agentbox-sdk 0.1.322 → 0.1.400

package/dist/agents/index.d.ts

@@ -1,5 +1,5 @@
-import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a3 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, aa as SetupLayout } from '../types-DG4J_zMT.js';
-export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a5 as RepoSkillConfig, ac as TextPart, ag as UserContent, ah as UserContentPart } from '../types-DG4J_zMT.js';
+import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a3 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, aa as SetupLayout } from '../types-vOsvzkcO.js';
+export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a5 as RepoSkillConfig, ac as TextPart, ag as UserContent, ah as UserContentPart } from '../types-vOsvzkcO.js';
 import { S as Sandbox } from '../Sandbox-DcKAU-E3.js';
 export { AgentProvider } from '../enums.js';
 import 'e2b';
@@ -42,6 +42,23 @@ declare class Agent<P extends AgentProviderName = AgentProviderName> {
      * work.
      */
     setup(): Promise<void>;
+    /**
+     * Stop the long-lived provider CLI server booted by {@link Agent.setup}
+     * (claude-code relay daemon, codex app-server, opencode `serve`).
+     *
+     * agentbox NEVER kills a running server on its own — not on run
+     * completion, not on `abort()`, and not when {@link Agent.setup} detects
+     * a changed config/credential set. This method is the single, explicit,
+     * developer-driven teardown. Call it to free a server's resources, or to
+     * apply a changed config: after `killServer()` the next {@link setup}
+     * cold-starts a fresh server with the new configuration.
+     *
+     * Best-effort and idempotent: a no-op when no server is running, or when
+     * the provider has no shared server for the current mode (host-mode
+     * claude-code runs the SDK in-process; local codex spawns a fresh
+     * app-server per run, torn down with the run).
+     */
+    killServer(): Promise<void>;
     stream(runConfig: AgentRunConfig): AgentRun;
     run(runConfig: AgentRunConfig): Promise<AgentResult>;
     rawEvents(runConfig: AgentRunConfig): AsyncIterable<RawAgentEvent>;

package/dist/agents/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "../chunk-ZK5PDWOI.js";
+} from "../chunk-KFMFNBVC.js";
 import "../chunk-775FIGGL.js";
 import {
   AGENT_RESERVED_PORTS,

package/dist/{chunk-ZK5PDWOI.js → chunk-KFMFNBVC.js}

@@ -583,6 +583,9 @@ function buildClaudeHookSettings(hooks) {
   }
   return { hooks };
 }
+function buildClaudeWorkflowSettings(ultracode) {
+  return ultracode ? { enableWorkflows: true, ultracode: true } : {};
+}
 function buildCodexHooksFile(hooks) {
   if (!hasHookEntries(hooks)) {
     return void 0;
@@ -1228,13 +1231,14 @@ async function preflightSetup(target, setupId, daemon) {
       ];
       if (daemon) {
         const url = `http://127.0.0.1:${daemon.port}${daemon.healthPath}`;
+        const auth = daemon.curlAuthArg ? `${daemon.curlAuthArg} ` : "";
         if (daemon.expectedVersionMatch) {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
           );
         } else {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} >/dev/null 2>&1`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} >/dev/null 2>&1`
           );
         }
       }
@@ -1513,6 +1517,46 @@ function buildCodexSubagentArtifacts(subAgents, layout) {
   };
 }
 
+// src/agents/config/capability-token.ts
+import crypto from "crypto";
+var tokenCache = /* @__PURE__ */ new WeakMap();
+async function readCapabilityTokenFile(sandbox, tokenFilePath) {
+  const result = await sandbox.run(
+    `if [ -f ${shellQuote(tokenFilePath)} ]; then cat ${shellQuote(tokenFilePath)}; fi`
+  );
+  if (result.exitCode !== 0) return void 0;
+  const value = result.stdout.trim();
+  return value.length > 0 ? value : void 0;
+}
+function resolveCapabilityToken(sandbox, tokenFilePath, create) {
+  let byPath = tokenCache.get(sandbox);
+  if (!byPath) {
+    byPath = /* @__PURE__ */ new Map();
+    tokenCache.set(sandbox, byPath);
+  }
+  const map = byPath;
+  let cached = map.get(tokenFilePath);
+  if (!cached) {
+    const pending = (async () => {
+      const existing = await readCapabilityTokenFile(sandbox, tokenFilePath);
+      if (existing) return existing;
+      if (create) return crypto.randomBytes(32).toString("hex");
+      throw new Error(
+        `Capability token file is missing at ${tokenFilePath}. setup() must run before connecting to this sandbox server.`
+      );
+    })().catch((error) => {
+      map.delete(tokenFilePath);
+      throw error;
+    });
+    map.set(tokenFilePath, pending);
+    cached = pending;
+  }
+  return cached;
+}
+function withBearerToken(base, token) {
+  return { ...base, Authorization: `Bearer ${token}` };
+}
+
 // src/agents/cost.ts
 function addIfNumber(target, key, value) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
@@ -1643,11 +1687,12 @@ function extractOpenCodeCostData(events) {
 }
 
