deepspace 0.33.1 → 0.34.0

package/dist/server.js

@@ -1860,36 +1860,60 @@ async function resolveAppRole(env, userId) {
 import { createAnthropic } from "@ai-sdk/anthropic";
 import { createOpenAI } from "@ai-sdk/openai";
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
-function withDefaultAnthropicMaxTokens(body) {
+
+// src/shared/sandbox.ts
+var SANDBOX_SCOPE_HEADER = "x-deepspace-sandbox-scope";
+
+// src/server/utils/app-identity.ts
+function appendAppIdentity(headers, env) {
+  headers.delete("x-app-identity-token");
+  headers.delete("x-app-id");
+  if (!env.APP_IDENTITY_TOKEN) return;
+  headers.set("x-app-identity-token", env.APP_IDENTITY_TOKEN);
+  headers.set("x-app-id", env.DEEPSPACE_APP_ID);
+}
+
+// src/server/utils/ai.ts
+import { defaultSettingsMiddleware, wrapLanguageModel } from "ai";
+function resolveProxyAuthToken(env, options) {
+  const authToken = options.authToken ?? env.APP_OWNER_JWT;
+  if (!authToken) {
+    throw new Error(
+      "DeepSpace AI proxy: no auth token available. Either pass `options.authToken` explicitly (for user-initiated calls), or ensure `env.APP_OWNER_JWT` is set (injected at deploy time or by `deepspace dev start`)."
+    );
+  }
+  return authToken;
+}
+function setProxyHeaders(headers, env, authToken, scope = "user") {
+  headers.set("X-Auth-Token", authToken);
+  appendAppIdentity(headers, {
+    DEEPSPACE_APP_ID: env.DEEPSPACE_APP_ID ?? "",
+    APP_IDENTITY_TOKEN: env.APP_IDENTITY_TOKEN
+  });
+  headers.set(SANDBOX_SCOPE_HEADER, scope);
+}
+var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 64e3;
+var OPENAI_TOOLS_NEED_NO_REASONING = /^gpt-(5\.6|6)-(sol|terra|luna)(-|$)/;
+function withOpenAIToolReasoningEffort(body) {
   if (typeof body !== "string") return body;
   try {
     const parsed = JSON.parse(body);
-    const hasExplicitLimit = typeof parsed.max_tokens === "number" || typeof parsed.max_completion_tokens === "number" || typeof parsed.max_output_tokens === "number";
-    if (hasExplicitLimit) return body;
-    return JSON.stringify({
-      ...parsed,
-      max_tokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS
-    });
+    const needsEffort = typeof parsed.model === "string" && OPENAI_TOOLS_NEED_NO_REASONING.test(parsed.model) && Array.isArray(parsed.tools) && parsed.tools.length > 0 && parsed.reasoning_effort === void 0;
+    return needsEffort ? JSON.stringify({ ...parsed, reasoning_effort: "none" }) : body;
   } catch {
     return body;
   }
 }
 function createDeepSpaceAI(env, provider, options = {}) {
   const transport = resolveApiTransport(env);
-  const authToken = options.authToken ?? env.APP_OWNER_JWT;
-  if (!authToken) {
-    throw new Error(
-      "createDeepSpaceAI: no auth token available. Either pass `options.authToken` explicitly (for user-initiated calls), or ensure `env.APP_OWNER_JWT` is set (injected at deploy time or by `deepspace dev start`)."
