mindwire 0.1.14 → 0.1.18

package/dist/index.d.ts

@@ -32,7 +32,9 @@ export { catalogProviders, catalogProvider, catalogModels, lookupModel, loadCata
 export type { CatalogOptions } from "./catalog/index.js";
 export { MindwireError, ApiError, RunFailedError, TimeoutError } from "./errors.js";
 export * from "./types.js";
-export { WorkspaceApi, WorkspaceCollection, ProjectOperationsApi } from "./workspace.js";
-export type { ProjectRequest, ProjectAuth, ProjectOperation, ProjectRemoveRequest } from "./workspace.js";
+export { ServiceApi } from "./service.js";
+export type { ServiceUpdateState, ServiceUpdateLease } from "./service.js";
+export { WorkspaceApi, WorkspaceCollection, ProjectOperationsApi, GitAccessApi } from "./workspace.js";
+export type { ProjectRequest, ProjectAuth, ProjectOperation, ProjectRemoveRequest, GitConnection, GitAccessState, ProjectGitState, GitAction, GitOperationRequest, GitOperation } from "./workspace.js";
 export type { WorkspaceRecord, WorkspaceAgent, WorkspaceProject, WorkspaceChat, WorkspaceKind, WorkspaceInput, WorkspaceImport, WorkspaceSnapshot } from "./workspace.js";
 export * from "./surfaces.js";

package/dist/index.js

@@ -380,8 +380,9 @@ var Run = class _Run {
     await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/cancel`);
   }
   /**
-   * Answer a mid-turn interaction the turn is waiting on — a permission approval, or an
-   * AskUserQuestion / ExitPlanMode reply. Requires the agent's `respond` capability.
+   * Answer a pending permission, question or plan. Message-mode questions remain answerable
+   * after completion; the daemon steers or resumes the conversation. Read the chat's latest
+   * run after replying to a completed run. Requires the agent's `respond` capability.
    */
   async respond(input = {}) {
     await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/respond`, { body: input });
@@ -545,12 +546,14 @@ var WorkspaceCollection = class {
 var WorkspaceApi = class {
   constructor(mw) {
     this.mw = mw;
+    this.git = new GitAccessApi(mw);
     this.operations = new ProjectOperationsApi(mw);
     this.agents = new WorkspaceCollection(mw, "agents");
     this.projects = new WorkspaceCollection(mw, "projects");
     this.chats = new WorkspaceCollection(mw, "chats");
   }
   mw;
+  git;
   operations;
   agents;
   projects;
@@ -579,6 +582,75 @@ var WorkspaceApi = class {
     return this.mw.http.request("POST", "/workspace/import", { body: records });
   }
 };
+var GitAccessApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  state() {
+    return this.mw.http.request("GET", "/workspace/git");
+  }
+  setDefault(connection, auth) {
+    return this.mw.http.request("PUT", "/workspace/git", { body: { connection, auth } });
+  }
+  forget(connectionId) {
+    return this.mw.http.request("DELETE", `/workspace/git/connections/${encodeURIComponent(connectionId)}`);
+  }
+  project(projectId) {
+    return this.mw.http.request("GET", `/workspace/projects/${encodeURIComponent(projectId)}/git`);
+  }
+  setProject(projectId, connection, expectedRevision, auth) {
+    return this.mw.http.request("PUT", `/workspace/projects/${encodeURIComponent(projectId)}/git`, {
+      body: { connection, expectedRevision, auth }
+    });
+  }
+  /** Compatibility call. Prefer start() and operation()/watch() for reconnectable writes. */
+  run(projectId, operation, auth) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/${operation}`, { body: { auth } });
+  }
+  /** Requires health.gitOperationsVersion >= 1. Acceptance persists before Git runs;
+   * disconnecting only detaches the client. The same ID/intent never runs twice.
