@zhin.js/adapter-sandbox 1.0.69 → 1.1.0

package/lib/index.d.ts

@@ -1,53 +1,3 @@
-import { EventEmitter } from "events";
-import { Bot, Adapter, Message, SendOptions, MessageType, MessageElement, Plugin } from "zhin.js";
-import type { WebSocket } from "ws";
-import { Router } from "@zhin.js/http";
-export interface SandboxConfig {
-    context: "sandbox";
-    ws: WebSocket;
-    name: string;
-}
-declare module "zhin.js" {
-    namespace Plugin {
-        interface Contexts {
-            router: Router;
-            web: any;
-        }
-    }
-    interface Adapters {
-        sandbox: SandboxAdapter;
-    }
-}
-export declare class SandboxBot extends EventEmitter implements Bot<SandboxConfig, {
-    content: MessageElement[];
-    ts: number;
-}> {
-    adapter: SandboxAdapter;
-    $config: SandboxConfig;
-    $connected: boolean;
-    get $id(): string;
-    private logger;
-    constructor(adapter: SandboxAdapter, $config: SandboxConfig);
-    $connect(): Promise<void>;
-    $disconnect(): Promise<void>;
-    $formatMessage({ content, type, id, ts }: {
-        content: MessageElement[];
-        id: string;
-        type: MessageType;
-        ts: number;
-    }): Message<{
-        content: MessageElement[];
-        ts: number;
-    }>;
-    $sendMessage(options: SendOptions): Promise<string>;
-    $recallMessage(id: string): Promise<void>;
-}
-declare class SandboxAdapter extends Adapter<SandboxBot> {
-    wss?: ReturnType<Router["ws"]>;
-    constructor(plugin: Plugin);
-    createBot(config: SandboxConfig): SandboxBot;
-    start(): Promise<void>;
-    setupWebSocket(router: Router): Promise<void>;
-}
-export {};
-//# sourceMappingURL=index.d.ts.map
+export { bindSandboxWsSocket, formatSandboxOutbound, normalizeSandboxOutboundSegments, parseSandboxWsPayload, resolveSandboxEndpoint, sandboxInboundConversation, whenWsOpen, type MessageElement, type MessageType, type ResolvedSandboxBot, type SandboxAdapterConfig, type SandboxWsSocket, } from './protocol.js';
+export { SandboxClient, sandboxClient, type SandboxClientEventMap, type SandboxClientConnection, } from './client.js';
+export { SandboxWsEndpoint, type SandboxEndpointOptions, } from './endpoint.js';

