noumen 0.3.0 → 0.5.0

package/dist/index.js

@@ -7,18 +7,9 @@ import {
   DEFAULT_PRICING,
   DEFAULT_RETRY_CONFIG,
   DenialTracker,
-  DockerComputer,
-  DockerFs,
-  DockerSandbox,
-  E2BComputer,
-  E2BFs,
-  E2BSandbox,
   FileCheckpointManager,
   FileMemoryProvider,
   FileStateCache,
-  FreestyleComputer,
-  FreestyleFs,
-  FreestyleSandbox,
   InProcessBackend,
   InvariantViolation,
   LocalComputer,
@@ -31,9 +22,6 @@ import {
   STRUCTURED_OUTPUT_TOOL_NAME,
   SandboxedLocalComputer,
   SpanStatusCode,
-  SpritesComputer,
-  SpritesFs,
-  SpritesSandbox,
   StreamingToolExecutor,
   SwarmManager,
   TaskStore,
@@ -126,30 +114,18 @@ import {
   tryReactiveCompact,
   webSearchToolPlaceholder,
   withRetry
-} from "./chunk-4HW6LN6D.js";
-import {
-  applySnipRemovals,
-  projectSnippedView,
-  snipMessagesByUuids
-} from "./chunk-42PHHZUA.js";
+} from "./chunk-WPCYGZOE.js";
 import {
   DEFAULT_MODELS,
   SUPPORTED_PROVIDERS,
   detectProvider,
   resolveProvider
-} from "./chunk-5JN4SPI7.js";
+} from "./chunk-WTLK2ZAR.js";
 import {
-  getAutoCompactThreshold,
-  getContextWindowForModel,
-  getEffectiveContextWindow,
-  getMessageCacheBreakpointIndex,
-  registerContextWindows,
-  sortToolDefinitionsForCache
-} from "./chunk-HEQQQGK5.js";
-import {
-  ChatStreamError
-} from "./chunk-L3L3FG5T.js";
-import "./chunk-3HEYCV26.js";
+  applySnipRemovals,
+  projectSnippedView,
+  snipMessagesByUuids
+} from "./chunk-42PHHZUA.js";
 import {
   RULE_SOURCE_PRECEDENCE,
   TOOL_SEARCH_NAME,
@@ -187,12 +163,7 @@ import {
   toolMatchesRule,
   webFetchTool,
   writeFileTool
-} from "./chunk-HL6JCRZJ.js";
-import {
-  formatZodValidationError,
-  registerZodToJsonSchema,
-  zodToJsonSchema
-} from "./chunk-3SK5GCI6.js";
+} from "./chunk-XZN4QZLK.js";
 import {
   API_IMAGE_MAX_BASE64_SIZE,
   IMAGE_EXTENSIONS,
@@ -209,6 +180,23 @@ import {
   normalizeNameForMCP,
   parseMcpToolName
 } from "./chunk-4SQA2UCV.js";
+import {
+  formatZodValidationError,
+  registerZodToJsonSchema,
+  zodToJsonSchema
+} from "./chunk-3SK5GCI6.js";
+import {
+  getAutoCompactThreshold,
+  getContextWindowForModel,
+  getEffectiveContextWindow,
+  getMessageCacheBreakpointIndex,
+  registerContextWindows,
+  sortToolDefinitionsForCache
+} from "./chunk-HEQQQGK5.js";
+import {
+  ChatStreamError
+} from "./chunk-L3L3FG5T.js";
+import "./chunk-3HEYCV26.js";
 import {
   contentToString,
   hasImageContent,
@@ -228,18 +216,9 @@ export {
   DEFAULT_PRICING,
   DEFAULT_RETRY_CONFIG,
   DenialTracker,
-  DockerComputer,
-  DockerFs,
-  DockerSandbox,
-  E2BComputer,
-  E2BFs,
-  E2BSandbox,
   FileCheckpointManager,
   FileMemoryProvider,
   FileStateCache,
-  FreestyleComputer,
-  FreestyleFs,
-  FreestyleSandbox,
   IMAGE_EXTENSIONS,
   IMAGE_MAX_HEIGHT,
   IMAGE_MAX_WIDTH,
@@ -257,9 +236,6 @@ export {
   SUPPORTED_PROVIDERS,
   SandboxedLocalComputer,
   SpanStatusCode,
-  SpritesComputer,
-  SpritesFs,
-  SpritesSandbox,
   StreamingToolExecutor,
   SwarmManager,
   TOOL_SEARCH_NAME,