+   */
+  start(projectId, request) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`, { body: request });
+  }
+  async operations(projectId, activeOnly = false) {
+    const result = await this.mw.http.request(
+      "GET",
+      `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`,
+      { query: { active: activeOnly } }
+    );
+    return result.operations;
+  }
+  operation(id) {
+    return this.mw.http.request("GET", `/workspace/git/operations/${encodeURIComponent(id)}`);
+  }
+  cancel(id) {
+    return this.mw.http.request("POST", `/workspace/git/operations/${encodeURIComponent(id)}/cancel`);
+  }
+  /** Current snapshot followed by state changes. Aborting observation never cancels the operation. */
+  async *watch(id, opts = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    opts.signal?.addEventListener("abort", abort, { once: true });
+    if (opts.signal?.aborted) controller.abort();
+    try {
+      const response = await this.mw.http.open("GET", `/workspace/git/operations/${encodeURIComponent(id)}/stream`, {
+        signal: controller.signal
+      });
+      let sequence = -1;
+      for await (const operation of readSSE(response.body, controller.signal)) {
+        if (operation.sequence > sequence) {
+          sequence = operation.sequence;
+          yield operation;
+        }
+      }
+    } finally {
+      controller.abort();
+      opts.signal?.removeEventListener("abort", abort);
+    }
+  }
+};
 
 // src/surfaces.ts
 var SurfacesApi = class {
@@ -640,8 +712,27 @@ var SurfacesApi = class {
   }
 };
 
+// src/service.ts
+var ServiceApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  updateStatus() {
+    return this.client.http.request("GET", "/service/update");
+  }
+  /** Download first. Acquire immediately before replacement; busy work returns 409.
+   * Admission stays closed until release, process exit, or the one-minute expiry. */
+  acquireUpdate() {
+    return this.client.http.request("POST", "/service/update");
+  }
+  releaseUpdate(id) {
+    return this.client.http.request("DELETE", `/service/update/${encodeURIComponent(id)}`);
+  }
+};
+
 // src/version.ts
-var SDK_VERSION = "0.1.14" ;
+var SDK_VERSION = "0.1.18" ;
 
 // src/daemon-binary.ts
 function supported(platform, arch) {
@@ -902,6 +993,7 @@ var Mindwire = class _Mindwire {
   /** Workspace registry: saved agent profiles, projects and chat relationships. */
   workspace;
   surfaces;
+  service;
   http;
   /** The default agent type applied to agent-scoped calls, if set. */
   defaultAgent;
@@ -937,6 +1029,7 @@ var Mindwire = class _Mindwire {
     this.defaultAgent = opts.agent;
     this.workspace = new WorkspaceApi(this);
     this.surfaces = new SurfacesApi(this);
+    this.service = new ServiceApi(this);
     this.auth = new AuthApi(this);
     this.prompts = new PromptsApi(this);
     this.mcp = new McpApi(this);
@@ -959,6 +1052,7 @@ var Mindwire = class _Mindwire {
     clone.defaultAgent = agent;
     clone.workspace = new WorkspaceApi(clone);
     clone.surfaces = new SurfacesApi(clone);
+    clone.service = new ServiceApi(clone);
     clone.auth = new AuthApi(clone);
     clone.prompts = new PromptsApi(clone);
     clone.mcp = new McpApi(clone);
@@ -1007,6 +1101,12 @@ var Mindwire = class _Mindwire {
   agent(scoped) {
     return this.http.request("GET", "/agent", { query: this.agentParam(scoped) });
   }
+  /** `GET /agent/software` — installed version, compatibility and approved update target. */
+  software(opts = {}) {
+    return this.http.request("GET", "/agent/software", {
+      query: { ...this.agentParam(opts), ...opts.refresh ? { refresh: "true" } : {} }
+    });
+  }
   /**
    * `GET /models` — the models the selected agent can run for the configured account. An empty array
    * is valid (no credentials yet / offline). Throws a 400 {@link ApiError} for an agent whose model is
@@ -1024,7 +1124,7 @@ var Mindwire = class _Mindwire {
   setup(scoped) {
     return this.http.request("POST", "/setup", { query: this.agentParam(scoped) });
   }
-  /** `POST /update` — re-run the toolchain, forcing reinstall of installable steps. */
+  /** `POST /update` — install the catalog's newest tested version compatible with this daemon. */
   update(scoped) {
     return this.http.request("POST", "/update", { query: this.agentParam(scoped) });
   }
@@ -1121,6 +1221,7 @@ var Mindwire = class _Mindwire {
     if (input.options !== void 0) body.options = input.options;
     if (input.mode !== void 0) body.mode = input.mode;
     if (input.resolve !== void 0) body.resolve = input.resolve;
+    if (input.gitAuth !== void 0) body.gitAuth = input.gitAuth;
     const data = await this.http.request("POST", "/turns", {
       query: this.agentParam(input),
       body
@@ -1224,12 +1325,26 @@ var AuthApi = class {
       body: input
     });
   }
+  /** Read one interactive attempt, scoped by the returned AuthState.flowId. */
+  poll(flowId, scoped) {
+    return this.step({ _flowId: flowId }, scoped);
+  }
+  /** Cancel this native login without affecting a newer sign-in attempt. */