package/lib/index.js

@@ -1,173 +1,3 @@
-import { EventEmitter } from "events";
-import { Adapter, usePlugin, Message, segment, } from "zhin.js";
-import path from "path";
-const plugin = usePlugin();
-const logger = plugin.logger;
-export class SandboxBot extends EventEmitter {
-    adapter;
-    $config;
-    $connected = false;
-    get $id() {
-        return this.$config.name;
-    }
-    logger = logger;
-    constructor(adapter, $config) {
-        super();
-        this.adapter = adapter;
-        this.$config = $config;
-        this.$config.ws.on("message", (data) => {
-            const message = JSON.parse(data.toString());
-            // 确保 content 是 MessageElement[] 格式
-            const content = typeof message.content === 'string'
-                ? [{ type: 'text', data: { text: message.content } }]
-                : message.content;
-            this.logger.debug(`${this.$config.name} recv  ${message.type}(${message.id}):${segment.raw(content)}`);
-            const formattedMessage = this.$formatMessage({ content: content, type: message.type, id: message.id, ts: message.timestamp });
-            this.adapter.emit("message.receive", formattedMessage);
-        });
-        this.$config.ws.on("close", () => {
-            this.logger.debug(`Sandbox bot ${this.$config.name} disconnected`);
-            this.$connected = false;
-            // 从 adapter 中移除 bot
-            this.adapter.bots.delete(this.$id);
-        });
-    }
-    async $connect() {
-        this.$connected = true;
-    }
-    async $disconnect() {
-        this.$config.ws.close();
-        this.$connected = false;
-    }
-    $formatMessage({ content, type, id, ts }) {
-        const message = Message.from({ content, ts }, {
-            $id: `${ts}`,
-            $adapter: "sandbox",
-            $bot: `${this.$config.name}`,
-            $sender: {
-                id: `${id}`,
-                name: `mock`,
-            },
-            $channel: {
-                id: `${id}`,
-                type: type,
-            },
-            $content: content,
-            $raw: segment.raw(content),
-            $timestamp: ts,
-            $recall: async () => {
-                await this.$recallMessage(message.$id);
-            },
-            $reply: async (content, quote) => {
-                if (!Array.isArray(content))
-                    content = [content];
-                if (quote)
-                    content.unshift({ type: "reply", data: { id: typeof quote === "boolean" ? message.$id : quote } });
-                return await this.adapter.sendMessage({
-                    ...message.$channel,
-                    context: "sandbox",
-                    bot: `${this.$config.name}`,
-                    content,
-                });
-            },
-        });
-        return message;
-    }
-    async $sendMessage(options) {
-        if (!this.$connected)
-            return "";
-        this.logger.debug(`${this.$config.name} send ${options.type}(${options.id}):${segment.raw(options.content)}`);
-        options.bot = this.$config.name;
-        options.context = "sandbox";
-        this.$config.ws.send(JSON.stringify({
-            ...options,
-            content: options.content, // 发送消息段数组
-            timestamp: Date.now(),
-        }));
-        return "";
-    }
-    async $recallMessage(id) {
-        // 沙盒不支持撤回消息
-    }
-}
-class SandboxAdapter extends Adapter {
-    wss;
-    constructor(plugin) {
-        super(plugin, "sandbox", []);
-    }
-    createBot(config) {
-        const bot = new SandboxBot(this, config);
-        // 将 bot 添加到 bots Map 中
-        this.bots.set(bot.$id, bot);
-        return bot;
-    }
-    async start() {
-        // start 方法会在 mounted 时被调用
-        // WebSocket server 的创建在 useContext("router") 中处理
-    }
-    async setupWebSocket(router) {
-        if (this.wss)
-            return; // 已经设置过了
-        // 创建 WebSocket server
-        this.wss = router.ws("/sandbox");
-        this.wss.on("connection", (ws, req) => {
-            // 为每个连接创建一个唯一的 bot 名称
-            const botName = `sandbox-${Math.random().toString(36).slice(2, 9)}`;
-            logger.debug(`New sandbox connection: ${botName} from ${req.socket.remoteAddress}`);
-            // 创建 bot 配置
-            const config = {
-                context: "sandbox",
-                ws,
-                name: botName,
-            };
-            // 创建并连接 bot
-            const bot = this.createBot(config);
-            bot.$connect();
-            // WebSocket 关闭时清理
-            ws.on("close", () => {
-                logger.debug(`Sandbox connection closed: ${botName}`);
-                this.bots.delete(bot.$id);
-            });
-            ws.on("error", (error) => {
-                logger.error(`Sandbox WebSocket error for ${botName}:`, error);
-            });
-        });
-        logger.debug("Sandbox WebSocket server started at /sandbox");
-    }
-}
-const { provide } = usePlugin();
-provide({
-    name: "sandbox",
-    description: "Sandbox Adapter",
-    mounted: async (p) => {
-        const adapter = new SandboxAdapter(p);
-        await adapter.start();
-        return adapter;
-    },
-    dispose: async (adapter) => {
-        // 关闭所有 bot 连接
-        for (const bot of adapter.bots.values()) {
-            await bot.$disconnect();
-        }
-        // 关闭 WebSocket server
-        adapter.wss?.close();
-        await adapter.stop();
-    },
-});
-// 使用 router 上下文创建 WebSocket server
-plugin.useContext("router", async (router) => {
-    // 等待 sandbox adapter 就绪
-    plugin.useContext("sandbox", async (adapter) => {
-        await adapter.setupWebSocket(router);
-    });
-});
-// 使用 web 上下文注册客户端入口
-plugin.useContext("web", (web) => {
-    // 注册 Sandbox 适配器的客户端入口文件
-    const dispose = web.addEntry({
-        production: path.resolve(import.meta.dirname, "../dist/index.js"),
-        development: path.resolve(import.meta.dirname, "../client/index.tsx"),
-    });
-    return dispose;
-});
-//# sourceMappingURL=index.js.map
+export { bindSandboxWsSocket, formatSandboxOutbound, normalizeSandboxOutboundSegments, parseSandboxWsPayload, resolveSandboxEndpoint, sandboxInboundConversation, whenWsOpen, } from './protocol.js';
+export { SandboxClient, sandboxClient, } from './client.js';
+export { SandboxWsEndpoint, } from './endpoint.js';