package/dist/lsp/index.d.ts

@@ -1,6 +1,7 @@
-import { L as LspServerConfig, a as LspServerState, b as LspDiagnostic, T as Tool } from '../types-RPKUTu1k.js';
-export { D as DiagnosticRegistry, c as LspLocation, d as LspOperation, e as LspServerManager, f as LspSymbol } from '../types-RPKUTu1k.js';
+import { L as LspServerConfig, a as LspServerState, b as LspDiagnostic, T as Tool } from '../types-BA87bHPV.js';
+export { D as DiagnosticRegistry, c as LspLocation, d as LspOperation, e as LspServerManager, f as LspSymbol } from '../types-BA87bHPV.js';
 import '../types-LrU4LRmX.js';
+import '../computer-BPdxSo6X.js';
 import '../types-CD0rUKKT.js';
 
 interface ServerCapabilities {

package/dist/mcp/index.d.ts

@@ -1,14 +1,15 @@
-import { M as McpClientManager } from '../server-CHMxuWKq.js';
-export { a as McpClientManagerOptions, b as McpServerOptions, c as buildMcpToolName, d as createMcpServer, g as getMcpPrefix, n as normalizeNameForMCP, p as parseMcpToolName } from '../server-CHMxuWKq.js';
+import { M as McpClientManager } from '../server-Cu9gv1dk.js';
+export { a as McpClientManagerOptions, b as McpServerOptions, c as buildMcpToolName, d as createMcpServer, g as getMcpPrefix, n as normalizeNameForMCP, p as parseMcpToolName } from '../server-Cu9gv1dk.js';
 import { T as TokenStorage, O as OAuthTokenData, a as OAuthProviderOptions } from '../types-2kTLUCnD.js';
 export { b as McpConfig, c as McpConnection, d as McpHttpServerConfig, e as McpOAuthConfig, M as McpServerConfig, f as McpSseServerConfig, g as McpStdioServerConfig, h as McpToolInfo, i as McpWebSocketServerConfig } from '../types-2kTLUCnD.js';
 import { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
 export { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { OAuthClientInformation, OAuthClientInformationFull, OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import { T as Tool } from '../types-RPKUTu1k.js';
+import { T as Tool } from '../types-BA87bHPV.js';
 import '@modelcontextprotocol/sdk/client/index.js';
 import '../types-LrU4LRmX.js';
+import '../computer-BPdxSo6X.js';
 import '../types-CD0rUKKT.js';
 
 /**

package/dist/mcp/index.js

@@ -11,8 +11,7 @@ import {
 } from "../chunk-BZSFUEWM.js";
 import {
   ToolRegistry
-} from "../chunk-HL6JCRZJ.js";
-import "../chunk-3SK5GCI6.js";
+} from "../chunk-XZN4QZLK.js";
 import "../chunk-5GEX6ZSB.js";
 import {
   buildMcpToolName,
@@ -20,6 +19,7 @@ import {
   normalizeNameForMCP,
   parseMcpToolName
 } from "../chunk-4SQA2UCV.js";
+import "../chunk-3SK5GCI6.js";
 import {
   contentToString
 } from "../chunk-JACGEMTF.js";

package/dist/{provider-factory-KCLIF34X.js → provider-factory-KI7OZUY3.js}

@@ -7,7 +7,7 @@ import {
   SUPPORTED_PROVIDERS,
   detectProvider,
   resolveProvider
-} from "./chunk-5JN4SPI7.js";
+} from "./chunk-WTLK2ZAR.js";
 import "./chunk-DGUM43GV.js";
 export {
   DEFAULT_MODELS,
@@ -17,4 +17,4 @@ export {
   isOllamaRunning,
   ollamaBaseURL
 };
-//# sourceMappingURL=provider-factory-KCLIF34X.js.map
+//# sourceMappingURL=provider-factory-KI7OZUY3.js.map

package/dist/{resolve-4JA2BBDA.js → resolve-GDSHNMG6.js}

@@ -3,7 +3,7 @@ import {
   SUPPORTED_PROVIDERS,
   detectProvider,
   resolveProvider
-} from "./chunk-5JN4SPI7.js";
+} from "./chunk-WTLK2ZAR.js";
 import "./chunk-DGUM43GV.js";
 export {
   DEFAULT_MODELS,
@@ -11,4 +11,4 @@ export {
   detectProvider,
   resolveProvider
 };
-//# sourceMappingURL=resolve-4JA2BBDA.js.map
+//# sourceMappingURL=resolve-GDSHNMG6.js.map

