noumen 0.6.0 → 0.8.0

package/dist/sandbox-9qeMTNrD.d.ts

@@ -1,126 +0,0 @@
-import { V as VirtualComputer, E as ExecOptions, C as CommandResult, a as VirtualFs } from './computer-BPdxSo6X.js';
-
-/**
- * Filesystem and network restriction config passed to `@anthropic-ai/sandbox-runtime`.
- */
-interface SandboxConfig {
-    filesystem?: {
-        /** Paths the agent may write to (default: `[cwd]`). Write is denied everywhere else. */
-        allowWrite?: string[];
-        /** Paths to explicitly deny writes within allowed regions. */
-        denyWrite?: string[];
-        /** Paths to deny reading. By default everything is readable. */
-        denyRead?: string[];
-        /** Paths to re-allow reading within denyRead regions. Takes precedence over denyRead. */
-        allowRead?: string[];
-    };
-    network?: {
-        /** Domains the agent may reach via HTTP/HTTPS/SOCKS. */
-        allowedDomains?: string[];
-        /** Domains to explicitly block. */
-        deniedDomains?: string[];
-    };
-}
-interface SandboxedLocalComputerOptions {
-    defaultCwd?: string;
-    defaultTimeout?: number;
-    sandbox?: SandboxConfig;
-}
-/**
- * `VirtualComputer` that wraps every command with OS-level sandboxing via
- * `@anthropic-ai/sandbox-runtime`. Uses macOS Seatbelt (`sandbox-exec`) or
- * Linux bubblewrap (`bwrap`) under the hood.
- */
-declare class SandboxedLocalComputer implements VirtualComputer {
-    private defaultCwd;
-    private defaultTimeout;
-    private sandboxConfig;
-    private initPromise;
-    private initialized;
-    constructor(opts?: SandboxedLocalComputerOptions);
-    private buildRuntimeConfig;
-    private ensureInitialized;
-    executeCommand(command: string, opts?: ExecOptions): Promise<CommandResult>;
-    /**
-     * Tear down the sandbox runtime. Call when the agent is done.
-     */
-    dispose(): Promise<void>;
-}
-
-/**
- * Bundled sandbox: a `VirtualFs` and `VirtualComputer` paired together.
- *
- * Use one of the built-in factories (`LocalSandbox`, `UnsandboxedLocal`)
- * or import a remote backend from its subpath
- * (`noumen/docker`, `noumen/e2b`, `noumen/freestyle`, `noumen/ssh`,
- * `noumen/sprites`). You can also supply any object that satisfies this
- * shape for custom sandboxes (in-memory, custom cloud backends, etc.).
- */
-interface Sandbox {
-    fs: VirtualFs;
-    computer: VirtualComputer;
-    /** Optional cleanup — called by Agent.close() to tear down OS-level sandbox state. */
-    dispose?(): Promise<void>;
-    /**
-     * Lazily provision the underlying sandbox resource. Idempotent — repeated
-     * calls return the same single-flight promise.
-     *
-     * When `sandboxId` is provided the sandbox reconnects to an existing
-     * resource instead of creating a new one. This is used during session
-     * resume: the stored sandbox identifier is read from session metadata
-     * and passed here so the agent reattaches to its previous container.
-     *
-     * When omitted a fresh resource is provisioned (for factories that
-     * support auto-creation) or the call is a no-op (for factories that
-     * were given a pre-created resource up front).
-     */
-    init?(sandboxId?: string): Promise<void>;
-    /**
-     * Return the opaque identifier for this sandbox instance so it can be
-     * persisted in session metadata and used to reconnect later via `init()`.
-     * Returns `undefined` before `init()` has resolved or for sandboxes
-     * that don't support reconnection.
-     */
-    sandboxId?(): string | undefined;
-}
-interface UnsandboxedLocalOptions {
-    /** Working directory for both file resolution and command execution. */
-    cwd?: string;
-    /** Default timeout (ms) for shell commands. */
-    defaultTimeout?: number;
-}
-/**
- * Create a `Sandbox` backed by the host filesystem and shell with **no
- * OS-level isolation**. The agent can access anything the host process can.
- *
- * Use this for development or fully-trusted environments where sandboxing
- * overhead is unwanted. For production use, prefer `LocalSandbox()` (which
- * wraps commands with `@anthropic-ai/sandbox-runtime`).
- */
-declare function UnsandboxedLocal(opts?: UnsandboxedLocalOptions): Sandbox;
-interface LocalSandboxOptions {
-    /** Working directory for both file resolution and command execution. */
-    cwd?: string;
-    /** Default timeout (ms) for shell commands. */
-    defaultTimeout?: number;
-    /**
-     * Sandbox restrictions. Defaults: writes allowed only in `cwd`,
-     * reads allowed everywhere, network unrestricted.
-     */
-    sandbox?: SandboxConfig;
-}
-/**
- * Create a `Sandbox` with OS-level isolation via `@anthropic-ai/sandbox-runtime`.
- *
- * - **macOS**: Seatbelt (`sandbox-exec`) profiles restrict filesystem and network.
- * - **Linux**: bubblewrap (`bwrap`) + socat for namespace-based isolation.
- *
- * Filesystem operations (`VirtualFs`) use the host `node:fs` — the sandbox
- * boundary is enforced on shell commands (`VirtualComputer`), which is where
- * the agent executes arbitrary code.
- *
- * Requires `@anthropic-ai/sandbox-runtime` as a peer dependency.
- */
-declare function LocalSandbox(opts?: LocalSandboxOptions): Sandbox;
-
-export { LocalSandbox as L, type Sandbox as S, UnsandboxedLocal as U, type LocalSandboxOptions as a, type SandboxConfig as b, SandboxedLocalComputer as c, type SandboxedLocalComputerOptions as d, type UnsandboxedLocalOptions as e };