package/lib/protocol.d.ts

@@ -0,0 +1,78 @@
+/** Sandbox WebSocket wire protocol helpers (no legacy Adapter/Endpoint). */
+import type { ConversationRef } from '@zhin.js/im-contract';
+import { type SandboxAgentRunConfig } from './run-config.js';
+export type MessageType = 'private' | 'group' | 'guild' | 'direct' | 'channel';
+export interface MessageElement {
+    readonly type: string;
+    readonly data?: Record<string, unknown>;
+}
+export interface SandboxWsSocket {
+    send(data: string): void;
+    close(code?: number, reason?: string): void;
+    on?(event: 'message' | 'close' | 'error', listener: (...args: unknown[]) => void): void;
+    off?(event: 'message' | 'close' | 'error', listener: (...args: unknown[]) => void): void;
+    addEventListener?(type: 'message' | 'close' | 'error', listener: (ev: Event | MessageEvent | CloseEvent) => void): void;
+    removeEventListener?(type: 'message' | 'close' | 'error', listener: (ev: Event | MessageEvent | CloseEvent) => void): void;
+}
+export type ResolvedSandboxBot = {
+    readonly context: 'sandbox';
+    readonly id: string;
+    readonly owner: string;
+    readonly randomNamePerConnection: boolean;
+};
+export interface SandboxAdapterConfig {
+    /** Runtime expands `endpoints[i]` onto the top level — prefer these. */
+    readonly context?: string;
+    readonly id?: string;
+    readonly owner?: string;
+    /** Legacy shape: endpoint entries nested under `endpoints[]`. */
+    readonly endpoints?: ReadonlyArray<{
+        readonly context?: string;
+        readonly id?: string;
+        readonly owner?: string;
+    }>;
+}
+export declare function resolveSandboxEndpoint(appConfig: SandboxAdapterConfig): ResolvedSandboxBot;
+export declare function bindSandboxWsSocket(ws: SandboxWsSocket, handlers: {
+    onMessage: (raw: string) => void;
+    onClose: () => void;
+    onError?: (err: unknown) => void;
+}): () => void;
+export declare function parseSandboxWsPayload(raw: string): {
+    type: MessageType;
+    id: string;
+    messageId?: string;
+    content: MessageElement[];
+    timestamp: number;
+    text: string;
+    action?: {
+        id: string;
+        payload: string;
+    };
+    agentRun?: SandboxAgentRunConfig;
+};
+/**
+ * 入站归一化 → ConversationRef。sandbox 无平台社交图谱：
+ * `private`/`group`/`channel` 直映射；`direct`（私聊）归 'private'；
+ * `guild`（频道容器语义）归 'channel'。无 guild/temp 容器信息，不产生 parent。
+ */
+export declare function sandboxInboundConversation(endpointKey: string, msg: {
+    readonly type: MessageType;
+    readonly id: string;
+}): ConversationRef;
+export type SandboxOutboundChannel = {
+    readonly type?: string;
+    readonly id?: string;
+    readonly bot?: string;
+    readonly endpoint?: string;
+    readonly messageId?: string;
+};
+/** 出站段数组归一：媒体段走 MediaRef-only 归一，其余段原样透传。 */
+export declare function normalizeSandboxOutboundSegments(segments: readonly unknown[]): unknown[];
+/**
+ * Wire-encode an already-rendered outbound payload.
+ * Stamps `channel` so Console SandboxChat can filter by type+id (otherwise
+ * replies look like they disappeared).
+ */
+export declare function formatSandboxOutbound(payload: unknown, channel?: SandboxOutboundChannel): string;
+export declare function whenWsOpen(ws: SandboxWsSocket, fn: () => void): void;