package/dist/sandbox-9qeMTNrD.d.ts

@@ -0,0 +1,126 @@
+import { V as VirtualComputer, E as ExecOptions, C as CommandResult, a as VirtualFs } from './computer-BPdxSo6X.js';
+
+/**
+ * Filesystem and network restriction config passed to `@anthropic-ai/sandbox-runtime`.
+ */
+interface SandboxConfig {
+    filesystem?: {
+        /** Paths the agent may write to (default: `[cwd]`). Write is denied everywhere else. */
+        allowWrite?: string[];
+        /** Paths to explicitly deny writes within allowed regions. */
+        denyWrite?: string[];
+        /** Paths to deny reading. By default everything is readable. */
+        denyRead?: string[];
+        /** Paths to re-allow reading within denyRead regions. Takes precedence over denyRead. */
+        allowRead?: string[];
+    };
+    network?: {
+        /** Domains the agent may reach via HTTP/HTTPS/SOCKS. */
+        allowedDomains?: string[];
+        /** Domains to explicitly block. */
+        deniedDomains?: string[];
+    };
+}
+interface SandboxedLocalComputerOptions {
+    defaultCwd?: string;
+    defaultTimeout?: number;
+    sandbox?: SandboxConfig;
+}
+/**
+ * `VirtualComputer` that wraps every command with OS-level sandboxing via
+ * `@anthropic-ai/sandbox-runtime`. Uses macOS Seatbelt (`sandbox-exec`) or
+ * Linux bubblewrap (`bwrap`) under the hood.
+ */
+declare class SandboxedLocalComputer implements VirtualComputer {
+    private defaultCwd;
+    private defaultTimeout;
+    private sandboxConfig;
+    private initPromise;
+    private initialized;
+    constructor(opts?: SandboxedLocalComputerOptions);
+    private buildRuntimeConfig;
+    private ensureInitialized;
+    executeCommand(command: string, opts?: ExecOptions): Promise<CommandResult>;
+    /**
+     * Tear down the sandbox runtime. Call when the agent is done.
+     */
+    dispose(): Promise<void>;
+}
+
+/**
+ * Bundled sandbox: a `VirtualFs` and `VirtualComputer` paired together.
+ *
+ * Use one of the built-in factories (`LocalSandbox`, `UnsandboxedLocal`)
+ * or import a remote backend from its subpath
+ * (`noumen/docker`, `noumen/e2b`, `noumen/freestyle`, `noumen/ssh`,
+ * `noumen/sprites`). You can also supply any object that satisfies this
+ * shape for custom sandboxes (in-memory, custom cloud backends, etc.).
+ */
+interface Sandbox {
+    fs: VirtualFs;
+    computer: VirtualComputer;
+    /** Optional cleanup — called by Agent.close() to tear down OS-level sandbox state. */
+    dispose?(): Promise<void>;
+    /**
+     * Lazily provision the underlying sandbox resource. Idempotent — repeated
+     * calls return the same single-flight promise.
+     *
+     * When `sandboxId` is provided the sandbox reconnects to an existing
+     * resource instead of creating a new one. This is used during session
+     * resume: the stored sandbox identifier is read from session metadata
+     * and passed here so the agent reattaches to its previous container.
+     *
+     * When omitted a fresh resource is provisioned (for factories that
+     * support auto-creation) or the call is a no-op (for factories that
+     * were given a pre-created resource up front).
+     */
+    init?(sandboxId?: string): Promise<void>;
+    /**
+     * Return the opaque identifier for this sandbox instance so it can be
+     * persisted in session metadata and used to reconnect later via `init()`.
+     * Returns `undefined` before `init()` has resolved or for sandboxes
+     * that don't support reconnection.
+     */
+    sandboxId?(): string | undefined;
+}
+interface UnsandboxedLocalOptions {
+    /** Working directory for both file resolution and command execution. */
+    cwd?: string;
+    /** Default timeout (ms) for shell commands. */
+    defaultTimeout?: number;
+}
+/**
+ * Create a `Sandbox` backed by the host filesystem and shell with **no
+ * OS-level isolation**. The agent can access anything the host process can.
+ *
+ * Use this for development or fully-trusted environments where sandboxing
+ * overhead is unwanted. For production use, prefer `LocalSandbox()` (which
+ * wraps commands with `@anthropic-ai/sandbox-runtime`).
+ */
+declare function UnsandboxedLocal(opts?: UnsandboxedLocalOptions): Sandbox;
+interface LocalSandboxOptions {
+    /** Working directory for both file resolution and command execution. */
+    cwd?: string;
+    /** Default timeout (ms) for shell commands. */
+    defaultTimeout?: number;
+    /**
+     * Sandbox restrictions. Defaults: writes allowed only in `cwd`,
+     * reads allowed everywhere, network unrestricted.
+     */
+    sandbox?: SandboxConfig;
+}
+/**
+ * Create a `Sandbox` with OS-level isolation via `@anthropic-ai/sandbox-runtime`.
+ *
+ * - **macOS**: Seatbelt (`sandbox-exec`) profiles restrict filesystem and network.
+ * - **Linux**: bubblewrap (`bwrap`) + socat for namespace-based isolation.
+ *
+ * Filesystem operations (`VirtualFs`) use the host `node:fs` — the sandbox
+ * boundary is enforced on shell commands (`VirtualComputer`), which is where
+ * the agent executes arbitrary code.
+ *
+ * Requires `@anthropic-ai/sandbox-runtime` as a peer dependency.
+ */
+declare function LocalSandbox(opts?: LocalSandboxOptions): Sandbox;
+
+export { LocalSandbox as L, type Sandbox as S, UnsandboxedLocal as U, type LocalSandboxOptions as a, type SandboxConfig as b, SandboxedLocalComputer as c, type SandboxedLocalComputerOptions as d, type UnsandboxedLocalOptions as e };

