await handle.run();
-			await transcriptPersistQueue;
-			if (opts.sessionKey && this.deps.sessionStore) {
-				await this.deps.sessionStore.saveMessages(opts.sessionKey, messages);
-				emitSessionTranscriptUpdate({ sessionKey: opts.sessionKey });
-			}
+			const { summary, status } = await handle.run();
+			if (status !== "success") return null;
 			if (opts.signal?.aborted) return null;
 			if (wantStructured) {
 				if (!capture.called) {
@@ -144,9 +128,6 @@ var DelegateSubagentRunner = class {
 		});
 	}
 };
-function cloneAgentMessages(messages) {
-	return messages.map((message) => structuredClone(message));
-}
 function resolveAllowedToolNames(requested, wantStructured) {
 	const filtered = (requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS]).map((s) => String(s).trim()).filter((s) => s.length > 0).filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));
 	if (wantStructured && !filtered.includes("structured_output")) filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);

package/dist/src/agent-config/schema.d.ts

@@ -116,6 +116,13 @@ export declare const WorkflowPolicySchema: z.ZodObject<{
     allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export declare const RuntimePolicySchema: z.ZodObject<{
+    commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"host">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"docker">;
+        image: z.ZodString;
+        network: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>], "mode">>;
     maxTurns: z.ZodOptional<z.ZodNumber>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
     maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -179,6 +186,13 @@ export declare const AgentDefaultsSchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     runtime: z.ZodDefault<z.ZodObject<{
+        commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"host">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"docker">;
+            image: z.ZodString;
+            network: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -255,6 +269,13 @@ export declare const AgentEntrySchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     runtime: z.ZodOptional<z.ZodObject<{
+        commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"host">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"docker">;
+            image: z.ZodString;
+            network: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -321,6 +342,13 @@ export declare const AgentsConfigSchema: z.ZodObject<{
             allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         runtime: z.ZodDefault<z.ZodObject<{
+            commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                mode: z.ZodLiteral<"host">;
+            }, z.core.$strict>, z.ZodObject<{
+                mode: z.ZodLiteral<"docker">;
+                image: z.ZodString;
+                network: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -393,6 +421,13 @@ export declare const AgentsConfigSchema: z.ZodObject<{
             allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         runtime: z.ZodOptional<z.ZodObject<{
+            commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                mode: z.ZodLiteral<"host">;
+            }, z.core.$strict>, z.ZodObject<{
+                mode: z.ZodLiteral<"docker">;
+                image: z.ZodString;
+                network: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -465,6 +500,13 @@ export declare const EffectiveAgentConfigSchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>;
     runtime: z.ZodObject<{
+        commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"host">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"docker">;
+            image: z.ZodString;
+            network: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;

package/dist/src/agent-config/schema.js

@@ -77,6 +77,11 @@ var init_schema = __esmMin((() => {
 		allowed: z.array(z.string().min(1)).optional()
 	}).strict();
 	RuntimePolicySchema = z.object({
+		commandIsolation: z.discriminatedUnion("mode", [z.object({ mode: z.literal("host") }).strict(), z.object({
+			mode: z.literal("docker"),
+			image: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9./:_-]*@sha256:[a-f0-9]{64}$/),
+			network: z.boolean().default(false)
+		}).strict()]).optional(),
 		maxTurns: z.number().int().positive().optional(),
 		timeoutMs: z.number().int().positive().optional(),
 		maxToolFailuresPerTurn: z.number().int().positive().optional(),

package/dist/src/automations/draft/automation-draft-service.js

@@ -2,8 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
-import { buildAutomationDraftPrompt, buildAutomationDraftRepairPrompt, buildAutomationRunRepairPrompt, buildAutomationRunRepairRetryPrompt } from "./automation-draft-prompt.js";
 import { resolveDraftModelRef } from "../../workflows/draft/workflow-draft-service.js";
+import { buildAutomationDraftPrompt, buildAutomationDraftRepairPrompt, buildAutomationRunRepairPrompt, buildAutomationRunRepairRetryPrompt } from "./automation-draft-prompt.js";
 import { buildAutomationDraftResponse, parseGeneratedAutomationDraft, parseGeneratedAutomationRepairDraft } from "./automation-draft-validator.js";
 //#region src/automations/draft/automation-draft-service.ts
 init_providers();