 // src/agents/providers/claude-code.ts
-var DAEMON_PROTOCOL_VERSION = "2";
+var DAEMON_PROTOCOL_VERSION = "3";
 var DAEMON_PORT = 43180;
 var DAEMON_PATH = "/tmp/agentbox/claude-code/daemon.mjs";
 var DAEMON_LOG_PATH = "/tmp/agentbox/claude-code/daemon.log";
 var DAEMON_PID_PATH = "/tmp/agentbox/claude-code/daemon.pid";
+var DAEMON_TOKEN_PATH = "/tmp/agentbox/claude-code/daemon-token";
 var DAEMON_READY_TIMEOUT_MS = 3e4;
 var DAEMON_READY_POLL_INTERVAL_MS = 250;
 function claudeConfigDir(options) {
@@ -1672,6 +1717,7 @@ function buildClaudeQueryOptions(params) {
     extraArgs["append-system-prompt"] = run.systemPrompt;
   }
   const includeHookEvents = provider?.includeHookEvents ?? false;
+  const effort = provider?.ultracode ? "xhigh" : run.reasoning;
   return {
     cwd: params.cwd ?? params.request.options.cwd,
     env: params.env,
@@ -1684,7 +1730,7 @@ function buildClaudeQueryOptions(params) {
     thinking: { type: "adaptive", display: "summarized" },
     ...provider?.additionalDirectories?.length ? { additionalDirectories: provider.additionalDirectories } : {},
     ...run.model ? { model: run.model } : {},
-    ...run.reasoning ? { effort: run.reasoning } : {},
+    ...effort ? { effort } : {},
     ...provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
     ...provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
     ...provider?.allowedTools?.length ? { allowedTools: provider.allowedTools } : {},
@@ -1741,11 +1787,30 @@ function createClaudeCodeDaemonScript() {
   const version = JSON.stringify(DAEMON_PROTOCOL_VERSION);
   return `import http from "node:http";
 import { execSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
 import { query, getSessionInfo } from "@anthropic-ai/claude-agent-sdk";
 
 const VERSION = ${version};
 const port = Number(process.argv[2] ?? "${DAEMON_PORT}");
+// Capability token: every route except the loopback /__version probe
+// requires \`Authorization: Bearer <token>\`. Loaded once at boot from the
+// 0600 file the host writes alongside this script. Fails closed (rejects
+// all run-control requests) when the file is missing or empty.
+const tokenFilePath = process.argv[3] ?? "";
+let AUTH_TOKEN = "";
+try { if (tokenFilePath) AUTH_TOKEN = readFileSync(tokenFilePath, "utf8").trim(); } catch {}
+
+function isAuthorized(req) {
+  if (!AUTH_TOKEN) return false;
+  const header = req.headers["authorization"] || "";
+  const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
+  if (!presented) return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(AUTH_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
 const liveRuns = new Map();
 