-    );
-  }
+  const authToken = resolveProxyAuthToken(env, options);
   const proxyFetch = (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
     const headers = new Headers(init?.headers);
     headers.delete("authorization");
     headers.delete("x-api-key");
-    headers.set("X-Auth-Token", authToken);
-    const body = provider === "anthropic" ? withDefaultAnthropicMaxTokens(init?.body) : init?.body;
+    setProxyHeaders(headers, env, authToken, options.sandboxScope);
+    const body = provider === "openai" ? withOpenAIToolReasoningEffort(init?.body) : init?.body;
     if (body !== init?.body) {
       headers.delete("content-length");
     }
@@ -1903,8 +1927,13 @@ function createDeepSpaceAI(env, provider, options = {}) {
   };
   const baseURL = `https://api-worker.internal/api/proxy/${provider}/v1`;
   switch (provider) {
-    case "anthropic":
-      return createAnthropic({ baseURL, apiKey: "platform-managed", fetch: proxyFetch });
+    case "anthropic": {
+      const anthropic2 = createAnthropic({ baseURL, apiKey: "platform-managed", fetch: proxyFetch });
+      const defaults = defaultSettingsMiddleware({
+        settings: { maxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS }
+      });
+      return (modelId) => wrapLanguageModel({ model: anthropic2(modelId), middleware: defaults });
+    }
     case "openai": {
       const op = createOpenAI({ baseURL, apiKey: "platform-managed", fetch: proxyFetch });
       return op.chat;
@@ -1925,10 +1954,7 @@ function createDeepSpaceAI(env, provider, options = {}) {
 }
 
 // src/server/utils/agent.ts
-import {
-  stepCountIs,
-  streamText
-} from "ai";
+import { isStepCount, streamText } from "ai";
 
 // src/shared/ai-models.ts
 var MULTI_STEP_AGENT_PROFILES = ["application", "documentation"];
@@ -1950,16 +1976,17 @@ var openAIModel = createMultiStepModelFactory({
   providerLabel: "OpenAI",
   transport: "chat-completions"
 });
+var DIRECT_GENERATION_NOTE = "Available for direct generation; the current proxy adapter has not passed multi-step tool-result continuation.";
 var DEEPSPACE_AI_MODELS = [
   anthropicModel({
-    id: "claude-fable-5",
-    label: "Claude Fable 5",
+    id: "claude-opus-5-5",
+    label: "Claude Opus 5.5",
     family: "Claude 5",
     recommendation: "frontier"
   }),
   anthropicModel({
-    id: "claude-opus-5",
-    label: "Claude Opus 5",
+    id: "claude-fable-5-1",
+    label: "Claude Fable 5.1",
     family: "Claude 5",
     recommendation: "frontier"
   }),
@@ -1976,23 +2003,29 @@ var DEEPSPACE_AI_MODELS = [
     recommendation: "fast"
   }),
   openAIModel({
-    id: "gpt-5.6-sol",
-    label: "GPT-5.6 Sol",
-    family: "GPT-5.6",
-    recommendation: "frontier"
-  }),
-  openAIModel({
-    id: "gpt-5.6-terra",
-    label: "GPT-5.6 Terra",
-    family: "GPT-5.6",
+    id: "gpt-6-sol",
+    label: "GPT-6 Sol",
+    family: "GPT-6",
     recommendation: "balanced"
   }),
   openAIModel({
-    id: "gpt-5.6-luna",
-    label: "GPT-5.6 Luna",
-    family: "GPT-5.6",
+    id: "gpt-6-luna",
+    label: "GPT-6 Luna",
+    family: "GPT-6",
     recommendation: "fast"
   }),
+  {
+    id: "gpt-6-astra",
+    label: "GPT-6 Astra",
+    provider: "openai",
+    providerLabel: "OpenAI",
+    family: "GPT-6",
+    agentSupport: "none",
+    agentProfiles: [],
+    transport: "chat-completions",
+    recommendation: "limited",
+    note: "Available for direct generation; its tool calling requires the Responses API, which the DeepSpace proxy does not serve."
+  },
   {
     id: "gpt-oss-120b",
     label: "GPT-OSS 120B",
@@ -2003,12 +2036,30 @@ var DEEPSPACE_AI_MODELS = [
     agentProfiles: [],
     transport: "chat-completions",
     recommendation: "limited",
-    note: "Available for direct generation; the current proxy adapter has not passed multi-step tool-result continuation."
-  }
+    note: DIRECT_GENERATION_NOTE
+  },
+  {
+    id: "qwen-3.8-27b",
+    label: "Qwen 3.8 27B",
+    provider: "cerebras",
+    providerLabel: "Cerebras",
+    family: "Qwen 3.8",
+    agentSupport: "single-step",
+    agentProfiles: [],
+    transport: "chat-completions",
+    recommendation: "limited",
+    note: DIRECT_GENERATION_NOTE
+  },
+  // Superseded models: still resolvable for apps that saved them.