+  cancel(flowId, scoped) {
+    return this.step({ _flowId: flowId, _action: "cancel" }, scoped);
+  }
   /** `GET /auth/status` — is the agent authenticated, and via which method. */
   status(scoped) {
     return this.mw.http.request("GET", "/auth/status", {
       query: this.mw.agentParam(scoped)
     });
   }
+  /** `POST /auth/logout` — disconnect this harness once its running chats finish. */
+  logout(scoped) {
+    return this.mw.http.request("POST", "/auth/logout", {
+      query: this.mw.agentParam(scoped)
+    });
+  }
 };
 var PromptsApi = class {
   constructor(mw) {
@@ -1471,6 +1586,23 @@ var NotifyApi = class {
 };
 
 // src/target/host.ts
+function versionAtLeast(actual, desired) {
+  if (actual === desired) return true;
+  if (!actual || !/^\d+\.\d+\.\d+$/.test(actual) || !/^\d+\.\d+\.\d+$/.test(desired)) return false;
+  const a = actual.split(".").map(Number), b = desired.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return true;
+}
+var versionCheckScript = String.raw`version_at_least() {
+  [ "$1" != "$2" ] || return 0
+  [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && [[ "$2" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+  local a b c x y z
+  IFS=. read -r a b c <<< "$1"
+  IFS=. read -r x y z <<< "$2"
+  (( 10#$a > 10#$x || (10#$a == 10#$x && 10#$b > 10#$y) || (10#$a == 10#$x && 10#$b == 10#$y && 10#$c >= 10#$z) ))
+}`;
 function makeEmit(cfg) {
   const target = cfg.target ?? "sandbox";
   return (e) => {
@@ -1507,19 +1639,24 @@ async function ensureDaemon(host, cfg) {
         message: health.version ? `daemon reachable (v${health.version})` : "daemon reachable (version unknown)",
         version: health.version
       });
-      const upToDate = health.version !== void 0 && health.version === desired;
+      const upToDate = versionAtLeast(health.version, desired);
       if (!cfg.forceDeploy && (upToDate || !cfg.autoUpdate)) {
         emit2({
           phase: "skip",
-          message: upToDate ? `daemon already at v${desired}` : "keeping the running daemon",
+          message: upToDate ? `daemon already at v${health.version}` : "keeping the running daemon",
           version: health.version
         });
         return token;
       }
+      if ((health.serviceUpdateVersion ?? 0) < 1) {
+        if (cfg.forceDeploy) throw new MindwireError("This legacy service cannot reserve an idle update. Upgrade it explicitly or stop it after its work finishes before deploying.");
+        emit2({ phase: "skip", message: "automatic update deferred: upgrade this legacy service explicitly to enable idle updates", version: health.version });
+        return token;
+      }
     } else {
       emit2({ phase: "probe", message: "no daemon reachable; deploying" });
     }
-    await deploy(host, cfg, emit2, token, directory);
+    await deploy(host, cfg, emit2, token, directory, health.reachable);
     if (!cfg.token) token = await readWorkspaceToken(host, directory) ?? token;
     return token;
   } catch (err) {
@@ -1532,7 +1669,7 @@ async function readWorkspaceToken(host, directory) {
   const candidate = saved.stdout?.trim();
   return candidate && candidate.length <= 4096 && /^[\x21-\x7e]+$/.test(candidate) ? candidate : void 0;
 }
-async function deploy(host, cfg, emit2, token, directory) {
+async function deploy(host, cfg, emit2, token, directory, requireLease) {
   const newPath = directory + "/mindwired.new";
   const BIN = shellQuote(directory + "/mindwired"), BIN_NEW = shellQuote(newPath);
   const STATE = shellQuote(directory + "/agent-state.json"), LOG = shellQuote(directory + "/daemon.log");
@@ -1574,6 +1711,7 @@ async function deploy(host, cfg, emit2, token, directory) {
       `  latest=$(curl -fsSL https://api.github.com/repos/oblien/mindwire/releases/latest | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')`,
       '  case "$latest" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "MINDWIRE_FAIL no matching or latest release"; exit 1 ;; esac',
       '  release="https://github.com/oblien/mindwire/releases/download/$latest"',
+      '  mw_expected_version="${latest#v}"',
       `  asset="mindwired-$latest-${platform}-${arch}"`,
       '  download || { echo "MINDWIRE_FAIL latest release download failed"; exit 1; }',
       "fi",
@@ -1593,43 +1731,75 @@ async function deploy(host, cfg, emit2, token, directory) {
     'else echo "MINDWIRE_FAIL No supported update lock is available (flock on Linux, lockf on macOS)."; exit 1; fi',
     `mw_token=${shellQuote(token)}`,
     !cfg.token ? `if [ -s ${TOKEN} ]; then mw_token=$(cat ${TOKEN}); fi` : "",
+    'mw_lease=""',
+    `mw_lease_file=${shellQuote(directory)}/update-lease-$$.json`,
+    "cleanup_update() {",
+    `  if [ -n "$mw_lease" ]; then curl -s --connect-timeout 2 --max-time 3 -X DELETE -H "Authorization: Bearer $mw_token" "http://127.0.0.1:${cfg.port}/service/update/$mw_lease" >/dev/null 2>&1 || true; fi`,
+    `  rm -f ${BIN_NEW} "$mw_lease_file"${stagedUpload ? " " + shellQuote(stagedUpload) : ""}`,
+    "}",
+    // Shared staging is only removed while this process owns the workspace lock.