package/dist/src/cli/commands/extension-marketplace.js

@@ -3,9 +3,9 @@ import { init_loader, loadConfig } from "../../config/loader.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { getContextWithOpts } from "../context.js";
 import { getExtensionLockfileManager } from "../../extensions/lockfile.js";
+import { fetchRegistry, findExtension, getExtensionMarketplaceStoreBaseUrl, listExtensions, searchExtensions } from "../../extensions/marketplace.js";
 import { installFromLocal, installFromNpm, peekExtensionManifestFromStoreZip } from "../../extensions/install.js";
 import { commitStagedExtensionInstall, finalizeStagedExtensionInstall, rollbackStagedExtensionInstall, stageExtensionStoreZip } from "../../extensions/install-transaction.js";
-import { fetchRegistry, findExtension, getExtensionMarketplaceStoreBaseUrl, listExtensions, searchExtensions } from "../../extensions/marketplace.js";
 import { colors } from "../utils/colors.js";
 import { validateExtensionPackageDirectory } from "./extension-pack.js";
 import { join, resolve } from "node:path";

package/dist/src/config/schema.d.ts

@@ -100,6 +100,13 @@ export declare const AgentsConfigSchema: z.ZodDefault<z.ZodObject<{
             allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         runtime: z.ZodDefault<z.ZodObject<{
+            commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                mode: z.ZodLiteral<"host">;
+            }, z.core.$strict>, z.ZodObject<{
+                mode: z.ZodLiteral<"docker">;
+                image: z.ZodString;
+                network: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -172,6 +179,13 @@ export declare const AgentsConfigSchema: z.ZodDefault<z.ZodObject<{
             allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         runtime: z.ZodOptional<z.ZodObject<{
+            commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                mode: z.ZodLiteral<"host">;
+            }, z.core.$strict>, z.ZodObject<{
+                mode: z.ZodLiteral<"docker">;
+                image: z.ZodString;
+                network: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -1569,6 +1583,13 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
             runtime: z.ZodDefault<z.ZodObject<{
+                commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    mode: z.ZodLiteral<"host">;
+                }, z.core.$strict>, z.ZodObject<{
+                    mode: z.ZodLiteral<"docker">;
+                    image: z.ZodString;
+                    network: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>], "mode">>;
                 maxTurns: z.ZodOptional<z.ZodNumber>;
                 timeoutMs: z.ZodOptional<z.ZodNumber>;
                 maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
@@ -1641,6 +1662,13 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
             runtime: z.ZodOptional<z.ZodObject<{
+                commandIsolation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    mode: z.ZodLiteral<"host">;
+                }, z.core.$strict>, z.ZodObject<{
+                    mode: z.ZodLiteral<"docker">;
+                    image: z.ZodString;
+                    network: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>], "mode">>;
                 maxTurns: z.ZodOptional<z.ZodNumber>;
                 timeoutMs: z.ZodOptional<z.ZodNumber>;
                 maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;

package/dist/src/execution-environments/local-worktree-manager.d.ts

@@ -32,6 +32,8 @@ export declare class LocalWorktreeManager {
     provisionManagedWorktree(input: ProvisionManagedWorktreeInput): Promise<ExecutionEnvironment>;
     inspect(environmentId: string): Promise<LocalWorktreeInspection>;
     reconcile(environmentId: string): Promise<ExecutionEnvironment>;
-    remove(environmentId: string): Promise<ExecutionEnvironment>;
+    remove(environmentId: string, options?: {
+        releaseSessionKey: string;
+    }): Promise<ExecutionEnvironment>;
     private cleanupFailedProvision;
 }