+  anthropicModel({ id: "claude-opus-5", label: "Claude Opus 5", family: "Claude 5", recommendation: "frontier", legacy: true }),
+  anthropicModel({ id: "claude-fable-5", label: "Claude Fable 5", family: "Claude 5", recommendation: "frontier", legacy: true }),
+  openAIModel({ id: "gpt-5.6-sol", label: "GPT-5.6 Sol", family: "GPT-5.6", recommendation: "frontier", legacy: true }),
+  openAIModel({ id: "gpt-5.6-terra", label: "GPT-5.6 Terra", family: "GPT-5.6", recommendation: "balanced", legacy: true }),
+  openAIModel({ id: "gpt-5.6-luna", label: "GPT-5.6 Luna", family: "GPT-5.6", recommendation: "fast", legacy: true })
 ];
 var DEEPSPACE_AI_DEFAULTS = {
-  agent: "claude-sonnet-5",
-  directGeneration: "claude-sonnet-5",
+  agent: "claude-opus-5-5",
+  directGeneration: "claude-opus-5-5",
   summarization: "claude-haiku-4-5"
 };
 var DEEPSPACE_AGENT_PROFILES = {
@@ -2063,7 +2114,7 @@ var DeepSpaceAgentProfileError = class extends Error {
   code = "agent_profile_violation";
 };
 function streamDeepSpaceAgent(env, options) {
-  const { profile, modelId, authToken, ...streamOptions } = options;
+  const { profile, modelId, authToken, sandboxScope, ...streamOptions } = options;
   const selection = resolveDeepSpaceAgentModel(modelId, profile);
   if (!selection) throw new DeepSpaceAgentModelError(modelId, profile);
   if (selection.profile.allowedTools !== "application-defined") {
@@ -2074,14 +2125,17 @@ function streamDeepSpaceAgent(env, options) {
       }
     }
   }
-  const provider = createDeepSpaceAI(env, selection.provider, authToken ? { authToken } : {});
+  const provider = createDeepSpaceAI(env, selection.provider, {
+    ...authToken ? { authToken } : {},
+    ...sandboxScope ? { sandboxScope } : {}
+  });
   const { prepareStep, tools, ...remainingStreamOptions } = streamOptions;
   const boundedTools = limitToolExecutions(tools, selection.profile.maxToolCalls);
   const result = streamText({
     ...remainingStreamOptions,
     ...boundedTools ? { tools: boundedTools } : {},
     model: provider(selection.modelId),
-    stopWhen: stepCountIs(selection.profile.maxSteps),
+    stopWhen: isStepCount(selection.profile.maxSteps),
     prepareStep: enforceToolCallLimit(prepareStep, selection.profile.maxToolCalls),
     ...selection.provider === "openai" ? { providerOptions: { openai: { reasoningEffort: "none" } } } : {}
   });
@@ -2193,6 +2247,115 @@ function safeLogText(value) {
   ).trim().slice(0, 300);
 }
 
+// src/server/utils/sandbox.ts
+import { anthropic, forwardAnthropicContainerIdFromLastStep } from "@ai-sdk/anthropic";
+var FILES_PATH = "/api/proxy/anthropic/v1/files";
+var CODE_EXECUTION_CALLER = "code_execution_20260120";
+function codeExecutionTool() {
+  return anthropic.tools.codeExecution_20260120();
+}
+function callableFromSandbox(tool2) {
+  const anthropicOptions = tool2.providerOptions?.anthropic;
+  return {
+    ...tool2,
+    providerOptions: {
+      ...tool2.providerOptions,
+      anthropic: { ...anthropicOptions, allowedCallers: ["direct", CODE_EXECUTION_CALLER] }
+    }
+  };
+}
+var forwardSandboxContainer = forwardAnthropicContainerIdFromLastStep;
+function reuseSandbox(containerId) {
+  return containerId ? { anthropic: { container: { id: containerId } } } : void 0;
+}
+function sandboxUpload(file) {
+  return {
+    type: "file",
+    mediaType: file.mime_type,
+    filename: file.filename,
+    data: { type: "reference", reference: { anthropic: file.id } },
+    providerOptions: { anthropic: { containerUpload: true } }
+  };
+}
+function collectFileIds(value, out) {
+  if (Array.isArray(value)) {
+    for (const item of value) collectFileIds(item, out);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    if (key === "file_id" && typeof child === "string" && child) out.add(child);
+    else collectFileIds(child, out);
