agentbox-sdk 0.1.323 → 0.1.400

package/dist/agents/index.d.ts

@@ -1,5 +1,5 @@
-import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a3 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, aa as SetupLayout } from '../types-t01PuLUJ.js';
-export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a5 as RepoSkillConfig, ac as TextPart, ag as UserContent, ah as UserContentPart } from '../types-t01PuLUJ.js';
+import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a3 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, aa as SetupLayout } from '../types-vOsvzkcO.js';
+export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a5 as RepoSkillConfig, ac as TextPart, ag as UserContent, ah as UserContentPart } from '../types-vOsvzkcO.js';
 import { S as Sandbox } from '../Sandbox-DcKAU-E3.js';
 export { AgentProvider } from '../enums.js';
 import 'e2b';

package/dist/agents/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "../chunk-XONT46YC.js";
+} from "../chunk-KFMFNBVC.js";
 import "../chunk-775FIGGL.js";
 import {
   AGENT_RESERVED_PORTS,

package/dist/{chunk-XONT46YC.js → chunk-KFMFNBVC.js}

@@ -583,6 +583,9 @@ function buildClaudeHookSettings(hooks) {
   }
   return { hooks };
 }
+function buildClaudeWorkflowSettings(ultracode) {
+  return ultracode ? { enableWorkflows: true, ultracode: true } : {};
+}
 function buildCodexHooksFile(hooks) {
   if (!hasHookEntries(hooks)) {
     return void 0;
@@ -1228,13 +1231,14 @@ async function preflightSetup(target, setupId, daemon) {
       ];
       if (daemon) {
         const url = `http://127.0.0.1:${daemon.port}${daemon.healthPath}`;
+        const auth = daemon.curlAuthArg ? `${daemon.curlAuthArg} ` : "";
         if (daemon.expectedVersionMatch) {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
           );
         } else {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} >/dev/null 2>&1`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} >/dev/null 2>&1`
           );
         }
       }
@@ -1513,6 +1517,46 @@ function buildCodexSubagentArtifacts(subAgents, layout) {
   };
 }
 
+// src/agents/config/capability-token.ts
+import crypto from "crypto";
+var tokenCache = /* @__PURE__ */ new WeakMap();
+async function readCapabilityTokenFile(sandbox, tokenFilePath) {
+  const result = await sandbox.run(
+    `if [ -f ${shellQuote(tokenFilePath)} ]; then cat ${shellQuote(tokenFilePath)}; fi`
+  );
+  if (result.exitCode !== 0) return void 0;
+  const value = result.stdout.trim();
+  return value.length > 0 ? value : void 0;
+}
+function resolveCapabilityToken(sandbox, tokenFilePath, create) {
+  let byPath = tokenCache.get(sandbox);
+  if (!byPath) {
+    byPath = /* @__PURE__ */ new Map();
+    tokenCache.set(sandbox, byPath);
+  }
+  const map = byPath;
+  let cached = map.get(tokenFilePath);
+  if (!cached) {
+    const pending = (async () => {
+      const existing = await readCapabilityTokenFile(sandbox, tokenFilePath);
+      if (existing) return existing;
+      if (create) return crypto.randomBytes(32).toString("hex");
+      throw new Error(
+        `Capability token file is missing at ${tokenFilePath}. setup() must run before connecting to this sandbox server.`
+      );
+    })().catch((error) => {
+      map.delete(tokenFilePath);
+      throw error;
+    });
+    map.set(tokenFilePath, pending);
+    cached = pending;
+  }
+  return cached;
+}
+function withBearerToken(base, token) {
+  return { ...base, Authorization: `Bearer ${token}` };
+}
+
 // src/agents/cost.ts
 function addIfNumber(target, key, value) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
@@ -1643,11 +1687,12 @@ function extractOpenCodeCostData(events) {
 }
 