package/dist/src/execution-environments/local-worktree-manager.js

@@ -183,7 +183,11 @@ var LocalWorktreeManager = class {
 		const environment = this.store.getRequired(environmentId);
 		const inspection = await this.inspect(environmentId);
 		if (inspection.healthy) {
-			if (environment.status !== "degraded" && environment.status !== "provisioning") return environment;
+			if (![
+				"degraded",
+				"provisioning",
+				"error"
+			].includes(environment.status)) return environment;
 			const provisioning = environment.status === "provisioning" ? environment : this.store.transition({
 				environmentId,
 				expectedVersion: environment.version,
@@ -207,7 +211,7 @@ var LocalWorktreeManager = class {
 			error: inspection.problems.join("; ")
 		});
 	}
-	async remove(environmentId) {
+	async remove(environmentId, options) {
 		const environment = this.store.getRequired(environmentId);
 		if (environment.status === "deleted") return environment;
 		if (environment.kind === "local_checkout") {
@@ -232,7 +236,7 @@ var LocalWorktreeManager = class {
 		}
 		if (environment.kind !== "managed_worktree" || !environment.repositoryRoot || !environment.gitCommonDir) throw new Error(`Execution environment ${environmentId} is not a managed worktree`);
 		assertManagedPath(environment.rootPath, this.stateDir);
-		if (this.store.listBindings(environmentId).length > 0) throw new ExecutionEnvironmentConflictError(`Managed worktree ${environmentId} still has active bindings`);
+		if (this.store.listBindings(environmentId).some((binding) => binding.sessionKey !== options?.releaseSessionKey)) throw new ExecutionEnvironmentConflictError(`Managed worktree ${environmentId} still has active bindings`);
 		const deleting = environment.status === "deleting" ? environment : this.store.transition({
 			environmentId,
 			expectedVersion: environment.version,
@@ -274,6 +278,7 @@ var LocalWorktreeManager = class {
 					}
 				}
 			});
+			if (options?.releaseSessionKey) this.store.releaseBinding(options.releaseSessionKey, environmentId);
 			const deleted = this.store.transition({
 				environmentId,
 				expectedVersion: deleting.version,

package/dist/src/execution-environments/session-environment-service.js

@@ -19,7 +19,9 @@ var SessionEnvironmentService = class {
 		if (existing) {
 			if (existing.projectId !== input.project.id) throw new ExecutionEnvironmentConflictError(`Session ${input.sessionKey} is already bound to a different project's execution environment`);
 			if (input.mode && existing.kind !== input.mode) throw new ExecutionEnvironmentConflictError(`Session ${input.sessionKey} is already using ${existing.kind}; release it before switching to ${input.mode}`);
-			return existing;
+			const checked = existing.kind === "managed_worktree" ? await this.worktrees.reconcile(existing.id) : existing;
+			if (checked.status !== "ready") throw new ExecutionEnvironmentConflictError(`Execution environment ${checked.id} is ${checked.status}; repair it before resuming`);
+			return checked;
 		}
 		const workspaceRoot = input.project.workspaceRoot?.trim();
 		if (!workspaceRoot) throw new ExecutionEnvironmentConflictError(`Project ${input.project.id} needs a fixed workspace before an execution environment can be created`);
@@ -43,8 +45,8 @@ var SessionEnvironmentService = class {
 		const binding = this.store.resolveBinding(sessionKey);
 		if (!binding) return void 0;
 		const environment = this.store.get(binding.environmentId);
-		this.store.releaseBinding(sessionKey, binding.environmentId);
-		if (removeManaged && environment?.kind === "managed_worktree") await this.worktrees.remove(environment.id);
+		if (removeManaged && environment?.kind === "managed_worktree") await this.worktrees.remove(environment.id, { releaseSessionKey: sessionKey });
+		else this.store.releaseBinding(sessionKey, binding.environmentId);
 		return environment;
 	}
 	async resolveLocalCheckout(projectId, workspaceRoot) {

package/dist/src/extensions/update.js

@@ -4,8 +4,8 @@ import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from ".
 import { init_loader, loadConfig } from "../config/loader.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { getExtensionLockfileManager } from "./lockfile.js";
-import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
 import { findExtension } from "./marketplace.js";
+import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
 import { join } from "node:path";
 import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import semver from "semver";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -106,6 +106,13 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 allowed?: string[];
             };
             runtime: {
+                commandIsolation?: {
+                    mode: "host";
+                } | {
+                    mode: "docker";
+                    image: string;
+                    network: boolean;
+                };
                 maxTurns?: number;
                 timeoutMs?: number;
                 maxToolFailuresPerTurn?: number;

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,8 +1,8 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
-import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
+import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";