+    "trap cleanup_update EXIT",
+    versionCheckScript,
+    `mw_desired=${shellQuote(desired)}`,
+    'mw_expected_version="$mw_desired"',
+    `mw_health=$(curl -fsS --max-time 3 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz 2>/dev/null || true)`,
     !cfg.forceDeploy ? [
-      `mw_health=$(curl -fsS --max-time 3 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz 2>/dev/null || true)`,
       `mw_version=$(printf '%s' "$mw_health" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\\([^" ]*\\)".*/\\1/p')`,
-      `if [ -n "$mw_health" ] && ${cfg.autoUpdate ? `[ "$mw_version" = ${shellQuote(desired)} ]` : "true"}; then echo MINDWIRE_READY; exit 0; fi`
+      `if [ -n "$mw_health" ] && ${cfg.autoUpdate ? 'version_at_least "$mw_version" "$mw_desired"' : "true"}; then echo MINDWIRE_READY; exit 0; fi`
     ].join("\n") : "",
     // macOS ships POSIX setsid in Perl, but does not include Linux's setsid executable.
     "if command -v setsid >/dev/null 2>&1; then mw_detach=(setsid);",
     `elif command -v perl >/dev/null 2>&1; then mw_detach=(perl -MPOSIX -e 'defined(my $sid = POSIX::setsid()) && $sid >= 0 or die "setsid: $!"; exec @ARGV; die "exec: $!";');`,
     'else echo "MINDWIRE_FAIL Cannot start the Mindwire service: setsid or Perl is required."; exit 1; fi',
     acquire,
-    // Stop a prior daemon by exact process NAME, never `pkill -f <path>`: this whole script (which
-    // contains `${BIN}` several times) is the argv of the `bash -lc` shell running it, so a full-cmdline
-    // match would SIGTERM our own deploying shell before the daemon ever launches. `-x mindwired` matches
-    // only the daemon's comm (`bash`/`pkill` never match), leaving this shell alive.
-    "if command -v pkill >/dev/null 2>&1; then",
-    "  pkill -x mindwired 2>/dev/null || true",
-    "else",
-    "  for mw_proc in /proc/[0-9]*/comm; do",
-    '    IFS= read -r mw_name 2>/dev/null < "$mw_proc" || continue',
-    '    [ "$mw_name" = mindwired ] || continue',
-    "    mw_pid=${mw_proc#/proc/}; mw_pid=${mw_pid%/comm}",
-    '    kill "$mw_pid" 2>/dev/null || true',
-    "  done",
+    // The service decides idleness after transfer. Never stop arbitrary processes
+    // or interrupt a chat that began while the SDK was downloading its binary.