 // src/agents/providers/claude-code.ts
-var DAEMON_PROTOCOL_VERSION = "2";
+var DAEMON_PROTOCOL_VERSION = "3";
 var DAEMON_PORT = 43180;
 var DAEMON_PATH = "/tmp/agentbox/claude-code/daemon.mjs";
 var DAEMON_LOG_PATH = "/tmp/agentbox/claude-code/daemon.log";
 var DAEMON_PID_PATH = "/tmp/agentbox/claude-code/daemon.pid";
+var DAEMON_TOKEN_PATH = "/tmp/agentbox/claude-code/daemon-token";
 var DAEMON_READY_TIMEOUT_MS = 3e4;
 var DAEMON_READY_POLL_INTERVAL_MS = 250;
 function claudeConfigDir(options) {
@@ -1672,6 +1717,7 @@ function buildClaudeQueryOptions(params) {
     extraArgs["append-system-prompt"] = run.systemPrompt;
   }
   const includeHookEvents = provider?.includeHookEvents ?? false;
+  const effort = provider?.ultracode ? "xhigh" : run.reasoning;
   return {
     cwd: params.cwd ?? params.request.options.cwd,
     env: params.env,
@@ -1684,7 +1730,7 @@ function buildClaudeQueryOptions(params) {
     thinking: { type: "adaptive", display: "summarized" },
     ...provider?.additionalDirectories?.length ? { additionalDirectories: provider.additionalDirectories } : {},
     ...run.model ? { model: run.model } : {},
-    ...run.reasoning ? { effort: run.reasoning } : {},
+    ...effort ? { effort } : {},
     ...provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
     ...provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
     ...provider?.allowedTools?.length ? { allowedTools: provider.allowedTools } : {},
@@ -1741,11 +1787,30 @@ function createClaudeCodeDaemonScript() {
   const version = JSON.stringify(DAEMON_PROTOCOL_VERSION);
   return `import http from "node:http";
 import { execSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
 import { query, getSessionInfo } from "@anthropic-ai/claude-agent-sdk";
 
 const VERSION = ${version};
 const port = Number(process.argv[2] ?? "${DAEMON_PORT}");
+// Capability token: every route except the loopback /__version probe
+// requires \`Authorization: Bearer <token>\`. Loaded once at boot from the
+// 0600 file the host writes alongside this script. Fails closed (rejects
+// all run-control requests) when the file is missing or empty.
+const tokenFilePath = process.argv[3] ?? "";
+let AUTH_TOKEN = "";
+try { if (tokenFilePath) AUTH_TOKEN = readFileSync(tokenFilePath, "utf8").trim(); } catch {}
+
+function isAuthorized(req) {
+  if (!AUTH_TOKEN) return false;
+  const header = req.headers["authorization"] || "";
+  const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
+  if (!presented) return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(AUTH_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
 const liveRuns = new Map();
 