package/lib/protocol.js

@@ -0,0 +1,301 @@
+/** Sandbox WebSocket wire protocol helpers (no legacy Adapter/Endpoint). */
+import { readFileSync } from 'node:fs';
+import { isMediaRef } from '@zhin.js/core';
+import { formatCompact, getLogger } from '@zhin.js/logger';
+import { normalizeSandboxAgentRunConfig, } from './run-config.js';
+const logger = getLogger('sandbox');
+export function resolveSandboxEndpoint(appConfig) {
+    const entry = appConfig.endpoints?.find((item) => item.context === 'sandbox');
+    const fixedName = typeof appConfig.id === 'string' && appConfig.id
+        ? appConfig.id
+        : typeof entry?.id === 'string' && entry.id
+            ? entry.id
+            : undefined;
+    const id = fixedName || process.env.SANDBOX_BOT_NAME || 'sandbox-bot';
+    const owner = (typeof appConfig.owner === 'string' && appConfig.owner)
+        || (typeof entry?.owner === 'string' && entry.owner)
+        || process.env.SANDBOX_BOT_OWNER
+        || 'sandbox-user';
+    return {
+        context: 'sandbox',
+        id,
+        owner,
+        // The endpoint id participates in the Agent session key. Keep it stable
+        // across browser reconnects and Host restarts so a persisted playground
+        // session resumes the same Agent context.
+        randomNamePerConnection: false,
+    };
+}
+export function bindSandboxWsSocket(ws, handlers) {
+    if (typeof ws.on === 'function') {
+        const onMessage = (...args) => {
+            const data = args[0];
+            const raw = typeof data === 'string'
+                ? data
+                : data instanceof ArrayBuffer
+                    ? new TextDecoder().decode(data)
+                    : Buffer.isBuffer(data)
+                        ? data.toString()
+                        : String(data ?? '');
+            handlers.onMessage(raw);
+        };
+        ws.on('message', onMessage);
+        ws.on('close', handlers.onClose);
+        if (handlers.onError)
+            ws.on('error', handlers.onError);
+        return () => {
+            ws.off?.('message', onMessage);
+            ws.off?.('close', handlers.onClose);
+            if (handlers.onError)
+                ws.off?.('error', handlers.onError);
+        };
+    }
+    const onMessage = (ev) => {
+        const data = ev.data;
+        handlers.onMessage(typeof data === 'string' ? data : '');
+    };
+    const onClose = () => handlers.onClose();
+    const onError = handlers.onError
+        ? () => handlers.onError?.(new Error('WebSocket error'))
+        : undefined;
+    ws.addEventListener('message', onMessage);
+    ws.addEventListener('close', onClose);
+    if (onError)
+        ws.addEventListener('error', onError);
+    return () => {
+        ws.removeEventListener('message', onMessage);
+        ws.removeEventListener('close', onClose);
+        if (onError)
+            ws.removeEventListener('error', onError);
+    };
+}
+export function parseSandboxWsPayload(raw) {
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        payload = { text: raw };
+    }
+    const type = payload.type ?? 'private';
+    const id = payload.id ?? 'sandbox-user';
+    const content = typeof payload.content === 'string'
+        ? [{ type: 'text', data: { text: payload.content } }]
+        : Array.isArray(payload.content)
+            ? payload.content
+            : [{ type: 'text', data: { text: payload.text ?? raw } }];
+    const actionSegment = content.find((segment) => segment.type === 'action');
+    let action;
+    if (actionSegment?.data) {
+        const actionPayload = typeof actionSegment.data.payload === 'string'
+            ? actionSegment.data.payload
+            : typeof actionSegment.data.id === 'string'
+                ? actionSegment.data.id
+                : '';
+        const actionId = typeof actionSegment.data.id === 'string'
+            ? actionSegment.data.id
+            : actionPayload;
+        if (actionId || actionPayload) {
+            action = { id: actionId || actionPayload, payload: actionPayload || actionId };
+        }
+    }
+    let text = content
+        .flatMap((segment) => (segment.type === 'text' && typeof segment.data?.text === 'string'
+        ? [segment.data.text]
+        : []))
+        .join('\n');
+    if (!text.trim()) {
+        text = (typeof payload.text === 'string' && payload.text.trim())
+            ? payload.text
+            : action?.payload ?? raw;
+    }
+    const agentRun = normalizeSandboxAgentRunConfig(payload.agentRun);
+    const rawMessageId = typeof payload.messageId === 'string' ? payload.messageId.trim() : '';
+    const messageId = /^[A-Za-z0-9._:-]{1,160}$/u.test(rawMessageId) ? rawMessageId : undefined;
+    return {
+        type,
+        id,
+        ...(messageId ? { messageId } : {}),
+        content,
+        timestamp: payload.timestamp ?? Date.now(),
+        text,
+        action,
+        ...(agentRun ? { agentRun } : {}),
+    };
+}
+/**
+ * 入站归一化 → ConversationRef。sandbox 无平台社交图谱：
+ * `private`/`group`/`channel` 直映射；`direct`（私聊）归 'private'；
+ * `guild`（频道容器语义）归 'channel'。无 guild/temp 容器信息，不产生 parent。
+ */
+export function sandboxInboundConversation(endpointKey, msg) {
+    const kind = msg.type === 'direct'
+        ? 'private'
+        : msg.type === 'guild'
+            ? 'channel'
+            : msg.type;
+    return {
+        endpoint: { id: endpointKey, adapter: endpointKey.split('\0')[0] ?? endpointKey },
+        kind,