+  }
+}
+function sandboxOutputs(steps) {
+  let containerId = null;
+  const fileIds = /* @__PURE__ */ new Set();
+  for (const step of steps) {
+    const container = step.providerMetadata?.anthropic?.container;
+    if (typeof container?.id === "string") containerId = container.id;
+    for (const part of step.content) {
+      const result = part;
+      if (result.type === "tool-result" && result.providerExecuted) collectFileIds(result.output, fileIds);
+    }
+  }
+  return { containerId, fileIds: [...fileIds] };
+}
+var SandboxFileError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "SandboxFileError";
+  }
+};
+function sandboxFiles(env, options = {}) {
+  const authToken = resolveProxyAuthToken(env, options);
+  async function send(path, init = {}) {
+    const headers = new Headers(init.headers);
+    setProxyHeaders(headers, env, authToken, options.scope);
+    const response = await apiWorkerFetch(env, `${FILES_PATH}${path}`, { ...init, headers });
+    if (!response.ok) {
+      const text = await response.text();
+      let message = text || response.statusText;
+      try {
+        const body = JSON.parse(text);
+        if (typeof body.error === "string") message = body.error;
+        else if (body.error && typeof body.error === "object") message = JSON.stringify(body.error);
+      } catch {
+      }
+      throw new SandboxFileError(response.status, `Sandbox file request failed (${response.status}): ${message}`);
+    }
+    return response;
+  }
+  const fileUrl = (fileId) => `/${encodeURIComponent(fileId)}`;
+  return {
+    async upload(file, { filename, expiresInSeconds } = {}) {
+      const name = filename ?? (file instanceof File ? file.name : void 0);
+      if (!name) throw new SandboxFileError(400, "sandboxFiles.upload: a Blob needs options.filename");
+      const form = new FormData();
+      form.set("file", file, name);
+      if (expiresInSeconds !== void 0) form.set("expires_in_seconds", String(expiresInSeconds));
+      return (await send("", { method: "POST", body: form })).json();
+    },
+    async get(fileId) {
+      return (await send(fileUrl(fileId))).json();
+    },
+    download(fileId) {
+      return send(`${fileUrl(fileId)}/content`);
+    },
+    async list({ limit, page } = {}) {
+      const query = new URLSearchParams();
+      if (limit !== void 0) query.set("limit", String(limit));
+      if (page !== void 0) query.set("page", page);
+      const suffix = query.size > 0 ? `?${query}` : "";
+      return (await send(suffix)).json();
+    },
+    async delete(fileId) {
+      await send(fileUrl(fileId), { method: "DELETE" });
+    }
+  };
+}
+
 // src/server/utils/composio-tools.ts
 import { tool, jsonSchema } from "ai";
 var EMPTY_SCHEMA = { type: "object", properties: {} };
@@ -2275,15 +2438,6 @@ async function composioTools(env, options) {
   return tools;
 }
 
-// src/server/utils/app-identity.ts
-function appendAppIdentity(headers, env) {
-  headers.delete("x-app-identity-token");
-  headers.delete("x-app-id");
-  if (!env.APP_IDENTITY_TOKEN) return;
-  headers.set("x-app-identity-token", env.APP_IDENTITY_TOKEN);
-  headers.set("x-app-id", env.DEEPSPACE_APP_ID);
-}
-
 // src/server/utils/screenshot.ts
 async function captureScreenshot(env, url) {
   const headers = new Headers({ "content-type": "application/json" });
@@ -2636,14 +2790,14 @@ function formatTranscript(messages) {
 }
 function makeDefaultSummarizer(env, options = {}) {
   return async (messages) => {
-    const anthropic = createDeepSpaceAI(env, "anthropic", { authToken: options.authToken });
+    const anthropic2 = createDeepSpaceAI(env, "anthropic", { authToken: options.authToken });
     const { text } = await generateText({
       // Stable alias — provider bug-fix snapshots roll forward without code change.