 // The SDK's default spawn does \`existsSync(pathToClaudeCodeExecutable)\`
@@ -1982,6 +2047,14 @@ const server = http.createServer((req, res) => {
     res.end(VERSION);
     return;
   }
+  // Capability-token gate for every run-control route. The /__version probe
+  // above stays open: it carries no secret and the host probes it over
+  // loopback (no bearer) to detect daemon liveness/version.
+  if (!isAuthorized(req)) {
+    res.writeHead(401, { "content-type": "text/plain" });
+    res.end("unauthorized");
+    return;
+  }
   const url = req.url ?? "";
   let m;
   if (req.method === "POST" && (m = url.match(/^\\/runs\\/([^/]+)\\/start$/))) {
@@ -2052,6 +2125,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       );
       return;
     }
+    const daemonToken = await resolveCapabilityToken(
+      sandbox,
+      DAEMON_TOKEN_PATH,
+      true
+    );
     const daemonDir = path8.posix.dirname(DAEMON_PATH);
     const daemonNodeModules = `${daemonDir}/node_modules/@anthropic-ai`;
     const launchCommand = [
@@ -2059,13 +2137,18 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       `if [ -z "$NPM_ROOT" ] || [ ! -d "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ]; then echo "claude-code daemon launch: @anthropic-ai/claude-agent-sdk not found under $NPM_ROOT" >&2; exit 1; fi`,
       `mkdir -p ${shellQuote(daemonNodeModules)}`,
       `ln -sfn "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ${shellQuote(daemonNodeModules + "/claude-agent-sdk")}`,
+      // The base uploadAndRun only chmods execute-bit artifacts, so the 0600
+      // tarball mode is dropped on Daytona (and other non-Modal providers).
+      // Tighten the just-written token file explicitly — matching codex —
+      // so the bearer is never group/world-readable inside the sandbox.
+      `chmod 600 ${shellQuote(DAEMON_TOKEN_PATH)}`,
       `if [ -f ${shellQuote(DAEMON_PID_PATH)} ]; then kill -TERM "$(cat ${shellQuote(DAEMON_PID_PATH)})" 2>/dev/null || true; fi`,
       `(fuser -k -n tcp ${DAEMON_PORT} 2>/dev/null || true)`,
       // Brief grace so the kernel releases the port before the new
       // daemon's listen() — only matters on warm-sandbox respawns;
       // adds 200ms otherwise.
       `sleep 0.2`,
-      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
+      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} ${shellQuote(DAEMON_TOKEN_PATH)} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
     ].join(" && ");
     const launch = await time(
       debugRelay,
@@ -2076,6 +2159,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
             path: DAEMON_PATH,
             content: createClaudeCodeDaemonScript(),
             mode: 420
+          },
+          {
+            path: DAEMON_TOKEN_PATH,
+            content: daemonToken,
+            mode: 384
           }
         ],
         launchCommand,
@@ -2171,6 +2259,10 @@ async function daemonBaseUrl(sandbox) {
   const url = await sandbox.getPreviewLink(DAEMON_PORT);
   return url.replace(/\/$/, "");
 }
+async function daemonAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(sandbox, DAEMON_TOKEN_PATH, false);
+  return withBearerToken(sandbox.previewHeaders, token);
+}
 var ClaudeCodeAgentAdapter = class {
   /**
    * Sandbox-side preparation. Uploads `.claude/` artifacts and ensures
@@ -2223,12 +2315,19 @@ var ClaudeCodeAgentAdapter = class {
         () => prepareSkillArtifacts(provider, options.skills, target.layout)
       );
       const hookSettings = buildClaudeHookSettings(hooks) ?? {};
+      const workflowSettings = buildClaudeWorkflowSettings(
+        options.provider?.ultracode
+      );
+      const claudeSettings = { ...hookSettings, ...workflowSettings };
       const mcpConfigJson = buildClaudeMcpConfig(options.mcps) ?? JSON.stringify({ mcpServers: {} }, null, 2);
       const artifacts = [
         ...skillArtifacts,
         ...buildClaudeCommandArtifacts(options.commands, target.layout),
         ...buildClaudeSubagentArtifacts(options.subAgents, target.layout),
-        { path: settingsPath, content: JSON.stringify(hookSettings, null, 2) },
+        {
+          path: settingsPath,
+          content: JSON.stringify(claudeSettings, null, 2)
+        },
         { path: mcpConfigPath, content: mcpConfigJson }
       ];
       const enableRtk = options.enableRtk === true;
@@ -2297,6 +2396,7 @@ var ClaudeCodeAgentAdapter = class {
       "getPreviewLink daemon",
       () => daemonBaseUrl(sandbox)
     );
+    const authHeaders = await daemonAuthHeaders(sandbox);
     const startUrl = `${baseUrl}/runs/${encodeURIComponent(request.runId)}/start`;
     const sdkOptions = buildClaudeQueryOptions({
       request,
@@ -2328,7 +2428,7 @@ var ClaudeCodeAgentAdapter = class {
       try {
         await fetch(
           `${baseUrl}/runs/${encodeURIComponent(request.runId)}/abort`,
-          { method: "POST", headers: sandbox.previewHeaders }
+          { method: "POST", headers: authHeaders }
         );
       } catch {
       }
@@ -2345,7 +2445,7 @@ var ClaudeCodeAgentAdapter = class {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            ...sandbox.previewHeaders
+            ...authHeaders
           },
           body: JSON.stringify({ content: mapped })
         }
@@ -2360,7 +2460,7 @@ var ClaudeCodeAgentAdapter = class {
         signal: fetchAbort.signal,
         headers: {
           "content-type": "application/json",
-          ...sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify(requestBody)
       })
@@ -2588,6 +2688,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachAbort(request) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -2596,7 +2697,7 @@ var ClaudeCodeAgentAdapter = class {
         {
           method: "POST",
           signal: controller.signal,
-          headers: request.sandbox.previewHeaders
+          headers: authHeaders
         }
       ).catch((error) => {
         debugClaude("attachAbort POST failed: %o", error);
@@ -2613,6 +2714,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachSendMessage(request, content) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const inputParts = await validateProviderUserInput(
       AgentProvider.ClaudeCode,
       content
@@ -2624,7 +2726,7 @@ var ClaudeCodeAgentAdapter = class {
         method: "POST",
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify({ content: mapped })
       }
@@ -2638,7 +2740,7 @@ var ClaudeCodeAgentAdapter = class {
 };
 