+        id: msg.id,
+    };
+}
+const MEDIA_SEGMENT_TYPES = new Set(['image', 'audio', 'video', 'file']);
+/**
+ * base64 内联值：Console UI 的 resolveMediaSrc 只识别 data: / base64://
+ * 前缀；裸 base64 补前缀（有 mime_type 时拼成可直转 data: URL 的形状）。
+ */
+function toInlineBase64Value(value, mimeType) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('base64://') || trimmed.startsWith('data:'))
+        return trimmed;
+    return mimeType
+        ? `base64://${mimeType};base64,${trimmed}`
+        : `base64://${trimmed}`;
+}
+/**
+ * 出站媒体段归一（canonical MediaRef 唯一来源，不读 legacy url/file/base64/src）：
+ * - kind=url → 浏览器直连 URL，原样透传；
+ * - kind=base64 → 内联直发（补 base64:// 前缀供 Console UI 解析）；
+ * - kind=path → 读盘物化为 base64 内联（sandbox 无平台上传通道）；
+ * - kind=file → sandbox 无不透明引用通道，丢弃。
+ * 无 canonical `data.media` 的媒体段一律 warn + 丢弃。
+ */
+function normalizeMediaSegment(segment) {
+    const data = segment.data ?? {};
+    const media = data.media;
+    if (!isMediaRef(media)) {
+        logger.warn(formatCompact({
+            op: 'sandbox_outbound_media_dropped',
+            type: segment.type,
+            reason: 'missing_media_ref',
+        }));
+        return null;
+    }
+    if (media.kind === 'url')
+        return { type: segment.type, data };
+    if (media.kind === 'base64') {
+        return {
+            type: segment.type,
+            data: {
+                ...data,
+                media: { ...media, value: toInlineBase64Value(media.value, media.mime_type) },
+            },
+        };
+    }
+    if (media.kind === 'path') {
+        try {
+            const base64 = readFileSync(media.value).toString('base64');
+            return {
+                type: segment.type,
+                data: {
+                    ...data,
+                    media: {
+                        ...media,
+                        kind: 'base64',
+                        value: toInlineBase64Value(base64, media.mime_type),
+                    },
+                },
+            };
+        }
+        catch (err) {
+            logger.warn(formatCompact({
+                op: 'sandbox_outbound_media_dropped',
+                type: segment.type,
+                reason: 'path_read_failed',
+                error: err instanceof Error ? err.message : String(err),
+            }));
+            return null;
+        }
+    }
+    logger.warn(formatCompact({
+        op: 'sandbox_outbound_media_dropped',
+        type: segment.type,
+        reason: 'unsupported_media_kind',
+    }));
+    return null;
+}
+/** 出站段数组归一：媒体段走 MediaRef-only 归一，其余段原样透传。 */
+export function normalizeSandboxOutboundSegments(segments) {
+    const out = [];
+    for (const item of segments) {
+        if (item
+            && typeof item === 'object'
+            && !Array.isArray(item)
+            && MEDIA_SEGMENT_TYPES.has(String(item.type))) {
+            const normalized = normalizeMediaSegment(item);
+            if (normalized)
+                out.push(normalized);
+            continue;
+        }
+        out.push(item);
+    }
+    return out;
+}
+/**
+ * Wire-encode an already-rendered outbound payload.
+ * Stamps `channel` so Console SandboxChat can filter by type+id (otherwise
+ * replies look like they disappeared).
+ */
+export function formatSandboxOutbound(payload, channel = {}) {
+    const stamp = {};
+    if (channel.type)
+        stamp.type = channel.type;
+    if (channel.id)
+        stamp.id = channel.id;
+    if (channel.bot)
+        stamp.bot = channel.bot;
+    if (channel.endpoint)
+        stamp.endpoint = channel.endpoint;
+    if (channel.messageId)
+        stamp.messageId = channel.messageId;
+    if (typeof payload === 'string') {
+        return JSON.stringify({
+            ...stamp,
+            content: [{ type: 'text', data: { text: payload } }],
+            timestamp: Date.now(),
+        });
+    }
+    if (Array.isArray(payload)) {
+        return JSON.stringify({
+            ...stamp,
+            content: normalizeSandboxOutboundSegments(payload),
+            timestamp: Date.now(),
+        });
+    }
+    // Already a wire envelope ({ content, type, … }) — pass through so the
+    // Console UI can read `content` / `type` without an extra nesting layer.
+    // Bare segment objects ({ type: 'text', data: … }) still need wrapping.
+    if (payload
+        && typeof payload === 'object'
+        && !Array.isArray(payload)
+        && ('content' in payload
+            || 'type' in payload && 'timestamp' in payload)) {
+        const envelope = payload;
+        return JSON.stringify({
+            ...stamp,
+            ...envelope,
+            ...(Array.isArray(envelope.content)
+                ? { content: normalizeSandboxOutboundSegments(envelope.content) }
+                : {}),
+            type: envelope.type ?? stamp.type,
+            id: envelope.id ?? stamp.id,
+            timestamp: typeof envelope.timestamp === 'number' ? envelope.timestamp : Date.now(),
+        });
+    }
+    return JSON.stringify({ ...stamp, content: payload, timestamp: Date.now() });
+}
+/** WebSocket.OPEN 常量值；Node <22 无全局 WebSocket，不能用 WebSocket.OPEN。 */
+const WS_OPEN = 1;
+export function whenWsOpen(ws, fn) {
+    const std = ws;
+    if (typeof std.readyState === 'number') {
+        if (std.readyState === WS_OPEN) {
+            fn();
+            return;
+        }
+        std.addEventListener('open', fn, { once: true });
+        return;
+    }
+    fn();
+}