 // The SDK's default spawn does \`existsSync(pathToClaudeCodeExecutable)\`
@@ -1982,6 +2047,14 @@ const server = http.createServer((req, res) => {
     res.end(VERSION);
     return;
   }
+  // Capability-token gate for every run-control route. The /__version probe
+  // above stays open: it carries no secret and the host probes it over
+  // loopback (no bearer) to detect daemon liveness/version.
+  if (!isAuthorized(req)) {
+    res.writeHead(401, { "content-type": "text/plain" });
+    res.end("unauthorized");
+    return;
+  }
   const url = req.url ?? "";
   let m;
   if (req.method === "POST" && (m = url.match(/^\\/runs\\/([^/]+)\\/start$/))) {
@@ -2052,6 +2125,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       );
       return;
     }
+    const daemonToken = await resolveCapabilityToken(
+      sandbox,
+      DAEMON_TOKEN_PATH,
+      true
+    );
     const daemonDir = path8.posix.dirname(DAEMON_PATH);
     const daemonNodeModules = `${daemonDir}/node_modules/@anthropic-ai`;
     const launchCommand = [
@@ -2059,13 +2137,18 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       `if [ -z "$NPM_ROOT" ] || [ ! -d "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ]; then echo "claude-code daemon launch: @anthropic-ai/claude-agent-sdk not found under $NPM_ROOT" >&2; exit 1; fi`,
       `mkdir -p ${shellQuote(daemonNodeModules)}`,
       `ln -sfn "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ${shellQuote(daemonNodeModules + "/claude-agent-sdk")}`,
+      // The base uploadAndRun only chmods execute-bit artifacts, so the 0600
+      // tarball mode is dropped on Daytona (and other non-Modal providers).
+      // Tighten the just-written token file explicitly — matching codex —
+      // so the bearer is never group/world-readable inside the sandbox.
+      `chmod 600 ${shellQuote(DAEMON_TOKEN_PATH)}`,
       `if [ -f ${shellQuote(DAEMON_PID_PATH)} ]; then kill -TERM "$(cat ${shellQuote(DAEMON_PID_PATH)})" 2>/dev/null || true; fi`,
       `(fuser -k -n tcp ${DAEMON_PORT} 2>/dev/null || true)`,
       // Brief grace so the kernel releases the port before the new
       // daemon's listen() — only matters on warm-sandbox respawns;
       // adds 200ms otherwise.
       `sleep 0.2`,
-      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
+      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} ${shellQuote(DAEMON_TOKEN_PATH)} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
     ].join(" && ");
     const launch = await time(
       debugRelay,
@@ -2076,6 +2159,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
             path: DAEMON_PATH,
             content: createClaudeCodeDaemonScript(),
             mode: 420
+          },
+          {
+            path: DAEMON_TOKEN_PATH,
+            content: daemonToken,
+            mode: 384
           }
         ],
         launchCommand,
@@ -2171,6 +2259,10 @@ async function daemonBaseUrl(sandbox) {
   const url = await sandbox.getPreviewLink(DAEMON_PORT);
   return url.replace(/\/$/, "");
 }
+async function daemonAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(sandbox, DAEMON_TOKEN_PATH, false);
+  return withBearerToken(sandbox.previewHeaders, token);
+}
 var ClaudeCodeAgentAdapter = class {
   /**
    * Sandbox-side preparation. Uploads `.claude/` artifacts and ensures
@@ -2181,6 +2273,24 @@ var ClaudeCodeAgentAdapter = class {
    * match what we'd produce, we skip the artifact upload AND the daemon
    * boot entirely.
    */
+  /**
+   * Explicit, developer-invoked teardown of the in-sandbox claude-code
+   * relay daemon (see {@link AgentProviderAdapter.killServer}). agentbox
+   * never calls this on its own. Best-effort and idempotent: a no-op when
+   * the daemon isn't running or no sandbox is configured. After it returns