-      model: anthropic("claude-haiku-4-5"),
+      model: anthropic2("claude-haiku-4-5"),
       // 2500 gives the model room to finish a sentence after hitting the
       // "under 2000 tokens" soft limit in the prompt.
       maxOutputTokens: 2500,
-      system: SUMMARIZER_SYSTEM_PROMPT,
+      instructions: SUMMARIZER_SYSTEM_PROMPT,
       messages: [{ role: "user", content: formatTranscript(messages) }]
     });
     return text;
@@ -4956,6 +5110,7 @@ function getAllUserRecords(sql, schemaRegistry) {
 }
 async function registerUser(sql, userId, name, email, imageUrl, isAdmin, defaultRole = "viewer", schemaRegistry) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
+  const normalizedEmail = email.trim().toLowerCase();
   const existing = getUserRecord(sql, userId, schemaRegistry);
   let role;
   if (isAdmin) {
@@ -4966,7 +5121,7 @@ async function registerUser(sql, userId, name, email, imageUrl, isAdmin, default
     role = defaultRole;
   }
   if (existing) {
-    const updatedEmail = email || existing.data.email;
+    const updatedEmail = normalizedEmail || existing.data.email;
     const updatedName = name && name !== "Anonymous" ? name : existing.data.name;
     const updatedImageUrl = imageUrl ?? existing.data.imageUrl;
     sql.exec(
@@ -4995,14 +5150,14 @@ async function registerUser(sql, userId, name, email, imageUrl, isAdmin, default
     userId,
     now,
     now,
-    email,
+    normalizedEmail,
     name,
     imageUrl ?? null,
     role,
     now,
     now
   );
-  return { id: userId, email, name, imageUrl, role, createdAt: now, lastSeenAt: now };
+  return { id: userId, email: normalizedEmail, name, imageUrl, role, createdAt: now, lastSeenAt: now };
 }
 function rosterFor(ctx, schema, records, publicRoster, userId, role) {
   if (!userId || isAnonymousUserId(userId)) return [];
@@ -5057,16 +5212,19 @@ function broadcastUserList(ctx, except) {
     });
   }
 }
-function handleUserUpdate(ctx, _ws, attachment, payload) {
+function handleUserUpdate(ctx, _ws, attachment) {
   const existing = getUserRecord(ctx.sql, attachment.userId, ctx.schemaRegistry);
   if (!existing) return;
-  const data = { lastSeenAt: (/* @__PURE__ */ new Date()).toISOString() };
-  if (payload.name && payload.name !== "Anonymous") data.name = payload.name;
-  if (payload.email) data.email = payload.email;
-  if (payload.imageUrl !== void 0) data.imageUrl = payload.imageUrl || void 0;
-  putRecord(ctx, "users", attachment.userId, data, attachment.userId, "admin", true, true);
-  const rosterChanged = data.name !== void 0 && data.name !== existing.data.name || data.imageUrl !== void 0 && data.imageUrl !== existing.data.imageUrl;
-  if (rosterChanged) broadcastUserList(ctx);
+  putRecord(
+    ctx,
+    "users",
+    attachment.userId,
+    { lastSeenAt: (/* @__PURE__ */ new Date()).toISOString() },
+    attachment.userId,
+    "admin",
+    true,
+    true
+  );
 }
 async function handleSetRole(ctx, ws, attachment, payload) {
   if (attachment.role !== "admin") {
@@ -5815,7 +5973,7 @@ var RecordRoom = class extends BaseRoom {
         this.schemaRegistry
       );
       const regMs = Date.now() - regStart;
-      if (!before || before.name !== registeredUser.name || before.imageUrl !== registeredUser.imageUrl || before.role !== registeredUser.role) {
+      if (!before || before.name !== registeredUser.name || before.email !== registeredUser.email || before.imageUrl !== registeredUser.imageUrl || before.role !== registeredUser.role) {
         broadcastUserList(this.createUserContext(), ws);
       }
       attachment = {
@@ -5942,12 +6100,7 @@ var RecordRoom = class extends BaseRoom {
         handleUserList(userCtx, ws, attachment);
         break;
       case MSG.USER_UPDATE:
-        handleUserUpdate(
-          recordCtx,
-          ws,
-          attachment,
-          payload
-        );
+        handleUserUpdate(recordCtx, ws, attachment);
         break;
       case MSG.SET_ROLE:
         await handleSetRole(userCtx, ws, attachment, payload);
@@ -7179,6 +7332,7 @@ function computeNextRunAt(task, from) {
 