package/lib/run-config.d.ts

@@ -0,0 +1,10 @@
+export type SandboxSafetyMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+export type SandboxApprovalMode = 'ask' | 'deny' | 'allow';
+export interface SandboxAgentRunConfig {
+    readonly workingDirectory: string;
+    readonly safetyMode: SandboxSafetyMode;
+    readonly approvalMode: SandboxApprovalMode;
+    readonly networkAccess: boolean;
+}
+export declare const DEFAULT_SANDBOX_AGENT_RUN_CONFIG: SandboxAgentRunConfig;
+export declare function normalizeSandboxAgentRunConfig(value: unknown): SandboxAgentRunConfig | undefined;

package/lib/run-config.js

@@ -0,0 +1,30 @@
+export const DEFAULT_SANDBOX_AGENT_RUN_CONFIG = Object.freeze({
+    workingDirectory: '',
+    safetyMode: 'workspace-write',
+    approvalMode: 'ask',
+    networkAccess: false,
+});
+const SAFETY_MODES = new Set(['read-only', 'workspace-write', 'danger-full-access']);
+const APPROVAL_MODES = new Set(['ask', 'deny', 'allow']);
+export function normalizeSandboxAgentRunConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const input = value;
+    const workingDirectory = typeof input.workingDirectory === 'string'
+        ? input.workingDirectory.trim().slice(0, 4096)
+        : '';
+    const safetyMode = SAFETY_MODES.has(input.safetyMode)
+        ? input.safetyMode
+        : DEFAULT_SANDBOX_AGENT_RUN_CONFIG.safetyMode;
+    const approvalMode = APPROVAL_MODES.has(input.approvalMode)
+        ? input.approvalMode
+        : DEFAULT_SANDBOX_AGENT_RUN_CONFIG.approvalMode;
+    return Object.freeze({
+        workingDirectory,
+        safetyMode,
+        approvalMode,
+        // Full host access cannot be combined with a portable network namespace.
+        // Keep the contract honest: danger mode includes network authority.
+        networkAccess: safetyMode === 'danger-full-access' || input.networkAccess === true,
+    });
+}