+   * the next `setup()` re-spawns the daemon (its `/__version` probe fails).
+   */
+  async killServer(request) {
+    const sandbox = request.options.sandbox;
+    if (!sandbox) return;
+    await sandbox.run(
+      [
+        `if [ -f ${shellQuote(DAEMON_PID_PATH)} ]; then kill -TERM "$(cat ${shellQuote(DAEMON_PID_PATH)})" 2>/dev/null || true; rm -f ${shellQuote(DAEMON_PID_PATH)}; fi`,
+        `fuser -k -n tcp ${DAEMON_PORT} 2>/dev/null || true`
+      ].join("; "),
+      { cwd: request.options.cwd, timeoutMs: 1e4 }
+    ).catch(() => void 0);
+  }
   async setup(request) {
     await time(debugClaude, "claude-code setup()", async () => {
       const options = request.options;
@@ -2205,12 +2315,19 @@ var ClaudeCodeAgentAdapter = class {
         () => prepareSkillArtifacts(provider, options.skills, target.layout)
       );
       const hookSettings = buildClaudeHookSettings(hooks) ?? {};
+      const workflowSettings = buildClaudeWorkflowSettings(
+        options.provider?.ultracode
+      );
+      const claudeSettings = { ...hookSettings, ...workflowSettings };
       const mcpConfigJson = buildClaudeMcpConfig(options.mcps) ?? JSON.stringify({ mcpServers: {} }, null, 2);
       const artifacts = [
         ...skillArtifacts,
         ...buildClaudeCommandArtifacts(options.commands, target.layout),
         ...buildClaudeSubagentArtifacts(options.subAgents, target.layout),
-        { path: settingsPath, content: JSON.stringify(hookSettings, null, 2) },
+        {
+          path: settingsPath,
+          content: JSON.stringify(claudeSettings, null, 2)
+        },
         { path: mcpConfigPath, content: mcpConfigJson }
       ];
       const enableRtk = options.enableRtk === true;
@@ -2279,6 +2396,7 @@ var ClaudeCodeAgentAdapter = class {
       "getPreviewLink daemon",
       () => daemonBaseUrl(sandbox)
     );
+    const authHeaders = await daemonAuthHeaders(sandbox);
     const startUrl = `${baseUrl}/runs/${encodeURIComponent(request.runId)}/start`;
     const sdkOptions = buildClaudeQueryOptions({
       request,
@@ -2310,7 +2428,7 @@ var ClaudeCodeAgentAdapter = class {
       try {
         await fetch(
           `${baseUrl}/runs/${encodeURIComponent(request.runId)}/abort`,
-          { method: "POST", headers: sandbox.previewHeaders }
+          { method: "POST", headers: authHeaders }
         );
       } catch {
       }
@@ -2327,7 +2445,7 @@ var ClaudeCodeAgentAdapter = class {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            ...sandbox.previewHeaders
+            ...authHeaders
           },
           body: JSON.stringify({ content: mapped })
         }
@@ -2342,7 +2460,7 @@ var ClaudeCodeAgentAdapter = class {
         signal: fetchAbort.signal,
         headers: {
           "content-type": "application/json",
-          ...sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify(requestBody)
       })
@@ -2570,6 +2688,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachAbort(request) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -2578,7 +2697,7 @@ var ClaudeCodeAgentAdapter = class {
         {
           method: "POST",
           signal: controller.signal,
-          headers: request.sandbox.previewHeaders
+          headers: authHeaders
         }
       ).catch((error) => {
         debugClaude("attachAbort POST failed: %o", error);
@@ -2595,6 +2714,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachSendMessage(request, content) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const inputParts = await validateProviderUserInput(
       AgentProvider.ClaudeCode,
       content
@@ -2606,7 +2726,7 @@ var ClaudeCodeAgentAdapter = class {
         method: "POST",
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify({ content: mapped })
       }
@@ -2620,7 +2740,7 @@ var ClaudeCodeAgentAdapter = class {
 };
 