package/dist/server/index.d.ts

@@ -1,8 +1,10 @@
 import { ServerResponse, IncomingMessage } from 'node:http';
-import { A as Agent } from '../agent-1nFVUP9E.js';
+import { A as Agent } from '../agent-C3eDRsxs.js';
 import { S as StreamEvent } from '../types-LrU4LRmX.js';
 import { P as PermissionResponse } from '../types-CD0rUKKT.js';
-import '../types-RPKUTu1k.js';
+import '../sandbox-9qeMTNrD.js';
+import '../computer-BPdxSo6X.js';
+import '../types-BA87bHPV.js';
 import '../cache-DsRqxx6v.js';
 import '../types-2kTLUCnD.js';
 import '@modelcontextprotocol/sdk/client/index.js';

package/dist/{server-CHMxuWKq.d.ts → server-Cu9gv1dk.d.ts}

@@ -1,4 +1,4 @@
-import { T as Tool, g as ToolResult, h as ToolContext } from './types-RPKUTu1k.js';
+import { T as Tool, g as ToolResult, h as ToolContext } from './types-BA87bHPV.js';
 import { T as TokenStorage, M as McpServerConfig } from './types-2kTLUCnD.js';
 
 /**

package/dist/sprites.d.ts

@@ -0,0 +1,136 @@
+import { S as Sandbox } from './sandbox-9qeMTNrD.js';
+import { a as VirtualFs, R as ReadOptions, F as FileEntry, b as FileStat, V as VirtualComputer, E as ExecOptions, C as CommandResult } from './computer-BPdxSo6X.js';
+
+interface SpritesSandboxOptions {
+    /** sprites.dev API token. */
+    token: string;
+    /**
+     * Name of an existing sprite container. When provided the sandbox
+     * attaches to this sprite directly — no auto-creation occurs and
+     * `dispose()` will **not** delete it (lifecycle is yours to manage).
+     *
+     * When omitted a new sprite is provisioned on the first `init()` call
+     * (via `POST /v1/sprites`). The auto-created sprite is deleted when
+     * `dispose()` is called, and its name is available via `sandboxId()`
+     * for session persistence.
+     */
+    spriteName?: string;
+    /** Base URL for sprites API (default: https://api.sprites.dev). */
+    baseURL?: string;
+    /** Working directory inside the sprite (default: /home/sprite). */
+    workingDir?: string;
+    /**
+     * Optional prefix for auto-generated sprite names (default: "noumen-").
+     * Only used when `spriteName` is omitted.
+     */
+    namePrefix?: string;
+}
+/**
+ * Create a `Sandbox` backed by a remote sprites.dev container.
+ * Full isolation — the agent has no access to the host machine.
+ *
+ * **Auto-creation:** When `spriteName` is omitted the sandbox is created
+ * lazily on the first `init()` call via the Sprites REST API. The sprite
+ * name is available through `sandboxId()` so callers can persist it in
+ * session metadata for reconnection on resume. Pass the stored name back
+ * through `init(storedId)` to reattach instead of creating a new sprite.
+ *
+ * **Explicit ID:** When `spriteName` is provided the sandbox attaches to
+ * that sprite immediately on `init()`. `dispose()` is a no-op in this
+ * case — the caller owns the sprite's lifecycle.
+ *
+ * @example
+ * ```ts
+ * // Auto-create — sprite provisioned on first init()
+ * const sandbox = SpritesSandbox({ token: process.env.SPRITES_TOKEN! });
+ *
+ * // Explicit — attach to pre-existing sprite, no auto-lifecycle
+ * const sandbox = SpritesSandbox({
+ *   token: process.env.SPRITES_TOKEN!,
+ *   spriteName: "my-sprite",
+ * });
+ * ```
+ */