 // src/agents/providers/codex.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import path9 from "path";
 
 // src/agents/transports/app-server.ts
@@ -2895,7 +2997,7 @@ function resolveCodexAppServerToken(sandbox, tokenFilePath, create) {
         return existing;
       }
       if (create) {
-        return crypto.randomBytes(32).toString("hex");
+        return crypto2.randomBytes(32).toString("hex");
       }
       throw new Error(
         `Codex app-server token file is missing at ${tokenFilePath}. setup() must run before connecting to the codex app-server.`
@@ -3967,6 +4069,37 @@ var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
+var OPENCODE_AUTH_USERNAME = "opencode";
+function opencodeServerTokenPath() {
+  return path10.posix.join(
+    agentboxRoot(AgentProvider.OpenCode, true),
+    "opencode-auth-token"
+  );
+}
+function opencodeCurlAuthArg() {
+  return `-u "opencode:$(cat ${shellQuote(opencodeServerTokenPath())} 2>/dev/null)"`;
+}
+function opencodeHealthCurl(port) {
+  return `curl -fsS --max-time 2 ${opencodeCurlAuthArg()} http://127.0.0.1:${port}/global/health >/dev/null 2>&1`;
+}
+async function isSandboxOpenCodeServerAuthEnforced(sandbox, cwd, port) {
+  const probe = await sandbox.run(
+    `test "$(curl -s -o /dev/null -w '%{http_code}' --max-time 2 http://127.0.0.1:${port}/global/health)" = "401"`,
+    { cwd, timeoutMs: 5e3 }
+  ).catch(() => void 0);
+  return probe?.exitCode === 0;
+}
+async function opencodeAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(
+    sandbox,
+    opencodeServerTokenPath(),
+    false
+  );
+  const basic = Buffer.from(`${OPENCODE_AUTH_USERNAME}:${token}`).toString(
+    "base64"
+  );
+  return { ...sandbox.previewHeaders, Authorization: `Basic ${basic}` };
+}
 var LLM_API_KEY_ENV_VARS = [
   "OPENROUTER_API_KEY",
   "OPENAI_API_KEY",
@@ -4017,10 +4150,10 @@ async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
     ).catch(() => void 0);
     const deadline = Date.now() + 5e3;
     while (Date.now() < deadline) {
-      const probe = await sandbox.run(
-        `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-        { cwd, timeoutMs: 5e3 }
-      );
+      const probe = await sandbox.run(opencodeHealthCurl(port), {
+        cwd,
+        timeoutMs: 5e3
+      });
       if (probe.exitCode !== 0) {
         return;
       }
@@ -4160,6 +4293,12 @@ async function ensureSandboxOpenCodeServer(request) {
       SHARED_OPENCODE_TARGET_ID,
       options
     );
+    const serverTokenPath = opencodeServerTokenPath();
+    const serverToken = await resolveCapabilityToken(
+      sandbox,
+      serverTokenPath,
+      true
+    );
     const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(
       request.provider,
       options.skills,
@@ -4177,10 +4316,18 @@ async function ensureSandboxOpenCodeServer(request) {
       {
         path: configPath,
         content: JSON.stringify(openCodeConfig, null, 2)
+      },
+      {
+        path: serverTokenPath,
+        content: serverToken
       }
     ];
     const enableRtk = options.enableRtk === true;
-    const daemonInfo = { port, healthPath: "/global/health" };
+    const daemonInfo = {
+      port,
+      healthPath: "/global/health",
+      curlAuthArg: opencodeCurlAuthArg()
+    };
     const setupId = computeSetupId({
       artifacts: allArtifacts,
       installCommands,
@@ -4195,10 +4342,15 @@ async function ensureSandboxOpenCodeServer(request) {
       return;
     }
     if (await isSandboxOpenCodeServerHealthy(sandbox, options.cwd, port)) {
+      if (await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+        debugOpencode(
+          "opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+        );
+        return;
+      }
       debugOpencode(
-        "opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+        "opencode server running without capability auth \u2014 restarting to enforce it"