 // src/agents/providers/codex.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import path9 from "path";
 
 // src/agents/transports/app-server.ts
@@ -2877,7 +2997,7 @@ function resolveCodexAppServerToken(sandbox, tokenFilePath, create) {
         return existing;
       }
       if (create) {
-        return crypto.randomBytes(32).toString("hex");
+        return crypto2.randomBytes(32).toString("hex");
       }
       throw new Error(
         `Codex app-server token file is missing at ${tokenFilePath}. setup() must run before connecting to the codex app-server.`
@@ -3573,10 +3693,34 @@ async function buildCodexInputItems(options, inputParts) {
   );
   return inputItems;
 }
+async function killCodexAppServer(request) {
+  const { options } = request;
+  const sandbox = options.sandbox;
+  if (!sandbox) return;
+  const sharedTarget = await createSetupTarget(
+    request.provider,
+    REMOTE_CODEX_APP_SERVER_ID,
+    options
+  );
+  const pidFilePath = path9.posix.join(
+    sharedTarget.layout.rootDir,
+    "codex-app-server.pid"
+  );
+  await sandbox.run(
+    [
+      `if [ -f ${shellQuote(pidFilePath)} ]; then kill "$(cat ${shellQuote(pidFilePath)})" 2>/dev/null || true; rm -f ${shellQuote(pidFilePath)}; fi`,
+      `fuser -k -n tcp ${REMOTE_CODEX_APP_SERVER_PORT} 2>/dev/null || true`
+    ].join("; "),
+    { cwd: options.cwd, timeoutMs: 1e4 }
+  ).catch(() => void 0);
+}
 var CodexAgentAdapter = class {
   async setup(request) {
     await setupCodex(request);
   }
+  async killServer(request) {
+    await killCodexAppServer(request);
+  }
   async execute(request, sink) {
     const executeStartedAt = Date.now();
     debugCodex("execute() start runId=%s", request.runId);
@@ -3925,6 +4069,37 @@ var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
+var OPENCODE_AUTH_USERNAME = "opencode";
+function opencodeServerTokenPath() {
+  return path10.posix.join(
+    agentboxRoot(AgentProvider.OpenCode, true),
+    "opencode-auth-token"
+  );
+}
+function opencodeCurlAuthArg() {
+  return `-u "opencode:$(cat ${shellQuote(opencodeServerTokenPath())} 2>/dev/null)"`;
+}
+function opencodeHealthCurl(port) {
+  return `curl -fsS --max-time 2 ${opencodeCurlAuthArg()} http://127.0.0.1:${port}/global/health >/dev/null 2>&1`;
+}
+async function isSandboxOpenCodeServerAuthEnforced(sandbox, cwd, port) {
+  const probe = await sandbox.run(
+    `test "$(curl -s -o /dev/null -w '%{http_code}' --max-time 2 http://127.0.0.1:${port}/global/health)" = "401"`,
+    { cwd, timeoutMs: 5e3 }
+  ).catch(() => void 0);
+  return probe?.exitCode === 0;
+}
+async function opencodeAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(
+    sandbox,
+    opencodeServerTokenPath(),
+    false
+  );
+  const basic = Buffer.from(`${OPENCODE_AUTH_USERNAME}:${token}`).toString(
+    "base64"
+  );
+  return { ...sandbox.previewHeaders, Authorization: `Basic ${basic}` };
+}
 var LLM_API_KEY_ENV_VARS = [
   "OPENROUTER_API_KEY",
   "OPENAI_API_KEY",
@@ -3975,10 +4150,10 @@ async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
     ).catch(() => void 0);
     const deadline = Date.now() + 5e3;
     while (Date.now() < deadline) {
-      const probe = await sandbox.run(
-        `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-        { cwd, timeoutMs: 5e3 }
-      );
+      const probe = await sandbox.run(opencodeHealthCurl(port), {
+        cwd,
+        timeoutMs: 5e3
+      });
       if (probe.exitCode !== 0) {
         return;
       }
@@ -4118,6 +4293,12 @@ async function ensureSandboxOpenCodeServer(request) {
       SHARED_OPENCODE_TARGET_ID,
       options
     );
+    const serverTokenPath = opencodeServerTokenPath();
+    const serverToken = await resolveCapabilityToken(
+      sandbox,
+      serverTokenPath,
+      true
+    );
     const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(
       request.provider,
       options.skills,
@@ -4135,10 +4316,18 @@ async function ensureSandboxOpenCodeServer(request) {
       {
         path: configPath,
         content: JSON.stringify(openCodeConfig, null, 2)
+      },
+      {
+        path: serverTokenPath,
+        content: serverToken
       }
     ];
     const enableRtk = options.enableRtk === true;
-    const daemonInfo = { port, healthPath: "/global/health" };
+    const daemonInfo = {
+      port,
+      healthPath: "/global/health",
+      curlAuthArg: opencodeCurlAuthArg()
+    };
     const setupId = computeSetupId({
       artifacts: allArtifacts,
       installCommands,
@@ -4152,6 +4341,17 @@ async function ensureSandboxOpenCodeServer(request) {
       debugOpencode("opencode setup() preflight hit \u2014 skipping");
       return;
     }
+    if (await isSandboxOpenCodeServerHealthy(sandbox, options.cwd, port)) {
+      if (await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+        debugOpencode(
+          "opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+        );
+        return;
+      }
+      debugOpencode(
+        "opencode server running without capability auth \u2014 restarting to enforce it"
+      );
+    }
     const commonEnv = {
       OPENCODE_CONFIG: configPath,
       OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
@@ -4170,9 +4370,18 @@ async function ensureSandboxOpenCodeServer(request) {
       target.layout.rootDir,
       "opencode-serve.log"
     );
-    const serveEnv = { ...options.env ?? {}, ...commonEnv };
+    const serveEnv = {
+      ...options.env ?? {},
+      ...commonEnv,
+      // Native opencode HTTP basic auth. The host presents this token on
+      // every request (see opencodeAuthHeaders); the in-sandbox health probes
+      // present it too (see opencodeHealthCurl).
+      OPENCODE_SERVER_USERNAME: OPENCODE_AUTH_USERNAME,
+      OPENCODE_SERVER_PASSWORD: serverToken
+    };
     const launchCommand = [
       `mkdir -p ${shellQuote(target.layout.rootDir)}`,