+    `mw_health=$(curl -fsS --max-time 3 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz 2>/dev/null || true)`,
+    'if [ -n "$mw_health" ]; then',
+    `  mw_status=$(curl -s --connect-timeout 2 --max-time 5 -X POST -H "Authorization: Bearer $mw_token" -o "$mw_lease_file" -w '%{http_code}' http://127.0.0.1:${cfg.port}/service/update) || mw_status=000`,
+    '  case "$mw_status" in',
+    "    201)",
+    `      mw_lease=$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*"\\([[:alnum:]]*\\)".*/\\1/p' "$mw_lease_file")`,
+    `      mw_service_pid=$(sed -n 's/.*"pid"[[:space:]]*:[[:space:]]*\\([0-9][0-9]*\\).*/\\1/p' "$mw_lease_file")`,
+    '      [ -n "$mw_lease" ] && [[ "$mw_service_pid" =~ ^[0-9]+$ ]] && [ "$mw_service_pid" -gt 1 ] || { echo "MINDWIRE_FAIL invalid service update lease"; exit 1; }',
+    '      kill "$mw_service_pid" ;;',
+    "    409) echo MINDWIRE_UPDATE_DEFERRED; exit 0 ;;",
+    '    404) echo "MINDWIRE_FAIL this legacy service requires an explicit upgrade before idle updates"; exit 1 ;;',
+    '    *) echo "MINDWIRE_FAIL could not reserve an idle service update"; exit 1 ;;',
+    "  esac",
+    requireLease ? 'else echo "MINDWIRE_FAIL the service went offline before its idle update could be reserved"; exit 1' : "",
     "fi",
     "sleep 0.3",
     `mv -f ${BIN_NEW} ${BIN}`,
     `chmod +x ${BIN}`,
     // Detach so the daemon survives this exec's shell exiting. ADDR=":<port>" binds 0.0.0.0.
-    `"\${mw_detach[@]}" nohup env ADDR=":${cfg.port}" AGENT_TYPE=${shellQuote(cfg.agent)} AGENT_CWD=${shellQuote(cfg.agentCwd)} STATE_PATH=${STATE} DAEMON_TOKEN="$mw_token" ${BIN} > ${LOG} 2>&1 < /dev/null 9>&- &`,
+    // Ignore HUP directly: macOS nohup can fail after setsid in a headless workspace.
+    `"\${mw_detach[@]}" /bin/sh -c 'trap "" HUP; exec "$@"' mindwire-service env ADDR=":${cfg.port}" AGENT_TYPE=${shellQuote(cfg.agent)} AGENT_CWD=${shellQuote(cfg.agentCwd)} STATE_PATH=${STATE} DAEMON_TOKEN="$mw_token" ${BIN} > ${LOG} 2>&1 < /dev/null 9>&- &`,
     // Health-poll from inside the VM (loopback) and emit a marker — exit codes are unreliable here.
-    `for ((mw_attempt=0; mw_attempt<60; mw_attempt++)); do curl -fsS --max-time 2 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
-    "echo MINDWIRE_FAIL",
-    `tail -n 40 ${LOG} 2>/dev/null || true`
+    'mw_pid=$!; mw_exit=""; mw_deadline=$((SECONDS + 30))',
+    "while (( SECONDS < mw_deadline )); do",
+    `  mw_health=$(curl -fsS --connect-timeout 2 --max-time 3 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz 2>/dev/null || true)`,
+    `  mw_version=$(printf '%s' "$mw_health" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\\([^" ]*\\)".*/\\1/p')`,
+    '  if version_at_least "$mw_version" "$mw_expected_version"; then echo MINDWIRE_READY; exit 0; fi',
+    '  if [ -z "$mw_exit" ] && ! kill -0 "$mw_pid" 2>/dev/null; then',
+    '    mw_exit=0; wait "$mw_pid" || mw_exit=$?; [ "$mw_exit" = 0 ] || break',
+    "  fi",
+    "  sleep 0.25",
+    "done",
+    `mw_tail=$(tail -n 40 ${LOG} 2>/dev/null || true)`,
+    'if [ -n "$mw_exit" ] && [ "$mw_exit" != 0 ]; then mw_reason="Mindwire exited during startup (status $mw_exit).";',
+    'else mw_reason="The Mindwire service did not become ready at v$mw_expected_version (reported: $mw_version)."; fi',
+    '[ -z "$mw_tail" ] || mw_reason="$mw_reason $mw_tail"',
+    'printf "MINDWIRE_FAIL %s\\n" "$mw_reason"'
   ].join("\n");
   emit2({ phase: "launch", message: "launching daemon" });
   const res = await host.exec(["bash", "-lc", script], { timeoutSeconds: 420 });
   const out = res.stdout ?? "";
+  if (out.includes("MINDWIRE_UPDATE_DEFERRED")) {
+    if (cfg.forceDeploy) throw new MindwireError("The workspace is busy. Wait for its operations to finish before deploying the service.");
+    emit2({ phase: "skip", message: "service update deferred while workspace operations are running" });
+    return;
+  }
   if (!out.includes("MINDWIRE_READY")) {
     throw new MindwireError(
       "mindwire: the in-sandbox daemon did not become healthy after deploy.\n" + (out || res.stderr || res.error || "(no output)").trim()
@@ -1644,7 +1814,11 @@ async function probeHealth(host, port, token) {
   if (!body) return { reachable: false };
   try {
     const j = JSON.parse(body);
-    return { reachable: true, version: typeof j.version === "string" ? j.version : void 0 };
+    return {
+      reachable: true,
+      version: typeof j.version === "string" ? j.version : void 0,
+      serviceUpdateVersion: typeof j.serviceUpdateVersion === "number" ? j.serviceUpdateVersion : void 0
+    };
   } catch {
     return { reachable: true };
   }
@@ -1745,7 +1919,7 @@ var ContainerHost = class {
   base;
   containerId;
   exec(argv, opts) {
-    return this.base.exec(["docker", "exec", this.containerId, ...argv], opts);
+    return this.base.exec(["docker", "exec", "--env", "MINDWIRE_ISOLATION=container", this.containerId, ...argv], opts);
   }
   async putFile(path, data, opts) {
     const slash = path.lastIndexOf("/");
@@ -1845,7 +2019,7 @@ async function runContainer(host, cfg, emit2) {
       "mindwire: running the daemon in a container needs an image (docker.image) to create one, or an existing container (docker.container) to attach to."