+declare function SpritesSandbox(opts: SpritesSandboxOptions): Sandbox;
+
+interface SpritesFsOptions {
+    /** sprites.dev API token */
+    token: string;
+    /** Name of the sprite container */
+    spriteName: string;
+    /** Base URL for sprites API (default: https://api.sprites.dev) */
+    baseURL?: string;
+    /** Working directory inside the sprite (default: /home/sprite) */
+    workingDir?: string;
+}
+/**
+ * Sandboxed VirtualFs backed by a remote sprites.dev container. All file
+ * operations are executed over the sprites.dev HTTP API — the agent has no
+ * access to the host filesystem. This is the recommended VirtualFs for
+ * production deployments and untrusted agents. See `LocalFs` for an
+ * unsandboxed local alternative.
+ */
+declare class SpritesFs implements VirtualFs {
+    private token;
+    private spriteName;
+    private baseURL;
+    private workingDir;
+    constructor(opts: SpritesFsOptions);
+    private fsUrl;
+    private resolvePath;
+    private headers;
+    readFile(filePath: string, _opts?: ReadOptions): Promise<string>;
+    readFileBytes(filePath: string, maxBytes?: number): Promise<Buffer>;
+    writeFile(filePath: string, content: string): Promise<void>;
+    /**
+     * @warning Not atomic. Concurrent appends may lose data due to
+     * read-then-write TOCTOU. The Sprites API does not expose an append primitive.
+     */
+    appendFile(filePath: string, content: string): Promise<void>;
+    deleteFile(filePath: string, opts?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    mkdir(dirPath: string, opts?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    readdir(dirPath: string, _opts?: {
+        recursive?: boolean;
+    }): Promise<FileEntry[]>;
+    exists(filePath: string): Promise<boolean>;
+    stat(filePath: string): Promise<FileStat>;
+}
+
+interface SpritesComputerOptions {
+    /** sprites.dev API token */
+    token: string;
+    /** Name of the sprite container */
+    spriteName: string;
+    /** Base URL for sprites API (default: https://api.sprites.dev) */
+    baseURL?: string;
+    /** Working directory inside the sprite (default: /home/sprite) */
+    workingDir?: string;
+}
+/**
+ * Sandboxed VirtualComputer that executes commands inside a remote
+ * sprites.dev container. All shell execution is fully isolated — the agent
+ * has no access to the host machine's processes, filesystem, or network.
+ *
+ * This is the recommended VirtualComputer for production deployments and
+ * untrusted agents. See `LocalComputer` for an unsandboxed local alternative.
+ *
+ * Uses the non-interactive exec REST endpoint (POST command, receive
+ * stdout/stderr/exit_code). The WebSocket exec endpoint can be used for
+ * streaming/TTY use cases, but REST is sufficient for tool calls.
+ */
+declare class SpritesComputer implements VirtualComputer {
+    private token;
+    private spriteName;
+    private baseURL;
+    private workingDir;
+    constructor(opts: SpritesComputerOptions);
+    private headers;
+    executeCommand(command: string, opts?: ExecOptions): Promise<CommandResult>;
+    private shellEscape;
+}
+
+export { SpritesComputer, type SpritesComputerOptions, SpritesFs, type SpritesFsOptions, SpritesSandbox, type SpritesSandboxOptions };