       );
-      return;
     }
     const commonEnv = {
       OPENCODE_CONFIG: configPath,
@@ -4218,9 +4370,18 @@ async function ensureSandboxOpenCodeServer(request) {
       target.layout.rootDir,
       "opencode-serve.log"
     );
-    const serveEnv = { ...options.env ?? {}, ...commonEnv };
+    const serveEnv = {
+      ...options.env ?? {},
+      ...commonEnv,
+      // Native opencode HTTP basic auth. The host presents this token on
+      // every request (see opencodeAuthHeaders); the in-sandbox health probes
+      // present it too (see opencodeHealthCurl).
+      OPENCODE_SERVER_USERNAME: OPENCODE_AUTH_USERNAME,
+      OPENCODE_SERVER_PASSWORD: serverToken
+    };
     const launchCommand = [
       `mkdir -p ${shellQuote(target.layout.rootDir)}`,
+      `chmod 600 ${shellQuote(serverTokenPath)} 2>/dev/null || true`,
       `(${[
         `setsid nohup ${[
           binary,
@@ -4263,10 +4424,10 @@ async function ensureSandboxOpenCodeServer(request) {
             );
           }
           while (Date.now() < readyDeadline) {
-            const probe = await sandbox.run(
-              `curl -fsS http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-              { cwd: options.cwd, timeoutMs: 5e3 }
-            );
+            const probe = await sandbox.run(opencodeHealthCurl(port), {
+              cwd: options.cwd,
+              timeoutMs: 5e3
+            });
             if (probe.exitCode === 0) {
               debugOpencode("ready on attempt %d", attempt);
               return true;
@@ -4308,6 +4469,18 @@ opencode log:
 ${lastLog}` : "")
       );
     }
+    if (!await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+      await killSandboxOpenCodeServer(
+        sandbox,
+        pidFilePath,
+        options.cwd,
+        port
+      ).catch(() => void 0);
+      await target.cleanup().catch(() => void 0);
+      throw new Error(
+        "OpenCode server started but is not enforcing the capability token (OPENCODE_SERVER_PASSWORD ignored). Upgrade opencode-ai to a version that supports server authentication."
+      );
+    }
     await markSetupComplete(target, setupId);
   });
 }
@@ -4399,10 +4572,7 @@ async function setupOpenCode(request) {
   await ensureLocalOpenCodeServer(request);
 }
 async function isSandboxOpenCodeServerHealthy(sandbox, cwd, port) {
-  const probe = await sandbox.run(
-    `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-    { cwd, timeoutMs: 5e3 }
-  ).catch(() => void 0);
+  const probe = await sandbox.run(opencodeHealthCurl(port), { cwd, timeoutMs: 5e3 }).catch(() => void 0);
   return probe?.exitCode === 0;
 }
 async function isLocalOpenCodeServerHealthy() {
@@ -4443,7 +4613,7 @@ async function buildOpenCodeRuntime(options) {
     const baseUrl2 = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
     return {
       baseUrl: baseUrl2,
-      previewHeaders: sandbox.previewHeaders,
+      previewHeaders: await opencodeAuthHeaders(sandbox),
       raw: { baseUrl: baseUrl2, port: SANDBOX_OPENCODE_PORT }
     };
   }
@@ -4977,6 +5147,7 @@ var OpenCodeAgentAdapter = class {
       );
     }
     const baseUrl = (await request.sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -4985,7 +5156,7 @@ var OpenCodeAgentAdapter = class {
         signal: controller.signal,
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         }
       }).catch((error) => {
         debugOpencode(
@@ -5016,12 +5187,13 @@ var OpenCodeAgentAdapter = class {
       content
     );
     const parts = mapToOpenCodeParts(inputParts);
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const url = `${baseUrl}/session/${request.sessionId}/prompt_async`;
     const response = await fetch(url, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        ...request.sandbox.previewHeaders
+        ...authHeaders
       },
       body: JSON.stringify({
         agent: openCodeAgentSlug(void 0),