     );
   }
-  const runArgs = ["docker", "run", "-d"];
+  const runArgs = ["docker", "run", "-d", "--env", "MINDWIRE_ISOLATION=container"];
   if (cfg.name) runArgs.push("--name", cfg.name);
   runArgs.push("-p", `127.0.0.1:0:${port}`);
   if (cfg.createArgs?.length) runArgs.push(...cfg.createArgs);
@@ -2172,7 +2346,7 @@ var DockerHost = class {
   container;
   async exec(argv) {
     const { Writable } = await import('stream');
-    const exec = await this.container.exec({ Cmd: argv, AttachStdout: true, AttachStderr: true });
+    const exec = await this.container.exec({ Cmd: argv, Env: ["MINDWIRE_ISOLATION=container"], AttachStdout: true, AttachStderr: true });
     const stream = await exec.start({ hijack: true, stdin: false });
     const out = [];
     const err = [];
@@ -2226,7 +2400,7 @@ async function provisionDocker(docker2, config = {}, onLog) {
       // The runtime image starts mindwired itself. Do not replace its command: doing so turns the
       // image ENTRYPOINT into `mindwired sleep infinity` and prevents the runtime from starting.
       Image: image,
-      Env: [`ADDR=:${port}`, `AGENT_TYPE=${agent}`, `AGENT_CWD=${agentCwd}`],
+      Env: [`ADDR=:${port}`, `AGENT_TYPE=${agent}`, `AGENT_CWD=${agentCwd}`, "MINDWIRE_ISOLATION=container"],
       Tty: false,
       ExposedPorts: { [portKey]: {} },
       HostConfig: { PortBindings: { [portKey]: [{ HostPort: "0" }] } },
@@ -2541,6 +2715,6 @@ function clearCatalogCache() {
   inflight = null;
 }
 
-export { ApiError, AuthApi, ContainerHost, Http, MODELS_DEV_URL, McpApi, Mindwire, MindwireError, NotifyApi, ProjectOperationsApi, PromptsApi, ProvidersApi, Run, RunFailedError, SDK_VERSION, SurfacesApi, TimeoutError, WorkspaceApi, WorkspaceCollection, catalogModels, catalogProvider, catalogProviders, clearCatalogCache, docker, ensureDaemon, ensureDaemonBinary, loadCatalog, local, lookupModel, oblien, provisionContainer, provisionDocker, provisionOblien, provisionSsh, provisionSshContainer, remote, resolveLinuxDaemon, ssh, startEmbedded };
+export { ApiError, AuthApi, ContainerHost, GitAccessApi, Http, MODELS_DEV_URL, McpApi, Mindwire, MindwireError, NotifyApi, ProjectOperationsApi, PromptsApi, ProvidersApi, Run, RunFailedError, SDK_VERSION, ServiceApi, SurfacesApi, TimeoutError, WorkspaceApi, WorkspaceCollection, catalogModels, catalogProvider, catalogProviders, clearCatalogCache, docker, ensureDaemon, ensureDaemonBinary, loadCatalog, local, lookupModel, oblien, provisionContainer, provisionDocker, provisionOblien, provisionSsh, provisionSshContainer, remote, resolveLinuxDaemon, ssh, startEmbedded };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map