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
+var BACKGROUND_ALARM_MS = 3e4;
 var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_SNAPSHOT_LIMIT = 100;
 var JobRoom = class extends BaseRoom {
@@ -7187,6 +7341,7 @@ var JobRoom = class extends BaseRoom {
   retentionMs;
   snapshotLimit;
   retryBackoffMs;
+  backgroundJobTypes;
   authorizeWrite;
   authorizeRead;
   broadcastQueue = Promise.resolve();
@@ -7200,6 +7355,7 @@ var JobRoom = class extends BaseRoom {
     this.retentionMs = Math.max(0, config.retentionMs ?? DEFAULT_RETENTION_MS);
     this.snapshotLimit = Math.max(1, config.snapshotLimit ?? DEFAULT_SNAPSHOT_LIMIT);
     this.retryBackoffMs = Math.max(0, config.retryBackoffMs ?? 1e3);
+    this.backgroundJobTypes = new Set(config.backgroundJobTypes ?? []);
     this.authorizeWrite = config.authorizeWrite ?? ((user) => user.role === ROLES.MEMBER || user.role === ROLES.ADMIN);
     this.authorizeRead = config.authorizeRead ?? this.authorizeWrite;
   }
@@ -7447,11 +7603,8 @@ var JobRoom = class extends BaseRoom {
   // ==========================================================================
   // Alarm / execution
   // ==========================================================================
-  /**
-   * Drain due jobs in FIFO order. All due jobs share the alarm's
-   * 15-min wall budget (a CF property, not a per-job allocation).
-   */
   async drainDueJobs() {
+    if (this.inFlight.size > 0) return;
     const cutoff = (/* @__PURE__ */ new Date()).toISOString();
     while (true) {
       const row = this.sql.exec(
@@ -7463,7 +7616,16 @@ var JobRoom = class extends BaseRoom {
         cutoff
       ).toArray()[0];
       if (!row) return;
-      await this.executeJob(row);
+      const execution = this.executeJob(row);
+      if (this.backgroundJobTypes.has(row.type)) {
+        this.state.waitUntil(
+          execution.catch(
+            (error) => console.error(`[jobs] background execution failed: ${loggableError(error)}`)
+          ).finally(() => this.scheduleNextAlarm())
+        );
+        return;
+      }
+      await execution;
     }
   }
   async executeJob(row) {
@@ -7500,7 +7662,7 @@ var JobRoom = class extends BaseRoom {
       this.inFlight.delete(row.id);
     }
     const currentStatus = this.readStatus(row.id);
-    if (currentStatus === "canceled") {
+    if (currentStatus !== "running") {
       this.continueState = null;
       return;
     }
@@ -7632,6 +7794,10 @@ var JobRoom = class extends BaseRoom {
   // Scheduling / recovery / pruning
   // ==========================================================================
   scheduleNextAlarm() {
+    if (this.inFlight.size > 0) {
+      this.state.storage.setAlarm(Date.now() + BACKGROUND_ALARM_MS);
+      return;
+    }
     const queued = this.sql.exec(
       `SELECT next_run_at FROM jobs
           WHERE status = 'queued'
@@ -7665,6 +7831,7 @@ var JobRoom = class extends BaseRoom {
       cutoff
     ).toArray();
     for (const r of stuck) {
+      if (this.inFlight.has(r.id)) continue;
       if (r.attempts >= r.max_attempts) {
         this.sql.exec(
           `UPDATE jobs
@@ -8619,6 +8786,7 @@ function isTestAccountTier(tier) {
 
 // src/server/auth/betterAuth.ts
 import { betterAuth } from "better-auth";
+import { getOAuthState } from "better-auth/api";
 import { organization, twoFactor } from "better-auth/plugins";
 import { SignJWT, importPKCS8 } from "jose";
 function createDeepSpaceAuth(config) {
@@ -8662,6 +8830,7 @@ function createDeepSpaceAuth(config) {
     emailAndPassword: {
       enabled: config.emailAndPassword ?? true
     },
+    ...config.userAdditionalFields ? { user: { additionalFields: config.userAdditionalFields } } : {},
     socialProviders,
     trustedOrigins: config.trustedOrigins ?? [
       "https://deep.space",
@@ -8697,29 +8866,45 @@ function createDeepSpaceAuth(config) {
     //     keys) — that case is caught by the runtime assertions in
     //     __tests__/betterAuth-hooks.test.ts, which read the wired hook back
     //     off auth.options. Don't rename the key without running them.