+      `chmod 600 ${shellQuote(serverTokenPath)} 2>/dev/null || true`,
       `(${[
         `setsid nohup ${[
           binary,
@@ -4215,10 +4424,10 @@ async function ensureSandboxOpenCodeServer(request) {
             );
           }
           while (Date.now() < readyDeadline) {
-            const probe = await sandbox.run(
-              `curl -fsS http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-              { cwd: options.cwd, timeoutMs: 5e3 }
-            );
+            const probe = await sandbox.run(opencodeHealthCurl(port), {
+              cwd: options.cwd,
+              timeoutMs: 5e3
+            });
             if (probe.exitCode === 0) {
               debugOpencode("ready on attempt %d", attempt);
               return true;
@@ -4260,6 +4469,18 @@ opencode log:
 ${lastLog}` : "")
       );
     }
+    if (!await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+      await killSandboxOpenCodeServer(
+        sandbox,
+        pidFilePath,
+        options.cwd,
+        port
+      ).catch(() => void 0);
+      await target.cleanup().catch(() => void 0);
+      throw new Error(
+        "OpenCode server started but is not enforcing the capability token (OPENCODE_SERVER_PASSWORD ignored). Upgrade opencode-ai to a version that supports server authentication."
+      );
+    }
     await markSetupComplete(target, setupId);
   });
 }
@@ -4311,7 +4532,13 @@ async function ensureLocalOpenCodeServer(request) {
     debugOpencode("local opencode server up-to-date \u2014 reusing");
     return;
   }
-  debugOpencode("local opencode server drifted/absent \u2014 (re)spawning");
+  if (await isLocalOpenCodeServerHealthy()) {
+    debugOpencode(
+      "local opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+    );
+    return;
+  }
+  debugOpencode("local opencode server absent \u2014 spawning");
   await applyDifferentialSetup(target, allArtifacts, installCommands);
   await killLocalOpenCodeServer();
   spawnCommand({
@@ -4344,13 +4571,49 @@ async function setupOpenCode(request) {
   }
   await ensureLocalOpenCodeServer(request);
 }
+async function isSandboxOpenCodeServerHealthy(sandbox, cwd, port) {
+  const probe = await sandbox.run(opencodeHealthCurl(port), { cwd, timeoutMs: 5e3 }).catch(() => void 0);
+  return probe?.exitCode === 0;
+}
+async function isLocalOpenCodeServerHealthy() {
+  try {
+    const res = await fetch(
+      `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
+    );
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function killOpenCodeServer(request) {
+  const { options } = request;
+  if (options.sandbox) {
+    const target = await createSetupTarget(
+      request.provider,
+      SHARED_OPENCODE_TARGET_ID,
+      options
+    );
+    const pidFilePath = path10.posix.join(
+      target.layout.rootDir,
+      "opencode-serve.pid"
+    );
+    await killSandboxOpenCodeServer(
+      options.sandbox,
+      pidFilePath,
+      options.cwd,
+      SANDBOX_OPENCODE_PORT
+    );
+    return;
+  }
+  await killLocalOpenCodeServer();
+}
 async function buildOpenCodeRuntime(options) {
   if (options.sandbox) {
     const sandbox = options.sandbox;
     const baseUrl2 = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
     return {
       baseUrl: baseUrl2,
-      previewHeaders: sandbox.previewHeaders,
+      previewHeaders: await opencodeAuthHeaders(sandbox),
       raw: { baseUrl: baseUrl2, port: SANDBOX_OPENCODE_PORT }
     };
   }
@@ -4365,6 +4628,9 @@ var OpenCodeAgentAdapter = class {
   async setup(request) {
     await setupOpenCode(request);
   }
+  async killServer(request) {
+    await killOpenCodeServer(request);
+  }
   async execute(request, sink) {
     const executeStartedAt = Date.now();
     debugOpencode("execute() start runId=%s", request.runId);
@@ -4881,6 +5147,7 @@ var OpenCodeAgentAdapter = class {
       );
     }
     const baseUrl = (await request.sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -4889,7 +5156,7 @@ var OpenCodeAgentAdapter = class {
         signal: controller.signal,
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         }
       }).catch((error) => {
         debugOpencode(
@@ -4920,12 +5187,13 @@ var OpenCodeAgentAdapter = class {
       content
     );
     const parts = mapToOpenCodeParts(inputParts);
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const url = `${baseUrl}/session/${request.sessionId}/prompt_async`;
     const response = await fetch(url, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        ...request.sandbox.previewHeaders
+        ...authHeaders
       },
       body: JSON.stringify({
         agent: openCodeAgentSlug(void 0),
@@ -5353,6 +5621,30 @@ var Agent = class {
       throw error;
     }
   }
+  /**
+   * Stop the long-lived provider CLI server booted by {@link Agent.setup}
+   * (claude-code relay daemon, codex app-server, opencode `serve`).
+   *
+   * agentbox NEVER kills a running server on its own — not on run
+   * completion, not on `abort()`, and not when {@link Agent.setup} detects
+   * a changed config/credential set. This method is the single, explicit,
+   * developer-driven teardown. Call it to free a server's resources, or to
+   * apply a changed config: after `killServer()` the next {@link setup}
+   * cold-starts a fresh server with the new configuration.
+   *
+   * Best-effort and idempotent: a no-op when no server is running, or when
+   * the provider has no shared server for the current mode (host-mode
+   * claude-code runs the SDK in-process; local codex spawns a fresh
+   * app-server per run, torn down with the run).
+   */
+  async killServer() {
+    debugAgent("killServer() provider=%s", this.provider);
+    await this.adapter.killServer({
+      provider: this.provider,
+      options: this.options
+    });
+    this.setupPromise = void 0;
+  }
   stream(runConfig) {
     if (runConfig.resumeSessionId && runConfig.forkSessionId) {
       throw new Error(