package/dist/events/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, ab as TextDeltaEvent, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from '../types-t01PuLUJ.js';
+export { A as AISDKEvent, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, ab as TextDeltaEvent, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from '../types-vOsvzkcO.js';
 import { AgentProvider } from '../enums.js';
 import '../Sandbox-DcKAU-E3.js';
 import 'e2b';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a5 as RepoSkillConfig, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, aa as SetupLayout, ab as TextDeltaEvent, ac as TextPart, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ag as UserContent, ah as UserContentPart, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from './types-t01PuLUJ.js';
+export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a5 as RepoSkillConfig, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, aa as SetupLayout, ab as TextDeltaEvent, ac as TextPart, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ag as UserContent, ah as UserContentPart, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from './types-vOsvzkcO.js';
 export { AGENT_RESERVED_PORTS, Agent, agentboxRoot, collectAllAgentReservedPorts, getAgentLayout } from './agents/index.js';
 export { A as AsyncCommandHandle, C as CommandEvent, a as CommandOptions, b as CommandResult, D as DaytonaProviderOptions, c as DaytonaSandboxOptions, E as E2bProviderOptions, d as E2bSandboxOptions, G as GitCloneOptions, L as LocalDockerProviderOptions, e as LocalDockerSandboxOptions, M as ModalProviderOptions, f as ModalSandboxOptions, S as Sandbox, g as SandboxDescriptor, h as SandboxListOptions, i as SandboxOptions, j as SandboxOptionsBase, k as SandboxOptionsMap, l as SandboxProviderName, m as SandboxRaw, n as SandboxRawMap, o as SandboxResourceSpec, T as TarballEntry, V as VercelGitSource, p as VercelProviderOptions, q as VercelSandboxOptions } from './Sandbox-DcKAU-E3.js';
 export { SandboxAdapter, buildGitCloneCommand } from './sandboxes/index.js';

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "./chunk-XONT46YC.js";
+} from "./chunk-KFMFNBVC.js";
 import {
   ProviderLogAssembler,
   createNormalizedEvent,

package/dist/{types-t01PuLUJ.d.ts → types-vOsvzkcO.d.ts}

@@ -418,6 +418,18 @@ interface ClaudeCodeProviderOptions {
      * silence them when hook noise drowns out the rest of the event stream.
      */
     includeHookEvents?: boolean;
+    /**
+     * Enable "ultracode" for claude-code runs: xhigh reasoning effort plus
+     * standing dynamic-workflow orchestration (the built-in `Workflow` tool).
+     *
+     * When `true`, agentbox writes `enableWorkflows: true` + `ultracode: true`
+     * into the managed `settings.json` and forces `effort: "xhigh"` on the query.
+     *
+     * Requires an xhigh-capable model (e.g. Opus) and a recent runtime — the
+     * Workflows feature shipped around Claude Code 2.1.154 / Agent SDK 0.3.149.
+     * On older CLIs the settings keys are simply ignored.
+     */
+    ultracode?: boolean;
 }
 interface CodexAgentOptions extends AgentOptionsBase {
     provider?: CodexProviderOptions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbox-sdk",
-  "version": "0.1.323",
+  "version": "0.1.400",
   "description": "Swappable coding agents and sandbox providers for Bun and TypeScript.",
   "license": "MIT",
   "repository": {