package/dist/types-CD0rUKKT.d.ts

@@ -1,109 +0,0 @@
-type PermissionMode = "default" | "plan" | "acceptEdits" | "auto" | "bypassPermissions" | "dontAsk";
-type PermissionBehavior = "allow" | "deny" | "ask";
-type PermissionRuleSource = "user" | "project" | "session" | "policy";
-/** Precedence order: policy > project > user > session. */
-declare const RULE_SOURCE_PRECEDENCE: PermissionRuleSource[];
-interface PermissionRule {
-    toolName: string;
-    ruleContent?: string;
-    behavior: PermissionBehavior;
-    /** Where this rule came from. Higher-precedence sources override lower ones. */
-    source?: PermissionRuleSource;
-}
-type PermissionUpdate = {
-    type: "addRules";
-    rules: PermissionRule[];
-} | {
-    type: "removeRules";
-    toolName: string;
-    behavior?: PermissionBehavior;
-} | {
-    type: "setMode";
-    mode: PermissionMode;
-} | {
-    type: "addDirectories";
-    directories: string[];
-} | {
-    type: "removeDirectories";
-    directories: string[];
-};
-interface PermissionAllowResult<Input extends Record<string, unknown> = Record<string, unknown>> {
-    behavior: "allow";
-    updatedInput?: Input;
-    reason?: string;
-}
-interface PermissionDenyResult {
-    behavior: "deny";
-    message: string;
-    reason?: string;
-}
-interface PermissionAskResult {
-    behavior: "ask";
-    message: string;
-    reason?: string;
-    suggestions?: PermissionRule[];
-}
-interface PermissionPassthroughResult {
-    behavior: "passthrough";
-    message: string;
-    reason?: string;
-    suggestions?: PermissionRule[];
-}
-/**
- * What `Tool.checkPermissions` returns. Includes `passthrough` for tools that
- * have no opinion and want the global pipeline to decide.
- */
-type PermissionResult<Input extends Record<string, unknown> = Record<string, unknown>> = PermissionAllowResult<Input> | PermissionDenyResult | PermissionAskResult | PermissionPassthroughResult;
-/**
- * Final decision after the pipeline resolves. No `passthrough` — always
- * one of allow / deny / ask.
- */
-type PermissionDecision<Input extends Record<string, unknown> = Record<string, unknown>> = PermissionAllowResult<Input> | PermissionDenyResult | PermissionAskResult;
-interface PermissionRequest {
-    toolName: string;
-    input: Record<string, unknown>;
-    message: string;
-    suggestions?: PermissionRule[];
-    isReadOnly: boolean;
-    isDestructive: boolean;
-    /** Abort signal from the session — handlers should stop promptly when fired. */
-    signal?: AbortSignal;
-}
-interface PermissionResponse {
-    allow: boolean;
-    updatedInput?: Record<string, unknown>;
-    feedback?: string;
-    addRules?: PermissionRule[];
-}
-type PermissionHandler = (request: PermissionRequest) => Promise<PermissionResponse>;
-interface AutoModeConfig {
-    /** Custom system prompt for the classifier. When omitted, uses a default. */
-    classifierPrompt?: string;
-    /** Model to use for classification. When omitted, uses the thread's model. */
-    classifierModel?: string;
-}
-interface DenialTrackingConfig {
-    /** Max consecutive denials before fallback (default: 3). */
-    maxConsecutive?: number;
-    /** Max total denials before fallback (default: 20). */
-    maxTotal?: number;
-}
-interface PermissionConfig {
-    mode?: PermissionMode;
-    rules?: PermissionRule[];
-    handler?: PermissionHandler;
-    workingDirectories?: string[];
-    /** Called when a permission update is applied (for host-side persistence). */
-    onPermissionUpdate?: (update: PermissionUpdate) => void;
-    /** Configuration for auto mode classifier. */
-    autoMode?: AutoModeConfig;
-    /** Configuration for denial tracking limits. */
-    denialTracking?: DenialTrackingConfig;
-}
-interface PermissionContext {
-    mode: PermissionMode;
-    rules: PermissionRule[];
-    workingDirectories: string[];
-}
-
-export { type AutoModeConfig as A, type DenialTrackingConfig as D, type PermissionResponse as P, RULE_SOURCE_PRECEDENCE as R, type PermissionMode as a, type PermissionResult as b, type PermissionHandler as c, type PermissionConfig as d, type PermissionContext as e, type PermissionBehavior as f, type PermissionRule as g, type PermissionDecision as h, type PermissionUpdate as i, type PermissionAllowResult as j, type PermissionAskResult as k, type PermissionDenyResult as l, type PermissionPassthroughResult as m, type PermissionRequest as n, type PermissionRuleSource as o };

package/dist/uuid-RVN2T26F.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/zod-7YXKWYMC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}