package/dist/{chunk-T4AS2WEF.js → chunk-TUBBWIOM.js}

@@ -251,6 +251,20 @@ function resolveSandboxResources(resources) {
 }
 
 // src/sandboxes/providers/daytona.ts
+var STARTABLE_STATES = /* @__PURE__ */ new Set(["stopped", "archived"]);
+var TERMINAL_STATES = /* @__PURE__ */ new Set([
+  "error",
+  "build_failed",
+  "destroyed",
+  "destroying"
+]);
+var ATTACH_SETTLE_TIMEOUT_MS = 12e4;
+var ATTACH_POLL_INTERVAL_MS = 2e3;
+function isStateChangeInProgressError(err) {
+  const e = err;
+  if (!e) return false;
+  return e.statusCode === 409 || e.name === "DaytonaConflictError" || /state change in progress/i.test(e.message ?? "");
+}
 var DaytonaSandboxAdapter = class extends SandboxAdapter {
   client;
   sandbox;
@@ -292,20 +306,54 @@ var DaytonaSandboxAdapter = class extends SandboxAdapter {
       throw new Error(`Daytona sandbox ${id} not found`);
     }
     this.sandbox = existing;
-    const state = existing.state ?? "unknown";
-    const isWarm = state === "started";
-    if (!isWarm) {
-      await existing.start();
+    this.isWarmFlag = existing.state === "started";
+    await this.ensureStarted(existing);
+  }
+  /**
+   * Bring a sandbox to the `started` state, tolerating in-flight transitions.
+   *
+   * `start()` only works from a resting state (`stopped`/`archived`); calling
+   * it while the sandbox is creating/starting/restoring/snapshotting/etc. — or
+   * racing another caller that's already starting it — makes Daytona 409 with
+   * "Sandbox state change in progress". So we poll: start from a resting
+   * state, wait out a transition, fail fast on a terminal state, and treat a
+   * 409 as "someone else is mid-transition" and keep waiting.
+   */
+  async ensureStarted(sandbox) {
+    let current = sandbox;
+    const deadline = Date.now() + ATTACH_SETTLE_TIMEOUT_MS;
+    for (; ; ) {
+      const state = current.state ?? "unknown";
+      if (state === "started") return;
+      if (TERMINAL_STATES.has(state)) {
+        throw new Error(
+          `Daytona sandbox ${current.id} is in a terminal state: ${state}`
+        );
+      }
+      if (STARTABLE_STATES.has(state)) {
+        try {
+          await current.start();
+          return;
+        } catch (err) {
+          if (!isStateChangeInProgressError(err)) throw err;
+        }
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Timed out waiting for Daytona sandbox ${current.id} to start (state=${state})`
+        );
+      }
+      await sleep(ATTACH_POLL_INTERVAL_MS);
+      current = await this.client.get(current.id);
+      this.sandbox = current;
     }
-    this.isWarmFlag = isWarm;
   }
   async provision() {
     const existing = await this.findMatchingSandbox();
     if (existing) {
       this.sandbox = existing;
-      const isWarm = existing.state === "started";
-      await existing.start();
-      this.isWarmFlag = isWarm;
+      this.isWarmFlag = existing.state === "started";
+      await this.ensureStarted(existing);
       return;
     }
     const labels = this.getLabels();