-    databaseHooks: buildDatabaseHooks(config.onUserCreated),
+    databaseHooks: buildDatabaseHooks(config.beforeUserCreate, config.onUserCreated),
     plugins: [organization(), twoFactor()]
   });
 }
-function buildDatabaseHooks(onUserCreated) {
-  if (!onUserCreated) return void 0;
+function buildDatabaseHooks(beforeUserCreate, onUserCreated) {
+  if (!beforeUserCreate && !onUserCreated) return void 0;
   return {
     user: {
       create: {
-        after: async (user, ctx) => {
-          try {
-            await onUserCreated(
-              { id: user.id, email: user.email, name: user.name },
-              // Forward BOTH request and standalone headers — some better-auth
-              // entry points populate ctx.headers without a request.
-              ctx ? { request: ctx.request, headers: ctx.headers ?? void 0 } : null
-            );
-          } catch (err) {
-            console.error(
-              `[deepspace] onUserCreated hook failed (signup unaffected): ${loggableError(err)}`
-            );
+        ...beforeUserCreate ? {
+          before: async (user, ctx) => beforeUserCreate(
+            user,
+            ctx ? {
+              request: ctx.request,
+              headers: ctx.headers ?? void 0,
+              path: ctx.path,
+              // Read from this package's Better Auth instance. In a
+              // pnpm graph the consuming worker can have another
+              // physical copy whose request-state singleton differs.
+              oauthState: await getOAuthState()
+            } : null
+          )
+        } : {},
+        ...onUserCreated ? {
+          after: async (user, ctx) => {
+            try {
+              await onUserCreated(
+                { id: user.id, email: user.email, name: user.name },
+                // Forward BOTH request and standalone headers — some better-auth
+                // entry points populate ctx.headers without a request.
+                ctx ? { request: ctx.request, headers: ctx.headers ?? void 0 } : null
+              );
+            } catch (err) {
+              console.error(
+                `[deepspace] onUserCreated hook failed (signup unaffected): ${loggableError(err)}`
+              );
+            }
           }
-        }
+        } : {}
       }
     }
   };
@@ -8924,6 +9109,7 @@ export {
   SYSTEM_COLLECTION_SCHEMAS,
   SYSTEM_MAINTAINED_COLUMNS,
   SYSTEM_MANAGED_COLUMNS,
+  SandboxFileError,
   SchemaRegistry,
   SubscriptionAuthError,
   SubscriptionRequiredError,
@@ -8946,6 +9132,7 @@ export {
   buildTableSelect,
   buildUiParts,
   callRegistry,
+  callableFromSandbox,
   canCreate,
   canDelete,
   canRead,
@@ -8955,6 +9142,7 @@ export {
   captureScreenshot,
   checkFieldPermissions,
   checkUnclaimedOwnerTransition,
+  codeExecutionTool,
   coerceValue,
   collectionTableName,
   columnId,
@@ -8975,6 +9163,7 @@ export {
   executeQuery,
   folderFilter,
   formatBytes,
+  forwardSandboxContainer,
   getAllUsers,
   getChat,
   getOrCreateYjsDoc,
@@ -9033,8 +9222,12 @@ export {
   resolveAppRole,
   resolveColumn,
   resolveSessionReadAuth,
+  reuseSandbox,
   rowToData,
   runMigrations,
+  sandboxFiles,
+  sandboxOutputs,
+  sandboxUpload,
   saveYjsDoc,
   storageLimitForTier,
   storageQuotaMessage,