package/dist/events/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, ab as TextDeltaEvent, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from '../types-DG4J_zMT.js';
+export { A as AISDKEvent, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, ab as TextDeltaEvent, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from '../types-vOsvzkcO.js';
 import { AgentProvider } from '../enums.js';
 import '../Sandbox-DcKAU-E3.js';
 import 'e2b';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a5 as RepoSkillConfig, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, aa as SetupLayout, ab as TextDeltaEvent, ac as TextPart, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ag as UserContent, ah as UserContentPart, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from './types-DG4J_zMT.js';
+export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a5 as RepoSkillConfig, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, aa as SetupLayout, ab as TextDeltaEvent, ac as TextPart, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ag as UserContent, ah as UserContentPart, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from './types-vOsvzkcO.js';
 export { AGENT_RESERVED_PORTS, Agent, agentboxRoot, collectAllAgentReservedPorts, getAgentLayout } from './agents/index.js';
 export { A as AsyncCommandHandle, C as CommandEvent, a as CommandOptions, b as CommandResult, D as DaytonaProviderOptions, c as DaytonaSandboxOptions, E as E2bProviderOptions, d as E2bSandboxOptions, G as GitCloneOptions, L as LocalDockerProviderOptions, e as LocalDockerSandboxOptions, M as ModalProviderOptions, f as ModalSandboxOptions, S as Sandbox, g as SandboxDescriptor, h as SandboxListOptions, i as SandboxOptions, j as SandboxOptionsBase, k as SandboxOptionsMap, l as SandboxProviderName, m as SandboxRaw, n as SandboxRawMap, o as SandboxResourceSpec, T as TarballEntry, V as VercelGitSource, p as VercelProviderOptions, q as VercelSandboxOptions } from './Sandbox-DcKAU-E3.js';
 export { SandboxAdapter, buildGitCloneCommand } from './sandboxes/index.js';

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "./chunk-ZK5PDWOI.js";
+} from "./chunk-KFMFNBVC.js";
 import {
   ProviderLogAssembler,
   createNormalizedEvent,
@@ -14,7 +14,7 @@ import {
   Sandbox,
   SandboxAdapter,
   buildGitCloneCommand
-} from "./chunk-T4AS2WEF.js";
+} from "./chunk-TUBBWIOM.js";
 import {
   AGENT_RESERVED_PORTS,
   collectAllAgentReservedPorts

package/dist/sandboxes/index.js

@@ -2,7 +2,7 @@ import {
   Sandbox,
   SandboxAdapter,
   buildGitCloneCommand
-} from "../chunk-T4AS2WEF.js";
+} from "../chunk-TUBBWIOM.js";
 import "../chunk-AVXJMCBC.js";
 import "../chunk-NSJM57Z4.js";
 import {

package/dist/{types-DG4J_zMT.d.ts → types-vOsvzkcO.d.ts}

@@ -418,6 +418,18 @@ interface ClaudeCodeProviderOptions {
      * silence them when hook noise drowns out the rest of the event stream.
      */
     includeHookEvents?: boolean;
+    /**
+     * Enable "ultracode" for claude-code runs: xhigh reasoning effort plus
+     * standing dynamic-workflow orchestration (the built-in `Workflow` tool).
+     *
+     * When `true`, agentbox writes `enableWorkflows: true` + `ultracode: true`
+     * into the managed `settings.json` and forces `effort: "xhigh"` on the query.
+     *
+     * Requires an xhigh-capable model (e.g. Opus) and a recent runtime — the
+     * Workflows feature shipped around Claude Code 2.1.154 / Agent SDK 0.3.149.
+     * On older CLIs the settings keys are simply ignored.
+     */
+    ultracode?: boolean;
 }
 interface CodexAgentOptions extends AgentOptionsBase {
     provider?: CodexProviderOptions;
@@ -599,6 +611,22 @@ interface AgentProviderAdapter<P extends AgentProviderName = AgentProviderName>
      * is already listening.
      */
     setup(request: AgentSetupRequest<P>): Promise<void>;
+    /**
+     * Stop the long-lived provider CLI server that {@link setup} boots
+     * (claude-code relay daemon, codex app-server, opencode `serve`).
+     *
+     * agentbox NEVER calls this on its own — not on run completion, not on
+     * abort, and not when {@link setup} sees a changed config/credential
+     * set. It exists purely so a developer can explicitly tear a server
+     * down (to reclaim resources, or to force the changed config to apply
+     * on the next cold {@link setup}).
+     *
+     * Best-effort and idempotent: a no-op when nothing is running, or when
+     * the provider has no shared server for the current mode (host-mode
+     * claude-code runs the SDK in-process; local codex spawns a fresh
+     * app-server per run).
+     */
+    killServer(request: AgentSetupRequest<P>): Promise<void>;
     execute(request: AgentExecutionRequest<P>, sink: AgentRunSink): Promise<() => Promise<void> | void>;
     /**
      * Stateless abort. Dial the in-sandbox provider server, issue the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbox-sdk",
-  "version": "0.1.322",
+  "version": "0.1.400",
   "description": "Swappable coding agents and sandbox providers for Bun and TypeScript.",
   "license": "MIT",
   "repository": {